Virtual Memory Topics n n n Motivations for

Virtual Memory Topics n n n Motivations for VM Address translation Accelerating translation with TLBs

Motivations for Virtual Memory Use Physical DRAM as a Cache for the Disk n n Address space of a process can exceed physical memory size Sum of address spaces of multiple processes can exceed physical memory Simplify Memory Management n Multiple processes resident in main memory. l Each process with its own address space n Only “active” code and data is actually in memory l Allocate more memory to process as needed. Provide Protection n One process can’t interfere with another. l because they operate in different address spaces. n User process cannot access privileged information l different sections of address spaces have different permissions. – 2–

DRAM a “Cache” for Disk Full address space is quite large: n n 32 -bit addresses: ~4, 000, 000 (4 billion) bytes 64 -bit addresses: ~16, 000, 000 (16 quintillion) bytes Disk storage is ~300 X cheaper than DRAM storage n n 80 GB of DRAM: ~ $33, 000 80 GB of disk: ~ $110 To access large amounts of data in a cost-effective manner, the bulk of the data must be stored on disk 1 GB: ~$200 80 GB: ~$110 4 MB: ~$500 SRAM – 3– DRAM Disk

Levels in Memory Hierarchy cache CPU regs Register size: speed: $/Mbyte: line size: 32 B 1 ns 8 B 8 B C a c h e 32 B Cache 32 KB-4 MB 2 ns $125/MB 32 B larger, slower, cheaper – 4– virtual memory Memory 1024 MB 30 ns $0. 20/MB 4 KB disk Disk Memory 100 GB 8 ms $0. 001/MB

DRAM vs. SRAM as a “Cache” DRAM vs. disk is more extreme than SRAM vs. DRAM n Access latencies: l DRAM ~10 X slower than SRAM l Disk ~100, 000 X slower than DRAM n Importance of exploiting spatial locality: l First byte is ~100, 000 X slower than successive bytes on disk » vs. ~4 X improvement for page-mode vs. regular accesses to DRAM n Bottom line: l Design decisions made for DRAM caches driven by enormous cost of misses SRAM – 5– DRAM Disk

Impact of Properties on Design If DRAM was to be organized similar to an SRAM cache, how would we set the following design parameters? n Line size? l Large, since disk better at transferring large blocks n Associativity? l High, to mimimize miss rate n Write through or write back? l Write back, since can’t afford to perform small writes to disk What would the impact of these choices be on: n miss rate l Extremely low. << 1% n hit time l Must match cache/DRAM performance n miss latency l Very high. ~20 ms n tag storage overhead l Low, relative to block size – 6–

Locating an Object in a “Cache” SRAM Cache n n Tag stored with cache line Maps from cache block to memory blocks l From cached to uncached form l Save a few bits by only storing tag n n No tag for block not in cache Hardware retrieves information l can quickly match against multiple tags Object Name X = X? Tag Data 0: D 243 1: X • • • J 17 • • • 105 N-1: – 7– “Cache”

Locating an Object in “Cache” DRAM Cache n n Each allocated page of virtual memory has entry in page table Mapping from virtual pages to physical pages l From uncached form to cached form n Page table entry even if page not in memory l Specifies disk address l Only way to indicate where to find page n OS retrieves information Page Table “Cache” Location Data Object Name D: 0 0: 243 X J: On Disk 1: 17 • • • 105 X: – 8– • • • 1 N-1:

A System with Physical Memory Only Examples: n most Cray machines, early PCs, nearly all embedded systems, etc. Memory Physical Addresses 0: 1: CPU N-1: n – 9– Addresses generated by the CPU correspond directly to bytes in physical memory

A System with Virtual Memory Examples: n workstations, servers, modern PCs, etc. Virtual Addresses 0: 1: Page Table 0: 1: Memory Physical Addresses CPU P-1: N-1: Disk n Address Translation: Hardware converts virtual addresses to physical addresses via OS-managed lookup table (page table) – 10 –

