1. Address Translation

2. Main Points Address Translation Concept Flexible Address Translation
How do we convert a virtual address to a physical address?
Flexible Address Translation
Base and bound
Segmentation
Paging
Multilevel translation
Efficient Address Translation
Translation Lookaside Buffers
Virtually and physically addressed caches

3. Address Translation Concept

4. Address Translation Goals
Memory protection
Memory sharing
Shared libraries, interprocess communication
Sparse addresses
Multiple regions of dynamic allocation (heaps/stacks)
Efficiency
Memory placement
Runtime lookup
Compact translation tables
Portability

5. Bonus Feature
What can you do if you can (selectively) gain control whenever a program reads or writes a particular virtual memory location?
Examples:
Copy on write
Zero on reference
Fill on demand
Demand paging
Memory mapped files …

6. A Preview: MIPS Address Translation
Software-Loaded Translation lookaside buffer (TLB)
Cache of virtual page -> physical page translations
If TLB hit, physical address
If TLB miss, trap to kernel
Kernel fills TLB with translation and resumes execution
Kernel can implement any page translation
Page tables
Multi-level page tables
Inverted page tables …

7. A Preview: MIPS Lookup
In assignment 2, TLB is setup for you – physical memory for a process is contiguously allocated, and limited size, so it fits entirely in the TLB.

8. Virtually Addressed Base and Bounds

9. Question
With virtually addressed base and bounds, what is saved/restored on a process context switch?
Only the OS gets to change the base and bounds! Clearly, user program can't, or else lose protection.
With base&bounds system, what gets saved/restored on a context switch?
contents of base and bounds register; or maybe even contents of memory

10. Virtually Addressed Base and Bounds
Pros?
Simple
Fast (2 registers, adder, comparator)
Safe
Can relocate in physical memory without changing process
Cons?
Can’t keep program from accidentally overwriting its own code
Can’t share code/data with other processes
Can’t grow stack/heap as needed
Provides level of indirection: OS can move bits around behind the program's back, for instance, if program needs to grow beyond its bounds, or if need to coalesce fragments of memory. Stop program, copy bits, change base and bounds registers, restart.
Because OS manages the translation, we control the vertical, we control the horizontal.
Hardware cost:
2 registers
adder, comparator
Plus, slows down hardware because need to take time to do add/compare on every memory reference.
In 60's, thought to be too expensive!
But get better use of memory, and you get protection. These are really important. CPU speed (especially now) is the easy part.

11. Segmentation Segment is a contiguous region of virtual memory
Each process has a segment table (in hardware)
Entry in table = segment
Segment can be located anywhere in physical memory
Each segment has: start, length, access permission
Processes can share segments
Same start, length, same/different access permissions

12. Segmentation
This should seem a bit strange: the virtual address space has gaps in it! Each segment gets mapped to contiguous locations in physical memory, but may be gaps between segments.
This is a little like walking around in the dark, and there are huge pits in the ground where you die if you step in the pit.
But! of course, a correct program will never step off into a pit, so ok.
A correct program will never address gaps; if it does, trap to kernel and then core dump. Minor exception: stack, heap can grow. In UNIX, sbrk() increases size of heap segment. For stack, just take fault, system automatically increases size of stack.
Detail: Protection mode in segmentation table entries. For example, code segment would be read-only (only execution and loads are allowed). Data and stack segment would be read-write (stores allowed).
What must be saved/restored on context switch? Typically, segment table stored in CPU, not in memory, because it’s small.
Contents must be saved/restored.

13. Segment start length code 0x4000 0x700 data 0x500 heap - stack 0x2000
0x500
heap -
stack
0x2000
0x1000
2 bit segment #
12 bit offset
Physical Memory
Virtual Memory
main: 240
store #1108, r2
244
store pc+8, r31
248
jump 360
24c …
strlen: 360
loadbyte (r2), r3
420
jump (r31)
x: 1108
a b c \0
x: 108
a b c \0 …
main: 4240
store #1108, r2
4244
store pc+8, r31
4248
jump 360
424c
strlen: 4360
loadbyte (r2),r3
4420
jump (r31)
Initially, pc = 240.
What happens first? Simulate machine, building up physical memory contents as we go.
1. fetch 240? virtual segment #? 0; offset ? Physical address: 4240 from base = offset = Fetch value at Store address of x into r2 (first argument to procedure).
2. fetch 244? virtual segment #? 0; offset ? Physical address: Fetch value at Instruction to Store PC + 8 into r31 (return value).
5. What is PC? (Note PC is untranslated!) = 24c Instruction to execute after return.
6. Fetch 248? Physical address Fetch instruction: jump 360.
7. Fetch 360? Physaddr Fetch instruction: load (r2) into r3. Contents of r2?
8. r2 is used as a pointer. Contents of r2 is a virtual address. Therefore, need to translate it! Seg # ? 1 offset ? Physaddr: Fetch value a. Do remainder of strlen.
9. On return, jump to (r31) -- this holds return PC in *virtual space* c

