ENCM 369 Winter 2016 Lab 11 for the Week of April 4

Transcription

1 page 1 of 13 ENCM 369 Winter 2016 Lab 11 for the Week of April 4 Steve Norman Department of Electrical & Computer Engineering University of Calgary April 2016 Lab instructions and other documents for ENCM 369 can be found at 1 This Lab is important, but will not be marked If the usual pattern for ENCM 369 labs were followed, this lab would be due Friday, April 8, That would leave very little time for your TAs to get the lab marked before the last lab periods on April 12 So this lab will not be marked, and solutions will be posted sometime during the week of April 4 Please make a serious effort to solve the Exercises yourself before checking solutions! 2 Exercise A: Analysis of set-associative caches 21 Read This First As explained in lectures, set-associative caches provide a good (but not perfect) solution to the problem of set-bit conflicts in direct-mapped caches The difference between direct-mapped and set-associative structure is illustrated in Figure 1 Just as for a direct-mapped cache, in a set-associative cache an address must be split into parts: tag, set bits, block offset (if there are multi-word blocks), and byte offset The formulas for the widths of these address parts are exactly the same as given for direct-mapped caches in Section?? However, the equations for the capacity of a set-associative cache are slightly different from those for the capacity of a direct-mapped cache If C is capacity in bytes, S is the number of sets, N is the number of ways, and Bpl ( bytes per line ) is the size in bytes of a block, then C = S N Bpl To use a block size given in words instead of bytes: C = S N words per block bytes per word For units to make sense in these equations, it turns that appropriate units for N are blocks per set Here are some example calculations:

2 ENCM 369 Winter 2016 Lab 11 page 2 of 13 Figure 1: Graphical comparison of set-associative caches, direct-mapped caches, and fully-associative caches After reading this caption you should probably use the Rotate Right tool in your PDF reader to view the diagram The term search tag refers to the tag extracted from the address of the instruction or data item the processor core is seeking The diagrams are intended to show conceptual structure, and leave out wires and some important logic elements (eg, multiplexers) Layout in the diagram may or may not reflect actual physical layout within integrated circuits Key to colouring of storage cells status bit(s): 1 valid bit, plus, in the case of a write-back D-cache, 1 dirty bit tag bits block of data or instruction words bits that help with LRU or approximate-lru replacement Note: Relative sizes are not to scale A block might be as large as 64 bytes (512 bits), which is difficult to describe graphically in proportion to a single status bit N-way set-associative cache: Each way is organized like a direct-mapped cache For lookup, the index selects a set, and all N blocks in that set must be checked for a hit N valid-bits are checked all at once; at the same time N tags are compared with the search tag set 0 set 1 set 2 set 3 set S 3 set S 2 set S 1 way 0 way 1 way N 1 = = = set 0 set 1 set 2 set 3 set S 3 set S 2 set S 1 = set bits decoder N comparators for tags work in parallel Direct-mapped cache: Like a 1-way set-associative cache The set bits decide which set is inspected to test for a hit set bits decoder 1 tag comparator for the whole cache Fully-associative cache: Like a set-associative cache with only one set No set bits are required for lookup Instead all tags in the entire cache are checked at the same time Each tag has built-in comparison logic to test for a match with the search tag entry 0 entry 1 entry 2 entry N 2 entry N 1

3 ENCM 369 Winter 2016 Lab 11 page 3 of 13 What is the capacity of the cache of textbook Figure 89? Obtaining all the dimensions we need from Figure 89, C = S N words per block bytes per word = 4 sets 2 blocks set = 32 bytes 1 word block 4 bytes word Suppose we modify the design of the cache of Exercise A of Lab 10, so that it is two-way set-associative instead of direct-mapped, and has four-word blocks instead of one-word blocks The capacity will remain 1024 words, that is 4096 = 2 12 bytes How will addresses be split into parts to access this new design? We need to know S to determine the number of set bits C S = N words per block bytes per word 4 KB = = 2 blocks set 4 words block 4 bytes word bytes bytes/set = 128 sets The number of set bits is log 2 S = log = 7 The word size is 4 bytes, so there is a 2-bit byte offset The block size is 4 words, so the block offset is also 2 bits wide Here is the address split: bit tag set bits bit block offset 2-bit byte offset 22 What to Do Refer to Problem 4 in Exercise B of Lab 10 Do parts (a), (b), and (c) again, with the following assumptions: no change in word size; no change in block size; no changes to the capacities of the caches; L1 D-cache changed to 8-way set-associative; L2 cache changed to 16-way set-associative 3 Exercise B: Virtual and physical addresses of array elements 31 Read This First To understand how virtual memory works, it s useful to think about the common operation of sequentially accessing all of the elements in an array For example, consider this simple C function:

