Hi,
I’m running an application in a Virtualbox instance on a Win 7 host
Windbg lkd running on the host shows for the Virtualbox process instance:
lkd> !process 8601d360 1
PROCESS 8601d360 SessionId: 1 Cid: 14cc Peb: 7ffd9000 ParentCid: 1468
DirBase: a8f2c5e0 ObjectTable: c2d2d960 HandleCount: 703.
Image: VirtualBox.exe
VadRoot 8a5c89f8 Vads 772 Clone 0 Private 11135. Modified 424433. Locked 0.
DeviceMap c7c16cd8
Token cd2f6910
ElapsedTime 04:56:10.891
UserTime 00:02:41.741
KernelTime 00:00:06.193
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (11330, 50, 345) (45320KB, 200KB, 1380KB)
PeakWorkingSetSize 15778
VirtualSize 208 Mb
PeakVirtualSize 212 Mb
PageFaultCount 6114698
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 16503
CommitCharge is 16503 page (4KB each) but i can see a huge host’s memory utilization. If i go deeper to view how memory is allocated for VirtualBox:
lkd> !vad 8a5c89f8
VAD level start end commit
85fecdc8 ( 7) 10 1f 0 Mapped READWRITE Pagefile-backed section
85ae1d28 ( 8) 20 20 0 Mapped READONLY Pagefile-backed section
860a2d30 ( 6) 30 33 0 Mapped READONLY Pagefile-backed section
89551230 ( 8) 40 40 1 Private READWRITE
85b3e4d8 ( 7) 50 b6 0 Mapped READONLY \Windows\System32\locale.nls
85fab118 ( 8) c0 c0 0 Mapped READONLY Pagefile-backed section
85e64da8 ( 5) d0 d0 0 Mapped READONLY Pagefile-backed section
8572a438 ( 8) e0 e0 0 Mapped READONLY Pagefile-backed section
85ec5b50 ( 7) f0 f0 0 Mapped READONLY Pagefile-backed section
85da6b98 ( 8) 100 100 1 Private READWRITE
85a96158 ( 6) 110 110 1 Private READWRITE
8954e7b0 ( 7) 120 126 0 Mapped READONLY Pagefile-backed section
86d40298 ( 8) 130 131 0 Mapped READWRITE Pagefile-backed section
85f3c9e8 ( 4) 140 813 20 Mapped Exe EXECUTE_WRITECOPY \Programmi\Oracle\VirtualBox\VirtualBox.exe
85d15b90 ( 6) 820 8e7 0 Mapped READONLY Pagefile-backed section
85bfe5b0 ( 5) 8f0 8ff 1 Private READWRITE
858b7698 ( 6) 900 900 0 Private Phys READWRITE
85ad4828 ( 7) 910 910 0 Mapped READONLY Pagefile-backed section
b7e9bc80 ( 3) 920 92f 16 Private READWRITE
85da3638 ( 7) 930 930 0 Mapped READONLY Pagefile-backed section
85f32fc0 ( 6) 940 940 0 Mapped READONLY Pagefile-backed section
85c11d80 ( 5) 950 951 0 Mapped READONLY Pagefile-backed section
85b81958 ( 7) 960 960 0 Private Phys READWRITE
85daf718 ( 8) 970 970 0 Private Phys READWRITE
8a28e4b0 ( 6) 980 a7f 17 Private READWRITE
85bd4ae0 ( 7) a80 b80 0 Mapped READONLY Pagefile-backed section
85e69d88 ( 8) b90 b91 0 Private Phys READWRITE
85da34f0 ( 4) ba0 c9f 256 Private READWRITE
8605c308 ( 8) ca0 d9f 256 Private READWRITE
8a355ea0 ( 7) da0 da1 2 Private EXECUTE_READWRITE
85abb8b0 ( 8) db0 dbf 0 Private Phys READWRITE
bf135568 ( 6) dc0 dff 40 Private READWRITE
85b81908 ( 9) e00 e24 0 Private Phys READWRITE
85f87970 ( 8) e30 e4f 0 Private Phys READWRITE
85ecd968 ( 9) e50 e53 0 Private Phys READWRITE
85db1f28 ( 7) e60 e6f 16 Private READWRITE
85db1ed8 ( 9) e70 e73 0 Private Phys READWRITE
bf098d18 ( 8) e80 e8f 16 Private READWRITE
bba1e2b8 ( 5) e90 1a8f 0 Mapped READONLY Pagefile-backed section
87361c40 ( 8) 1a90 1e82 0 Mapped READONLY Pagefile-backed section
8a6691d0 ( 7) 1e90 1f8f 89 Private READWRITE
bf0cd230 ( 6) 1f90 200f 1 Private READWRITE
85bc79e0 ( 8) 2010 2010 1 Private READWRITE
8a339528 ( 7) 2020 202f 3 Private READWRITE
8a2cb008 ( 8) 2030 2054 0 Private Phys READWRITE
8741e060 ( 9) 2060 2060 1 Private READWRITE
893ff370 ( 2) 2070 20af 50 Private READWRITE
bf09bfc0 ( 9) 20b0 218e 0 Mapped READONLY Pagefile-backed section
you can see there exist many VA ranges of “Private Phys” type, but it seems "process commit " does not take them in account (the associated commit value is 0) whereas the “system commit limit” is hit
What kind of memory is allocated for the process ?
Thanks.
I believe that this represents a view mapped to \Device\PhysicalMemory:
…
fffffa801005b1b0 ( 8) 43d0 43d0 0 Private Phys
…
0: kd> !vad 43d0000 1
VAD @ fffffa801005b1b0
Start VPN 43d0 End VPN 43d0 Control Area
0000000000000000
FirstProtoPte 0000000000000000 LastPte 0000000000000000 Commit Charge
0 (0.)
Secured.Flink 0 Blink 0 Banked/Extend
0
File Offset 0
PhysicalMapping ViewUnmap PrivateMemory READWRITE
Should be easy enough to verify with some test code.
