Kernel malloc/realloc?

How can you alocate then realocate a memory buffer in kernel mode (W2k+) ?

Maxim
Tue Feb 03 19:52:57 CST 2004

I never heard about realloc() in kernel, but ExAllocatePoolWithTag is used
instead of malloc().

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


"Bogdan Bejan" <na@na.na> wrote in message
news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> How can you alocate then realocate a memory buffer in kernel mode (W2k+) ?
>
>

David
Tue Feb 03 20:06:42 CST 2004

Should you be writing drivers? Look at the source code for realloc that
comes with Visual Studio and adapt it to kernel mode.

"Bogdan Bejan" <na@na.na> wrote in message
news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> How can you alocate then realocate a memory buffer in kernel mode
(W2k+) ?
>
>

Doron
Tue Feb 03 20:32:27 CST 2004

no such API exists. you must be able to update the pointer value atomically
if you need to have a bigger allocation

d

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please reply to newsgroups only.

"Bogdan Bejan" <na@na.na> wrote in message
news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> How can you alocate then realocate a memory buffer in kernel mode (W2k+) ?
>
>

Bogdan
Wed Feb 04 16:53:00 CST 2004


"David J. Craig" <SeniorDriversWriter@shogunyoshimuni.com.net> wrote in
message news:OJy$JOs6DHA.3648@TK2MSFTNGP11.phx.gbl...
> Should you be writing drivers? Look at the source code for realloc that
Let me guess, realloc is written using system calls like GlobalRealloc, to
which i don't have the souce code, do I?
Why I should not write drivers? When i was learning about virtual vs.
hardware memory the top of the lince CPU was 386...soo..
Besides, I know how realloc works on x86 CPUs, what i don't know is the
windows kernel API to get the same thing.

> comes with Visual Studio and adapt it to kernel mode.
>
> "Bogdan Bejan" <na@na.na> wrote in message
> news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > How can you alocate then realocate a memory buffer in kernel mode
> (W2k+) ?
> >
> >
>
>

Bogdan
Wed Feb 04 16:56:31 CST 2004

I wasn't sure is shuch API exists in kernel, thanx for clearing it.

"Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> no such API exists. you must be able to update the pointer value
atomically
> if you need to have a bigger allocation

Don't you have to update the pointer with realloc to? Isn't realloc based on
GlobalRealloc?Which i suppose works by allocating more hardware pages and
mapping them in a new vitual location, where you have enough virtual space
for the new buffer?

>
> d
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> Please reply to newsgroups only.
>
> "Bogdan Bejan" <na@na.na> wrote in message
> news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > How can you alocate then realocate a memory buffer in kernel mode (W2k+)
?
> >
> >
>
>

Don
Wed Feb 04 17:06:01 CST 2004

No, you are talking about Win32 user space API's not kernel API's. The
reason people are asking is if you haven't learned the basics, and you
aren't working to get the knowledge yourself, you will be comming back here
an awful lot with stupid questions. I recomend as a minimum getting a good
book on driver writing such as "Programming the Windows Driver Model Second
Edition" by Walter Oney, or better yet taking a seminar in driver writing.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

"Bogdan Bejan" <na@na.na> wrote in message
news:%23M%23nsG36DHA.1040@TK2MSFTNGP10.phx.gbl...
>
> "David J. Craig" <SeniorDriversWriter@shogunyoshimuni.com.net> wrote in
> message news:OJy$JOs6DHA.3648@TK2MSFTNGP11.phx.gbl...
> > Should you be writing drivers? Look at the source code for realloc that
> Let me guess, realloc is written using system calls like GlobalRealloc, to
> which i don't have the souce code, do I?
> Why I should not write drivers? When i was learning about virtual vs.
> hardware memory the top of the lince CPU was 386...soo..
> Besides, I know how realloc works on x86 CPUs, what i don't know is the
> windows kernel API to get the same thing.
>
> > comes with Visual Studio and adapt it to kernel mode.
> >
> > "Bogdan Bejan" <na@na.na> wrote in message
> > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > How can you alocate then realocate a memory buffer in kernel mode
> > (W2k+) ?
> > >
> > >
> >
> >
>
>

Bogdan
Wed Feb 04 17:30:01 CST 2004


"Don Burn" <burn@stopspam.acm.org> wrote in message
news:1022uq15mknk4a4@corp.supernews.com...
> No, you are talking about Win32 user space API's not kernel API's. The
> reason people are asking is if you haven't learned the basics, and you
> aren't working to get the knowledge yourself, you will be comming back
here
> an awful lot with stupid questions. I recomend as a minimum getting a
good
> book on driver writing such as "Programming the Windows Driver Model
Second
> Edition" by Walter Oney, or better yet taking a seminar in driver writing.

Do you think I should attend a seminar to find out if there is or not a
kernel mode API function to do what GlobalRealloc/realloc function does?

The fact is that you and David did not understood my question, even wors you
started to assume what I know and what I don't know and gave generic
unhelpfull answers, advertised some book etc..etc..

As i sed, I do know what is behind GlobalRealloc/realloc/etc.. from the x86
point of view (do you?), what I didn't know was if there was a kernel mode
function to facilitate it.

Aniway, my question was answered, thanx again Dorono..



