What is kernel space

The OS divide the space into two parts, Kernel- space and User space
I search the MSDN online support, and found only one page has session space
But I don’t understand what session space is. Why kernel is not loaded into kernel space

What different purpose of Kernel and session space

Thank
We

http://msdn.microsoft.com/library/de...ccodes_7g6f.as

Why the driver image is not loaded Kernel space

Bug Check 0xCF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFER ENC
The TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFER ENCE bug check has a value of 0x000000CF. This indicates that a driver has been incorrectly ported to the terminal server
Parameter
The following parameters are displayed on the blue screen
Parameter Descriptio
1 Memory address reference
2 0: Read
1: Writ
3 Address that referenced memory (if known
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver
Caus
The driver is referencing session space addresses from the system process context. This probably results from the driver queuing an item to a system worker thread
This driver needs to comply with Terminal Server's memory management rules

Re-promote my question again

What is session space? This is my question

XP divided the space into two parts, Kernel- space and User space

But what is session space? I found that the drivers are loaded into session space
I am confusing kernel with session spaces.

Then I search the MSDN online support, and find only one page has key words about session space
http://msdn.microsoft.com/library/de...ccodes_7g6f.as

"The driver is referencing session space addresses from the system process context.

What different about those space?
Why the driver image is not loaded into Kernel space

Thank
We

To 3 parts.

Kernel, (0x80000000 - 0x9fffffff and 0xb0000000 - 0xffffffff), Session
(0xa0000000 - 0xafffffff) and User (below 0x80000000).

Session space is accessible only from kernel mode (Ring 0 on x86), and its
mapped content is per-desktop-session - 1 for interactive user and IIRC all
services, and 1 another for each Remote Desktop user.

The windowing subsystem (win32k) and the video card driver DLL live in session
space.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

HI maxim

I try to list all module address by WINDBG comman

But I found some information is not match your explain.

************************************************** **************************
Here is my syste

VIA KT / ATI 9700 PRO / XP SP

But
win32k is in 0xbf800000 - 0xbf9bf38
ati2dvag is in 0xbf9c0000 - 0xbfa0e000
ati3duag is in 0xbfa0e000 - 0xbfb17320

