Linux Process Memory Management Essentials

Basic Concepts

Kernel: Runs on top of hardware, is the core of the operating system, and runs in memory

Process: All programs running on a computer, managed uniformly by the kernel, these processes compose user space

User Process: User-level processes such as GUI processes, server processes, and command-line processes

The kernel runs in kernel mode, can directly access the processor and memory, and cannot tolerate faults; while user processes run in user mode, where a single process crash will not affect the entire system operation

Thread: A more granular concept than process, generally mentioned processes are single-threaded, multi-threaded processes start faster than multi-process ones, main threads will fork other child threads, and can communicate with each other conveniently while sharing I/O and system resources

Kernel Management of Processes and Memory

• Process: The kernel decides which process can use the CPU
• Memory: The kernel manages all memory, allocates memory to processes, including shared memory between processes and free memory

Understanding Kernel Process Management

For a single-core CPU, every process takes turns using the CPU. The CPU times each incoming process, pauses when time expires, then switches to kernel mode. The kernel records the state of CPU and memory, to restore the suspended process. The kernel executes tasks from the previous time slice such as disk read/write operations, then selects a ready process to execute. The kernel prepares CPU and memory for the new process (or for previously suspended processes), the kernel tells the CPU the time slice, switches the CPU back to user mode, and then the process continues using the CPU for computation

The process of switching CPU usage rights between processes is called context switching, and the kernel runs during the gaps of context switching

System Calls

fork(): Kernel creates a process copy

exec(): Kernel uses the program in exec(program) to replace the current process

Processes that need kernel assistance all use the approach of first fork then exec(..) to request the kernel

Process Tracking

Common commands:

Process information: top and ps

Process and file information: lsof

Trace system calls: strace

Trace shared library calls: ltrace

Tracing Threads

$ ps m

Or press H under top

Measuring CPU Time

$ top -p pid1

Command file execution CPU timing

$ /usr/bin/time command

Average Load

$ uptime

Indicates CPU busyness level, typically web servers have higher average loads, processes start quickly and end quickly

High average load but slow response usually indicates significant memory performance impact. When memory is insufficient, many processes are in ready state but there isn’t enough memory for executing processes

Memory status can be viewed using: free command

Understanding CPU, Kernel, and Memory Relationships

The CPU converts virtual addresses accessed by processes into actual memory addresses through the MMU (Memory Management Unit). The kernel assists the MMU in dividing memory used by processes into smaller regions called pages. Multiple pages are managed using page tables (a data structure maintained by the kernel). The MMU can map virtual addresses to actual memory addresses through these page tables. Page allocation is demand-based, roughly starting with instructions loaded into pages. If the next instruction of this process is executed when the previously loaded memory pages don’t exist, the kernel will load the required memory pages for the instruction, then let the program resume execution. If the process needs more memory, it similarly requires the kernel to obtain more memory before allocation

Memory Page Errors

• Minor page fault: If the required memory page exists in main memory but the MMU cannot find it, usually occurs when a process wants more memory but MMU space is limited
• Major page fault: If the required page doesn’t exist in main memory, the kernel will attempt to load it from storage media like disk. Most errors affect system performance, particularly likely when loading code from disk for the first time or when memory is insufficient

Viewing method:

$ /usr/bin/time

Monitoring CPU and Memory

$ vmstat n // Refresh data every n seconds

IO Monitoring

• Global

$ iostat

• Per process

$ iotop