Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Monthly Seminars at OSR Headquarters

East Coast USA
Windows Internals and SW Drivers, Dulles (Sterling) VA, 9 April 2018

Writing WDF Drivers I: Core Concepts, Manchester, NH, 7 May 2018

Kernel Debugging & Crash Analysis for Windows, Manchester, NH, 21 May 2018


Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 11  
29 Dec 17 00:25
James Danks
xxxxxx@gmx.com
Join Date: 26 Dec 2017
Posts To This List: 6
Should I always mark my functions as PAGED in mini-filter?

Question like in the title. #pragma alloc_text(PAGE, FunctionName) Should I always do this in mini-filter?
  Message 2 of 11  
29 Dec 17 02:42
David F.
xxxxxx@terabyteunlimited.com
Join Date: 12 Jan 2012
Posts To This List: 26
Should I always mark my functions as PAGED in mini-filter?

only if the function would be guaranteed to run PASSIVE_LEVEL https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/writing-preoperatio n-callback-routines "Like a dispatch routine, a preoperation callback routine can be called at IRQL = PASSIVE_LEVEL or at IRQL = APC_LEVEL. Typically it is called at IRQL = PASSIVE_LEVEL, in the context of the thread that originated the I/O request. For fast I/O and file system filter (FsFilter) operations, the preoperation callback routine is always called at IRQL = PASSIVE_LEVEL. However, for an IRP-based operation, a minifilter driver's preoperation callback routine can be called in the context of a system worker thread if a higher filter or minifilter driver pends the operation for processing by the worker thread." https://social.msdn.microsoft.com/Forums/en-US/acbdf5a7-f2db-45ff-a9ba-4a56a594cb 50/minifitler-irql?forum=wdk "In general assume the IRQL can be DISPATCH_LEVEL, except for PreCreate which is guaranteed to be PASSIVE_LEVEL."
  Message 3 of 11  
29 Dec 17 02:59
James Danks
xxxxxx@gmx.com
Join Date: 26 Dec 2017
Posts To This List: 6
Should I always mark my functions as PAGED in mini-filter?

Thank you for your answer David. Should I also mark functions PAGED when I call them inside functions with PASSIVE_LEVEL? For example I have function ReplaceCharacters that I use in preoperation. Should it be marked PAGED too?
  Message 4 of 11  
29 Dec 17 16:24
Aleh Kazakevich
xxxxxx@mail.ru
Join Date: 27 Jul 2015
Posts To This List: 15
Should I always mark my functions as PAGED in mini-filter?

James Danks wrote: > > Should I always mark my functions as PAGED in mini-filter? A function can be safely placed in the paged section only if ALL the following conditions are true: 1. The function is never called at DISPATCH_LEVEL or higher. 2. The function is not raises IRQL to DISPATCH_LEVEL or higher, directly or indirectly. 3. The function is not involved in the page fault handling (i.e. is not called on paging I/O path). 4. The function is not calls other functions that may violate the rules above. Also, some type of drivers (for example, storage drivers) must be in resident memory all of the time. ---- In my opinion, the 'paged code' was designed for very limited and very specific cases. Today, it has no benefits except a little (microscopic!) economy of system resources when code is paged out. On other side, the paging of code may lead to phantom bugs that are really hard to diagnose. And most of time you will try to solve the big problem: "to page or not to page" :) Instead of doing your business... So, my answer is: you should not.
  Message 5 of 11  
29 Dec 17 16:35
Don Burn
xxxxxx@windrvr.com
Join Date: 23 Feb 2011
Posts To This List: 174
Should I always mark my functions as PAGED in mini-filter?