Win32K and Video driver is not in session space Session (0xa0000000 - 0xafffffff

Another question, what is IIRC ? Is session space special for Graphics adapter


Thank
We

kd> !l
119 loaded modules..
base - end nam
0x804d7000 - 0x806ca100 ntoskrn
0x806cb000 - 0x806dec80 halacp
0xb60b1000 - 0xb60f1180 HTT
0xb61e2000 - 0xb6272dc0 NAVEX1
0xb6273000 - 0xb629c7a0 NAVA
0xb6535000 - 0xb6541600 SYMEVEN
0xb67cd000 - 0xb67f6e80 kmixe
0xb67f7000 - 0xb6848680 sr
0xb6934000 - 0xb6948180 wdmau
0xb6999000 - 0xb69c4f00 mrxda
0xb6a99000 - 0xb6a9b0c0 NAVAPE
0xb6add000 - 0xb6ae0c00 DbgMs
0xb6c51000 - 0xb6c54200 ndisui
0xb6d35000 - 0xb6d4c500 dump_atap
0xb6d75000 - 0xb6d8a480 ipna
0xb6d8b000 - 0xb6df6780 mrxsm
0xb6df7000 - 0xb6e21c80 rdbs
0xb6e62000 - 0xb6e70f00 sysaudi
0xb6ec2000 - 0xb6ee3d80 af
0xb6ee4000 - 0xb6f0b880 netb
0xb6f0c000 - 0xb6f63400 tcpi
0xb6f64000 - 0xb6f76e80 ipse
0xb6ffc000 - 0xb6ffe900 Dxap
0xbf800000 - 0xbf9bf380 win32
0xbf9c0000 - 0xbfa0e000 ati2dva
0xbfa0e000 - 0xbfb17320 ati3dua
0xbff80000 - 0xbff91500 dx
0xf9245000 - 0xf9274180 updat
0xf9275000 - 0xf92a4c80 rdpd
0xf92a5000 - 0xf92b5b80 psche
0xf92c6000 - 0xf92d5400 NAVEN
0xf9356000 - 0xf936c700 ndiswa
0xf936d000 - 0xf9380780 parpor
0xf9381000 - 0xf93a4000 portcl
0xf93a4000 - 0xf93c6e00 USBPOR
0xf93c7000 - 0xf93e9500 k
0xf93ea000 - 0xf93fd700 VIDEOPR
0xf93fe000 - 0xf9496000 ati2mta
0xf95de000 - 0xf95f8a80 Mu
0xf95f9000 - 0xf974d0a0 NTic
0xf974e000 - 0xf976f0c0 Siwvi
0xf9770000 - 0xf979c780 NDI
0xf979d000 - 0xf97b3680 KSecD
0xf97b4000 - 0xf97d6700 Fastfa
0xf97d7000 - 0xf97f4300 fltmg
0xf97f5000 - 0xf980c900 SCSIPOR
0xf980d000 - 0xf981fd00 viasrai
0xf9820000 - 0xf9837500 atap
0xf9838000 - 0xf985d700 dmi
0xf985e000 - 0xf987c880 ftdis
0xf987d000 - 0xf988d880 pc
0xf988e000 - 0xf98bbc00 ACP
0xf98dd000 - 0xf98e5c00 isapn
0xf98ed000 - 0xf98f7080 MountMg
0xf98fd000 - 0xf9909c80 VolSna
0xf990d000 - 0xf9915d80 dis
0xf991d000 - 0xf9929180 CLASSPN
0xf992d000 - 0xf9937500 viaag
0xf993d000 - 0xf9947e80 uagp3
0xf994d000 - 0xf995be00 ohci139
0xf998d000 - 0xf9995100 process
0xf999d000 - 0xf99a8e80 cdro
0xf99ad000 - 0xf99bb000 redboo
0xf99bd000 - 0xf99c7b00 viaudi
0xf99cd000 - 0xf99dbb00 drm
0xf99dd000 - 0xf99ecc80 seria
0xf99ed000 - 0xf99f9e00 i8042pr
0xf99fd000 - 0xf9a09880 rasl2t
0xf9a0d000 - 0xf9a16800 raspppo
0xf9a1d000 - 0xf9a28d80 rasppt
0xf9a2d000 - 0xf9a35900 msgp
0xf9a3d000 - 0xf9a46e80 termd
0xf9a6d000 - 0xf9a76480 NDProx
0xf9a7d000 - 0xf9a8b080 usbhu
0xf9aad000 - 0xf9ab5700 netbio
0xf9add000 - 0xf9ae5880 Fip
0xf9afd000 - 0xf9b05700 wanar
0xf9b0d000 - 0xf9b1c900 Cdf
0xf9b5d000 - 0xf9b63180 PCIIDE
0xf9b65000 - 0xf9b69900 PartMg
0xf9b9d000 - 0xf9ba2000 usbuhc
0xf9ba5000 - 0xf9bab800 usbehc
0xf9bad000 - 0xf9bb3a00 fetnd
0xf9bb5000 - 0xf9bbba80 fd
0xf9bbd000 - 0xf9bc2a00 mouclas
0xf9bc5000 - 0xf9bcb000 kbdclas
0xf9bcd000 - 0xf9bd1880 TD
0xf9bd5000 - 0xf9bd9580 ptilin
0xf9bdd000 - 0xf9be1080 raspt
0xf9bed000 - 0xf9bf2200 vg
0xf9bf5000 - 0xf9bf9a80 Msf
0xf9bfd000 - 0xf9c04880 Npf
0xf9c05000 - 0xf9c09680 watchdo
0xf9ced000 - 0xf9cf0000 BOOTVI
0xf9d71000 - 0xf9d74c00 serenu
0xf9d75000 - 0xf9d77980 gameenu
0xf9d79000 - 0xf9d7b580 ndistap
0xf9d91000 - 0xf9d94c80 mssmbio
0xf9dc5000 - 0xf9dc7280 rasac
0xf9ddd000 - 0xf9ddec80 kd139
0xf9ddf000 - 0xf9de0100 WMILI
0xf9de1000 - 0xf9de2480 viaid
0xf9de3000 - 0xf9de4700 dmloa
0xf9de5000 - 0xf9de6d40 nmfilte
0xf9de7000 - 0xf9de8100 swenu
0xf9de9000 - 0xf9dea280 USBD
0xf9deb000 - 0xf9decf00 Fs_Rec
0xf9ded000 - 0xf9dee080 Beep
0xf9def000 - 0xf9df0080 mnmdd
0xf9df1000 - 0xf9df2080 RDPCDD
0xf9df3000 - 0xf9df4100 dump_WMILIB
0xf9e11000 - 0xf9e12a80 ParVdm
0xf9ea5000 - 0xf9ea54a0 Siwsym
0xf9eba000 - 0xf9ebab80 msmpu401
0xf9ebb000 - 0xf9ebbc00 audstub
0xf9ed8000 - 0xf9ed8b80 Null
0xf9f2f000 - 0xf9f2fd00 dxgthk
0x59ff0000 - 0x5a0a4000 ntdll
0x7ffe0000 - 0x7ffe1000 SharedUserData

Maybe I was mistaken in providing the exact addresses. On XP SP3 this area is a
session space.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

thanks

What is IIRC?
what is per-desktop-session

I am curious about session space

would you please kindly tell me more detail about session space feature

thank
we

Gosh Max, what beta program are you in? I only have XP SP2, RC1.

--
Gary G. Little
Seagate Technologies, LLC

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:%23ImtT35GEHA.740@tk2msftngp13.phx.gbl...

Sorry for typo. XP SP2, surely. The numbers I provided originally were w2k
if not NT4.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com


"Gary G. Little" <gary.g.little.nospam@seagate.com> wrote in message
news:mbycc.5094$_73.2393@newssvr23.news.prodigy.co m...

If session space can be accessed from kernel drivers, what is significance of this.

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message news:<eHZMUs9GEHA.704@tk2msftngp13.phx.gbl>...

wei <anonymous@discussions.microsoft.com> wrote:
"If I Recall Correctly".

If you use the multiple simultaneous users feature of Windows XP, where you
can have several different users logged in at once and shift between them,
then you are using an incredibly powerful part of Windows called "terminal
services". Each user in that case has their own "desktop session"; there
really can be multiple desktops in the system at onetime.

There just isn't that much to tell. It's just a part of the kernel address
space happens to be different for each desktop session. Usually, kernel
space is the same system-wide.

Unless you are writing very unusual drivers, you just don't have to worry
about it.
--
- Tim Roberts, timr@probo.com
Providenza & Boekelheide, Inc

If your number is real, session space Session (0xa0000000 -> 0xafffffff

so, the size of session space is 256M in 2K

and in X
win32k is in 0xbf800000 - 0xbf9bf38
ati2dvag is in 0xbf9c0000 - 0xbfa0e00
ati3duag is in 0xbfa0e000 - 0xbfb1732

then I suppose the session space is only 8M in XP. right ?