Windows® Internals, Sixth Edition, Part 2

You can view session space memory utilization with the !vm 4 command in the kernel debugger. For example, the following output was taken from a 32-bit Windows client system with the default two sessions created at system startup:lkd> !vm 4 . . Terminal Server Memory Usage By Session: Session ID 0 @ 9a8c7000: Paged Pool Usage: 2372K Commit Usage: 4832K Session ID 1 @ 9a881000: Paged Pool Usage: 14120K Commit Usage: 16704K

System Page Table Entries

System page table entries (PTEs) are used to dynamically map system pages such as I/O space, kernel stacks, and the mapping for memory descriptor lists. System PTEs aren’t an infinite resource. On 32-bit Windows, the number of available system PTEs is such that the system can theoretically describe 2 GB of contiguous system virtual address space. On 64-bit Windows, system PTEs can describe up to 128 GB of contiguous virtual address space.

EXPERIMENT: Viewing System PTE Information

You can see how many system PTEs are available by examining the value of the Memory: Free System Page Table Entries counter in Performance Monitor or by using the !sysptes or !vm command in the debugger. You can also dump the _MI_SYSTEM_PTE_TYPE structure associated with the MiSystemPteInfo global variable. This will also show you how many PTE allocation failures occurred on the system—a high count indicates a problem and possibly a system PTE leak.0: kd> !sysptes System PTE Information Total System Ptes 307168 starting PTE: c0200000 free blocks: 32 total free: 3856 largest free block: 542 Kernel Stack PTE Information Unable to get syspte index array - skipping bins starting PTE: c0200000 free blocks: 165 total free: 1503 largest free block: 75 0: kd> ? nt!MiSystemPteInfo Evaluate expression: -2100014016 = 82d45440 0: kd> dt _MI_SYSTEM_PTE_TYPE 82d45440 nt!_MI_SYSTEM_PTE_TYPE +0x000 Bitmap : _RTL_BITMAP +0x008 Flags : 3 +0x00c Hint : 0x2271f +0x010 BasePte : 0xc0200000 _MMPTE +0x014 FailureCount : 0x82d45468 -> 0 +0x018 Vm : 0x82d67300 _MMSUPPORT +0x01c TotalSystemPtes : 0n7136 +0x020 TotalFreeSystemPtes : 0n4113 +0x024 CachedPteCount : 0n0 +0x028 PteFailures : 0 +0x02c SpinLock : 0 +0x02c GlobalMutex : (null)

If you are seeing lots of system PTE failures, you can enable system PTE tracking by creating a new DWORD value in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management key called TrackPtes and setting its value to 1. You can then use !sysptes 4 to show a list of allocators, as shown here:lkd>!sysptes 4 0x1ca2 System PTEs allocated to mapping locked pages VA MDL PageCount Caller/CallersCaller ecbfdee8 f0ed0958 2 netbt!DispatchIoctls+0x56a/netbt!NbtDispatchDevCtrl+0xcd f0a8d050 f0ed0510 1 netbt!DispatchIoctls+0x64e/netbt!NbtDispatchDevCtrl+0xcd ecef5000 1 20 nt!MiFindContiguousMemory+0x63 ed447000 0 2 Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95 ee1ce000 0 2 Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95 ed9c4000 1 ca nt!MiFindContiguousMemory+0x63 eda8e000 1 ca nt!MiFindContiguousMemory+0x63 efb23d68 f8067888 2 mrxsmb!BowserMapUsersBuffer+0x28 efac5af4 f8b15b98 2 ndisuio!NdisuioRead+0x54/nt!NtReadFile+0x566 f0ac688c f848ff88 1 ndisuio!NdisuioRead+0x54/nt!NtReadFile+0x566 efac7b7c f82fc2a8 2 ndisuio!NdisuioRead+0x54/nt!NtReadFile+0x566 ee4d1000 1 38 nt!MiFindContiguousMemory+0x63 efa4f000 0 2 Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95 efa53000 0 2 Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95 eea89000 0 1 TDI!DllInitialize+0x4f/nt!MiResolveImageReferences+0x4bc ee798000 1 20 VIDEOPRT!pVideoPortGetDeviceBase+0x1f1 f0676000 1 10 hal!HalpGrowMapBuffers+0x134/hal!HalpAllocateAdapterEx+0x1ff f0b75000 1 1 cpqasm2+0x2af67/cpqasm2+0x7847 f0afa000 1 1 cpqasm2+0x2af67/cpqasm2+0x6d82

64-Bit Address Space Layouts

The theoretical 64-bit virtual address space is 16 exabytes (18,446,744,073,709,551,616 bytes, or approximately 18.44 billion billion bytes). Unlike on x86 systems, where the default address space is divided in two parts (half for a process and half for the system), the 64-bit address is divided into a number of different size regions whose components match conceptually the portions of user, system, and session space. The various sizes of these regions, listed in Table 10-8, represent current implementation limits that could easily be extended in future releases. Clearly, 64 bits provides a tremendous leap in terms of address space sizes.