Section 4: Memory Management

The Big Picture: Everyone Needs RAM

RAM is fast but limited, and every process wants some. The OS is the memory manager. It must do four things: give each process memory, keep each process out of the others' memory, use RAM wisely, and cope when RAM runs out.

Chapter 3 explained how RAM chips and the MMU (Memory Management Unit, the CPU part that translates addresses) work. This section shows what the OS does with that hardware. In short: the hardware provides the tools; the OS makes the decisions.

 Hardware (Chapter 3)             OS (this section)
 ────────────────────             ──────────────────────────────
 MMU translates addresses   ◄──   builds and edits the page tables
 Page-fault signal          ──►   decides what to do about it
 Physical RAM chips         ◄──   hands out and takes back frames

4.1 Virtual Memory Abstraction

What it is: Virtual memory is the trick of giving every process its own private, imaginary memory map. The process sees addresses like 0x00400000. The OS and MMU quietly translate each one to a real location in RAM chips (a physical address).

Why not let programs use real addresses directly?

 Process A's view            Real RAM                 Process B's view
 (virtual)                   (physical)               (virtual)

 0x1000 ──► page ───────────► frame 7  ◄──────────── page ◄── 0x1000
 0x2000 ──► page ───────────► frame 2
                              frame 9  ◄──────────── page ◄── 0x2000

Two processes both use the address 0x1000, yet land in different real frames. They never collide.

The key words:

How big is the space? On a 64-bit Windows PC, each process gets a huge virtual space (the hardware allows far more than any PC has RAM). The OS splits it into a user half for the program and a kernel half for the OS, which is shared and protected (Section 7).

4.2 Memory Allocation to Processes

What it is: How memory is handed out as programs start and as they ask for more.

Two levels of allocation:

1. The OS gives out pages. When a program needs memory, it asks the OS (a system call such as VirtualAlloc on Windows). The OS reserves a range of virtual pages.
2. The program's own library hands out small pieces. Programs usually need small things (a 40-byte object). Asking the OS for every one would be slow. So a heap manager (a library such as the C malloc or the Windows heap) takes big chunks from the OS and cuts them into small pieces.

Lazy allocation (demand paging). The OS does not hand over real RAM at once. When a program asks for 1 GB, the OS only promises it: it records "these virtual pages are allowed". Real frames are assigned the first time the program touches a page.

1. Program asks for 1 GB          ──► OS notes the promise. RAM used: ~0
2. Program writes to page 5       ──► page fault (no frame yet)
3. OS grabs a free frame, fills in the page table
4. The write is retried and works ──► RAM used: 4 KB

This is why Task Manager can show a program with a large committed (promised) size but a smaller working set (the part really in RAM). Programs that load an .exe also get it mapped lazily: only the pieces that run are read from disk.

Fragmentation. Over time free memory can become many small gaps ("fragments"). Paging solves most of it for the OS, because any free frame can go with any page. A heap inside a program can still fragment, which is one reason long-running programs sometimes use more memory than expected.

Memory the OS also keeps for itself: the kernel's own code and data, caches of file contents, and driver buffers. In Windows, the file cache uses spare RAM to keep recently used file data ready. That spare RAM is given back at once if a program needs it. So "RAM is almost full" in Task Manager is often good: unused RAM is wasted RAM.

On Windows: Task Manager → Performance → Memory shows In use, Available, Committed and Cached. The Resource Monitor (resmon) Memory tab shows the colour bar of Hardware Reserved, In Use, Modified, Standby and Free memory.

4.3 Memory Protection

What it is: The OS and the CPU together stop a process from touching memory that is not its own, and stop it from using memory in the wrong way.

Protection is built into every page table entry. Each entry holds permission bits:

So the code pages of a program are marked read and execute, but not writable. Data pages are read and write, but not executable. This rule (often called DEP, Data Execution Prevention, on Windows) stops a whole family of attacks that sneak code in as "data" and run it.

What happens when a program breaks the rules? The MMU notices and raises a fault (a kind of CPU exception, Chapter 2). Control jumps into the OS. The OS checks:

• If it is a harmless case (like lazy allocation, 4.2), it fixes it and resumes.
• If the program really touched forbidden memory, the OS ends the program. On Linux this shows as a segmentation fault. On Windows you see "stopped working" or an access violation error.

The crash hits only the guilty process. Everything else keeps running. That is one of the most valuable things an OS gives you.

Random layout (ASLR). Windows and Linux also place a program's pieces at random addresses each time (Address Space Layout Randomization). An attacker cannot guess where useful code sits.

4.4 Paging and Swapping

What it is: What the OS does when RAM is full: move rarely used pages out to disk, to make room for pages that are needed now.

The idea. Disk is far larger and far slower than RAM. The OS treats RAM like a desk and the disk like a filing cabinet. Papers you are not using go in the cabinet; when you need one, you fetch it.

Speed gap (about):

Paging out and in:

RAM is nearly full, and a new page is needed
        │
1. OS picks a "cold" page (not used for a while)
2. If it was changed, the OS writes it to the paging file on disk
3. The frame is now free; give it to the new page
4. The old page's table entry is marked "not present"
        │
Later, the program touches the old page
        │
5. MMU: page not present → page fault
6. OS reads the page back from the paging file into a free frame
7. Table entry updated; the program continues

Names you will meet:

Thrashing happens when the total memory the programs actively need is much bigger than RAM. The PC grinds, the disk light stays on, and the mouse lags. The cure is simple: close programs or add RAM.

Does a page file mean you are out of memory? No. Windows also uses it to push rarely used pages out early, so RAM stays free for the file cache, and it needs it to write crash dumps and to support the committed memory limit. Keeping it on is recommended.

On Windows: Win + R → sysdm.cpl → Advanced → Performance Settings → Advanced → Virtual memory → Change shows your paging file size. Resource Monitor's Memory tab shows Hard Faults/sec. A constantly high number with a slow disk means you are short of RAM.

Summary