If you've poked around in your system settings, you've probably seen the "paging file." You probably know that the paging file is the main on-disk repository for data that your programs need access to, but not necessarily right now. Somehow, Windows NT decides which data goes into the paging file and which data resides in physical memory.

There's a little more to it than that, however. In this article, I'll describe how this paging file works, what it does, and why you need it. First, I'll explain some basic concepts and structures associated with paging, and then I'll explore how paging and physical memory work together to affect your system's performance.

Virtual vs. Physical
When you refer to memory use under NT, it's important to know whether you're referring to physical memory or virtual memory. Physical memory is an easy concept to grasp--it's the amount of RAM installed on your system. Virtual memory, however, has nothing to do with the amount of physical memory installed but is the amount of memory that the operating system and the applications you're running perceive to be available: 4GB for each application. The amount of physical memory does not affect the amount of virtual memory available to each program. Whether your computer has 16MB or 600MB of RAM, each program will have 4GB of virtual memory.

Why 4GB of virtual memory? Because NT uses a 32-bit binary addressing scheme (i.e., each address in virtual memory has 32 bits), and 2³² is equal to 4GB. Future versions of NT that use an addressing scheme with more bits will support an even larger virtual memory area.

The 4GB of virtual memory addresses available to each program are divided between user space and system space. User space, using the lower addresses, is private to each 32-bit program, and other programs ordinarily cannot manipulate it; 16-bit applications made for previous versions of Windows share a single address space, unless you specify otherwise at program startup. (If two 32-bit programs have a shared memory area set up, they can read and write to the data in each other's user address space, but this situation is the exception, rather than the rule.) System space, using the upper addresses, is common to all programs running on the system and to all components of the operating system. It's used for structures that all programs need access to.

Be aware that NT 4.0 divides the virtual addresses evenly between the user and system areas, providing 2GB of space for each. Adding Service Pack 3 (SP3) and running NT Enterprise Edition mean that you can boot NT 4.0 on an x86 system with a 3GB user address space, leaving 1GB for system space. NT 5.0 will always use the 3GB/1GB split for user addresses and system addresses.

Among the structures stored in system space are those used to translate between virtual and physical addresses. Translation? Well, yes: NT physically stores data into RAM, but all programs refer to virtual addresses, not physical ones. Translation between the two is necessary so that, for example, when a program requests the data stored at virtual address 2000000, it gets the data stored in physical address 45h.

Page Faults
What if a program requests data stored at virtual address 2000000, but no physical address is currently storing that data? This turn of events is fairly common, particularly when a program is just starting up, because NT starts applications with the least amount of memory necessary. In this case, an exception called a page fault occurs.

Unlike some other NT exceptions, a page fault isn't dire--it's simply how the operating system alerts itself that it can't do something that it's been directed to do under current circumstances, and other action is required. This exception is equivalent to you getting in your car without your car keys and realizing that you can't start the car without first getting out, retrieving the keys from the side table where you left them, and getting back in the car. This glitch doesn't mean your car won't start, but that you need to do something before it will.

NT's Virtual Memory Manager is responsible for handling page faults. The Virtual Memory Manager loads data into a physical memory address that can be translated into a virtual address for the sake of the process.

Page faults are normal occurrences: Except for the minimum needed to get a program going, no data is loaded into memory for the program. This method is NT's way of keeping memory usage to a minimum, ensuring that no application occupies physical memory that it doesn't need. Paging data into memory takes more time than just retrieving data from a physical memory address, but paging is a necessary part of the virtual memory system and better for system performance than forcing all program data to be locked into memory.

Working Sets
When a piece of a program's data is faulted into physical memory, it becomes part of that program's working set. A working set is not the minimum amount of data a program needs to function, nor the maximum, but simply the data that the program happens to be working with at the moment. Broadly speaking, a program's working set is a measure of the amount of physical memory that the program is using. This measure is only an approximate count, because some data included in the working set may be shared among several processes (DLLs are a common example), but that situation is typical of the relationship between working set and physical memory usage.

Working sets will grow and shrink depending on the demand for physical memory. A system thread called the balance set manager is responsible for taking data out of the working set if it hasn't been used for a while. If a serious demand for physical memory arises, the balance set manager may in fact trim every program's working set to a bare minimum (a value established at the time the program was started), requiring programs to fault pages back into memory as required.

Nonpageable Data
Not all data may be paged in and out of memory. All data stored in user virtual address space can be paged to disk when not in use, and most data stored in system space can also be paged, but any data that must be stored in a particular area of system space, called the nonpaged pool, cannot be paged. The reason for this limitation is not usually one of performance, but of necessity--some structures created from the nonpaged pool are those used to locate pageable data. (In addition to these pointers, the nonpaged pool includes device driver code and some other data.) The addresses that make up the nonpaged pool vary from platform to platform (i.e., they'll be different on an x86-based system from on an Alpha chip-based system). However, when you boot with the 2GB user and system address split, the addresses are around the middle of the system memory area of the 4GB virtual address space.

