Explain virtual memory and paging. How does the operating system map a process's virtual addresses to physical RAM?

1. Address translation, drawn (x64, 4 KB pages)

virtual address (48 bits used)
| PML4 index | PDPT index | PD index | PT index | offset (12 bits) |
      |            |           |          |
      v            v           v          v
   [PML4] ---> [PDPT] ---> [  PD  ] ---> [  PT  ] ---> frame number + offset = physical address
   CR3 register points to the PML4 of the current process

TLB hit:  translation in ~1 cycle
TLB miss: up to 4 memory reads (often cached) for the page walk

2. Reserved, committed, resident

That's why a .NET process can show a virtual size of hundreds of GB (GC reservations) while using a few hundred MB of RAM. Size services by working set and committed memory, not virtual size.

3. Large pages

• A 2 MB page covers 512 times more memory per TLB entry, reducing TLB misses for big heaps.
• Requires OS configuration and privileges; the .NET GC can use large pages with GCLargePages together with a heap hard limit. It's specialised tuning for very large, long-running servers.
• Linux's transparent huge pages (THP) can apply automatically, with mixed results for some workloads.

4. Overcommit on Linux

• By default, Linux lets processes commit more than RAM plus swap (heuristic overcommit). Failure comes later, at touch time, via the OOM killer.
• Windows enforces a commit limit (RAM plus page file); allocation fails up front with an out-of-memory error.

5. ASLR and security

• Address space layout randomisation places code, stacks and heaps at random addresses each run, making exploits harder.
• Non-executable stacks and heaps (NX/DEP) stop injected data being run as code.
• .NET code benefits automatically; native libraries should be built with these protections too.

6. Memory-mapped files in .NET

using var mmf = MemoryMappedFile.CreateFromFile("index.bin", FileMode.Open, null, 0, MemoryMappedFileAccess.Read);
using var view = mmf.CreateViewAccessor(0, 0, MemoryMappedFileAccess.Read);
long value = view.ReadInt64(offset);   // page fault on first touch of each page, then RAM speed

Good for large read-mostly data and sharing between processes; less suitable for heavy random writes or data that must be durable immediately.

7. Try it yourself

1. Allocate a 1 GB byte[] and watch working set before and after writing one byte per 4 KB page (on Linux the GC may commit and zero memory differently; observe both virtual and resident sizes in top).
2. Memory-map a large file, read one byte from every page, and watch resident memory and page faults (ps -o min_flt,maj_flt -p <pid>).
3. Compare Process.VirtualMemorySize64, PrivateMemorySize64 and WorkingSet64 for an idle ASP.NET Core app.

namespace VirtualMemory;

using System.Diagnostics;
using System.IO.MemoryMappedFiles;

public static class Program
{
    private const int PageSize = 4096;

    public static void Main(string[] args)
    {
        Report("Start");

        var big = GC.AllocateUninitializedArray<byte>(512 * 1024 * 1024);   // address space committed, pages not all touched
        Report("After allocating 512 MB (uninitialised)");

        for (var i = 0; i < big.Length; i += PageSize)
        {
            big[i] = 1;                                        // first touch of each page -> page fault -> RAM
        }
        Report("After touching every page");
        GC.KeepAlive(big);

        if (args.Length > 0)
        {
            using var mmf = MemoryMappedFile.CreateFromFile(args[0], FileMode.Open, null, 0, MemoryMappedFileAccess.Read);
            using var view = mmf.CreateViewAccessor(0, 0, MemoryMappedFileAccess.Read);
            long sum = 0;
            for (long offset = 0; offset < view.Capacity; offset += PageSize)
            {
                sum += view.ReadByte(offset);                  // pages come from the page cache on demand
            }
            Report($"After reading one byte per page of {args[0]} (sum {sum})");
        }
    }

    private static void Report(string label)
    {
        using var p = Process.GetCurrentProcess();
        Console.WriteLine($"{label,-45} virtual {p.VirtualMemorySize64 >> 20,8} MB  private {p.PrivateMemorySize64 >> 20,6} MB  working set {p.WorkingSet64 >> 20,6} MB");
    }
}