FOR FAQ: Re: Context switching ... (now double fault)

A double fault occurs as a result of a driver (usually a filesystem
filter driver or filesystem driver) overflowing the kernel stack. You
will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
parameter as 0x00000008. From the DDK:

"0x00000008, or Double Fault, is when an exception occurs while trying
to call the handler for a prior exception. Normally, the two exceptions
can be handled serially. However, there are several exceptions that
cannot be handled serially, and in this situation the processor signals
a double fault. There are two common causes of a double fault:

  1. A kernel stack overflow. This occurs when a guard page is hit, and
    then the kernel tries to push a trap frame. Since there is no stack
    left, a stack overflow results, causing the double fault. If you suspect
    this has occurred, use the !thread debugger extension to determine the
    stack limits, and then use the KB (Display Stack Backtrace) debugger
    command with a large parameter (for example, kb 100) to display the full
    stack.

  2. A hardware problem."

Prokash Sinha wrote:

Nick,

Is it the reason that a double fault would occur, if the directories
are paged out !!!

-prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 1:33 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Re: Context switching …

Page tables can be paged out, but page directories cannot be.

James Antognini wrote:

>I believe page tables are themselves pageable. That suggests very strongly

that

>if their storage is stolen and they are paged back in, they will assume a
>possibly different storage location.
>
>Nick Ryan wrote:
>
>
>
>>From what I understand, all page table directories for all processes
>>exist at different kernel-mode addresses simultaneously.
>
>
>–
>If replying by e-mail, please remove “nospam.” from the address.
>
>James Antognini
>Windows DDK MVP
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

Thanx again.

But is it possible to have a pagefault, while we are in a pagefault ?

-prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 3:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)

A double fault occurs as a result of a driver (usually a filesystem
filter driver or filesystem driver) overflowing the kernel stack. You
will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
parameter as 0x00000008. From the DDK:

"0x00000008, or Double Fault, is when an exception occurs while trying
to call the handler for a prior exception. Normally, the two exceptions
can be handled serially. However, there are several exceptions that
cannot be handled serially, and in this situation the processor signals
a double fault. There are two common causes of a double fault:

  1. A kernel stack overflow. This occurs when a guard page is hit, and
    then the kernel tries to push a trap frame. Since there is no stack
    left, a stack overflow results, causing the double fault. If you suspect
    this has occurred, use the !thread debugger extension to determine the
    stack limits, and then use the KB (Display Stack Backtrace) debugger
    command with a large parameter (for example, kb 100) to display the full
    stack.

  2. A hardware problem."

Prokash Sinha wrote:

Nick,

Is it the reason that a double fault would occur, if the directories
are paged out !!!

-prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 1:33 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Re: Context switching …

Page tables can be paged out, but page directories cannot be.

James Antognini wrote:

>I believe page tables are themselves pageable. That suggests very strongly

that

>if their storage is stolen and they are paged back in, they will assume a
>possibly different storage location.
>
>Nick Ryan wrote:
>
>
>
>>From what I understand, all page table directories for all processes
>>exist at different kernel-mode addresses simultaneously.
>
>
>–
>If replying by e-mail, please remove “nospam.” from the address.
>
>James Antognini
>Windows DDK MVP
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

That type of ‘double-fault’ can be handled, depending on the situation.
If the page fault occurs on a memory-mapped file and Mm calls back into
the FSD, and the FSD then faults again accessing paged memory backed by
the swap file, this second fault is perfectly legal. For obvious
reasons, of course, you can’t fault on the same entity that you are
already handling a fault on (which is why an FSD or filter can’t touched
paged pool on the paging file I/O path).

Prokash Sinha wrote:

Thanx again.

But is it possible to have a pagefault, while we are in a pagefault ?

-prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 3:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)

A double fault occurs as a result of a driver (usually a filesystem
filter driver or filesystem driver) overflowing the kernel stack. You
will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
parameter as 0x00000008. From the DDK:

"0x00000008, or Double Fault, is when an exception occurs while trying
to call the handler for a prior exception. Normally, the two exceptions
can be handled serially. However, there are several exceptions that
cannot be handled serially, and in this situation the processor signals
a double fault. There are two common causes of a double fault:

  1. A kernel stack overflow. This occurs when a guard page is hit, and
    then the kernel tries to push a trap frame. Since there is no stack
    left, a stack overflow results, causing the double fault. If you suspect
    this has occurred, use the !thread debugger extension to determine the
    stack limits, and then use the KB (Display Stack Backtrace) debugger
    command with a large parameter (for example, kb 100) to display the full
    stack.

  2. A hardware problem."

Prokash Sinha wrote:

>Nick,
>
>Is it the reason that a double fault would occur, if the directories
>are paged out !!!
>
>-prokash
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>Sent: Thursday, July 24, 2003 1:33 PM
>To: Windows System Software Developers Interest List
>Subject: [ntdev] Re: Context switching …
>
>
>Page tables can be paged out, but page directories cannot be.
>
>James Antognini wrote:
>
>
>
>>I believe page tables are themselves pageable. That suggests very strongly
>
>that
>
>
>>if their storage is stolen and they are paged back in, they will assume a
>>possibly different storage location.
>>
>>Nick Ryan wrote:
>>
>>
>>
>>>From what I understand, all page table directories for all processes
>>
>>>exist at different kernel-mode addresses simultaneously.
>>
>>
>>–
>>If replying by e-mail, please remove “nospam.” from the address.
>>
>>James Antognini
>>Windows DDK MVP
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
>–
>- Nick Ryan (MVP for DDK)
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

Yes I am rusty on this, and still not clear ( about the page directories,
and tables).
Given a logical(linear) addr, h/w MMU unit would raise a flag if the
pagetable containing
directory info is not resident !!!, pagefault handler would field this
fault!!, bring the
page from the system page file ( no file specific mem map, it is the page
file we often
modify the size of for different options of krnl dump ??? ), now while the
page is fetched, it
is a directory, so we need to get the pagetable, then another fault from
pagetable to actual page
(assuming one lvl of indirection) …

By your logic it seems like this could be handled, may be just the
performance reason to have the
directory and resident all the time!!.

If pagetable is pageable, (w/one level of inderection), we may have another
actual page to bring in
so then it answers my question…

thanx
prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 3:49 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

That type of ‘double-fault’ can be handled, depending on the situation.
If the page fault occurs on a memory-mapped file and Mm calls back into
the FSD, and the FSD then faults again accessing paged memory backed by
the swap file, this second fault is perfectly legal. For obvious
reasons, of course, you can’t fault on the same entity that you are
already handling a fault on (which is why an FSD or filter can’t touched
paged pool on the paging file I/O path).

Prokash Sinha wrote:

Thanx again.

But is it possible to have a pagefault, while we are in a pagefault ?

-prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 3:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)

A double fault occurs as a result of a driver (usually a filesystem
filter driver or filesystem driver) overflowing the kernel stack. You
will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
parameter as 0x00000008. From the DDK:

"0x00000008, or Double Fault, is when an exception occurs while trying
to call the handler for a prior exception. Normally, the two exceptions
can be handled serially. However, there are several exceptions that
cannot be handled serially, and in this situation the processor signals
a double fault. There are two common causes of a double fault:

  1. A kernel stack overflow. This occurs when a guard page is hit, and
    then the kernel tries to push a trap frame. Since there is no stack
    left, a stack overflow results, causing the double fault. If you suspect
    this has occurred, use the !thread debugger extension to determine the
    stack limits, and then use the KB (Display Stack Backtrace) debugger
    command with a large parameter (for example, kb 100) to display the full
    stack.