Page Faults (like “Cache Misses”) What if an object is on disk rather than in memory? n n Page table entry indicates virtual address not in memory OS exception handler invoked to move data from disk into memory l current process suspends, others can resume l OS has full control over placement, etc. Before fault Page Table Virtual Physical Addresses CPU Memory Page Table Virtual Addresses Physical Addresses CPU Disk – 11 – After fault Memory Disk

Servicing a Page Fault Processor Signals Controller n Read block of length P starting at disk address X and store starting at memory address Y Read Occurs n n Direct Memory Access (DMA) Under control of I/O controller I / O Controller Signals Completion n n – 12 – Interrupt processor OS resumes suspended process (1) Initiate Block Read Processor Reg (3) Read Done Cache Memory-I/O bus (2) DMA Transfer Memory I/O controller disk Disk

Memory Management Multiple processes can reside in physical memory. How do we resolve address conflicts? n what if two processes access something at the same address? kernel virtual memory stack %esp Memory mapped region forshared libraries Linux/x 86 process memory image – 13 – memory invisible to user code runtime heap (via malloc) 0 uninitialized data (. bss) initialized data (. data) program text (. text) forbidden the “brk” ptr

Separate Virt. Addr. Spaces n Virtual and physical address spaces divided into equal-sized blocks l blocks are called “pages” (both virtual and physical) n Each process has its own virtual address space l operating system controls how virtual pages as assigned to physical memory 0 Virtual Address Space for Process 1: Address Translation 0 VP 1 VP 2 PP 2 . . . N-1 PP 7 Virtual Address Space for Process 2: – 14 – Physical Address Space (DRAM) 0 VP 1 VP 2 PP 10 . . . N-1 M-1 (e. g. , read/only library code)

Contrast: Macintosh Memory Model MAC OS 1– 9 n Does not use traditional virtual memory Shared Address Space P 1 Pointer Table Process P 1 A B “Handles” P 2 Pointer Table C Process P 2 D E All program objects accessed through “handles” n n – 15 – Indirect reference through pointer table Objects stored in shared global address space

Macintosh Memory Management Allocation / Deallocation n Similar to free-list management of malloc/free Compaction n Can move any object and just update the (unique) pointer in pointer table P 1 Pointer Table Shared Address Space B Process P 1 A “Handles” P 2 Pointer Table C Process P 2 D – 16 – E

Mac vs. VM-Based Memory Allocating, deallocating, and moving memory: n can be accomplished by both techniques Block sizes: n Mac: variable-sized l may be very small or very large n VM: fixed-size l size is equal to one page (4 KB on x 86 Linux systems) Allocating contiguous chunks of memory: n n Mac: contiguous allocation is required VM: can map contiguous range of virtual addresses to disjoint ranges of physical addresses Protection n – 17 – Mac: “wild write” by one process can corrupt another’s data

MAC OS X “Modern” Operating System n n Virtual memory with protection Preemptive multitasking l Other versions of MAC OS require processes to voluntarily relinquish control Based on MACH OS n – 18 – Developed at CMU in late 1980’s

Motivation #3: Protection Page table entry contains access rights information n hardware enforces this protection (trap into OS if violation occurs) Page Tables Read? Write? VP 0: Yes No Process i: VP 1: Yes VP 2: No • • • – 19 – Physical Addr PP 9 Yes PP 4 No XXXXXXX • • • Read? Write? VP 0: Yes Process j: Memory • • • Physical Addr PP 6 VP 1: Yes No PP 9 VP 2: No XXXXXXX No • • • 0: 1: • • • N-1:

VM Address Translation Virtual Address Space n V = {0, 1, …, N– 1} Physical Address Space n n P = {0, 1, …, M– 1} M < N Address Translation n n MAP: V P U { } For virtual address a: l MAP(a) = a’ if data at virtual address a at physical address a’ in P l MAP(a) = if data at virtual address a not in physical memory » Either invalid or stored on disk – 20 –

VM Address Translation: Hit Processor a virtual address – 21 – Hardware Addr Trans Mechanism Main Memory a' part of the physical address on-chip memory mgmt unit (MMU)

