1

I'd like to battle paged pool memory leak caused by audio driver. I came up with the idea to limit the paged pool memory size to a reasonable amount. In "Windows Internals, Part 1" book by SysInternals on page 363 I found out about Memory Management Registry Keys. However the article states keys described — including PagedPoolLimit — are for 32-bit operating systems only.

Is there any other way I can manage this in 64-bit Windows 10? Or maybe that's a bad idea altogether.

Here's extraction from the book in case I misunderstand something: Book

And here's an article by IBM that doesn't mention 32-bit-only compatibility.

P.S. Here's what my paged pool memory leak looks like after a week of uptime (I'm 100% sure it's audio driver since I did my troubleshooting via PoolMon of WDK and Windows Performance Analyzer of Windows SDK as briely described in this answer and in SysInternals book): Task Manager PoolMon

Update In Windows Internals (7th edition) at page 384 it is stated that maximum paged pool size for 64-bit Windows 10 is 15.5 TB. It provides explanation where this size is set. But I have no idea how to change this (i.e. to 5 or 10% of physical RAM). Here's an extraction from the book:

Four of these computed sizes are stored in kernel variables in Windows 8.x and Server 2012/R2. Three of these are exposed as performance counters and one is computed only as a performance counter value. Windows 10 and Server 2016 moved the global variables into fields in a global memory management structure (MI_SYSTEM_INFORMATION) named MiState. Within this lies a variable named Vs (of type _MI_VISIBLE_STATE) where this information resides. The global variable MiVisibleState also points to that Vs member. These variables and counters are listed in Table 5-5.

Book

bananakid
  • 63
  • 7
  • I would trust Microsoft's documentation over anything IBM has generated about Windows. The Microsoft documentation is crystal clear, the registry keys you are asking, have no effect on a 64-bit installation of Windows. You should focus on identify the memory leak and then addressing potential solutions to that problem instead of focusing on something that "has not effect on 64-bit installations of Windows" – Ramhound Feb 24 '23 at 10:22
  • I identified memory leak on multiple machines with different versions of OS and driver, but there's no solution to be found and there's next to none hope it's going to get fixed (I have reported leak to the driver manufacturer). It doesn't help the other users of similar machines appear to be toxic or not caring. You can have a brief explanation in [my other question](https://apple.stackexchange.com/questions/455313/) that has been closed. I asked this question because I think there may be some way to limit paged pool no via registry key but via some process executed with SYSTEM user. – bananakid Feb 24 '23 at 10:30
  • So what is your question, after knowing the specific registry keys, have no effect on a 64-bit installation of Windows? There is no way to limit the page pool, for the reason described by Microsoft, "System virtual address space is not subject to exhaustion by fragmentation on 64-bit systems." I am neither toxic nor uncaring. I want to answer questions that have answers, your problem has an answer, but apparently, that solution isn't probably due to the manufacture's inaction. If it wasn't for signed drivers, and driver enforcement, you could in theory fix the driver yourself through assembly – Ramhound Feb 24 '23 at 10:41
  • You misunderstood, I wasn't calling you toxic or uncaring. I do run unsigned modified drivers perfectly fine but I'm not competent to fix driver through assembly. My question was asked in hope I'm missing or misunderstand something (as stated in OP). – bananakid Feb 24 '23 at 10:55
  • I double-checked if `"PagedPoolLimit"=dword:000001c0`, `"PagedPoolQuota"=dword:000001c0` and `"PagedPoolSize"=dword:000001c0` (448 MB) will make any difference on a 64-bit system. Unfortunately, negative, o there's no errr in Microsoft's article. – bananakid Feb 25 '23 at 08:50

1 Answers1

0

I think that a better battle strategy would be to find the buggy driver and try to locate a fix. For example, perhaps a newer driver version from the manufacturer could fix the problem.

To identify the troublesome driver, see PoolMonX. The last release dates from 2017, but it still works on Windows 10 64-bit.

You can click on a column in PoolMonX to sort by ascending or descending order.

enter image description here

Useful information:

In the article Memory Performance Information you will find QuotaNonPagedPoolUsage which seems to be the nonpaged pool quota for any single process.

In the article Win32_Process you will find this information :

QuotaNonPagedPoolUsage

Quota amount of nonpaged pool usage for a process.