14. Question
With segmentation, what is saved/restored on a process context switch?
Only the OS gets to change the base and bounds! Clearly, user program can't, or else lose protection.
With base&bounds system, what gets saved/restored on a context switch?
contents of base and bounds register; or maybe even contents of memory

15. UNIX fork and Copy on Write
Makes a complete copy of a process
Segments allow a more efficient implementation
Copy segment table into child
Mark parent and child segments read-only
Start child process; return to parent
If child or parent writes to a segment (ex: stack, heap)
trap into kernel
make a copy of the segment and resume

17. Zero-on-Reference
How much physical memory is needed for the stack or heap?
Only what is currently in use
When program uses memory beyond end of stack
Segmentation fault into OS kernel
Kernel allocates some memory
How much?
Zeros the memory
avoid accidentally leaking information!
Modify segment table
Resume process

18. Segmentation Pros? Cons?
Can share code/data segments between processes
Can protect code segment from being overwritten
Can transparently grow stack/heap as needed
Can detect if need to copy-on-write
Cons?
Complex memory management
Need to find chunk of a particular size
May need to rearrange memory from time to time to make room for new segment or growing segment
External fragmentation: wasted space between chunks

19. Paged Translation Manage memory in fixed size units, or pages
Finding a free page is easy
Bitmap allocation:
Each bit represents one physical page frame
Each process has its own page table
Stored in physical memory
Hardware registers
pointer to page table start
page table length
Simpler, because allows use of a bitmap. What's a bitmap?
Each bit represents one page of physical memory -- 1 means allocated, 0 means unallocated. Lots simpler than base&bounds or segmentation

20. Paged Translation (Abstract)

21. Paged Translation (Implementation)

22. Process View A Physical Memory B C D E 4 F 3 G H 1 I Page Table J K L
Suppose page size is 4 bytes
Where is virtual address 6? 9?

23. Paging Questions
With paging, what is saved/restored on a process context switch?
Pointer to page table, size of page table
Page table itself is in main memory
What if page size is very small?
What if page size is very large?
Internal fragmentation: if we don’t need all of the space inside a fixed size chunk
Means lots of space taken up with page table entries.

24. Paging and Copy on Write
Can we share memory between processes?
Set entries in both page tables to point to same page frames
Need core map of page frames to track which processes are pointing to which page frames (e.g., reference count)
UNIX fork with copy on write
Copy page table of parent into child process
Mark all pages (in new and old page tables) as read-only
Trap into kernel on write (in child or parent)
Copy page
Mark both as writeable
Resume execution

25. Fill On Demand
Can I start running a program before its code is in physical memory?
Set all page table entries to invalid
When a page is referenced for first time, kernel trap
Kernel brings page in from disk
Resume execution
Remaining pages can be transferred in the background while program is running
On windows, the compiler reorganizes where procedures are in the executable, to put the initialization code in a few pages right at the beginning

26. Sparse Address Spaces Might want many separate dynamic segments
Per-processor heaps
Per-thread stacks
Memory-mapped files
Dynamically linked libraries
What if virtual address space is large?
32-bits, 4KB pages => 500K page table entries
64-bits => 4 quadrillion page table entries
Is there a solution that allows simple memory allocation, easy to share memory, and is efficient for sparse address spaces?

27. Multi-level Translation
Tree of translation tables
Paged segmentation
Multi-level page tables
Multi-level paged segmentation
Fixed-size page as lowest level unit of allocation
Efficient memory allocation (compared to segments)
Efficient for sparse addresses (compared to paging)
Efficient disk transfers (fixed size units)
Easier to build translation lookaside buffers
Efficient reverse lookup (from physical -> virtual)
Variable granularity for protection/sharing

28. Paged Segmentation Process memory is segmented Segment table entry:
Pointer to page table
Page table length (# of pages in segment)
Access permissions
Page table entry:
Page frame
Share/protection at either page or segment-level

29. Paged Segmentation (Implementation)

30. Question
With paged segmentation, what must be saved/restored across a process context switch?

31. Multilevel Paging

32. Question
Write pseudo-code for translating a virtual address to a physical address for a system using 3-level paging.

