Windows 2000 Memory Windows 2000 Memory ManagementManagement

Computing Department,Computing Department,

Lancaster University, UKLancaster University, UK

OverviewOverview

• GoalsGoals– Overview of Memory ManagementOverview of Memory Management

•Virtual memoryVirtual memory

•Virtual address translationVirtual address translation

•Physical memoryPhysical memory

•Page files / page faultsPage files / page faults

•Working setWorking set

•Etc…Etc…

Virtual MemoryVirtual Memory• Virtual address space = logical viewVirtual address space = logical view

• Memory manager translates virtual addresses Memory manager translates virtual addresses into physical addressesinto physical addresses

• Paging transfers some memory contents to disk, Paging transfers some memory contents to disk, freeing physical memoryfreeing physical memory

Virtual MemoryPhysical Memory

Virtual Memory – Virtual Memory – Application’s ViewApplication’s View• Application always references “virtual Application always references “virtual

addresses”addresses”

• Not all of an application’s virtual address Not all of an application’s virtual address space is in physical memory at one timespace is in physical memory at one time– Application is fooled into thinking that it isApplication is fooled into thinking that it is– The rest is kept on disk, and is brought into The rest is kept on disk, and is brought into

physical memory as and when it is neededphysical memory as and when it is needed

Mapping Virtual to Physical Mapping Virtual to Physical PagesPages

Virtual Memory

Physical Memory

Page tableentries

Virtual Pages

Successive page table entries describesuccessive virtual pages, pointing to“scattered” physical pages

Windows 2000 Memory Windows 2000 Memory ManagerManager

• Provides a 4 GB flat virtual address Provides a 4 GB flat virtual address spacespace– PAE provides up to 64 GBs…PAE provides up to 64 GBs…

• Exports memory-mapped filesExports memory-mapped files

• Allows pages to be shared between Allows pages to be shared between processesprocesses

Virtual Address Space Virtual Address Space AllocationAllocation• Virtual address space is sparseVirtual address space is sparse

– Address space containsAddress space contains• Reserved regionsReserved regions• Committed regionsCommitted regions• Unused regionsUnused regions

• Unit of protection and usage is one pageUnit of protection and usage is one page– Page size within NT and 2000 is up to 64KPage size within NT and 2000 is up to 64K

• Large value chosen to allow support for future processors Large value chosen to allow support for future processors with large page sizeswith large page sizes

• No changes required to applications No changes required to applications making assumptions about allocation alignmentmaking assumptions about allocation alignment

• X86 uses 4K pagesX86 uses 4K pages

Kernel Mode vs. User ModeKernel Mode vs. User Mode

• Operating System ModesOperating System Modes– Kernel Mode (OS)Kernel Mode (OS)

• Privileged process modePrivileged process mode• Access to system data/hardwareAccess to system data/hardware

– User Mode (Applications)User Mode (Applications)• Nonprivileged processor modeNonprivileged processor mode• Limited access to system data/no direct hardware accessLimited access to system data/no direct hardware access

• Applications separated from the operating system Applications separated from the operating system – prevented from modifying critical data– prevented from modifying critical data

• Virtual Address Space (V.A.S.) divided into:Virtual Address Space (V.A.S.) divided into:– Process spaceProcess space– System spaceSystem space

Virtual Address Space Virtual Address Space (V.A.S.)(V.A.S.)

• Process space Process space contains:contains:– The application you are The application you are

running (.EXE + .DLLs)running (.EXE + .DLLs)– A user-mode stack for A user-mode stack for

each threadeach thread– All static storage defined All static storage defined

by the applicationby the application

UserAccessible

Kernel-modeaccessible

00000000

7FFFFFFF

80000000

FFFFFFFF

Unique perprocess

System-wide

Virtual Address Space Virtual Address Space (V.A.S.)(V.A.S.)

• System space System space contains:contains:– Executive, Kernel and Executive, Kernel and

HALHAL– Statically-allocated Statically-allocated

system-wide data cellssystem-wide data cells– Page tablesPage tables– Kernel-mode device Kernel-mode device

driversdrivers– File system cacheFile system cache– A kernel-mode stack A kernel-mode stack

for every thread for every thread in every in every processprocess

UserAccessible

Kernel-modeaccessible

00000000

7FFFFFFF

80000000

FFFFFFFF

Unique perprocess

System-wide

Windows 9x Virtual Address Windows 9x Virtual Address SpaceSpace

• 1 GB region for user-1 GB region for user-mode shared memorymode shared memory– Shared memory has same Shared memory has same

addresses in all processesaddresses in all processes– No protection between No protection between

applications for shared applications for shared memorymemory

UserAccessible

Shared, process-writable(DLLs,

shared memory, Win16 apps)

Unique perprocess

System-Wide, user mode

Windows 95OS

System-Wide, kernel mode

Virtual Address TranslationVirtual Address Translation

• Hardware converts each valid virtual address to a physical addressHardware converts each valid virtual address to a physical address

Address translation (hardware)

Virtual page number Byte within page

Byte within pagePhysical page number

PageTables

TranslationLookaside

Buffer

PageDirectory

virtual address

physical address

If page not valid

Page fault

Physical MemoryPhysical Memory

• Maximum physical memory supported by Maximum physical memory supported by Windows NT 4.0 is 4 GB for x86, 8 GB for AlphaWindows NT 4.0 is 4 GB for x86, 8 GB for Alpha

• Windows 2000 has extended addressing Windows 2000 has extended addressing supportsupport– Can address up to 64 GB on an x86 using 36-bit Can address up to 64 GB on an x86 using 36-bit

PAE – Physical Address Extension – introduces a PAE – Physical Address Extension – introduces a “page directory pointer table”“page directory pointer table”

– PAE really is just a stop-gap…PAE really is just a stop-gap…– Maximum supported memory on Windows 2000Maximum supported memory on Windows 2000

• Professional, Server: Professional, Server: 4GB4GB• Advanced Server:Advanced Server: 8GB8GB• Datacenter ServerDatacenter Server 64GB64GB

Increased Limits in 64-bit Increased Limits in 64-bit Windows 2000Windows 2000

64-bit Win2000 32-bit 64-bit Win2000 32-bit Win2000Win2000

Virtual memoryVirtual memory 16 TB16 TB 4 GB4 GB

System cacheSystem cache 1 TB1 TB 1 GB1 GB

Paging file sizePaging file size 512 TB512 TB 16 TB16 TB

Paged poolPaged pool 128 GB128 GB 470 MB470 MB

Non-paged poolNon-paged pool 128 GB128 GB 256 MB256 MB

Page FilesPage Files

• Only used when private memory requirements Only used when private memory requirements exceed the amount of physical memory exceed the amount of physical memory availableavailable

• Size depends on virtual memory requirements Size depends on virtual memory requirements of applications and driversof applications and drivers– Minimum page file size should be maximum of the Minimum page file size should be maximum of the

normal “virtual memory” usagenormal “virtual memory” usage No pagefile fragmentationNo pagefile fragmentation• Hard disk space is cheapHard disk space is cheap

• Contiguous page files do help!Contiguous page files do help!– Will be, when created, if space is availableWill be, when created, if space is available– Or defrag… (Pagedefrag tool)Or defrag… (Pagedefrag tool)

Page Files (2)Page Files (2)

• When page file space runs low:When page file space runs low:– 1. “System running low on virtual 1. “System running low on virtual

memory”memory”•First time: Before pagefile expansionFirst time: Before pagefile expansion

•Second time: When committed bytes Second time: When committed bytes reaching commit limitreaching commit limit

– 2. “System out of virtual memory”2. “System out of virtual memory”•Page files are fullPage files are full

Who is Consuming Pagefile Who is Consuming Pagefile Space?Space?• Process memory leakProcess memory leak

– Task Manager, Processes tab, VM sizeTask Manager, Processes tab, VM size– Or Perfmon “private bytes”Or Perfmon “private bytes”

• Paged pool leakPaged pool leak– Could be a result of processes not Could be a result of processes not

closing handlesclosing handles•Task Manager, Processes tab, Handle countTask Manager, Processes tab, Handle count

Memory Management Memory Management InformationInformation

• Total committed Total committed private virtual private virtual memory (total of memory (total of “VM size” + “VM size” + Kernel Memory Kernel Memory Paged)Paged)

• ““Commit charge Commit charge limit” = sum of limit” = sum of physical memory physical memory available + available + current total size current total size of paging filesof paging files

2

1

1

2

1

1

2

Page FaultsPage Faults

• A page fault occurs when there is a reference to a page A page fault occurs when there is a reference to a page that isn’t mapped to a physical pagethat isn’t mapped to a physical page

• The system goes to the appropriate block in the The system goes to the appropriate block in the associated file to find the contents of the page:associated file to find the contents of the page:– Physical page is allocatedPhysical page is allocated– Block is read into physical pageBlock is read into physical page– Page table entry is filled inPage table entry is filled in– Exception is dismissedException is dismissed– Processor re-executes the instruction that caused the page faultProcessor re-executes the instruction that caused the page fault

• The page has now been “faulted into” the process The page has now been “faulted into” the process “working set”“working set”

• Pages are only brought into memory as a result of page Pages are only brought into memory as a result of page faultsfaults

Mapping of (Committed) Mapping of (Committed) Virtual Address Space to Virtual Address Space to FilesFiles• Ranges of virtual address space are mapped to Ranges of virtual address space are mapped to

ranges of blocks within disk filesranges of blocks within disk files– These are the “backing store” for the virtual address spaceThese are the “backing store” for the virtual address space