VM Address Translation: Miss page fault handler Processor a virtual address – 22 – Hardware Addr Trans Mechanism Main Memory Secondary memory a' part of the physical address on-chip memory mgmt unit (MMU) OS performs this transfer (only if miss)

VM Address Translation Parameters n n n P = 2 p = page size (bytes). N = 2 n = Virtual address limit M = 2 m = Physical address limit n– 1 p p– 1 virtual page number 0 virtual address page offset address translation m– 1 p p– 1 physical page number page offset 0 physical address Page offset bits don’t change as a result of translation – 23 –

Page Tables Virtual Page Number Memory resident page table (physical page Valid or disk address) 1 1 0 1 0 1 – 24 – Physical Memory Disk Storage (swap file or regular file system file)

Address Translation via Page Table page table base register VPN acts as table index if valid=0 then page not in memory virtual address n– 1 p p– 1 virtual page number (VPN) page offset valid access physical page number (PPN) m– 1 p p– 1 physical page number (PPN) page offset physical address – 25 – 0 0

Page Table Operation Translation n Separate (set of) page table(s) per process n VPN forms index into page table (points to a page table entry) – 26 –

Page Table Operation Computing Physical Address n Page Table Entry (PTE) provides information about page l if (valid bit = 1) then the page is in memory. » Use physical page number (PPN) to construct address l if (valid bit = 0) then the page is on disk » Page fault – 27 –

Page Table Operation Checking Protection n Access rights field indicate allowable access l e. g. , read-only, read-write, execute-only l typically support multiple protection modes (e. g. , kernel vs. user) n – 28 – Protection violation fault if user doesn’t have necessary permission

Integrating VM and Cache VA CPU miss PA Translation Cache Main Memory hit data Most Caches “Physically Addressed” n n Accessed by physical addresses Allows multiple processes to have blocks in cache at same time Allows multiple processes to share pages Cache doesn’t need to be concerned with protection issues l Access rights checked as part of address translation Perform Address Translation Before Cache Lookup n n – 29 – But this could involve a memory access itself (of the PTE) Of course, page table entries can also become cached

Speeding up Translation with a TLB “Translation Lookaside Buffer” (TLB) n n n Small hardware cache in MMU Maps virtual page numbers to physical page numbers Contains complete page table entries for small number of pages hit PA VA CPU TLB Lookup miss Cache hit Translation data – 30 – Main Memory

Address Translation with a TLB n– 1 p p– 1 0 virtual page number page offset valid . virtual address tag physical page number . TLB . = TLB hit physical address tag index valid tag byte offset data Cache = cache hit – 31 – data

Simple Memory System Example Addressing n n n 14 -bit virtual addresses 12 -bit physical address Page size = 64 bytes 13 12 11 10 9 8 7 6 5 4 VPN – 32 – 10 2 1 0 VPO (Virtual Page Offset) (Virtual Page Number) 11 3 9 8 7 6 5 4 3 2 1 PPN PPO (Physical Page Number) (Physical Page Offset) 0

Simple Memory System Page Table n – 33 – Only show first 16 entries VPN PPN Valid 00 28 1 08 13 1 01 – 0 09 17 1 02 33 1 0 A 09 1 03 02 1 0 B – 0 04 – 0 0 C – 0 05 16 1 0 D 2 D 1 06 – 0 0 E 11 1 07 – 0 0 F 0 D 1

Simple Memory System TLB n n 16 entries 4 -way associative TLBT 13 12 11 10 TLBI 9 8 7 6 5 4 3 VPN 2 1 0 VPO Set Tag PPN Valid 0 03 – 0 09 0 D 1 00 – 0 07 02 1 1 03 2 D 1 02 – 0 04 – 0 0 A – 0 2 02 – 0 08 – 0 06 – 0 03 – 0 3 07 – 0 03 0 D 1 0 A 34 1 02 – 0 – 34 –

