-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
1/21
Microsoft Corporation 1
Windows Kernel InternalsAdvance Virtual Memory
David B. Probert, Ph.D.
Windows Kernel DevelopmentMicrosoft Corporation
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
2/21
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
3/21
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
4/21
Microsoft Corporation 4
PFN: Working Set Page
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
5/21
Microsoft Corporation 5
PFN: Free Page
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
6/21
Microsoft Corporation 6
PFN: Standby Page
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
7/21
Microsoft Corporation 7
PFN: Transition page
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
8/21
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
9/21
Microsoft Corporation 9
Page Table Entries
Some fields defined by hardware
Six PTE states: Active/valid
Transition Modified-no-write
Demand zero
Page file
Mapped file
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
10/21
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
11/21
Microsoft Corporation 11
x86 Invalid PTEs
Page file
Page file offset Protection PFN 031 12 11 10 9 5 4 1 0
0
TransitionPrototype
Transition
Page file offset Protection HW ctrl 0
31 12 11 10 9 5 4 1 0
1
Transition
Prototype
Cache disable
Write through
OwnerWrite
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
12/21
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
13/21
Microsoft Corporation 13
MMPAGING_FILE
PFN_NUMBER Size, MaxSize, MinSize,
FreeSpace, CurrUsage, PeekUsage,HighestPage
pFileObject
ModWriterMdlEntries[]
pPageFileName
pAllocationBitmap Flags:
PageFileNumber, RefCount, BootPart
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
14/21
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
15/21
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
16/21
Microsoft Corporation 16
MMVAD
MMADDRESS_NODEAddressTreeNode
pControlArea pFirstProtoPte
pLastContigPte
Flags:
CommitCharge, PhysMap, ImageMap, Awe, Prot,
MemCommit, Private, LargePages, WriteWatch,NoChange, FileOffset64k, SecNoChange, ReadOnly,
Extendable, Inherit, CopyOnWrite
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
17/21
Microsoft Corporation 17
CONTROL_AREA
pSegment
DereferenceListEntry[2] nSectRefs, nPfnRefs, nMapViews,
nCacheViews, nUserRefs
nModWrites, nFlushesActive, Flags
pFileObject
iPfnBase
Subsections[]
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
18/21
Microsoft Corporation 18
SUBSECTION
pControlArea
Flags: ReadOnly, ReadWrite, SubsectionStatic, GlobalMemory,
Protection, StartingSector, SectorEndOffset
StartingSector
nFullSectors pSubsectBasePtes
nUnusedPtes
nPtesInSubsection pNextSubsection
nMappedViews
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
19/21
Microsoft Corporation 19
SECTION
MMADDRESS_NODEAddressTreeNode
pSegment
Size
InitialPageProt
Flags: BeingDeleted, BeingCreated, BeingPurged, NoModifiedWriting,
FailAllIo, Image, Based, File, Networked, NoCache,PhysicalMemory, CopyOnWrite, Commit, FloppyMedia,WasPurged, UserReference, GlobalMemory, DeleteOnClose,
FilePointerNull, DebugSymbolsLoaded,SetMappedFileIoComplete, CollidedFlush, NoChange,HadUserReference, ImageMappedInSystemSpace,UserWritable, Accessed, GlobalOnlyPerSession, Rom
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
20/21
Microsoft Corporation 20
SEGMENT
pControlArea
nPtes
nWritableUserRefs
Size
PteTemplate nCommittedPages
Flags
BasedAddress PrototypePte
ProtoPtes[]
-
7/28/2019 Windows Kernel Internals Virtual Memory Manager.pdf
21/21
Microsoft Corporation 21
Discussion
