Memory paging/pagefile and Windows Pool

kimchee411

Senior member
Apr 28, 2001
272
0
0
Hi all,

I'm writing up some documentation on how to troubleshoot an error we've been having with our servers pertaining to EID 2019 System nonpaged pool depletion, and I'm trying to explain what pool is for some background info, but I'm a little unclear myself...

First question: What is the relationship between pagefile and pool?

I've read time and time again that Windows always has 4GB of address space - 2 to apps and 2 to system no matter how much RAM the system has, but how would the system page out, let's say 2 GB, if the pagefile is smaller than that?

And disk space? If you have a 2 GB hard drive and 256 MB RAM, would the pool size/address space still be 4 GB? What would happen if 3 different applications, in theory, tried to utilize a full 2 GB of address space each? I don't understand how that could be if your page file is like 384 MB + the 256 MB of physical RAM.

Would page faults occur until the necessary resources are freed? Wouldn't this mean we should always have at least a 4 GB pagefile?

Pardon my crude understanding and probably poor wording. I can't find these answers via Google.


Thanks in advance!
 

QuixoticOne

Golden Member
Nov 4, 2005
1,855
0
0
Well I think I can answer some of those questions,
though I'm not a Windows memory architecture expert
and can't precisely explain the way it decides to do
paging / pooling / address mapping.

A 32 bit operating mode processor under Windows
runs in a paged virtual memory configuration.
The virtual address space of the 32 bit processor is
in general approximately 32 bits worth,
2^32 = 4 gigabytes addressable from addresses
0x00000000 to 0xffffffff, i.e. every possible 32 bit
address number.

So in that way you always have a 4GB (approximately)
virtual *address space* to work with, that doesn't mean
that you can *USE* it all though depending on the actual
amount of physical RAM and amount of demand paging
secondary storage you have configured (e.g. page files).

You say windows 32 allocates 2GB address space for
system / kernel use and 2GB address space for
application use. I've heard things like that before and
doubtlessly have concrete references to the details but
don't recall them.

It's not terribly important just how it does it unless you're
writing code that has to use a lot of memory inside an
application or are writing certain kinds of system code.

Actually as you can have a large number of task / page
descriptors you can (in the 32 bit processor limitation,
saying nothing about windows) have lots and lots of
independent tasks each with a potentially independent
and non-overlapping 4GB address space of their very own.
When you context switch to a given task context you
basically reload the MMU's Physical to Virtual memory
mapping tables and page protetection tables etc. so
the actual memory map active for a given task can be
anything, and of course the kernel has the opportunity
to completely reconfigure the *contents* of physical
and virtual memory as well as I/O before switching tasks
so basically there is something closer to an infinite amount
of "virtualized" storage available just depending on how
the kernel allocates PM and the 4GBy of VM to each task.

Anyway windows apparently keeps 2GB of VM mapped for
task related uses and 2GB VM mapped into a task's address
space for system controlled shared memory / IO areas
etc. etc. PAE mode may change the details a bit, as well
as if you're running 16 bit compatibility mode or DOS
compatibility mode tasks, etc. etc.

Anyway demand paging takes advantage of the fact that
whenever a piece of memory is requested the 32 bit
address is divided into two parts, the upper bits specifying
a page number, and the lower few bits specifying an
address within the page. Typically pages are 4 kilobytes,
though depending on your architecture and OS the
number can vary.

The page number is looked up in a page table
which contains bits like security information
on whether the page is readable, writable, executable,
resident, non-resident, clean, dirty, who owns it,
etc. If there's a security problem relating to a task
accessing a page an exception is raised and system
code is invoked to handle the situation before the
task instruction that was trying to access the memory
is even completed. The system can then decide what
the "result" of the memory access should be.

Similarly when a memory page is marked "non resident"
i.e. not actually available in memory, any access attempt
to it generates an exception interrupting the requesting
task's access instruction in mid-execution.
System code and the system can then handle that exception
by choosing to load that page's data into physical RAM
(e.g. from a disk copy of the page) and then continue the
access instruction as if nothing ever happened (except
a long actual delay as the memory was loaded from disc
and the page remarked "resident" by the system).

So basically a few of your questions seem to be answered
by noting that the system may always have/provide
those 4GB / 2GB virtual address *spaces* for each
task, the actual available amount of physical memory
may be far less than 2GB, and furthermore the amount
of page storage available in the page file may also be
less than even 2GB.

This doesn't mean that you must have at least 2GB of
RAM or at least 2GB of page file or RAM+pagefile >= 2GB.
It just means that it'll quit trying to allow more "active"
memory pages from being created once you reach the
limit of your physical RAM, and it'll quit allowing more
"demand paged" memory pages from being created
once your physical RAM and pagefile storage capacity
are exhausted.