-scott
OSR
wrote in message news:xxxxx@windbg…
Hi,
I’m running an application in a Virtualbox instance on a Win 7 host
Windbg lkd running on the host shows for the Virtualbox process instance:
lkd> !process 8601d360 1
PROCESS 8601d360 SessionId: 1 Cid: 14cc Peb: 7ffd9000 ParentCid: 1468
DirBase: a8f2c5e0 ObjectTable: c2d2d960 HandleCount: 703.
Image: VirtualBox.exe
VadRoot 8a5c89f8 Vads 772 Clone 0 Private 11135. Modified 424433. Locked
0.
DeviceMap c7c16cd8
Token cd2f6910
ElapsedTime 04:56:10.891
UserTime 00:02:41.741
KernelTime 00:00:06.193
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (11330, 50, 345) (45320KB, 200KB,
1380KB)
PeakWorkingSetSize 15778
VirtualSize 208 Mb
PeakVirtualSize 212 Mb
PageFaultCount 6114698
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 16503
CommitCharge is 16503 page (4KB each) but i can see a huge host’s memory
utilization. If i go deeper to view how memory is allocated for VirtualBox:
lkd> !vad 8a5c89f8
VAD level start end commit
85fecdc8 ( 7) 10 1f 0 Mapped READWRITE
Pagefile-backed section
85ae1d28 ( 8) 20 20 0 Mapped READONLY
Pagefile-backed section
860a2d30 ( 6) 30 33 0 Mapped READONLY
Pagefile-backed section
89551230 ( 8) 40 40 1 Private READWRITE
85b3e4d8 ( 7) 50 b6 0 Mapped READONLY
\Windows\System32\locale.nls
85fab118 ( 8) c0 c0 0 Mapped READONLY
Pagefile-backed section
85e64da8 ( 5) d0 d0 0 Mapped READONLY
Pagefile-backed section
8572a438 ( 8) e0 e0 0 Mapped READONLY
Pagefile-backed section
85ec5b50 ( 7) f0 f0 0 Mapped READONLY
Pagefile-backed section
85da6b98 ( 8) 100 100 1 Private READWRITE
85a96158 ( 6) 110 110 1 Private READWRITE
8954e7b0 ( 7) 120 126 0 Mapped READONLY
Pagefile-backed section
86d40298 ( 8) 130 131 0 Mapped READWRITE
Pagefile-backed section
85f3c9e8 ( 4) 140 813 20 Mapped Exe EXECUTE_WRITECOPY
\Programmi\Oracle\VirtualBox\VirtualBox.exe
85d15b90 ( 6) 820 8e7 0 Mapped READONLY
Pagefile-backed section
85bfe5b0 ( 5) 8f0 8ff 1 Private READWRITE
858b7698 ( 6) 900 900 0 Private Phys READWRITE
85ad4828 ( 7) 910 910 0 Mapped READONLY
Pagefile-backed section
b7e9bc80 ( 3) 920 92f 16 Private READWRITE
85da3638 ( 7) 930 930 0 Mapped READONLY
Pagefile-backed section
85f32fc0 ( 6) 940 940 0 Mapped READONLY
Pagefile-backed section
85c11d80 ( 5) 950 951 0 Mapped READONLY
Pagefile-backed section
85b81958 ( 7) 960 960 0 Private Phys READWRITE
85daf718 ( 8) 970 970 0 Private Phys READWRITE
8a28e4b0 ( 6) 980 a7f 17 Private READWRITE
85bd4ae0 ( 7) a80 b80 0 Mapped READONLY
Pagefile-backed section
85e69d88 ( 8) b90 b91 0 Private Phys READWRITE
85da34f0 ( 4) ba0 c9f 256 Private READWRITE
8605c308 ( 8) ca0 d9f 256 Private READWRITE
8a355ea0 ( 7) da0 da1 2 Private EXECUTE_READWRITE
85abb8b0 ( 8) db0 dbf 0 Private Phys READWRITE
bf135568 ( 6) dc0 dff 40 Private READWRITE
85b81908 ( 9) e00 e24 0 Private Phys READWRITE
85f87970 ( 8) e30 e4f 0 Private Phys READWRITE
85ecd968 ( 9) e50 e53 0 Private Phys READWRITE
85db1f28 ( 7) e60 e6f 16 Private READWRITE
85db1ed8 ( 9) e70 e73 0 Private Phys READWRITE
bf098d18 ( 8) e80 e8f 16 Private READWRITE
bba1e2b8 ( 5) e90 1a8f 0 Mapped READONLY
Pagefile-backed section
87361c40 ( 8) 1a90 1e82 0 Mapped READONLY
Pagefile-backed section
8a6691d0 ( 7) 1e90 1f8f 89 Private READWRITE
bf0cd230 ( 6) 1f90 200f 1 Private READWRITE
85bc79e0 ( 8) 2010 2010 1 Private READWRITE
8a339528 ( 7) 2020 202f 3 Private READWRITE
8a2cb008 ( 8) 2030 2054 0 Private Phys READWRITE
8741e060 ( 9) 2060 2060 1 Private READWRITE
893ff370 ( 2) 2070 20af 50 Private READWRITE
bf09bfc0 ( 9) 20b0 218e 0 Mapped READONLY
Pagefile-backed section
you can see there exist many VA ranges of “Private Phys” type, but it seems
"process commit " does not take them in account (the associated commit value
is 0) whereas the “system commit limit” is hit
What kind of memory is allocated for the process ?
Thanks.
Or a user-space MDL mapping.
From: Scott Noonemailto:xxxxx
Sent: ?3/?13/?2013 11:53 AM
To: Kernel Debugging Interest Listmailto:xxxxx
Subject: Re:[windbg] windbg - Private Phys allocation
I believe that this represents a view mapped to \Device\PhysicalMemory:
…
fffffa801005b1b0 ( 8) 43d0 43d0 0 Private Phys
…
0: kd> !vad 43d0000 1
VAD @ fffffa801005b1b0
Start VPN 43d0 End VPN 43d0 Control Area
0000000000000000
FirstProtoPte 0000000000000000 LastPte 0000000000000000 Commit Charge
0 (0.)