>
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
> "Bogdan Bejan" <na@na.na> wrote in message
> news:%23M%23nsG36DHA.1040@TK2MSFTNGP10.phx.gbl...
> >
> > "David J. Craig" <SeniorDriversWriter@shogunyoshimuni.com.net> wrote in
> > message news:OJy$JOs6DHA.3648@TK2MSFTNGP11.phx.gbl...
> > > Should you be writing drivers? Look at the source code for realloc
that
> > Let me guess, realloc is written using system calls like GlobalRealloc,
to
> > which i don't have the souce code, do I?
> > Why I should not write drivers? When i was learning about virtual vs.
> > hardware memory the top of the lince CPU was 386...soo..
> > Besides, I know how realloc works on x86 CPUs, what i don't know is the
> > windows kernel API to get the same thing.
> >
> > > comes with Visual Studio and adapt it to kernel mode.
> > >
> > > "Bogdan Bejan" <na@na.na> wrote in message
> > > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > > How can you alocate then realocate a memory buffer in kernel mode
> > > (W2k+) ?
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Maxim
Wed Feb 04 18:12:53 CST 2004

> Let me guess, realloc is written using system calls like GlobalRealloc, to

This is not a syscall. This is hooked to user-mode ntdll!RtlxxxHeap, which do
all heap management.

VirtualAlloc and other Virtualxxx are syscalls, hooked to
ZwAllocateVirtualMemort.

> Besides, I know how realloc works on x86 CPUs, what i don't know is the
> windows kernel API to get the same thing.

Just - no such API. Allocate the second block and copy.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Maxim
Wed Feb 04 18:15:40 CST 2004

> As i sed, I do know what is behind GlobalRealloc/realloc/etc.. from the x86
> point of view (do you?)

There is nothing under realloc() "from x86 point of view" (except the virtual
memory, but this is too low a level - for instance, it only knows pages and not
small memory blocks).

realloc() is a function of the heap manager package, and, if the heap manager
has no such function - then sorry.

ExxxxPool heap manager has no such function.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Bogdan
Wed Feb 04 18:27:04 CST 2004


"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:uUv9Oy36DHA.1936@TK2MSFTNGP12.phx.gbl...
> > Let me guess, realloc is written using system calls like GlobalRealloc,
to
>
> This is not a syscall. This is hooked to user-mode ntdll!RtlxxxHeap, which
do
> all heap management.

I didn't mean syscall (as in a call to kernel) i meant a system call or API,
imlemented in a user mode dll, like you sed :)

All the runtime function from C/C++ have to go trough windows user mode API
to do the real-work, so if I look at the realloc code I won't learn much, do
I?

So the real newbe here was David J.
:P

When i sed malloc/realloc some people understood it literaly when I only
ment them as the end result I was looking for, that is being able to resize
a kernel mode memory buffer.

>
> VirtualAlloc and other Virtualxxx are syscalls, hooked to
> ZwAllocateVirtualMemort.
>
> > Besides, I know how realloc works on x86 CPUs, what i don't know is the
> > windows kernel API to get the same thing.
>
> Just - no such API. Allocate the second block and copy.

For startes I will do just that, but, you should be able to realocate the
number of fizical pages behind a buffer and map them in a diffrent location
(yes, i still have to finish looking at the zilions of memory functions from
the DDK) where there is enough virtual space, right?
That way you don't do the costly copy operation.

>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
>

Bogdan
Wed Feb 04 18:38:39 CST 2004


"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:%234pKyz36DHA.2644@TK2MSFTNGP11.phx.gbl...
> > As i sed, I do know what is behind GlobalRealloc/realloc/etc.. from the
x86
> > point of view (do you?)
>
> There is nothing under realloc() "from x86 point of view" (except the
virtual

In realloc there isn't a single bit of x86 dependent code (ok , meybe one or
two :)
and it can never be.Why? Because it is a C/C++ runtime library that is ment
to be portable and has to realy on the OS to acctually do the reallocation.

"from x86 point of view" = read, I know how the x86 memory model works,I
know it at the lowest possible level, I don't need to buy some books for
that. Don't we have the Architecture/OS manual from Intel? Which is a free
download?

I don't want the want the damn C/C++ runtime in a driver, I only need to
resize a memory buffer. Simple as that

> memory, but this is too low a level - for instance, it only knows pages
and not
> small memory blocks).
>
> realloc() is a function of the heap manager package, and, if the heap
manager
> has no such function - then sorry.
>
> ExxxxPool heap manager has no such function.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
>

Maxim
Wed Feb 04 18:57:35 CST 2004

> I don't want the want the damn C/C++ runtime in a driver, I only need to
> resize a memory buffer. Simple as that

The ExxxxPool memory allocator package does not support this operation. Maybe
this is because MS just forgotten to do this. It is rarely needed anyway.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Doron
Wed Feb 04 22:38:15 CST 2004

one of the semantics of realloc is that the same pointer as before can be
returned (i haven't used realloc in such a long time, i can't remember if
this true 100% of the time or not). Based on this assumption if you were to
resize a buffer, you would need to
1) make sure any threads that are using the previous buffer have stopped
using it
2) update the field which contains the pointer value so that no one picks
up the old value and starts using the new one

d

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please reply to newsgroups only.

"Bogdan Bejan" <na@na.na> wrote in message
news:ufvFlI36DHA.2952@TK2MSFTNGP09.phx.gbl...
> I wasn't sure is shuch API exists in kernel, thanx for clearing it.
>
> "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> > no such API exists. you must be able to update the pointer value
> atomically
> > if you need to have a bigger allocation
>
> Don't you have to update the pointer with realloc to? Isn't realloc based
on
> GlobalRealloc?Which i suppose works by allocating more hardware pages and
> mapping them in a new vitual location, where you have enough virtual space
> for the new buffer?
>
> >
> > d
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > Please reply to newsgroups only.
> >
> > "Bogdan Bejan" <na@na.na> wrote in message
> > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > How can you alocate then realocate a memory buffer in kernel mode
(W2k+)
> ?
> > >
> > >
> >
> >
>
>

Bogdan
Thu Feb 05 07:12:06 CST 2004


"Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
news:u7ysgH66DHA.4012@tk2msftngp13.phx.gbl...
> one of the semantics of realloc is that the same pointer as before can be
> returned (i haven't used realloc in such a long time, i can't remember if
> this true 100% of the time or not).

Any for of realocation of a memory buffer can't possible guarantee to return
the same adress, what if you don't have enought linear virtual memory there
to fulfill the request?

