Shulou(Shulou.com)06/03 Report--

This article focuses on "how to use PAE paging mode". Interested friends may wish to have a look at it. The method introduced in this paper is simple, fast and practical. Now let the editor take you to learn how to use PAE paging mode.

Preface

Physical address extension Physical Address Extension (abbreviated PAE).

Explanation: normally, 32-bit CPU can access 4G physical memory, but in reality, the development of memory is faster than that of CPU, so there is a need for 32-bit CPU to access more than 4G memory. The implementation is to add 4 address lines to the CPU, up to 36, so that 64 gigabytes of memory can be addressed.

Intel has designed four paging modes so far, which are 32-bit, PAE, 4-level and 5-level. This paper mainly talks about how Intel designs the page table-related data structure of PAE schema.

The part "Chapter 4 Paging" is the translation note made by the author when reading the Intel manual, corresponding to the Volume3: Chapter 4 Paging of the original text. If there are inaccuracies in the translation, the original text shall prevail. You can download the manual here. Intel ®64 and IA-32 Architectures Software Developer Manuals

The "Experimental questions" section implements a gadget that can browse the process page table, where you can view the source code. Github source code

Chapter 4 Paging

4.1 paging mode and control bits

Registers related to paging control

CR0 marker bits: WP (bit 16), PG (bit 31)

CR4 markers: PSE (bit 4), PAE (bit 5), PGE (bit 7), PCIDE (bit 17), SMEP (bit 20), SMAP (bit 21), PKE (bit 22), CET (bit 23), PKS (bit 24)

IA32_EFER MSR marker bits: LEM (bit 8), NXE (bit 11)

EFLAGS symbol bit: AC (bit 18)

How the software enables paging: make sure that the CR3 is the physical memory address of the paging structure table, and then use the MOV instruction to set the CR0.PG bit.

4.1.1 four paging modes

This section determines whether paging is enabled and what paging mode is enabled according to CR0.PG, CR4.PAE, CR4.LA57 and IA32_EFER.LME.

CR0.PG = 0 indicates that paging mode is not enabled, and the linear address is used directly as a physical address.

CR0.PG = 1 means that paging mode is enabled. Paging can be enabled only if protection is enabled (CR0.PE = 1). At this point, CR4.PAE, CR4.LA57, and IA32_EFER.LME decide which paging mode is enabled.

32-bit paging mode CR4.PAE = 0 (see Section 4.3 for details)

PAE paging mode CR4.PAE = 1 and IA32_EFER.LME = 0 (see Section 4.4 for details)

4-level paging mode CR4.PAE = 1, IA32_EFER.LME = 1, and CR4.LA57 = 0 (4 indicates that the 4-layer table is looking for the Pages page, see Section 4.5 for details)

5-level paging mode CR4.PAE = 1, IA32_EFER.LME = 1, and CR4.LA57 = 1 (5 means the 5-tier table is looking for the Pages page, see Section 4.5 for details)

32-bit and PAG modes are used for protected mode 32-bit mode, IA32_EFER.LME = 0

4-level and 5-level modes are used for 64-bit mode (IA-32e stands for 64-bit mode), IA32_EFER.LME = 1

The difference between the four modes:

Linear address width

Physical address width

Page size: 4K, 2m, 4m, 1G

Support for execute-disable, data execution protection

PCIDs is supported, and the operating system can enable the function of caching linear addresses. If you don't understand very well, release it first.

Support protection keys, I don't know what to do

The 4-level and 5-level modes also have two submodes:

Compatibility mode: compatible 32-bit mode

64-bit mode: although it is a 64-bit linear address, 4-level actually uses only a low 48-bit linear address, while a 5-level page uses only a low 57-bit, with only 52 physical address lines.

4.1.2 enable and toggle paging mode

This section: how to enable and switch different paging modes based on CR0.PG, CR4.PAE, CR4.LA57, and IA32_EFER.LME

Explain the rules of switching between different modes, this part is not interested, skip.

4.1.3 paging property control

This section: control the properties of Pages in different paging modes through CR0.WP, CR4.PSE, CR4.PGE, CR4.PCIDE, CR4.SMEP, CR4.SMAP, CR4.PKE, CR4.CET, CR4.PKS and IA32_EFER.NXE

CR0.WP

Write data protection flag bits:

Equal to 0, supervisor-mode (should refer to a 0-ring application) can write data to a page with read-only attributes; if equal to 1, it cannot be operated.

