"Excuse me, that's not here."
What happens if a process tries to access a virtual memory address, the MMU checks the page table, and the entry says "currently not in RAM"?
This triggers a Page Fault. The CPU pauses the process and raises an exception, handing control to the Linux kernel's page fault handler. The kernel investigates the type of fault:
1. Minor Page Fault (Cheap)
The data is actually in RAM, just not mapped to this specific process's page table yet.
- Example: Two processes load the same shared library (
libc.so). The physical copy is already in RAM from the first process. When the second process accesses it, the kernel simply updates the second process's page table to point to the existing physical page. No disk I/O occurs. This is very fast — typically microseconds. - Example: A process calls
malloc()and gets virtual memory back, but Linux uses lazy allocation — it doesn't actually assign physical RAM until the process first writes to that memory. The first write triggers a minor fault, and the kernel maps a real page at that point.
2. Major Page Fault (Expensive)
The data is not in RAM. It needs to be fetched from the slow hard disk.
- Example: Your web browser needs to display an image you scrolled past an hour ago. It was pushed out of RAM to make space. The kernel must pause the browser, read the image data from disk back into a free RAM page, update the page table, and then let the browser continue. This involves disk I/O and can take milliseconds — thousands of times slower than a minor fault.
Segmentation Fault (Invalid Access)
If a process accesses a virtual address that has no valid mapping at all — not in RAM, not on disk, just completely unmapped — the kernel determines the access is illegal and sends the process a SIGSEGV signal (segmentation fault), terminating it. This is the kernel enforcing memory isolation.
Page fault counts for any process are visible via /usr/bin/time -v, which reports both "Major (requiring I/O) page faults" and "Minor (reclaiming a frame) page faults" in its summary — a quick way to see empirically which category of fault a workload is generating.