  2. A hardware problem."

Prokash Sinha wrote:

>Nick,
>
>Is it the reason that a double fault would occur, if the directories
>are paged out !!!
>
>-prokash
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>Sent: Thursday, July 24, 2003 1:33 PM
>To: Windows System Software Developers Interest List
>Subject: [ntdev] Re: Context switching …
>
>
>Page tables can be paged out, but page directories cannot be.
>
>James Antognini wrote:
>
>
>
>>I believe page tables are themselves pageable. That suggests very
strongly
>
>that
>
>
>>if their storage is stolen and they are paged back in, they will assume a
>>possibly different storage location.
>>
>>Nick Ryan wrote:
>>
>>
>>
>>>From what I understand, all page table directories for all processes
>>
>>>exist at different kernel-mode addresses simultaneously.
>>
>>
>>–
>>If replying by e-mail, please remove “nospam.” from the address.
>>
>>James Antognini
>>Windows DDK MVP
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
>–
>- Nick Ryan (MVP for DDK)
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The page directories cannot be paged out. Not all virtual memory pages
in the system are backed by the page file - NonPaged pool, for instance.
The scenario you are describing is simply not possible.

Prokash Sinha wrote:

Yes I am rusty on this, and still not clear ( about the page directories,
and tables).
Given a logical(linear) addr, h/w MMU unit would raise a flag if the
pagetable containing
directory info is not resident !!!, pagefault handler would field this
fault!!, bring the
page from the system page file ( no file specific mem map, it is the page
file we often
modify the size of for different options of krnl dump ??? ), now while the
page is fetched, it
is a directory, so we need to get the pagetable, then another fault from
pagetable to actual page
(assuming one lvl of indirection) …

By your logic it seems like this could be handled, may be just the
performance reason to have the
directory and resident all the time!!.

If pagetable is pageable, (w/one level of inderection), we may have another
actual page to bring in
so then it answers my question…

thanx
prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 3:49 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

That type of ‘double-fault’ can be handled, depending on the situation.
If the page fault occurs on a memory-mapped file and Mm calls back into
the FSD, and the FSD then faults again accessing paged memory backed by
the swap file, this second fault is perfectly legal. For obvious
reasons, of course, you can’t fault on the same entity that you are
already handling a fault on (which is why an FSD or filter can’t touched
paged pool on the paging file I/O path).

Prokash Sinha wrote:

>Thanx again.
>
>But is it possible to have a pagefault, while we are in a pagefault ?
>
>-prokash
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>Sent: Thursday, July 24, 2003 3:04 PM
>To: Windows System Software Developers Interest List
>Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)
>
>
>A double fault occurs as a result of a driver (usually a filesystem
>filter driver or filesystem driver) overflowing the kernel stack. You
>will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
>parameter as 0x00000008. From the DDK:
>
>“0x00000008, or Double Fault, is when an exception occurs while trying
>to call the handler for a prior exception. Normally, the two exceptions
>can be handled serially. However, there are several exceptions that
>cannot be handled serially, and in this situation the processor signals
>a double fault. There are two common causes of a double fault:
>
>1. A kernel stack overflow. This occurs when a guard page is hit, and
>then the kernel tries to push a trap frame. Since there is no stack
>left, a stack overflow results, causing the double fault. If you suspect
>this has occurred, use the !thread debugger extension to determine the
>stack limits, and then use the KB (Display Stack Backtrace) debugger
>command with a large parameter (for example, kb 100) to display the full
>stack.
>
>2. A hardware problem.”
>
>Prokash Sinha wrote:
>
>
>
>>Nick,
>>
>>Is it the reason that a double fault would occur, if the directories
>>are paged out !!!
>>
>>-prokash
>>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>>Sent: Thursday, July 24, 2003 1:33 PM
>>To: Windows System Software Developers Interest List
>>Subject: [ntdev] Re: Context switching …
>>
>>
>>Page tables can be paged out, but page directories cannot be.
>>
>>James Antognini wrote:
>>
>>
>>
>>
>>>I believe page tables are themselves pageable. That suggests very

strongly

>>that
>>
>>
>>
>>>if their storage is stolen and they are paged back in, they will assume a
>>>possibly different storage location.
>>>
>>>Nick Ryan wrote:
>>>
>>>
>>>
>>>>From what I understand, all page table directories for all processes
>>>
>>>
>>>>exist at different kernel-mode addresses simultaneously.
>>>
>>>
>>>–
>>>If replying by e-mail, please remove “nospam.” from the address.
>>>
>>>James Antognini
>>>Windows DDK MVP
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>
>>
>>–
>>- Nick Ryan (MVP for DDK)
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
>–
>- Nick Ryan (MVP for DDK)
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

I think I’m not clear enough. But for sure, why would anyone
have a backup file for nonpaged pool, no need ???