This flag bit has no effect on User-mode, because as long as it is a page with read-only properties, the 3-ring program cannot be written.

(more details in section 4.6)

CR4.PSE

Whether 4m paging is enabled:

Only works on 32-bit paging mode, equal to 0, indicating that the page size can only be 4K; equal to 1, you can choose 4K or 4m pages. The paging size of the other three modes is free to choose and is not controlled by this bit. (more details in Section 4.3)

CR4.PGE

Whether to enable global shared pages:

Equal to 0, physical memory is not shared between different processes; equal to 1, physical memory can be shared between processes. (maybe the translation is wrong, paste it in the original)

CR4.PGE enables global pages. If CR4.PGE = 0, no translations are shared across address spaces; if CR4.PGE = 1

Specified translations may be shared across address spaces. (more details in section 4.10.2.4)

CR4.PCIDE

Enables process-context identifiers to work on 4-level and 5-level modes.

The PCIDs logical processor caches multiple linear addresses. (more details in section 4.10.1)

CR4.SMEP

If CR4.SMEP = 1, software operating in supervisor mode cannot fetch instructions from linear addresses that are accessible in user mode. (more details in Section 4.6)

CR4.SMAP

If CR4.SMAP = 1, software operating in supervisor mode cannot access data at linear addresses that are accessible in user mode. Software can override this protection by setting EFLAGS.AC.

CR4.PKE and CR4.PKS

The 4-level and 5-level modes associate each linear address with the protection key.

When CR4.PKE=1, the PKRU register indicates whether the protection key associated with the linear address of the user-mode is readable or writable.

When CR4.PKS=1, the IA32_PKRS MSR does the same for supervisor-mode linear addresses.

CR4.CET

This is hard to understand.

If CR4.CET = 1, certain memory accesses are identified as shadow-stack accesses and certain linear addresses translate to

Shadow-stack pages.

IA32_EFER.NXE

Perform protection on 4-level and 5-level modes. If set to 1, the instruction cannot be executed, but the instruction can be read.

4.1.4 Enumeration of Paging Features by CPUID

This part protects the meaning and usage of the flag bit.

PSE: page-size extensions for 32-bit paging.

PAE: physical-address extension.

PGE: global-page support.

PAT: page-attribute table.

PSE-36: page-size extensions with 40-bit physical-address extension.

PCID: process-context identifiers.

SMEP: supervisor-mode execution prevention.

SMAP: supervisor-mode access prevention.

PKU: protection keys for user-mode pages.

OSPKE: enabling of protection keys for user-mode pages.

CET: control-flow enforcement technology.

LA57: 57-bit linear addresses and 5-level paging.

PKS: protection keys for supervisor-mode pages.

NX: execute disable.

Page1GB: 1-GByte pages.

LM: IA-32e mode support.

CPUID.80000008H:EAX [7:0] reports the physical-address width supported by the processor.

CPUID.80000008H:EAX [15:8] reports the linear-address width supported by the processor.

4.2 Overview of hierarchical page table structure

Different modes use different page table structures, some with only two tables, and some with more.

The size of each table is 4096 bytes, for 32-bit mode, each item is 4 bytes, for a total of 1024 items; for the other three modes, each item is 8 bytes, each table 512 items. The PAE schema is a special case, with only four items in its first table.

Linear addresses are handled differently in different modes, which will be discussed in more detail.

Two nouns are proposed here: the part of a page frame linear address used for addressing, and the part of a page offset linear address used as an offset.

The address part of each item is the physical memory address.

The first table is always saved in the CR3 register.

Four modes of parsing linear addresses (4K paging examples):

32-bit mode: 32:22 (10 digits) Table 1 subscript, 21:12 (10 digits) Table 2 subscript, 11:0 (12 digits) is used as the offset within the page.

PAE mode: 31:30 (2 digits) Table 1 subscript, 29:21 (9 digits) Table 2 subscript, 20:12 (9 digits) Table 3 subscript, 11:0 (12 bits) offset within the page.

