Memory Allocation Limit in Mini-Filter Drivers

NTFSD
1

Hi All,

I am writing a sample mini-filter driver.
Does any one know about, the maximum limit of memory allocation that can be done in mini-filter drivers?

Any inputs are appreciated.

Thanks,
Mahesh

2

It is really weird question. I hope you don’t get concrete number in any answer. It would lead you to bad design. Doesn’t have each computer different amount of physical memory? Definitely you should minimize amount of nonpaged pool allocations. But the same is valid for paged pool allocations. Kernel memory space is backed up by paging file. Do you think that paging-out and paging-in during passing of each single IRP thru your mini-filter would make your customer happy?

-bg

3

xxxxx@yahoo.com wrote:

It’s the same as other drivers for the most part (-graphics). The same
things apply.

Whether you are talking about Pool or Stack allocations makes a
difference, along with the type of driver. However,
you did specify mini-filters…

If your talking about memory allocated from the stack, you still have
the same limits for 32 or 64 bit. 12k or 24k stacks.
Thus you are quite limited here and this generally isn’t a good idea for
obvious reasons. (if I understand correctly, video
drivers stack size is larger, but this doesn’t matter here).

Physical memory obviously would affect non-paged pool allocations.
Whether the system is 32 or 64 bit
could affect the size of your paged pool (VMM has the 4 gig limit on
32bit).

There are many variables here. In all circumstances that I can think of,
anytime you max out resources in a
driver it’s always a bad design because it will eventually kill the
system (even if you get close).

What is it your trying to do?

Matt

Hi All,

I am writing a sample mini-filter driver.
Does any one know about, the maximum limit of memory allocation that can be done in mini-filter drivers?

Any inputs are appreciated.

Thanks,
Mahesh

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Hi,

Many Thanks for your inputs.

In my mini-filter driver, i have allocated almost 110 MB of NonPagedPool type memory using ExAllocatePoolWithTag(), using PoolTag Utility i saw the memory amout.
My Filter is loaded at Boot Time and in DriverEntry() routine i have successfully allocated 110 MB of NonPagedPool memory.

Does this much memory allocation at Boot Time, will have any issues?

Thanks
Mahesh

5

At 10:25 27/03/2008, xxxxx@yahoo.com wrote:

Hi,

Many Thanks for your inputs.

In my mini-filter driver, i have allocated almost 110 MB of
NonPagedPool type memory using ExAllocatePoolWithTag(), using
PoolTag Utility i saw the memory amout.
My Filter is loaded at Boot Time and in DriverEntry() routine i have
successfully allocated 110 MB of NonPagedPool memory.

Does this much memory allocation at Boot Time, will have any issues?

Yes, you’re likely to have issues. Such as other drivers who load
later won’t be able to allocate enough memory to even
initialise. Other drivers may initialise but then encounter
allocation failures during run time - and I would bet more than a few
of these haven’t been run with Verifier in resource shortage mode, so
they will crash the system. Now that’s a real bad double fault -
their driver not protecting itself properly, but caused by your
driver grabbing all the memory. For example, IIRC on XP the
pre-allocated non-paged pool is only 128MB. So your little escapade
will only leave 18MB for the O/S and every other driver in the system.

Non-paged pool is a relatively or very scarce resource (Vista and 2K8
are rather more adaptive). Drivers should “play fair” and never use
more than they need. Grabbing that much non-paged pool is probably
an indication of a bad design, or poor understanding of how your
device really works.

There are exceptions, but rarely does a driver actually need that
amount of non-paged pool all at once. If you think you need it as
buffers, you can look at alternate schemes such as allocating from
paged pool and only locking it when you actually need it.

Release a driver such as yours to customers and you will be plagued
with issues of other drivers and applications crashing or not working.

So the next part of the list dialog is - what is it you’re really
trying to achieve ?

Mark.

6

xxxxx@yahoo.com wrote:

Marks’ reply pretty much answered this question, but I have to ask, what
in the world could a mini-filter
possibly use 110 MB of non paged memory for???

Well, I have one idea, but it becomes incredibly broken whenever you
download any modern Dev kit
that are routinely over a GB nowadays.

Perhaps a general description of the drivers task could help in
providing tips that would result in a better and more robust
design.

Matt

Hi,

Many Thanks for your inputs.

In my mini-filter driver, i have allocated almost 110 MB of NonPagedPool type memory using ExAllocatePoolWithTag(), using PoolTag Utility i saw the memory amout.
My Filter is loaded at Boot Time and in DriverEntry() routine i have successfully allocated 110 MB of NonPagedPool memory.

Does this much memory allocation at Boot Time, will have any issues?

Thanks
Mahesh

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

>but I have to ask, what in the world could a mini-filter possibly use

110 MB of non paged memory for???
Virus signatures?

The amount of allocated memory reminds me very favorite AV product in Japanese, which also takes like 100MB of memory in kernel, but IIRC it was paged pool. I have seen this in crash dumps.

-bg

Here are official numbers
http://msdn2.microsoft.com/en-us/library/aa366778(VS.85).aspx

8

xxxxx@xythos.com wrote:

> but I have to ask, what in the world could a mini-filter possibly use
> 110 MB of non paged memory for???
>
Virus signatures?

Well that would be a pretty shitty design! Who stole my idea?

The amount of allocated memory reminds me very favorite AV product in Japanese, which also takes like 100MB of memory in kernel, but IIRC it was paged pool. I have seen this in crash dumps.

-bg

Here are official numbers
http://msdn2.microsoft.com/en-us/library/aa366778(VS.85).aspx

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

9

>My Filter is loaded at Boot Time and in DriverEntry() routine i have successfully allocated 110 MB of NonPagedPool memory.

Does this much memory allocation at Boot Time, will have any issues?

On 32 bit systems, the size of Non Paged Pool & Paged Pool is relatively smaller than that on 64 bit.
Allocating 110 MB of memory from NonPagedPool can lead to failure of other kernel mode components when they request memory allocation from NonPagedPool.
Avoid allocating & holding this much memory for a long time.

Regards,
Ayush Gupta

10

The limitations are defined by the following

  • Virtual Address Space( and therefore pools ) fragmentation limits the
    maximum size of a single allocation from both paged and non-paged pools- you
    can allocate more using small chunks instead of a one huge block
  • Physical( Real ) Memory defines the Non-Paged Pool size and therefore
    limits the size of all allocations from the NP Pool.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> I am writing a sample mini-filter driver.
> Does any one know about, the maximum limit of memory allocation that can
> be done in mini-filter drivers?
>
> Any inputs are appreciated.
>
> Thanks,
> Mahesh
>
>