Secured.Flink 0 Blink 0 Banked/Extend
0
File Offset 0
PhysicalMapping ViewUnmap PrivateMemory READWRITE
Should be easy enough to verify with some test code.
-scott
OSR
wrote in message news:xxxxx@windbg…
Hi,
I’m running an application in a Virtualbox instance on a Win 7 host
Windbg lkd running on the host shows for the Virtualbox process instance:
lkd> !process 8601d360 1
PROCESS 8601d360 SessionId: 1 Cid: 14cc Peb: 7ffd9000 ParentCid: 1468
DirBase: a8f2c5e0 ObjectTable: c2d2d960 HandleCount: 703.
Image: VirtualBox.exe
VadRoot 8a5c89f8 Vads 772 Clone 0 Private 11135. Modified 424433. Locked
0.
DeviceMap c7c16cd8
Token cd2f6910
ElapsedTime 04:56:10.891
UserTime 00:02:41.741
KernelTime 00:00:06.193
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (11330, 50, 345) (45320KB, 200KB,
1380KB)
PeakWorkingSetSize 15778
VirtualSize 208 Mb
PeakVirtualSize 212 Mb
PageFaultCount 6114698
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 16503
CommitCharge is 16503 page (4KB each) but i can see a huge host’s memory
utilization. If i go deeper to view how memory is allocated for VirtualBox:
lkd> !vad 8a5c89f8
VAD level start end commit
85fecdc8 ( 7) 10 1f 0 Mapped READWRITE
Pagefile-backed section
85ae1d28 ( 8) 20 20 0 Mapped READONLY
Pagefile-backed section
860a2d30 ( 6) 30 33 0 Mapped READONLY
Pagefile-backed section
89551230 ( 8) 40 40 1 Private READWRITE
85b3e4d8 ( 7) 50 b6 0 Mapped READONLY
\Windows\System32\locale.nls
85fab118 ( 8) c0 c0 0 Mapped READONLY
Pagefile-backed section
85e64da8 ( 5) d0 d0 0 Mapped READONLY
Pagefile-backed section
8572a438 ( 8) e0 e0 0 Mapped READONLY
Pagefile-backed section
85ec5b50 ( 7) f0 f0 0 Mapped READONLY
Pagefile-backed section
85da6b98 ( 8) 100 100 1 Private READWRITE
85a96158 ( 6) 110 110 1 Private READWRITE
8954e7b0 ( 7) 120 126 0 Mapped READONLY
Pagefile-backed section
86d40298 ( 8) 130 131 0 Mapped READWRITE
Pagefile-backed section
85f3c9e8 ( 4) 140 813 20 Mapped Exe EXECUTE_WRITECOPY
\Programmi\Oracle\VirtualBox\VirtualBox.exe
85d15b90 ( 6) 820 8e7 0 Mapped READONLY
Pagefile-backed section
85bfe5b0 ( 5) 8f0 8ff 1 Private READWRITE
858b7698 ( 6) 900 900 0 Private Phys READWRITE
85ad4828 ( 7) 910 910 0 Mapped READONLY
Pagefile-backed section
b7e9bc80 ( 3) 920 92f 16 Private READWRITE
85da3638 ( 7) 930 930 0 Mapped READONLY
Pagefile-backed section
85f32fc0 ( 6) 940 940 0 Mapped READONLY
Pagefile-backed section
85c11d80 ( 5) 950 951 0 Mapped READONLY
Pagefile-backed section
85b81958 ( 7) 960 960 0 Private Phys READWRITE
85daf718 ( 8) 970 970 0 Private Phys READWRITE
8a28e4b0 ( 6) 980 a7f 17 Private READWRITE
85bd4ae0 ( 7) a80 b80 0 Mapped READONLY
Pagefile-backed section
85e69d88 ( 8) b90 b91 0 Private Phys READWRITE
85da34f0 ( 4) ba0 c9f 256 Private READWRITE
8605c308 ( 8) ca0 d9f 256 Private READWRITE
8a355ea0 ( 7) da0 da1 2 Private EXECUTE_READWRITE
85abb8b0 ( 8) db0 dbf 0 Private Phys READWRITE
bf135568 ( 6) dc0 dff 40 Private READWRITE
85b81908 ( 9) e00 e24 0 Private Phys READWRITE
85f87970 ( 8) e30 e4f 0 Private Phys READWRITE
85ecd968 ( 9) e50 e53 0 Private Phys READWRITE
85db1f28 ( 7) e60 e6f 16 Private READWRITE
85db1ed8 ( 9) e70 e73 0 Private Phys READWRITE
bf098d18 ( 8) e80 e8f 16 Private READWRITE
bba1e2b8 ( 5) e90 1a8f 0 Mapped READONLY
Pagefile-backed section
87361c40 ( 8) 1a90 1e82 0 Mapped READONLY
Pagefile-backed section
8a6691d0 ( 7) 1e90 1f8f 89 Private READWRITE
bf0cd230 ( 6) 1f90 200f 1 Private READWRITE
85bc79e0 ( 8) 2010 2010 1 Private READWRITE
8a339528 ( 7) 2020 202f 3 Private READWRITE
8a2cb008 ( 8) 2030 2054 0 Private Phys READWRITE
8741e060 ( 9) 2060 2060 1 Private READWRITE
893ff370 ( 2) 2070 20af 50 Private READWRITE
bf09bfc0 ( 9) 20b0 218e 0 Mapped READONLY
Pagefile-backed section
you can see there exist many VA ranges of “Private Phys” type, but it seems
"process commit " does not take them in account (the associated commit value
is 0) whereas the “system commit limit” is hit
What kind of memory is allocated for the process ?
Thanks.
—
WINDBG is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>
From here http://superuser.com/questions/185318/process-explorer-not-showing-the-biggest-user-of-my-ram (and the referred link http://blogs.msdn.com/b/oldnewthing/archive/2007/11/06/5924058.aspx#comments) it seems VirtualBox locks (calling VirtualLock()) an huge amount of memory in its process’WS (I can see it using sysinternals VMMAP)
If that is the case, I believe we should see also an (equivalent) huge amount of “process committed” memory, don’t you ?