So this applayes to maloc or any other function, i think.

> Based on this assumption if you were to
> resize a buffer, you would need to
> 1) make sure any threads that are using the previous buffer have stopped
> using it
> 2) update the field which contains the pointer value so that no one picks
> up the old value and starts using the new one

I really know this.
I just don't know how to acctualy resize a memory buffer in kernel mode.

>
> d
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> Please reply to newsgroups only.
>
> "Bogdan Bejan" <na@na.na> wrote in message
> news:ufvFlI36DHA.2952@TK2MSFTNGP09.phx.gbl...
> > I wasn't sure is shuch API exists in kernel, thanx for clearing it.
> >
> > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> > > no such API exists. you must be able to update the pointer value
> > atomically
> > > if you need to have a bigger allocation
> >
> > Don't you have to update the pointer with realloc to? Isn't realloc
based
> on
> > GlobalRealloc?Which i suppose works by allocating more hardware pages
and
> > mapping them in a new vitual location, where you have enough virtual
space
> > for the new buffer?
> >
> > >
> > > d
> > >
> > > --
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > > Please reply to newsgroups only.
> > >
> > > "Bogdan Bejan" <na@na.na> wrote in message
> > > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > > How can you alocate then realocate a memory buffer in kernel mode
> (W2k+)
> > ?
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Alexander
Thu Feb 05 09:02:03 CST 2004

In most designs, realloc is so rarely used, that any implementation is left
up to you. You won't have an optimized realloc (which can resize a memory
block), though.

"Bogdan Bejan" <na@na.na> wrote in message
news:e0oirm%236DHA.2404@TK2MSFTNGP12.phx.gbl...
>
> "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> news:u7ysgH66DHA.4012@tk2msftngp13.phx.gbl...
> > one of the semantics of realloc is that the same pointer as before can
be
> > returned (i haven't used realloc in such a long time, i can't remember
if
> > this true 100% of the time or not).
>
> Any for of realocation of a memory buffer can't possible guarantee to
return
> the same adress, what if you don't have enought linear virtual memory
there
> to fulfill the request?
>
> So this applayes to maloc or any other function, i think.
>
> > Based on this assumption if you were to
> > resize a buffer, you would need to
> > 1) make sure any threads that are using the previous buffer have
stopped
> > using it
> > 2) update the field which contains the pointer value so that no one
picks
> > up the old value and starts using the new one
>
> I really know this.
> I just don't know how to acctualy resize a memory buffer in kernel mode.
>
> >
> > d
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > Please reply to newsgroups only.
> >
> > "Bogdan Bejan" <na@na.na> wrote in message
> > news:ufvFlI36DHA.2952@TK2MSFTNGP09.phx.gbl...
> > > I wasn't sure is shuch API exists in kernel, thanx for clearing it.
> > >
> > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > > news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> > > > no such API exists. you must be able to update the pointer value
> > > atomically
> > > > if you need to have a bigger allocation
> > >
> > > Don't you have to update the pointer with realloc to? Isn't realloc
> based
> > on
> > > GlobalRealloc?Which i suppose works by allocating more hardware pages
> and
> > > mapping them in a new vitual location, where you have enough virtual
> space
> > > for the new buffer?
> > >
> > > >
> > > > d
> > > >
> > > > --
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > > Please reply to newsgroups only.
> > > >
> > > > "Bogdan Bejan" <na@na.na> wrote in message
> > > > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > > > How can you alocate then realocate a memory buffer in kernel mode
> > (W2k+)
> > > ?
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Doron
Thu Feb 05 21:37:13 CST 2004

maloc/ExAllocatePoolWithTag has a much higher likelyhood of failure in the
kernel then in user mode. so, yes, as such you need to guard against NULL
being returned as well w/out a doubt. But there is a difference between a
NULL check and making sure all current users of valid pool are not touching
memory when you decide to grow the allocation.

d

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please reply to newsgroups only.

"Bogdan Bejan" <na@na.na> wrote in message
news:e0oirm%236DHA.2404@TK2MSFTNGP12.phx.gbl...
>
> "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> news:u7ysgH66DHA.4012@tk2msftngp13.phx.gbl...
> > one of the semantics of realloc is that the same pointer as before can
be
> > returned (i haven't used realloc in such a long time, i can't remember
if
> > this true 100% of the time or not).
>
> Any for of realocation of a memory buffer can't possible guarantee to
return
> the same adress, what if you don't have enought linear virtual memory
there
> to fulfill the request?
>
> So this applayes to maloc or any other function, i think.
>
> > Based on this assumption if you were to
> > resize a buffer, you would need to
> > 1) make sure any threads that are using the previous buffer have
stopped
> > using it
> > 2) update the field which contains the pointer value so that no one
picks
> > up the old value and starts using the new one
>
> I really know this.
> I just don't know how to acctualy resize a memory buffer in kernel mode.
>
> >
> > d
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > Please reply to newsgroups only.
> >
> > "Bogdan Bejan" <na@na.na> wrote in message
> > news:ufvFlI36DHA.2952@TK2MSFTNGP09.phx.gbl...
> > > I wasn't sure is shuch API exists in kernel, thanx for clearing it.
> > >
> > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > > news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> > > > no such API exists. you must be able to update the pointer value
> > > atomically
> > > > if you need to have a bigger allocation
> > >
> > > Don't you have to update the pointer with realloc to? Isn't realloc
> based
> > on
> > > GlobalRealloc?Which i suppose works by allocating more hardware pages
> and
> > > mapping them in a new vitual location, where you have enough virtual
> space
> > > for the new buffer?
> > >
> > > >
> > > > d
> > > >
> > > > --
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > > Please reply to newsgroups only.
> > > >
> > > > "Bogdan Bejan" <na@na.na> wrote in message
> > > > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > > > How can you alocate then realocate a memory buffer in kernel mode
> > (W2k+)
> > > ?
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

G
Thu Feb 05 22:04:11 CST 2004

Still, how do you perform the acctual resize?
Any reasons as to why there isn't a direct function in kernel to do this?

"Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
news:OVwTEKG7DHA.3880@tk2msftngp13.phx.gbl...
> maloc/ExAllocatePoolWithTag has a much higher likelyhood of failure in the
> kernel then in user mode. so, yes, as such you need to guard against NULL
> being returned as well w/out a doubt. But there is a difference between a
> NULL check and making sure all current users of valid pool are not
touching
> memory when you decide to grow the allocation.
>
> d
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> Please reply to newsgroups only.
>
> "Bogdan Bejan" <na@na.na> wrote in message
> news:e0oirm%236DHA.2404@TK2MSFTNGP12.phx.gbl...
> >
> > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > news:u7ysgH66DHA.4012@tk2msftngp13.phx.gbl...
> > > one of the semantics of realloc is that the same pointer as before can
> be
> > > returned (i haven't used realloc in such a long time, i can't remember
> if
> > > this true 100% of the time or not).
> >
> > Any for of realocation of a memory buffer can't possible guarantee to
> return
> > the same adress, what if you don't have enought linear virtual memory
> there
> > to fulfill the request?
> >
> > So this applayes to maloc or any other function, i think.
> >
> > > Based on this assumption if you were to
> > > resize a buffer, you would need to
> > > 1) make sure any threads that are using the previous buffer have
> stopped
> > > using it
> > > 2) update the field which contains the pointer value so that no one
> picks
> > > up the old value and starts using the new one
> >
> > I really know this.
> > I just don't know how to acctualy resize a memory buffer in kernel mode.
> >
> > >
> > > d
> > >
> > > --
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > > Please reply to newsgroups only.
> > >
> > > "Bogdan Bejan" <na@na.na> wrote in message
> > > news:ufvFlI36DHA.2952@TK2MSFTNGP09.phx.gbl...
> > > > I wasn't sure is shuch API exists in kernel, thanx for clearing it.
> > > >
> > > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > > > news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> > > > > no such API exists. you must be able to update the pointer value
> > > > atomically
> > > > > if you need to have a bigger allocation
> > > >
> > > > Don't you have to update the pointer with realloc to? Isn't realloc
> > based
> > > on
> > > > GlobalRealloc?Which i suppose works by allocating more hardware
pages
> > and
> > > > mapping them in a new vitual location, where you have enough virtual
> > space
> > > > for the new buffer?
> > > >
> > > > >
> > > > > d
> > > > >
> > > > > --
> > > > > This posting is provided "AS IS" with no warranties, and confers
no
> > > > rights.
> > > > > Please reply to newsgroups only.
> > > > >
> > > > > "Bogdan Bejan" <na@na.na> wrote in message
> > > > > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > > > > How can you alocate then realocate a memory buffer in kernel
mode
> > > (W2k+)
> > > > ?
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Doron
Fri Feb 06 00:03:41 CST 2004

depends on the application for how to do the resize, but i would either keep
a reference count of all the threads who want access or perform all access
under a lock (like a spinlock) which guarantees only one user of the buffer
at once. one reason realloc does not exist is that VA space is limited and
more often then not, the same pointer cannot be returned so this is
functionally the same as free/alloc anyways.

d

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Please reply to newsgroups only.

"G." <na@na.na> wrote in message
news:OrhiLZG7DHA.3880@tk2msftngp13.phx.gbl...
> Still, how do you perform the acctual resize?
> Any reasons as to why there isn't a direct function in kernel to do this?
>
> "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> news:OVwTEKG7DHA.3880@tk2msftngp13.phx.gbl...
> > maloc/ExAllocatePoolWithTag has a much higher likelyhood of failure in
the
> > kernel then in user mode. so, yes, as such you need to guard against
NULL
> > being returned as well w/out a doubt. But there is a difference between
a
> > NULL check and making sure all current users of valid pool are not
> touching
> > memory when you decide to grow the allocation.
> >
> > d
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > Please reply to newsgroups only.
> >
> > "Bogdan Bejan" <na@na.na> wrote in message
> > news:e0oirm%236DHA.2404@TK2MSFTNGP12.phx.gbl...
> > >
> > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > > news:u7ysgH66DHA.4012@tk2msftngp13.phx.gbl...
> > > > one of the semantics of realloc is that the same pointer as before
can
> > be
> > > > returned (i haven't used realloc in such a long time, i can't
remember
> > if
> > > > this true 100% of the time or not).
> > >
> > > Any for of realocation of a memory buffer can't possible guarantee to
> > return
> > > the same adress, what if you don't have enought linear virtual memory
> > there
> > > to fulfill the request?
> > >
> > > So this applayes to maloc or any other function, i think.
> > >
> > > > Based on this assumption if you were to
> > > > resize a buffer, you would need to
> > > > 1) make sure any threads that are using the previous buffer have
> > stopped
> > > > using it
> > > > 2) update the field which contains the pointer value so that no one
> > picks
> > > > up the old value and starts using the new one
> > >
> > > I really know this.
> > > I just don't know how to acctualy resize a memory buffer in kernel
mode.
> > >
> > > >
> > > > d
> > > >
> > > > --
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > > Please reply to newsgroups only.
> > > >
> > > > "Bogdan Bejan" <na@na.na> wrote in message
> > > > news:ufvFlI36DHA.2952@TK2MSFTNGP09.phx.gbl...
> > > > > I wasn't sure is shuch API exists in kernel, thanx for clearing
it.
> > > > >
> > > > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > > > > news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> > > > > > no such API exists. you must be able to update the pointer
value
> > > > > atomically
> > > > > > if you need to have a bigger allocation
> > > > >
> > > > > Don't you have to update the pointer with realloc to? Isn't
realloc
> > > based
> > > > on
> > > > > GlobalRealloc?Which i suppose works by allocating more hardware
> pages
> > > and
> > > > > mapping them in a new vitual location, where you have enough
virtual
> > > space
> > > > > for the new buffer?
> > > > >
> > > > > >
> > > > > > d
> > > > > >
> > > > > > --
> > > > > > This posting is provided "AS IS" with no warranties, and confers
> no
> > > > > rights.
> > > > > > Please reply to newsgroups only.
> > > > > >
> > > > > > "Bogdan Bejan" <na@na.na> wrote in message
> > > > > > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > > > > > How can you alocate then realocate a memory buffer in kernel
> mode
> > > > (W2k+)
> > > > > ?
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