4-level mode: each table has 512 items, for a total of 4 tables, so 47:39, 38:30, 29:21, 20:12 corresponds to the subscript of the 4 tables, and the offset in the 11:0 (12-bit) page.

5-level mode: use 5 tables, 56:48 is the first table subscript, the rest of the root 4-level mode is the same.

Summarize the above parsing linear address process, in fact, is to look up the table, look up the table, and then look up the table. In some cases, the table lookup process may be interrupted, such as when a page fault exception is encountered.

There are also two special cases:

In the process of looking up the table, the width of the remaining unresolved linear address exceeds 12 bits. If the attribute bit bit 7 (PS bit-page size) of the current table item is equal to 1, the current item is the last page.

In the process of looking up the table, the width of the remaining unresolved linear address is equal to 12 bits, bit 7 is no longer the PS bit, and the current item points to another table.

Give an example of the first case mentioned above:

32-bit mode, if the paging size is 4m (CR4.PSE=1), then Table 1 is the stored page, a total of 1024 items, 1024*4M=4G, exactly addressing 4G space, Table 2 does not exist. For example, in PAE mode, if the paging size is 2m, the page will be found when the second table is found, and there is no table 3.

Different table structures have names, refer to the following figure:

For the above abbreviations, we usually have the following name:

PTE page table, each item is the final Pages physical address, 32-bit paging size is 4K, 2m, 4m, 64-bit can be expanded to 1G size

PDE page catalog table, each item stored is PTE

PDPTE page directory pointer table, PAE mode has only 4 items, 4-level and 5-level modes are filled with 512 items, each item points to a page catalog table.

PML4E and PML5E do not know for the time being. In fact, the usage is similar, each adding a layer of table.

4.4 PAE paging mode

Register flag bit:

CR0.PG = 1

CR4.PAE = 1

IA32_EFER.LME = 0

4.4.1 PDPTE register

CR3 points to the page-directory-pointer table. Where:

4:0 is useless

31:5 the physical address where the pointer table is stored

63:52 is useless

The page-dirctory-pointer table consists of four 8-byte PDPTEs, each addressable 1-GByte-sized linear address space.

Corresponding to these four PDPTE, the logic processor maintains four corresponding non-architectural registers, which are PDPTE0, PDPTE1, PDPTE2 and PDPTE3. The logical processor reloads the PDPTEs in memory to four registers when the following occurs:

If the flag bits in these registers are modified using MOV to CR0 or MOV to CR4 instructions (CR0.CD, CR0.NW, CR0.PG, CR4.PAE, CR4.PGE, CR4.PSE, or CR4.SMEP), PDPTESs will reload from the address executed in CR3

In PAE paging mode, if the MOV to CR3 instruction is executed, PDPTESs will reload from the address executed in CR3

In PAE paging mode, if the value in CR3 is modified by task switch, PDPTEs is loaded from the new CR3

The structure of PDPTE is described in the following table:

Bit use

0 (P) Present, equal to 1, indicates that this item points to a page catalog table, and equals 0 does not include a page catalog table.

Reserved bit at 2:1, must fill in 0

3 (PWT) Page-level write-through, which is used to indirectly determine the memory attributes required to access the page catalog table (see Section 4.9 for details)

4 (PCD) Page-level cache disable, which is used to indirectly determine the memory attributes required to access the page catalog table (see Section 4.9 for details)

Reserved bit at 8:5, must fill in 0

Ignore at 11:9

(Mmur1): 12 points to the 4K-aligned physical address of the page catalog table

63Rom reserved bit, must be 0

Note: M stands for MAXPHYADDR, the maximum physical address width, and there are 52 address lines in this manual.

4.4.2 Linear address to physical address

In PAE mode, you can use 4K or 2m paging.

How to determine whether it is 4K or 2m pages:

31:30 (2 bits) of the linear address is used to select one of the four PDPTE registers, called PDPTEi,i equal to the value of these two bits. Each PDPTEi can correspond to a 1G linear address space. If the P bit of PDPTEi is 0, then this item is invalid, which means that the item does not contain the corresponding page catalog table and generates a page-fault exception (see Section 4.7 for details).

If the P bit of the PDPTEi is 1, then its 51:12 (40 bit) points to the physical address of the page directory table. Each page catalog table consists of 512 8-byte PDEs.

