MMU (Translation of virtual addresses to physical addresses)

MMU (Memory Management Unit) is a hardware unit of the processor that converts program virtual addresses into real memory addresses. It isolates processes, preventing them from interfering with each other’s data, and creates the illusion of a contiguous address space even with physical RAM fragmentation.

The memory management unit is an integral part of all modern processor systems: from server CPUs and desktop chips to high-end embedded controllers. It is critically necessary in operating systems with virtual memory (Windows, Linux, macOS) for separating process address spaces. Without an MMU, hardware memory protection in smartphones and the operation of modern browsers where each tab is an isolated process would be impossible.

The most frequent failure is a Page Fault, when a program accesses an address not present in physical memory, causing costly disk paging. Speculative execution attacks (Meltdown) are considered a serious vulnerability, exploiting MMU delays to read protected kernel data. Page table fragmentation errors and access violation exceptions (Segmentation Fault) also occur when attempting to write to memory regions marked as read-only.

How MMU works

MMU operation is based on the mechanism of paged memory organization, which replaced outdated segmented addressing that operated with blocks of arbitrary size. In modern systems, virtual and physical address spaces are divided into equal fixed-size blocks (usually 4 KB). When the processor issues a virtual address, the MMU splits it into a virtual page number and an offset. The key component here is the Translation Lookaside Buffer (TLB) — an ultra-fast cache memory storing recent address mappings. If the required address is found in the TLB (hit), translation occurs instantly. On a miss, the MMU initiates a page table walk procedure — a multi-level hierarchical structure in RAM, where entries contain physical page frame numbers and access permission flags. Unlike the simple direct mapping of old systems, the multi-level scheme saves memory for service structures but increases latency: for the x86_64 architecture, up to four RAM accesses are required to translate a single address.

The hardware table walker fetches the entry, checks presence and protection bits. If the page is swapped out to storage, an exception is generated, and the operating system loads data from disk into a free physical frame, updating the table. After that, the TLB is filled with a new entry, and the faulting instruction is restarted. This complex process is completely hidden from the user application, which works with linear virtual memory as if it were real, unaware of the complex mechanics of background eviction and data defragmentation.

