Virtual Memory Management with Paging and TLB
Virtual memory lets each process use its own large virtual address space while the OS maps those virtual addresses onto a smaller physical memory of frames. The mapping is done using paging: virtual memory is partitioned into fixed-size pages, and physical memory into fixed-size frames. Address translation is accelerated with a TLB (Translation Lookaside Buffer), which caches recent translations so the CPU avoids repeatedly consulting the page tables. If a translation is missing in the TLB or the page is not present, the system performs a page table walk and may raise a page fault that the OS resolves by loading the required page. 3
A typical translation pipeline for a load/store instruction is:
- CPU splits the virtual address into
(VPN, offset)whereVPNindexes a page-table entry (PTE) andoffsetselects a byte within the page. - CPU looks up
(PID/address-space tag, VPN)in the TLB. -
- TLB hit: CPU uses the cached
(physical page number, permissions)to form the physical address. - TLB miss: CPU performs a page-table walk starting from a base register (e.g.,
CR3on x86-64) to find the PTE forVPN, checks validity/permissions, then inserts the translation into the TLB for future reuse. 2
- TLB hit: CPU uses the cached
-
- If the PTE indicates the page is not present, the CPU triggers a page fault exception.
- The OS’s page-fault handler locates the page (e.g., from disk or swap), allocates a free frame (or evicts one using a replacement policy), updates the PTE (valid/present bit, frame number), and resumes the faulting instruction.
Key ideas:
- Paging: ensures contiguous virtual regions need not be contiguous in RAM.
- TLB: reduces page-table walks for repeated accesses.
- Page table walk: can be multi-level (common on modern CPUs).
- Page fault: OS loads the page and updates metadata.
Footnotes
-
Memory management unit (MMU) - Overview of MMU and virtual-to-physical address translation concepts. ↩ ↩2
-
Translation lookaside buffer - How TLB caches translations and why it improves performance. ↩ ↩2 ↩3
-
Paging - Basics of paging, pages/frames, and page tables. ↩ ↩2 ↩3
-
Page fault - What page faults are and how systems handle them by bringing pages into RAM. ↩ ↩2
Virtual Memory & Paging (TLB, Page Table Walk, Page Faults) - Educational Overview
Virtual address translation with paging + TLB (step-by-step)
Assume the virtual address is split into:
VPN(virtual page number)offsetwithin the page (size = page size, e.g., 4 KiB)
The CPU ultimately needs the mapping:
VPN -> PFN(physical frame number), plus permission checks.
A page table entry (PTE) typically contains:
- a present/valid bit (whether the page is in RAM)
- a frame number (PFN) if present
- permission bits (read/write/execute/user) used to enforce access rules
- possibly accessed/dirty bits used by the OS for tracking and replacement policy.
When the translation is cached in the TLB, the CPU can directly construct:
PhysicalAddress = PFN || offset
When it is not, the CPU uses the page table(s) in memory to find the PTE, checks validity/permissions, then installs the result into the TLB (subject to replacement/eviction policies in the TLB hardware). 2
Footnotes
-
Page fault - What page faults are and how systems handle them by bringing pages into RAM. ↩
-
Translation lookaside buffer - How TLB caches translations and why it improves performance. ↩
Paging address translation and TLB behavior
- 1Step 1
Split the virtual address into VPN and offset according to the system’s page size.
- 2Step 2
Search the TLB for an entry matching the current address space tag (e.g., ASID/PCID) and the VPN.
- 3Step 3
If found, obtain the PFN and permissions; check permissions, then build the physical address using the offset.
- 4Step 4
Fetch the relevant PTE(s) from memory to obtain PFN and permissions; then insert the translation into the TLB.
- 5Step 5
If the PTE’s valid/present bit is false, the CPU raises a page-fault exception to the OS.
- 6Step 6
The OS allocates a frame (or evicts one), loads the page contents, updates PTE state, and resumes the instruction.
- 7Step 7
On resume, the translation should succeed (TLB may be updated now or on the next access).
Suitable numerical example (4 KiB pages, single-level presentation)
Let’s use a simple (educational) layout with 4 KiB pages:
- Page size = bytes
- Offset bits = 12 bits
- Suppose virtual addresses are 32-bit for the example.
We choose:
- Virtual address =
0x0040_1234 - Split into:
- offset = lower 12 bits =
0x234 - VPN = upper bits =
0x0040_1234 >> 12 = 0x00401
- offset = lower 12 bits =
Now consider the translation process:
Case A: TLB hit
- TLB contains an entry:
(VPN=0x00401) -> (PFN=0x00ABC, perms=read/write, valid=1) - Physical address =
(PFN || offset)- PFN corresponds to frame base:
PFN << 12 = 0x00ABC << 12 = 0x00ABC000 - Add offset:
0x00ABC000 + 0x234 = 0x00ABC234
- PFN corresponds to frame base:
Case B: TLB miss, page table walk
- TLB does not have VPN=0x00401.
- CPU performs page-table walk, reads PTE for VPN=0x00401.
- If PTE is valid and gives PFN=0x00ABC, the CPU constructs
0x00ABC234and inserts(VPN=0x00401 -> PFN=0x00ABC)into the TLB.
Case C: TLB miss + page fault
- TLB miss occurs again.
- Page-table walk finds PTE but
present=0(page not in RAM). - CPU raises a page-fault exception; OS loads page contents from backing store (or allocates a zero page for first-touch memory like BSS).
- OS updates PTE to
present=1and sets PFN to a newly allocated frame. - After the OS resumes the program, the translation can now complete, producing a physical address of the form
(newPFN << 12) + offset.
The general construction always follows:
And the only part that changes between hits/misses is how quickly the CPU finds PFN (TLB cache vs. page-table walk). 2
Footnotes
-
Page fault - What page faults are and how systems handle them by bringing pages into RAM. ↩
-
Translation lookaside buffer - How TLB caches translations and why it improves performance. ↩
Why TLB matters
TLB hits avoid memory reads for page tables; TLB misses require page-table walk(s), which typically adds latency and consumes memory bandwidth.
Footnotes
-
Translation lookaside buffer - How TLB caches translations and why it improves performance. ↩
TLB + address-space changes
When the CPU switches to a different process, the meaning of VPNs changes. TLB entries must be tagged by address-space identifiers (ASIDs/PCIDs) or flushed; otherwise, stale translations can break isolation. 2
Footnotes
-
Translation lookaside buffer - How TLB caches translations and why it improves performance. ↩
Visualizing page tables and the TLB cache
A useful mental model:
- The page table is the authoritative mapping for each process.
- The TLB is a performance cache of a subset of page-table entries.
Latency cost intuition: TLB hit vs. page-table walk vs. page fault
Illustrative comparison (not measured values): relative cost increases from hit to miss to fault.
End-to-end lifecycle for a not-present page
CPU references a virtual address
AccessCPU extracts VPN and probes the TLB."
CPU walks page tables
TLB missPTE lookup finds the page not present."
Page fault is raised
ExceptionCPU transfers control to OS page-fault handler."
OS brings page into RAM
Load & mapAllocates frame, loads content, updates PTE valid bit + PFN."
Instruction restarts
ResumeTranslation now succeeds; TLB may be populated."
Common edge cases and details
Knowledge Check
On a TLB hit, which part of the virtual address still must be used to form the physical address?