The ExAllocatePoolWithQuotaTag routine allocates pool memory, charging the quota against the current thread.
PVOID
ExAllocatePoolWithQuotaTag(
IN POOL_TYPE PoolType,
IN SIZE_T NumberOfBytes,
IN ULONG Tag
);
ExAllocatePoolWithQuotaTag returns a pointer to the allocated pool.
If the request cannot be satisfied, ExAllocatePoolWithQuotaTag raises an exception.
Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.
This routine is called by highest-level drivers that allocate memory to satisfy a request in the context of the thread that originally made the I/O request. Lower-level drivers call ExAllocatePoolWithTag instead.
If NumberOfBytes >= PAGE_SIZE, a page-aligned buffer is allocated.
Memory requests less than PAGE_SIZE are allocated within a page and do not cross page boundaries. Memory requests less than PAGE_SIZE are not necessarily page-aligned but are aligned on an 8-byte boundary.
The system associates the pool tag with the allocated memory. Programming tools, such as WinDbg, can display the pool tag associated with each allocated buffer. The value of Tag is normally displayed in reversed order. For example, if a caller passes ‘Fred’ as a Tag, it would appear as ‘derF’ if the pool is dumped or when tracking pool usage in the debugger.
The allocated buffer can be freed with either ExFreePool or ExFreePoolWithTag.
The system automatically sets certain standard event objects when the amount of pool (paged or nonpaged) is high or low. Drivers can wait for these events to tune their pool usage. For more information, see Standard Event Objects.
Callers of ExAllocatePoolWithQuotaTag must be running at IRQL < DISPATCH_LEVEL.