Linux Virtual Memory Explained: Page Tables, MMU, TLB, Page Faults, and Swap

Introduction

Linux is widely used as the foundation for servers and cloud services, making it an essential technology for infrastructure engineers. Among its core mechanisms, virtual memory plays a key role in Linux memory management and has a significant impact on system performance and stability.

However, terms such as “virtual address,” “physical address,” “page table,” and “MMU” can seem complicated, and many people may find it difficult to fully understand how virtual memory works.

In this article, we will explain how virtual memory works in Linux in an easy-to-understand way using diagrams. We will also introduce some of the key features enabled by virtual memory, such as shared libraries and Copy-on-Write (CoW).

Understanding virtual memory will help you gain deeper insight into how Linux works internally and provide useful knowledge for system design and troubleshooting.

Overview of Physical Memory

Before discussing virtual memory, let’s first understand physical memory. Physical memory refers to the main memory installed in a computer, such as RAM (Random Access Memory). It temporarily stores the instructions and data required by the CPU when executing programs. RAM is typically implemented using semiconductor memory chips.

Overview of Virtual Memory

Virtual memory is a memory management mechanism provided by the operating system. It provides each process with its own independent virtual address space, allowing programs to run without having to know the actual layout of physical memory.

Virtual memory enables memory protection between processes, efficient use of physical memory, and memory sharing for shared libraries. For these reasons, virtual memory is widely used in modern operating systems, including Linux and Windows, except for some specialized embedded operating systems.

The basic mechanism of virtual memory works as follows.

1. The CPU uses virtual addresses when executing instructions and accessing or modifying data. Programs do not need to directly manage physical addresses.
   
   Note: In practice, virtual memory and physical memory are divided into fixed-size blocks called pages rather than being managed directly as individual addresses. A common page size is 4 KB.
   
2. The mapping between virtual addresses and physical addresses is handled by hardware called the MMU (Memory Management Unit). The MMU refers to a mapping structure called a page table to determine the physical address corresponding to a virtual address.
   
3. The corresponding data in physical memory is then accessed or modified.

Page Tables

A page table is not simply a single flat table. In practice, page tables use a hierarchical structure. This makes it possible to efficiently manage very large virtual address spaces while reducing memory overhead.

If the CPU had to walk through page tables for every memory access, address translation would introduce significant overhead. Therefore, the CPU stores recently used virtual-to-physical address translations in a high-speed cache called the TLB (Translation Lookaside Buffer). When the required translation is available in the TLB, the CPU can obtain the physical address without walking through the page tables. This reduces address translation overhead and speeds up memory access.

Page Faults

A page fault occurs when the CPU accesses a virtual address but the corresponding physical page has not yet been allocated or the required page is not currently present in physical memory.

When a page fault occurs, execution is temporarily interrupted and control is transferred to the Linux kernel. The kernel checks the relevant memory information and performs operations such as the following when necessary.

• Allocate a new physical page
• Load the required page from an executable file or shared library
• Bring a page that was moved to swap space back into physical memory

Once these operations are complete, the page table is updated and the interrupted instruction is executed again. The application can continue running without explicitly handling the page fault.

A page fault is not necessarily an error. It is a normal mechanism used to implement virtual memory. Linux uses Demand Paging, which allocates or loads physical pages only when they are actually accessed. As a result, page faults commonly occur when a program starts or when a page is accessed for the first time.

However, a page fault that requires reading a page from swap space involves storage I/O and therefore takes longer to process. If a large number of page faults requiring storage access occur, overall system performance may degrade.

Page faults can be broadly classified into two types: Minor Page Faults and Major Page Faults.

A Minor Page Fault occurs when the required data can be resolved without accessing storage, for example when the required page is already present in physical memory but the process’s page table entry has not yet been established. Because no storage I/O is required, a Minor Page Fault can generally be handled relatively quickly.

A Major Page Fault occurs when the required page is not currently available in physical memory and storage I/O is needed to load it into memory. For example, the page may need to be read from an executable file, a shared library, or swap space. Because a Major Page Fault requires storage access, it generally takes significantly longer to handle than a Minor Page Fault. If Major Page Faults occur frequently, the increased storage I/O can lead to application latency and overall system performance degradation.

Benefits of Virtual Memory

Virtual memory provides several important benefits. Let’s take a closer look at each one.

• Large and Flexible Address Space
• Efficient Use of Physical Memory
• Address Space Isolation Between Processes

Large and Flexible Address Space

Virtual memory provides each process with a large virtual address space that is independent of the actual layout of physical memory. As a result, programs can use memory without needing to know where their data is physically located.

However, having a large virtual address space does not mean that unlimited memory is available. The amount of memory that can actually be used is constrained by resources such as physical memory and swap space.

When physical memory becomes insufficient, less frequently used anonymous pages can be moved to swap space, which is an area on storage used to temporarily hold memory pages. This frees physical memory by moving less frequently used anonymous pages out of RAM when memory pressure increases. However, accessing swap is significantly slower than accessing physical memory, so frequent swapping can cause system performance to degrade.

Efficient Use of Physical Memory

Virtual memory also makes it possible to use physical memory more efficiently. Here are some representative examples.

・Shared Libraries
When multiple processes use the same shared library, they can reference the same physical memory pages. This avoids storing unnecessary duplicate copies and improves physical memory efficiency.

・Deferred Copying with Copy-on-Write (CoW)
When a process is duplicated using the fork() system call, the parent and child processes initially share the same physical memory pages.

Only when a write occurs is the corresponding page copied and a new physical page allocated.

Address Space Isolation Between Processes

Each process has its own virtual address space and corresponding page tables, which are isolated from those of other processes. This isolation prevents processes from freely accessing each other’s memory and improves security. In addition, because processes cannot normally interfere with each other’s memory spaces, a problem in one process generally does not directly corrupt the memory of another process, improving overall system stability.
Note: This does not apply to memory regions that are intentionally shared, such as shared libraries or shared memory between related processes.

Conclusion

In this article, we explained how virtual memory works in Linux.

Virtual memory is not simply a mechanism for “extending physical memory.” It plays several important roles in Linux, including providing each process with an independent address space, improving the efficiency of physical memory usage, and enhancing system security.

Understanding how virtual memory works makes it easier to analyze the causes of memory shortages and performance problems, making this knowledge useful for day-to-day system administration and troubleshooting.

If you’d like to learn more about Linux memory management, I’ve covered the topic in detail in the following book. Please check it out if you’re interested.