How does one define #pragma alloc_text(X,Y)

Albert

This doesn't seem to work in C++ files, so how does one define these?
Also, what happens If these aren't defined, and then a function defines PAGED_CODE()?

Tim_Roberts

It certainly does work in C++ files, but you have to declare the functions as extern "C".

Tim_Roberts

BTW, what the PAGED_CODE macro does is assert that the IRQL is at PASSIVE_LEVEL. It neither knows nor cares in which section the code actually lives.

Albert

@Tim_Roberts said:
BTW, what the PAGED_CODE macro does is assert that the IRQL is at PASSIVE_LEVEL. It neither knows nor cares in which section the code actually lives.

Yes, but without the #pragma, it makes no sense to add it as SDV wont be able to validate?

Albert

@Tim_Roberts said:
BTW, what the PAGED_CODE macro does is assert that the IRQL is at PASSIVE_LEVEL. It neither knows nor cares in which section the code actually lives.

If I have c++ classes, what is the best way to mark some functions as pagable/non-pagable? extern "C" won't work for member methods.

Tim_Roberts

Leave them all non-pageable. It's not worth the trouble.

Doron_Holan

You can use declspec code_seg to put c++ functions and classes into a PAGEable section. See https://docs.microsoft.com/en-us/cpp/cpp/code-seg-declspec?view=vs-2019

Albert

@Tim_Roberts said:
Leave them all non-pageable. It's not worth the trouble.

So the loader will by default make every section non-paged for a driver?

Tim_Roberts

So the loader will by default make every section non-paged for a driver?

The linker directives will make the INIT section discardable, and the PAGE section pageable. If there's no alloc_text, the function goes in the CODE section, which is not pageable.

I'll get in trouble for saying it, but unless your driver is in the megabytes, it isn't worth the trouble.

Peter_Viscarola_(OSR)

I'll get in trouble for saying it, but unless your driver is in the megabytes, it isn't worth the trouble.

You won’t get in any trouble from me. I absolutely, and emphatically, agree.

With the possible exception of PagedPool, and except for some very special cases, paging any kernel mode code (and much data) in the 21st Century is a mistake. For driver devs, it’s just asking for extra complications with zero return for your effort.

There is one, small, special-case exception to all the above: That is the use of MmPageEntireDriver, MmLockPageableCodeSecrion, and friends on systems with limited memory, for device instances that are commonly enumerated but never used (because In Windows we load drivers when devices are discovered, not when the device is first opened, because of how we create Device Objects, etc).

Peter

Albert

@Peter_Viscarola_(OSR) said:

I'll get in trouble for saying it, but unless your driver is in the megabytes, it isn't worth the trouble.

You won’t get in any trouble from me. I absolutely, and emphatically, agree.

With the possible exception of PagedPool, and except for some very special cases, paging any kernel mode code (and much data) in the 21st Century is a mistake. For driver devs, it’s just asking for extra complications with zero return for your effort.

There is one, small, special-case exception to all the above: That is the use of MmPageEntireDriver, MmLockPageableCodeSecrion, and friends on systems with limited memory, for device instances that are commonly enumerated but never used (because In Windows we load drivers when devices are discovered, not when the device is first opened, because of how we create Device Objects, etc).

Peter

@Tim_Roberts said:

So the loader will by default make every section non-paged for a driver?

The linker directives will make the INIT section discardable, and the PAGE section pageable. If there's no alloc_text, the function goes in the CODE section, which is not pageable.

I'll get in trouble for saying it, but unless your driver is in the megabytes, it isn't worth the trouble.

Thanks the both of you. Followup question:
The NPP size has increased over the years, if one has to write a driver backward compatible to win7, where the NPP size is much smaller, then does it matter?
Also, does the NPP pool from where ExAllocatePoolWithTag get memory the same as where the loader gets memory to load the drivers? I guess I am trying to ask if loading drivers as non-pagable will deplete the pool where data can be allocated from.

Peter_Viscarola_(OSR)

No. Drivers are not loaded into the non-paged pool. Non-paged pool is not synonymous with non-paged memory. Nonpaged pool is, rather, a specific subset of the non-paged memory on the system used for “scratch” storage.

Peter