In this lesson, you will learn how to distinguish between major and minor page faults to diagnose memory allocation bottlenecks in your applications.
When a process accesses a memory address that isn't currently mapped to physical RAM, the CPU triggers a page fault. Linux handles this via the page fault handler, which we categorize into two distinct types: minor and major faults.
Understanding the Fault Types
- Minor Page Fault: The page is already in memory (e.g., shared library code already loaded by another process) but the page table entry (PTE) is not yet updated for this process. These are generally fast and unavoidable in modern, demand-paged systems.
- Major Page Fault: The page is not in RAM at all and must be fetched from disk (backing storage). This involves I/O latency and is a primary indicator of memory pressure or "thrashing."
Correlating Patterns with eBPF
By using BCC tools like minherit or writing custom BPF programs attached to the exceptions:page_fault_user and exceptions:page_fault_kernel tracepoints, we can correlate these faults with application behavior.
Consider a memory-intensive application. If you observe a high rate of minor faults during startup, the application is likely faulting in its own memory regions (zero-filling). However, if you see an increase in major faults while the application is processing data, it suggests the system is under memory pressure and is being forced to swap pages out to disk or re-read them from the filesystem.
You can observe this correlation using perf stat or a simple BPF script:
// BPF logic snippet to track fault type
int trace_page_fault(struct pt_regs *ctx, unsigned long error_code) {
// If minor, the page is in cache; if major, it requires I/O
// We increment a map based on the fault type to correlate with
// the current task's allocation pattern.
return 0;
}
By profiling these against malloc or mmap calls, you can identify if your application's memory allocation pattern is causing excessive disk I/O, allowing you to optimize memory pools or adjust your mlock strategies.
Key Takeaway: Major page faults indicate true memory pressure and disk I/O dependency, whereas minor page faults reflect the normal, low-latency overhead of demand-paging during process execution.