Victoria - Fotolia
Understand and manage Windows 10 virtual memory
It can be difficult for IT pros to understand the intricacies of Windows 10 virtual memory, but they should develop a basic knowledge of virtual memory to effectively manage desktops.
One of the biggest headaches for any desktop admin is users complaining about desktop performance, and perhaps the easy culprit to blame is memory.
IT's first instinct may be to buy more memory, but adding more random access memory (RAM) isn't always the best option. Additionally, there are several factors that control and limit how desktops can use memory.
However, there are some fundamental concepts that can help desktop admins understand how Windows 10 virtual memory works and how physical memory fits into the picture.
Windows 10 virtual memory vs. physical memory
IT professionals should understand the basics when it comes to physical memory, virtual memory and virtual addresses -- also known as address space.
Physical memory is the amount of physical RAM available in the computer. This is something organizations purchase with the computer itself and what many people refer to when they say memory.
Physical memory is where data is stored (Figure 1). Each cell shown in the table has a unique address where data is stored that aids the Windows OS in locating applications.
Windows 10 virtual memory exists as a physical, hidden file on the hard disk called the page file: pagefile.sys. IT professionals should think of the virtual memory as using the hard disk for additional memory when there is not enough RAM for all process requests. The processes, typically opening and running applications, fit into a queue that the OS manages.
The OS can access both the Windows 10 virtual memory and physical memory and map the data and resources that the current processes are using from the page file to RAM. Application processes are written specific to an OS because they cannot communicate directly with the hardware.
Processes operate in privacy, so they aren't aware of any other processes using system resources. Each process depends on the OS to prioritize and manage the total resources to avoid crashing the desktop.
Writing memory and page file swapping
When a process starts up, it reserves a certain amount of memory, which is dictated by the developer in the code. However, initializing processes requires few physical resources. This is analogous to making a hotel reservation. For a hotel receptionist, making the reservation just takes some time to enter it in the system and talk to the customer, but it does not block off the room until you arrive.
Committed memory occurs when the process requests the memory manager to back the reservation with memory via RAM and page files. Using the hotel example, this would be checking into the hotel. Now, there is a room blocked off for the customer, but the customer hasn't taken up any resources such as electricity or water. In a similar way, at this point in the process initiation, the OS hasn't written anything to memory.
Windows 10 memory management vocabulary
There are several terms that desktop admins need to know to understand Windows memory management processes.
Page. At 4 KB in size, this is the smallest unit of memory. Pages of memory are reserved, committed or free.
Free memory. Pages of the virtual address space available for a process's use. When a user initializes the process, most of the pages in its virtual address are free memory.
Process reserved memory. The amount of memory reserved by a process for its own use. This memory isn't necessarily used, but it is usually reserved when a process initializes.
Committed memory. Processes actively use this type of memory, and it consists of physical RAM and page files. It is a promise from the OS that it will be backed by RAM or paging files.
Working set. The amount of RAM used by a single process. This includes private and shareable memory.
Page file. A file on disk -- pagefile.sys -- that extends physical memory but can only hold modified memory pages that are not on disk.
When the OS writes the memory, it maps the virtual memory pages into RAM and the process will consume memory. Using the hotel example, this is where the customer enters the room and starts consuming water, electricity, housekeeping services and other resources. Each process performs these actions as they run.
If one process is running and using less than its dedicated physical RAM, the OS should perform well without any RAM-related issues. However, if several processes are running and their data requirements are more than the available physical RAM, the OS stores some data in the page file and swaps it into RAM with a replacement algorithm.
The OS typically swaps out data that it determines isn't frequently in use to the page file and data needed for a current process action will be swapped in. This swapping causes a delay and, thus, a performance hit.
If the process demand is more than the OS can manage with swapping, or if the process gets referred to an address that doesn't exist, it crashes. In this situation, more RAM may be the best option. IT can analyze the page file using debug tools to determine the cause: for example, a bad driver.
