Today we’ll start a multipart post on the Windows memory architecture. I will explain the different address spaces, cover 32bit and 64bit platforms, and provide some options for tuning and troubleshooting memory issues. Let’s start with the aspects that are common between Windows 32bit and 64bit systems. Physical memory is truly the physical memory in a system. The amount of available physical memory is limited only by the OS maximum.
Virtual memory is the memory that applications use and can be much greater than the Physical memory installed.
Ok, so virtual memory isn’t limited by physical memory then how does it work? The Virtual Memory Manager (VMM) is responsible for mapping each virtual address into a corresponding physical address. The VMM performs the mapping by dividing the RAM into fixed-size page frames, creating system page table entries (PTEs) to store information about these page frames, and mapping them. VMM also manages kernel resources, such as the paged pool, nonpaged pools and the system cache.
User Mode Memory is the address space where all nonsystem (kernel) processes and applications run. Each process has its own virtual memory address space up to the maximum allowable on the OS Architecture. If you have 10 user mode process running on a 32bit windows system each will have its own 2GB address space
Kernel Memory, unlike the User Mode Address space, shares the same address space (2GB by default on a 32bit system), and all kernel allocations share the same memory space.
Kernel memory consists of four main areas:
Paged Pool consists of virtual memory addresses that can be paged to disk.
Nonpaged pool consists of virtual memory addresses that are guaranteed to reside in physical memory as long as the corresponding kernel objects are allocated.
System Cache which is used to cache disk I/O processes for faster file access.
System Page Table Entries (PTE)
A little more on PTEs, every process that runs on a 32bit Windows system has 4GB of virtual address space for its use. Of this, the upper 2 GB address (kernel) is common to all processes running in the system. The lower region is called user address space. System PTEs are small chucks of kernel memory that are used to map virtual address space to physical memory. From the process perspective, each element of virtual address maps to a byte of physical memory. It is the responsibility of the Virtual Memory Manager to do this translation, and each PTE represents a page, and contains information necessary for the VMM to locate that page.
That's it for now. We'll get into the 32bit architecture in part 2