Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
This doesn't seem to work in C++ files, so how does one define these?
Also, what happens If these aren't defined, and then a function defines PAGED_CODE()?
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Writing WDF Drivers | 7 Dec 2020 | LIVE ONLINE |
Internals & Software Drivers | 25 Jan 2021 | LIVE ONLINE |
Developing Minifilters | 8 March 2021 | LIVE ONLINE |
Comments
It certainly does work in C++ files, but you have to declare the functions as extern "C".
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
BTW, what the PAGED_CODE macro does is assert that the IRQL is at PASSIVE_LEVEL. It neither knows nor cares in which section the code actually lives.
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
Yes, but without the #pragma, it makes no sense to add it as SDV wont be able to validate?
If I have c++ classes, what is the best way to mark some functions as pagable/non-pagable? extern "C" won't work for member methods.
Leave them all non-pageable. It's not worth the trouble.
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
So the loader will by default make every section non-paged for a driver?
The linker directives will make the INIT section discardable, and the PAGE section pageable. If there's no alloc_text, the function goes in the CODE section, which is not pageable.
I'll get in trouble for saying it, but unless your driver is in the megabytes, it isn't worth the trouble.
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.
You won’t get in any trouble from me. I absolutely, and emphatically, agree.
With the possible exception of PagedPool, and except for some very special cases, paging any kernel mode code (and much data) in the 21st Century is a mistake. For driver devs, it’s just asking for extra complications with zero return for your effort.
There is one, small, special-case exception to all the above: That is the use of MmPageEntireDriver, MmLockPageableCodeSecrion, and friends on systems with limited memory, for device instances that are commonly enumerated but never used (because In Windows we load drivers when devices are discovered, not when the device is first opened, because of how we create Device Objects, etc).
Peter
Peter Viscarola
OSR
@OSRDrivers
Thanks the both of you. Followup question:
The NPP size has increased over the years, if one has to write a driver backward compatible to win7, where the NPP size is much smaller, then does it matter?
Also, does the NPP pool from where ExAllocatePoolWithTag get memory the same as where the loader gets memory to load the drivers? I guess I am trying to ask if loading drivers as non-pagable will deplete the pool where data can be allocated from.
No. Drivers are not loaded into the non-paged pool. Non-paged pool is not synonymous with non-paged memory. Nonpaged pool is, rather, a specific subset of the non-paged memory on the system used for “scratch” storage.
Peter
Peter Viscarola
OSR
@OSRDrivers