As is widely known, a program running under 32-bit Windows OS has only 2GB of virtual memory available. Also it is known that the other 2GB are reserved as Kernel space. But what is actually in that kernel space?
I could understand reserve needed for kernel itself, but why kernel space in VAS of process? Thanks.
Get the Windows Internals book, it describes this in gory detail. For the short summary though, some things that are in the kernel virtual address (KVA) space:
1) The kernel and HAL
2) The device drivers
3) The kernel mode heaps (called the executive pools, which I always find amusing)
4) The objects exported to user mode via handles (process, thread, event, mutex, etc. objects)
5) System PTEs, which map all kinds of interesting things away from the grubby user mode apps (e.g. the execution stacks that threads use when running in kernel mode)
6) The file system cache
And the list goes on and on…Like I said, read Windows Internals.
-scott