Example:

Get-CimInstance -ClassName Win32_Process | Select-Object -Property Handle, QuotaNonPagedPoolUsage

There might be a way to set QuotaNonPagedPoolUsage for AppleAudio.sys.

There is also at registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management the values of NonPagedPoolQuota and NonPagedPoolSize, but some reports doubt their effect in 64-bit Windows.

harrymc
  • 455,459
  • 31
  • 526
  • 924
  • Unfortunately I cannot accept this answer because I've done the steps before asking a question and provided this information in OP. I already know what device driver is causing paged memory pool leak: it's audio driver AppleAudio.sys leaking memory when audio output through internal speakers is utilized. So you either have no audio at all or have a constant leak (I'm aware you can schedule RAMMap CLI task to purge active Working Sets but it's bad practice). While I have reported this bug to the driver developer via feedback page I'd very much prefer to fix of walkaround myself… – bananakid Feb 25 '23 at 09:40
  • 1
    I added more information in my answer. It seems that 64-bit Windows has dropped many of the limits that were available in 32-bit Windows, perhaps with the mistaken idea that virtual memory has become practically unlimited. – harrymc Feb 25 '23 at 10:30
  • Yep, I [tested](https://superuser.com/questions/1770468/limit-paged-pool-memory-size-in-windows-10-to-battle-driver-memory-leak?noredirect=1#comment2757905_1770468) PagedPoolQuota, PagedPoolSize, PagedPoolLimit (I've got paged pool leak, not no-paged pool leak), they all have no effect on 64-bit system. I have also tried disabling PnP service since according to Windows Intertals (7th edition) book, page 87, it's an undocumented PnP manager interface tag. Didn't help. – bananakid Feb 25 '23 at 10:40
  • I have also tested if this leaked memory is releasable at all: using NotMyFault I added an additional 70% physical RAM paged pool leak (I disabled virtual memory beforehand so total physical RAM usage was at around 95% with artificial NMF leak) and launched VM that configured to about 60% of physicals RAM. The NotMyFault leaked memory was immediately released, but the one consumed by AppleAudio.sys stayed not released. – bananakid Feb 25 '23 at 10:45
  • I'm afraid there is no other solution than the dangerous one of flushing the pool. Downgrading to Windows 32-bit where the limits are enforced, is a solution that is worse than the problem. – harrymc Feb 25 '23 at 10:45
  • I wish I could downgrade to 32-bit system if I needed to but unfortunately there are no 32-bit drivers at all. Regarding flushing the pool: do you happen to know why Task Manager keeps the pool usage data the same after flushing it with RAMMap? All of that may sound like I'm just too picky but I actually have a huge reason to fix this leak: because of another audio driver (or more likely a firmware) issue I have to keep audio interface running all the time to prevent popping sounds ([ongoing issue since 2018](https://cdm.link/2019/02/apple-2018-glitch/), affects Windows too). So leak is 24/7! – bananakid Feb 25 '23 at 10:55
  • Yes, I have seen this solution. I don't know about Task Manager, but if flushing improves the situation then Task Manager might be reporting unupdated performance data. You could use the Task Scheduler to run flushing periodically to work around the problem, but not too frequently. – harrymc Feb 25 '23 at 11:03
  • I looks like I found the location of the limit of paged pool memory in 64-bit system. However I now need assistance in editing variable `MiState.Vs.SizeOfPagedPoolInBytes` of global memory management structure (`MI_SYSTEM_INFORMATION`) named `MiState`. Within this lies a variable named `Vs` (of type `_MI_VISIBLE_STATE`) where this information resides. The global variable `MiVisibleState` also points to that `Vs` member. I updated question with book extraction. – bananakid Feb 25 '23 at 11:40
  • 1
    If you wish to hack the Windows kernel, you might need [Blackbone](https://github.com/DarthTon/Blackbone). But your project is blowing up out of proportions. Flushing the pool will be much easier... – harrymc Feb 25 '23 at 15:15
  • I wish I could just flush but I prefer to run without pagefile.sys (without virtual memory). ASAIK this makes flushing of modified pages impossible (to release leaked paged memory pool by kernel level driver I have to use RAMMap Empty Working Sets, Modified Lists and Standby Lists in this particular order). Please correct me if I'm wrong. Thanks for Backbone thing. – bananakid Feb 25 '23 at 15:50