Basic Non Paged Pool Question

NTDEV
1

Hi all,

I have been examining some crash dumps in windbg. In doing so, I have run
into something that I can’t find an answer to anywhere. When I look at a
given process using the !process command, I get something like this:

…
QuotaPoolUsage[PagedPool] 5932
QuotaPoolUsage[NonPagedPool] 1252
…

I understand most of what is dumped here, but I am confused about these two
lines. Can anyone tell me

A: What units these are measured in (bytes, kbytes, pages)?
B. How does a user process obtain NonPagedPool in the first place?

Thanks,

Don

2

Don wrote:

…
QuotaPoolUsage[PagedPool] 5932
QuotaPoolUsage[NonPagedPool] 1252
…

I understand most of what is dumped here, but I am confused about these two
lines. Can anyone tell me

A: What units these are measured in (bytes, kbytes, pages)?
B. How does a user process obtain NonPagedPool in the first place?

Bytes.

I hate to state the obvious, but any pool that’s allocated by the system
for the process using ExAllocatePoolWithQuota specifying NonPagedPool
will be counted in the numbers above.

Thus, many things that are allocated strictly on behalf of the process
by the system.

HTH,

Peter
OSR