A followon from an earlier thread.
I want to be able to intercept pagefile writes and use an intermediate memory cache (not main memory - it’s a pool of memory that is managed by Xen and shared amongst VM’s) where possible. I wrote a proof-of-concept minifilter and logged pagefile reads and writes and notice that pagefile writes are always 64kb, and reads are always 4kb. This is under windows 2003. I also noted that the pages in the pagefile are sometimes read more than once, and sometimes written over without first being read. I understand the reasons why this would happen.
So I’m guessing that Windows optimistically writes out 64kb chunks when it needs to page something out, but reads in only what is required. And just because a page is written out to the pagefile doesn’t mean it no longer exists in memory, just that it is available for eviction if required.
Is there a way for a driver to tell when Windows evicts a page from memory (because it is already written to the swapfile)? Or is this all “black box” stuff that I have no hope of gaining visibility to?
I can still go ahead with the pagefile filter approach, but it would mean that I’m using the xen provided memory store unnecessarily as the pages may still be in memory, and there is unlikely to be a gain in performance as my hit rate will be very low.
I’m thinking this is the end of the road for this idea…
Thanks
James