Memory Protection

Two processes can use the same virtual address, such as 0x7f100000, without gaining access to the same memory. A process can read its heap but cannot normally read the kernel's data. It can modify its writable variables but should not be able to rewrite its executable instructions.

These boundaries are enforced by memory protection.

Memory protection combines hardware privilege levels, virtual address translation, page permissions, and kernel policy. The processor checks the active mapping on every instruction fetch, load, and store. When an access violates the mapping, execution traps into the kernel instead of silently reaching the forbidden bytes.

This mechanism serves both reliability and security. It contains ordinary pointer bugs, isolates mutually untrusted processes, protects the kernel, and makes several code-injection techniques harder.

Memory protection defines which virtual-memory operations are permitted in the current address space and privilege mode.

This chapter follows hardware permission checks across process and kernel address spaces, explains read, write, execute, guard, copy-on-write, and shared mappings, and examines protection changes, user pointers, devices, inspection, and fault diagnosis.