iapx Systems Electronic Computers M 1
iapx History We analyze 32 bit systems: generalization to 64 bits is straigtforward Segment Registers (16 bits) Code Segment Stack Segment Data Segment Extra Ssegment FS Data segments GS In iapx systems all (physical) addresses are relative that is they are indicated as offset from a base (a segment register). A consistent piece of software (i.e. a subroutine, an operating system service etc.) is called a segment and contains only relative addresses referred to a common base This means that relocation in a non paged system is very easy (only the base must be changed) This wouldn t be so important in a paged system but it is the base for the protection (see later) because it acts on segments 2
iapx Registers (32 bits) 31 0 IP 31 FLAGS 0 EF Accumulators 31 15 AH 8 7 AX AL 0 EAX BH BX CH CX DH DX SI DI BP SP BL CL DL EBX ECX EDX ESI EDI EBP ESP In the new 64 bit systems more registers (R8, R9 R16) are present Floating Point registers (8 x 80 bit stack). 3
Segments The segmentation is a memory management scheme which reflects the programmer s point of view A program is a segments collection: main program, procedures, functions, objects, local and global variables, stack etc. that is modules with consistent information to be stored in memory in general in non consecutive addresses (at module level) The segmentation allows the relocation and the sharing of data Fragmentation is a possible drawback (external, not that of paging) for instance if paging not implemented or disabled Automatic segment association. Instructions=>CS, Stack=>SS, Data=>DS. Other associations are possible making it explicit in the instruction. BP automatically associated with SS (if no other indication in the instruction mov ax, 40 ; copy word at address of DS mod16 +40 to ax mov ax, ES:40 ; copy word at address of ES mod16 +40 to ax push ax ; push ax into the slot indicated by SP+SS mod16 mov al, 40 ; copy byte at address of DS mod16 +40 to al Mod16 see later It must be noted that although the same instruction code at the assembly language is used (mov) compilers and assemblers translate this code into different machine laguage codes according to the destination register (ax, ah, al, eax etc.) 5
Segments FFFFFFFFF Data Segment(s) DS (ES, FS,GS) X+2 X X-2 Pop Stack Segment Push SP (offset) BP (offset) Word (16 bit) oriented stack SS Stack Segment base address The stack grows normally downwards The BP is mainly used to address the stack segment as a memory data segment Code Segment IP (offset) CS 000000000 6
FLAGS (partial list) 8 10 9 11 7 6 TF DF IF OF SF ZF 4 Trap Direction 2 0 Sign Overflow Int. en. Zero AF PF CF Parity Aux. carry Carry 7
Address construction SEGMENT (0) CS/DS/ES/FS/GS/SS (Mod16) BASE BP/BX (16 bit) INDEX SI/DI (16 bit) (sum module 64K -16 bit)) OFFSET (16 bit) S + [(B + I + O)] 20 bit) 10
Address construction OPCODE MOD DISPL DIRECT EFFECT. ADDR. OPCODE MOD DISPL BASED BX/BP EFFECT. ADDR. OPCODE MOD DISPL INDEXED SI/DI EFFECT. ADDR. 11
Address construction OPCODE MOD DISPL BASED INDEXED SI/DI BX/BP EFFECT. ADDR. OPCODE MOD INDIRECT BX/BP/SI/DI EFFECT. ADDR. 13
iapx Segmentation (32+ bit Systems) Protection and segment access control to check the access rights and the address correctness Multiple environments : each one must be separated and protected from the others (multiple concurrent usersprocesses) Operating systems support 8086 Address Memory iapx86 Address Control Memory 15
Rivisited segmentation If a system access control must implemented a control mechanism is required This is achieved by means of a segment table which for each segment indicates the initial address, the size, its characteristics (valid/invalid, read/write, user/supervisor etc.) pointed by a segment table register. A further register storing the register table size is used for protection (Segment Table Length Register): a segment number k is valid if and only if k<stlr. Each entry is a segment descriptor 16
Segment descriptors Each segment is an «object» which is described by a segment descriptor which defines: The initial address in the address space The segment length The access rights (read, write, execute etc.) The privilege level (security level) which a program must exibit to access the segment (see later) Whether it is a data or code segment or other types of segments The presence in the main memory (significant when the system is not paged) Whether an access to the segment was made (not whether it was written dirty segment) 17
Segment descriptor 31 24 19 16 14 13 11 8 7 0 Base 31:24 Base 15:00 G D B 0 A V Limit 19-16 P P L S Type Limit 15:00 Base 23:16 64 bit 8 bytes Example. Data segment descriptor AV: available for the software BASE: base starting address (32 bit) DB: segment parallelism (16/32 bit operands) PL privilege level (see later) G: granularity (segment size limit - multiple of 1 or 4096 bytes) of the segment 1Byte=>1MB or 4KB=>4GB LIMIT: segment limit ( 20 bit see G bit) P: segment present in memory S: descriptor type (system/user) TYPE: segment type (data/code R/W - Expand down-up) The descriptor fields have different meanings according to the type and other parameters Please notice that no fields are available to determine the «age» of the segment for replacement policies (only the accessed bit can be used) : this is due to the fact that normally the systems are paged More modern descriptors for higher parallelism are slightly different 18
Descriptors 31 24 19 16 14 13 11 8 7 0 Base 31:24 G D B 0 A Limit V 19-16 P P L S Type Base 23:16 Base 15:00 Limit 15:00 P P L S Type Access Right Byte P > Present in memory (code/data) or valid/invalid (for OS segments and gates) PL > Protection level S > = 1 code(data (user) ; = 0 system or gates segments Type > 16 different types (really 32 because the meaning depends on S too) 19
Data descriptors (System ->only by OS usable level 0 see later) S = 1 non system P P L 1 Type Access Right Byte C/D E W A C/D E W A Data/code (0 data). Expand down or upward (stack) Write read only or R/W Accessed 20
Code descriptors S = 1 non system P P L 1 Type Access Right Byte C/D C R A C/D Code/Data (1 Code) C 0/1 Conforming descriptor (see later)) R 0/1 read only or R/W A Accessed 21
Data (C/D=0) Segments Non System C/D E(xp.) W A(ccessed) Descrizione 0 0 0 0 Not yet accessed segment, read only, upward expansion 0 0 0 1 The same but accessed 0 0 1 0 Not yet accessed segment, read/write, upward expansion (normal data segment) 0 0 1 1 The same but accessed 0 1 0 0 Not yet accessed segment, read only, downward expansion (call gate see later) 0 1 0 1 The same but accessed 0 1 1 0 Not yet accessed segment, read/write, downward expansion (normale stack segment) 0 1 1 1 The same but accessed 22
Descriptors tables In the iapx86 systems each segment is found through its descriptor whch can be located in two different tables: GDT (Global Descriptor Table) or LDT (Local Descriptor Table). Typical descriptors of the LDTs are data, segments, code. There are also task descriptors (see later) The CS, SS, DS etc. do not store addresses but selectors (16 bits) which lead to the segment descriptors storing all information of the segment 23
Addressing An address of iapx86 systems is a string of 48 bits (16 bit for the selector contained in thge segment register and 32 bit for the offset) Segment register Limit address Segment 47 SELECTOR 32 31 OFFSET 0 data Access Rights Limit Initial address GDT or LDT segment descriptor Segment initial address The computed address is the linear or virtual address 24
GDT GDT N Index SELECTOR N-1 N-2 CPU Registers LIMIT BASE 4 3 2 1 0 GDTR Global Descriptor Table Register The base address value and the limit of the GDT must be stored by the OS during the initial configuration phase through privileged instructions (see later) Since the index is stored in the first 13 bits of the selector (see later the other bits are for control) the GDT can store up to 8192 8 bytes descriptors (64 Kbytes). The same for each LDT (and IDT see later). GDT is used for system segments 25
LDT LDT N N-1 N-2 LDTR GDT N N-1 N-2 4 3 2 1 0 4 3 2 1 0 There is a LDTR register storing a selector which points to the current LDT descriptor. The LDT is therefore a segment of the GDT. The register can be loded by a privileged instruction. LDT is used for user segments 26
Selectors Segment selector (Segment register content) 15 INDEX 3 2 1 0 T I RPL INDEX: descriptor table index 13 bit -> 8192 selectors TI: Table Identifier (0 =>GDT 1 => LDT) RPL: Privilege level (see protection later) 27
LDT A Local Descriptor Table contains all descriptors of a task (process) defined in the system. In particular the LDTR stores the selector of the LDT of the process presently executed Local Descriptor Table contents: Task code, data and stack The call gates (see later) The task gates which allow to trigger the execution of other tasks Are the addresses of the GDTR and LDTR virtual or physical? And the addresses in the GDT and LDT? All virtual! There must be a GDT and LDT for each task! 28
Aliasing But since all data of the LDT or GDT are segments descriptors how can the OS modify the their contents since there are no specific access instructions? ALIAS Since a segment is a portion of the logical (and therefore physical) memory nothing prevents a double description of the same area with different access rights. N N-1 X K 3 2 1 0 GDT Y X and Y are the same memory area which is however described by two different descriptors i.e. one (X) code and the other (Y) data. The compiler, for instance, when generates the code writes in the segment through descriptor Y (enable write) but when the segment must be executed the OS uses descriptor Y. Obviously the OS must be aware of this aliasing because when X (Y) is deleted from memory or saved in disk all aliased descriptors must be updatesd. For the entire GDT and LDT there is an alias. 29
An example mov ax, 00D0 mov ds, ax mov dl,[3] In iapx86 (i.e. 08086) this means to insert value in DS (starting address 00D00) But in the protected environment (modern processors) 00D0 is a selector 0000 0000 1101 0000 pointing the twentyseventh descriptor (do not forget 0!) of the GDT (11010 B =26 D ) with privilege level 00! If the segment base address in the descriptor is 0000F5D0 the byte at virtual address 0000F5D3 is read (the offset of the instruction is 3)! 30