Simple Memory System Cache n n n 16 lines 4 -byte line size Direct mapped CI CT 11 10 9 8 7 6 5 4 PPN CO 3 2 1 0 PPO Idx Tag Valid B 0 B 1 B 2 B 3 0 19 1 99 11 23 11 8 24 1 3 A 00 51 89 1 15 0 – – 9 2 D 0 – – 2 1 B 1 00 02 04 08 A 2 D 1 93 15 DA 3 B 3 36 0 – – B 0 B 0 – – 4 32 1 43 6 D 8 F 09 C 12 0 – – 5 0 D 1 36 72 F 0 1 D D 16 1 04 96 34 15 6 31 0 – – E 13 1 83 77 1 B D 3 7 – 35 – 16 1 11 C 2 DF 03 F 14 0 – –

Address Translation Example #1 Virtual Address 0 x 03 D 4 TLBT 13 12 11 10 TLBI 9 8 7 6 5 4 3 VPN ___ Fault? __ Physical Address 10 TLBT ____ – 36 – CI___ 0 TLB Hit? __ CI CT 9 8 7 6 5 4 Page CO 3 PPN Offset ___ 1 VPO TLBI ___ PPN: ____ 11 2 CT ____ Hit? __ Byte: ____ 2 PPO 1 0

Address Translation Example #2 Virtual Address 0 x 0 B 8 F TLBT 13 12 11 10 TLBI 9 8 7 6 5 4 3 VPN ___ Fault? __ Physical Address 10 TLBT ____ – 37 – CI___ 0 TLB Hit? __ CI CT 9 8 7 6 5 4 Page CO 3 PPN Offset ___ 1 VPO TLBI ___ PPN: ____ 11 2 CT ____ Hit? __ Byte: ____ 2 PPO 1 0

Address Translation Example #3 Virtual Address 0 x 0040 TLBT 13 12 11 10 TLBI 9 8 7 6 5 4 3 VPN ___ Fault? __ Physical Address 10 TLBT ____ – 38 – CI___ 0 TLB Hit? __ CI CT 9 8 7 6 5 4 Page CO 3 PPN Offset ___ 1 VPO TLBI ___ PPN: ____ 11 2 CT ____ Hit? __ Byte: ____ 2 PPO 1 0

Multi-Level Page Tables Level 2 Tables Given: n n n 4 KB (212) page size 32 -bit address space 4 -byte PTE Problem: n Would need a 4 MB page table! Level 1 Table l 220 *4 bytes Common solution n n multi-level page tables e. g. , 2 -level table (P 6) l Level 1 table: 1024 entries, each of which points to a Level 2 page table. l Level 2 table: 1024 entries, each of which points to a page – 39 – . . .

Main Themes Programmer’s View n Large “flat” address space l Can allocate large blocks of contiguous addresses n Processor “owns” machine l Has private address space l Unaffected by behavior of other processes System View n User virtual address space created by mapping to set of pages l Need not be contiguous l Allocated dynamically l Enforce protection during address translation n OS manages many processes simultaneously l Continually switching among processes l Especially when one must wait for resource » E. g. , disk I/O to handle page fault – 40 –

Intel P 6 Internal Designation for Successor to Pentium n Which had internal designation P 5 Fundamentally Different from Pentium n n Out-of-order, superscalar operation Designed to handle server applications l Requires high performance memory system Resulting Processors n n Pentium. Pro (1996) Pentium II (1997) l Incorporated MMX instructions » special instructions for parallel processing l L 2 cache on same chip n Pentium III (1999) l Incorporated Streaming SIMD Extensions » More instructions for parallel processing – 41 –

P 6 Memory System 32 bit address space 4 KB page size L 1, L 2, and TLBs DRAM n external system bus (e. g. PCI) inst TLB n n L 2 cache instruction fetch unit L 1 i-cache n inst TLB data TLB L 1 d-cache n – 42 – 64 entries 16 sets L 1 i-cache and d-cache n n n 16 KB 32 B line size 128 sets L 2 cache n processor package 32 entries 8 sets data TLB cache bus interface unit 4 -way set associative n unified 128 KB -- 2 MB

