Should I always mark my functions as PAGED in mini-filter?

Question like in the title.

#pragma alloc_text(PAGE, FunctionName)

Should I always do this in mini-filter?

only if the function would be guaranteed to run PASSIVE_LEVEL

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/writing-preoperation-callback-routines

“Like a dispatch routine, a preoperation callback routine can be called at IRQL = PASSIVE_LEVEL or at IRQL = APC_LEVEL. Typically it is called at IRQL = PASSIVE_LEVEL, in the context of the thread that originated the I/O request. For fast I/O and file system filter (FsFilter) operations, the preoperation callback routine is always called at IRQL = PASSIVE_LEVEL. However, for an IRP-based operation, a minifilter driver’s preoperation callback routine can be called in the context of a system worker thread if a higher filter or minifilter driver pends the operation for processing by the worker thread.”

https://social.msdn.microsoft.com/Forums/en-US/acbdf5a7-f2db-45ff-a9ba-4a56a594cb50/minifitler-irql?forum=wdk

“In general assume the IRQL can be DISPATCH_LEVEL, except for PreCreate which is guaranteed to be PASSIVE_LEVEL.”

Thank you for your answer David.

Should I also mark functions PAGED when I call them inside functions with PASSIVE_LEVEL? For example I have function ReplaceCharacters that I use in preoperation. Should it be marked PAGED too?

James Danks wrote:

Should I always mark my functions as PAGED in mini-filter?

A function can be safely placed in the paged section only if
ALL the following conditions are true:

  1. The function is never called at DISPATCH_LEVEL or higher.

  2. The function is not raises IRQL to DISPATCH_LEVEL or higher,
    directly or indirectly.

  3. The function is not involved in the page fault handling
    (i.e. is not called on paging I/O path).

  4. The function is not calls other functions that may
    violate the rules above.

Also, some type of drivers (for example, storage drivers)
must be in resident memory all of the time.


In my opinion, the ‘paged code’ was designed for very limited and
very specific cases. Today, it has no benefits except a little
(microscopic!) economy of system resources when code is paged out.

On other side, the paging of code may lead to phantom bugs that
are really hard to diagnose. And most of time you will try to
solve the big problem: “to page or not to page” :slight_smile:
Instead of doing your business…

So, my answer is: you should not.

Actually even storage drivers may make some functions pageable, but these
are things like support for WMI, and other non-operational (i.e. not
directly involved with storage I/O) functions.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@mail.ru
Sent: Friday, December 29, 2017 4:24 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Should I always mark my functions as PAGED in
mini-filter?

James Danks wrote:
>
> Should I always mark my functions as PAGED in mini-filter?

A function can be safely placed in the paged section only if ALL the
following conditions are true:

1. The function is never called at DISPATCH_LEVEL or higher.

2. The function is not raises IRQL to DISPATCH_LEVEL or higher,
directly or indirectly.

3. The function is not involved in the page fault handling
(i.e. is not called on paging I/O path).

4. The function is not calls other functions that may
violate the rules above.

Also, some type of drivers (for example, storage drivers) must be in
resident memory all of the time.

----

In my opinion, the ‘paged code’ was designed for very limited and very
specific cases. Today, it has no benefits except a little
(microscopic!) economy of system resources when code is paged out.

On other side, the paging of code may lead to phantom bugs that are really
hard to diagnose. And most of time you will try to solve the big problem:
“to page or not to page” :slight_smile: Instead of doing your business…

So, my answer is: you should not.


NTFSD is sponsored by OSR

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:>

Don, is your statement “In general assume the IRQL can be DISPATCH_LEVEL, except for PreCreate which is guaranteed to be PASSIVE_LEVEL” in regards to the PreOperation for IRP_MJ_CREATE ? I assume so, but you know how assumptions go.

Thanks.

Actually since the question was on storage drivers I was thinking below
mini-filter level. I have written a number of disk filters that have some
paged routines. I have also written storport drivers with some paged
routines.

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@terabyteunlimited.com
Sent: Saturday, December 30, 2017 8:34 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Should I always mark my functions as PAGED in
mini-filter?

Don, is your statement “In general assume the IRQL can be DISPATCH_LEVEL,
except for PreCreate which is guaranteed to be PASSIVE_LEVEL” in regards to
the PreOperation for IRP_MJ_CREATE ? I assume so, but you know how
assumptions go.

Thanks.


NTFSD is sponsored by OSR

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at
http:</http:></http:>

Well, is there a “cheat sheet” for all the various IRP’s and which ones are guaranteed to be PASSIVE_LEVEL? IRP_MJ_CREATE PreOperation, IRP_MJ_SET_INFORMATION PreOperation, PostOperations ? It’s easy to just say, forget it, everything is non-paged, but there must be some sort of standard? (I mean if some minifilter along they way elevates the irql outside of the “standard” it could cause problems down the line, but if it was well documented on the “standard” then they wouldn’t elevate the irql). So I guess having to deal with that, it should just all be non-paged ?

David F. wrote:

It’s easy to just say, forget it, everything is non-paged, but there must
be some sort of standard?

Yes:

Dispatch Routine IRQL and Thread Context
https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/dispatch-routine-irql-and-thread-context

Thank you all for your answers and happy new year 2018 :slight_smile:

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/dispatch-routine-irql-and-thread-context

Great!!

Now if MS would put back their little yellow printer icon on their website… The web browsers nowadays don’t do a very good job.