In this scenario, perhaps a better analogy is to a restaurant. Someone wants to eat dinner, which is the process. To do so, this person has to be in the restaurant, or the physical memory, but the number of customers allowed at a given time is limited by the number of seats -- address space.
When the number of customers exceeds the number of seats, the restaurant manager, who is the operating system, issues tickets, which are the virtual address space. The manager uses some rationale to remove customers who are waiting for their food to come and allows some customers with tickets to come into the restaurant.
Eventually, everyone will get in, though they may have to come back several times to finish dinner. This process isn't ideal for serving a meal, but it works for computer processes. While more memory provides better performance in some scenarios, there is a limiting factor called the address table.
Virtual addressing and page tables
Each process stores data and code in address space of memory and is mapped onto the virtual address space by the OS to keep track of it. The OS addresses virtual memory and uses the CPU to interface with the physical memory. Windows 10 virtual memory is limited only by the address space available on the computer's architecture. If the computer architecture cannot address all the memory, then adding memory will not help performance. IT professionals should be familiar with the difference between virtual addressing for 32- and 64-bit architectures (Figure 2).
32-bit architecture
The virtual address space for 32-bit architecture has a physical limit of 232 - 1 or about 4 GB, regardless of the amount of RAM in the computer. Further, Windows divides the address space up into two sections: user and kernel space (Figure 1). The addresses in the kernel space are reserved for system processes, and only the user space addresses are accessible for applications. Therefore, each application has a virtual memory limit of 2 GB, regardless of physical RAM.
No process can ever address more than 2 GB of virtual address space by default. Exceeding this limit produces an out-of-virtual-memory error and can occur even when there is plenty of physical memory available.
Consider a user with several applications open at the same time on a 32-bit platform, for example. Each application or process has 2 GB of virtual address space and has no way to know it is sharing physical RAM with other processes. The OS' memory management then will use Process Translation Extensions to translate the virtual address space for each process to physical RAM. The use of virtual memory allows the three applications, each with 2 GB of virtual address space, to share the 2 GB RAM in the computer (Figure 2). The OS accomplishes this by paging infrequently used data to disk and paging it back to RAM when needed.
The 32-bit architecture can only provide 4 GB address space on an endpoint device with 12 GB of RAM, so it may appear that there is 8 GB of wasted RAM. The RAM isn't wasted; it's allocated to the Physical Address Extension (PAE). This is a processor feature, supported by Intel and AMD, that extends the address space to 236 or about 64 GB. This requires a chipset capable of PAE, and applications must be written to take advantage of PAE.
PAE is enabled on Windows desktops by default, unless explicitly disabled. IT can also repurpose 1 GB from kernel space and add it to user space by using the /3GB switch in boot.ini and BCD. This is common for server applications such as 32-bit Microsoft Exchange Server.
64-bit architecture
The 64-bit architecture (x64) permits 264 or about 16 exabytes (EB) of address space. Windows uses a 16 TB tuning model, with 8 TB in user space and 8 TB in Kernel space (Figure 3). This makes a significant difference in memory addressing over the 4 MB of 32 bit.
Rather than the same special switches and extensions of the 32-bit architecture, x64 addresses memory management with a flat model. This allows more processes to run in memory without paging, significantly increasing performance for memory-intensive processes.
The sum of all the memory used by active processes in the system is displayed in Windows 10 Task Manager (Figure 4).
IT professionals can opt to view the alternative Resource Monitor available within Task Manager. This view displays visual and numerical data on the following categories of resource use and availability:
- Hardware reserved. Memory dedicated to hardware operation.
- In Use. Memory used by processes, Windows and drivers.
- Modified. Memory with contents that have not been written to disk. This memory cannot be used until it is written to disk.
- Standbby. Memory that contains cached data and code not currently in use.
- Free. Free memory that does not contain any valuable data and will be used first when more memory is needed.
