Windows Driver Development Fundamentals (eight) memory management

Windows Driver Development Basic series, reprint please indicate source: http://blog.csdn.net/ikerpeng/article/details/38826159

For a 32-bit computer, he has 4G of real physical memory. But this is not enough, so introduced the concept of virtual memory. Enables each process to have 4G of virtual memory.

virtual Memory is actually a way of mapping. 4G of memory is actually paged. In general, the size of a page is 4K. It is also said to be divided into 1M pages. In so many pages, some of them correspond to physical memory (which can be many-to-one), some of which correspond to space on disk, but this part of the data is marked (Dirty), and part of it is empty!

I didn't find the right picture, huh?

The virtual memory low of 2G is called the user-mode address, and the high-level 2G is called the kernel-mode address. The kernel address mappings for all processes are exactly the same, and when the process switches, the mapping of the user-mode address is changed.

Windows the memory resources used by the driver are very valuable and should be saved as much as possible when allocating memory. As with applications, local variables are stored in the stack space. But the stack space is not as large as the application, so the driver is not suitable for recursive calls or local variables are large data structures. If large data structures are needed, we can apply them in the heap.

Windows specifies that some virtual memory pages can be swapped into files, which are called paged memory, and otherwise cannot be called: nonpaged memory.

When the program's interrupt request is dispatch_level or above, the program can only use non-paged memory, otherwise there will be a blue screen panic .

List of links used in Windows drivers:

For a single-linked list, next in each element points to the next element, and for a doubly linked list, there are two pointers in each element: Blink points to the previous element, and FLINK points to the latter element. Point to yourself when initializing. ：

Let's look at the structure of his body:

<span style= "Font-family:microsoft yahei;font-size:14px;" >typedef struct _list_entry {  struct _list_entry *flink;  struct _list_entry *blink;} List_entry, *plist_entry;</span>

There is no data defined in it, it is necessary for the program ape to define the type of each data.

For example:

typedef struct _mydatastruct{

List_entry ListEntry;

ULONG x;

ULONG y;

}mydatastruct,*pmydatastruct;

In our memory operations , if we frequently request memory, it will appear: empty problem, that is, our disk fragmentation. To avoid this problem, the driver uses the lookaside structure to handle it. He is like a memory container, first to Windows to request a larger area of memory, and then you can intelligently avoid the creation of empty situations.

run-time functions : Usually starting with RTL, which is essential when the program is running. Includes: Inter-memory replication (overlapping, non-overlapping), memory padding, memory comparisons, etc.

Finish this section!

Reference documents:

A detailed description of the Windows driver Development technology

Windows Driver Development Fundamentals (eight) memory management