33. x86 Multilevel Paged Segmentation
Global Descriptor Table (segment table)
Pointer to page table for each segment
Segment length
Segment access permissions
Context switch: change global descriptor table register (GDTR, pointer to global descriptor table)
Multilevel page table
4KB pages; each level of page table fits in one page
32-bit: two level page table (per segment)
64-bit: four level page table (per segment)
Omit sub-tree if no valid addresses

34. Multilevel Translation
Pros:
Allocate/fill only page table entries that are in use
Simple memory allocation
Share at segment or page level
Cons:
Space overhead: one pointer per virtual page
Two (or more) lookups per memory reference

35. Portability
Many operating systems keep their own memory translation data structures
List of memory objects (segments)
Virtual page -> physical page frame
Physical page frame -> set of virtual pages
One approach: Inverted page table
Hash from virtual page -> physical page
Space proportional to # of physical pages

36. Efficient Address Translation
Translation lookaside buffer (TLB)
Cache of recent virtual page -> physical page translations
If cache hit, use translation
If cache miss, walk multi-level page table
Cost of translation =
Cost of TLB lookup +
Prob(TLB miss) * cost of page table lookup

37. TLB and Page Table Translation

38. TLB Lookup

39. MIPS Software Loaded TLB
Software defined translation tables
If translation is in TLB, ok
If translation is not in TLB, trap to kernel
Kernel computes translation and loads TLB
Kernel can use whatever data structures it wants
Pros/cons?

40. Question What is the cost of a TLB miss on a modern processor?
Cost of multi-level page table walk
MIPS: plus cost of trap handler entry/exit

41. Hardware Design Principle
The bigger the memory, the slower the memory

42. Intel i7

43. Memory Hierarchy
Anecdote: the system that I used for building my first OS, would fit in today’s 1st level cache
Implication is that TLB miss will be like a first level cache miss – so second level TLB can be pretty big. Even then, second level miss is likely to have a bunch of the page table entries in the 3rd level cache.
i7 has 8MB as shared 3rd level cache; 2nd level cache is per-core

44. Question What is the cost of a first level TLB miss?
Second level TLB lookup
What is the cost of a second level TLB miss?
x86: 2-4 level page table walk
How expensive is a 4-level page table walk on a modern processor?

45. Virtually Addressed vs. Physically Addressed Caches
Too slow to first access TLB to find physical address, then look up address in the cache
Instead, first level cache is virtually addressed
In parallel, access TLB to generate physical address in case of a cache miss

46. Virtually Addressed Caches

47. Physically Addressed Cache
Note that the TLB miss walks the page table in the physical cache, so you may not even need to go to physical memory on a TLB miss

48. When Do TLBs Work/Not Work?
Video Frame Buffer: 32 bits x 1K x 1K = 4MB

49. Superpages On many systems, TLB entry can be
A page
A superpage: a set of contiguous pages
x86: superpage is set of pages in one page table
x86 TLB entries
4KB
2MB
1GB

50. Superpages

51. When Do TLBs Work/Not Work, part 2
What happens when the OS changes the permissions on a page?
For demand paging, copy on write, zero on reference, …
TLB may contain old translation
OS must ask hardware to purge TLB entry
On a multicore: TLB shootdown
OS must ask each CPU to purge TLB entry

52. TLB Shootdown

53. When Do TLBs Work/Not Work, part 3
What happens on a context switch?
Reuse TLB?
Discard TLB?
Solution: Tagged TLB
Each TLB entry has process ID
TLB hit only if process ID matches current process

55. Question
With a virtual cache, what do we need to do on a context switch?
Need to invalidate the cache, or tag the cache with process ID’s
If tagged, and the virtual cache is > page size, means that it is possible to have multiple cache blocks that have different contents

56. Aliasing
Alias: two (or more) virtual cache entries that refer to the same physical memory
A consequence of a tagged virtually addressed cache!
A write to one copy needs to update all copies
Typical solution
Keep both virtual and physical address for each entry in virtually addressed cache
Lookup virtually addressed cache and TLB in parallel
Check if physical address from TLB matches multiple entries, and update/invalidate other copies

57. Multicore and Hyperthreading
Modern CPU has several functional units
Instruction decode
Arithmetic/branch
Floating point
Instruction/data cache
TLB
Multicore: replicate functional units (i7: 4)
Share second/third level cache, second level TLB
Hyperthreading: logical processors that share functional units (i7: 2)
Better functional unit utilization during memory stalls
No difference from the OS/programmer perspective
Except for performance, affinity, …

58. Address Translation Uses
Process isolation
Keep a process from touching anyone else’s memory, or the kernel’s
Efficient interprocess communication
Shared regions of memory between processes
Shared code segments
E.g., common libraries used by many different programs
Program initialization
Start running a program before it is entirely in memory
Dynamic memory allocation
Allocate and initialize stack/heap pages on demand

59. Address Translation (more)
Cache management
Page coloring
Program debugging
Data breakpoints when address is accessed
Zero-copy I/O
Directly from I/O device into/out of user memory
Memory mapped files
Access file data using load/store instructions
Demand-paged virtual memory
Illusion of near-infinite memory, backed by disk or memory on other machines

60. Address Translation (even more)
Checkpointing/restart
Transparently save a copy of a process, without stopping the program while the save happens
Persistent data structures
Implement data structures that can survive system reboots
Process migration
Transparently move processes between machines
Information flow control
Track what data is being shared externally
Distributed shared memory
Illusion of memory that is shared between machines