kernel memory hog

There is a certain well know virus/spyware protection company, (not mcaffe,
not symantec) that uses a gigantic chunk (around 78 MB ) of paged memory in
the kernel and NEVER relinquishes it.

If this stuff is installed on a computer, my software , which uses a
substantial chunk of paged memory from time to time will simply not
function.

So far I've not gotten anyone's attention beyond the 1st line of technical
support
The unnamed company is much bigger than me, what can be done?????


I'd hate to think about forcing my driver to load early, grabbing what it
needs before this hog gets it snout in the trough ....That would result in 2
hogs with the expected results ... blah blah.
--
Gak -
Finecats

a-kevhou
Thu Jun 14 16:26:27 CDT 2007

------=_NextPart_0001_00B4644C
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

Is this on XP/Server 2003 or Vista? Are you running out of paged memory or
system PTEs?

Check to see if you're booting with the /3GB switch in the boot string.

Is PAE enabled? You can tell by checking which kernel image is loaded with
the following debugger command:

lm vm nt*

Can you send the output from !vm debugger command entered just before you
attempt to allocate memory to get an idea of how much memory is on the
system and what's available at the point you're trying to load your driver?

If your running out of system PTEs, check out the following link:
http://msdn2.microsoft.com/en-us/library/ms793941.aspx

Please send the output from "!sysptes 5" after you've set the value in the
registry and rebooted.

This posting is provided "AS IS" with no warranties, and confers no rights.

------=_NextPart_0001_00B4644C
Content-Type: text/x-rtf
Content-Transfer-Encoding: 7bit

{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fnil\fprq2\fcharset0 MS Sans Serif;}}
\viewkind4\uc1\pard\f0\fs20 Is this on XP/Server 2003 or Vista? Are you running out of paged memory or system PTEs?
\par
\par Check to see if you're booting with the /3GB switch in the boot string.
\par
\par Is PAE enabled? You can tell by checking which kernel image is loaded with the following debugger command:
\par
\par lm vm nt*
\par
\par Can you send the output from !vm debugger command entered just before you attempt to allocate memory to get an idea of how much memory is on the system and what's available at the point you're trying to load your driver?
\par
\par If your running out of system PTEs, check out the following link:
\par http://msdn2.microsoft.com/en-us/library/ms793941.aspx
\par
\par Please send the output from "!sysptes 5" after you've set the value in the registry and rebooted.
\par
\par This posting is provided "AS IS" with no warranties, and confers no rights.
\par
\par
\par }
------=_NextPart_0001_00B4644C--

usfinecats
Sun Jun 24 13:39:00 CDT 2007

The problem occurred on XP Pro sp2 with 2 G memory. It does not have the 3GB
switch enabled. I confirmed that the memory belongs to the particular
program by loading and unloading their software and watching the allocations
in Poolmon poollist, etc and identifing the tags that had huge allocations.

My failures occurred with ExAllocatePoolWith tag. By removing their
software, my stuff behaves just fine.

The next time I have time to reload their software and perform your
experiments I will let you know of the results.

Nevertheless, how do I get them to respond to this problem ?


--
Gak -
Finecats


"Kevin Hough [MSFT]" wrote:

> Is this on XP/Server 2003 or Vista? Are you running out of paged memory or
> system PTEs?
>
> Check to see if you're booting with the /3GB switch in the boot string.
>
> Is PAE enabled? You can tell by checking which kernel image is loaded with
> the following debugger command:
>
> lm vm nt*
>
> Can you send the output from !vm debugger command entered just before you
> attempt to allocate memory to get an idea of how much memory is on the
> system and what's available at the point you're trying to load your driver?
>
> If your running out of system PTEs, check out the following link:
> http://msdn2.microsoft.com/en-us/library/ms793941.aspx
>
> Please send the output from "!sysptes 5" after you've set the value in the
> registry and rebooted.
>
> This posting is provided "AS IS" with no warranties, and confers no rights

David
Sun Jun 24 13:59:32 CDT 2007

You assume that they care. Most companies have the mindset that any use of
a computer other than with their software doesn't matter. Who is the
company? If they have a good relationship with Microsoft they can be nudged
to change their code but it will take time and you will still have to work
with the older versions.

You said you had failures and without them being present your code works
fine. It could be you didn't express it precisely enough, but your comments
lead me to think that your failure was more than just a device that would
not work. Have you tried your code with driver verifier and low resource
simulation? If you can't fail cleanly in that environment there are changes
needed.

