What Happens Inside a Linux Process Address Space?

Sample program to observe fork behavior

The following C++ program creates a child process with fork(). Both parent and child run infinite loops that print their process IDs, the value of a global variable g_val, and the address of g_val. The child changes g_val to 200 while the parent only reads it.

#include<iostream>
#include<unistd.h>
using namespace std;

int g_val = 100;

int main() {
    pid_t id = fork();
    if (id == 0) { // child
        while (true) {
            cout << "Child pid=" << getpid() << " ppid=" << getppid()
                 << " g_val=" << g_val << " &g_val=" << &g_val << endl;
            g_val = 200;
            sleep(1);
        }
    } else { // parent
        while (true) {
            cout << "Parent pid=" << getpid() << " ppid=" << getppid()
                 << " g_val=" << g_val << " &g_val=" << &g_val << endl;
            sleep(1);
        }
    }
    return 0;
}

Running the program shows that the printed address of g_val is identical in both processes, but the value diverges after the child modifies it.

Why the same virtual address appears in both processes

The printed address is a virtual (linear) address . Modern operating systems give each process its own virtual address space. The hardware translates these virtual addresses to physical memory frames via page tables, so two processes can have the same virtual address that maps to different physical pages.

Linux representation of a process address space

Linux describes a process’s memory layout with the kernel structure mm_struct. Relevant fields delimit the start and end of major regions such as code, data, heap (brk), and stack.

struct mm_struct {
    long code_start;
    long code_end;
    long init_start;
    long init_end;
    /* … other regions … */
    long brk_start;
    long brk_end;
    long stack_start;
    long stack_end;
};

The _start and _end pairs define contiguous virtual address ranges for each region.

Virtual‑to‑physical mapping and page tables

When a process accesses a virtual page, the CPU consults the page‑table entry to locate the corresponding physical frame. If the page is not yet mapped, a page‑fault occurs and the kernel allocates a frame and updates the page table.

Copy‑On‑Write (COW) after fork()

Immediately after fork(), parent and child share the same physical pages marked read‑only. On the first write to a shared page, the kernel copies that page (COW) and gives the writer a private copy, while the virtual address remains unchanged. This explains why the child’s modification of g_val does not affect the parent even though both print the same virtual address.

Benefits of per‑process virtual address spaces

Isolation : A process cannot read or write another process’s memory, protecting physical RAM and improving security.

Decoupled memory management : The OS can allocate physical pages on demand (e.g., on page‑fault), allowing lazy allocation and efficient use of RAM.

Uniform linear view : Each process sees a contiguous address space, simplifying programming and enabling the same binary to run on different hardware configurations.

Illustrative diagrams

The following images illustrate the process address space layout, virtual‑to‑physical mapping, and the COW mechanism.