Windows NT Paging Fundamentals

Understanding NT's concept of memory management

If you've poked around in your system settings, you've probably seen the "pagingfile." You probably know that the paging file is the main on-diskrepository for data that your programs need access to, but not necessarily rightnow. Somehow, Windows NT decides which data goes into the paging file and whichdata resides in physical memory.

There's a little more to it than that, however. In this article, I'lldescribe how this paging file works, what it does, and why you need it. First,I'll explain some basic concepts and structures associated with paging, and thenI'll explore how paging and physical memory work together to affect yoursystem's performance.

Virtual vs. Physical
When you refer to memory use under NT, it's important to know whether you'rereferring to physical memory or virtual memory. Physical memory is an easyconcept to grasp--it's the amount of RAM installed on your system. Virtualmemory, however, has nothing to do with the amount of physical memory installedbut is the amount of memory that the operating system and the applicationsyou're running perceive to be available: 4GB for each application. Theamount of physical memory does not affect the amount of virtual memory availableto each program. Whether your computer has 16MB or 600MB of RAM, each programwill have 4GB of virtual memory.

Why 4GB of virtual memory? Because NT uses a 32-bit binary addressing scheme(i.e., each address in virtual memory has 32 bits), and 2³² is equalto 4GB. Future versions of NT that use an addressing scheme with more bits willsupport an even larger virtual memory area.

The 4GB of virtual memory addresses available to each program are dividedbetween user space and system space. User space, using the lower addresses, isprivate to each 32-bit program, and other programs ordinarily cannot manipulateit; 16-bit applications made for previous versions of Windows share a singleaddress space, unless you specify otherwise at program startup. (If two 32-bitprograms have a shared memory area set up, they can read and write to the datain each other's user address space, but this situation is the exception, ratherthan the rule.) System space, using the upper addresses, is common to allprograms running on the system and to all components of the operating system.It's used for structures that all programs need access to.

Be aware that NT 4.0 divides the virtual addresses evenly between the userand system areas, providing 2GB of space for each. Adding Service Pack 3 (SP3)and running NT Enterprise Edition mean that you can boot NT 4.0 on an x86 systemwith a 3GB user address space, leaving 1GB for system space. NT 5.0 will alwaysuse the 3GB/1GB split for user addresses and system addresses.

Among the structures stored in system space are those used to translatebetween virtual and physical addresses. Translation? Well, yes: NT physicallystores data into RAM, but all programs refer to virtual addresses, not physicalones. Translation between the two is necessary so that, for example, when aprogram requests the data stored at virtual address 2000000, it gets the datastored in physical address 45h.

Page Faults
What if a program requests data stored at virtual address 2000000, but nophysical address is currently storing that data? This turn of events is fairlycommon, particularly when a program is just starting up, because NT startsapplications with the least amount of memory necessary. In this case, anexception called a page fault occurs.

Unlike some other NT exceptions, a page fault isn't dire--it's simply howthe operating system alerts itself that it can't do something that it's beendirected to do under current circumstances, and other action is required. Thisexception is equivalent to you getting in your car without your car keys andrealizing that you can't start the car without first getting out, retrieving thekeys from the side table where you left them, and getting back in the car. Thisglitch doesn't mean your car won't start, but that you need to dosomething before it will.

NT's Virtual Memory Manager is responsible for handling pagefaults. The Virtual Memory Manager loads data into a physical memory addressthat can be translated into a virtual address for the sake of the process.

Page faults are normal occurrences: Except for the minimum needed to get aprogram going, no data is loaded into memory for the program. This method isNT's way of keeping memory usage to a minimum, ensuring that no applicationoccupies physical memory that it doesn't need. Paging data into memory takesmore time than just retrieving data from a physical memory address, but pagingis a necessary part of the virtual memory system and better for systemperformance than forcing all program data to be locked into memory.

Working Sets
When a piece of a program's data is faulted into physical memory, it becomespart of that program's working set. A working set is not the minimumamount of data a program needs to function, nor the maximum, but simply the datathat the program happens to be working with at the moment. Broadly speaking, aprogram's working set is a measure of the amount of physical memory that theprogram is using. This measure is only an approximate count, because some dataincluded in the working set may be shared among several processes (DLLs are acommon example), but that situation is typical of the relationship betweenworking set and physical memory usage.

Working sets will grow and shrink depending on the demand for physicalmemory. A system thread called the balance set manager is responsiblefor taking data out of the working set if it hasn't been used for a while. If aserious demand for physical memory arises, the balance set manager may in facttrim every program's working set to a bare minimum (a value established at thetime the program was started), requiring programs to fault pages back intomemory as required.

