How Does an MMU Handle a Page Fault?

When a program accesses a virtual memory address whose page is not currently loaded in physical RAM, the Memory Management Unit detects the missing mapping and triggers a page fault exception. Rather than resolving the missing data on its own, the MMU halts the faulting instruction, records the offending address, and transfers control to the operating system kernel. The kernel then locates the page on secondary storage, loads it into a free physical frame, updates the page table, and resumes the interrupted instruction.

Address Translation and Detection

In a classical virtual memory system, a virtual address is split into a virtual page number (VPN) and a page offset. For a page size of \(P = 2^k\) bytes, the lower \(k\) bits form the offset within the page, while the upper bits identify the VPN. The MMU translates the VPN into a physical frame number (PFN) by consulting the Translation Lookaside Buffer (TLB) and, on a TLB miss, walking the page table in memory.

Each page table entry (PTE) contains control bits alongside the PFN, including a present (or valid) bit. When the MMU inspects the PTE for the referenced VPN and finds the present bit cleared (\(0\)), it determines that the virtual page is not resident in RAM.

Raising the Page Fault Exception

Because the MMU is hardware and does not manage disk I/O or memory allocation policies, it cannot fetch the missing page itself. Instead, it immediately aborts the current memory access and raises a synchronous hardware exception known as a page fault.

Before transferring control, the hardware performs several critical steps:

  1. It saves the faulting virtual address in a dedicated control register (such as CR2 on x86 architectures or FAR_EL1 on ARM64).
  2. It pushes the processor state, including the program counter pointing to the faulting instruction, onto the kernel stack.
  3. It switches the CPU from user mode to privileged kernel mode and jumps to the operating system's page fault handler.

Operating System Resolution

Once the kernel's page fault handler takes over, it inspects the faulting address and the process's memory map to determine whether the access is legal. If the address is invalid or violates permissions (such as writing to a read-only page), the kernel terminates the process with a segmentation fault.

If the access is valid and the page is simply not in RAM, the kernel resolves the fault through the following sequence:

  1. Allocate a physical frame: The kernel finds a free frame in RAM. If memory is full, a page replacement algorithm (such as LRU or Clock) selects a victim frame to evict, writing it back to disk if its dirty bit is set.
  2. Fetch the page: The kernel schedules a disk or swap read to copy the missing page from secondary storage into the allocated physical frame.
  3. Update the page table: Once the I/O operation completes, the kernel updates the PTE with the new PFN, sets the present bit to \(1\), and clears or sets appropriate protection bits.
  4. Invalidate stale TLB entries: If necessary, the kernel flushes any stale translation for that virtual address from the TLB.

Resuming Execution

After updating the page table, the kernel executes a return-from-exception instruction. This restores the saved processor state, switches back to user mode, and re-executes the exact instruction that originally caused the fault. This time, the MMU finds the present bit set in the PTE, caches the translation in the TLB, and completes the memory access transparently to the running program.