Descriptors caching The descriptors of all segments pointed by the segment registers are stored in small caches of 8 bytes linked to the segment registers. These caches are loaded when a new selector is loaded into a segment register.. This prevents that for each memory access an access to the descriptor table is needed. 31
Full addressing in iapx86 Displacement selector SS selector GS selector FS selector ES selector DS selector CS Base Register Index Register X DESCRIPTOR REGISTERS Access Rights SS Access Rights GS Limit Access Rights FS Base Address Limit Access Rights ES Base Address Limit Access Rights DS Base Address Limit Access Rights CS Base Address Limit Base Address Limit Base Address + + Scale Offset LINEAR ADDRESS REGISTERS CACHE 32
iapx86 (32 bit) full addressing SELECTOR 15 0 31 0 selector OFFSET Instruction Address Descriptor 31 22 21 12 11 Linear address 0 DIR 20 bit address + 12 bit info TABLE 20 bit address + 12 bit info OFFSET OP. DIR ENTRY P.TBL.ENTRY Physical address 1024 slots CR3 Each task has its own page table loaded for each context change The OS services are started by software interrupts Physical address in CR3 (reloaded for each context switch) 35
Page table descriptors (I level) Page Directory Element (DIR field) 31 12 Initial address 31:12 11 9 8 7 6 5 4 3 2 1 0 P P Avail 0 P 0 A C W U W P S D T Available for software [Page size (4K/4M)] [II level table used] Page cache disable Page write through Supervisor Writable Present Accessible only from Protection Level 0,1,2 The physical address of the first level table is pointed by the system register CR3 In the field 31-12 the physical address of the II level table (aligned 4K!!) is stored PCD e PWT indicate whether the II level table items are cacheable and the used policy (WT or WB). The cacheability and the PWT of the I level table is stored in CR3. 37
Page table descriptors (II level) Page Table Entry (Table fields of the virtual address) Not used 31 12 Page base address 31:12 Avail 0 0 D Available for software Dirty (written) Used Page cache disable Page write through User/Supervisor Writable Present in memory See later 11 9 8 7 6 5 4 3 2 1 0 A P C D P W U W P T Indicate whether the page data are cacheable and their policy (WB or WT). For the protection (see later) first the segment descriptor is checked then the page protection. Very often for the page tables PWT=1: then no write-back problems occur 38
Sharing and protection Process 1 page table Process 2 page table Pointers Flags Bit di controllo Disk addresses Memory 39
I and II level page fault What in case of a page fault? The linear address is saved in CR2 (hardware see later) A software interrupt n. 14 is generated The triggered routine reads CR2 OS call to find a free or replaceable page Disk driver call The new initial address is stored in the II level table IRET which restarts the page-faulted instruction A page fault can occur also if the second level page table is missing 40
Caches and page tables A I or II level table stores data which must be available for the OS and therefore must be possibly cacheable. The use policy can be determined singularly for each level CR3 control register Physical Address 31 12 11 5 4 3 2 0 Page directory base address Reserved 1/0 Data of the 1st level table can be cacheable. P C D P W T Reserv. If cacheable Write Back or Write Trhough The page (pointed by I or II level tables) policies are defined in the page descriptors (previously described) initial address of the 1st level page (1024 elements) (different for each process) is stored in the 20 Msbits (31-12). Different page tables for each process The physical 41
System registers 31 0 RESERVED CR0 CR1 47 15 BASE BASE 0 SELECTOR SELECTOR TR LDTR CR2 CR3 CR4 16 15 0 LIMIT LIMIT GDTR IDTR The system registers load and store are carried out by specific privileged instructions (ex. LTR Load Task Register LGDT Load Global Descriptor Table etc.). For privileges see later. Selectors have the associated shadow registers 42
CR0 31 3029 18 17 16 P G C N D W R A M R W P R 5 4 3 N E R T S 2 1 0 E M 1 P E R Reserved PG Paging enable CD Cache disable CACHE control NW Not writethrough AM Alignment mask (align check) WP Write protect (supervisor is not allowed to write user pages) NE Numeric Error TS task switched (save e restore Floating Point) EM Escape Instruction Trapped PE Protection enabled NB: Paging enable is valid only if PE=1 43
Page Fault CR2 31 0 PAGE FAULT LINEAR ADDRESS 44
CR4 CR4 control register 31 7 6 5 4 3 2 1 0 Reserved Machine check enable (i.e. unaligned data) [Page Size (4K/4M)] Debugging extensions Time stamp disable Protected Mode Virtual Interrupt Virtual 8086 Mode Extensions If paging is disabled virtual and physical addresses coincide iapx86 systems can be segmented only, paged only (defining only one big segment see Linux) and segmented and paged In the new systems bit 7 indicates whether page tables can be shared among many processes. Bit 5 allows 36 bit addressing M C E 0 P S E D E T S D P V I V M E 45