It means that the first two bits of the linear address are used to determine the subscript of the page catalog table (PDPTE) and find one of the four page catalog tables.

Page catalog table, each page record table contains 512 table items, each 8-byte size, pointing to a page table or to a 2m page, which is determined by the PS flag bits described below.

If the PS bit of the PDE's page catalog entry is equal to 1, the entry points to a final 2m page, and the physical address is determined by 51:21 (31 bit) and 20:0 (21 bit) of the item. The maximum number of physical address lines is 52, some CPU is 36, so the high position is 35:21 (15 bits), some CPU has 52 lines, and the high position is 51:21.

If the PS bit of the PDE's page catalog table entry is equal to 0, this item points to the page table. As in the case above, the physical address of the page table is divided into 36 physical address lines and 52 physical address lines.

In the case of 2m paging, 29:21 (9 bits) of the last 30 bits of the linear address is used as the subscript index of Table 2 (page catalog table) to determine the final page address, and 20:0 (21 bits) is used as the offset within the 2m page.

In the case of 4K paging, the last 30 bits of the linear address are 29:21 (9 bits) as the subscript index for Table 2 (page catalog table), 20:12 (9 bits) as the subscript index for Table 3 (page table), and 11:0 (12 bits) as the offset within the 4K page.

If the P bit (bit 0) of the page table entry (PDE) or page table item (PTE) equals 0, or if any of their reserved bits is set, the table entry will be invalidated and cause a page-fault exception (see Section 4.7 for details).

There are several reserved bits in PAE mode:

If the P flag (bit 0) of a PDE or a PTE is 1, bits 62:MAXPHYADDR are reserved.

If the P flag and the PS flag (bit 7) of a PDE are both 1, bits 20:13 are reserved.

If IA32_EFER.NXE = 0 and the P flag of a PDE or a PTE is 1, the XD flag (bit 63) is reserved

If the PAT is not supported:

-If the P flag of a PTE is 1, bit 7 is reserved.

-If the P flag and the PS flag of a PDE are both 1, bit 12 is reserved.

The following figure is a schematic diagram of the process of converting a 4K paged linear address to a physical address.

The following figure is a schematic diagram of the process of converting a 2m paged linear address to a physical address.

The following figure is a schematic diagram of the table item structure of PDPTE, PDE-2M, PDE-4K, and PTE:

The manual gives a detailed explanation of the structure of PDE-2M, PDE, and PTE, which are the following three tables:

First of all, the PDE-2M table item structure analysis: Table 4-9. Format of a PAE Page-Directory Entry that Maps a 2-MByte Page

Bit use

0 (P) Present, which must be equal to 1, indicating that the item points to a 2m page

1 (Read/Write W). If it is 0, it is not allowed to write data to 2m pages.

2 (Uplink S) User/supervisor, permission flag bit, equal to 0, the 3-ring program cannot access 2m paging

3 (PWT) Page-level write-through, which is used to indirectly determine the memory attributes needed to access 2m pages

4 (PCD) Page-level cache disable, which is used to indirectly determine the memory attributes needed to access 2m pages

5 (A) Accessed, indicating whether this 2m page has been accessed

6 (D) Dirty, indicating whether the 2m page has been written to data

7 (PS) Page size, paging size flag bit, must be equal to 1 (otherwise the meaning of this item becomes to point to a 4K paged page table)

8 (G) Gloabe, if CR4.PGE equals 1, this bit is used to determine whether the page is globally shared

11:9 Ignored

12 (PAT) if PAT is supported, it is used to indirectly determine the memory properties required to access 2m paging

20:13 Reserved, reserved bit, must be 0

(Mmur1): the physical address of 21 2m pages, 36 physical lines are 35:21 (15 bits), some CPU have 52 lines, it is 51:21

62Rom M Reserved, reserved bit, must be 0

63 (XD) if the IA32_EFER.NXE flag bit is equal to 1, the data in the page is not executable (fetching instructions from the page will be prohibited); IA32_EFER.NXE equals 0, the bit is reserved and must be filled with 0

Analysis of PDE item structure: Table 4-10. Format of a PAE Page-Directory Entry that References a Page Table

Bit use

0 (P) Present, which must be equal to 1, indicating that the item points to a page table

1 (Read/Write W). If it is 0, it is not allowed to write data to its 1024 pages (2m in total).

