Windows® Internals, Sixth Edition, Part 2

You can look at the current usage and peak usage of each system virtual address type by using the kernel debugger. For each system virtual address type described in Table 10-9, the Mi-SystemVaTypeCount, MiSystemVaTypeCountFailures, and MiSystemVaTypeCountPeak arrays in the kernel contain the sizes, count failures, and peak sizes for each type. Here’s how you can dump the usage for the system, followed by the peak usage (you can use a similar technique for the failure counts):lkd> dd /c 1 MiSystemVaTypeCount l c 81f4f880 00000000 81f4f884 00000028 81f4f888 00000008 81f4f88c 0000000c 81f4f890 0000000b 81f4f894 0000001a 81f4f898 0000002f 81f4f89c 00000000 81f4f8a0 000001b6 81f4f8a4 00000030 81f4f8a8 00000002 81f4f8ac 00000006 lkd> dd /c 1 MiSystemVaTypeCountPeak l c 81f4f840 00000000 81f4f844 00000038 81f4f848 00000000 81f4f84c 00000000 81f4f850 0000003d 81f4f854 0000001e 81f4f858 00000032 81f4f85c 00000000 81f4f860 00000238 81f4f864 00000031 81f4f868 00000000 81f4f86c 00000006

Theoretically, the different virtual address ranges assigned to components can grow arbitrarily in size as long as enough system virtual address space is available. In practice, on 32-bit systems, the kernel allocator implements the ability to set limits on each virtual address type for the purposes of both reliability and stability. (On 64-bit systems, kernel address space exhaustion is currently not a concern.) Although no limits are imposed by default, system administrators can use the registry to modify these limits for the virtual address types that are currently marked as limitable (see Table 10-9).

If the current request during the MiObtainSystemVa call exceeds the available limit, a failure is marked (see the previous experiment) and a reclaim operation is requested regardless of available memory. This should help alleviate memory load and might allow the virtual address allocation to work during the next attempt. (Recall, however, that reclaiming affects only system cache and nonpaged pool).

EXPERIMENT: Setting System Virtual Address Limits

The MiSystemVaTypeCountLimit array contains limitations for system virtual address usage that can be set for each type. Currently, the memory manager allows only certain virtual address types to be limited, and it provides the ability to use an undocumented system call to set limits for the system dynamically during run time. (These limits can also be set through the registry, as described at http://msdn.microsoft.com/en-us/library/bb870880(VS.85).aspx.) These limits can be set for those types marked in Table 10-9.

You can use the MemLimit utility (http://www.winsiderss.com/tools/memlimit.html) from Winsider Seminars & Solutions to query and set the different limits for these types, and also to see the current and peak virtual address space usage. Here’s how you can query the current limits with the –q flag:C:\ >memlimit.exe -q MemLimit v1.00 - Query and set hard limits on system VA space consumption Copyright (C) 2008 Alex Ionescu www.alex-ionescu.com System Va Consumption: Type Current Peak Limit Non Paged Pool 102400 KB 0 KB 0 KB Paged Pool 59392 KB 83968 KB 0 KB System Cache 534528 KB 536576 KB 0 KB System PTEs 73728 KB 75776 KB 0 KB Session Space 75776 KB 90112 KB 0 KB

As an experiment, use the following command to set a limit of 100 MB for paged pool:memlimit.exe -p 100M

And now try running the testlimit –h experiment from Chapter 3 (in Part 1) again, which attempted to create 16 million handles. Instead of reaching the 16 million handle count, the process will fail, because the system will have run out of address space available for paged pool allocations.

System Virtual Address Space Quotas

The system virtual address space limits described in the previous section allow for limiting systemwide virtual address space usage of certain kernel components, but they work only on 32-bit systems when applied to the system as a whole. To address more specific quota requirements that system administrators might have, the memory manager also collaborates with the process manager to enforce either systemwide or user-specific quotas for each process.