“Pavel Lebedynskiy” wrote in message
news:xxxxx@windbg…
>Or a user-space MDL mapping.
Excellent, thanks for the additional information.
-scott
OSR
“Pavel Lebedynskiy” wrote in message
news:xxxxx@windbg…
Or a user-space MDL mapping.
From: Scott Noone
Sent: ý3/ý13/ý2013 11:53 AM
To: Kernel Debugging Interest List
Subject: Re:[windbg] windbg - Private Phys allocation
I believe that this represents a view mapped to \Device\PhysicalMemory:
…
fffffa801005b1b0 ( 8) 43d0 43d0 0 Private Phys
…
0: kd> !vad 43d0000 1
VAD @ fffffa801005b1b0
Start VPN 43d0 End VPN 43d0 Control Area
0000000000000000
FirstProtoPte 0000000000000000 LastPte 0000000000000000 Commit Charge
0 (0.)
Secured.Flink 0 Blink 0 Banked/Extend
0
File Offset 0
PhysicalMapping ViewUnmap PrivateMemory READWRITE
Should be easy enough to verify with some test code.
-scott
OSR
wrote in message news:xxxxx@windbg…
Hi,
I’m running an application in a Virtualbox instance on a Win 7 host
Windbg lkd running on the host shows for the Virtualbox process instance:
lkd> !process 8601d360 1
PROCESS 8601d360 SessionId: 1 Cid: 14cc Peb: 7ffd9000 ParentCid: 1468
DirBase: a8f2c5e0 ObjectTable: c2d2d960 HandleCount: 703.
Image: VirtualBox.exe
VadRoot 8a5c89f8 Vads 772 Clone 0 Private 11135. Modified 424433. Locked
0.
DeviceMap c7c16cd8
Token cd2f6910
ElapsedTime 04:56:10.891
UserTime 00:02:41.741
KernelTime 00:00:06.193
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (11330, 50, 345) (45320KB, 200KB,
1380KB)
PeakWorkingSetSize 15778
VirtualSize 208 Mb
PeakVirtualSize 212 Mb
PageFaultCount 6114698
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 16503
CommitCharge is 16503 page (4KB each) but i can see a huge host’s memory
utilization. If i go deeper to view how memory is allocated for VirtualBox:
lkd> !vad 8a5c89f8
VAD level start end commit
85fecdc8 ( 7) 10 1f 0 Mapped READWRITE
Pagefile-backed section
85ae1d28 ( 8) 20 20 0 Mapped READONLY
Pagefile-backed section
860a2d30 ( 6) 30 33 0 Mapped READONLY
Pagefile-backed section
89551230 ( 8) 40 40 1 Private READWRITE
85b3e4d8 ( 7) 50 b6 0 Mapped READONLY
\Windows\System32\locale.nls
85fab118 ( 8) c0 c0 0 Mapped READONLY
Pagefile-backed section
85e64da8 ( 5) d0 d0 0 Mapped READONLY
Pagefile-backed section
8572a438 ( 8) e0 e0 0 Mapped READONLY
Pagefile-backed section
85ec5b50 ( 7) f0 f0 0 Mapped READONLY
Pagefile-backed section
85da6b98 ( 8) 100 100 1 Private READWRITE
85a96158 ( 6) 110 110 1 Private READWRITE
8954e7b0 ( 7) 120 126 0 Mapped READONLY
Pagefile-backed section
86d40298 ( 8) 130 131 0 Mapped READWRITE
Pagefile-backed section
85f3c9e8 ( 4) 140 813 20 Mapped Exe EXECUTE_WRITECOPY
\Programmi\Oracle\VirtualBox\VirtualBox.exe
85d15b90 ( 6) 820 8e7 0 Mapped READONLY
Pagefile-backed section
85bfe5b0 ( 5) 8f0 8ff 1 Private READWRITE
858b7698 ( 6) 900 900 0 Private Phys READWRITE
85ad4828 ( 7) 910 910 0 Mapped READONLY
Pagefile-backed section
b7e9bc80 ( 3) 920 92f 16 Private READWRITE
85da3638 ( 7) 930 930 0 Mapped READONLY
Pagefile-backed section
85f32fc0 ( 6) 940 940 0 Mapped READONLY
Pagefile-backed section
85c11d80 ( 5) 950 951 0 Mapped READONLY
Pagefile-backed section
85b81958 ( 7) 960 960 0 Private Phys READWRITE
85daf718 ( 8) 970 970 0 Private Phys READWRITE
8a28e4b0 ( 6) 980 a7f 17 Private READWRITE
85bd4ae0 ( 7) a80 b80 0 Mapped READONLY
Pagefile-backed section
85e69d88 ( 8) b90 b91 0 Private Phys READWRITE
85da34f0 ( 4) ba0 c9f 256 Private READWRITE
8605c308 ( 8) ca0 d9f 256 Private READWRITE
8a355ea0 ( 7) da0 da1 2 Private EXECUTE_READWRITE
85abb8b0 ( 8) db0 dbf 0 Private Phys READWRITE
bf135568 ( 6) dc0 dff 40 Private READWRITE
85b81908 ( 9) e00 e24 0 Private Phys READWRITE
85f87970 ( 8) e30 e4f 0 Private Phys READWRITE
85ecd968 ( 9) e50 e53 0 Private Phys READWRITE
85db1f28 ( 7) e60 e6f 16 Private READWRITE
85db1ed8 ( 9) e70 e73 0 Private Phys READWRITE
bf098d18 ( 8) e80 e8f 16 Private READWRITE
bba1e2b8 ( 5) e90 1a8f 0 Mapped READONLY
Pagefile-backed section
87361c40 ( 8) 1a90 1e82 0 Mapped READONLY
Pagefile-backed section
8a6691d0 ( 7) 1e90 1f8f 89 Private READWRITE
bf0cd230 ( 6) 1f90 200f 1 Private READWRITE
85bc79e0 ( 8) 2010 2010 1 Private READWRITE
8a339528 ( 7) 2020 202f 3 Private READWRITE
8a2cb008 ( 8) 2030 2054 0 Private Phys READWRITE
8741e060 ( 9) 2060 2060 1 Private READWRITE
893ff370 ( 2) 2070 20af 50 Private READWRITE
bf09bfc0 ( 9) 20b0 218e 0 Mapped READONLY
Pagefile-backed section
you can see there exist many VA ranges of “Private Phys” type, but it seems
"process commit " does not take them in account (the associated commit value
is 0) whereas the “system commit limit” is hit
What kind of memory is allocated for the process ?
