Page Frame Number (PFN) database
The Page Frame Number database contains lists that represent the physical memory pages of the system. The kernel uses the lists to track which pages are “in use” (allocated to working sets), free, available, and so on. This allows the kernel to quickly know which pages of memory are best to use or reuse. For example, if a page is needed for a process working set, then the kernel can get a page from its free list towards the allocation.
It’s important to note that the PFN database resides in kernel virtual address space and the more physical memory [RAM] that a system has, the larger the PFN database must be. In non-PAE mode 24 bytes in the PFN database represents each 4 KB page of physical memory – this is a ratio of 170:1. In PAE mode 28 bytes represents each 4 KB page of physical memory – this is a ratio of 146:1. This means that roughly 6 MB or 7 MB is needed in the PFN database to describe each 1 GB of physical memory. This might not sound like much, but if you have a 32-bit system with 16 GB of physical memory, then it requires about 112 MB of the 2 GB of kernel virtual address space just to address the RAM. This is another reason why systems with 16 GB of physical memory or more will not allow the 3GB mode (also known as IncreaseUserVA) which increases the user virtual address space to 3 GB and decreases the kernel virtual address space to 1 GB on 32-bit systems.
Note: The x64 (64-bit) architecture has 8 TB of virtual address space, so this should be plenty of space to accommodate a large PFN database for systems with large amounts of physical memory.
The PFN database consists of many page lists. For the scope of this document, I will only mention the ones that are commonly used in troubleshooting:
- Active list: The page is “in use” by a working set which could be a process working set, a session working set, or a system working set.
- Standby list: The page is no longer “in use” or active and contains data that was once in a working set. The data in the page is backed by the disk. This means that if the data on disk is needed again, then it can be retrieved from physical memory avoiding the need to read from disk. This is known as “fast IO”. Ultimately, this means the larger the standby list the less often the disk must be accessed and this is why the more physical memory a system has, the less often the disk must be accessed. Also, since the page is already backed by the disk, it means that the page itself can be emptied and reused without incurring a disk IO.
- Modified list: The page was once in a working set, but was removed and the data it contains is not backed by the disk because it was modified in some way. This means that the page itself cannot be reused until the data it contains has been backed by the disk. If the system needs to reuse a page on the modified list, then it must write the data to disk before it can be reused.
- Free list: The page is no longer “in use” and has been freed. This could have happened from a process specifically freeing the memory or indirectly freed when a process has exited. The data on the page is unknown and likely contains data that was private to the process. Therefore, it must be “cleaned” by writing all zeroes (0) to the page before it can be reused.
- Zero list: The page is free and has all zeroes (0) in it.
The sum of the Free list and the Zero list is commonly referred to as “Free” memory. The sum of the Free, Zero, and Standby page lists is commonly referred to as “available” memory because all of the pages on those lists can be reused without incurring a disk IO to back it up.
For more information on this topic, refer to Chapter 10 Memory Management in the Windows Internals, 6th edition, Part 2 book.