G
Fri Feb 06 08:55:08 CST 2004

Let's try to be as technical as possible.
In kernel mode (driver) how you do this:

1. Allocate a bunch of pf phisical pages
2. Map them to some VA, continguosly
3. Clear the VA mapping, but not free the phisical pages
4. Alocate more phisical pages
5. Continguosly in VA map the pages allocated from step 1 & 4
6. Destroy the VM mapping.
7. Free the phisical pages.


"Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
news:OfEw6bH7DHA.2168@TK2MSFTNGP12.phx.gbl...
> depends on the application for how to do the resize, but i would either
keep
> a reference count of all the threads who want access or perform all access
> under a lock (like a spinlock) which guarantees only one user of the
buffer
> at once. one reason realloc does not exist is that VA space is limited
and
> more often then not, the same pointer cannot be returned so this is
> functionally the same as free/alloc anyways.
>
> d
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> Please reply to newsgroups only.
>
> "G." <na@na.na> wrote in message
> news:OrhiLZG7DHA.3880@tk2msftngp13.phx.gbl...
> > Still, how do you perform the acctual resize?
> > Any reasons as to why there isn't a direct function in kernel to do
this?
> >
> > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > news:OVwTEKG7DHA.3880@tk2msftngp13.phx.gbl...
> > > maloc/ExAllocatePoolWithTag has a much higher likelyhood of failure in
> the
> > > kernel then in user mode. so, yes, as such you need to guard against
> NULL
> > > being returned as well w/out a doubt. But there is a difference
between
> a
> > > NULL check and making sure all current users of valid pool are not
> > touching
> > > memory when you decide to grow the allocation.
> > >
> > > d
> > >
> > > --
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > > Please reply to newsgroups only.
> > >
> > > "Bogdan Bejan" <na@na.na> wrote in message
> > > news:e0oirm%236DHA.2404@TK2MSFTNGP12.phx.gbl...
> > > >
> > > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > > > news:u7ysgH66DHA.4012@tk2msftngp13.phx.gbl...
> > > > > one of the semantics of realloc is that the same pointer as before
> can
> > > be
> > > > > returned (i haven't used realloc in such a long time, i can't
> remember
> > > if
> > > > > this true 100% of the time or not).
> > > >
> > > > Any for of realocation of a memory buffer can't possible guarantee
to
> > > return
> > > > the same adress, what if you don't have enought linear virtual
memory
> > > there
> > > > to fulfill the request?
> > > >
> > > > So this applayes to maloc or any other function, i think.
> > > >
> > > > > Based on this assumption if you were to
> > > > > resize a buffer, you would need to
> > > > > 1) make sure any threads that are using the previous buffer have
> > > stopped
> > > > > using it
> > > > > 2) update the field which contains the pointer value so that no
one
> > > picks
> > > > > up the old value and starts using the new one
> > > >
> > > > I really know this.
> > > > I just don't know how to acctualy resize a memory buffer in kernel
> mode.
> > > >
> > > > >
> > > > > d
> > > > >
> > > > > --
> > > > > This posting is provided "AS IS" with no warranties, and confers
no
> > > > rights.
> > > > > Please reply to newsgroups only.
> > > > >
> > > > > "Bogdan Bejan" <na@na.na> wrote in message
> > > > > news:ufvFlI36DHA.2952@TK2MSFTNGP09.phx.gbl...
> > > > > > I wasn't sure is shuch API exists in kernel, thanx for clearing
> it.
> > > > > >
> > > > > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in
message
> > > > > > news:uocOjcs6DHA.1556@tk2msftngp13.phx.gbl...
> > > > > > > no such API exists. you must be able to update the pointer
> value
> > > > > > atomically
> > > > > > > if you need to have a bigger allocation
> > > > > >
> > > > > > Don't you have to update the pointer with realloc to? Isn't
> realloc
> > > > based
> > > > > on
> > > > > > GlobalRealloc?Which i suppose works by allocating more hardware
> > pages
> > > > and
> > > > > > mapping them in a new vitual location, where you have enough
> virtual
> > > > space
> > > > > > for the new buffer?
> > > > > >
> > > > > > >
> > > > > > > d
> > > > > > >
> > > > > > > --
> > > > > > > This posting is provided "AS IS" with no warranties, and
confers
> > no
> > > > > > rights.
> > > > > > > Please reply to newsgroups only.
> > > > > > >
> > > > > > > "Bogdan Bejan" <na@na.na> wrote in message
> > > > > > > news:euNZM9r6DHA.2764@TK2MSFTNGP09.phx.gbl...
> > > > > > > > How can you alocate then realocate a memory buffer in kernel
> > mode
> > > > > (W2k+)
> > > > > > ?
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

G
Fri Feb 06 08:56:53 CST 2004

In user space, I can only think of only one way. don't use realloc, malloc
some other buffer then copy.

I kernel mode you should be able to do this without the copy operation, but
i don't know how..

"Antranik" <ardziv13NO_CAPS@freenet.nospam.am> wrote in message
news:8924A7AA-0802-4974-AF37-D63B9BA10086@microsoft.com...
> What about the case where you would actually WANT a different pointer
returned from realloc()?
>
> Is there any way to force it to move the block to another user-space VA
location?

