← Interview Prep

Linux Kernel — Memory Addressing

How x86-64 turns a virtual address into physical RAM: segmentation (flat model) vs paging, the 4-level page-table walk & PTE flags, per-process page tables & isolation, the TLB (flushes, shootdowns, huge pages), the user/kernel address-space split & KPTI, and NUMA nodes/zones.

How the CPU turns an address in your program into a physical byte in RAM — the foundation everything else (paging, process isolation, the page cache) builds on. This is an original, interview-focused tour of x86-64 memory addressing as Linux uses it.

Three address spaces: a logical/virtual address (what your code sees) → the MMU walks page tables → a physical address in RAM. The TLB caches recent translations so this isn't done from scratch every access.

Segmentation vs paging

• Segmentation (x86 legacy): logical → linear via segment descriptors. Linux barely uses it — it sets up a flat model (base 0, full range) so linear ≈ logical, and relies on paging for real protection/translation. Worth one sentence in an interview, no more.
• Paging is the real mechanism: the linear address space is divided into fixed pages (4 KiB standard), mapped to physical page frames by page tables.

Paging & the page-table walk

On x86-64, a 48-bit virtual address is translated through a 4-level page table (5 levels with LA57). Each level indexes a table; the final entry (PTE) gives the physical frame + flags:

virtual addr → PGD → PUD → PMD → PTE → physical frame + offset
   (Linux names: pgd → p4d → pud → pmd → pte)
PTE flags: Present, R/W, User/Supervisor, Accessed, Dirty, NX (no-execute), Global

• Per-process page tables: each process has its own top-level table (its mm->pgd), so the same virtual address maps to different physical memory in different processes — that's isolation. A context switch loads the new page-table root (CR3).
• Page fault: if the PTE isn't present (or a permission is violated) the CPU traps to the kernel, which either maps a page (demand paging / COW) or kills the process (SIGSEGV).

The TLB

Walking 4 levels per access would be ruinous, so the MMU caches translations in the TLB. A hit is ~1 cycle; a miss triggers the walk. Consequences you should know:

• Changing a mapping requires a TLB flush (invlpg, or a full flush on CR3 reload) — expensive; cross-CPU flushes are TLB shootdowns (IPIs).
• Huge pages (2 MiB / 1 GiB) map more memory per TLB entry → fewer misses; big win for databases/JVMs (THP or hugetlbfs).
• Global pages (kernel mappings) survive a CR3 reload; PCID tags avoid full flushes on context switch.

The address-space split

Every process shares the same kernel mapping (so a syscall doesn't switch page tables), but user mappings are private. KPTI (Meltdown mitigation) partly breaks that sharing by unmapping most of the kernel while in user mode.

Physical memory: nodes & zones

• Physical RAM is tracked per-frame by a struct page array. On NUMA it's split into nodes (per-socket memory), each into zones (DMA, DMA32, Normal, Movable) for allocation constraints.
• The buddy allocator hands out power-of-two page blocks; the slab/slub allocator carves those into kernel objects. (More in Memory Management.)