Memory related questions

[Deepakumar]

I have some memory related questions:

1. Is the object and handle allocated from paged/nonpaged pool? If yes, any
tag will be there to track?

2. Can any allocation be there in paged/nonpaged memory without tag (even
without wdm/ddk tag)?

3. If any handle/object leakage is there, can we catch this with Driver
Verfier? I saw that Driver verfier could not find one object leakage (I
selected only my driver in Driver Verifier). Or should I select any microsoft
driver to catch this?

4. If I map user buffer to a kernel addres space, does it map to the paged
memory address or some where else? If yes, does it have any tag?

Regards,
Deepakumar

[Maxim S. Shatskih]

> 1. Is the object and handle allocated from paged/nonpaged pool? If yes, any
> tag will be there to track?

Don't remember whether handle table is paged, probably yes.

The objects? depend on particular type. The tag names are the first 4 chars of
the type name - 'Devi' for Device etc.

> 2. Can any allocation be there in paged/nonpaged memory without tag (even
> without wdm/ddk tag)?

No. Default tag is substituted.

Mapped user buffers are not pool at all, and they are nonpaged.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
ma...@storagecraft.com
http://www.storagecraft.com

[Deepakumar]

Thanks Maxim,

>
> > 2. Can any allocation be there in paged/nonpaged memory without tag (even
> > without wdm/ddk tag)?
>
> No. Default tag is substituted.
>

I asked this because I saw a contradictory measurement on memory allocation
in paged pool. The !vm shows that memory allocated in paged pool is 160MB
PagedPool Usage: 40960 ( 163840 Kb)
But the sum of all the paged pool used (!poolused 4) gives around 125MB. So
where is the remaning 35Mb?

> Mapped user buffers are not pool at all, and they are nonpaged.
>

Then in which kernel address space they are getting mapped?

[Maxim S. Shatskih]

> > Mapped user buffers are not pool at all, and they are nonpaged.
> >
> Then in which kernel address space they are getting mapped?

In the system PTEs area, same as used by MmMapIoSpace.

[Sam B]

I'm responding in case your "where is the remaining 35Mb?" question wasn't
answered. I asked a question in microsoft.public.win32.programmer.kernel that
may directly relate to yours. At the system level perfmon and taskmanager
were reporting 21MB of nonpaged memory used, but the total of nonpaged memory
of all tags in poolmon was 16MB. I couldn't account for the missing 5MB.
Pavel Lebedinsky [MSFT] posted this response:

"I believe poolmon shows the total allocated size, while perfmon/taskmgr
report the total consumed pool memory, which includes pool structures,
fragmented unused space, etc."

So maybe !poolused shows the total allocated size while !vm reports the
total consumed pool memory, which includes pool structures, fragmented unused
space, etc.