I am learning page table management, and I learned that VA to PA translation takes 4 memory accesses in a 4-level page table (considering TLB miss and miss in page walk cache).

But, as Linux uses the follow_page function for the PTW and this function internally calls to follow_page_mask. That further makes calls to p4d_offset, pud_offset, pgd_offset and so on.

So, my question here is that, for example, when pud_offset is called, it will return virtual address of a PMD directory (I guess) and to get the physical address of the PMD directory, there is again need to perform PTW.

So, how does memory accesses for address translation will 4? Isn't it more than 4?

2 Answers 2


When people say that virtual to physical address translation using four-level page tables on x86 takes four memory accesses (at most), they are referring to the work that the CPU (strictly-speaking, the MMU) has to do to decode a linear address and convert it into a physical address.

The process is detailed in Volume 3A of the Intel® 64 and IA-32 Architectures Software Developer’s Manuals, section 4.5. In four-level mode with 4KiB pages (the worst case), linear addresses are structured as follows:

47-39 38-30 29-21 20-12 11-0
PML4 Directory pointer Directory Table Offset

Given such an address, if a full address decode is required, the CPU has to:

  • use the base in CR3 plus the PML4 value to find the relevant PML4 entry (one memory access)
  • in the page-directory-pointer table corresponding to the PML4 entry, read the entry for the directory pointer (one memory access)
  • in the page directory, read the entry for the directory (one memory access)
  • in the page table, read the entry for the table (one memory access)

The result of the last read, combined with the offset portion of the linear address, gives the physical address, after a total of four memory accesses.

The kernel is only involved if a page fault occurs; it needs to do more work to handle this than the CPU does in the ideal case.


The page directory and page table entries contain the physical addresses to the start of page tables and page directories. Thus there is no need to do a page table walk to find these locations.

A memory access is done by hardware in the memory management unit, so unless there is some error like trying to access an invalid address or an unmapped page, the access is transparent to the software.

  • Okay, is it so that whenever PTW is carried out, follow_page is not called most of the time? Instead, MMU takes entries from page directories and walks through the next level of page directories.
    – Rohit
    Aug 16, 2021 at 10:51
  • 1
    Yes, it's all done by the hardware in the MMU. This is how it is done on x86, but there are of course different variations on this theme. For example, the MIPS architecture specifies a software-managed translation lookaside buffer (TLB). This reduces the hardware MMU to just a TLB that is capable of generating an exception on a TLB miss, and the exception handler routine is responsible for loading the appropriate entry into the TLB. Aug 16, 2021 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .