How Does Virtual Memory Give Private Address Spaces?
Virtual memory is a memory management technique used by modern operating systems to give every running process the illusion that it owns a large, private, and contiguous block of memory. In reality, physical RAM is shared among many processes and is often fragmented into non-contiguous regions. By separating the addresses a program uses from the actual locations in physical hardware, virtual memory provides isolation, simplifies programming, and allows systems to run programs larger than physical RAM.
Virtual Addresses vs. Physical Addresses
When a program executes, it does not reference physical RAM directly. Instead, every memory access uses a virtual address. The operating system and hardware cooperate to translate each virtual address into a corresponding physical address in RAM.
Because each process has its own independent virtual address space,
two different processes can use the exact same virtual address—such as
0x00400000—without interfering with each other. The
translation layer maps Process A's virtual address to one physical
location and Process B's virtual address to a completely different
physical location.
Paging and Address Translation
To manage memory efficiently, virtual memory divides both virtual and physical memory into fixed-size blocks.
- Pages: Fixed-size blocks of virtual memory, commonly \(4\text{ KB}\) (\(4096\) bytes) in size.
- Frames: Fixed-size blocks of physical RAM of the exact same size as pages.
A virtual address of \(n\) bits is split into two parts: a Virtual Page Number (VPN) and a page offset. If the page size is \(2^k\) bytes, the lower \(k\) bits represent the offset within the page, and the upper \(n - k\) bits represent the VPN.
\[\text{Virtual Address} = (\text{VPN}, \text{Offset})\]
During translation, the offset remains unchanged, while the VPN is mapped to a Physical Frame Number (PFN).
\[\text{Physical Address} = (\text{PFN}, \text{Offset})\]
Because any virtual page can be mapped to any available physical frame, a process's memory appears contiguous in its virtual address space even when its frames are scattered across physical RAM.
The Role of the Page Table and MMU
The mapping between virtual pages and physical frames is stored in a
data structure called a page table. The operating
system maintains a separate page table for each process. When a context
switch occurs—meaning the CPU switches from running one process to
another—the operating system updates a special CPU register (such as
CR3 on x86 architectures) to point to the new process's
page table.
The Memory Management Unit (MMU) is the hardware component responsible for performing the address translation on every memory access. If a virtual page is not currently mapped to a physical frame, the MMU triggers a page fault, allowing the operating system to either load the required data from disk into RAM or terminate the process if the access is invalid.
Speeding Up Translation with the TLB
Looking up a page table in main memory for every instruction would be too slow. To solve this, the MMU includes a small, fast hardware cache called the Translation Lookaside Buffer (TLB).
The TLB stores recent VPN-to-PFN translations. When the CPU generates a virtual address, the MMU checks the TLB first:
- TLB Hit: The translation is found immediately, and physical memory is accessed with minimal delay.
- TLB Miss: The MMU walks the page table in RAM to find the mapping, caches it in the TLB, and then completes the memory access.
Process Isolation and Security
Beyond creating the illusion of contiguous memory, virtual memory enforces strict isolation between processes. Each page table entry contains permission bits that control how a page can be accessed, such as read, write, and execute permissions, as well as a user/supervisor bit.
Because a process can only generate virtual addresses, and its page table only maps frames belonging to that process (or explicitly shared regions), it cannot read or overwrite the memory of another process or the operating system kernel. Any attempt to access an unmapped or unauthorized address results in a hardware exception, allowing the operating system to protect system stability and security.