Even with 256MB RAM and 1GB page file the kernel will
still have a 2GB virtual address space and the
application will too, but no more than 1.25 GB will actually
ever be available to the combined uses of the system
in such a case. Extending the size of the page file out to
some larger number will allow more virtual memory to be
taken advantage of, but it's rarely beneficial to have
much more actively used virtual memory than physical
RAM since the VM disk paging will be millions of times
slower than the physical RAM. So the programs using it
will still operate transparently not knowing they're
causing memory paging while they go through memory
calculating, but the result will become untenably slow in
many cases once you start paging to disk very often.



Originally posted by: kimchee411
Hi all,

I'm writing up some documentation on how to troubleshoot an error we've been having with our servers pertaining to EID 2019 System nonpaged pool depletion, and I'm trying to explain what pool is for some background info, but I'm a little unclear myself...

First question: What is the relationship between pagefile and pool?

I've read time and time again that Windows always has 4GB of address space - 2 to apps and 2 to system no matter how much RAM the system has, but how would the system page out, let's say 2 GB, if the pagefile is smaller than that?

And disk space? If you have a 2 GB hard drive and 256 MB RAM, would the pool size/address space still be 4 GB? What would happen if 3 different applications, in theory, tried to utilize a full 2 GB of address space each? I don't understand how that could be if your page file is like 384 MB + the 256 MB of physical RAM.

Would page faults occur until the necessary resources are freed? Wouldn't this mean we should always have at least a 4 GB pagefile?

Pardon my crude understanding and probably poor wording. I can't find these answers via Google.


Thanks in advance!

 

Nothinman

Elite Member
Sep 14, 2001
30,672
0
0
I've read time and time again that Windows always has 4GB of address space - 2 to apps and 2 to system no matter how much RAM the system has, but how would the system page out, let's say 2 GB, if the pagefile is smaller than that?

Generally true except with the /3GB switch it becomes a 3/1 split with only 1G going to the kernel. If the pagefile is set to less than 2G and not allowed to grow then the system will fail to page data to it and start failing allocations. But you have to remember that not all paging activity comes from the pagefile. Anything that still has backing on disk somewhere (i.e. unmodified binaries, shared libraries, mmap()'d files, etc) will be paged back in from there if they're ever evicted from memory.

And disk space? If you have a 2 GB hard drive and 256 MB RAM, would the pool size/address space still be 4 GB? What would happen if 3 different applications, in theory, tried to utilize a full 2 GB of address space each? I don't understand how that could be if your page file is like 384 MB + the 256 MB of physical RAM.

The address space is always 4G on a 32-bit system no matter what. As many applications as the kernel can keep track of (it takes memory to track all of that memory usage) can allocate as much virtual space as they want without putting much pressure on physical memory. I can mmap() a 2G file into my address space and use all 2G without using any physical memory.

Would page faults occur until the necessary resources are freed? Wouldn't this mean we should always have at least a 4 GB pagefile?

Page faults aren't a bad thing and they happen for a number of reasons. For example, whenever a process starts up it almost certainly needs some shared libraries to run so the kernel will setup the base mappings for them but as that process runs and it accesses other parts of that library that aren't already mapped into it's address space it'll cause page faults since that particular page isn't mapped into it's address space. The kernel will notice this and just add a mapping pointing to the single copy of that library in memory, that's a soft page fault. If it's the first instance of that library then the kernel will have to go out to disk and page in parts of library, that's a hard page fault. Neither of which are bad, they just mean that some data that was needed wasn't immediately available.

I can't find these answers via Google.

That's because memory addressing is a complicated subject and way too many people get it wrong. If you really want to understand how it works get a copy of Inside Windows or Understanding the Linux kernel. The OS-specific parts will be different but the overall ideas are the same.

So in that way you always have a 4GB (approximately) virtual *address space* to work with, that doesn't mean that you can *USE* it all though depending on the actual amount of physical RAM and amount of demand paging secondary storage you have configured (e.g. page files).

Actually you can always use it all since not all virtual addresses are backed by physical memory.

You say windows 32 allocates 2GB address space for system / kernel use and 2GB address space for application use. I've heard things like that before and doubtlessly have concrete references to the details but don't recall them.

Since there's only 4G of addresses to go around there has to be some split, MS chose 2/2 by default with 3/1 as an option. Linux uses 3/1 by default but can also be configured to do 2/2, 1/3, 3.5/0.5, 4/4 and probably other strange combinations that most people don't care about.

but no more than 1.25 GB will actually ever be available to the combined uses of the system in such a case. Extending the size of the page file out to some larger number will allow more virtual memory to be taken advantage of,

That's not true, the amount of pagefile has no bearing on the amount of VM available. This is one of the most confusing aspects and the whole thing is exacerbated by MS' own misuse of VM terminology in their documentation.

but it's rarely beneficial to have much more actively used virtual memory than physical RAM since the VM disk paging will be millions of times slower than the physical RAM.