Linux Organizes VM as Collection of “Areas” process virtual memory task_struct mm vm_area_struct mm_struct pgd mmap vm_end vm_start vm_prot vm_flags vm_next n pgd: l page directory address n vm_prot: l read/write permissions for this area n vm_flags l shared with other processes or private to this process – 43 – vm_end vm_start vm_prot vm_flags shared libraries 0 x 40000000 data 0 x 0804 a 020 vm_next text vm_end vm_start vm_prot vm_flags vm_next 0 x 08048000 0

Linux Page Fault Handling Is the VA legal? process virtual memory vm_area_struct n vm_end vm_start r/o n shared libraries vm_next 1 read vm_end vm_start r/w 3 read data vm_next vm_end vm_start r/o 2 n n i. e. , can the process read/write this area? if not then signal protection violation (e. g. , (2)) If OK, handle fault n vm_next 0 – 44 – Is the operation legal? write text i. e. is it in an area defined by a vm_area_struct? if not then signal segmentation violation (e. g. (1)) e. g. , (3)

Memory Mapping Creation of new VM area done via “memory mapping” n n create new vm_area_struct and page tables for area can be backed by (i. e. , get its initial values from) : l regular file on disk (e. g. , an executable object file) » initial page bytes come from a section of a file l nothing (e. g. , bss) » initial page bytes are zeros n dirty pages are swapped back and forth between a special swap file. Key point: no virtual pages are copied into physical memory until they are referenced! n n – 45 – known as “demand paging” crucial for time and space efficiency

User-Level Memory Mapping void *mmap(void *start, int len, int prot, int flags, int fd, int offset) n map len bytes starting at offset of the file specified by file description fd, preferably at address start (usually 0 for don’t care). l prot: MAP_READ, MAP_WRITE l flags: MAP_PRIVATE, MAP_SHARED n n return a pointer to the mapped area. Example: fast file copy l useful for applications like Web servers that need to quickly copy files. l mmap allows file transfers without copying into user space. – 46 –

mmap() Example: Fast File Copy #include #include <unistd. h> <sys/mman. h> <sys/types. h> <sys/stat. h> <fcntl. h> int main() { struct stat; int i, fd, size; char *bufp; /* open the file & get its size*/ fd = open(". /mmap. c", O_RDONLY); fstat(fd, &stat); size = stat. st_size; /* * mmap. c - a program that uses mmap * to copy itself to stdout */ /* map the file to a new VM area */ bufp = mmap(0, size, PROT_READ, MAP_PRIVATE, fd, 0); /* write the VM area to stdout */ write(1, bufp, size); } – 47 –

Exec() Revisited To run a new program p in the current process using exec(): process-specific data structures (page tables, task and mm structs) n physical memory same for each process kernel code/data/stack 0 xc 0 %esp stack Memory mapped region for shared libraries n kernel VM demand-zero process VM brk – 48 – 0 shared libs. l text and data backed by ELF executable object file. l bss and stack initialized to zero. n set PC to entry point in. text l Linux will swap in code and runtime heap (via malloc) uninitialized data (. bss) initialized data (. data) program text (. text) forbidden l stack, bss, data, text, . data. text libc. so free vm_area_struct’s and page tables for old areas. create new vm_area_struct’s and page tables for new areas. demand-zero. data. text p data pages as needed.

Fork() Revisited To create a new process using fork(): n make copies of the old process’s mm_struct, vm_area_struct’s, and page tables. l at this point the two processes are sharing all of their pages. l How to get separate spaces without copying all the virtual pages from one space to another? » “copy on write” technique. n copy-on-write l make pages of writeable areas read-only l flag vm_area_struct’s for these areas as private “copy-on- write”. l writes by either process to these pages will cause page faults. » fault handler recognizes copy-on-write, makes a copy of the page, and restores write permissions. n Net result: l copies are deferred until absolutely necessary (i. e. , when one of the processes tries to modify a shared page). – 49 –

Memory System Summary Virtual Memory n Supports many OS-related functions l Process creation » Initial » Forking children l Task switching l Protection n Combination of hardware & software implementation l Software management of tables, allocations l Hardware access of tables l Hardware caching of table entries (TLB) – 50 –