A process's memory to the kernel: mm_struct & VMAs, the regions (text/data/bss/heap/mmap/stack), creating/growing them (mmap, brk, stack growth), demand paging & page faults (minor/major, anon vs file-backed, Copy-On-Write, SIGSEGV), and ASLR/hardening.
What a process's memory actually looks like to the kernel — the regions, how they're created, and how a page fault fills them in lazily. Original, interview-focused notes; the per-process side of Memory Addressing.
A process's address space is a set of memory regions (VMAs), described by an
mm_struct. Nothing is really allocated up front — the kernel just records "this range is valid," and
demand paging maps physical pages only when they're first touched.
mm_struct is the address space: the page-table root (pgd), the list/tree
of regions, and boundaries (code/data/heap/stack). Threads share one mm; kernel threads have none.vm_area_struct (VMA) is one contiguous region with uniform properties: start/end,
permissions (r/w/x), and whether it's anonymous (heap/stack) or file-backed
(a mapped file/library). VMAs are kept in a tree for fast "which region owns this address?" lookups on a fault./proc/<pid>/maps is the VMA list made visible — every line is a region.| Region | What |
|---|---|
| text | Executable code — file-backed, read-only, shared between processes. |
| data / bss | Initialized / zero-initialized globals. |
| heap | Grown by brk/sbrk; large allocations go via mmap instead. |
| mmap area | Shared libraries, file mappings, large malloc chunks, anonymous maps. |
| stack | Grows down on demand; a guard gap prevents collision. |
mmap() is the workhorse: map a file (shared or private) or anonymous memory. The
kernel just adds a VMA — no pages yet.brk moves the heap's top; the C library's malloc uses brk for small
allocations and mmap for large ones (returned independently to the kernel on free).RLIMIT_STACK).Because regions are lazy, actually using memory triggers a page fault, which the kernel resolves by the VMA type:
fork, shared pages are read-only; the first write faults and
the kernel makes a private copy — why fork is cheap.mprotect tighten what's allowed./proc/pid/maps show?mmap actually do at call time? (adds a VMA; no pages yet — demand paging)malloc — when does glibc use each?