I’m asking this to clarify myself, what is the reason that
a paging directory can not be pageable. There must be a reason (either
the h/w with the handler would not handle it, due to, who knows, nested
page faults?? or just perf reason !!!

thanx
prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 5:30 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

The page directories cannot be paged out. Not all virtual memory pages
in the system are backed by the page file - NonPaged pool, for instance.
The scenario you are describing is simply not possible.

Prokash Sinha wrote:

Yes I am rusty on this, and still not clear ( about the page directories,
and tables).
Given a logical(linear) addr, h/w MMU unit would raise a flag if the
pagetable containing
directory info is not resident !!!, pagefault handler would field this
fault!!, bring the
page from the system page file ( no file specific mem map, it is the page
file we often
modify the size of for different options of krnl dump ??? ), now while the
page is fetched, it
is a directory, so we need to get the pagetable, then another fault from
pagetable to actual page
(assuming one lvl of indirection) …

By your logic it seems like this could be handled, may be just the
performance reason to have the
directory and resident all the time!!.

If pagetable is pageable, (w/one level of inderection), we may have
another
actual page to bring in
so then it answers my question…

thanx
prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 3:49 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

That type of ‘double-fault’ can be handled, depending on the situation.
If the page fault occurs on a memory-mapped file and Mm calls back into
the FSD, and the FSD then faults again accessing paged memory backed by
the swap file, this second fault is perfectly legal. For obvious
reasons, of course, you can’t fault on the same entity that you are
already handling a fault on (which is why an FSD or filter can’t touched
paged pool on the paging file I/O path).

Prokash Sinha wrote:

>Thanx again.
>
>But is it possible to have a pagefault, while we are in a pagefault ?
>
>-prokash
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>Sent: Thursday, July 24, 2003 3:04 PM
>To: Windows System Software Developers Interest List
>Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)
>
>
>A double fault occurs as a result of a driver (usually a filesystem
>filter driver or filesystem driver) overflowing the kernel stack. You
>will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
>parameter as 0x00000008. From the DDK:
>
>“0x00000008, or Double Fault, is when an exception occurs while trying
>to call the handler for a prior exception. Normally, the two exceptions
>can be handled serially. However, there are several exceptions that
>cannot be handled serially, and in this situation the processor signals
>a double fault. There are two common causes of a double fault:
>
>1. A kernel stack overflow. This occurs when a guard page is hit, and
>then the kernel tries to push a trap frame. Since there is no stack
>left, a stack overflow results, causing the double fault. If you suspect
>this has occurred, use the !thread debugger extension to determine the
>stack limits, and then use the KB (Display Stack Backtrace) debugger
>command with a large parameter (for example, kb 100) to display the full
>stack.
>
>2. A hardware problem.”
>
>Prokash Sinha wrote:
>
>
>
>>Nick,
>>
>>Is it the reason that a double fault would occur, if the directories
>>are paged out !!!
>>
>>-prokash
>>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>>Sent: Thursday, July 24, 2003 1:33 PM
>>To: Windows System Software Developers Interest List
>>Subject: [ntdev] Re: Context switching …
>>
>>
>>Page tables can be paged out, but page directories cannot be.
>>
>>James Antognini wrote:
>>
>>
>>
>>
>>>I believe page tables are themselves pageable. That suggests very

strongly

>>that
>>
>>
>>
>>>if their storage is stolen and they are paged back in, they will assume
a
>>>possibly different storage location.
>>>
>>>Nick Ryan wrote:
>>>
>>>
>>>
>>>>From what I understand, all page table directories for all processes
>>>
>>>
>>>>exist at different kernel-mode addresses simultaneously.
>>>
>>>
>>>–
>>>If replying by e-mail, please remove “nospam.” from the address.
>>>
>>>James Antognini
>>>Windows DDK MVP
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>
>>
>>–
>>- Nick Ryan (MVP for DDK)
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
>–
>- Nick Ryan (MVP for DDK)
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The page directory has entries that map back to itself (possible because
the format of page table entries and page directory entries are
compatible). There are special bits in the PDE/PTE that mark a page as
being backed by a page file. When Windows builds up the entries for the
page directory, I assume it doesn’t set these bits, indicating that the
page directory itself cannot be paged out.