--
David J. Craig
Engineer, Sr. Staff Software Systems
Broadcom Corporation


"usfinecats" <usfinecats@nospam.nospam> wrote in message
news:94EB2C71-6B37-4E6B-A7B2-208160D1FAFE@microsoft.com...
> The problem occurred on XP Pro sp2 with 2 G memory. It does not have the
> 3GB
> switch enabled. I confirmed that the memory belongs to the particular
> program by loading and unloading their software and watching the
> allocations
> in Poolmon poollist, etc and identifing the tags that had huge
> allocations.
>
> My failures occurred with ExAllocatePoolWith tag. By removing their
> software, my stuff behaves just fine.
>
> The next time I have time to reload their software and perform your
> experiments I will let you know of the results.
>
> Nevertheless, how do I get them to respond to this problem ?
>
>
> --
> Gak -
> Finecats
>
>
> "Kevin Hough [MSFT]" wrote:
>
>> Is this on XP/Server 2003 or Vista? Are you running out of paged memory
>> or
>> system PTEs?
>>
>> Check to see if you're booting with the /3GB switch in the boot string.
>>
>> Is PAE enabled? You can tell by checking which kernel image is loaded
>> with
>> the following debugger command:
>>
>> lm vm nt*
>>
>> Can you send the output from !vm debugger command entered just before you
>> attempt to allocate memory to get an idea of how much memory is on the
>> system and what's available at the point you're trying to load your
>> driver?
>>
>> If your running out of system PTEs, check out the following link:
>> http://msdn2.microsoft.com/en-us/library/ms793941.aspx
>>
>> Please send the output from "!sysptes 5" after you've set the value in
>> the
>> registry and rebooted.
>>
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights

usfinecats
Mon Jun 25 13:39:02 CDT 2007

David,
When I said "failed" what I meant is that: My code tries to allocate a
bunch of memory (40MB would be ideal, but will settle for much less). When I
fail to acquire this memory I do not crash, I simply cannot perform the tasks
I need to. I then gracefully abandon my functionality . If logging for my
stuff is enabled, I log the failure. When it is my turn to do my "job"
again, I try again.

I don't mean to be overly coy about not naming the package from the unnamed
vendor, but I'd be happy to inform Microsoft directly and see if they can
exert pressure in a quiet and professional way.


--
Gak -
Finecats


"David J. Craig" wrote:

> You assume that they care. Most companies have the mindset that any use of
> a computer other than with their software doesn't matter. Who is the
> company? If they have a good relationship with Microsoft they can be nudged
> to change their code but it will take time and you will still have to work
> with the older versions.
>
> You said you had failures and without them being present your code works
> fine. It could be you didn't express it precisely enough, but your comments
> lead me to think that your failure was more than just a device that would
> not work. Have you tried your code with driver verifier and low resource
> simulation? If you can't fail cleanly in that environment there are changes
> needed.
>
> --
> David J. Craig
> Engineer, Sr. Staff Software Systems
> Broadcom Corporation
>
>
> "usfinecats" <usfinecats@nospam.nospam> wrote in message
> news:94EB2C71-6B37-4E6B-A7B2-208160D1FAFE@microsoft.com...
> > The problem occurred on XP Pro sp2 with 2 G memory. It does not have the
> > 3GB
> > switch enabled. I confirmed that the memory belongs to the particular
> > program by loading and unloading their software and watching the
> > allocations
> > in Poolmon poollist, etc and identifing the tags that had huge
> > allocations.
> >
> > My failures occurred with ExAllocatePoolWith tag. By removing their
> > software, my stuff behaves just fine.
> >
> > The next time I have time to reload their software and perform your
> > experiments I will let you know of the results.
> >
> > Nevertheless, how do I get them to respond to this problem ?
> >
> >
> > --
> > Gak -
> > Finecats
> >
> >
> > "Kevin Hough [MSFT]" wrote:
> >
> >> Is this on XP/Server 2003 or Vista? Are you running out of paged memory
> >> or
> >> system PTEs?
> >>
> >> Check to see if you're booting with the /3GB switch in the boot string.
> >>
> >> Is PAE enabled? You can tell by checking which kernel image is loaded
> >> with
> >> the following debugger command:
> >>
> >> lm vm nt*
> >>
> >> Can you send the output from !vm debugger command entered just before you
> >> attempt to allocate memory to get an idea of how much memory is on the
> >> system and what's available at the point you're trying to load your
> >> driver?
> >>
> >> If your running out of system PTEs, check out the following link:
> >> http://msdn2.microsoft.com/en-us/library/ms793941.aspx
> >>
> >> Please send the output from "!sysptes 5" after you've set the value in
> >> the
> >> registry and rebooted.
> >>
> >> This posting is provided "AS IS" with no warranties, and confers no
> >> rights
>
>
>

a-kevhou
Thu Jun 28 18:26:09 CDT 2007

------=_NextPart_0001_3825BC93
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

Unfortunately, this probably isn't the right place to report such issues.
We can help you, as the driver writer, if your driver is having problems
handling low resource issues but I don't know how this newsgroup can help
with loading problems on a system.

This posting is provided "AS IS" with no warranties, and confers no rights.
------=_NextPart_0001_3825BC93
Content-Type: text/x-rtf
Content-Transfer-Encoding: 7bit

{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fnil\fprq2\fcharset0 MS Sans Serif;}}
\viewkind4\uc1\pard\f0\fs20 Unfortunately, this probably isn't the right place to report such issues. We can help you, as the driver writer, if your driver is having problems handling low resource issues but I don't know how this newsgroup can help with loading problems on a system.
\par
\par This posting is provided "AS IS" with no warranties, and confers no rights.
\par }
------=_NextPart_0001_3825BC93--