Nonpageable Data
Not all data may be paged in and out of memory. All data stored in uservirtual address space can be paged to disk when not in use, and most data storedin system space can also be paged, but any data that must be stored in aparticular area of system space, called the nonpaged pool, cannot bepaged. The reason for this limitation is not usually one of performance, but ofnecessity--some structures created from the nonpaged pool are those used tolocate pageable data. (In addition to these pointers, the nonpaged pool includesdevice driver code and some other data.) The addresses that make up the nonpagedpool vary from platform to platform (i.e., they'll be different on an x86-basedsystem from on an Alpha chip-based system). However, when you boot with the 2GBuser and system address split, the addresses are around the middle of the systemmemory area of the 4GB virtual address space.

The Paging File
It's time to upgrade your 486. Because you're broke and you reallyneed more hard disk space, you upgrade the hard disk first, figuring that you'lladd more RAM when you can afford it. More memory would be nice, but you'd rathernot scour your hard disk in search of files to delete.

However, when you install the new hard disk with extra space, your systemspeeds up, as if the idea of having more memory has given new life to yourapplications. What's going on?

Your system is faster because the additional hard disk space has increasedthe amount of room available to your system's paging file, the mainlocation (Pagefile.sys) on your hard disk where data not resident in physicalmemory goes. Although data stored on your hard disk takes longer to get at thandata stored in physical memory, an adequately sized paging file is necessary forgood system performance. Simply put, if you have a shortage of physical memory,the paging file will swell as the Virtual Memory Manager endeavors to keep dataclose at hand. If you run out of disk space, no more virtual memory can beallocated, whether a program needs it or not.

This increase in the paging file's size doesn't always mean an increase inperformance. If the paging file is adequate, increasing the size won't helpanything. However, if the paging file is much smaller than it should be, lettingit grow will improve the situation. To improve system performance on a machinethat already has an adequate paging file, Microsoft recommends that you add asecond paging file on a separate hard disk.

Be aware that you can't delete Pagefile.sys while running NT. If youdelete the file while the system is booted to another operating system, NT willre-create the file when you start NT.

By default, NT allocates a paging file the size of physical memory plus12MB. However, if you don't have enough disk space, the paging file cannot be asbig as it should be, as shown in the System Properties applet in Screen 1. Youcan view your system's information by going to Control Panel, anddouble-clicking System. The system in Screen 1 has 32MB of RAM, so it shouldhave a 44MB page file. However, because this system's hard disk is crowded, NTallocated only 32MB.

To see the maximum and minimum sizes for the paging file, and the size thatNT recommends for your system, click Change to see the Virtual Memory dialog boxshown in Screen 2, page 138. This system would perform better with more diskspace, because it would let the paging file more flexibly meet the needs of theprograms it's running.

Why You Can't Disable Paging
So far, I've explored the relationship between virtual memory and physicalmemory, defined some key structures involved in allocating physical and virtualmemory to processes, and demonstrated how hard-disk space can be nearly asimportant to system responsiveness as additional RAM. Why page at all? With RAMprices dropping, wouldn't it be better to install a bunch of physical memory onthe system and do away with paging?

Well, more RAM would make the system faster, but the reason you can'teliminate paging can be summed up quite simply: fat applications. These days,the programs we run and the files we create are simply too big to be stored inphysical memory all at once. If your computer has a lot of RAM installed, theVirtual Memory Manager will have to do less paging, but it's not a reasonablegoal to do away with paging altogether.

An easy way to see the relationship between a program's working set and thetotal amount of virtual memory that it requires is with the Process Viewerutility (Pviewer.exe) included with Microsoft Windows NT WorkstationResource Kit and Microsoft Windows NT Server Resource Kit. StartProcess Viewer, and you'll see the dialog box shown in Screen 3. (Although I'veselected to view Word 95 for this example, you can also use this tool to viewtotal process and memory details for the system.) This dialog box shows thecurrent working set size, but not much else relating to memory usage.

To get more information about Word's memory usage, click Memory Detail tosee a dialog box similar to Screen 4. The important part is in the sectionlabeled Virtual Memory Counts at the bottom of the dialog box. Notice therelative size of the Working Set and the Virtual Size of the application--theWorking Set is a little more than one-tenth the size of the entire app'svirtual memory requirements! To run this application without paging, you'd needabout 53MB of RAM for its exclusive use, and that amount does not include thememory that NT needs to run. Thus, although adding more memory to your systemwill definitely improve performance, you'll never do away with pagingaltogether. You're not supposed to--that's why virtual memory was invented.

What if you have 4GB of memory installed? Well, first you must wait untilthe 1GB SIMMs are available. However, even with this availability, you don'twant to disable paging, because Microsoft designed NT to move unused data to thehard disk to conserve space. According to the resource kit documentation, evenif a system has demands on its physical memory, about 4MB will remain unused inanticipation of future needs. Less paging might occur, but it doesn't appearthat it will be disabled entirely.

A Sense of Purpose
After reading this article, you should have a good understanding of thefundamental concepts of memory management under NT and realize why paging isnecessary to the system as it's designed. Although decreasing the amount ofpaging that your system needs to do will improve performance, Microsoft designedNT to page data in and out of memory to get the most good out of the memory thatyou have installed.