Tim
Sun Feb 08 00:09:45 CST 2004

"G." <na@na.na> wrote:
>
>Still, how do you perform the acctual resize?

char * newBuffer = ExAllocatePool( newBufferSize, NONPAGED_POOL );
memcpy( newBuffer, oldBuffer, oldBufferSize );
ExFreePool( oldBuffer );

>Any reasons as to why there isn't a direct function in kernel to do this?

Yes, because it isn't that common an operation in kernel mode, and it
SHOULDN'T be common.

Memory is a precious resource in kernel mode; non-paged pool is fixed and
cannot be increased. In many cases a memory allocation failure is a
blue-screen-worthy event. As a result, well-designed drivers tend to
allocate memory at device initialization and keep it around forever.

Further, many kernel buffers are shared with user-mode apps. If a buffer
is going to change its address, the driver writer needs to make a conscious
decision to do that.
--
- Tim Roberts, timr@probo.com
Providenza & Boekelheide, Inc

G
Sun Feb 08 08:03:51 CST 2004

That is verry smart, I never thought of that.
But, how you do that **without the copy** ?
You do know you can do that, don't you ?

Besides the real question is this, so answer this if you can (malloc/realloc
was more of a metafore see you guys didn't get it):
>1. Allocate a bunch of pf phisical pages
>2. Map them to some VA, continguosly
>3. Clear the VA mapping, but not free the phisical pages
>4. Alocate more phisical pages
>5. Continguosly in VA map the pages allocated from step 1 & 4
>6. Destroy the VM mapping.
>7. Free the phisical pages.

"Tim Roberts" <timr@probo.com> wrote in message
news:73kb20tq8p9n8up38k9eoh2pidnpu0u2ep@4ax.com...
> "G." <na@na.na> wrote:
> >
> >Still, how do you perform the acctual resize?
>
> char * newBuffer = ExAllocatePool( newBufferSize, NONPAGED_POOL );
> memcpy( newBuffer, oldBuffer, oldBufferSize );
> ExFreePool( oldBuffer );
>
> >Any reasons as to why there isn't a direct function in kernel to do this?
>
> Yes, because it isn't that common an operation in kernel mode, and it
> SHOULDN'T be common.
>
> Memory is a precious resource in kernel mode; non-paged pool is fixed and
> cannot be increased. In many cases a memory allocation failure is a
> blue-screen-worthy event. As a result, well-designed drivers tend to
> allocate memory at device initialization and keep it around forever.
>
> Further, many kernel buffers are shared with user-mode apps. If a buffer
> is going to change its address, the driver writer needs to make a
conscious
> decision to do that.
> --
> - Tim Roberts, timr@probo.com
> Providenza & Boekelheide, Inc

Don
Sun Feb 08 08:13:54 CST 2004

Sure you can do this, of course you are taking a limited system resource
(kernel PTE's) and squandering them for your driver. I guess that is ok, if
your driver is in an embedded or limited environment, but if this is a
driver for a general commecial environment, this is crap.

I am friends with several folks who perform the acceptance of drivers, for
large firms who are buying parts OEM, they tell a number of amusing tales of
their firms telling a supplier to completely rewrite their driver (because
of bad code like this, or using a toolkit that large firm won't bless) and
giving them a short time to rewrite. Unless you are just playing at this,
or know your driver is a one of a kind, write it based on standard
techniques.

--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply


"G." <na@na.na> wrote in message
news:OVZZlxk7DHA.696@tk2msftngp13.phx.gbl...
> That is verry smart, I never thought of that.
> But, how you do that **without the copy** ?
> You do know you can do that, don't you ?
>
> Besides the real question is this, so answer this if you can
(malloc/realloc
> was more of a metafore see you guys didn't get it):
> >1. Allocate a bunch of pf phisical pages
> >2. Map them to some VA, continguosly
> >3. Clear the VA mapping, but not free the phisical pages
> >4. Alocate more phisical pages
> >5. Continguosly in VA map the pages allocated from step 1 & 4
> >6. Destroy the VM mapping.
> >7. Free the phisical pages.
>
> "Tim Roberts" <timr@probo.com> wrote in message
> news:73kb20tq8p9n8up38k9eoh2pidnpu0u2ep@4ax.com...
> > "G." <na@na.na> wrote:
> > >
> > >Still, how do you perform the acctual resize?
> >
> > char * newBuffer = ExAllocatePool( newBufferSize, NONPAGED_POOL );
> > memcpy( newBuffer, oldBuffer, oldBufferSize );
> > ExFreePool( oldBuffer );
> >
> > >Any reasons as to why there isn't a direct function in kernel to do
this?
> >
> > Yes, because it isn't that common an operation in kernel mode, and it
> > SHOULDN'T be common.
> >
> > Memory is a precious resource in kernel mode; non-paged pool is fixed
and
> > cannot be increased. In many cases a memory allocation failure is a
> > blue-screen-worthy event. As a result, well-designed drivers tend to
> > allocate memory at device initialization and keep it around forever.
> >
> > Further, many kernel buffers are shared with user-mode apps. If a
buffer
> > is going to change its address, the driver writer needs to make a
> conscious
> > decision to do that.
> > --
> > - Tim Roberts, timr@probo.com
> > Providenza & Boekelheide, Inc
>
>

G
Sun Feb 08 10:16:10 CST 2004

To spam...not to spam....oh well, to spam

So, can you acctualy answer the question?

