I understand that a forked process maps the parent's memory and copies it when writing to it. Does it copy just what it needs written or does it copy the entire mapped memory ?


2 Answers 2


Short answer: Neither. The kernel copies a full page. The size of a page depends on the architecture you're using (and architectures these days usually support multiple page sizes). If you're running on a x86 64-bit architecture, 4KiB is the most likely size.

Longer answer: The kernel and hardware virtual memory systems deal with memory by slices called pages. The default page size on x86 64-bit architecture is 4KiB for example.

During fork() most of the parent memory space is shared with the child. This memory space is composed of pages. Each shared page is marked read-only by the kernel during fork().

After fork() is complete, if either the parent or the child tries to modify the memory, the hardware generates a page fault because the page is marked read-only. A page fault is a CPU exception that traps into the kernel (i.e the current program execution stops and the cpu starts executing a predefined exception handler in the kernel).

The kernel then determines that it's a copy on write fault and allocates a new page. This page is marked read/write, the content of the previous page is copied onto it. The kernel then maps it into the memory space. The process execution is then resumed at the trapping instruction: the instruction that triggered the fault is executed again. This time the page is marked read/write, so the instruction completes without faulting.

This process will repeat itself every time either the child or the parent writes to a shared page. After a CoW fault has occurred for a page, it is usually still marked read-only in the "other" process (it depends on the kernel implementation). If this process tries write to it, a fault will be generated like before. But the kernel will notice that the page is not shared anymore and simply mark it read/write.


In 1988 SunOS-4.0 introduced the modern mmap() implementation. All modern OS reimplemented this concepts from SunOS-4.0. Since that time, the fork() call is typically a copy on write variant.

If you write access memory that was mapped in a shared way by the parent process, this remains shared in the child. If you write access private memory, this is replaced by a private copy while you try to modify it.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .