« Crash Dump Analysis Patterns (Part 146)
A Visit from Vatican »

Vacuum Pages

It came to my attention that almost every huge or not so x64 kernel or complete memory dump is diagnosed with excessive pool usage. Sometimes it is too excessive like in the following example:

0: kd> !vm

*** Virtual Memory Usage ***
 Physical Memory:     8387414 (  33549656 Kb)
 Page File: \??\D:\pagefile.sys
   Current:  33856856 Kb  Free Space:  33855520 Kb
   Minimum:  33856856 Kb  Maximum:     46364420 Kb
 Available Pages:     7231844 (  28927376 Kb)
 ResAvail Pages:      7763458 (  31053832 Kb)
 Locked IO Pages:           0 (         0 Kb)
 Free System PTEs:   33556220 ( 134224880 Kb)
 Modified Pages:         2759 (     11036 Kb)
 Modified PF Pages:      2759 (     11036 Kb)
 NonPagedPool Usage: 650867425 (2603469700 Kb)
 NonPagedPoolNx Usage:  83715 (    334860 Kb)
 NonPagedPool Max:    6271754 (  25087016 Kb)
 ********** Excessive NonPaged Pool Usage *****
 PagedPool 0 Usage:     48923 (    195692 Kb)
 PagedPool 1 Usage:     39797 (    159188 Kb)
 PagedPool 2 Usage:     37412 (    149648 Kb)
 PagedPool 3 Usage:     37536 (    150144 Kb)
 PagedPool 4 Usage:     37453 (    149812 Kb)
 PagedPool Usage:      201121 (    804484 Kb)
 PagedPool Maximum:  33554432 ( 134217728 Kb)
 Session Commit:        15829 (     63316 Kb)
 Shared Commit:          7198 (     28792 Kb)
 Special Pool:              0 (         0 Kb)
 Shared Process:       158498 (    633992 Kb)
 PagedPool Commit:     201147 (    804588 Kb)
 Driver Commit:          5761 (     23044 Kb)
 Committed pages:     1126203 (   4504812 Kb)
 Commit limit:       16851145 (  67404580 Kb)

What we can see above is that the amount of used nonpaged pool is more than 2.5 Tb which is far less than the amount of physical memory + page file size (both in total do not exceed 100 Gb). So I conclude that Windows architects did the impossible and are able to create information (pages) from vacuum like matter can be created from vacuum fluctuations. Perhaps they are a step closer to implement some features from Cantor OS.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

This entry was posted on Friday, July 22nd, 2011 at 10:23 pm and is filed under Crash Dump Analysis, Fun with Crash Dumps, Futuristic Memory Dump Analysis, Science Fiction. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

4 Responses to “Vacuum Pages”

  1. Miro Says:
    July 23rd, 2011 at 2:23 pm

    I’ve encountered exactly the same thing last weekend when looking at complete memory dump of one (partial) hung x64 W2k8 R2 system :)

  2. Dmitry Vostokov Says:
    July 23rd, 2011 at 11:02 pm

    So it looks like !vm command needs an update to bring it up with reality :-)

  3. Marc Sherman Says:
    July 25th, 2011 at 2:15 pm

    I’ve seen it too.

  4. Miro Says:
    July 29th, 2011 at 12:44 pm

    Update:
    It seems that also x86 systems are affected, this comes from x86 W2k3 R2 SP2 dump i’ve got today:
    Physical Memory: 1048499 ( 4193996 Kb)
    Page File: \??\C:\pagefile.sys
    Current: 2097152 Kb Free Space: 1629204 Kb
    Minimum: 2097152 Kb Maximum: 2097152 Kb
    Available Pages: 180524 ( 722096 Kb)
    ResAvail Pages: 951257 ( 3805028 Kb)
    Locked IO Pages: 471 ( 1884 Kb)
    Free System PTEs: 198498 ( 793992 Kb)
    Free NP PTEs: 32766 ( 131064 Kb)
    Free Special NP: 0 ( 0 Kb)
    Modified Pages: 109 ( 436 Kb)
    Modified PF Pages: 109 ( 436 Kb)
    NonPagedPool 0 Used: 268435455 (1073741820 Kb)
    NonPagedPoolNx 0 Used: 2858 ( 11432 Kb)
    NonPagedPool 1 Used: -1 ( -4 Kb)
    NonPagedPoolNx 1 Used: 5027 ( 20108 Kb)
    NonPagedPool Usage: 268435454 (1073741816 Kb)
    NonPagedPoolNx Usage: 19041 ( 76164 Kb)
    NonPagedPool Max: 65212 ( 260848 Kb)
    ********** Excessive NonPaged Pool Usage *****

Leave a Reply

You must be logged in to post a comment.