Windows 7 Memory Management III

Kernel-Mode Heaps (System Memory Pools)

• At system initialization, the memory manager creates two dynamically sized memory pools, or heaps, that most kernel-mode components use to allocate system memory:
• Non-paged pool.  Consists of ranges of system virtual addresses that are guaranteed to reside in physical memory at all times and thus can be accessed at any time without incurring a page fault; therefore, they can be accessed from any IRQL. Why need non-paged pool? Because page fault cannot be satisfied at DPC/dispatch level or above. Therefore, any code and data that might execute or be accessed at or above DPC/dispatch level must be in non-pageable memory.
• Paged pool. A region of virtual memory in system space that can be paged into and out of the system. Device drivers that don't need to access the memory from DPC/dispatch level or above can use paged pool. It is accessible from any process context.
• Both memory pools are located in the system part of the address space and are mapped in the virtual address space of every process.
• Systems start with 4 paged pools and 1 non-paged pool.
• Having more than one paged pool reduces the frequency of system code blocking on simultaneous calls to pool routines.
• In addition to the paged and non-paged pools, there are a few other pools with special attributes or uses.
• There is a pool region in session space, which is used for data that is common to all processes in the session.
• There is a pool called special pool. Allocations from special pool are surrounded by pages marked as no-access to help isolate problems in code that accesses memory before or after the region of pool it allocated.

+ Pool Sizes

• Non-paged pool
• starts at an initial size based on the amount of physical memory on the system and then grows as needed.
• The initial size is 3 percent of system RAM. It this is less than 40 MB, the system will instead use 40 MB as long as 10 percent of RAM results in more than 40 MB; otherwise 10 percent of RAM is chosen as a minimum. 

+ Look-Aside Lists
Windows also provides a fast memory allocation mechanism called look-aisde lists. The basic difference between pools and look-aside lists is that while general pool allocations can vary in size, a look-aside list contains only fixed-size blocks. Although the general pool are more flexible in terms of what they can supply, look-aside lists are faster because they don't use any spin-locks.

• Executive components and device drivers can create look-aside lists that match the size of frequently allocated data structures by using the ExInitializeNPagedLookasideList and ExInitializePagedLookasideList functions.
• The executive also creates a general per-processor paged and non-paged look-aside list for small allocations (256 bytes or less).
• If a look-aside list is empty (as it is when it's first created), the system must allocate from paged or non-paged pool. But if it contains a freed block, the allocation can be satisfied very quickly.
• The pool allocation routines automatically tune the number of freed buffers that look-aside lists store according to how often a device driver or executive subsystem allocates from the list - the more frequent the allocations, the more blocks are stored on a list.
• Look-aside lists are automatically reduced in size if they aren't being allocated from. This check happens once per second when the balance set manager system thread wakes up and calls the function ExAdjustLookasideDepth.