The Paging File
It's time to upgrade your 486. Because you're broke and you really need more hard disk space, you upgrade the hard disk first, figuring that you'll add more RAM when you can afford it. More memory would be nice, but you'd rather not scour your hard disk in search of files to delete.

However, when you install the new hard disk with extra space, your system speeds up, as if the idea of having more memory has given new life to your applications. What's going on?

Your system is faster because the additional hard disk space has increased the amount of room available to your system's paging file, the main location (Pagefile.sys) on your hard disk where data not resident in physical memory goes. Although data stored on your hard disk takes longer to get at than data stored in physical memory, an adequately sized paging file is necessary for good system performance. Simply put, if you have a shortage of physical memory, the paging file will swell as the Virtual Memory Manager endeavors to keep data close at hand. If you run out of disk space, no more virtual memory can be allocated, whether a program needs it or not.

This increase in the paging file's size doesn't always mean an increase in performance. If the paging file is adequate, increasing the size won't help anything. However, if the paging file is much smaller than it should be, letting it grow will improve the situation. To improve system performance on a machine that already has an adequate paging file, Microsoft recommends that you add a second paging file on a separate hard disk.

Be aware that you can't delete Pagefile.sys while running NT. If you delete the file while the system is booted to another operating system, NT will re-create the file when you start NT.

By default, NT allocates a paging file the size of physical memory plus 12MB. However, if you don't have enough disk space, the paging file cannot be as big as it should be, as shown in the System Properties applet in Screen 1. You can view your system's information by going to Control Panel, and double-clicking System. The system in Screen 1 has 32MB of RAM, so it should have a 44MB page file. However, because this system's hard disk is crowded, NT allocated only 32MB.

To see the maximum and minimum sizes for the paging file, and the size that NT recommends for your system, click Change to see the Virtual Memory dialog box shown in Screen 2, page 138. This system would perform better with more disk space, because it would let the paging file more flexibly meet the needs of the programs it's running.

Why You Can't Disable Paging
So far, I've explored the relationship between virtual memory and physical memory, defined some key structures involved in allocating physical and virtual memory to processes, and demonstrated how hard-disk space can be nearly as important to system responsiveness as additional RAM. Why page at all? With RAM prices dropping, wouldn't it be better to install a bunch of physical memory on the system and do away with paging?

Well, more RAM would make the system faster, but the reason you can't eliminate paging can be summed up quite simply: fat applications. These days, the programs we run and the files we create are simply too big to be stored in physical memory all at once. If your computer has a lot of RAM installed, the Virtual Memory Manager will have to do less paging, but it's not a reasonable goal to do away with paging altogether.

An easy way to see the relationship between a program's working set and the total amount of virtual memory that it requires is with the Process Viewer utility (Pviewer.exe) included with Microsoft Windows NT Workstation Resource Kit and Microsoft Windows NT Server Resource Kit. Start Process Viewer, and you'll see the dialog box shown in Screen 3. (Although I've selected to view Word 95 for this example, you can also use this tool to view total process and memory details for the system.) This dialog box shows the current working set size, but not much else relating to memory usage.

To get more information about Word's memory usage, click Memory Detail to see a dialog box similar to Screen 4. The important part is in the section labeled Virtual Memory Counts at the bottom of the dialog box. Notice the relative size of the Working Set and the Virtual Size of the application--the Working Set is a little more than one-tenth the size of the entire app's virtual memory requirements! To run this application without paging, you'd need about 53MB of RAM for its exclusive use, and that amount does not include the memory that NT needs to run. Thus, although adding more memory to your system will definitely improve performance, you'll never do away with paging altogether. You're not supposed to--that's why virtual memory was invented.

What if you have 4GB of memory installed? Well, first you must wait until the 1GB SIMMs are available. However, even with this availability, you don't want to disable paging, because Microsoft designed NT to move unused data to the hard disk to conserve space. According to the resource kit documentation, even if a system has demands on its physical memory, about 4MB will remain unused in anticipation of future needs. Less paging might occur, but it doesn't appear that it will be disabled entirely.

A Sense of Purpose
After reading this article, you should have a good understanding of the fundamental concepts of memory management under NT and realize why paging is necessary to the system as it's designed. Although decreasing the amount of paging that your system needs to do will improve performance, Microsoft designed NT to page data in and out of memory to get the most good out of the memory that you have installed.