Thanks.
—
WINDBG is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
>Or a user-space MDL mapping.
re-thinking about it…in that case, IIUC, the system is allocating physical memory pages at kernel level (like a driver…) building an MDL for them and mapping it in user-space (in VirtualBox process context)
I’ve done a test using RAMMAP that shows an huge amount of “Driver Locked” memory. Do you think that is consistent with the assumption above ?
Thanks.
>I’ve done a test using RAMMAP that shows an huge amount of “Driver Locked”
memory. Do you think that is consistent with the >assumption above ?
In that case, it sounds like the driver is locking regions of memory
(MmProbeAndLockPages) and then mapping them into user space
(MmMapLockedPagesSpecifyCache). Again this should be easy to verify in the
debugger.
-scott
OSR
wrote in message news:xxxxx@windbg…
Or a user-space MDL mapping.
re-thinking about it…in that case, IIUC, the system is allocating
physical memory pages at kernel level (like a driver…) building an MDL for
them and mapping it in user-space (in VirtualBox process context)
I’ve done a test using RAMMAP that shows an huge amount of “Driver Locked”
memory. Do you think that is consistent with the assumption above ?
Thanks.
> Again this should be easy to verify in the debugger.
Do you mean to launch Virtualbox under the debugger (e.g. windbg) control ? AFAIK in that case the debugger will run in user-mode…in that debugger mode is also possible to view kernel-space details ? (e.g. driver locking regions of memory and so on…)
Thanks in advance.
No, attaching to a local process isn’t going to do anything. If I were you,
I’d write test code to validate these assumptions and run that under a
kernel debugger (or attach a kernel debugger to the machine running the
software you’re investigating).
-scott
OSR
wrote in message news:xxxxx@windbg…
Again this should be easy to verify in the debugger.
Do you mean to launch Virtualbox under the debugger (e.g. windbg) control ?
AFAIK in that case the debugger will run in user-mode…in that debugger
mode is also possible to view kernel-space details ? (e.g. driver locking
regions of memory and so on…)
Thanks in advance.
VirtualLock has no effect on process commit. If you have a private 1 GB allocation then your process commit charge will be 1 GB, with or without VirtualLock. A 1 GB mapped view on the other hand will not be charged to the process (unless the view is copy-on-write), and again it doesn’t matter whether the view is VirtualLock’ed or not.
I’m not sure what was happening in the VirtualBox link below. The VirtualLock explanation doesn’t make sense to me because in order to lock something you have to have it mapped in the VA space, which would increase your virtual size.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@alice.it
Sent: Thursday, March 14, 2013 2:13 AM
To: Kernel Debugging Interest List
Subject: RE:[windbg] windbg - Private Phys allocation
From here http://superuser.com/questions/185318/process-explorer-not-showing-the-biggest-user-of-my-ram (and the referred link http://blogs.msdn.com/b/oldnewthing/archive/2007/11/06/5924058.aspx#comments) it seems VirtualBox locks (calling VirtualLock()) an huge amount of memory in its process’WS (I can see it using sysinternals VMMAP)
If that is the case, I believe we should see also an (equivalent) huge amount of “process committed” memory, don’t you ?
I’m not sure what exactly “Driver Locked” means in RamMap but if it’s the same as in xperf (and the APIs used by it), it should refer to memory allocated with MmAllocatePagesForMdl(Ex).
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Scott Noone
Sent: Friday, March 15, 2013 7:25 AM
To: Kernel Debugging Interest List
Subject: Re:[windbg] windbg - Private Phys allocation
I’ve done a test using RAMMAP that shows an huge amount of “Driver Locked”
memory. Do you think that is consistent with the >assumption above ?
In that case, it sounds like the driver is locking regions of memory
(MmProbeAndLockPages) and then mapping them into user space (MmMapLockedPagesSpecifyCache). Again this should be easy to verify in the debugger.
-scott
OSR
wrote in message news:xxxxx@windbg…
Or a user-space MDL mapping.
re-thinking about it…in that case, IIUC, the system is allocating physical memory pages at kernel level (like a driver…) building an MDL for them and mapping it in user-space (in VirtualBox process context)
I’ve done a test using RAMMAP that shows an huge amount of “Driver Locked”
memory. Do you think that is consistent with the assumption above ?
> The VirtualLock explanation doesn’t make sense to me because in order to lock something you have
to have it mapped in the VA space, which would increase your virtual size.
process’s virtual size increase including when an MDL is mapped in that (user) process’s address space ?
Yes.
From: xxxxx@alice.itmailto:xxxxx
Sent: ?3/?16/?2013 3:34 PM
To: Kernel Debugging Interest Listmailto:xxxxx
Subject: RE:[windbg] windbg - Private Phys allocation
> The VirtualLock explanation doesn’t make sense to me because in order to lock something you have
> to have it mapped in the VA space, which would increase your virtual size.
process’s virtual size increase including when an MDL is mapped in that (user) process’s address space ?
—
WINDBG is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>
> process’s virtual size increase including when an MDL is mapped in that (user) process’s address space ?
Yes.
What do not make sense to me is that VirtualBox’s VAD tree has entries for each MDL physical page mapped in user-space (Private Phys type), however its process’s virtual size does not seem to take them in account…
0: kd> !process 85cc4d40 1
PROCESS 85cc4d40 SessionId: 1 Cid: 1044 Peb: 7ffd4000 ParentCid: 04a0
DirBase: a8f16540 ObjectTable: cda0a410 HandleCount: 666.
Image: VirtualBox.exe
VadRoot 899b7e70 Vads 662 Clone 0 Private 10725. Modified 1501. Locked 0.
DeviceMap b53f3098
Token cdf5a910
ElapsedTime 00:19:22.687
UserTime 00:00:00.062
KernelTime 00:00:00.093
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (15195, 50, 345) (60780KB, 200KB, 1380KB)
PeakWorkingSetSize 15612
VirtualSize 198 Mb
PeakVirtualSize 206 Mb
PageFaultCount 61684
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 16061
0: kd> !vad 899b7e70
VAD level start end commit
85dca2f0 ( 7) 10 1f 0 Mapped READWRITE Pagefile-backed section
85edf218 ( 8) 20 20 0 Mapped READONLY Pagefile-backed section
85e8d2f0 ( 6) 30 33 0 Mapped READONLY Pagefile-backed section
b89a2108 ( 7) 40 40 1 Private READWRITE
85bcce80 ( 8) 50 50 0 Mapped READONLY Pagefile-backed section
8a40a660 ( 5) 60 15f 14 Private READWRITE
858df558 ( 8) 160 160 0 Mapped READONLY Pagefile-backed section
858eada0 ( 7) 170 170 0 Mapped READONLY Pagefile-backed section
8a31b940 ( 8) 180 180 0 Mapped READONLY Pagefile-backed section
8a3dba48 ( 6) 190 28f 226 Private READWRITE
85919ce0 ( 7) 290 2f6 0 Mapped READONLY \Windows\System32\locale.nls
85d850d0 ( 4) 300 3c7 0 Mapped READONLY Pagefile-backed section
85ed4498 ( 8) 3d0 3d0 1 Private READWRITE
85f30bf0 ( 7) 3e0 3e0 1 Private READWRITE
85c4c460 ( 8) 3f0 3f6 0 Mapped READONLY Pagefile-backed section
8a31e060 ( 6) 400 401 0 Mapped READWRITE Pagefile-backed section
859f1228 ( 7) 410 410 0 Private Phys READWRITE
85998ee8 ( 8) 420 420 0 Mapped READONLY Pagefile-backed section
85d64c30 ( 5) 430 43f 3 Private READWRITE
8a317228 ( 9) 440 440 0 Mapped READONLY Pagefile-backed section
85aa7f30 ( 8) 450 450 0 Mapped READONLY Pagefile-backed section
85b59cc8 ( 7) 460 461 0 Mapped READONLY Pagefile-backed section
85edd060 ( 9) 470 494 0 Private Phys READWRITE
85b56ca0 ( 8) 4a0 4af 16 Private READWRITE
858ccee0 ( 9) 4b0 4b1 2 Private EXECUTE_READWRITE
85a66ea0 ( 6) 4c0 4cf 16 Private READWRITE
857001c8 ( 7) 4d0 5d0 0 Mapped READONLY Pagefile-backed section
875f10c8 ( 8) 5e0 11df 0 Mapped READONLY Pagefile-backed section
89907440 ( 3) 11e0 18b3 20 Mapped Exe EXECUTE_WRITECOPY \Programmi\Oracle\VirtualBox\VirtualBox.exe
85d86bc8 ( 9) 18c0 1cb2 0 Mapped READONLY Pagefile-backed section
85ea6068 ( 8) 1cc0 1dbf 256 Private READWRITE
85e17bb0 ( 7) 1dc0 1dc0 0 Private Phys READWRITE
85eda5b0 ( 8) 1dd0 1dd0 0 Private Phys READWRITE
85b99b30 ( 9) 1de0 1de1 0 Private Phys READWRITE
85da8a38 ( 6) 1df0 1dff 16 Private READWRITE
85db48a0 ( 8) 1e00 1eff 89 Private READWRITE
85f019b0 ( 7) 1f00 1f1f 0 Private Phys READWRITE
85e8e990 ( 8) 1f20 1f44 0 Private Phys READWRITE
85edb720 ( 9) 1f50 1f6f 0 Private Phys READWRITE
8a7b6f98 ( 5) 1f70 1f7f 1 Private READWRITE
89872e38 ( 7) 1f80 1f9f 0 Private Phys READWRITE
85afaac0 ( 6) 1fa0 1fbf 1 Private READWRITE
85e852f0 ( 8) 1fc0 1fcf 0 Private Phys READWRITE
85f10838 ( 7) 1fd0 1fe0 0 Private Phys READWRITE
b89369e8 ( 8) 1ff0 202f 15 Private READWRITE
85a0db40 ( 4) 2030 210e 0 Mapped READONLY Pagefile-backed section
85a31748 ( 8) 2110 218f 1 Private READWRITE
85d472f0 ( 9) 2190 21eb 0 Private Phys READWRITE
85d05870 ( 7) 21f0 222f 39 Private READWRITE
85c725f0 ( 9) 2230 2249 0 Private Phys READWRITE
85c37778 ( 8) 2250 234f 4 Private READWRITE
85d26db8 (10) 2350 2353 0 Private Phys READWRITE
85e57858 ( 9) 2360 2363 0 Private Phys READWRITE
85ce3c00 (10) 2370 2370 1 Private READWRITE
85af1be8 ( 6) 2380 247f 3 Private READWRITE
85f1e1d0 ( 9) 2480 257f 189 Private READWRITE
85a173e8 ( 8) 2580 25ff 0 Private Phys READWRITE
b88fd110 ( 7) 2600 2600 1 Private READWRITE
85b4a6b0 ( 8) 2660 269f 1 Private READWRITE
85f05300 ( 9) 2710 29de 0 Mapped READONLY \Windows\Globalization\Sorting\SortDefault.nls
8a733a60 ( 5) 29e0 2a1f 0 Private Phys READWRITE
85ee9858 ( 9) 2a20 2a33 0 Private Phys READWRITE
b89d0328 ( 8) 2a40 2a5f 0 Private Phys READWRITE
858ce9c8 ( 9) 2a60 2a61 2 Private READWRITE
85734fc0 ( 7) 2a70 2a70 0 Mapped READONLY Pagefile-backed section
85a0d170 ( 9) 2a80 2a8f 3 Private READWRITE
85b17340 ( 8) 2a90 2a91 0 Mapped READWRITE Pagefile-backed section
85ba0f40 ( 9) 2aa0 2b1f 0 Private Phys READWRITE
898f4418 (10) 2b20 2b9f 0 Private Phys READWRITE
8a33a4a0 ( 6) 2ba0 2ba1 2 Private READWRITE
859642a0 ( 9) 2bb0 2bb2 0 Mapped READWRITE Pagefile-backed section
8a31e0d8 ( 8) 2bc0 2bc1 2 Private READWRITE
898fa008 (10) 2bd0 2c4f 0 Private Phys READWRITE
85cf2290 ( 9) 2cf0 2dc2 211 Private READWRITE
85c0d8b8 ( 7) 2dd0 2ddf 16 Private READWRITE
8985e820 ( 8) 2e10 2f0f 4 Private READWRITE
8a404190 ( 9) 2f10 2ff1 226 Private READWRITE
86d43e20 ( 2) 3000 30ff 4 Private READWRITE
85ec9790 ( 7) 3240 362a 0 Mapped READONLY Pagefile-backed section
85d2e9e8 ( 8) 3650 374f 4 Private READWRITE
85cac350 ( 6) 3750 394f 512 Private READWRITE
85d2d328 ( 7) 3950 3a69 282 Private READWRITE
85dc97c0 ( 8) 3ae0 3bdf 4 Private READWRITE
85b553a8 ( 5) 3c30 3c6f 25 Private READWRITE
859db538 ( 9) 3c70 3e6f 0 Private Phys READWRITE
85ecb640 ( 8) 3e70 406f 0 Private Phys READWRITE
The process virtual size should be equal (or pretty close) to the sum of its VAD sizes. Are you seeing something different?
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@alice.it
Sent: Sunday, March 17, 2013 8:42 AM
To: Kernel Debugging Interest List
Subject: RE:[windbg] windbg - Private Phys allocation
process’s virtual size increase including when an MDL is mapped in that (user) process’s address space ?
Yes.
What do not make sense to me is that VirtualBox’s VAD tree has entries for each MDL physical page mapped in user-space (Private Phys type), however its process’s virtual size does not seem to take them in account…
0: kd> !process 85cc4d40 1
PROCESS 85cc4d40 SessionId: 1 Cid: 1044 Peb: 7ffd4000 ParentCid: 04a0
DirBase: a8f16540 ObjectTable: cda0a410 HandleCount: 666.
Image: VirtualBox.exe
VadRoot 899b7e70 Vads 662 Clone 0 Private 10725. Modified 1501. Locked 0.
DeviceMap b53f3098
Token cdf5a910
ElapsedTime 00:19:22.687
UserTime 00:00:00.062
KernelTime 00:00:00.093
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (15195, 50, 345) (60780KB, 200KB, 1380KB)
PeakWorkingSetSize 15612
VirtualSize 198 Mb
PeakVirtualSize 206 Mb
PageFaultCount 61684
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 16061
0: kd> !vad 899b7e70
VAD level start end commit
85dca2f0 ( 7) 10 1f 0 Mapped READWRITE Pagefile-backed section
85edf218 ( 8) 20 20 0 Mapped READONLY Pagefile-backed section
85e8d2f0 ( 6) 30 33 0 Mapped READONLY Pagefile-backed section
b89a2108 ( 7) 40 40 1 Private READWRITE
85bcce80 ( 8) 50 50 0 Mapped READONLY Pagefile-backed section
8a40a660 ( 5) 60 15f 14 Private READWRITE
858df558 ( 8) 160 160 0 Mapped READONLY Pagefile-backed section
858eada0 ( 7) 170 170 0 Mapped READONLY Pagefile-backed section
8a31b940 ( 8) 180 180 0 Mapped READONLY Pagefile-backed section
8a3dba48 ( 6) 190 28f 226 Private READWRITE
85919ce0 ( 7) 290 2f6 0 Mapped READONLY \Windows\System32\locale.nls
85d850d0 ( 4) 300 3c7 0 Mapped READONLY Pagefile-backed section
85ed4498 ( 8) 3d0 3d0 1 Private READWRITE
85f30bf0 ( 7) 3e0 3e0 1 Private READWRITE
85c4c460 ( 8) 3f0 3f6 0 Mapped READONLY Pagefile-backed section
8a31e060 ( 6) 400 401 0 Mapped READWRITE Pagefile-backed section
859f1228 ( 7) 410 410 0 Private Phys READWRITE
85998ee8 ( 8) 420 420 0 Mapped READONLY Pagefile-backed section
85d64c30 ( 5) 430 43f 3 Private READWRITE
8a317228 ( 9) 440 440 0 Mapped READONLY Pagefile-backed section
85aa7f30 ( 8) 450 450 0 Mapped READONLY Pagefile-backed section
85b59cc8 ( 7) 460 461 0 Mapped READONLY Pagefile-backed section
85edd060 ( 9) 470 494 0 Private Phys READWRITE
85b56ca0 ( 8) 4a0 4af 16 Private READWRITE
858ccee0 ( 9) 4b0 4b1 2 Private EXECUTE_READWRITE
85a66ea0 ( 6) 4c0 4cf 16 Private READWRITE
857001c8 ( 7) 4d0 5d0 0 Mapped READONLY Pagefile-backed section
875f10c8 ( 8) 5e0 11df 0 Mapped READONLY Pagefile-backed section
89907440 ( 3) 11e0 18b3 20 Mapped Exe EXECUTE_WRITECOPY \Programmi\Oracle\VirtualBox\VirtualBox.exe
85d86bc8 ( 9) 18c0 1cb2 0 Mapped READONLY Pagefile-backed section
85ea6068 ( 8) 1cc0 1dbf 256 Private READWRITE
85e17bb0 ( 7) 1dc0 1dc0 0 Private Phys READWRITE
85eda5b0 ( 8) 1dd0 1dd0 0 Private Phys READWRITE
85b99b30 ( 9) 1de0 1de1 0 Private Phys READWRITE
85da8a38 ( 6) 1df0 1dff 16 Private READWRITE
85db48a0 ( 8) 1e00 1eff 89 Private READWRITE
85f019b0 ( 7) 1f00 1f1f 0 Private Phys READWRITE
85e8e990 ( 8) 1f20 1f44 0 Private Phys READWRITE
85edb720 ( 9) 1f50 1f6f 0 Private Phys READWRITE
8a7b6f98 ( 5) 1f70 1f7f 1 Private READWRITE
89872e38 ( 7) 1f80 1f9f 0 Private Phys READWRITE
85afaac0 ( 6) 1fa0 1fbf 1 Private READWRITE
85e852f0 ( 8) 1fc0 1fcf 0 Private Phys READWRITE
85f10838 ( 7) 1fd0 1fe0 0 Private Phys READWRITE
b89369e8 ( 8) 1ff0 202f 15 Private READWRITE
85a0db40 ( 4) 2030 210e 0 Mapped READONLY Pagefile-backed section
85a31748 ( 8) 2110 218f 1 Private READWRITE
85d472f0 ( 9) 2190 21eb 0 Private Phys READWRITE
85d05870 ( 7) 21f0 222f 39 Private READWRITE
85c725f0 ( 9) 2230 2249 0 Private Phys READWRITE
85c37778 ( 8) 2250 234f 4 Private READWRITE
85d26db8 (10) 2350 2353 0 Private Phys READWRITE
