Windows® Internals, Sixth Edition, Part 2

The swapper is also awakened by the scheduling code in the kernel if a thread that needs to run has its kernel stack swapped out or if the process has been swapped out. The swapper looks for threads that have been in a wait state for 15 seconds (or 3 seconds on a system with less than 12 MB of RAM). If it finds one, it puts the thread’s kernel stack in transition (moving the pages to the modified or standby lists) so as to reclaim its physical memory, operating on the principle that if a thread’s been waiting that long, it’s going to be waiting even longer. When the last thread in a process has its kernel stack removed from memory, the process is marked to be entirely outswapped. That’s why, for example, processes that have been idle for a long time (such as Winlogon is after you log on) can have a zero working set size.

System Working Sets

Just as processes have working sets that manage pageable portions of the process address space, the pageable code and data in the system address space is managed using three global working sets, collectively known as the system working sets:

The system cache working set (MmSystemCacheWs) contains pages that are resident in the system cache.

The paged pool working set (MmPagedPoolWs) contains pages that are resident in the paged pool.

The system PTEs working set (MmSystemPtesWs) contains pageable code and data from loaded drivers and the kernel image, as well as pages from sections that have been mapped into the system space.

You can examine the sizes of these working sets or the sizes of the components that contribute to them with the performance counters or system variables shown in Table 10-22. Keep in mind that the performance counter values are in bytes, whereas the system variables are measured in terms of pages.

(You can also examine the paging activity in the system cache working set by examining the Memory: Cache Faults/sec performance counter, which describes page faults that occur in the system cache working set (both hard and soft). MmSystemCacheWs.PageFaultCount is the system variable that contains the value for this counter.

Table 10-22. System Working Set Performance Counters

Performance Counter (in Bytes)

System Variable (in Pages)

Description

Memory: Cache Bytes, also

Memory: System Cache Resident Bytes

MmSystemCacheWs.

WorkingSetSize

Physical memory consumed by the file system cache.

Memory: Cache Bytes Peak

MmSystemCacheWs.Peak

Peak system working set size.

Memory: System Driver Resident Bytes

MmSystemDriverPage

Physical memory consumed by pageable device driver code.

Memory: Pool Paged Resident Bytes

MmPagedPoolWs.

WorkingSetSize

Physical memory consumed by paged pool.

Memory Notification Events

Windows provides a way for user-mode processes and kernel-mode drivers to be notified when physical memory, paged pool, nonpaged pool, and commit charge are low and/or plentiful. This information can be used to determine memory usage as appropriate. For example, if available memory is low, the application can reduce memory consumption. If available paged pool is high, the driver can allocate more memory. Finally, the memory manager also provides an event that permits notification when corrupted pages have been detected.

User-mode processes can be notified only of low or high memory conditions. An application can call the CreateMemoryResourceNotification function, specifying whether low or high memory notification is desired. The returned handle can be provided to any of the wait functions. When memory is low (or high), the wait completes, thus notifying the thread of the condition. Alternatively, the QueryMemoryResourceNotification can be used to query the system memory condition at any time without blocking the calling thread.

Drivers, on the other hand, use the specific event name that the memory manager has set up in the \KernelObjects directory, since notification is implemented by the memory manager signaling one of the globally named event objects it defines, shown in Table 10-23.

Table 10-23. Memory Manager Notification Events

Event Name

Description

HighCommitCondition

This event is set when the commit charge is near the maximum commit limit. In other words, memory usage is very high, very little space is available in physical memory or paging files, and the operating system cannot increase the size of its paging files.

HighMemoryCondition

This event is set whenever the amount of free physical memory exceeds the defined amount.

HighNonPagedPoolCondition

This event is set whenever the amount of nonpaged pool exceeds the defined amount.

HighPagedPoolCondition