2 (Uplink S) User/supervisor, permission flag bit, equal to 0, then the 3-ring program cannot access the 1024 pages it contains (2m in total)

3 (PWT) Page-level write-through, which is used to indirectly determine the memory attributes needed to access the page table

4 (PCD) Page-level cache disable, which is used to indirectly determine the memory attributes needed to access the page table

5 (A) Accessed, indicating that the entry has been accessed (accessed by a linear address translator)

6 (D) Ignored

7 (PS) Page size, paging size flag bit, must be equal to 0

11:8 Ignored

(Mmur1): the physical address of the table on 12 pages, the CPU of 36 physical lines is 25:12 (24 bits), and some CPU has 52 lines, which is 51:12 (40 bits)

62Rom M Reserved, reserved bit, must be 0

63 (XD) if the IA32_EFER.NXE flag bit is equal to 1, the data in all pages (1024 pages) in the page table that the item points to is not executable; if IA32_EFER.NXE equals 0, the bit is reserved and must be filled with 0

Analysis of PTE item structure: Table 4-11. Format of a PAE Page-Table Entry that Maps a 4-KByte Page

Bit use

0 (P) Present, which must be equal to 1, indicating that the item points to a 4K page

1 (Read/Write W). If 0, data is not allowed to be paged to 4K.

2 (Uplink S) User/supervisor, permission flag bit, equal to 0, the 3-ring program cannot access 4K paging

3 (PWT) Page-level write-through, which is used to indirectly determine the memory attributes needed to access 4K paging

4 (PCD) Page-level cache disable, which is used to indirectly determine the memory attributes needed to access 4K paging

5 (A) Accessed, indicating whether the 4K page has been accessed

6 (D) Dirty, indicating whether the 4K page has been written to data

7 (PAT) if PAT is supported, it is used to indirectly determine the memory properties required to access 4K paging

8 (G) Gloabe, if CR4.PGE equals 1, this bit is used to determine whether the page is globally shared

11:9 Ignored

(Mmur1): the physical address of 124K pages, the CPU of 36 physical lines is 25:12 (24 bits), and some CPU has 52 lines, which is 51:12 (40 bits)

62Rom M Reserved, reserved bit, must be 0

63 (XD) if the IA32_EFER.NXE flag bit is equal to 1, the data in the page is not executable (fetching instructions from the page will be prohibited); IA32_EFER.NXE equals 0, the bit is reserved and must be filled with 0

Experiment question: implement a page table browsing tool

0. View the source code

Github source code

1. Environment settin

Test operating system: winxp sp3

Development environment configuration:

VS2015 implements MFC dialog box project

WDK 7.1.0 developing winxp driver

How do I enable PAE mode?

Readers can search for the keyword "winxp pae" and will find many tutorials on enabling PAE mode on winxp systems.

2. Code implementation of MFC browsing tool

The effect of the tool is shown below:

The first column shows all the processes in the system and traverses the process by calling CreateToolhelp32Snapshot.

The second column shows the table item (PDPTE) of the page directory pointer table. After selecting a process in the parent directory, the MFC program calls the driver interface, loads the PDPTE of the process, and finally shows the valid table item.

The third column shows the table item of the page catalog table (PDE). After selecting a PDPTE table item of the parent directory, the process is similar to the above.

The fourth column, the display page table items (PTE), the process is similar to the above.

About the slow speed of loading process page tables:

For PAE mode, the total number of page table items for the process is: 4 PDPTE x 512 PDE x 512 PTE

In the original version of the tool design, a three-layer loop was used to traverse the page table items, loading all the page tables of a process at once. But there is the problem of slow loading speed. Therefore, the loading mode is improved, which is changed to load 512 PDE under an PDPTE entry according to the index, or 512 PTE under an PDE entry. After this improvement, the loading speed is significantly improved.

Code: defines the structure that holds page table data

Namespace PAEPaging

{

Struct PDE_T

{

PDEval

PTE PTEs [512]

BOOL LoadedFlag

}

Struct PDPTE_T

{

PDPTEval

PDE_T PDEs [512]

BOOL LoadedFlag

}

Struct PDPTE_TT

{

ULONG cr3Val

PDPTE_T PDPTEs [4]

}

}

Code: call driver interface to load the implementation of page table

BOOL COperateKernel::LoadPages (DWORD dwPID, _ _ in DWORD dwPDPTEIdx, _ _ in DWORD dwPDEIdx, PAEPaging::PDPTE_TT* tt)

{

...

