Windows® Internals, Sixth Edition, Part 2

The second PFN in Figure 10-42 is for a page on either the standby or the modified list. In this case, the forward and backward link fields link the elements of the list together within the list. This linking allows pages to be easily manipulated to satisfy page faults. When a page is on one of the lists, the share count is by definition 0 (because no working set is using the page) and therefore can be overlaid with the backward link. The reference count is also 0 if the page is on one of the lists. If it is nonzero (because an I/O could be in progress for this page—for example, when the page is being written to disk), it is first removed from the list.

The third PFN in Figure 10-42 is for a page that belongs to a kernel stack. As mentioned earlier, kernel stacks in Windows are dynamically allocated, expanded, and freed whenever a callback to user mode is performed and/or returns, or when a driver performs a callback and requests stack expansion. For these PFNs, the memory manager must keep track of the thread actually associated with the kernel stack, or if it is free it keeps a link to the next free look-aside stack.

The fourth PFN in Figure 10-42 is for a page that has an I/O in progress (for example, a page read). While the I/O is in progress, the first field points to an event object that will be signaled when the I/O completes. If an in-page error occurs, this field contains the Windows error status code representing the I/O error. This PFN type is used to resolve collided page faults.

In addition to the PFN database, the system variables in Table 10-19 describe the overall state of physical memory.

Table 10-19. System Variables That Describe Physical Memory

Variable

Description

MmNumberOfPhysicalPages

Total number of physical pages available on the system

MmAvailablePages

Total number of available pages on the system—the sum of the pages on the zeroed, free, and standby lists

MmResidentAvailablePages

Total number of physical pages that would be available if every process was trimmed to its minimum working set size and all modified pages were flushed to disk

EXPERIMENT: Viewing PFN Entries

You can examine individual PFN entries with the kernel debugger !pfn command. You need to supply the PFN as an argument. (For example, !pfn 1 shows the first entry, !pfn 2 shows the second, and so on.) In the following example, the PTE for virtual address 0x50000 is displayed, followed by the PFN that contains the page directory, and then the actual page:lkd> !pte 50000 VA 00050000 PDE at 00000000C0600000 PTE at 00000000C0000280 contains 000000002C9F7867 contains 800000002D6C1867 pfn 2c9f7 ---DA--UWEV pfn 2d6c1 ---DA--UW-V lkd> !pfn 2c9f7 PFN 0002C9F7 at address 834E1704 flink 00000026 blink / share count 00000091 pteaddress C0600000 reference count 0001 Cached color 0 Priority 5 restore pte 00000080 containing page 02BAA5 Active M Modified lkd> !pfn 2d6c1 PFN 0002D6C1 at address 834F7D1C flink 00000791 blink / share count 00000001 pteaddress C0000280 reference count 0001 Cached color 0 Priority 5 restore pte 00000080 containing page 02C9F7 Active M Modified

You can also use the MemInfo tool to obtain information about a PFN. MemInfo can sometimes give you more information than the debugger’s output, and it does not require being booted into debugging mode. Here’s MemInfo’s output for those same two PFNs:C:\>meminfo -p 2c9f7 PFN: 2c9f7 PFN List: Active and Valid PFN Type: Page Table PFN Priority: 5 Page Directory: 0x866168C8 Physical Address: 0x2C9F7000 C:\>meminfo -p 2d6c1 PFN: 2d6c1 PFN List: Active and Valid PFN Type: Process Private PFN Priority: 5 EPROCESS: 0x866168C8 [windbg.exe] Physical Address: 0x2D6C1000

MemInfo correctly recognized that the first PFN was a page table and that the second PFN belongs to WinDbg, which was the active process when the !pte 50000 command was used in the debugger.

Physical Memory Limits

Now that you’ve learned how Windows keeps track of physical memory, we’ll describe how much of it Windows can actually support. Because most systems access more code and data than can fit in physical memory as they run, physical memory is in essence a window into the code and data used over time. The amount of memory can therefore affect performance, because when data or code that a process or the operating system needs is not present, the memory manager must bring it in from disk or remote storage.