Understanding Linux Memory Management: From Physical RAM to Virtual Address Spaces

Process, Virtual Memory and Physical Memory

Physical memory, often called main memory or DRAM, is the actual RAM installed in a computer (e.g., 8 GB, 16 GB). Linux processes do not access this memory directly; they work with virtual addresses that the kernel maps to physical pages, providing isolation between processes.

The kernel creates an independent virtual address space for each process, whose size depends on the CPU word length—typically 1 GB kernel space + 3 GB user space on 32‑bit systems (max 4 GB total) and up to 128 TB for both spaces on 64‑bit systems. Only the kernel space can directly address physical memory, and physical pages are allocated on demand.

Mapping between virtual and physical memory is handled by the Memory Management Unit (MMU) via page tables. Linux uses a four‑level hierarchical page table, supporting both multi‑level pages (which store only used entries) and huge pages.

How Processes Use Memory

Within the user portion of a process’s virtual address space, memory is divided into five segments from low to high addresses:

Read‑only segment for code and constants.

Data segment for global variables.

Heap for dynamically allocated memory, growing upward.

Memory‑mapped segment for shared libraries, shared memory, etc., growing downward.

Stack for local variables and call frames, typically fixed at 8 MB.

The heap and memory‑mapped segment are allocated dynamically using functions such as malloc() or mmap(). Physical pages are not reserved until the first access triggers a page‑fault, at which point the kernel creates the necessary page‑table entries.

When memory pressure occurs, the kernel can reclaim memory through several mechanisms:

Cache reclamation using LRU to drop rarely used pages.

Swapping out infrequently accessed pages to the swap partition (note: swapping can severely impact performance).

Invoking the OOM killer to terminate processes with the highest oom_score.

The OOM score reflects a process’s memory consumption (higher score means higher kill probability) and is influenced by CPU usage (more CPU lowers the score). Administrators can adjust a process’s score via /proc/<pid>/oom_adj within the range [-17, 15], where -17 disables OOM killing.

How to View Memory Usage

free command

Total – total amount of memory.

Used – memory in use, including shared memory.

Free – memory not used at all.

Shared – size of shared memory.

Buff/Cache – size of buffers and cache.

Available – memory readily available for new processes.

free -help options: -b Show sizes in bytes. -k Show sizes in kilobytes. -m Show sizes in megabytes. -g Show sizes in gigabytes. -h Auto‑scale to appropriate units. -l Show detailed low‑ and high‑memory statistics. -s<seconds> Continuously monitor at the given interval (bug fixed in version 3.3.12). -t Show total memory usage. -V Display version information.

top command

Key columns related to memory:

%MEM – percentage of physical memory used by the process.

VIRT – total virtual memory used (including swap), in KB.

SWAP – amount of virtual memory that has been swapped out, in KB.

RES – resident (non‑swapped) physical memory size, in KB.

SHR – shared memory size, in KB.

Common top usage examples: top – refresh every 5 seconds, showing all processes. top -d 2 – refresh every 2 seconds. top -c – display full command lines. top -p 12345 -p 6789 – monitor specific PIDs. top -d 2 -c -p 123456 – combine interval, command view, and PID filtering.

ps command ps aux lists all running processes with memory information.

%MEM – percentage of physical memory used by the process.

VSZ – virtual memory size (KB).

RSS – resident set size, i.e., non‑swapped physical memory (KB).

Example usage

Use top or ps to locate memory‑intensive processes, then inspect detailed memory maps with cat /proc/<pid>/status or pmap -x <pid> to see allocation patterns and changes over time.