7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

1/21

Microsoft Corporation 1

Windows Kernel InternalsAdvance Virtual Memory

David B. Probert, Ph.D.

Windows Kernel DevelopmentMicrosoft Corporation

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

2/21

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

3/21

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

4/21

Microsoft Corporation 4

PFN: Working Set Page

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

5/21

Microsoft Corporation 5

PFN: Free Page

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

6/21

Microsoft Corporation 6

PFN: Standby Page

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

7/21

Microsoft Corporation 7

PFN: Transition page

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

8/21

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

9/21

Microsoft Corporation 9

Page Table Entries

Some fields defined by hardware

Six PTE states: Active/valid

Transition Modified-no-write

Demand zero

Page file

Mapped file

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

10/21

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

11/21

Microsoft Corporation 11

x86 Invalid PTEs

Page file

Page file offset Protection PFN 031 12 11 10 9 5 4 1 0

0

TransitionPrototype

Transition

Page file offset Protection HW ctrl 0

31 12 11 10 9 5 4 1 0

1

Transition

Prototype

Cache disable

Write through

OwnerWrite

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

12/21

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

13/21

Microsoft Corporation 13

MMPAGING_FILE

PFN_NUMBER Size, MaxSize, MinSize,

FreeSpace, CurrUsage, PeekUsage,HighestPage

pFileObject

ModWriterMdlEntries[]

pPageFileName

pAllocationBitmap Flags:

PageFileNumber, RefCount, BootPart

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

14/21

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

15/21

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

16/21

Microsoft Corporation 16

MMVAD

MMADDRESS_NODEAddressTreeNode

pControlArea pFirstProtoPte

pLastContigPte

Flags:

CommitCharge, PhysMap, ImageMap, Awe, Prot,

MemCommit, Private, LargePages, WriteWatch,NoChange, FileOffset64k, SecNoChange, ReadOnly,

Extendable, Inherit, CopyOnWrite

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

17/21

Microsoft Corporation 17

CONTROL_AREA

pSegment

DereferenceListEntry[2] nSectRefs, nPfnRefs, nMapViews,

nCacheViews, nUserRefs

nModWrites, nFlushesActive, Flags

pFileObject

iPfnBase

Subsections[]

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

18/21

Microsoft Corporation 18

SUBSECTION

pControlArea

Flags: ReadOnly, ReadWrite, SubsectionStatic, GlobalMemory,

Protection, StartingSector, SectorEndOffset

StartingSector

nFullSectors pSubsectBasePtes

nUnusedPtes

nPtesInSubsection pNextSubsection

nMappedViews

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

19/21

Microsoft Corporation 19

SECTION

MMADDRESS_NODEAddressTreeNode

pSegment

Size

InitialPageProt

Flags: BeingDeleted, BeingCreated, BeingPurged, NoModifiedWriting,

FailAllIo, Image, Based, File, Networked, NoCache,PhysicalMemory, CopyOnWrite, Commit, FloppyMedia,WasPurged, UserReference, GlobalMemory, DeleteOnClose,

FilePointerNull, DebugSymbolsLoaded,SetMappedFileIoComplete, CollidedFlush, NoChange,HadUserReference, ImageMappedInSystemSpace,UserWritable, Accessed, GlobalOnlyPerSession, Rom

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

20/21

Microsoft Corporation 20

SEGMENT

pControlArea

nPtes

nWritableUserRefs

Size

PteTemplate nCommittedPages

Flags

BasedAddress PrototypePte

ProtoPtes[]

7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf

21/21

Microsoft Corporation 21

Discussion