What Is Kernel Stack?

The kernel stack is a limited storage area that is used for information that is passed from one function to another and for local variable storage. The size of the stack can vary among different hardware platforms and different versions of the operating system, but it is always a scarce resource.

Although the stack is mapped into system space, it is considered part of the thread context of the original calling routine, not part of the driver itself. It is therefore guaranteed to be resident whenever the thread is running, but it can be swapped out along with the thread.

Because the kernel stack is associated with the thread context, functions such as IoGetRemainingStackSize (which returns the amount of kernel stack space that is currently available) and IoGetStackLimits (which returns the addresses of the stack) provide information about the kernel stack in the thread from which they are called. A driver can use these system routines to determine whether enough stack space remains to call a function to perform a task. If not, the driver can queue the task to a work item, which runs in a separate thread. The stack size and limit functions are useful primarily in file system drivers. Drivers for physical devices typically have shallow stack usage and therefore do not often require these functions.

Drivers should use the kernel stack conservatively. Heavily recursive functions that are passed many bytes of data can quickly deplete stack space and cause a system crash. Instead of passing large amounts of data, the driver should pass a pointer to the data.

On x64-based systems, Windows does not allow third-party software to allocate memory "on the side" and use it as a kernel stack. If the operating system detects one of these modifications or any other unauthorized patch, it generates a bug check and shuts down the system. To help ensure stability and reliability of the operating system and a better experience for customers, drivers for all platforms should avoid these practices.