How does /burnmemory=XXX boot.ini switch work?

Question

I know what the /burnmemory switch does on Windows, but I'd like to understand what Windows is doing under the hood to support it.

It's described on msdn as the "amount of memory, in megabytes, that Windows cannot use".

Does this mean simply that the kernel does not allow user virtual memory mapping into this area? How is this accomplished in the kernel, and are there other restrictions that the kernel will make when burnmemory is set?

Answer 1

When you use the burnmemory switch, the Windows kernel will reduce the physically accessible amount of memory starting from the bottom of the memory map upwards. The kernel doesn't allow user virtual memory mapping in this area, since the kernel itself is disallowed from mapping memory lower then the burnmemory limit.

When you boot the computer with that switch, the kernel determines the total physical memory, computes the highest addressable physical address (from the total RAM minus the given value in megabytes) after taking into account any gaps in system memory allocation (from boot time or other system use), and sets that as the lower-bound RAM address limit.

Do note, however, that the computed address differs from using the maxmem switch. The maxmem switch will use the megabyte value you specify as the direct hard limit on the addressable memory (so the total user-space memory is usually slightly smaller then the size you set). The burnmemory switch computes the minimum address as a combination of the value you specify, and any gaps in memory addresses or system-reserved addresses (so the total user-space memory set is the size you set).

From a kernel perspective, this switch literally modifies the lowest possible memory address (the kernel thinks that the ending address is the physical start of your system's memory). Any applications trying to access memory outside of the range would trigger DEP or a BSOD.