• Commonly used files are:Commonly used files are:– The system paging fileThe system paging file

• Used for most writeable dataUsed for most writeable data– Files for read-only applications and sharable dataFiles for read-only applications and sharable data

• Executable program or DLLExecutable program or DLL

• It is possible to set-up additional file / virtual It is possible to set-up additional file / virtual address space relationships at runtimeaddress space relationships at runtime

• Exceptions to this mapping include the nonpaged Exceptions to this mapping include the nonpaged poolpool

Working SetWorking Set

• Working set: All the physical pages “owned” by a Working set: All the physical pages “owned” by a processprocess– All the pages the process can refer to without incurring All the pages the process can refer to without incurring

a page faulta page fault

• Working set limit: The maximum number of pages Working set limit: The maximum number of pages the process can ownthe process can own– When limit is reached, a page must be released for When limit is reached, a page must be released for

every page that is brought in (working set replacement)every page that is brought in (working set replacement)– Default limits on size for each process:Default limits on size for each process:

• Mem: small, min WS = 20, max WS = 45Mem: small, min WS = 20, max WS = 45• Mem: medium, min WS = 30, max WS = 145Mem: medium, min WS = 30, max WS = 145• Mem: high, min WS = 50, max WS = 345Mem: high, min WS = 50, max WS = 345

Working Set (2)Working Set (2)

• A process always starts with an empty A process always starts with an empty working setworking set

• When working set “count” = working When working set “count” = working set limit, process must give up pages set limit, process must give up pages to make room for new pagesto make room for new pages

• Page replacement is a “modified FIFO”Page replacement is a “modified FIFO”– Windows 2000 on a uniprocessor x86 Windows 2000 on a uniprocessor x86

implements a “least recently accessed” implements a “least recently accessed” policypolicy

Working Set System Working Set System ServicesServices

• Can adjust maximum working set sizeCan adjust maximum working set size– Actually changes the limited within which Actually changes the limited within which

the system may change your working setthe system may change your working set– Limits are “soft”Limits are “soft”

• Can also self-initiate working set Can also self-initiate working set trimmingtrimming– Minimizing window does this… Minimizing window does this… – Demo…Demo…

Working Set System Working Set System Services (2)Services (2)

• Perfmon showing Process / Working Perfmon showing Process / Working SetSet

Process Memory InformationProcess Memory Information• “Mem Usage” =

physical memory used by process (WS size not WS limit). Note: shared pages are counted in each process

• “VM Size” = private (not shared) committed virtual space in processes

• “Mem Usage” in status bar in not total of “Mem Usage” column

2

1

1 2

3

3

System Working SetSystem Working Set

• Just as processes have working sets, Win 2000’s Just as processes have working sets, Win 2000’s pageable system-space code and data lives in the pageable system-space code and data lives in the “system working set”“system working set”

• Made up of 4 components:Made up of 4 components:– Paged poolPaged pool– Pageable code and data in the executivePageable code and data in the executive– Pageable code and data in the kernel-mode drivers, Pageable code and data in the kernel-mode drivers,

Win32K.sys, graphics drivers etc…Win32K.sys, graphics drivers etc…– Global file system data cacheGlobal file system data cache

• To get physical (resident) size of these with Perfmon, To get physical (resident) size of these with Perfmon, look at: Memory | Pool Paged Resident Bytes, System look at: Memory | Pool Paged Resident Bytes, System Code Resident Bytes, System Driver Resident Bytes, Code Resident Bytes, System Driver Resident Bytes, System Cache Resident Bytes, Cache bytesSystem Cache Resident Bytes, Cache bytes

Memory Management Memory Management InformationInformation

• ““System Cache” System Cache” really the total really the total physical size of physical size of pageable pageable portions of portions of paged pool, paged pool, NtosKrnl.Exe NtosKrnl.Exe code and data, code and data, drivers code drivers code and data and and data and file system file system cachecache

• ““Available” = Available” = sum of free, sum of free, standby, and standby, and zero page lists zero page lists (physical)(physical)

2

1

1

2

Accounting for Physical Accounting for Physical Memory UsageMemory Usage• Process working setsProcess working sets

– Remember that shared resident pages are counted in Remember that shared resident pages are counted in the process working set of every processthe process working set of every process• The total of all of these may be greater than physical memoryThe total of all of these may be greater than physical memory

• Nonpageable system codeNonpageable system code– NTOSKNL + driversNTOSKNL + drivers

• Nonpageable poolNonpageable pool• Free, zero and standby page listsFree, zero and standby page lists• Pageable, but currently resident, system-space Pageable, but currently resident, system-space

memorymemory• Modified, bad page listsModified, bad page lists