How to cause a TLB thrashing with a user process?

My current work needs to generate a specified number of TLB misses on CPU of Intel Core series, while it's not going on well. I've tried many methods but all of them have a very high rate of TLB hit. Does anyone know some useful information about how x86 TLB works, or some method to generate large number of TLB misses within a user process开发者_StackOverflow社区?

---

The TLB is a cache used by the CPU to remember the physical address associated with a virtual address. The virtual address space is split into pages, usually 4KB each. The TLB has a space for each possible virtual page which contains the address of the physical page associated with it. A TLB miss occurs when you try to access a page whose physical address has not been loaded yet. Therefore, to maximize misses, you need to maximize the number of different pages accessed.

Unfortunately, it is not that simple. A simple TLB miss would read entries from the page table hierarchy to find the proper physical address. But this only occurs if you access a page which has a physical address. The OS will determine what virtual addresses have what physical addresses, and if you try to read from any others, you will cause a page fault. The page fault handler will either terminate your program for illegally accessing that page or move data around to put a physical page in that virtual address.

The best way to cause as many TLB misses as possible is to:

1. Allocate as much memory as the OS will let you. You should alternate allocating large and small pieces, freeing the small pieces after allocating another large one. This will hopefully maximize fragmentation, spreading your memory out over as many pages as possible.
2. Create a list with one address from every different page used in the memory you allocated. You can also add other pages which you know are readable, such as the pages containing your code.
3. Loop through this list, reading data from each page. As the OS needs to free up physical pages to put in your virtual pages, it will (hopefully) use the physical pages previously associated with other pages in your loop, causing the maximum number of TLB misses.

The number of misses will go up as available RAM gets low, because the OS will have to move more physical pages around to satisfy your program's needs, so it is good to have other, memory hungry processes running at the same time.