Usage of nonpaged pool and paged pool in Windows

Many DBAs are confused about how to use nonpage pool and paged pool. Find a document and translate it.

From: http://blogs.technet.com/ B /markrussinovich/archive/2009/03/26/3211216.aspx

Nonpaged pool(Non-Paging pool)

The kernel and device drivers use nonpaged pool to store data that might be accessed when the system can't handle page faults. the kernel enters such a state when it executes interrupt service routines (ISRs) and deferred procedure CILS (dpcs), which are functions related to hardware interrupts. page faults are also illegal when the kernel or a device driver acquires a spin lock, which, because they are the only type of lock that can be used within ISRs and dpcs, must be used to protect data structures that are accessed from within ISRs or dpcs and either other ISRs or dpcs or code executing on Kernel threads. failure by a driver to honor these rules results in the most common crash code, irql_not_less_or_equal.

The kernel or device driver uses a non-Paging pool to store the data that may be accessed, but it cannot be accessed with errors. When the kernel executes the interrupted service program and delays the call process, it enters this state, which is associated with the disconnection in the hardware. When the kernel or device driver is in this status, it gets a spin lock and page errors are not allowed, the spin lock is the only lock type that can be used in delayed calls or service interruption programs. It is used to protect data accessed by delayed process calls and service interruption programs, it may come from delayed process calls and service interruption programs, other delayed process calls and service interruption programs, or other kernel threads. If the driver fails to execute the entire rule, it will get an irql_not_less_or_equal crash code.

Nonpaged pool is therefore always kept present in physical memory and nonpaged pool virtual memory is assigned physical memory. common system data structures stored in nonpaged pool include the kernel and objects that represent processes and threads, synchronization objects like mutexes, semaphores and events, references to files, which are represented as file objects, and I/O request packets (IRPs), which represent I/O operations.

The non-Paging pool always reports an error in the memory. The virtual address of the non-Paging pool is allocated by the physical address. The general system data structure is stored in a non-Paging pool that contains the kernel and Objects representing processes and threads, mutex objects, synchronous semaphores, and referenced files (representing file objects ), and I/O request packets (For I/O operations)

Paged pool (Paging pool)

Paged pool, on the other hand, gets its name from the fact that Windows can write the data it stores to the paging file, allowing the physical memory it occupies to be repurposed. just as for user-mode virtual memory, when a driver or the system references paged pool memory that's in the paging file, an operation called a page fault occurs, and the memory manager reads the data back into physical memory. the largest consumer of paged pool, at least on Windows Vista and later, is typically the registry, since references to registry keys and other registry data structures are stored in paged pool. the data structures that represent memory mapped files, calledSectionsInternally, are also stored in paged pool.

The paging pool, literally, can be stored in the system's paging file, allowing physical memory redirection. For example, if a user-mode virtual memory exists in a paging file in the drive or system reference paging pool, an operation will call a page error, the Memory Management System reads data from paging files to the physical memory. In Windows Vista and later versions, the largest user in the paging pool is the registry. The referenced registry key values and other registry data are stored in the paging pool. Memory ing files (internally called memory objects [sections]) also exist in the paging pool.

 

Device drivers use the exallocatepoolwithtag API to allocate nonpaged and paged pool, specifying the type of pool desired as one of the parameters. Another parameter is a 4-byteTag, Which drivers are supposed to use to uniquely identify the memory they allocate, and that can be a useful key for tracking down drivers that leak pool, as I'll show later.

The device driver can use the exallocatepoolwithtag API to apply for non-Paging pool and paging pool. You can use parameters to specify the type of pool application. Another parameter is a four-byte tag that uniquely identifies the driver for memory allocation and is useful in tracking whether the driver lacks a pool.