Windows - 32-bit vs 64-bit

[Paul Adams]

A quick overview of the fundamental differences between 32-bit (x86/IA32) and 64-bit (x64/Intel64) versions of Windows, with a few commonly-asked questions.
Starting with a refresher on the difference between physical memory and virtual memory...

PHYSICAL MEMORY
Maximum physical memory support in Windows depends on the platform and version purchased:

x86 Platform
XP Starter Edition - 512MB
XP * - 4GB
Server 2003 Standard SP2 - 4GB
Server 2003 Enterprise SP2 - 64GB
Vista Starter Edition - 1GB
Vista * - 4GB

x64 Platform
XP Professional - 128GB
Server 2003 Standard SP2 - 32GB
Server 2003 Enterprise SP2 - 2TB
Vista Home Basic - 8GB
Vista Home Premium - 16GB
Vista * - 128GB

Though at present you don't find many home-built machines supporting more than 4GB anyway.

See: Processor and memory capabilities of Windows XP Professional x64 Edition and of the x64-based versions of Windows Server 2003
See: Memory Limits for Windows Releases (Windows)


VIRTUAL MEMORY
On a 32-bit version of Windows, using default settings, each application can use up to 2GB (2^31 bytes) of virtual memory it can address.

Of the total virtual address space available to any 32-bit process (4GB = 2^32 bytes), the remaining space is used for the kernel.

0x00000000 - 0x7FFFFFFF = 0y00000000000000000000000000000000 - 0x01111111111111111111111111111111 = lower 2GB, user-mode
0x80000000 - 0xFFFFFFFF = 0y10000000000000000000000000000000 - 0x11111111111111111111111111111111 = upper 2GB, kernel-mode

This is true even for systems with less than 4GB of physical memory installed - we are talking VIRTUAL memory addresses here, and anything that won't fit into physical memory can be put into the page (or "swap") file.

Comparing the bitmasks, by default it can be determined if a virtual memory address is in user-mode or kernel-mode space by looking at the left-most (most significant) bit:
0 = User-mode
1 = Kernel-mode


If I run 2 very large apps at the same time, could each of them use 2GB of memory?

Yes, their respective user-mode virtual memory spaces can be 2GB each, which may occupy physical memory.
Remember we are still talking virtual memory here, so as long as there is disk space and the pagefile has not been modified, it should work on any system.


How can the 32-bit version of Windows possibly use more than 4GB of physical memory?

If the BIOS supports "Physical Address Extension" (PAE) and you use the /PAE BOOT.INI switch - the memory pointers are now extended to 36 bits, to provide a possibility of up to 64GB of physical memory to be addressed (2^36).
As each virtual memory address is now bigger, it takes up more space in the kernel space, so having more memory consumes more memory (albeit a small overhead).
The 64-bit versions of Windows have no PAE switch as they can natively address way, way, way more than 4GB.

See: Operating Systems and PAE Support
See: Physical Address Extension - PAE Memory and Windows
See: Intel Physical Addressing Extensions (PAE) in Windows 2000


I have 4GB of physical memory installed, but 32-bit Windows reports only 2.7/3/3.3GB - why?

The BIOS uses part of the memory address space for hardware, such as PCI devices or shared (graphics) memory - this was never a problem before we moved from measuring RAM in MB to GB, but now we want to use these addresses.
This is where PAE is also required - the BIOS needs to allow "remapping" of those addresses to above the 4GB barrier, and the OS kernel has to be enabled for PAE.

If you are using the PAE kernel and Windows still reports less than 4GB, your BIOS does not support memory remapping.

See: The system memory that is reported in the System Information dialog box in Windows Vista is less than you expect if 4 GB of RAM is installed
See: Windows Vista or Windows Server 2003 may report less memory than you expect


What happens if my machine has more than the "maximum supported memory" installed for my version of Windows?

Windows will boot, but not see the extra memory to be able to use it - e.g. an x86 XP machine with 6GB of physical RAM will use up to 4GB (depending on that PAE thing).


How can I tell if I have PAE enabled in Windows?

Right-click on My Computer, click Properties - the system summary will mention "Physical Address Extension".
Alternatively, use a debugger to look at the module information for "nt" (i.e. "lmvm nt" in windbg.exe):
- ntoskrnl.exe = uni-processor, non-PAE
- ntoskrpa.exe = uni-processor, PAE
- ntkrnlmp.exe = multi-processor, non-PAE
- ntkrpamp.exe = multi-processor, PAE


I didn't turn PAE on, but it is reported in my system summary!

Data Execution Prevention (DEP) requires PAE, and is enabled by default in Windows XP SP2 - only when this is forced to "always off" in BOOT.INI is a non-PAE kernel used.


Is there a way for a 32-bit application on a 32-bit version of Windows to use more than 2GB of memory?

/3GB (or /4GT) can be used in BOOT.INI to skew the 4GB virtual memory split into "1 for the kernel, 3 for the process", but this halves some of the system resources available to the kernel so has a system-wide impact.
It also reduces the maximum amount of physical memory supported to 16GB in all but the DataCenter SP2 edition.

