Windows® Internals, Sixth Edition, Part 2

You can use the MemInfo tool from Winsider Seminars & Solutions to dump the size of each standby paging list by using the –c flag. MemInfo will also display the number of repurposed pages for each standby list—this corresponds to the number of pages in each list that had to be reused to satisfy a memory allocation, and thus thrown out of the standby page lists. The following is the relevant output from the following command.C:\Windows\system32>meminfo -c MemInfo v2.10 - Show PFN database information Copyright (C) 2007-2009 Alex Ionescu www.alex-ionescu.com Initializing PFN Database... Done Priority Standby Repurposed 0 - Idle 0 ( 0 KB) 0 ( 0 KB) 1 - Very Low 41352 ( 165408 KB) 0 ( 0 KB) 2 - Low 7201 ( 28804 KB) 0 ( 0 KB) 3 - Background 2043 ( 8172 KB) 0 ( 0 KB) 4 - Background 24715 ( 98860 KB) 0 ( 0 KB) 5 - Normal 7895 ( 31580 KB) 0 ( 0 KB) 6 - Superfetch 23877 ( 95508 KB) 0 ( 0 KB) 7 - Superfetch 8435 ( 33740 KB) 0 ( 0 KB) TOTAL 115518 ( 462072 KB) 0 ( 0 KB)

You can add the –i flag to MemInfo to continuously display the state of the standby page lists and repurpose counts, which is useful for tracking memory usage as well as the following experiment. Additionally, the System Information panel in Process Explorer (choose View, System Information) can also be used to display the live state of the prioritized standby lists, as shown in this screen shot:

On the recently started x64 system used in this experiment (see the previous MemInfo output), there is no data cached at priority 0, about 165 MB at priority 1, and about 29 MB at priority 2. Your system probably has some data in those priorities as well.

The following shows what happens when we use the TestLimit tool from Sysinternals to commit and touch 1 GB of memory. Here is the command you use (to leak and touch memory in 20 chunks of 50 MB):testlimit -d 50 -c 20

Here is the output of MemInfo just before the run:Priority Standby Repurposed 0 - Idle 0 ( 0 KB) 2554 ( 10216 KB) 1 - Very Low 92915 ( 371660 KB) 141352 ( 565408 KB) 2 - Low 35783 ( 143132 KB) 0 ( 0 KB) 3 - Background 50666 ( 202664 KB) 0 ( 0 KB) 4 - Background 15236 ( 60944 KB) 0 ( 0 KB) 5 - Normal 34197 ( 136788 KB) 0 ( 0 KB) 6 - Superfetch 2912 ( 11648 KB) 0 ( 0 KB) 7 - Superfetch 5876 ( 23504 KB) 0 ( 0 KB) TOTAL 237585 ( 950340 KB) 143906 ( 575624 KB)

And here is the output after the allocations are done but the TestLimit process still exists:Priority Standby Repurposed 0 - Idle 0 ( 0 KB) 2554 ( 10216 KB) 1 - Very Low 5 ( 20 KB) 234351 ( 937404 KB) 2 - Low 0 ( 0 KB) 35830 ( 143320 KB) 3 - Background 9586 ( 38344 KB) 41654 ( 166616 KB) 4 - Background 15371 ( 61484 KB) 0 ( 0 KB) 5 - Normal 34208 ( 136832 KB) 0 ( 0 KB) 6 - Superfetch 2914 ( 11656 KB) 0 ( 0 KB) 7 - Superfetch 5881 ( 23524 KB) 0 ( 0 KB) TOTAL 67965 ( 271860 KB) 314389 (1257556 KB)

Note how the lower-priority standby page lists were used first (shown by the repurposed count) and are now depleted, while the higher lists still contain valuable cached data.

Modified Page Writer

The memory manager employs two system threads to write pages back to disk and move those pages back to the standby lists (based on their priority). One system thread writes out modified pages (MiModifiedPageWriter) to the paging file, and a second one writes modified pages to mapped files (MiMappedPageWriter). Two threads are required to avoid creating a deadlock, which would occur if the writing of mapped file pages caused a page fault that in turn required a free page when no free pages were available (thus requiring the modified page writer to create more free pages). By having the modified page writer perform mapped file paging I/Os from a second system thread, that thread can wait without blocking regular page file I/O.

Both threads run at priority 17, and after initialization they wait for separate objects to trigger their operation. The mapped page writer waits on an event, MmMappedPageWriterEvent. It can be signaled in the following cases:

During a page list operation (MiInsertPageInLockedList or MiInsertPageInList). These routines signal this event if the number of file-system-destined pages on the modified page list has reached more than 800 and the number of available pages has fallen below 1,024, or if the number of available pages is less than 256.

In an attempt to obtain free pages (MiObtainFreePages).