I've written an article before.Understanding Program Memory, which was mainly for the user state, the following a little further down:
we take 32-bit program as an example (do not enable AWE), a total of 4G virtual space, wherein the low 2G is the user state, high 2G belongs to the operating system kernel, each program has its own low 2G user space, high 2G kernel space is all programs shared. in high 2G kernel space, programs that belong to the same session share the same session space:
x86 system All memory is allocated at 64K boundary granularity, 4K page size.
user-state memory space, by usage can be divided into: image, mapped file, heap, stack, free, etc.According to the state can be divided into: free, reserved, commit;commit memory, when accessed may exist in a different state, may have been committed to physical memory (RAM), may be the form of a page file in the background, if it is the form of a page file, Access will trigger a page-break operation.
we often see a number of different memory terms in Task Manager or process Explorer:virtual memory for Size:reserve and commitPrivate Bytes: Dedicated virtual memory already in commitworking Set:commit The part of the virtual memory that has been loaded into physical memoryWS Private/Memory (dedicated working set): Working set that cannot be shared with other programs
What about the size of these memory relationships? The virtual size is certainly the largest; WS private is certainly the smallest, working set and private bytes are not large in size, because working set, while representing physical memory, contains both shared and unshared parts, Private Bytes, though it is virtual memory, contains only private parts. In addition, we usually see the program memory leaks, the main can see private bytes and WS private.
The virtual address used in our program, how does it not turn into a real physical address when it is accessed?
1. Our virtual address is divided into page Directory index, page table index, byte offset three parts2. According to the CR3 register to get the current Process page directory table address, according to the page directory index to get the page Catalog table item (PDE), then you can get the address of the page table3. Based on the page table index, get the address of the page table item (PTE) and then navigate to the page to access the real physical memory based on the offset bytes
The operating system uses the page-on-demand algorithm to implement memory access, which means that the system will actually access an address when the address will be transferred to a valid physical address, if the access failure, will trigger a page change exception, and then really load the page to physical memory. The system uses a balanced binary tree of virtual address descriptors (VAD, virtual addresses descriptor) to track all virtual memory to determine the state of all virtual memory (free, reserver, commit), and attributes.
below is the application layer access to program memory, according to the use of memory can be divided roughly:Image: Mainly refers to the binary module in memory mode, such as EXE and DLL, the corresponding API such as LoadLibrary. Mapped file: Mainly refers to memory map files, can be used to quickly load large files, or cross-process shared memory, the corresponding API such as createfilemapping.Stack : Each thread has its own stack, including the user-state stack and the kernel stack, although the stack memory allocation has a size limit, but is very efficient,The local variables of the function exist inside,The process of running a program (the process of calling a function) is actually the process of pressing the stack and out of the stack, and the size generally retains 1M by default (see How the thread stack grows )Heap: The system has its own heap manager, although the efficiency heap memory allocation is inefficient, but there is no size limit, the corresponding API such as new, malloc, HeapAlloc
operating system for our access to memory provides a variety of channels, we can choose according to their own needs, from the bottom up can be divided into:virtual Memory: Corresponding APIs such as VirtualAlloc (ex), VirtualFree (ex), VirtualLock, VirtualProtect, via these APIs, we can assign directly (Reserver, commit) Large chunks of memory (4K page size), along with the definition of modified page properties, is the most efficient way to allocate big memory. Win32 heap Memory: the corresponding API such as HeapCreate, HeapAlloc, heap memory based on virtual memory, many times we do not need virtual memory of large chunks of memory, only a small block of memory, the operating system through the heap manager to help us solve the problem. The system creates a default heap each time the process starts, and we can also create our own private heap, and whether sharing the same CRT heap between different modules depends on the compilation options of the module (seeWinDbg-based memory leak analysis)CRT Heap Memory: Our most commonly used memory allocation methods in C/s + + code are malloc and new, and typically malloc is only responsible for memory allocations, while new allocates memory to malloc while also having the ability to construct objects on allocated memory. As for the implementation of malloc, different compiler vendors will have different implementations, some may be implemented through the Win32 heap, or they may be implemented directly through the virtual memory API.
think about why you have the virtual memory API and the Win32 heap API, and the CRT heap API? one of the more classical words in software engineering is that any problem can be solved by adding an indirect layer. The APIs provided by the operating system are platform-dependent, platform-independent through the indirect layer of the CRT, and we can do a lot of things on this layer of indirection, such as memory leak tracking, implementing our own memory pool, etc.
If we call the virtual memory API directly to allocate memory, which type of memory is that? In fact, according to Vmmap, there are more memory types: Image, Mapped File, shareable, heap, Managed heap, Stack, Private Data, Page Table, unusable, Free.the memory allocated directly through VirtualAlloc does not belong to the heap and should belong to private Data.
Windows Memory Summary
