2月11日 pte,pde

kd> !pte
               VA 00000000
PDE at   C0300000        PTE at C0000000
contains 0E474067      contains 00000000
pfn e474 ---DA--UWEV

虚拟地址0x00000000的pte在虚拟地址0xc0000000,pde在虚拟地址0xc0300000,
因为每个pte映射一个页面,4k,每个pte在pde中占4个字节,,这样要映射全部4gb虚拟地址空间需要4g/4k*4=4m.
给pde分配一个页面,其中这4k中每4字节是一个pte的虚拟地址,而pde的这个页面也需要一个pte(页表项)来表示,页表是从0xc0000000开始放置.即地址0x00000000-0x00001000 这4k空间的pte表项存在0xc0000000开始的4字节中,,这样,,地址0xc0000000-0xc0001000的页表项放在0xc0300000开始的4字节中,,,所以这一个也表项正是pde所用的页,,,pde选在0xc0300000是有道理的 :>
通过pde找到第一个页表,也就找到了虚拟4g地址空间的开始

相关的一些
if paged pool expansion requires the allocation of a new system page table, the memory manager doesn't go back and update all the process page directories to point to the new system page table. Instead, it updates the process page directories when the processes reference the new virtual address.

Thus, a process can take a page fault when referencing paged pool that is in fact physically resident because its process page directory doesn't yet point to the new system page table that describes the new area of pool. Page faults don't occur when accessing nonpaged pool, even though it too can be expanded, because Windows 2000 builds enough system page tables to describe the maximum size during system initialization.