If (DeviceIoControl (hFile, IOCTL_GET_PAGES_PAE, inBuff, sizeof (inBuff), outBuff, sizeof (outBuff))

& dwBytesRead, NULL))

{

DWORD dwOutBuffOffset = 0

/ / load PDPTE table

If (dwPDPTEIdx = =-1 & & dwPDEIdx = =-1)

{

For (int I = 0; I

< 4; i++) { PAEPaging::PDPTE *pPDPTE = (PAEPaging::PDPTE*)((DWORD)outBuff + dwOutBuffOffset); tt->

PDPTES [I] .val = * pPDPTE

DwOutBuffOffset + = sizeof (PAEPaging::PDPTE)

}

}

/ / load PDE table

Else if (dwPDPTEIdx! =-1 & & dwPDEIdx = =-1)

{

For (int I = 0; I

< 512; i++) { PAEPaging::PDE *pPDE = (PAEPaging::PDE*)((DWORD)outBuff + dwOutBuffOffset); tt->

PDPTES [dwPDPTEIdx] .PDEs [I] .val.uint64 = pPDE- > uint64

DwOutBuffOffset + = sizeof (PAEPaging::PDE)

}

}

/ / load PTE table

Else if (dwPDPTEIdx! =-1 & & dwPDEIdx! =-1)

{

For (int I = 0; I

< 512; i++) { PAEPaging::PTE *pPTE = (PAEPaging::PTE*)((DWORD)outBuff + dwOutBuffOffset); tt->

PDPTES [dwPDPTEIdx]. PDEs [dwPDEIdx] .PTEs [I] = * pPTE

DwOutBuffOffset + = sizeof (PAEPaging::PTE)

}

}

BRet = TRUE

}

...

}

3. Implementation of driver code

NTSTATUS GetProcessPages (PVOID pInBuff, PVOID pOutBuff, ULONG nOutLength, ULONG* nBytes)

{

...

/ / load PDPTE table

If (nPDPTEIdx = =-1 & & nPDEIdx = =-1)

{

For (int I = 0; I < 4; iTunes +)

{

ULONG64 paPDPTE = paCR3 + 8 * I

ULONG64 PDPTE = GetQuadByPA (paPDPTE)

* (ULONG64*) ((ULONG) pOutBuff + nWriteOffset) = PDPTE

NWriteOffset + = sizeof (ULONG64)

}

}

/ / load PDE table

Else if (nPDPTEIdx! =-1 & & nPDEIdx = =-1)

{

ULONG64 paPDPTE = paCR3 + 8 * nPDPTEIdx

ULONG64 PDPTE = GetQuadByPA (paPDPTE) & 0xFFFFFF000

For (int I = 0; I < 512; iTunes +)

{

ULONG64 paPDE = PDPTE + 8 * I

ULONG64 PDE = GetQuadByPA (paPDE)

* (ULONG64*) ((ULONG) pOutBuff + nWriteOffset) = PDE

NWriteOffset + = sizeof (ULONG64)

}

}

/ / load PTE table

Else if (nPDPTEIdx! =-1 & & nPDEIdx! =-1)

{

ULONG64 paPDPTE = paCR3 + 8 * nPDPTEIdx

ULONG64 PDPTE = GetQuadByPA (paPDPTE) & 0xFFFFFF000

ULONG64 paPDE = PDPTE + 8 * nPDEIdx

ULONG64 PDE = GetQuadByPA (paPDE) & 0xFFFFFF000

For (int I = 0; I < 512; iTunes +)

{

ULONG64 paPTE = PDE + 8 * I

ULONG64 PTE = GetQuadByPA (paPTE)

* (ULONG64*) ((ULONG) pOutBuff + nWriteOffset) = PTE

NWriteOffset + = sizeof (ULONG64)

}

}

...

}

At this point, I believe you have a deeper understanding of "how to use PAE paging mode". You might as well do it in practice. Here is the website, more related content can enter the relevant channels to inquire, follow us, continue to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.