none
DPC Stack size and switch RRS feed

  • Question

  • What is the size of the DPC stack?

    Also kernel always switches to the DPC stack from the current thread stack when handling medium and high importance DPCs?

    In my virtual PC, i could see the kernel was not switched immediately to DPC stack. I expected the switch to happen in nt!KiDispatchInterruptContinue but it happened in KxRetireDpcList. 

    DpcStack : 0xfffff800`03c31fb0 Void from PCRB
    Current thread Stack - Base fffff8800 2261000 Limit fffff880 0225b000

    Child-SP          RetAddr           :  Call Site
    fffff800`03c31fa8 fffff800`026d2905 :  nt!KiRetireDpcList
    fffff800`03c31fb0 fffff800`026d271c :  nt!KxRetireDpcList+0x5 (TrapFrame @ 
    fffff880`0225fd80 fffff800`0271545c :  nt!KiDispatchInterruptContinue
    fffff880`0225fdb0 fffff880`0183627b :  nt!KiDpcInterrupt+0xcc (TrapFrame @ 
    fffff880`0225ff40 fffff880`01835ef5 :  tcpip!UdpSendMessages+0x36b
    fffff880`02260330 fffff800`026dbefa :  tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x15
    fffff880`02260360 fffff880`018364b8 :  nt!KeExpandKernelStackAndCalloutEx+0xda
     


    • Edited by Boomi.s Monday, October 26, 2015 3:20 PM Updated Example
    Monday, October 26, 2015 3:00 PM

All replies

  • For which version of Windows? 32-bit or 64-bit?

    The DPC stack starts out the same size as any other kernel stack, which is processor architecture-specific. It is 12KB on x86, and 24KB on x64.

    Why do you care where it happens? What decision will this help you make?

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog


    Monday, October 26, 2015 7:03 PM
    Moderator
  • Thanks Brian.

    I just wanted to know the stack switching when handling the DPCs? Simply wanted to understand the flow..

    Monday, October 26, 2015 10:02 PM
  • Is there anyway to obtain the address of the Kernel Stack from a DPC stack when system crashes?
    Monday, October 26, 2015 11:14 PM
  • You don't need to worry about it; it will be done for you. By the way, if you try to change the stack yourself, you'll bugcheck the system. It happens in KiDispatchInterrupt

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Monday, October 26, 2015 11:15 PM
    Moderator
  • Which kernel stack? The last one used? For what purpose?

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Monday, October 26, 2015 11:17 PM
    Moderator