What is a page fault? Explain soft (minor) vs hard (major) page faults, and how you would investigate a .NET service whose latency spikes line up with a high page fault rate.

1. Virtual memory recap

Each process sees its own virtual address space split into pages (usually 4 KiB on x64; 4 KiB or 16 KiB on Arm64, and 2 MiB / 1 GiB huge pages). The kernel keeps a page table that maps virtual pages to physical frames.

Virtual address ──► TLB hit? ──yes──► physical address ──► cache/RAM
                      │
                      no
                      ▼
                 page table walk
                      │
         entry present? ──no──► PAGE FAULT (trap to kernel)

2. What the kernel does on a fault

PAGE FAULT
   │
   ├─ address not in any mapping ──────────► SIGSEGV / access violation
   │
   ├─ page in RAM already (page cache,
   │  shared lib, zero page, COW) ─────────► MINOR fault: fix page table, resume
   │
   └─ page on disk (swap, page file,
      mmap'd file) ───────────────────────► MAJOR fault: block thread,
                                              issue disk I/O, map page, resume

The thread that faulted is blocked for the whole disk read. If that thread holds a lock or is the GC thread, everyone waits.

3. Why minor faults are everywhere

• new byte[100_000_000] reserves and commits memory, but Linux only maps a physical page when you first touch it (demand paging). Every first write to a fresh 4 KiB page is a minor fault.
• After fork, parent and child share pages until one writes (copy-on-write).
• Loading System.Private.CoreLib.dll maps it; pages fault in as code runs.

This is why startup shows tens of thousands of minor faults. That is fine.

4. Why major faults hurt .NET in particular

The GC marks by walking object references across the heap. If parts of the heap were swapped out, a gen2 GC touches them all, triggering thousands of major faults in a row. A 50 ms GC becomes a multi-second pause. This is why many teams disable swap for latency-sensitive services, and why Kubernetes historically required swap to be off.

5. Memory-mapped files

MemoryMappedFile maps a file into the address space. Reading it causes major faults the first time (data comes from disk), then minor faults or none once it is in the page cache. This is often faster than FileStream for random access to large files, because the OS handles caching.

6. Huge pages and the TLB

The TLB holds a limited number of translations. With 4 KiB pages, a 32 GB heap needs ~8 million entries, so TLB misses are frequent. Huge pages (2 MiB) cut that by 512 times. .NET supports large pages for the GC heap (GCLargePages with GCHeapHardLimit), mostly useful for very large server heaps.

7. Tools

8. Try it yourself

1. Write a console app that allocates new byte[1_000_000_000] and then writes one byte every 4096 bytes.
2. Run it with /usr/bin/time -v dotnet run and look at Minor (reclaiming a frame) page faults: about 244,000 (1 GB / 4 KiB).
3. Run it again but only allocate, no writes. Minor faults drop sharply, because untouched pages are never mapped.
4. On a test VM with swap, start a process that eats most of RAM, then rerun step 2 and watch Major faults climb.

// Demonstrates demand paging: memory is only mapped when first touched.
using System.Diagnostics;

const int PageSize = 4096;
var buffer = GC.AllocateUninitializedArray<byte>(512 * 1024 * 1024); // 512 MiB

var before = Process.GetCurrentProcess();
Console.WriteLine($"Working set before touch: {before.WorkingSet64 / 1024 / 1024} MiB");

var sw = Stopwatch.StartNew();
for (int i = 0; i < buffer.Length; i += PageSize)
{
    buffer[i] = 1; // first write to each page = one minor page fault
}
sw.Stop();

var after = Process.GetCurrentProcess();
Console.WriteLine($"Working set after touch:  {after.WorkingSet64 / 1024 / 1024} MiB");
Console.WriteLine($"Touching {buffer.Length / PageSize:N0} pages took {sw.ElapsedMilliseconds} ms");

# Linux: count minor and major faults for the run
/usr/bin/time -v dotnet run -c Release 2>&1 | grep -i "page faults"

# Watch faults for a running service once a second
pidstat -r -p $(pgrep -f MyApi) 1

# System-wide: majflt/s and swap activity
sar -B 1
vmstat 1