Virtual memory and pages - how Linux manages memory

Virtual memory is the abstraction that lets every process have its own address space, regardless of physical RAM. The MMU (Memory Management Unit) maps virtual pages to physical frames.

Pages

The MMU works in pages, typically 4 KB. Every virtual address is a (page number, offset) tuple:

• Virtual address: 0x7fff12345678
• Page number: 0x7fff12345
• Offset: 0x678

The MMU translates the page number to a physical frame using the page table.

Page tables

Each process has a page table mapping virtual pages to physical frames:

• Page present in RAM: page table entry points to a frame.
• Page swapped out: page table entry is “not present”; swap location is stored elsewhere.
• Page not yet accessed: page table entry is “not present”; no swap yet.

If a process accesses a page that is “not present”, a page fault occurs. The kernel handles the fault:

• Page in RAM: load the frame, update page table, retry.
• Page in swap: read from swap, update page table, retry.
• Page not allocated: SIGSEGV (segfault).

Virtual vs physical

cat /proc/self/maps

Output:

00400000-00401000 r-xp 00000000 08:01 1234567 /usr/bin/cat
00600000-00601000 r--p 00001000 08:01 1234567 /usr/bin/cat
00601000-00602000 rw-p 00002000 08:01 1234567 /usr/bin/cat
7f1234000000-7f1234021000 r-xp 00000000 08:01 7654321 /lib/x86_64-linux-gnu/libc.so.6
...

Each line:

• Virtual address range (start-end).
• Permissions (rwx, plus p=private, s=shared).
• Offset in the file.
• Device and inode.
• File path (or [heap]/[stack]/[vdso]).

The virtual addresses are scattered; the kernel manages the mapping.

Anonymous memory

Anonymous memory has no file backing. It includes:

• Heap (malloc).
• Stack.
• BSS (uninitialised data).
• mmap with MAP_ANONYMOUS.

Anonymous memory is created on first use (zero page faults). It is freed when the process exits or the pages are released. If the kernel needs the RAM, anonymous memory is written to swap.

Page fault types

• Minor fault: page is in memory (e.g. shared library mapped by another process). Just a page table update.
• Major fault: page is not in memory, must be read from disk. Disk I/O.

High major faults = memory pressure (paging in from swap or disk).

Read /proc/meminfo for VM

grep -E 'MemTotal|MemFree|MemAvailable|Buffers|Cached|AnonPages|Mapped|Active|Inactive' /proc/meminfo

• Active(anon) and Inactive(anon): working set and reclaimable anonymous memory.
• Active(file) and Inactive(file): working set and reclaimable page cache.
• AnonPages: total anonymous memory.
• Mapped: files mapped into memory.

Common patterns

Knowledge check