"Don Burn" <burn@stopspam.acm.org> wrote in message
news:102ch4skan5rc7@corp.supernews.com...
> Sure you can do this, of course you are taking a limited system resource
> (kernel PTE's) and squandering them for your driver. I guess that is ok,
if
> your driver is in an embedded or limited environment, but if this is a
> driver for a general commecial environment, this is crap.
>
> I am friends with several folks who perform the acceptance of drivers, for
> large firms who are buying parts OEM, they tell a number of amusing tales
of
> their firms telling a supplier to completely rewrite their driver (because
> of bad code like this, or using a toolkit that large firm won't bless) and
> giving them a short time to rewrite. Unless you are just playing at this,
> or know your driver is a one of a kind, write it based on standard
> techniques.
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
>
> "G." <na@na.na> wrote in message
> news:OVZZlxk7DHA.696@tk2msftngp13.phx.gbl...
> > That is verry smart, I never thought of that.
> > But, how you do that **without the copy** ?
> > You do know you can do that, don't you ?
> >
> > Besides the real question is this, so answer this if you can
> (malloc/realloc
> > was more of a metafore see you guys didn't get it):
> > >1. Allocate a bunch of pf phisical pages
> > >2. Map them to some VA, continguosly
> > >3. Clear the VA mapping, but not free the phisical pages
> > >4. Alocate more phisical pages
> > >5. Continguosly in VA map the pages allocated from step 1 & 4
> > >6. Destroy the VM mapping.
> > >7. Free the phisical pages.
> >
> > "Tim Roberts" <timr@probo.com> wrote in message
> > news:73kb20tq8p9n8up38k9eoh2pidnpu0u2ep@4ax.com...
> > > "G." <na@na.na> wrote:
> > > >
> > > >Still, how do you perform the acctual resize?
> > >
> > > char * newBuffer = ExAllocatePool( newBufferSize, NONPAGED_POOL );
> > > memcpy( newBuffer, oldBuffer, oldBufferSize );
> > > ExFreePool( oldBuffer );
> > >
> > > >Any reasons as to why there isn't a direct function in kernel to do
> this?
> > >
> > > Yes, because it isn't that common an operation in kernel mode, and it
> > > SHOULDN'T be common.
> > >
> > > Memory is a precious resource in kernel mode; non-paged pool is fixed
> and
> > > cannot be increased. In many cases a memory allocation failure is a
> > > blue-screen-worthy event. As a result, well-designed drivers tend to
> > > allocate memory at device initialization and keep it around forever.
> > >
> > > Further, many kernel buffers are shared with user-mode apps. If a
> buffer
> > > is going to change its address, the driver writer needs to make a
> > conscious
> > > decision to do that.
> > > --
> > > - Tim Roberts, timr@probo.com
> > > Providenza & Boekelheide, Inc
> >
> >
>
>

Don
Sun Feb 08 10:27:09 CST 2004

You keep asking for a realloc, and people have given you approaches without
knowing the constraints you have we will just keep getting worthless barbs
back on this. The bottom line is it depends:

1. You allocate a big chunk, and manage your own heap. This is
wasteful in a general driver.

2. You can use the allocate, copy, free. But you don't seem to like
this.

3. You can look at your overall driver and determine if you really
need to use realloc. I haven't seen a need for realloc in the 10 years I've
been in the Windows kernel, nor have the driver writers I know, so perhaps
your upper level design is flawed.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

"G." <na@na.na> wrote in message
news:%23mwBh7l7DHA.2712@tk2msftngp13.phx.gbl...
> To spam...not to spam....oh well, to spam
>
> So, can you acctualy answer the question?
>
> "Don Burn" <burn@stopspam.acm.org> wrote in message
> news:102ch4skan5rc7@corp.supernews.com...
> > Sure you can do this, of course you are taking a limited system resource
> > (kernel PTE's) and squandering them for your driver. I guess that is
ok,
> if
> > your driver is in an embedded or limited environment, but if this is a
> > driver for a general commecial environment, this is crap.
> >
> > I am friends with several folks who perform the acceptance of drivers,
for
> > large firms who are buying parts OEM, they tell a number of amusing
tales
> of
> > their firms telling a supplier to completely rewrite their driver
(because
> > of bad code like this, or using a toolkit that large firm won't bless)
and
> > giving them a short time to rewrite. Unless you are just playing at
this,
> > or know your driver is a one of a kind, write it based on standard
> > techniques.
> >
> > --
> > Don Burn (MVP, Windows DDK)
> > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > Remove StopSpam from the email to reply
> >

David
Sun Feb 08 13:12:13 CST 2004

I think he has decided that realloc without copying is his solution and
nothing else matters. Obstinacy doesn't make writing drivers easy and
just wastes everyone's time when they ask a question to which they don't
want a valid answer. Of course, the question could be about how do I
grab an executing image, enlarge it, and add some virus code.

"Don Burn" <burn@stopspam.acm.org> wrote in message
news:102coumt0fv2ked@corp.supernews.com...
> You keep asking for a realloc, and people have given you approaches
without
> knowing the constraints you have we will just keep getting worthless
barbs
> back on this. The bottom line is it depends:
>
> 1. You allocate a big chunk, and manage your own heap. This is
> wasteful in a general driver.
>
> 2. You can use the allocate, copy, free. But you don't seem to
like
> this.
>
> 3. You can look at your overall driver and determine if you
really
> need to use realloc. I haven't seen a need for realloc in the 10
years I've
> been in the Windows kernel, nor have the driver writers I know, so
perhaps
> your upper level design is flawed.
>
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
> "G." <na@na.na> wrote in message
> news:%23mwBh7l7DHA.2712@tk2msftngp13.phx.gbl...
> > To spam...not to spam....oh well, to spam
> >
> > So, can you acctualy answer the question?
> >
> > "Don Burn" <burn@stopspam.acm.org> wrote in message
> > news:102ch4skan5rc7@corp.supernews.com...
> > > Sure you can do this, of course you are taking a limited system
resource
> > > (kernel PTE's) and squandering them for your driver. I guess that
is
> ok,
> > if
> > > your driver is in an embedded or limited environment, but if this
is a
> > > driver for a general commecial environment, this is crap.
> > >
> > > I am friends with several folks who perform the acceptance of
drivers,
> for
> > > large firms who are buying parts OEM, they tell a number of
amusing
> tales
> > of
> > > their firms telling a supplier to completely rewrite their driver
> (because
> > > of bad code like this, or using a toolkit that large firm won't
bless)
> and
> > > giving them a short time to rewrite. Unless you are just playing
at
> this,
> > > or know your driver is a one of a kind, write it based on standard
> > > techniques.
> > >
> > > --
> > > Don Burn (MVP, Windows DDK)
> > > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > > Remove StopSpam from the email to reply
> > >
>
>

G
Sun Feb 08 16:31:16 CST 2004

Try this instead

How do I implement some streams in a driver.

