IA32 Paging Scheme

1
IA32 Paging Scheme

• Introduction to the Pentiums support for
  virtual memory

2
Two-Level Translation Scheme
PAGE TABLES
PAGE DIRECTORY
PAGE FRAMES
CR3
3
Format of a Page-Table entry
31
12 11 10 9 8 7 6 5 4 3 2 1 0
PAGE-FRAME BASE ADDRESS
P
W
U
P W T
P C D
A
D
0
0
AVAIL
LEGEND P Present (1yes, 0no) W Writable
(1 yes, 0 no) U User (1 yes, 0 no)
A Accessed (1 yes, 0 no) D Dirty (1
yes, 0 no)
PWT Page Write-Through (1yes, 0 no) PCD
Page Cache-Disable (1 yes, 0 no)
4
Format of a Page-Directory entry
31
12 11 10 9 8 7 6 5 4 3 2 1 0
PAGE-TABLE BASE ADDRESS
P
W
U
P W T
P C D
A
0
P S
0
AVAIL
LEGEND P Present (1yes, 0no) W Writable
(1 yes, 0 no) U User (1 yes, 0 no)
A Accessed (1 yes, 0 no)
PS Page-Size (04KB, 1 4MB)
PWT Page Write-Through (1yes, 0 no) PCD
Page Cache-Disable (1 yes, 0 no)
5
Why page-faults happen

• Trying to access a virtual memory-address
• Instruction-operand / instruction-address
• Read-data/write-data, or fetch-instruction
• Maybe page is not present
• Maybe page is not readable
• Maybe page is not writable
• Maybe page is not visible

6
Page-fault examples

• movl eax, (ebx) writable?
• movl (ebx), eax readable?
• jmp ahead present?
• Everything depends on the entries in the current
  page-directory and page-tables,
• and on the cpus Current Privilege Level

7
Current Privilege Level (CPL)
Layout of segment-register contents
(16 bits)
0
1
2
3
15
segment-selector
RPL
T I
TI Table-Indicator
RPLRequested Privilege Level
CPL is determined by the value of RPL field in CS
and SS
8
What does the CPU do?

• Whenever the cpu detects a page-fault, its
• action depends on Current Privilege Level
• If CPL 0 (executing in kernel mode)
• 1) push EFLAGS register
• 2) push CS register
• 3) push EIP register
• 4) push error-code
• 5) jump to page-fault service-routine

9
Alternative action in user-mode

• If CPL 3 (executing in user mode)
• the CPU will switch to its kernel-mode stack
• 0) push SS and ESP
• 1) push EFLAGS
• 2) push CS
• 3) push EIP
• 4) push error-code
• 5) jump to the page-fault service-routine

10
Stack Frame Layout (32bit)
SS
points to the old stacks top
ESP
EFLAGS
CS
points to the faulting instruction
EIP
Error Code
SSESP the new stacks top
When the fault exception uses a 32-bit
Interrupt-Gate (or Trap-Gate)
11
Page-Fault Error-Code
0
1
2
unused
U/S
R/W
P
P Present (1Protection fault,
0Not-present fault) R/W Readable/Writable
(1Write fault, 0Read fault) U/S
User/Supervisor (1User fault, 0Supervisor fault)
CR2 virtual address which caused the page-fault
12
How CPU finds new stack

• Special CPU segment-register TR
• TR is the Task Register
• TR holds selector for a GDT descriptor
• Descriptor is for a Task State Segment
• So TR points indirectly to current TSS
• TSS stores address of kernel-mode stack

13
Stack-switching mechanism
user code
CS
EIP
user stack
INTERRUPT DESCRIPTOR TABLE
SS
ESP
user-space
kernel-space
kernel code
Gate descriptor
IDTR
GLOBAL DESCRIPTOR TABLE
kernel stack
SS0
ESP0
TSS descriptor
TR
TASK STATE SEGMENT
GDTR