What Exactly Do “buffers” and “cached” Mean in the Linux free Command?

Quick Answer

buffers

represents cache pages used by block devices, including direct block‑device I/O and filesystem metadata such as the SuperBlock. cached represents cache pages occupied by ordinary file data.

How the free Command Works

The free command reads /proc/meminfo. Using strace free shows it opens and reads this file, obtaining values like:

# cat /proc/meminfo
MemTotal:        3848656 kB
MemFree:          865640 kB
Buffers:          324432 kB
Cached:          2024904 kB
...

The kernel builds these fields in fs/proc/meminfo.c, function meminfo_proc_show(). The Cached value is calculated as:

global_page_state(NR_FILE_PAGES) – total_swapcache_pages – i.bufferram

global_page_state(NR_FILE_PAGES)

counts all page‑cache pages, which includes three components: Cached – ordinary file pages. Buffers (the i.bufferram term) – pages belonging to block devices, obtained from nr_blockdev_pages().

Swap cache pages.

Understanding Swap Cache

Memory pages are either file‑backed (associated with a file) or anonymous (e.g., from malloc()). When an anonymous page is swapped out, it may reside temporarily in the swap cache, which is essentially a page cache for swap devices and is managed with a radix‑tree. An anonymous page appears in the swap cache only while it is about to be swapped out or after it has been swapped in until it is modified or reclaimed.

How cached Is Defined

After removing buffers and swap‑cache pages, the remaining page‑cache pages constitute cached:

global_page_state(NR_FILE_PAGES) – total_swapcache_pages – i.bufferram

How buffers Is Calculated

The function nr_blockdev_pages() walks every block device and sums the nrpages field of each device’s inode mapping:

long nr_blockdev_pages(void)
{
    struct block_device *bdev;
    long ret = 0;
    spin_lock(&bdev_lock);
    list_for_each_entry(bdev, &all_bdevs, bd_list) {
        ret += bdev->bd_inode->i_mapping->nrpages;
    }
    spin_unlock(&bdev_lock);
    return ret;
}

Thus buffers counts pages that belong to block‑device mappings.

Who Updates Those Counters?

The generic functions add_to_page_cache and delete_from_page_cache are called for both block devices and regular files. The mapping argument determines whether the incremented counter contributes to buffers (block‑device mapping) or cached (file inode mapping).

Examples:

When a block device is opened, its inode’s i_mapping is assigned to the file’s f_mapping (see blkdev_open).

The filesystem superblock is also a block device; its metadata pages are therefore counted as buffers.

Indirect blocks used by files are metadata stored on the block device, so they also increase buffers.

Verification Experiments

Running free before and after a find that scans many files shows the buffers field growing, confirming that filesystem metadata contributes to it:

# free
              total       used       free     shared    buffers     cached
Mem:       3848656    2889508    959148       5316    263896    2023340
-/+ buffers/cache:    602272   3246384

# find / -name abc.def
# free
              total       used       free     shared    buffers     cached
Mem:       3848656    2984052    864604       5320    319612    2023348
-/+ buffers/cache:    641092   3207564

Reading a block device directly with dd also increases buffers:

# free
... buffers: 331020 ...
# dd if=/dev/sda1 of=/dev/null count=2000
# free
... buffers: 331872 ...

Conclusion

The free command’s buffers field reports the number of cache pages used by block devices, covering both direct block‑device I/O and filesystem metadata such as superblocks and indirect blocks. The cached field reports the number of cache pages used by ordinary file data, after excluding buffers and swap‑cache pages.