And no, I don't care is the driver is not the place for streams.

"David J. Craig" <SeniorDriversWriter@shogunyoshimuni.com.net> wrote in
message news:%23ieu3dn7DHA.1672@TK2MSFTNGP12.phx.gbl...
> I think he has decided that realloc without copying is his solution and
> nothing else matters. Obstinacy doesn't make writing drivers easy and
> just wastes everyone's time when they ask a question to which they don't
> want a valid answer. Of course, the question could be about how do I
> grab an executing image, enlarge it, and add some virus code.
>
> "Don Burn" <burn@stopspam.acm.org> wrote in message
> news:102coumt0fv2ked@corp.supernews.com...
> > You keep asking for a realloc, and people have given you approaches
> without
> > knowing the constraints you have we will just keep getting worthless
> barbs
> > back on this. The bottom line is it depends:
> >
> > 1. You allocate a big chunk, and manage your own heap. This is
> > wasteful in a general driver.
> >
> > 2. You can use the allocate, copy, free. But you don't seem to
> like
> > this.
> >
> > 3. You can look at your overall driver and determine if you
> really
> > need to use realloc. I haven't seen a need for realloc in the 10
> years I've
> > been in the Windows kernel, nor have the driver writers I know, so
> perhaps
> > your upper level design is flawed.
> >
> >
> > --
> > Don Burn (MVP, Windows DDK)
> > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > Remove StopSpam from the email to reply
> >
> > "G." <na@na.na> wrote in message
> > news:%23mwBh7l7DHA.2712@tk2msftngp13.phx.gbl...
> > > To spam...not to spam....oh well, to spam
> > >
> > > So, can you acctualy answer the question?
> > >
> > > "Don Burn" <burn@stopspam.acm.org> wrote in message
> > > news:102ch4skan5rc7@corp.supernews.com...
> > > > Sure you can do this, of course you are taking a limited system
> resource
> > > > (kernel PTE's) and squandering them for your driver. I guess that
> is
> > ok,
> > > if
> > > > your driver is in an embedded or limited environment, but if this
> is a
> > > > driver for a general commecial environment, this is crap.
> > > >
> > > > I am friends with several folks who perform the acceptance of
> drivers,
> > for
> > > > large firms who are buying parts OEM, they tell a number of
> amusing
> > tales
> > > of
> > > > their firms telling a supplier to completely rewrite their driver
> > (because
> > > > of bad code like this, or using a toolkit that large firm won't
> bless)
> > and
> > > > giving them a short time to rewrite. Unless you are just playing
> at
> > this,
> > > > or know your driver is a one of a kind, write it based on standard
> > > > techniques.
> > > >
> > > > --
> > > > Don Burn (MVP, Windows DDK)
> > > > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > > > Remove StopSpam from the email to reply
> > > >
> >
> >
>
>

G
Sun Feb 08 16:38:46 CST 2004

If i have a "virus" driver running in a system, do I reallly care about
infecting a file IN memory?

Do infecting a IN memory image really needs resizing a section? can you
really resize a section without unmapping it first(etc...etc..)?

"Should you be wrinting drivers?" :P

And sice after you the misteries of kernel memory management hide in the
realloc source code from your Visual C++ (how stupid is that?), i suppose
if I look in the fopen source code I will learn how to make file system
driver?

The fact is you don't know how to *really* answer the original question so
you spam,flame,etc..

Why do you even bother to post if your not going to add any meaningfull data
to the discussion?

"David J. Craig" <SeniorDriversWriter@shogunyoshimuni.com.net> wrote in
message news:%23ieu3dn7DHA.1672@TK2MSFTNGP12.phx.gbl...
> I think he has decided that realloc without copying is his solution and
> nothing else matters. Obstinacy doesn't make writing drivers easy and
> just wastes everyone's time when they ask a question to which they don't
> want a valid answer. Of course, the question could be about how do I
> grab an executing image, enlarge it, and add some virus code.
>
> "Don Burn" <burn@stopspam.acm.org> wrote in message
> news:102coumt0fv2ked@corp.supernews.com...
> > You keep asking for a realloc, and people have given you approaches
> without
> > knowing the constraints you have we will just keep getting worthless
> barbs
> > back on this. The bottom line is it depends:
> >
> > 1. You allocate a big chunk, and manage your own heap. This is
> > wasteful in a general driver.
> >
> > 2. You can use the allocate, copy, free. But you don't seem to
> like
> > this.
> >
> > 3. You can look at your overall driver and determine if you
> really
> > need to use realloc. I haven't seen a need for realloc in the 10
> years I've
> > been in the Windows kernel, nor have the driver writers I know, so
> perhaps
> > your upper level design is flawed.
> >
> >
> > --
> > Don Burn (MVP, Windows DDK)
> > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > Remove StopSpam from the email to reply
> >
> > "G." <na@na.na> wrote in message
> > news:%23mwBh7l7DHA.2712@tk2msftngp13.phx.gbl...
> > > To spam...not to spam....oh well, to spam
> > >
> > > So, can you acctualy answer the question?
> > >
&