MMU functionality

1. Translation of virtual addresses to physical addresses. The central task of the MMU is converting the virtual address generated by the processor core into a physical address on the memory bus. The translation process occurs in hardware based on page tables located in RAM, ensuring complete isolation of address spaces of different processes.
2. Hardware support for page tables. To accelerate navigation through multi-level structures (e.g., PGD, PUD, PMD, PTE), the MMU integrates specialized state machines. The hardware Walker automatically traverses these structures in memory, calculating the physical address of the requested page without CPU intervention, minimizing OS kernel overhead.
3. Translation Lookaside Buffer (TLB). The Translation Lookaside Buffer is a high-speed cache memory inside the MMU that stores recently performed virtual-to-physical page number mappings. The TLB avoids a full page table walk on every access by searching for matches across all entries in parallel within a single cycle.
4. Page access rights management. In addition to translation, the MMU checks the permission bits from the page table entry. The hardware verifies the correspondence of the current privilege level (User/Supervisor) to the read, write, or execute operation. On a rights violation, a page fault exception is instantly raised, transferring control to the OS handler.
5. Support for segmented memory organization. In architectures like x86 in compatibility mode, the MMU preliminarily converts a logical address into a linear address via segment registers and descriptor tables. Hardware checking of segment bounds and rights is performed before the page translation procedure, imposing additional validity conditions on the address.
6. TLB miss resolution mechanisms. On a TLB miss, if the hardware Walker is not supported by the architecture, the MMU generates an exception, and responsibility for table walking is shifted to the OS software handler. The hardware refill mechanism automatically fetches the entry, replacing the least recently used entry according to the eviction policy (LRU or Random).
7. Invalidation of translation caches. On task context switch or kernel modification of page table entries, forced flushing of TLB buffers is required. The MMU executes instructions like INVLPG or IPI broadcast signals to synchronize the states of all cores, ensuring that stale virtual-to-physical mappings are not used speculatively.
8. Support for various page sizes. Modern MMUs handle not only base 4 KB pages but also large ones (2 MB, 1 GB). Using huge pages reduces the depth of table walking, decreases TLB pressure and translation cache fragmentation, which is critically important for applications with gigantic working data sets.
9. Memory descriptors and caching attributes. The MMU extracts from the PTE attributes that control caching policy (Write-Back, Write-Through, Uncached). The hardware immediately translates these bits into system bus protocols, determining data placement in L1/L2/L3 caches and the write-back strategy for peripheral devices.
10. Access exception generation. Besides permission violations, the MMU registers attempts to access invalid pages and writes to clean regions when tracking dirty bits. Hardware setting of Accessed and Dirty bits in the PTE is done atomically, allowing the OS to implement page eviction algorithms and copy-on-write forks without data races.
11. Access domains and Address Space Identifiers (ASID). To reduce the frequency of full TLB invalidation on process switching, the MMU binds each entry to a unique process identifier. The hardware comparator checks the ASID of the current context against the TLB entry tag, allowing translations of several isolated tasks to simultaneously reside.
12. Second-level hardware memory virtualization. In the presence of a hypervisor, the MMU implements two-stage address translation: guest virtual to guest physical, then to host physical. Nested table walking (EPT/NPT) eliminates the need to support shadow page tables, radically reducing the number of VM-Exit transitions to the hypervisor.
13. NPT (Second-level address translation for virtualization)EPT (Hardware second-level memory address translation)
14. Execution disable protection (Exec-Disable). The MMU implements the NX bit in the page hierarchy, prohibiting instruction fetch from memory regions intended for data. Hardware execution blocking at the translation stage effectively prevents buffer overflow attacks without parasitic CPU time costs.
15. DMA coherence management. IOMMU, as a functional extension of MMU, translates virtual addresses used by direct memory access controllers into physical ones. This isolates peripherals in their own domains and blocks incorrect bus transactions that attempt to access beyond the permitted buffer.
16. IOMMU (Isolation of direct memory access addresses)
17. Demand paging. The MMU serves as a detector for the demand paging mechanism. On the first touch of a virtual region not loaded into RAM, the hardware generates a page absence exception. The OS handler loads data from disk and resumes the instruction, creating the illusion of continuous memory of arbitrary size.
18. Binding to nucleation architecture. In multi-cluster NUMA systems, the MMU can be distributed but logically unified. Address translation may result in pointing to a local or remote memory controller. The MMU hardware logic integrates with the interconnect for invisible routing of the request to the required RAM bank.
19. Tagged memory and security extensions. The MMU of modern architectures participates in Memory Tagging Extension checking. During address translation, the upper bits of the pointer are compared with the tag stored in shadow memory. A hardware mismatch triggers a synchronous exception, deterministically blocking use-after-free and out-of-bounds vulnerabilities.
20. Support for heterogeneous memory architectures. The MMU encodes the physical memory type in page attributes, managing data placement in high-speed HBM memory or standard DDR. Hardware distinction of address thermal characteristics allows the OS scheduler to transparently migrate pages without rewriting application code.
21. HBM (3D stacked memory with silicon vias)
22. Translation tracing and profiling. Built-in MMU performance monitoring units provide event counters: number of TLB misses, table walk cache hits, and bus wait duration. This statistics allows developers to detect buffer thrashing patterns and restructure data to improve reference locality.
23. Atomic operations on descriptors. To implement fast futex locks, the MMU interacts with the Load-Link/Store-Conditional mechanism. The hardware tracks attempts to modify a physical cell between reading and writing on the bus, canceling the conditional store and guaranteeing consistency of lock-free algorithms at the user level.

