Re: Taskmgr里面的PF usage由哪些部分组成?

Windows内核调试

Taskmgr里面的PF usage由哪些部分组成?

---

Thomson 2009-04-27, 22:59 下午

在xp的taskmgr下面看到有一个PF usage,这个数值由哪些部分组成呢? 除了每个process的virtual size,还有其它的吗?

Re: Taskmgr里面的PF usage由哪些部分组成?

---

MJ0011 2009-04-27, 23:55 下午
PF Usage(页面文件使用量）是通过ZwQuerySystemInformation(SystemPerformanceInformation)获取的

typedef struct _SYSTEM_PERFORMANCE_INFORMATION {
LARGE_INTEGER IdleProcessTime;
LARGE_INTEGER IoReadTransferCount;
LARGE_INTEGER IoWriteTransferCount;
LARGE_INTEGER IoOtherTransferCount;
ULONG IoReadOperationCount;
ULONG IoWriteOperationCount;
ULONG IoOtherOperationCount;
ULONG AvailablePages;
SYSINF_PAGE_COUNT CommittedPages;
SYSINF_PAGE_COUNT CommitLimit;
SYSINF_PAGE_COUNT PeakCommitment;
ULONG PageFaultCount;
ULONG CopyOnWriteCount;
ULONG TransitionCount;
ULONG CacheTransitionCount;
ULONG DemandZeroCount;
ULONG PageReadCount;
ULONG PageReadIoCount;
ULONG CacheReadCount;
ULONG CacheIoCount;
ULONG DirtyPagesWriteCount;
ULONG DirtyWriteIoCount;
ULONG MappedPagesWriteCount;
ULONG MappedWriteIoCount;
ULONG PagedPoolPages;
ULONG NonPagedPoolPages;
ULONG PagedPoolAllocs;
ULONG PagedPoolFrees;
ULONG NonPagedPoolAllocs;
ULONG NonPagedPoolFrees;
ULONG FreeSystemPtes;
ULONG ResidentSystemCodePage;
ULONG TotalSystemDriverPages;
ULONG TotalSystemCodePages;
ULONG NonPagedPoolLookasideHits;
ULONG PagedPoolLookasideHits;
ULONG AvailablePagedPoolPages;
ULONG ResidentSystemCachePage;
ULONG ResidentPagedPoolPage;
ULONG ResidentSystemDriverPage;
ULONG CcFastReadNoWait;
ULONG CcFastReadWait;
ULONG CcFastReadResourceMiss;
ULONG CcFastReadNotPossible;
ULONG CcFastMdlReadNoWait;
ULONG CcFastMdlReadWait;
ULONG CcFastMdlReadResourceMiss;
ULONG CcFastMdlReadNotPossible;
ULONG CcMapDataNoWait;
ULONG CcMapDataWait;
ULONG CcMapDataNoWaitMiss;
ULONG CcMapDataWaitMiss;
ULONG CcPinMappedDataCount;
ULONG CcPinReadNoWait;
ULONG CcPinReadWait;
ULONG CcPinReadNoWaitMiss;
ULONG CcPinReadWaitMiss;
ULONG CcCopyReadNoWait;
ULONG CcCopyReadWait;
ULONG CcCopyReadNoWaitMiss;
ULONG CcCopyReadWaitMiss;
ULONG CcMdlReadNoWait;
ULONG CcMdlReadWait;
ULONG CcMdlReadNoWaitMiss;
ULONG CcMdlReadWaitMiss;
ULONG CcReadAheadIos;
ULONG CcLazyWriteIos;
ULONG CcLazyWritePages;
ULONG CcDataFlushes;
ULONG CcDataPages;
ULONG ContextSwitches;
ULONG FirstLevelTbFills;
ULONG SecondLevelTbFills;
ULONG SystemCalls;
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;

使用其中的CommittedPages * (内存页面大小/1024)计算出来的
实际就是系统中的提交页面数量

Re: Taskmgr里面的PF usage由哪些部分组成?

---

MJ0011 2009-04-28, 00:09 上午
验证了一下~

HMODULE hlib = LoadLibrary("ntdll.dll");
PVOID p = GetProcAddress(hlib , "ZwQuerySystemInformation");

SYSTEM_PERFORMANCE_INFORMATION info ;
SYSTEM_BASIC_INFORMATION basinfo ;
ULONG cb = sizeof(info);
ULONG cb1 = sizeof(basinfo);

__asm
{
push 0
push cb1
lea eax ,basinfo
push eax
push 0 //SystemBasicInformation
call p
push 0
push cb
lea eax ,info
push eax
push 2 //SystemPerformanceInformation
call p
}
LONG mbs = info.CommittedPages * (basinfo.PageSize /1024) /1024;

printf("pf usage : %u MB(s)\n",mbs);

getchar();

Re: Taskmgr里面的PF usage由哪些部分组成?

---

格蠹老雷 2009-04-28, 12:40 下午
回答的精彩，不仅说其然，而且说其何以然:-)

Re: Taskmgr里面的PF usage由哪些部分组成?

---

王宇 2009-04-28, 13:42 下午

嗯，应该就是这么计算的。

专门去找了一下实现 ( ..\private\windows\shell\taskman )，但是没找着...

在 shell 文件夹下，最多的就是计算内存大小，方法也类似：

    //
    // Memory
    //

    Status = NtQuerySystemInformation(
                SystemBasicInformation,
                &BasicInfo,
                sizeof(BasicInfo),
                NULL
                );

    if (!NT_SUCCESS(Status)) {

        return;
    }

    dwTotalPhys = BasicInfo.NumberOfPhysicalPages *
                                          (BasicInfo.PageSize / 1024);

Re: Taskmgr里面的PF usage由哪些部分组成?

---

Thomson 2009-04-28, 22:59 下午
谢谢MJ0011, 回答很精彩...

另外,关于PF usage的获得,NtQuerySystemInformation应该就是根据nt!MmTotalCommittedPages换算出来的,那么这个值里面都包括哪些内存呢? 直接commit的private类型的肯定算在里面,还包括其它的吗?有没有一个列表什么的.(最好是有一个什么公式可以计算出这个值)

我看到好多处都在改这个变量.

Re: Taskmgr里面的PF usage由哪些部分组成?

---

王宇 2009-04-29, 09:55 上午
下了个 ba 看了看，集中在几个函数：MiChargeCommitment、MiChargeCommitmentCantExpand 还有 MiInitializeLoadedModuleList。

其中以 ExAllocatePoolWithTag -> MiAllocatePoolPages -> MiChargeCommitmentCantExpand 分支最频繁。

MiInitializeLoadedModuleList 函数主要是从 PsLoadedModuleList 开始计算
CommittedPages += (DataTableEntry1->SizeOfImage >> PAGE_SHIFT);

MmTotalCommittedPages += CommittedPages;

需要啃代码了...