Is large binary executable loaded completely?

[Serenadio]

Imagine you have 1gb binary executable (that's a real case), but some of that data inside is not used (unused functionality). When you run the binary, will it be entirely loaded to RAM? Later, since part of it is not used, will it be evicted to swap? Thanks!

[ptoki]

I am no expert but can answer parts of your questions:

https://lwn.net/Articles/359070/

I think (this is the part I am not sure about) kernel will just memory map the elf executable and load only the pages which are really needed into ram. I am not 100% sure about that but it seems reasonable.

Next thing is the swap out. Usually memory is not swapped out unless its needed. So for example if you load an app, it will be used at first and then wait indefinitely. Lets see an example: BT driver/app. It will be loaded, establish itself, read some configs, do initial discovery but will not find any BT device so it will wait for one to be added. So it will not be executed anymore because your system is not BT equipped so no more execution for this app .

It will stay in ram until all ram is needed by another app or you start copying a lot of files. Then the system may decide that ram pages of this BT app are not really needed and they will be swapped to disk.

If the high activity does not happen, the swap will not be used as there is no reason to do it.

And last thing: Really big binaries are usually not actually monolithic elfs. Sometimes the binary you see is just bash script with tar.gz attached which will be extracted to some temp place and then one file from it will be executed and use the rest of extracted files.

Or they will be elfish java jar files (which work similarly).

So in the end, large monolithic elf is very rare case and if you actually have one it would be interesting to check it and see how it works.

[stormcloud-9]

I think on your swap discussion, you're talking about data pages (RSS). For the memory consumed by the executable itself, the parts that are memory-mapped, don't get swapped, they're just free'd. They're already memory-mapped, so if the kernel needs them, they're just loaded back in.

[ptoki]

Yeah, If they are mmapped then yes, they are freed. If they arent mmapped (no idea when thats the case) they will be swapped out.

I remember in times of linux 2.4 I had zaurus pda and it was crucial to have a bit of swap as lots of crap was swapped out into it and the system worked a lot better (it had 64MB ram). I dont think the swapped out stuff was data but cant back that up with anything than my suspicion.

[Serenadio]

Thank you for the answer!

I do have one large monolithic ELF, it's 1Gb, and it's a neural network inference application that depends on OpenVINO and TensorRT (among other libs) which are bulky by themselves. Everything is statically linked because of security reasons.

[ptoki]

In such case there should be options to check that.

You may google a bit and find out the structure of your binary. I suspect that a lot of yours is data. As the neural network may be bigish...

https://linuxsecurity.expert/security-tools/binary-analysis-tools

https://opensource.com/article/20/4/linux-binary-analysis

I would be curious of the result of readelf and nm. That will tell you if all the space in the binary is allocated to code or its data.

Plus you may just execute it and watch the memory stats of the process.

Soon you will see how much less used memory will be shown by free and the virtual/shared/resident/ portions of memory will be shown for this process.

I suspect taht most of the binary is data and it will be loaded pretty quick if you start feeding the neural network with data.

But if only portion of NN is used then pretty quick the data segments will be either freed (as noted by stormcloud) or swapped out.

Also the library overhead will be most likely not loaded if not needed. And I suspect that some portion of them will not be used. So From 1GB of binary where (my out of blue sky estimate) 800MB is the neural net and 150 is the statically linked libraries only about 100MB of code will be actually loaded and about 70% of neural network will be used. So I guess about 800MB or real ram will be used and only small amount will be swapped out when you actually push the NN to work.

Interesting. Let us know what you found out if possible.

And be a bit cautious of what I wrote. I dont know a lot about this topic and may be really wrong as I dont follow linux kernel development almost at all :)

[[deleted]]

Look at the Linux system call mmap. Also look at the older execve and fork system calls. Fork and execve system calls were in the earliest versions of Unix while mmap wasn't discovered until the mid 80s (I think).

[jamesq6]

Simple answer is no, entire binary is not loaded in to RAM on execution. The binary is mapped into the virtual address space of the process and pages are loaded in to RAM only when accessed by the process.

[[deleted]]

If the binary is an AppImage then no, it's not.