Prokash Sinha wrote:

I think I’m not clear enough. But for sure, why would anyone
have a backup file for nonpaged pool, no need ???

I’m asking this to clarify myself, what is the reason that
a paging directory can not be pageable. There must be a reason (either
the h/w with the handler would not handle it, due to, who knows, nested
page faults?? or just perf reason !!!

thanx
prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 5:30 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

The page directories cannot be paged out. Not all virtual memory pages
in the system are backed by the page file - NonPaged pool, for instance.
The scenario you are describing is simply not possible.

Prokash Sinha wrote:

>Yes I am rusty on this, and still not clear ( about the page directories,
>and tables).
>Given a logical(linear) addr, h/w MMU unit would raise a flag if the
>pagetable containing
>directory info is not resident !!!, pagefault handler would field this
>fault!!, bring the
>page from the system page file ( no file specific mem map, it is the page
>file we often
>modify the size of for different options of krnl dump ??? ), now while the
>page is fetched, it
>is a directory, so we need to get the pagetable, then another fault from
>pagetable to actual page
>(assuming one lvl of indirection) …
>
>By your logic it seems like this could be handled, may be just the
>performance reason to have the
>directory and resident all the time!!.
>
>If pagetable is pageable, (w/one level of inderection), we may have

another

>actual page to bring in
>so then it answers my question…
>
>thanx
>prokash
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>Sent: Thursday, July 24, 2003 3:49 PM
>To: Windows System Software Developers Interest List
>Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
>fault)
>
>
>That type of ‘double-fault’ can be handled, depending on the situation.
>If the page fault occurs on a memory-mapped file and Mm calls back into
>the FSD, and the FSD then faults again accessing paged memory backed by
>the swap file, this second fault is perfectly legal. For obvious
>reasons, of course, you can’t fault on the same entity that you are
>already handling a fault on (which is why an FSD or filter can’t touched
>paged pool on the paging file I/O path).
>
>Prokash Sinha wrote:
>
>
>
>>Thanx again.
>>
>>But is it possible to have a pagefault, while we are in a pagefault ?
>>
>>-prokash
>>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>>Sent: Thursday, July 24, 2003 3:04 PM
>>To: Windows System Software Developers Interest List
>>Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)
>>
>>
>>A double fault occurs as a result of a driver (usually a filesystem
>>filter driver or filesystem driver) overflowing the kernel stack. You
>>will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
>>parameter as 0x00000008. From the DDK:
>>
>>“0x00000008, or Double Fault, is when an exception occurs while trying
>>to call the handler for a prior exception. Normally, the two exceptions
>>can be handled serially. However, there are several exceptions that
>>cannot be handled serially, and in this situation the processor signals
>>a double fault. There are two common causes of a double fault:
>>
>>1. A kernel stack overflow. This occurs when a guard page is hit, and
>>then the kernel tries to push a trap frame. Since there is no stack
>>left, a stack overflow results, causing the double fault. If you suspect
>>this has occurred, use the !thread debugger extension to determine the
>>stack limits, and then use the KB (Display Stack Backtrace) debugger
>>command with a large parameter (for example, kb 100) to display the full
>>stack.
>>
>>2. A hardware problem.”
>>
>>Prokash Sinha wrote:
>>
>>
>>
>>
>>>Nick,
>>>
>>>Is it the reason that a double fault would occur, if the directories
>>>are paged out !!!
>>>
>>>-prokash
>>>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com
>>>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>>>Sent: Thursday, July 24, 2003 1:33 PM
>>>To: Windows System Software Developers Interest List
>>>Subject: [ntdev] Re: Context switching …
>>>
>>>
>>>Page tables can be paged out, but page directories cannot be.
>>>
>>>James Antognini wrote:
>>>
>>>
>>>
>>>
>>>
>>>>I believe page tables are themselves pageable. That suggests very
>
>strongly
>
>
>>>that
>>>
>>>
>>>
>>>
>>>>if their storage is stolen and they are paged back in, they will assume

a

>>>>possibly different storage location.
>>>>
>>>>Nick Ryan wrote:
>>>>
>>>>
>>>>
>>>>>From what I understand, all page table directories for all processes
>>>>
>>>>
>>>>
>>>>>exist at different kernel-mode addresses simultaneously.
>>>>
>>>>
>>>>–
>>>>If replying by e-mail, please remove “nospam.” from the address.
>>>>
>>>>James Antognini
>>>>Windows DDK MVP
>>>>
>>>>
>>>>
>>>>—
>>>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>
>>>
>>>
>>>–
>>>- Nick Ryan (MVP for DDK)
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>
>>
>>–
>>- Nick Ryan (MVP for DDK)
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
>–
>- Nick Ryan (MVP for DDK)
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

Thanx - prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 6:03 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

The page directory has entries that map back to itself (possible because
the format of page table entries and page directory entries are
compatible). There are special bits in the PDE/PTE that mark a page as
being backed by a page file. When Windows builds up the entries for the
page directory, I assume it doesn’t set these bits, indicating that the
page directory itself cannot be paged out.

Prokash Sinha wrote:

I think I’m not clear enough. But for sure, why would anyone
have a backup file for nonpaged pool, no need ???

I’m asking this to clarify myself, what is the reason that
a paging directory can not be pageable. There must be a reason (either
the h/w with the handler would not handle it, due to, who knows, nested
page faults?? or just perf reason !!!

thanx
prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
Sent: Thursday, July 24, 2003 5:30 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

The page directories cannot be paged out. Not all virtual memory pages
in the system are backed by the page file - NonPaged pool, for instance.
The scenario you are describing is simply not possible.

Prokash Sinha wrote:

>Yes I am rusty on this, and still not clear ( about the page directories,
>and tables).
>Given a logical(linear) addr, h/w MMU unit would raise a flag if the
>pagetable containing
>directory info is not resident !!!, pagefault handler would field this
>fault!!, bring the
>page from the system page file ( no file specific mem map, it is the page
>file we often
>modify the size of for different options of krnl dump ??? ), now while the
>page is fetched, it
>is a directory, so we need to get the pagetable, then another fault from
>pagetable to actual page
>(assuming one lvl of indirection) …
>
>By your logic it seems like this could be handled, may be just the
>performance reason to have the
>directory and resident all the time!!.
>
>If pagetable is pageable, (w/one level of inderection), we may have

another

>actual page to bring in
>so then it answers my question…
>
>thanx
>prokash
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>Sent: Thursday, July 24, 2003 3:49 PM
>To: Windows System Software Developers Interest List
>Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
>fault)
>
>
>That type of ‘double-fault’ can be handled, depending on the situation.
>If the page fault occurs on a memory-mapped file and Mm calls back into
>the FSD, and the FSD then faults again accessing paged memory backed by
>the swap file, this second fault is perfectly legal. For obvious
>reasons, of course, you can’t fault on the same entity that you are
>already handling a fault on (which is why an FSD or filter can’t touched
>paged pool on the paging file I/O path).
>
>Prokash Sinha wrote:
>
>
>
>>Thanx again.
>>
>>But is it possible to have a pagefault, while we are in a pagefault ?
>>
>>-prokash
>>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>>Sent: Thursday, July 24, 2003 3:04 PM
>>To: Windows System Software Developers Interest List
>>Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)
>>
>>
>>A double fault occurs as a result of a driver (usually a filesystem
>>filter driver or filesystem driver) overflowing the kernel stack. You
>>will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
>>parameter as 0x00000008. From the DDK:
>>
>>“0x00000008, or Double Fault, is when an exception occurs while trying
>>to call the handler for a prior exception. Normally, the two exceptions
>>can be handled serially. However, there are several exceptions that
>>cannot be handled serially, and in this situation the processor signals
>>a double fault. There are two common causes of a double fault:
>>
>>1. A kernel stack overflow. This occurs when a guard page is hit, and
>>then the kernel tries to push a trap frame. Since there is no stack
>>left, a stack overflow results, causing the double fault. If you suspect
>>this has occurred, use the !thread debugger extension to determine the
>>stack limits, and then use the KB (Display Stack Backtrace) debugger
>>command with a large parameter (for example, kb 100) to display the full
>>stack.
>>
>>2. A hardware problem.”
>>
>>Prokash Sinha wrote:
>>
>>
>>
>>
>>>Nick,
>>>
>>>Is it the reason that a double fault would occur, if the directories
>>>are paged out !!!
>>>
>>>-prokash
>>>
>>>-----Original Message-----
>>>From: xxxxx@lists.osr.com
>>>[mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
>>>Sent: Thursday, July 24, 2003 1:33 PM
>>>To: Windows System Software Developers Interest List
>>>Subject: [ntdev] Re: Context switching …
>>>
>>>
>>>Page tables can be paged out, but page directories cannot be.
>>>
>>>James Antognini wrote:
>>>
>>>
>>>
>>>
>>>
>>>>I believe page tables are themselves pageable. That suggests very
>
>strongly
>
>
>>>that
>>>
>>>
>>>
>>>
>>>>if their storage is stolen and they are paged back in, they will assume

a

>>>>possibly different storage location.
>>>>
>>>>Nick Ryan wrote:
>>>>
>>>>
>>>>
>>>>>From what I understand, all page table directories for all processes
>>>>
>>>>
>>>>
>>>>>exist at different kernel-mode addresses simultaneously.
>>>>
>>>>
>>>>–
>>>>If replying by e-mail, please remove “nospam.” from the address.
>>>>
>>>>James Antognini
>>>>Windows DDK MVP
>>>>
>>>>
>>>>
>>>>—
>>>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>
>>>
>>>
>>>–
>>>- Nick Ryan (MVP for DDK)
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>>
>>>
>>>—
>>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>
>>
>>–
>>- Nick Ryan (MVP for DDK)
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>>
>>
>>—
>>You are currently subscribed to ntdev as: xxxxx@nryan.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
>–
>- Nick Ryan (MVP for DDK)
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@vormetric.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
>—
>You are currently subscribed to ntdev as: xxxxx@nryan.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nryan.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

  • Nick Ryan (MVP for DDK)

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Yes. The double fault occurs only if the CPU microcode used to service a
fault will try to cause another fault - usually when the stack of TSS is
invalid.
After the microcode is done, and the control is transferred to trap 0xe
handler, you can have another page faults, which will be recursive.

Max

----- Original Message -----
From: “Prokash Sinha”
To: “Windows System Software Developers Interest List”
Sent: Friday, July 25, 2003 2:29 AM
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double fault)