0x00000000 - 0xBFFFFFFF = 0y00000000000000000000000000000000 - 0x10111111111111111111111111111111 = lower 3GB, user-mode
0xC0000000 - 0xFFFFFFFF = 0y11000000000000000000000000000000 - 0x11111111111111111111111111111111 = upper 1GB, kernel-mode

** THIS ONLY HELPS FOR APPLICATIONS THAT HAVE BEEN COMPILED WITH "/LARGEADDRESSAWARE" **

Address Windowing Extensions (AWE) is a method by which processes can view a "2GB window" of their (much larger) virtual address space at any given time, but the application has to be coded to use those APIs.

** THIS REQUIRES PAE, AND THE VIRTUAL MEMORY FOR THE APPLICATION IS LOCKED IN PHYSICAL MEMORY AT ALL TIMES **

See: Large memory support is available in Windows Server 2003 and in Windows 2000


Is the only option on 32-bit to have the kernel virtual size 1GB or 2GB?

On Windows Server 2003 you can use the switch /USERVA=xxxx (in addition to /3GB) to specify a number (of MB) between 2048 and 3072 which is the size of user-mode addressing space.
This can be useful if you are running out of 'pool' memory when using /3GB alone, it increases the virtual address space for the kernel which in turn increases the pool sizes.

See: How to use the /userva switch with the /3GB switch to tune the User-mode space to a value between 2 GB and 3 GB


Can I use /3GB (/4GT) and /PAE together?

Yes, but it might not be wise to do so:
- the first halves the amount of memory available to the kernel, and limits the maximum amount of physical memory to 16GB
- the second increases the amount of kernel memory used to map physical memory
So you increase the risk of exhausting system resources.


Can I run a 32-bit application on 64-bit Windows?

Yes, so long as the application does not try to load 32-bit DLLs or drivers - these must be native 64-bit versions.
This is "Windows On Windows" (WOW) - 32-bit code goes through an emulating DLL to allow it to run on 64-bit Windows.
(On 32-bit Windows there was a similar feature for allowing 16-bit apps to run.)

Because of the DLL issue, some CD/DVD protection mechanisms fail to load and so games (typically) can refuse to launch, reporting the disc was not found, or the protection mechanism failed the security check.

Note that there are certain system resources that are "virtualized" for 32-bit processes running on a 64-bit OS, to prevent issues with conflicts between different platform versions of the same software.
This means requests through APIs for the following will get redirected to another location without their knowledge:
"Default Progam Files folder" => C:\Program Files (x86)
%systemroot%\System32 =>%systemroot%\SysWOW64
HKCR => HKCR\Wow6432Node
HKCU\SOFTWARE => HKCU\SOFTWARE\Wow6432Node
HKCU\SOFTWARE\Classes => HKCU\SOFTWARE\Classes\Wow6432Node
HKLM\SOFTWARE => HKLM\SOFTWARE\Wow6432Node
HKLM\SOFTWARE\Classes => HKLM\SOFTWARE\Classes\Wow6432Node

What this can mean on 64-bit versions of Winodws is that 32-bit processes which are hard-coded to read specific paths instead of using APIs could have problems, and 32-bit programs which are "registry cleaners" may find the path "HKLM\SOFTWARE\Wow6432Node" while scanning, and virtualization makes API calls for this path get remapped to "HKLM\SOFTWARE\Wow6432Node\Wow6432Node" which are false.

Contrary to FUD, the vast majority of 32-bit programs work perfectly fine on 64-bit Windows in my experience.


If I run a 32-bit application on 64-bit Windows, does it have the 2GB user-mode address limit still?

Yes, as the program will not be aware that it can address more than 2GB.
However, if it was compiled with /LARGEADDRESSAWARE then it now can address up to 4GB of virtual address space for user-mode (more than the 3GB possible on 32-bit).


Can I upgrade my 32-bit version of Windows to 64-bit?

No - there are way too many differences to make an upgrade viable, and none of the hardware drivers can be used, so a clean install is the only option.
For the same reasons, you cannot downgrade from 64-bit to 32-bit.


When using 64-bit Windows
- there is no "PAE" or "/3GB" as they are now irrelevant
- pool limitations jump from 256MB/470MB/650MB to 128GB each
- hardware Data Execution Prevention is enabled (NX or XD support from the processors)
- the kernel does not allow for modification whilst running ("Kernel Patch Protection" or "PatchGuard" - helps prevent rootkits)
- all drivers must be signed (prevents modification and provides a method to identify the author of software with bugs)
- all device drivers, filter drivers and all DLLs must be native 64-bit
- there is zero support for 16-bit processes (so 16-bit installers are unable to run to install some legacy programs)

[speardane]

excellent summary - thanks

[directhex]

how about a brief note on 16-bit apps (which are relevant for older installshield installers which have a 16-bit stub) or the need to hack on some .msi files with orca due to naive checking for NT 5.1 (where xp x64 is 5.2)

[vimes]

Thankfully my install of XP 32 bit can still access 3.5GB of my 4GB of RAM

[BUFF]

http://www.bit-tech.net/bits/2007/10...just_the_ram/1

[ikonia]

Paul, once again showing your value to the forum community. Thank you.

[Paul Adams]

Updated the original post to mention DEP has PAE as a pre-requisite, so the PAE kernel is used unless DEP is explicitly disabled, even if /PAE is not mentioned in BOOT.INI.