Actually even storage drivers may make some functions pageable, but these are things like support for WMI, and other non-operational (i.e. not directly involved with storage I/O) functions. Don Burn Windows Driver Consulting Website: http://www.windrvr.com -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@mail.ru Sent: Friday, December 29, 2017 4:24 PM To: Windows File Systems Devs Interest List <xxxxx@lists.osr.com> Subject: RE:[ntfsd] Should I always mark my functions as PAGED in mini-filter? James Danks wrote: > > Should I always mark my functions as PAGED in mini-filter? A function can be safely placed in the paged section only if ALL the following conditions are true: 1. The function is never called at DISPATCH_LEVEL or higher. 2. The function is not raises IRQL to DISPATCH_LEVEL or higher, directly or indirectly. 3. The function is not involved in the page fault handling (i.e. is not called on paging I/O path). 4. The function is not calls other functions that may violate the rules above. Also, some type of drivers (for example, storage drivers) must be in resident memory all of the time. ---- In my opinion, the 'paged code' was designed for very limited and very specific cases. Today, it has no benefits except a little (microscopic!) economy of system resources when code is paged out. On other side, the paging of code may lead to phantom bugs that are really hard to diagnose. And most of time you will try to solve the big problem: "to page or not to page" :) Instead of doing your business... So, my answer is: you should not. --- NTFSD is sponsored by OSR MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer>
  Message 6 of 11  
30 Dec 17 20:34
David F.
xxxxxx@terabyteunlimited.com
Join Date: 12 Jan 2012
Posts To This List: 26
Should I always mark my functions as PAGED in mini-filter?

Don, is your statement "In general assume the IRQL can be DISPATCH_LEVEL, except for PreCreate which is guaranteed to be PASSIVE_LEVEL" in regards to the PreOperation for IRP_MJ_CREATE ? I assume so, but you know how assumptions go. Thanks.
  Message 7 of 11  
30 Dec 17 20:39
Don Burn
xxxxxx@windrvr.com
Join Date: 23 Feb 2011
Posts To This List: 174
Should I always mark my functions as PAGED in mini-filter?

Actually since the question was on storage drivers I was thinking below mini-filter level. I have written a number of disk filters that have some paged routines. I have also written storport drivers with some paged routines. Don Burn Windows Driver Consulting Website: http://www.windrvr.com -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@terabyteunlimited.com Sent: Saturday, December 30, 2017 8:34 PM To: Windows File Systems Devs Interest List <xxxxx@lists.osr.com> Subject: RE:[ntfsd] Should I always mark my functions as PAGED in mini-filter? Don, is your statement "In general assume the IRQL can be DISPATCH_LEVEL, except for PreCreate which is guaranteed to be PASSIVE_LEVEL" in regards to the PreOperation for IRP_MJ_CREATE ? I assume so, but you know how assumptions go. Thanks. --- NTFSD is sponsored by OSR MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer>
  Message 8 of 11  
30 Dec 17 21:41
David F.
xxxxxx@terabyteunlimited.com
Join Date: 12 Jan 2012
Posts To This List: 26
Should I always mark my functions as PAGED in mini-filter?

Well, is there a "cheat sheet" for all the various IRP's and which ones are guaranteed to be PASSIVE_LEVEL? IRP_MJ_CREATE PreOperation, IRP_MJ_SET_INFORMATION PreOperation, PostOperations ? It's easy to just say, forget it, everything is non-paged, but there must be some sort of standard? (I mean if some minifilter along they way elevates the irql outside of the "standard" it could cause problems down the line, but if it was well documented on the "standard" then they wouldn't elevate the irql). So I guess having to deal with that, it should just all be non-paged ?
  Message 9 of 11  
31 Dec 17 11:18
Aleh Kazakevich
xxxxxx@mail.ru
Join Date: 27 Jul 2015
Posts To This List: 15
Should I always mark my functions as PAGED in mini-filter?

David F. wrote: > > It's easy to just say, forget it, everything is non-paged, but there must > be some sort of standard? Yes: Dispatch Routine IRQL and Thread Context https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/dispatch-routine-ir ql-and-thread-context
  Message 10 of 11  
01 Jan 18 00:53
James Danks
xxxxxx@gmx.com
Join Date: 26 Dec 2017
Posts To This List: 6
Should I always mark my functions as PAGED in mini-filter?

Thank you all for your answers and happy new year 2018 :)
  Message 11 of 11  
01 Jan 18 21:41
David F.
xxxxxx@terabyteunlimited.com
Join Date: 12 Jan 2012
Posts To This List: 26
Should I always mark my functions as PAGED in mini-filter?

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/dispatch-routine-ir ql-and-thread-context Great!! Now if MS would put back their little yellow printer icon on their website... The web browsers nowadays don't do a very good job.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 13:08.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license