Windows Internals has a section on virtual memory. I understand that the PFN fields in L4 entries, PDPEs, and PDEs refer to the base address of the next level tables, and that the PTE's PFN refers to the location of the page in memory (after shifting).

I also understand that the Windows' PFN database contains additional information about every page. It appears to be indexed by the PTE's PFN. That would mean one should exist per PDE. Is that true? How is it located?

Perhaps it's in the book but then I must be overlooking it.


The PFN database is at high-canonical virtual address 0xFFFFFA8000000000. It can be a maximum virtual size 0x57FFFFFFFFF (6TiB) (0x1D5555556 entries of size 0x30 bytes each). This covers 512 TiB (49 bits) even though only 256TiB physical space is allowed on 64 bit Intel chipsets (restricted by 48 bit PTE address fields) (0x1D5555556*PageSize = 512TiB). On my machine the PFN Database appears to be from 0xFFFFFA8000000000 - 0xFFFFFFFFFFFFFFFF despite the fact that only 48 bit physical addresses are allowed; I would have thought the kernel would have shrunk it by half). PFN 0 corresponds to the first physical frame at PA 0x0000; PFN 1 corresponds to the 2nd physical frame at 0x1000 and so on.

Use the PFN number (high 36 bits of the 48 bit physical address) to index into the PFN (times it by 0x30 entry size) to get the MMPFN that describes that physical frame.

MMPFN format:

enter image description here

Certain MMPFNs will be on certain lists (zero, free, standby, modified) connected by the forward and backward links connecting them to another MMPFN that is connected on the list.

Type: The type of page represented by this PFN. (Types include active/valid, standby, modified, modified-no-write, free, zeroed, bad, and transition.)

Colour: Besides being linked together on a list, PFN database entries use an additional field to link physical pages by “colour,” which is the page’s NUMA node number.

PFN of PTE aka. 'containing page': the physical frame number of the page containing the PTE that points to this physical frame: !pfn containing page

Original PTE contents – allows for restore of the contents of the PTE when it has been marked as a page fault page.

PTE address is the virtual address of the PTE that points to the page (kernel memory VA that is mapped to all processes). See here for how to get virtual address of PTE, PDE, PDPTE and PML4E for a virtual address: https://stackoverflow.com/a/55599816/7194773. To get the virtual address that this PTE covers, you need to reverse the equation in the link above, so #define MiPteToAddress(x) ((PVOID)((ULONG)(x) << 10))

The reference count is incremented when a page is first added to a working set and/or when the page is locked in memory for I/O (for example, by a device driver). The reference count is decremented when the share count becomes 0 or when pages are unlocked from memory. When the share count becomes 0, the page is no longer owned by a working set. Then, if the reference count is also zero, the PFN database entry that describes the page is updated to add the page to the free, standby, or modified list.

The share count field represents the number of PTEs that refer to this page (as pages marked read-only, copy-on-write, or shared read/write can be shared by multiple processes).

If the frame is part of the working set of the process then it will have a working set index which is the index into the array of MMWSLEs of the process. The array is pointed to by the MMWSL structure which is pointed to by the MMSUPPORT structure which is pointed to by the EPROCESS structure.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.