Swapping, Overcommit & OOM

The TLB — cache for translations

The Translation Lookaside Buffer caches recent VPN→PFN mappings. A TLB hit avoids a multi-level page walk (~10–100 cycles saved). On context switch, the TLB may be flushed or tagged per-ASID — otherwise the next process would see stale translations. High switch rates + large working sets = TLB miss storms.

Swapping — RAM overflow valve

When physical memory is scarce, the kernel evicts cold pages to swap (disk partition or file). Accessing an evicted page triggers a major page fault — milliseconds of disk latency vs nanoseconds for RAM. Sustained swap in/out (vmstat si/so) means you're memory-bound, not CPU-bound.

Metric	Meaning
RSS (Resident Set Size)	Pages actually in RAM
VSZ (Virtual Size)	Total mapped virtual — can exceed RAM
Swap used	Evicted anonymous pages
Page cache	File-backed pages (reclaimable)

Linux overcommit

Linux often grants more virtual memory than physical RAM exists — overcommit. Policies (vm.overcommit_memory):

• 0 (default) — heuristic: allow reasonable overcommit, deny obviously impossible requests.
• 1 — always succeed malloc/mmap until OOM.
• 2 — strict cap based on overcommit_ratio.

Committed memory can exceed RAM until processes actually touch pages — then the kernel scrambles.

The OOM killer

When reclaim (drop cache, swap out) fails, the OOM killer picks a process (by oom_score) and sends SIGKILL. In containers, cgroup memory.max triggers OOM inside the cgroup first — your pod dies while the node looks healthy.

Senior-level signal

"Plenty of free memory but OOM killed" usually means cgroup limit vs node limit confusion, or memory.max counting page cache the app didn't expect. Compare kubectl top, /sys/fs/cgroup/.../memory.current, and smaps_rollup — not just free -h.

Where this goes next

Heap Allocation & malloc dives into how user-space allocators request those virtual pages from the kernel — brk, mmap, and why RSS grows in steps.