85e57858 ( 9) 2360 2363 0 Private Phys READWRITE
85ce3c00 (10) 2370 2370 1 Private READWRITE
85af1be8 ( 6) 2380 247f 3 Private READWRITE
85f1e1d0 ( 9) 2480 257f 189 Private READWRITE
85a173e8 ( 8) 2580 25ff 0 Private Phys READWRITE
b88fd110 ( 7) 2600 2600 1 Private READWRITE
85b4a6b0 ( 8) 2660 269f 1 Private READWRITE
85f05300 ( 9) 2710 29de 0 Mapped READONLY \Windows\Globalization\Sorting\SortDefault.nls
8a733a60 ( 5) 29e0 2a1f 0 Private Phys READWRITE
85ee9858 ( 9) 2a20 2a33 0 Private Phys READWRITE
b89d0328 ( 8) 2a40 2a5f 0 Private Phys READWRITE
858ce9c8 ( 9) 2a60 2a61 2 Private READWRITE
85734fc0 ( 7) 2a70 2a70 0 Mapped READONLY Pagefile-backed section
85a0d170 ( 9) 2a80 2a8f 3 Private READWRITE
85b17340 ( 8) 2a90 2a91 0 Mapped READWRITE Pagefile-backed section
85ba0f40 ( 9) 2aa0 2b1f 0 Private Phys READWRITE
898f4418 (10) 2b20 2b9f 0 Private Phys READWRITE
8a33a4a0 ( 6) 2ba0 2ba1 2 Private READWRITE
859642a0 ( 9) 2bb0 2bb2 0 Mapped READWRITE Pagefile-backed section
8a31e0d8 ( 8) 2bc0 2bc1 2 Private READWRITE
898fa008 (10) 2bd0 2c4f 0 Private Phys READWRITE
85cf2290 ( 9) 2cf0 2dc2 211 Private READWRITE
85c0d8b8 ( 7) 2dd0 2ddf 16 Private READWRITE
8985e820 ( 8) 2e10 2f0f 4 Private READWRITE
8a404190 ( 9) 2f10 2ff1 226 Private READWRITE
86d43e20 ( 2) 3000 30ff 4 Private READWRITE
85ec9790 ( 7) 3240 362a 0 Mapped READONLY Pagefile-backed section
85d2e9e8 ( 8) 3650 374f 4 Private READWRITE
85cac350 ( 6) 3750 394f 512 Private READWRITE
85d2d328 ( 7) 3950 3a69 282 Private READWRITE
85dc97c0 ( 8) 3ae0 3bdf 4 Private READWRITE
85b553a8 ( 5) 3c30 3c6f 25 Private READWRITE
859db538 ( 9) 3c70 3e6f 0 Private Phys READWRITE
85ecb640 ( 8) 3e70 406f 0 Private Phys READWRITE
—
WINDBG is sponsored by OSR
OSR is hiring!! Info at http://www.osr.com/careers
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
> The process virtual size should be equal (or pretty close) to the sum of its VAD sizes. Are you seeing something different?
Pavel i assumed that, anyway I’ve double checked it summing up VAD VA ranges (using an excel spreadsheet): VAD sum is much more higher than VirtualBox’s virtual size (AFAIK EPROCESS.VirtualSize)
What OS are you seeing this on?
Are you sure you’re calculating the total VAD size correctly? The start/end values in !vad output are in pages so you need to multiply them by 4K.
From the snippet you posted, virtual size is 200 MB and there are ~660 VADs so the average VAD size is ~300K which seems more or less in line with the rest of the output.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@alice.it
Sent: Tuesday, March 19, 2013 2:29 AM
To: Kernel Debugging Interest List
Subject: RE:[windbg] windbg - Private Phys allocation
The process virtual size should be equal (or pretty close) to the sum of its VAD sizes. Are you seeing something different?
Pavel i assumed that, anyway I’ve double checked it summing up VAD VA ranges (using an excel spreadsheet): VAD sum is much more higher than VirtualBox’s virtual size (AFAIK EPROCESS.VirtualSize)
> What OS are you seeing this on?
Win 7 enterprise 32bit
Are you sure you’re calculating the total VAD size correctly? The start/end values in !vad output are in pages so you need to multiply them by 4K.
yes…anyway if i sum VAD size excluding “Private Phys” type entries the result match with the process’s virtual size.
This was a bug in win7 and previous versions. It should be fixed in win8.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@alice.it
Sent: Wednesday, March 20, 2013 9:19 AM
To: Kernel Debugging Interest List
Subject: RE:[windbg] windbg - Private Phys allocation
What OS are you seeing this on?
Win 7 enterprise 32bit
Are you sure you’re calculating the total VAD size correctly? The start/end values in !vad output are in pages so you need to multiply them by 4K.
yes…anyway if i sum VAD size excluding “Private Phys” type entries the result match with the process’s virtual size.
