Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

intercept pagefile access

James_HarperJames_Harper Member Posts: 1,615
A followon from an earlier thread.

I want to be able to intercept pagefile writes and use an intermediate memory cache (not main memory - it's a pool of memory that is managed by Xen and shared amongst VM's) where possible. I wrote a proof-of-concept minifilter and logged pagefile reads and writes and notice that pagefile writes are always 64kb, and reads are always 4kb. This is under windows 2003. I also noted that the pages in the pagefile are sometimes read more than once, and sometimes written over without first being read. I understand the reasons why this would happen.

So I'm guessing that Windows optimistically writes out 64kb chunks when it needs to page something out, but reads in only what is required. And just because a page is written out to the pagefile doesn't mean it no longer exists in memory, just that it is available for eviction if required.

Is there a way for a driver to tell when Windows evicts a page from memory (because it is already written to the swapfile)? Or is this all "black box" stuff that I have no hope of gaining visibility to?

I can still go ahead with the pagefile filter approach, but it would mean that I'm using the xen provided memory store unnecessarily as the pages may still be in memory, and there is unlikely to be a gain in performance as my hit rate will be very low.

I'm thinking this is the end of the road for this idea...


Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA