In my last article "" I talked about the capabilities of the Windows 7 Resource Monitor (Resource Monitor), explained how to use it to monitor the distribution of system resources between processes and services, and also mentioned that it can be used to solve specific problems - for example, to analyze memory consumption. This is exactly what this article will discuss.

A little about memory

Before starting the analysis, I’ll briefly talk about how memory is controlled. This will make it easier for you to understand what information is presented in the Windows 7 Resource Monitor.

Windows 7 Memory Manager creates a virtual memory system that consists of available physical RAM and a page file on the hard drive. This allows the operating system to allocate fixed-length memory blocks (pages) with sequential addresses in physical and virtual memory.

Launching Windows 7 Resource Monitor

To launch Windows 7 Resource Monitor, open the Start menu, type "Resmon.exe" in the search bar and click . In the window that opens, select the “Memory” tab (Fig. A).

Figure A: The Memory tab in Windows 7 Resource Monitor provides detailed memory allocation information.

Processes table

The Memory tab has a Processes table (Figure B) that lists all running processes and breaks memory usage into several categories.

Figure B: Memory usage information for each process is broken down into several categories.

Column "Image"

In the “Image” column the name is indicated executable file process. Processes, launched by applications, it is very easy to find out - for example, the process “notepad.exe” clearly belongs to Notepad. Processes named "svchost.exe" represent various operating system services. The service name appears in parentheses next to the process name.

Process ID column

The Process ID (PID) column indicates the process number - a unique combination of numbers that allows you to identify the running process.

"Completed" column

The Commit column indicates the amount of virtual memory, in kilobytes, that the system has reserved for this process. This includes both the physical memory used and the pages stored in the paging file.

Column "Working set"

The Working Set column indicates the amount of physical memory in kilobytes used by the process in this moment time. The working set consists of public and private memory.

Column "General"

The Shareable column indicates the amount of physical memory in kilobytes that this process shares with others. Sharing a single memory segment or swap page for related processes can save memory space. This physically stores only one copy of the page, which is then mapped to the virtual address space of other processes that access it. For example, all processes initiated by system DLLs- Ntdll, Kernel32, Gdi32 and User32 - use shared memory.

Column "Private"

The Private column indicates the amount of physical memory, in kilobytes, used exclusively by this process. It is this value that allows you to determine how much memory a particular application needs to operate.

Column “Errors of page missing from memory/sec.”

In the column “Errors of page out of memory/sec.” (Hard Faults/sec) shows the average number of page out of memory errors per second over the last minute. If a process tries to use more physical memory than is currently available, the system writes some of the data from memory to disk - to the page file. Subsequent access to data saved to disk is called a page out of memory error.

What do page out of memory errors mean?

Now that you have an idea of ​​what information is collected in the Processes table, let's see how you can use it to monitor memory allocation. When running applications and working with files, the memory manager monitors the working set size of each process and records requests for additional memory resources. As a process's working set increases, the dispatcher matches these requests to the needs of the kernel and other processes. If the available address space is insufficient, the dispatcher reduces the working set size by storing data from memory to disk.

Later, when reading this data from disk, a page out of memory error occurs. This is quite normal, but if errors occur simultaneously for different processes, the system requires additional time to read data from the disk. Too frequent page-out-of-memory errors consequently reduce system performance. You've probably experienced unexpected slowdowns in all applications, which then also suddenly stopped. This slowdown was almost certainly due to active data redistribution between physical memory and swap.

The conclusion follows: if page out of memory errors for a particular process occur too often and regularly, the computer does not have enough physical memory.

To make it more convenient to monitor processes that cause frequent page out of memory errors, you can mark them with flags. In this case, the selected processes will move to the top of the list, and in the graph of page missing errors they will be represented by an orange curve.

It's worth considering that memory allocation depends on a number of other factors, and monitoring for page-out-of-memory errors is neither best nor the only way identifying problems. However, it can serve as a good starting point for observation.

Table "Physical Memory"

The Processes table provides detailed information about memory allocation between individual processes, while the Physical Memory table gives an overall picture RAM usage. Its key component is the unique histogram shown in Fig. C.

Figure C: The histogram in the Physical Memory table provides an overview of memory distribution in Windows 7.

Each section of the histogram is indicated by its own color and represents a specific group of memory pages. As the system is used, the memory manager in background moves data between these groups, maintaining a delicate balance between physical and virtual memory to ensure all applications run efficiently. Let's take a closer look at the histogram.

Section “Reserved equipment”

On the left is the “Hardware Reserved” section, indicated in gray: this is the memory allocated for the needs of the connected hardware, which it uses to interact with the operating system. Memory reserved for hardware is locked and cannot be accessed by the memory manager.

Typically, the amount of memory allocated to the equipment ranges from 10 to 70 MB, but this figure depends on the specific system configuration and in some cases can reach several hundred megabytes. Components that affect the amount of reserved memory include:

;
Components motherboard- for example, advanced programmable input/output interrupt controller (APIC);
sound cards and other devices that perform memory-mapped input/output;
PCI Express (PCIe) bus;
video cards;
various chipsets;
flash drives.

Some users complain that their systems reserve an abnormal amount of memory for their hardware. I have never encountered such a situation and therefore I cannot vouch for the effectiveness of the proposed solution, but many note that updating the BIOS version can solve the problem.

“In Use” section

The In Use section, shown in green, represents the amount of memory used by the system, drivers, and running processes. The amount of memory used is calculated as the “Total” value minus the sum of the “Modified”, “Standby” and “Free” indicators. In turn, the “Total” value is the “Installed RAM” indicator minus the “Reserved Equipment” indicator.

Section "Changed"

The “Modified” section is highlighted in orange, which represents memory that has been modified but not used. In fact, it is not used, but can be used at any time if needed again. If memory has not been used for a long time, the data is transferred to the page file and the memory goes into the "Waiting" category.

Section "Waiting"

The Pending section, shown in blue, represents memory pages that have been removed from working sets but are still associated with them. In other words, the "Waiting" category is actually a cache. Memory pages in this category are assigned a priority from 0 to 7 (maximum). Pages associated with high-priority processes are given maximum priority. For example, shared processes have high priority, so the pages associated with them are given the highest priority in the Pending category.

If a process requires data from a waiting page, the memory manager immediately returns that page to the working set. However, all pages in the Pending category are available for recording data from other processes. When a process needs additional memory, and there is not enough free memory, the memory manager selects the waiting page with the lowest priority, initializes it, and allocates it to the requesting process.

Section "Free"

The Free category, indicated in blue, represents pages of memory that have not yet been allocated to any process or have been freed when a process terminates. This section shows both unused and freed memory, but in fact, unused memory belongs to another category - “Zero Pages”, which is so called because these pages are initialized to zero and ready for use.

About the problem of free memory

Now that you have a basic understanding of how the memory manager works, let's take a moment to address a common misconception about the memory management system in Windows 7. As you can see from Figure 1. C, The free memory section is one of the smallest in the histogram. However, it is a mistake to assume on this basis that Windows 7 consumes too much memory and that the system cannot work properly if there is so little free memory.

In fact, it's quite the opposite. In the context of Windows 7's approach to memory management, free memory is useless. The more memory used, the better. By maximizing memory and constantly moving pages from one category to another using a priority system, Windows 7 improves efficiency and prevents data from ending up in the page file, preventing out-of-page errors from slowing down performance.

Memory monitoring

Want to see Windows 7's memory management system in action? Restart your computer and immediately after startup, open the Windows 7 Resource Monitor. Go to the Memory tab and pay attention to the ratio of sections in the physical memory histogram.

Then start launching applications. As you run, watch the histogram change. Once you've launched as many applications as possible, start closing them one at a time and watch how the ratio of sections in the physical memory histogram changes.

By doing this extreme experiment, you'll understand how Windows 7 manages memory on your particular computer, and you'll be able to use Windows 7 Resource Monitor to monitor memory allocation under normal day-to-day operating conditions.

What do you think?

Do you like the idea of ​​using Windows 7 Resource Monitor to monitor memory allocation? Share your opinion in the comments!

Preemptive/non-preemptive algorithms.

In the case of a preemptive algorithm operating system at any time can interrupt the execution of the current thread and switch the processor to another thread. In non-preemptive algorithms, the thread that is given the processor only decides when to transfer control to the operating system.

Algorithms with quantization.

Each thread is given a time slice during which the thread can execute on the processor. When the quantum expires, the operating system switches the processor to the next thread in the queue. Quantum is usually equal to an integer number of system timer intervals 1.

Algorithms with priorities.

Each thread is assigned a priority - an integer indicating the degree of privilege of the thread. The operating system, if there are several threads ready to run, selects the thread with the highest priority.

Windows implements a mixed scheduling algorithm - preemptive, based on quantization and priorities.

1. Multitasking type for DOS application
2. Service guarantees
3. Scheduling foreground processes
4. Purpose of the paging file
5. Processes P1, P2, P3 allocate 100, 20, 80 MB of memory. The system has 128MB of RAM. What is the size of occupied memory in the page file. What is the size of the swap file.

1. What is a "page fault"?

Interrupt 14 -Page fault (#PF): Intel386…

Generated if the page engine is activated (CR0.PG = 1) and one of the following situations occurs when translating a linear address to a physical one:

• element of the page table or page directory used in address translation, has zero presence bit, i.e. the required page table or page is not present in physical memory;
• the procedure does not have privilege level, sufficient to access the selected page, or attempts to write to a page that is write-protected for the current privilege level.

The page fault handler obtains information about its cause from two sources: the error code, which is pushed onto the stack, and the contents of the CR2 register, which contains the linear address that caused the error. The page fault code has a special format (Fig. 3.7.).

An interrupted program, after eliminating the reasons that caused the page fault (for example, loading a page into physical memory), can be continued without any additional adjustments.

If a page fault was caused due to a violation of page security privileges, the access bit (A) in the corresponding page directory entry is set. The behavior of the access bit in the corresponding element of the page tables for this case is not regulated in Intel processors and may be different in different models.

1. High intensity page errors says:

Program insecurities

RAM unreliability

Other: explain

Column “Errors of page missing from memory/sec.”

In the column “Errors of page out of memory/sec.” (Hard Faults/sec) shows the average number of page out of memory errors per second over the last minute. If a process tries to use more physical memory than is currently available, the system writes some of the data from memory to disk - to the page file. Subsequent access to data saved to disk is called a page out of memory error.

What do page out of memory errors mean?

Now that you have an idea of ​​what information is collected in the Processes table, let's see how you can use it to monitor memory allocation. When running applications and working with files, the memory manager monitors the working set size of each process and records requests for additional memory resources. As a process's working set increases, the dispatcher matches these requests to the needs of the kernel and other processes. If the available address space is insufficient, the dispatcher reduces the working set size by storing data from memory to disk.

Later, when reading this data from disk, a page out of memory error occurs. This is quite normal, but if errors occur simultaneously for different processes, the system requires additional time to read data from the disk. Too frequent page out of memory errors, respectively, reduce system performance. You've probably experienced unexpected slowdowns in all applications, which then also suddenly stopped. This slowdown was almost certainly due to active data redistribution between physical memory and swap.

The conclusion follows: if page out of memory errors for a particular process occur too often and regularly, The computer does not have enough physical memory.

To make it more convenient to monitor processes that cause frequent page out of memory errors, you can mark them with flags. In this case, the selected processes will move to the top of the list, and in the graph of page missing errors they will be represented by an orange curve.

It's worth keeping in mind that memory allocation depends on a number of other factors, and monitoring page-out-of-memory errors is not the best or only way to identify problems. However, it can serve as a good starting point for observation.

1. How is thread priority determined in Windows?

Priorities

The Windows OS implements preemptive priority scheduling, when each thread is assigned a certain numerical value - a priority, in accordance with which the processor is allocated to it. Threads with the same priorities are scheduled according to the Round Robin algorithm (carousel). An important advantage of the system is the ability to preempt threads running in kernel mode - the executive system code is completely reentrant. Only threads holding a spinlock are not preempted (see "Synchronizing Threads"). Therefore, spinlocks are used with great care and are set for a minimum time.

The system provides 32 priority levels. Sixteen priority values ​​(16-31) correspond to the real-time priority group, fifteen values ​​(1-15) are for normal threads, and a value of 0 is reserved for the system page zeroing thread (see Figure 6.2).

Rice. 6.2. Thread Priorities

To save the user from having to remember numeric values priorities and be able to modify the scheduler, the developers introduced into the system priority abstraction layer. For example, the priority class for all threads of a particular process can be set using a set of constant parameters of the SetPriorityClass function, which can have the following values:

• real time (REALTIME_PRIORITY_CLASS) - 24
• high (HIGH_PRIORITY_CLASS) - 13
• above normal (ABOVE_NORMAL_PRIORITY_CLASS) 10
• normal (NORMAL_PRIORITY_CLASS) - 8
• below normal (BELOW_NORMAL_PRIORITY_CLASS) - 6
• and idle (IDLE_PRIORITY_CLASS) 4

The relative priority of a thread is set by similar parameters of the SetThreadPriority function:

A set of six process priority classes and seven thread priority classes forms 42 possible combinations and allows us to form the so-called basic thread priority

The default base priority of a process and primary thread is the value in the middle of the process priority ranges ( 24, 13, 10, 8, 6 or 4). Changing the priority of a process entails changing the priorities of all its threads, while their relative priorities remain unchanged.

Priorities 16 through 31 are not really real-time priorities because Windows' soft real-time support makes no guarantees about thread timing. These are simply higher priorities that are reserved for system threads and those threads that are given such priority by a user with administrative rights. However, the presence of real-time priorities, as well as preemptibility of kernel code, localization of memory pages (see "Operation of the memory manager") and a number of additional features- all this allows you to perform it in the OS environment Windows applications soft real time, for example, multimedia. The system thread with zero priority is busy clearing memory pages. Regular user threads can have priorities from 1 to 15.

Related information.

Memory allocation in Windows 9x and Windows NT. Windows 7 Resource Monitor. Explore memory-related items and tabs. Using Windows 7 Resource Monitor to monitor memory allocation. Increasing the size of the paging file (virtual memory). Checking memory using Windows.

3.1. Memory allocation in Windows 9x

Windows 9x OS is a 32-bit multi-threaded OS with preemptive multitasking and a graphical user interface. To boot, they use MS-DOS 7.0, which provides two modes of processor operation - real (BootGUI=0 is written in the MSDOS.SYS file) and protected (BootGUI=1). Protected mode is installed just before Windows 9x boots, causing the processor to begin managing memory using the paging mechanism virtual addresses into physical ones. The virtual address space area consists of 4 kilobyte pages that are located in RAM or on disk.

Low-order addresses of the virtual address space are used jointly by all processes to ensure compatibility with real-time device drivers, resident Windows programs, etc. This, on the one hand, is convenient, but, on the other hand, reduces reliability (one of the main qualities of the OS), because any process can corrupt components located at these addresses.

Each 32-bit Windows application program runs in its own address space, but access to the necessary addresses is possible, i.e. the organization of virtual addresses does not use all the hardware protection built into the microprocessor. 16-bit programs share a common address space and are also vulnerable to each other. The Windows 9x memory model is shown in Fig. 3.1.

Rice. 3.1. OP distributions in Windows 9x

The lower 64 KB of OP are not accessible to 32-bit programs, but 16-bit programs can write their data here. Addresses below 4 MB are mapped into the address space of each application program and are shared by all processes. This makes this area vulnerable to accidental writing.

The minimum required amount of memory for Windows 9x to function is 4 MB, but it is practically impossible to work with this amount of memory. Page file , with the help of which the virtual memory mechanism is implemented, is located in the Windows directory and has a variable size, changed if necessary by the system itself. Its dimensions can be set using system tools (Control Panel → System → Performance → File system), or specified in the SYSTEM.INI section of the file - lines indicating the drive and file name:

Pagingfive=c:\PageFile.sys

MinPagingFileSize=65536 (64 MB)

MaxPagingFileSize=262144 (256 MB)

The first and second lines define the file name and its location, and the last two – the initial and maximum size of the page file in KB.

