An Introduction to Virtual Memory in Windows

Virtual memory is like alternate universes for programs. Physicists theorize that gravity comes from another universe. I don't know about gravity; this article is about virtual memory, and there are some similarities between virtual memory and alternate universes in Science Fiction stories.

In a very general manner, virtual memory uses external storage such as disk drives to extend the amount of real (physical) memory available to a program. Virtual memory is usually used in systems that execute multiple programs. The theory is that when a program executes, it never actually uses all of the data in its memory at once, and also while a program executes, memory for non-executing programs is not used. Unused data is written to external storage until it is needed again. Virtual memory usually uses pages, which are a fixed size, such as 4 KB. In other words, data is managed by virtual memory in blocks of memory that are called pages. The act of moving memory out and back in is often called paging or swapping, since it is pages that are swapped. The file(s) in external storage (disk drives) used for storing virtual memory are often called page files.

Operating systems that provide virtual memory attempt to determine what pages are most likely to be used and what pages are least likely to be used as best as possible but that determination is never perfect. They use various algorithms to do that, some quite complicated. One relatively simple technique is to keep track of how often a page is used; least recently used (LRU) pages are most likely to be selected for paging out.

When a program's requirements for memory are large, and the amount of main memory is small, it is possible that the system might page memory out that the program or another program needs soon. Too much of that can cause the system to spend more time paging in and out than getting much accomplished. When this happens, it is often called thrashing (see Thrash). Systems with 512 MB or less of main memory and that use Windows XP and above are likely to page memory in and out a lot, which can be referred to as thrashing.

Most systems that support virtual memory also support multiple programs executing in them. Programs are usually called processes or applications and the memory used by processes are called address spaces. In most systems and in Windows specifically, processes have one address space and each address space has one process. Address spaces are like alternate universes in the sense that processes can access memory in their address space but not most of the memory in other address spaces. It is relatively difficult for processes to affect address spaces of other processes, except when the operating system allows it.

Processor Support

Most operating systems that support virtual memory use features of the processor to do some critical operations for support of virtual memory. Generally speaking, the processor has special registers used to look up an address in tables (often called page tables) to determine if the address is in a page that virtual memory is being used for. Operating systems always reserve some of physical memory to be used that is never paged (swapped) out for its use and for use by device drivers. If an address is in a page that is swapped out, then the processor causes a page fault error (exception) to occur. The operating system processes the page fault by paging the page back in.


Virtual memory was first developed about half a century ago (see Virtual memory - Wikipedia). The first commercially available computer with virtual memory was a Burroughs. Virtual memory technology has been developed over the years and therefore was well-developed when Windows was designed.

Virtual memory requires processor support with critical cooperation by the operating system. The first Intel x86 architecture processor that provided support of virtual memory was the 80286 (used in the IBM PC AT) however the feature was improved in the 80386.

Main memory in the past was much more expensive than it is now.
Virtual Memory in Windows

In Windows, the set of pages of a process that are currently in physical memory is called the process's Working Set.

When the processor determines that a page is not in the process's working set (not in physical memory as determined by the processor's tables and registers), that results in a page fault exception. Windows however might be able to find the page still available in memory; if it does, then that is called a soft page fault. If the page however is not available and does need to be read in from disk, then that is a hard fault.

In Windows, virtual memory can be "backed" by page files or can be backed by other disk files. Using other disk files in that manner is not traditional virtual memory and might be confusing to understand, but it can be very useful to understand it. Disk files can be "mapped" into a process's address space, and when that is done, accessing memory that is mapped to a file is equivalent to accessing the file on disk. Virtual memory in Windows can be mapped to more than one process, and when that is done, the virtual memory is shared between or among the processes. The disk file can be the system paging file if the data to be shared among processes does not need to be saved permanently on disk. When virtual memory is mapped to a disk file that is not the page file(s), the memory is not backed by a page file.

When an executable file, such as an EXE or a DLL, is executed, the file is actually mapped into the address space of the process or processes that execute them. Windows does not actually read the portions of EXE and DLL files that are not needed; the virtual memory subsystem actually is responsible for paging in the portions that are used.

The maximum value that can be represented by 32 bits is 4 GB; therefore 32-bit processors can access a maximum of 4 GB, and therefore the address spaces of processes in 32-bit Windows is limited to 4 GB. Windows usually reserves 2 GB for its use; therefore applications in 32-bit Windows are normally limited to 2 GB. There are options that allow applications to use 3 GB or even 4 GB in 32-bit Windows but those are not normally available. Address spaces for 64-bit Windows can be as large as 2 TB.

Inter-Process Communication and Win16

Since each process in Windows has their own address space, processes cannot easily access memory for other processes. This is a critical security and reliability feature. The disadvantage is that when processes have a valid reason to share data, some mechanism for Inter-Process Communication (IPC) is needed. Shared memory is one but there are alternatives to shared memory.

In 16-bit Windows, there is no address space; all memory can be accessed by all processes. Controls such as Edit Controls (text boxes) that existed in 16-bit Windows continue to use common memory, so the text of Edit Controls and the data in List Boxes are accessible from all processes.


This article is intended to provide an introduction to virtual memory. It is not intended to explain the details; there is much more to learn. An important point is that Windows uses advanced and complex technology to optimize use of main memory in systems.


RECAP: VIRTUAL MEMORY AND CACHE (A description of virtual memory by Intel)
The Virtual-Memory Manager in Windows NT (Microsoft's description of virtual memory at (about) the time of the release of NT)
Virtual Address Space
File Mapping
Memory Limits for Windows Releases