Actually it's extremely beneficial, without that ability mmap()'d files would be practically useless.
 

bsobel

Moderator Emeritus<br>Elite Member
Dec 9, 2001
13,346
0
0
Originally posted by: kimchee411
Hi all,

I'm writing up some documentation on how to troubleshoot an error we've been having with our servers pertaining to EID 2019 System nonpaged pool depletion, and I'm trying to explain what pool is for some background info, but I'm a little unclear myself...

First question: What is the relationship between pagefile and pool?

I've read time and time again that Windows always has 4GB of address space - 2 to apps and 2 to system no matter how much RAM the system has, but how would the system page out, let's say 2 GB, if the pagefile is smaller than that?

And disk space? If you have a 2 GB hard drive and 256 MB RAM, would the pool size/address space still be 4 GB? What would happen if 3 different applications, in theory, tried to utilize a full 2 GB of address space each? I don't understand how that could be if your page file is like 384 MB + the 256 MB of physical RAM.

Would page faults occur until the necessary resources are freed? Wouldn't this mean we should always have at least a 4 GB pagefile?

Pardon my crude understanding and probably poor wording. I can't find these answers via Google.


Thanks in advance!

Wow, long answers. The short one is the non-paged pool is a set of system memory that is never paged out. Its used for things like DMA buffers and other hardware features where you can't page during the operation (for example, if you need to read from your disk drive but need to page the code in that tells you how, you get to have a blue screen since the system is stuck unable to page the code in to tell it how to page the code in). Another example is an interupt handler which must be resident when the interupt hits (can't be paged in again).

If your seeing non-paged pool deletion, something requiring non-paged memory is leaking and using it up. When that pool is exausted, the system bluescreens since its a scarce resource. Its almost always a buggy driver which causes it.

Bill
 

VirtualLarry

No Lifer
Aug 25, 2001
56,570
10,202
126
IIRC, setting the /3GB switch in the boot.ini, actually decreases the size of the kernel pools. Bill, correct me if I'm wrong. I remember there being some issue about /3GB being bad to use with Terminal Server servers.
 

bsobel

Moderator Emeritus<br>Elite Member
Dec 9, 2001
13,346
0
0
Originally posted by: VirtualLarry
IIRC, setting the /3GB switch in the boot.ini, actually decreases the size of the kernel pools. Bill, correct me if I'm wrong. I remember there being some issue about /3GB being bad to use with Terminal Server servers.

I believe that's correct (the first comment), the second probably is (certainly wouldn't surprise me). The non-paged pool is kernel memory, not user memory. So running /3GB setting gives a 1 gig less address space to the kernel. I'd have to go dig to see if the nonpage pool is affected linerally (if at all) but I suspect its a very reasonable assumption to make.
 

bsobel

Moderator Emeritus<br>Elite Member
Dec 9, 2001
13,346
0
0
Originally posted by: VirtualLarry
IIRC, setting the /3GB switch in the boot.ini, actually decreases the size of the kernel pools. Bill, correct me if I'm wrong. I remember there being some issue about /3GB being bad to use with Terminal Server servers.

Larry I looked, your right at least on Windows 2003 systems and I have no reason to believe XP would be different in this regard (and the OP is talking server anyhow). With default boot.ini options the kernel has 356mb paged pool and a 256mb non-paged pool. With the /3GB switch enabled it drops to 256MB paged pool and 128MB non-paged pool. Terminal services needs some non-paged pool (AFAIR) for each session, so it would make sense that the /3GB could become an issue.

To the OP try looking here for some more details on pool memory and Windows.
 

stash

Diamond Member
Jun 22, 2000
5,468
0
0
Originally posted by: VirtualLarry
IIRC, setting the /3GB switch in the boot.ini, actually decreases the size of the kernel pools. Bill, correct me if I'm wrong. I remember there being some issue about /3GB being bad to use with Terminal Server servers.
Yes, the max paged pool and max non-paged pool will be lower with /3GB. The exact max depends on how much RAM the system has.

http://blogs.technet.com/clint...nel-memory-issues.aspx
 

kimchee411

Senior member
Apr 28, 2001
272
0
0
Wow, thanks guys! That is all very informative. It's good to see such knowledgeable people helping out here. Some of it was a little over my head but I think I get the main point now - address space is literally "virtual" memory, i.e. does not necessarily have a physical counterpart, be it physical memory or disk. I guess I had been interpreting it as VM = disk pages.

I had already resolved the issue using poolmon and driver verifier to find and disable the leaky driver. They had Legato installed on the box for backup, but it wouldn't uninstall. Piece of crap! :D