4 ENCM 369 Winter 2016 Lab 11 page 4 of 13 Figure 2: An array of byte ints Addresses must be sequential in virtual address space, but in physical address space, chunks of the array can be within pages that are far away from each other virtual address space address 0x elements 0 to 823 physical address space address 0x elements 824 to 1299 elements 0 to 823 0x x x x x elements 824 to x int sum_array(const int *arr, int n) { int sum = 0, i; for (i = 0; i < n; i++) sum += arr[i]; return sum; } arr should point to element 0 of an array, and n should indicate the number of elements belonging to the array In a system with virtual memory, the pointer argument arr will hold a virtual address Let s suppose sum_array is called with arr pointing to element 0 of an array of 1300 elements, each of which is a 4-byte int, and our virtual memory system uses 32-bit virtual addresses, 32-bit physical addresses, and 4 KB pages Further, let s suppose the virtual address of element 0 of the array is 0x1001_0320 if that s true, the layout of the array in virtual memory must look like the left side of Figure 2 However, there are many, many possible arrangements of the array in physical address space the right side of Figure 2 shows just one possible arrangement If the arguments arr and n and local variables sum and i are all in registers, the only data memory accesses the function will make will be reads of array elements, using virtual addresses 0x1001_0320, 0x1001_0324, and so on, in sequence Because parts of the array are in two different pages, two different VPN-to-PPN translations will be used by the load instructions that read the array element values The first translation is from VPN 0x10010 to PPN 0x33714 and the second translation is from VPN 0x10011 to PPN 0x25588 It s possible that both translations are in the D-TLB when the loop starts, in which case there will be no D-TLB misses at all while the loop runs At most there will be two D-TLB misses one on the access to arr[0], and another on the access to arr[824] (Remember, one of the effects of a TLB miss is copy a translation from a page table to the TLB)

5 ENCM 369 Winter 2016 Lab 11 page 5 of What to do, Part I Consider the scenario outlined in Read This First, but with the address of arr[0] changed to 0x1001_0fb0 Make a diagram similar to Figure 2, showing which array elements sit in which pages Be as detailed as you can There is essentially only one correct answer for the layout in virtual memory But there s a huge number of possible correct answers for the organization in physical memory come up with just one, making sure that it is consistent with the given information What the largest possible number of D-TLB misses as the loop runs? Which array element accesses could possibly cause D-TLB misses? 33 What to do, Part II Consider the same loop, but with a much larger array Suppose that the address of arr[0] is 0x1001_2f00, and that the value of n is 50,000 Determine the total number of pages partly or completely occupied by elements of the array Suppose the D-TLB has a capacity of 32 VPN-to-PPN translations Find the smallest and largest possible numbers of D-TLB misses as the loop runs from beginning to end 4 Exercise C: Integration of VM and caches 41 Read This First This problem asks you to trace some instruction fetches in a computer system that has both virtual memory and caches The computer runs the MIPS instruction set, so all instructions are 32 bits in size Both virtual and physical addresses are 32 bits wide The page size is 4KB There are two TLBs: one for instruction address translations, and one for data address translations The instruction TLB has room for 4 translations There are separate instruction and data caches The instruction cache is directmapped with 4-word blocks, and has a capacity of 256 bytes (The instruction TLB and instruction cache are both unrealistically small in order to make this a viable pencil-and-paper exercise) 42 What to Do Suppose a process attempts to fetch three instructions using the following virtual addresses, in the order given below: 040_0ff8 040_0ffc 040_1010 Suppose that none of the instructions are loads or stores The page table for the process contains the following information: virtual page number valid bit physical page number x900c x900ce x91076

6 ENCM 369 Winter 2016 Lab 11 page 6 of 13 0x x x7ffff 1 0x90fab When the sequence of instruction fetches starts, the following information is in the instruction TLB: virtual page number valid bit physical page number x x900c x x x80000 When the sequence of instruction fetches starts, the following information is in the instruction cache (along with 256 bytes of instructions): set bits valid bit tag 1 0x900c4f 0x1 1 0x900ce0 0x2 1 0x900ce0 0x3 1 0x900c4f 0x4 1 0x900c4f 0x5 1 0x900c4f 0x x x x xa 1 0x xb 1 0x xc 1 0x900c4f 0xd 1 0x900c4f 0xe 1 0x900c4f 0xf 1 0x For each of the three instruction fetches, answer the following questions: Is it a TLB hit or a TLB miss? Or is it not possible to tell with the given information? If it is a TLB miss, does the miss cause a page fault? Is it a cache hit or a cache miss? Or is it not possible to tell with the given information? Also, answer this: Why is it helpful to know that none of the instructions being fetched are loads or stores? 5 Exercise D: Why TLB miss handling must be fast 51 Read This First In programs with good spatial locality of reference, TLB misses will be relatively rare, and handling these misses will not add significantly to running time of the program However, certain important algorithms necessarily have bad spatial locality An example is binary search, which can very quickly find a number in a very large

7 ENCM 369 Winter 2016 Lab 11 page 7 of 13 sorted array of numbers (You do not have to know what binary search is or how it works to do this exercise) This exercise is designed to help you understand the importance of speed in a TLB miss handler in a case where there are frequent TLB misses 52 What to do Here is MIPS assembly language for a key loop within a procedure that performs a version of binary search: L1: srl $t1, $t0, 1 and $t9, $t1, $t8 lw $t3, ($t9) slt $t4, $a0, $t3 movn $a2, $t9, $t4 movz $a1, $t9, $t4 addiu $t5, $a1, 4 sltu $t6, $t5, $a2 bne $t6, $zero, L1 addu $t0, $a1, $a2 Note that it is coded for a true MIPS system with branch delays, so when the branch is taken, the sequence of instructions is bne, then addu, and then srl Question 1 Assume that the code is run on a MIPS processor that uses a simple pipeline that will normally start one instruction per clock cycle In the given loop, if there are no cache misses, one-cycle stalls will be needed only so that the slt instruction can use the lw result, and the the bne instruction can use the sltu result If there are no cache misses or TLB misses, how many clock cycles will it take to run through the loop 20 times? Question 2 To search a particular array of 1 million ints, the loop does in fact run 20 times, and the sequence of virtual data addresses used by the lw instruction is: 0x , 0x102fc6c0, 0x102825a0, 0x , 0x10226cc8, 0x102360ec, 0x1023dafc, 0x10239df4, 0x10237f70, 0x c, 0x c, 0x10236c5c, 0x10236e44, 0x10236f38, 0x10236fb0, 0x10236fec, 0x10236fcc, 0x10236fbc, 0x10236fc4, 0x10236fc8 The VPN for this system is bits of a virtual address Assume that when the loop runs, none of the needed VPN-to-PPN translations for data are in the data TLB, but all of the needed data pages are in physical memory Assume also (very unrealistically) that there are no D-cache misses as a result of any of the loads Finally, assume there are no misses in the instruction TLB or instruction cache If it takes 10 clock cycles to handle a miss in the data TLB, how many clock cycles in total does TLB miss handling add to the answer to Question 1? (This will require some analysis of the sequence of addresses used by the load instruction) Revise your answer, assuming now that it takes 100 cycles to handle a miss in the data TLB Would you say it doesn t matter much whether the TLB miss handler takes 10 or 100 cycles, or would you say that that it has a significant impact on the running time of the loop?

8 ENCM 369 Winter 2016 Lab 11 page 8 of Extra note This problem asks you to think about TLB misses in code that makes data memory accesses with poor spatial locality However, it is important to know that in most real-world cases of bad spatial locality cache misses will tend to cause more performance degradation than TLB misses 6 Exercise E: Page table organization 61 Read This First This exercise is designed to help you understand what a page table is, and what some of the design considerations are in choosing how to organize a page table The details about page table entries (PTEs) and page table organization are a blend of details taken from Section 84 of your textbook, address space and page table management in 32-bit x86 Linux, and 32-bit MIPS TLB miss handling So, put together, the details don t match any real computer system, past or current, but are realistic enough to give some insight about how virtual memory works on real computers We are considering a system with 32-bit virtual addresses, 32-bit physical addresses, and 4KB pages so, as seen in textbook and lecture examples, VPNs (virtual page numbers) and PPNs (physical page numbers) will both be 20 bits wide Our system will use one 32-bit memory word for each PTE: Alloc Valid Dirty Ref 20-bit PPN field The Valid, Ref, and Dirty bits play the same roles as exactly the V-bit described in textbook section 842, and the U-bit and D-bit described in textbook section 845 The purpose of the Alloc bit is to indicate whether or not a virtual page exists at all for a given VPN If a VPN is used to look up a PTE, and that PTE has Alloc=1 and Valid=1, that means the corresponding virtual page is in physical memory with the PPN given within the PTE If that PTE has Alloc=1 and Valid=0, the corresponding virtual page is on disk But if the PTE has Alloc=0, that means there is no virtual page for the given VPN Bits in our PTE format could be used for more status bits, such as writeaccess (does the process have permission to write to the page, or only to read?) or execute-permission (which would indicate whether a process is allowed to fetch instructions from the page) The simplest way to organize a page table is to simply make it a flat table, in other words, just a big array of PTEs, with one PTE for each possible VPN The VPN would be used simply as an array index to find a PTE Let s assume that the range of possible VPNs for a user process runs from 0000 to 0xbffff, which happens to be the range of allowable VPNs for user processes in current 32-bit x86 Linux systems Figure 3 shows an example of such a flat page table for a process with three pages of instructions starting at virtual address 040_0000, two pages of static data starting at virtual address 0x1001_0000, and three pages of stack starting at virtual address 0xbfff_d000 Notice that there are lots of PTEs filled with 0 bits in each of these PTEs bit 23, the Alloc bit, is zero So most of the page table is filled with information that indicates the nonexistence of many, many virtual pages! Let s suppose our computer uses the MIPS instruction set Then in assembly language the TLB miss handler would look something like the code shown in Figure 4

9 ENCM 369 Winter 2016 Lab 11 page 9 of 13 Figure 3: Flat page table PTEs are 32-bit words; in the diagram each nonzero PTE is shown split into a 12-bit status-bit field and a 20-bit PPN field Index 0xbffff 0xbfffe 0xbfffd 0xbfffc 0x x x x1000f ff e 0f 0f 08 0f 0d 0d 0d 0x81f23 0x x x x x86aba 0x9a9a0 0x92777

10 ENCM 369 Winter 2016 Lab 11 page 10 of 13 Figure 4: Sketch of TLB miss handler code for the page table organization of Figure 3 A few special memory management instructions to copy the VPN into $k0 and the base address of the page table into $k1 sll $k0, $k0, 2 # $k0 = VPN * 4 addu $k1, $k1, $k0 # $k1 = address of PTE lw $k1, ($k1) # $k1 = PTE srl $k0, $k0, 2 # restore VPN in $k0 A few more special memory management instructions to inspect the page status bits within the PTE in $k1 and make a quick decision The quick decision made in the second group of special memory management instructions is: If Alloc=1 and Valid=1, quickly update a TLB with information from $k0 and $k1, and restart a user process on whatever instruction caused the TLB miss If Alloc=1 but Valid=0, jump to kernel code to handle a page fault (in other words, get the kernel started on the disk operation needed to get the desired virtual page into physical memory) If Alloc=0, jump to kernel code to deal with an attempted illegal memory access by a user process Note that the MIPS register use conventions prohibit user processes from using GPRs $k0 and $k1 This rule is in place to help optimize TLB miss handlers for speed a miss handler can use those two registers without first saving them to memory to preserve data belonging to a user process Here is an example of how one of the all-zero PTEs in Figure 3 could be used Suppose our computer runs a Linux-like operating system A novice programmer writes a program for it in MIPS assembly language When the program runs as a user process, suppose it happens to be given virtual memory exactly corresponding to the page table shown in Figure 3 Suppose the program contains the instruction lw $t1, ($t0) Unfortunately the program is defective, and when the load instruction is reached, the address in $t0 is 0x1001_2468, which isn t in the set of virtual addresses the program is allowed to use What happens, in detail, is as follows: The VPN of 0x10012 is generated from 0x1001_2468 There is a miss in the data TLB (Make sure you understand why there cannot possibly be a hit!) The TLB miss handler software uses the VPN as an index in the page table, which produces an all-zero PTE in $k1 Because the Alloc bit in the PTE is zero, the TLB miss handler decides that the process has tried to make an illegal memory access, and shuts down the process Our novice programmer is left to figure out why the program died with a segmentation fault error message

11 ENCM 369 Winter 2016 Lab 11 page 11 of What to Do, Part 1 Review the Read This First information, then answer the following questions: For the process whose page table is shown in Figure 3, is the data word at virtual address 0x1001_1400 on disk or in physical memory? If it is in physical memory, what is the physical address for the word? Repeat the previous question, but use 0xbfff_dffc as the virtual address What is the combined size, in KB, of all the instruction, static data, and stack pages in use by the process of Figure 3? What is the size, in KB, of the page table shown in Figure 3? 63 Read This Second I hope you concluded from the last two answers you found in What to Do, Part 1, that the page table was unreasonably huge compared to how much memory was needed for the actual instructions and data of the process This example illustrates the fact that a flat page table is not a practical solution in the case of 32-bit addresses and 4 KB pages In Linux on x86 systems, addresses really are 32 bits wide and pages really are 4 KB in size Page table organization is close to what is shown in Figure 5 on page 12 (I am omitting some complicated details, so I can t say the organization is exactly as shown in the figure) Instead of one huge page table for each process, there are a number of medium-size page tables Part of the VPN is used to find a pointer within an array of pointers; this array of pointers is called a page directory If a valid (non-null) pointer is found in the page directory, that pointer is assumed to point at the base of the page table where the needed PTE is located Details about which bits of the VPN are used for what purposes are given in the caption to Figure 5 64 What to Do, Part 2 Answer the following questions: For the process with the page table information shown in Figure 5, describe how a TLB miss handler would determine that 0x10012 is not a legal VPN For the process whose page table is shown in Figure 5, is the instruction word at virtual address 040_2820 on disk or in physical memory? If it is in physical memory, what is the physical address for the word? Repeat the previous question, but consider the data word at virtual address 0x1001_1454 What is the combined size, in KB, of all the instruction, static data, and stack pages in use by the process of Figure 5? What is the combined size, in KB, of the page directory and the page tables shown in Figure 5? Does this seem reasonable compared to the size of the page table in Figure 3? Consider the TLB miss assembly language code of Figure 4 Replace the sll, addu, lw, and srl instructions with a sequence suitable for searching the page table organization of Figure 5 Pretend that in addition to $k0 and $k1, one more GPR called $k2 is available to hold intermediate results (Hint: Your sequence should be about 8 10 instructions in length, and should include two lw instructions)

12 ENCM 369 Winter 2016 Lab 11 page 12 of 13 Figure 5: Two-level page table structure PTEs have exactly the same format as in Figure 3 Bits of a virtual address (so, bits of the VPN for that virtual address) are used as an index into the page directory array If a non-null pointer is found in the page directory, that pointer is used as the base address of a 1024-word page table, and bits of the virtual address (so, bits 9 0 of the VPN for that virtual address) are used as an index into that page table (Note: Translations for the process of this figure are not the same as translations for the process with the page table of Figure 3) Page table 0e 0x e 0x84dfe 0f 0x91f01 Index 0x3ff 0x3fe 0x3fd 00 Index 0x2ff 0x2fe f Page directory Page table 0d 0f 0x88a62 0x9000e Index 0x3ff f Page table 0d 0x81fff 08 0x d 0x8a8a5 Index 0x3ff

13 ENCM 369 Winter 2016 Lab 11 page 13 of More notes about page table organization Real 32-bit MIPS systems use an efficient but somewhat hard-to-explain system for page tables that is not a two-level organization 32-bit x86 systems have a two-level page table organization much like what is presented in this exercise, but routine TLB miss handling is not done by kernel software instead special hardware is dedicated to fast searches for PTEs within page tables (However, if there is a miss in the page table after a miss in a TLB, then kernel software will have to manage the problem)