Unlocking Linux Memory: A Practical Guide to mmap and Its Real-World Uses

Related Background Knowledge

Understanding mmap requires first grasping the concept of a process’s virtual address space. On Linux each process runs in its own isolated virtual space, while the physical memory is limited and shared among processes. The addresses we see in code are virtual addresses.

When a program requests memory, it actually reserves a region of virtual addresses; physical memory is allocated only when those virtual addresses are accessed.

Linux on x86 uses a segmented‑paged memory management scheme: the CPU generates a logical address, which is translated to a linear (virtual) address, then paged to a physical address. The first access to a page that has no physical backing triggers a page‑fault, causing the kernel to allocate a physical page and update the page table.

Reading a file via the read system call first brings the data into the page cache (an inode structure) and then copies it to the user‑level buffer. The kernel maintains an struct address_space *i_mapping for each file, using an xarray to store the cached struct page objects.

mmap Overview

Prototype: void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset)

Function

Allocates a new contiguous virtual address region (represented by a vm_area_struct ) and returns its start address; if addr is non‑NULL the kernel tries to place the region at that address.

If a file descriptor fd is provided, the file’s contents are mapped into the process’s virtual address space.

The call has many flags (e.g., PROT_READ , PROT_WRITE , MAP_SHARED , MAP_PRIVATE ); see man mmap for details.

Typical mmap Applications

Shared mapping between different processes (not necessarily parent/child)

Both processes map the same disk file; after paging, the physical pages are shared.

Typical usage: open a file and map it with the MAP_SHARED flag.

<code>int fd = open("[filepath]", O_RDWR);
void *addr = mmap(NULL, [mmaping length], PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
</code>

Communication without a backing file (anonymous mapping)

A parent creates a child with fork ; both can communicate via a shared anonymous mapping.

Typical usage: no file descriptor, use MAP_SHARED | MAP_ANONYMOUS .

<code>void *addr = mmap(NULL, BUF_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
</code>

Process reads/writes files via mmap

When read reads a file, data first goes to the page cache, then to the user buffer.

With mmap , the file data is also read into the page cache, but the returned virtual address maps directly to the same physical pages, eliminating the second copy.

Diagram illustrating this flow:

Used by glibc malloc for large allocations (typically >128 KB) which internally employ mmap .

<code>void *addr = mmap(NULL, buffer_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
</code>

Write‑time copy (copy‑on‑write)

If a file is mapped with MAP_PRIVATE , writes modify a private copy of the page; the underlying file on disk is not changed.

Special Notes for File Mapping

The length argument must be page‑aligned. For example, mapping a 5000‑byte file on a 4 KB page system requires a length of 8192 bytes; the extra 3192 bytes are zero‑filled and accessible.

Mapping a zero‑length file allocates no physical memory and cannot be accessed until data is written, after which the mapping becomes valid.

mmap and Memory Swapping

Both file‑backed and anonymous mappings allocate physical pages that may be swapped out under memory pressure; MAP_LOCKED can prevent swapping.

For file‑backed mappings, swapped‑out pages are reclaimed to the page cache and re‑read from disk on next access.

Anonymous mappings without a backing file are swapped to swap space, which resides on disk.