Comparisons

• MMU vs MPU (Memory Protection Unit). The MMU translates virtual addresses to physical ones, creating the illusion of a contiguous address space for each process. The MPU, on the contrary, works only with physical addresses, providing access separation without conversion. Consequently, the MPU is deterministic and suitable for real-time systems, while the MMU is indispensable for full-fledged multitasking and page swapping in general-purpose operating systems.
• MMU vs TLB (Translation Lookaside Buffer). The TLB is an integral hierarchical part of the modern MMU, not a separate function. It is a hardware content-addressable memory cache storing recently used page table entries to accelerate address translation. Without a TLB, each memory access would require multiple transactions to read tables, making virtual memory practically unworkable due to colossal delays.
• MMU vs IOMMU (Input/Output Memory Management Unit). A regular MMU manages memory access from the central processor, translating task virtual addresses. The IOMMU performs a similar function but for direct memory access from peripheral devices, translating device virtual addresses to physical ones. This prevents memory corruption by incorrect DMA requests and allows virtualizing addresses for hardware accelerators, isolating them in their own domains.
• MMU vs Segment Addressing (x86 Real Mode). The segment addressing mechanism calculates a linear address using the formula base plus offset, providing code portability but without creating an isolated address space. The MMU uses paged organization, where the address is formed by merging the virtual page number and offset. Unlike variable-size segments, pages have a fixed size, which eliminates external fragmentation and simplifies memory management at the kernel level.
• MMU vs Software Memory Manager Emulation. A hardware MMU performs address translation in parallel with the instruction pipeline, with negligible overhead. Software emulation requires intercepting every memory access and simulating it, which increases latency by orders of magnitude. Consequently, without hardware page walk support, the virtual memory mechanism is not used in high-performance systems, remaining only in narrowly specialized software sandboxes and historical projects.

OS support

The MMU implements virtual memory through page tables, where each entry (PTE) contains flags for presence, access rights, and caching. The operating system, when creating a process, allocates a page directory, writing its physical address to the CR3 register (x86) or TTBR0 (ARM), and on context switch, the kernel updates this register, causing a hardware TLB flush. Drivers interact with the MMU through the kernel API for mapping device buffers to user space via functions like mmap and io_remap_pfn_range, while for DMA operations, the driver must use coherent or streaming mappings with explicit cache line management through architecture-dependent clean and invalidation instructions.

Security

Address space isolation is realized by the MMU hardware comparing the Address Space Identifier (ASID) and not allowing one process to reference the physical pages of another unless there is an explicit shared entry in the tables. The NX (No eXecute) flag in the PTE separates memory into code and data segments, preventing shellcode execution in the stack or heap, while the SMEP/SMAP mechanism (on x86) additionally prohibits the kernel from executing instructions or accessing data located in user space, blocking ret2usr attacks. Tagged memory technology (MTE) adds a 4-bit tag to the upper bits of the pointer and checks it against the tag of the physical memory cell on each load/store operation, detecting use-after-free and buffer overflows at the hardware level.

Logging and debugging

On a page fault occurrence, the MMU hardware saves in special registers (CR2 on x86, FAR on ARM) the virtual address that caused the error and the fault reason in the error code, where bits indicate the violation type: page absence, write permission violation, execution in a non-executable region, or an attempt to access kernel memory from user mode. The page fault handler in the kernel analyzes these registers and logs the incident in the system log through event tracing mechanisms (ftrace, eBPF), saving the register context and process memory map to a core dump on critical failures. For performance profiling, CPU performance counters track TLB miss and data cache miss events, allowing the developer via perf to detect false cache-line sharing patterns and optimize the layout of structures in memory.

Limitations

The fixed page size (mostly 4 KB) generates internal fragmentation when allocating small objects and requires multi-level tables, where a four- or five-level hierarchy on modern processors increases page walk overhead on a TLB miss to four to five accesses to physical memory. TLB capacity is physically limited to a few thousand entries for L1 and L2, which, when the application working set exceeds the covered volume, causes a wave of misses and complete translation reconstruction, while hardware tables (HPT in PowerPC) require software-managed search and eviction of entries from the hash table under hypervisor control. Additional latency is introduced when using large pages (2 MB, 1 GB), as they require a contiguous physical memory area and strict alignments, which complicates the buddy system allocator’s work and causes memory defragmentation managed by the background compaction process.

History and development

Early MMUs in minicomputers (PDP-11) and Motorola 68030 processors used segmented or primitive page translation with a single table, while Intel 80386 introduced a hierarchical two-level model, enabling full virtual memory with page swapping in personal systems. The transition to 64-bit architectures led to the introduction of three-level (AMD64), then four- and five-level tables (Intel with LA57 extension) to cover the huge virtual address space while maintaining structure compactness with sparse filling. Modern developments include hardware support for two-stage address translation (EPT/NPT) for virtualization, where the hypervisor manages the translation of guest physical address to real physical address, as well as integration of MMU into chiplet architecture with distributed TLBs and coherent fabrics minimizing inter-node addressing delays.