This question tests whether you know that "page fault" names a family of traps with very different costs. The interviewer wants the PTE mechanics — not "the program ran out of memory."
The mental model: every access goes through the TLB and page tables. A page fault is simply the hardware hitting a PTE that says "not present" or "you may not do that." The MMU can't continue, so it traps to the kernel, and the kernel's fault handler decides what the right outcome is.
Walk through the mechanism. On a not-present PTE, the handler classifies the fault. If the page exists somewhere in memory — in the page cache, or in swap cache after being swapped out — the fix is to allocate a frame and point the PTE at it. That's a minor fault: microseconds, no I/O, just a page table update and a TLB refill. If the page is on disk — a file page never read, or an anonymous page swapped out — the kernel issues I/O and blocks the thread until the page arrives. That's a major fault: milliseconds, dominated by disk seek and transfer. The pain threshold is the disk, not the trap.
Why the trap happens at all is demand paging: the kernel maps only a skeleton. When a program starts, its text, data, and stack are mapped lazily; perf stat shows the first touch of each region as minor or major faults. The expensive case is the first read of a file page through the page cache, or refaulting a page that got evicted — the page cache evicts clean pages under pressure, so a working set larger than RAM produces continuous major faults: thrashing. vmstat's si/so (swap in/out) going high is the signature.
The second family is protection faults. The PTE is present but the access violates its bits — a write to a read-only COW page, or an execute on a no-exec page. The handler checks the reason: COW faults are handled (copy the page), bad accesses become SIGSEGV. Distinguishing the two is exactly how copy-on-write works.
Tradeoffs and edge cases worth naming:
madvise(MADV_SEQUENTIAL)and readahead push the fault cost into the background by prefetching.- Huge pages (2MB) shrink page-table depth and fault count, at the cost of granularity.
- Fault latency under load grows non-linearly because reclaim itself stalls.
perf statreportspage-faultsandminor-faults/major-faultsseparately — a good answer names both counters.
A strong closing line: a page fault is a hardware trap on a missing or protected PTE, and the price is set by where the page lives — memory is microseconds, disk is milliseconds, and the difference is the whole question.