# Inferring TLB Configuration with Performance Tools
## 2 Materials and Methods
### Procedure  
C programs are used to implement the software probes used in this study. For each system under test, we utilize three C programs, each designed to access memory in ways that allow us to infer the configurations of the DTLB, ITLB, and STLB. The first C program, aimed at inferring the DTLB configuration, accepts two key inputs: the number of sets and the number of ways. Using the malloc function, it allocates a region of memory sized according to the formula: REGION_SIZE = PAGESIZE \(\times\) 256 \(\times\) 1024 \(\times\) 1024. This size ensures adequate memory coverage and facilitates effective monitoring of its impact on the TLB. The program iterates through the specified numbers of'sets' and 'ways', and it uses a mapping function to access VAs that map to the same'set' in the TLB. It is also designed to run for a predetermined duration during each execution. The crucial aspect of this DTLB C program is accessing VAs that map to the TLB following (\(S^{\prime}=\) VA mod \(S*\), where \(S^{\prime}\) is the target set, and \(S*\) is the total sets as indicated in [15]). The code's strategy involves setting a stride that, when combined with this linear function, maps to a specific set. As the 'ways' and'sets' numbers increase, we identify points where a minimal increase in ways leads to a rise in events. The implementation of the mapping function is illustrated in Listing 1. ```
1 for(intj=0;j<max_probes;j++){
2 uintptr_taddr=(uintptr_t)memory+((1+j*sets)*PAGE_SIZE);
3 printf(\"Address_Test:0x%1x\(\backslash\)\",addr);
4//Performareadfromeachaddress
5 volatilechardata=*((char*)addr);
6(void)data; }
```  
Listing 1: Xeon DTLB C program. The second C program is designed to infer the configuration of the ITLB. It accepts two inputs: the number of ways and sets. Similar to the first program, it accesses memory linearly. The main distinction, however, lies in how this program populates the allocated memory. Specifically, it fills the memory with NOP (no-operation) instructions, followed by a RET (return) instruction, as shown in Listing 2. This pattern, in combination with the linear mapping and the incrementally increasing number of ways and sets, aids in inferring the ITLB configuration. ```
1//PopulatetheallocatedmemorywithNOPfollowedbyaRET
3 for(size_ti=0;i<allocation_size;i++){
4 exec_memory[i]=0x90;//NOPinstructioninx66
5}
6//AddingARETinstructionattheendofeachpage
7 for(size_ti=0;i<allocation_size;i++PAQE_SIZE){
8 exec_memory[i+PAGE_SIZE-1]=0 xC3;//RETinstructioninx86
9}
```  
Listing 2: Xeon ITLB C program. The third C program is designed to infer the shared TLB. After testing the linear mapping to infer the STLB, and not obtaining an output with a pattern indicating a TLB configuration, a different mapping function was needed. As indicated by [14, 15], if a linear mapping function does not work, then a more complex XOR-N function is used by the system. The XOR-N function basically takes a subset of bits, performs an XOR on them and the result indicates the set. The C program implementation is shown in Listing 3. The piece of code shows how the virtual address is built based on N bits that are XOR.