The minimum paging file size can be obtained by running SysMon (System Monitor) and selecting the paging file size and the amount of free memory as the required parameters to estimate the memory requirements of the most frequently used applications.

3.2. Memory allocation in Windows NT

The differences between the distribution scheme and Windows 9x come down to the following:

1) more serious use of hardware memory protection provided in the microprocessor;

2) all system software modules are located in their own virtual address spaces and application programs cannot access them.

The distribution of address space in Windows NT is shown in Fig. 3.2.

Rice. 3.2. OP distributions in Windows NT

Application programs are allocated 2 GB of local (own) linear (unstructured) address space (the first 64 KB are not available). They are isolated from each other and can communicate with each other only through the clipboard, or through the DDE (Dynamic Data Exchange) and OLE (Object Linking and Embedding) mechanisms.

The upper part of the 2 GB area contains the code for system DLLs (dynamically linked libraries) that act as server processes. They check the values ​​of query parameters, execute the requested function, and send the results back to the calling program's address space.

In the address range of 2-4 GB there are system (low-level) components of Windows (i.e., the highest level of protection against unauthorized access: kernel, thread scheduler, memory manager).

For 16-bit Windows applications, WOW (Windows On Windows) sessions are implemented in preemptive multitasking mode, individually in their own address spaces or together in a shared address space.

When an application is launched, a process is created with its own information structure, within which the task is launched. It can run other tasks. As a result, a multitasking mode of operation is organized.

Memory management (allocation, reservation, release, paging) is performed by the VMM virtual memory manager (Virtual Memory Manager). Each virtual page is transferred to a physical page - a page frame, initially filled with zeros (this is the main requirement of the C2 level security system standard, which determines the impossibility of using their previous contents by other processes). Space for page swapping is reserved in the page file Pagefile.sys, which is a reserved block of disk space.

All Windows memory NT is subdivided into reserved(for dynamic use by processes when executing tasks), dedicated(for which uploading is reserved in Pagefile.sys) and accessible(the rest of the free memory).

Virtual memory in Windows

The most common reason for system slowdown is Windows control- filling physical memory. At the same time, Windows begins the so-called “paging” - moving blocks of code and program data (each such block is called a page) from physical memory to the hard drive. Accessing the page file from time to time is normal and does not degrade system performance, but frequent requests for data from a file on disk can significantly reduce overall system speed. This problem is especially noticeable when switching between multiple memory-intensive programs on a computer that does not contain enough physical memory. As a result, the disk is almost constantly in use, because the system tries to “pump” data from it to memory and back.

If the total size of allocated memory exceeds the total amount of physical memory, Windows must "pump" pages between the fast RAM and the much slower virtual memory in the page file, causing the system to slow down.

In progress Windows installations XP page file is automatically created in the root folder on the same disk where the system files are located Windows files. The paging file size is determined based on the amount of physical memory on the system. Default minimum size The page file is 1.5 times larger than the amount of physical memory, and the maximum size is 3 times larger. The swap file can be seen in the Explorer window if you enable the mode for displaying hidden and system files (Fig. 3.3).

Rice. 3.3. Enabling the display of hidden and system files

Typically, the Windows operating system itself sets the optimal amount of virtual memory and it is enough for most tasks, but if the computer runs applications that require a lot of memory, then the amount of virtual memory can be changed.

To do this, you need to perform the following sequence of actions:

1. Log in to the system using an account from the Administrators group and open the “Control Panel – System” window.

2. On the “Advanced” tab, click the “Options” button in the “Performance” section (Fig. 3.4).

3. In the Performance Options dialog box, select the Advanced tab and click the Change button (Figure 3.5) to display the Virtual Memory dialog box, which is shown in Figure 3.5. 3.6 for Windows XP and in Fig. 3.7 for Windows 7.

The current paging file settings are reflected in the “Total paging file size across all drives” field.

4. Select any drive from the list at the top of the dialog box to configure the settings for that drive.

You can change the following settings:

- Special size. Enter the value in the field Original size to set the initial size of the pagefile.sys file on the specified disk (in megabytes). In field Maximum size enter a number not less than the value in the field Original size, but not exceeding 4096 MB (4 GB).

- Size according to system choice. Select this option to enable dynamic management of the paging file size for of this disk. Select this option if you do not want to change the default settings Windows offers.

- No swap file. Use for all drives where you don't need a page file. Make sure there is a swap file on at least one drive.

5. After making any changes, click Set to record changes.

6. Repeat steps 4 and 5 for other drives (if necessary). Click OK to close the dialog box when you're done.

Rice. 3.4. “Options” button to go to view and/or

changing virtual memory parameters

Rice. 3.5. “Change” button to go to change virtual memory settings in Windows XP (left) and in Windows 7

Rice. 3.6. Window for viewing and setting the virtual memory size

Rice. 3.7. Window for viewing and setting the virtual memory size in Windows 7

If your computer has multiple physical disks, it is best to place the page file on the fastest, and it is preferable if system files Windows will be on a different drive. It's even better to split the page file into several physical disks because the disk controller can process multiple write and read requests in parallel.

Do not try to place the paging file on several logical drives of one physical drive!!!

If the system has one hard drive divided into partitions C, D and E, and the page file is distributed over several partitions, then the system may even slow down, since in this configuration the magnetic heads of the hard drive have to read data from several areas, rather than from one to another. one area of ​​the disk.

If you reduce the minimum or maximum paging file size and create a new paging file on disk, you must reboot the system for the changes to take effect. Increasing the size of the page file usually does not require restarting the computer.

If you have a lot of physical memory, you may be tempted to disable the page file altogether. Do not do that! !!

Windows XP was designed to use the page file to perform some kernel tasks, so some third-party programs may report low memory when attempting to disable virtual memory completely.

Windows doesn't use the pagefile until it's needed, so disabling virtual memory won't improve performance!!!

Windows can dynamically increase the page file size as needed. This function only works when you select " System selectable size", as well as when setting a maximum size greater than the current size of the paging file.

Based on experience with previous versions of Windows, some users try to create a paging file of a fixed size with equal initial and maximum dimensions. In theory, this should improve performance because it eliminates the possibility of page file fragmentation. However, the paging subsystem is designed so that in practice the file only occupies large blocks of disk space, making fragmentation minimal. You may notice a slight performance hit when Windows increases the size of the page file, but this is a one-time operation and has no impact on average performance.

Monitoring Memory Usage in Windows

The easiest way to find out how much RAM is being used at a given time is to open the Task Manager by clicking ++ and go to the “Performance” tab (Fig. 3.8). A detailed description of the information in the “Performance” tab for Windows XP is presented in table. 3.1.

Table 3.1. Decrypting Task Manager data

The “Performance” tab for Windows7 has significant innovations compared to the corresponding Manager tab Windows tasks XP.

The number in the “Total” column of the “Physical Memory” section indicates the total amount of RAM for this system. The Cached column shows the amount of physical memory that was recently used by system resources. It remains in the cache in case the system needs it again, but is available to other processes. The new “Available” column indicates the amount of currently unused physical memory, and the “Free” column indicates the amount of memory that is used by the cache but does not contain useful information.

The “Kernel Memory” section contains two columns - “Paged” and “Nonpaged”. Together they indicate how much memory the kernel is using. Paged is virtual memory, and non-paged is physical memory.

In the “System” section, columns for “Handles” and “Threads” appeared, associated with the constituent components of processes. The “Descriptors” column indicates the number of object identifiers (descriptors) that are used by currently running processes. The Threads column shows the number of subprocesses running within larger processes. The number in the “Processes” column, of course, indicates the total number of running processes, which can be seen on the “Processes” tab.

The “Up Time” column indicates how much time has passed since the last time the computer was started. The “Commit” column contains information about the paging file. The first number indicates the total amount of physical and virtual memory currently in use, and the second number indicates the total amount of memory for a given computer in principle.

Even more detailed information can be obtained by clicking the “Resource Monitor” button and selecting the “Memory” tab (Fig. 3.9).

Rice. 3.9. Memory tab of the Windows 7 Resource Monitor window

On the “Memory” tab there is a “Processes” table, which lists all running processes, and information about the memory used for each process is divided into several categories (Fig. 3.10).

Rice. 3.10. Processes table

In a collumn " Image" indicates the name of the process executable file. The processes running by applications are very easy to recognize - for example, the process “Winword.exe” clearly belongs to the Word text editor. Processes named "svchost.exe" represent various operating system services. The service name appears in parentheses next to the process name.

In a collumn " Process ID» indicates the process number - a unique combination of numbers that allows you to identify the running process.

In the column " Completed" indicates the amount of virtual memory in kilobytes reserved by the system for this process. This includes both the physical memory used and the pages stored in the paging file.

In the column " Working set" indicates the amount of physical memory in kilobytes used by the process at a given time. The working set consists of public and private memory.

In a collumn " General" indicates the amount of physical memory in kilobytes that this process shares with others. Sharing a single memory segment or swap page for related processes can save memory space. This physically stores only one copy of the page, which is then mapped to the virtual address space of other processes that access it. For example, all processes initiated system libraries DLLs - Ntdll, Kernel32, Gdi32 and User32 - use shared memory.

In the column " Private" indicates the amount of physical memory in kilobytes used exclusively by this process. It is this value that allows you to determine how much memory a particular application needs to operate.

In the column " Page out of memory errors/sec."The average number of page out of memory errors per second over the last minute is indicated. If a process tries to use more physical memory than is currently available, the system writes some of the data from memory to disk - to the page file. Subsequent access to data saved to disk is called a page out of memory error.

When running applications and working with files, the memory manager monitors the working set size of each process and records requests for additional memory resources. As a process's working set increases, the dispatcher matches these requests to the needs of the kernel and other processes. If the available address space is insufficient, the dispatcher reduces the working set size by storing data from memory to disk.

Later, when reading this data from disk, a page out of memory error occurs. This is quite normal, but if errors occur simultaneously for different processes, the system requires additional time to read data from the disk. Too frequent page-out-of-memory errors consequently reduce system performance. This manifests itself in unexpected slowdowns in all applications, which then also unexpectedly stop. The slowdown is due to active redistribution of data between physical memory and swap.

The conclusion follows: if page out of memory errors for a particular process occur too often and regularly, the computer does not have enough physical memory.

To make it more convenient to monitor processes that cause frequent page out of memory errors, you can mark them with flags. In this case, the selected processes will move to the top of the list, and in the graph of page missing errors they will be represented by an orange curve.

It's worth keeping in mind that memory allocation depends on a number of other factors, and monitoring page-out-of-memory errors is not the best or only way to identify problems. However, it can serve as a good starting point for observation.

The Processes table provides detailed information about the memory allocation between individual processes, and the Physical Memory table gives an overall picture of RAM usage. Its key component is the unique histogram shown in Fig. 3.11.

Figure 3.11. The histogram in the "Physical Memory" table allows you to get an overview of memory distribution in Windows 7

Each section of the histogram is indicated by its own color and represents a specific group of memory pages. As the system is used, the memory manager moves data between these groups in the background, maintaining a delicate balance between physical and virtual memory to ensure all applications run efficiently. Let's take a closer look at the histogram.

On the left is the section “ Reserved equipment", indicated in gray: this is the memory allocated to the needs of the connected equipment, which it uses to interact with the operating system. Memory reserved for hardware is locked and cannot be accessed by the memory manager. Typically, the amount of memory allocated to the equipment ranges from 10 to 70 MB, but this figure depends on the specific system configuration and in some cases can reach several hundred megabytes.

Components that affect the amount of reserved memory include:

Motherboard components - such as the Advanced Programmable I/O Interrupt Controller (APIC);

Sound cards and other devices that perform memory-mapped input/output;

PCI Express (PCIe) bus;

Video cards;

Various chipsets;

Flash drives.

Section " Used", indicated in green, represents the amount of memory used by the system, drivers, and running processes. The amount of memory used is calculated as the value " Total» minus the sum of indicators « Changed», « Expectation" And " Free" In turn, the value " Total" is an indicator " Installed" minus the indicator " Reserved equipment».

When a process starts in Windows, many of the pages that display the EXE and DLL images may already be in memory because they are being used by other processes. Writable image pages are marked "copy-on-write" so that they can be shared until they need to be modified. If the operating system recognizes an EXE that has already been executed, it can record the page link pattern (using a technology Microsoft calls Super-Fetch). This technology tries to pump up many of the necessary pages in advance (even though the process has not yet received page faults on them). This reduces application launch latency (reading pages from disk overlaps with executing the initialization code of the images). This technology improves disk output performance because disk drivers can more easily organize read operations (to reduce the required seek time). This pre-paging process is used both during system boot and when background application comes to the foreground when the system exits hibernation.

Prefetch paging is supported by the memory manager, but is implemented as a separate system component. Paged pages are not inserted into the process's page table; instead, they are inserted into a standby list from which they can be quickly inserted into the process (without accessing disk).

Unmapped pages are slightly different - they are not initialized by reading from a file. Instead, the first time an unmapped page is accessed, the memory manager provides a new physical page (making sure its contents are filled with zeros for security reasons). On subsequent page faults, the unmapped page may need to be found in memory or may have to be read from the page file.

On-demand paging in the memory manager is controlled by page faults. Every error causes an interrupt to the kernel. The kernel then builds a machine-independent descriptor (which reports what happened) and passes it to the executive memory manager. The memory manager then checks the access for validity. If the failed page falls within the committed region, it looks up the address in the VAD list and finds (or creates) the process's page table entry. In the case of a shared page, the memory manager uses the prototype page table entry (associated with the segment object) to populate the new process page table entry.

The format of the page table element varies depending on the processor architecture. For x86 and x64 processors, the elements of the displayed page are shown in Fig. 11.17. If an element is marked as valid, then its contents are interpreted by the hardware (so that the virtual address can be translated into the correct physical page). Unrendered pages also have their elements, but they are marked as invalid, and Hardware ignores the rest of the element. The software format is slightly different from the hardware one and is determined by the memory manager. For example, for an unrendered page (which must be positioned and reset before use), this fact is noted in the page table element.

Two important bits of the page table entry are updated directly by the hardware. These are the access bit (A) and the modified bit (D). These bits track the use of a given page mapping to access the page and whether the page can be modified by that access. This actually improves system performance because the memory manager can use the access bit to implement Least-Recently Used (LRU) paging. The principle of LRU is that those pages that have been unused the longest have the lowest likelihood of being reused in the near future. The access bit allows the memory manager to determine that the page has been accessed. The "modified" bit tells the memory manager that the page may have been modified (or, more importantly, it has not been modified). If the page has not been modified since it was read from disk, then the memory manager does not need to write its contents to disk (before using it for something else).

Both x86 and x64 architectures use a 64-bit page table entry (see Figure 11.17).

Each page fault can be classified into one of five categories:

1. The page is not fixed.

2. An attempt to access a page with a permission violation.

3. An attempt to modify a copy-on-write page.

1. It is necessary to increase the stack.

2. The page is fixed, but given time not displayed.

The first and second cases are programming errors. If a program tries to use an address that does not have a valid mapping, or tries to perform an illegal operation (such as trying to write to a read-only page), this is called an access violation and usually causes the process to terminate. An access violation is often the result of invalid pointer values, including access to memory that has been deallocated and detached from the process.

The third case has the same symptoms as the second (attempting to write to a read-only page), but its handling is different. Because the page was marked as copy-on-write, the memory manager does not report an access violation. Instead, it creates a private copy of the page for the current process and then returns control to the thread that attempted to write to the page. The thread repeats the write operation, which will now complete without a page fault.

The fourth case occurs when a thread pushes a value onto its stack and hits a page that has not yet been allocated. The memory manager recognizes this as a special case. As long as there is space in the virtual pages reserved for the stack, the memory manager will supply new pages, zero them out, and map them to the process. When the thread resumes execution, it will try to access again, and this time it will be successful.

And finally, the fifth case is a normal page fault. However, it has several sub-options. If a page is mapped to a file, the memory manager must look at its data structures (such as the prototype page table associated with the segment object) to ensure that there is no copy of it in memory. If there is a copy (for example, in another process, in the standby list, or in the list of modified pages), then he will simply make it shared (he may have to mark it as a copy-on-write page to do this if the changes are not shared supposed). If there is no copy yet, the memory manager will allocate a free physical page and prepare it for copying the file page from disk to it, unless another page is being transferred from disk at that moment (in which case you just need to wait until the transfer is completed).

If the memory manager can handle a page fault by locating the page in memory (rather than reading it from disk), the fault is called a soft fault. If you need a copy from the disk, then this is a hard fault. Soft errors are much cheaper and have little impact on application performance (compared to hard errors). Soft errors can occur because the shared page has already been mapped to another process, or simply needs a new zeroed page, or desired page was removed from the process's working set but is queried again before being reused. Soft errors can also occur because pages have been compressed to effective increase physical memory size. For most configurations central processor Memory and I/O in current systems are more efficiently compressed, rather than wasted on expensive I/O (in terms of performance and power) that requires reading a page from disk.

When a physical page is no longer mapped to any process's page table, it goes into one of three lists: free, modified, or reserved. Those pages that are never needed again (such as the stack pages of the terminating process) are freed immediately. Those pages that are likely to page fault again end up in either the modified list or the standby list (depending on whether the "modified" bit has been set for any page table entry that has displayed that page since it was last read from disk). Pages from the modified list will eventually be written to disk and then moved to the reserve list.

The memory manager can allocate pages as needed (using a list of either free or spare pages). Before allocating a page and copying it from disk, the memory manager always checks the lists of spare and modified pages to see if the page is already in memory. The forward paging scheme in Windows converts future hard errors into soft errors (by reading pages that might be needed and placing them on the standby page list). The memory manager itself does a small amount of paging ahead - it accesses groups of sequential pages (rather than individual pages). Additional pages are immediately placed on the standby page list. This is not wasteful because the overhead of the memory manager is much less than the cost of performing I/O operations. Reading an entire cluster of pages is slightly more expensive than reading a single page.

Elements of the page table in Fig. 11.17 refer to physical (not virtual) page numbers. To update a page table entry (and page directory), the kernel needs to use virtual addresses. Windows maps the page tables and page directories for the current process to the kernel virtual address space using the self-map element in the page directory (Figure 11.18). By mapping a page directory element to a page directory (self-map), we obtain virtual addresses that can be used to reference page directory elements (Fig. 11.18, a) and page table elements (Fig. 11.18, b). The self-map occupies 8 MB of kernel virtual addresses for each process (on x86 processors). For simplicity, the figure shows an x86 self-map element for 32-bit PTE entries (Page-Table Entries). In fact, Windows uses 64-bit PTE records, so the system can take advantage of more than 4 GB of physical memory. With 32-bit PTE entries, the self-map element uses only one PDE (Page-Directory Entry) entry in the page directory and therefore occupies only 4 MB of addresses rather than 8 MB.

You have connected a new device, but it is slow to work, or the old device has stopped functioning, or is not working correctly. What to do in these cases? Reinstall everything? It’s troublesome, and it’s not always necessary. How to find out what the reason is and how to eliminate it? Very simple. The fact is that in the Windows family of operating systems, and not only, there is a certainDevice Manager, in fact, a very necessary and useful manager, if you can call him that. Here he is, he will help us find out what is the cause of the problem, and my cheat sheet will help us fix the problem. So, in the above mentionedDevice Manager traces of errors in the operation of devices remain in the form of codes. Knowing the error code, it is not difficult to determine the cause of the problem. For the uninitiated, codes are just incomprehensible and meaningless numbers. But to a knowledgeable user, they can tell a lot. I will try, to the best of my ability, to shed light on this topic.

To view device errors, we first need to enter the Device Manager itself. It's done like this. Sign inControl Panel from the menuStart ( Can,My computer , right key -Properties — Device Manager, or you can do it by specifying a command inexecute , but why complicate everything). If we enter throughPanel management , then the path is:System - Equipment - Device Manager . Select by entering the menudevice Manager , the type of device we are interested in (keyboard, printer, modem, etc.), double-click on it, as a result we will see the devices included in this type. Select the device we need and double-click on it. Look at the column on the About tabgeneral, Device status. If there is a problem with the operation of the device, it will be displayed here as an error code. So we see numbers and figures. What do they mean? Below I give full list errors, with brief description errors and possible ways elimination. The error code is highlighted in red, its description in blue and the solution in black.

Code 1There is a problem setting up the device, no correct settings or the driver is missing. Click the button Update driver , to launch the wizardHardware update . If there is no driver at all, install it.

Code 3The device driver is damaged, or there is not enough RAM for the device to function correctly.1. Let's remove the damaged driver and install a new one. To do this: Properties - Driver - Delete, then follow the instructions of the wizard. Reboot. Opening againdevice Manager — Action — Update hardware configuration and follow the instructions of the master. 2. If the problem is a lack of virtual memory, close running applications to free up memory. To check the memory state we need to go toTask Manager , to do this, press the keyboard shortcutCtrl+Shift+Esc.We can view the virtual memory settings by right-clickingMy computer — Properties - Advanced - Performance - Settings (Options) . You can try to increase the swap file (I described how this is done in one of my previous blog articles), but this is far from a radical measure. You'll have to increase RAM. How this is done is a separate topic beyond the scope of this post.

Code 10In the registry section there is a parameter corresponding to the deviceFailReasonString,the value of this parameter is displayed in the error data, that is, if there is no parameter as such, then an error code appears, in other words, the device cannot be started. Update the driver as above. Or install a newer one.

Code 12There is no supply of resources required for this device. Disable other working devices, at least one, to do this, use the troubleshooting wizard, which, if you follow its instructions, will disable the conflicting device. (Let me briefly remind you: Properties - General - Troubleshooting.)

Code 14Requires a PC restart for this device to work.

Code 16It is impossible to identify the resources that are necessary for the device to operate; the device is not fully configured. You need to assign additional resources to the device. But this can be done without problems if the device belongs toPlug and Play.

Properties - Resources. If there is a resource with the sign ? in the list of resources, select it to assign to the selected device. If the resource cannot be changed, clickChange settings , if this function is not available, uncheckAutomatic setup

Code 18Reinstall the device driver. We try to update the driver or remove it and do it as in the example withcode 3.

Code 19There is insufficient information in the registry about device settings, or the settings are corrupted. RunTroubleshooting Wizard and follow his instructions, if it doesn’t help, reinstall the device as mentioned above. (code 3). Or, if that doesn't help, downloadLast Known Good Configuration. If this does not help, you need the help of a specialist, just as you need to edit the system registry. Without knowledge and experience, there is nothing for you to do on your own; any system administrator will confirm this to you. He who is knowledgeable and able, knows how to do it himself, without me. And for an inexperienced person, it’s better not to try. The registry is the heart of the operating system and only an experienced specialist, or under his supervision, should perform operations on it. I don’t want to offend anyone in any way, but if you haven’t worked with the system registry and if you value your computer, my advice is to forget the way there. I’m not writing for professionals, they don’t need it, but for the average user. Of course, I can write how and what to do there, but this will be a manual explanation and if you damage your computer as a result of the slightest mistake, I will be to blame. I don’t need this at all, and neither do you.

Code 21 The device is being removed from the system, that is, the operating system is trying to remove the device, but the process has not yet completed.

Pause for a few seconds and press the key

Code 22 The device is disabled. The device must be turned on.Action - Enable and follow further instructions.

Code 24 The device is missing or installed incorrectly, the driver is malfunctioning, the device may have been prepared for removal. Remove the device and install again.

Code 28 No driver. Install the driver. To do this, you need to Update the driver, follow the steps as in the instructions for Code 1.

Code 29Device disabled . You must allow the device to operate in settingsBIOSRead the instructions for using the device.

Code 31The system was unable to load drivers for this device . Update the drivers as described above.

Code 32The driver for this device is disabled in the system registry . Uninstall and reinstall the driver (described above)

Code 33The operating system cannot determine the resources for this devices . Set up the device or replace it.

Code 34The operating system cannot detect settings devices . Review the documentation supplied with the equipment and configure the configuration manually on the Resources tab.

Code 35The PC firmware does not have the necessary information for correct device operation . Need to updateBIOS.For instructions on how to do this, contact your supplier, or better yet, use the services of an experienced technician.

Code 36The device requires an interrupt to operate.PCIand the device is configured to interruptISA,or vice versa . Settings need to be changedBIOScontact an experienced technician.

Code 37The operating system does not recognize the driver for this device . Reinstall the driver (described above).

Code 38The OS cannot load the driver for the device because, the previous driver version remains in memory . You need to restart your PC. Run the Troubleshooting Wizard if it does not start (Properties - General - Troubleshooting) and follow the wizard's instructions. Afterwards there is a mandatory reboot.

Code 39The OS cannot load the device driver. The driver is damaged or it doesn't exist at all . Reinstall the driver as described above.

Code 40There is no access to the equipment because there is no information in the system registry or the information contains an error . Reinstall the driver.

Code 41Device not detected . Run the Troubleshooting Wizard (described above), if this does not help, update the hardware configuration (see above) or update the driver. If not, install more new version drivers.

Code 42The system already has such a driver. That is, there are two different devices with the same name, possibly due to an error . Restart your PC.

Code 43Stopping the device due to problems with its operation . Run the Troubleshooting Wizard and follow its instructions.

Code 44An application or service has stopped your device . Restart your PC.

Code 45Device not connected . Connect your device.

Code 46This error appears when the operating system shuts down. You don’t need to do anything, the next time you start the OS everything will work.

Code 47 The device has been prepared for secure removal, but has not yet been removed (for example, a flash drive) . Remove the device, then connect again, restart your PC.

Code 48The device, or rather its software, is blocked . Update the driver or install a new one.

Code 49The device cannot be started because it has a large system registry hive that exceeds acceptable registry parameters . Remove devices that are not used from the registry. You can do this: Device Manager - View - Show hidden devices. Here you will see hidden devices that are not connected to your PC. Select the devices you want to remove, click Properties for the device - Driver - Remove, then follow the instructions of the wizard and finally restart the PC.

A guide to removing any viruses from a PC with your own hands. All virus removal methods actually work and are tested in practice, step-by-step instruction with illustrations - simple and accessible even for a schoolchild + video tutorials + ultraiso program to create downloaders + useful links to tools in the fight against viruses. Download archive