> Thanx again.
>
> But is it possible to have a pagefault, while we are in a pagefault ?
>
> -prokash
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
> Sent: Thursday, July 24, 2003 3:04 PM
> To: Windows System Software Developers Interest List
> Subject: [ntdev] FOR FAQ: Re: Context switching … (now double fault)
>
>
> A double fault occurs as a result of a driver (usually a filesystem
> filter driver or filesystem driver) overflowing the kernel stack. You
> will see bug check code 0x7F (UNEXPECTED_KERNEL_MODE_TRAP), with first
> parameter as 0x00000008. From the DDK:
>
> “0x00000008, or Double Fault, is when an exception occurs while trying
> to call the handler for a prior exception. Normally, the two exceptions
> can be handled serially. However, there are several exceptions that
> cannot be handled serially, and in this situation the processor signals
> a double fault. There are two common causes of a double fault:
>
> 1. A kernel stack overflow. This occurs when a guard page is hit, and
> then the kernel tries to push a trap frame. Since there is no stack
> left, a stack overflow results, causing the double fault. If you suspect
> this has occurred, use the !thread debugger extension to determine the
> stack limits, and then use the KB (Display Stack Backtrace) debugger
> command with a large parameter (for example, kb 100) to display the full
> stack.
>
> 2. A hardware problem.”
>
> Prokash Sinha wrote:
>
> > Nick,
> >
> > Is it the reason that a double fault would occur, if the directories
> > are paged out !!!
> >
> > -prokash
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Nick Ryan
> > Sent: Thursday, July 24, 2003 1:33 PM
> > To: Windows System Software Developers Interest List
> > Subject: [ntdev] Re: Context switching …
> >
> >
> > Page tables can be paged out, but page directories cannot be.
> >
> > James Antognini wrote:
> >
> >
> >>I believe page tables are themselves pageable. That suggests very strongly
> >
> > that
> >
> >>if their storage is stolen and they are paged back in, they will assume a
> >>possibly different storage location.
> >>
> >>Nick Ryan wrote:
> >>
> >>
> >>
> >>>From what I understand, all page table directories for all processes
> >>>exist at different kernel-mode addresses simultaneously.
> >>
> >>
> >>–
> >>If replying by e-mail, please remove “nospam.” from the address.
> >>
> >>James Antognini
> >>Windows DDK MVP
> >>
> >>
> >>
> >>—
> >>You are currently subscribed to ntdev as: xxxxx@nryan.com
> >>To unsubscribe send a blank email to xxxxx@lists.osr.com
> >>
> >
> >
> > –
> > - Nick Ryan (MVP for DDK)
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vormetric.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@nryan.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> –
> - Nick Ryan (MVP for DDK)
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vormetric.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

> I’m asking this to clarify myself, what is the reason that

a paging directory can not be pageable.

Because CR3 register must point to valid physical memory. Only the PD of the
process which is completely outswapped can be paged out.

Max

> The page directory has entries that map back to itself (possible because

the format of page table entries and page directory entries are
compatible).

Only 1 entry, which maps the PTs themselves starting with 0xc0000000. This is
to simplify access to PTEs.

There are special bits in the PDE/PTE that mark a page as
being backed by a page file.

No. IIRC the “present” PTE only has a special bit of “copy on write”, the
others are hardware-defined.

Max

Max,

I read your earlier msg too…

Thanx for clarifying…

-prokash

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Maxim S. Shatskih
Sent: Friday, July 25, 2003 1:31 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: FOR FAQ: Re: Context switching … (now double
fault)

I’m asking this to clarify myself, what is the reason that
a paging directory can not be pageable.

Because CR3 register must point to valid physical memory. Only the PD of the
process which is completely outswapped can be paged out.

Max


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@vormetric.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Maxim S. Shatskih wrote:

>The page directory has entries that map back to itself (possible because
>the format of page table entries and page directory entries are
>compatible).

Only 1 entry, which maps the PTs themselves starting with 0xc0000000. This is
to simplify access to PTEs.

The one page at 0xc0300000, the PD itself, is covered by that same one
entry, but the PTs in 0xc0000000-0xc0300000 need PTEs of their own
within the PD when mapped (which must be an infrequent and protected
event since I suppose these PTEs may conflict with existing PDEs).

>There are special bits in the PDE/PTE that mark a page as
>being backed by a page file.

No. IIRC the “present” PTE only has a special bit of “copy on write”, the
others are hardware-defined.

Yeah, I forgot that present PTEs don’t have these bits, only non-present
PTEs contain information about the backing store for the page. Which
makes sense, since once the physical page has been resolved who cares
where it came from.

> The one page at 0xc0300000, the PD itself, is covered by that same one

entry, but the PTs in 0xc0000000-0xc0300000 need PTEs of their own
within the PD when mapped (which must be an infrequent and protected

These PTEs are PDEs themselves.

Yeah, I forgot that present PTEs don’t have these bits, only non-present
PTEs contain information about the backing store for the page. Which
makes sense, since once the physical page has been resolved who cares
where it came from.

Surely.

Max