x86 体系结构分页机制

分页机制

1. 内核和用户的代码都是 virtual address
2. 页目录和页表中包含 1024 个目录项 PTE (page table entry)
   • PPN (physical page number), 20 位的物理页码
   • Flags, 12 位
3. 第一步从 cr3 寄存器中获取页目录 page directory
4. va.dir 索引 page directory 获取到页表 page table
5. page directory / page table 包含 1024 个 PTE
   • 这段连续内存大小位 1024 * 4 byte = 4KB
   • 这 4KB 又叫页 page
6. va.table 索引 page table 获取到物理地址到 PPN

                            +--------------------------------------------+
                            |                                            |
Virtual Address(32)         |                Physical Address(32)        v
+----------------------------------+         +----------------------------------+
| Dir(10) | Table(10) | Offset(12) |         | PPN (20)            | Offset(12) |
+----------------------------------+         +----------------------------------+
    |          |                                 ^
    |          |                                 |
    |          |                                 |
    |          |                       1023 |----+---------------|
    |          |                            |    |    |          |
    |          |                            | PPN(20) | Flag(12) |
    |          |                            |         |          |
    |          |                            | 0x81    |          |
    |          +----------------------->  2 | 0x43    |          |
    |                                     1 | 0       |          |
    |            +--------------------->  0 |--------------------|
    |            |                                 PAGE TABLE
    |            |
    |            |
    |            |                                      1023 |------------|
    |  1023 |----+---------------|                           |     |      |
    |       |    |    |          |                           | PPN | Flag |
    |       | PPN(20) | Flag(12) |                           |     |      |
    |       |         |          |                         2 |     |      |
    |       |         |          |                         1 | 0   |      |
    `-->  2 | 0x23 ---+----------+---------------------->  0 |------------|
          1 | 0x10    |          |
cr3 --->  0 |--------------------|
                PAGE DIRECTORY

x86 的寻址模式

1. 虚拟地址/逻辑地址 logic address
   • 编译器产生的地址
2. 线性地址 linear address
   • CPU 加载程序后，会为这个程序分配内存，通过分段产生的地址
   • 段基址 + 逻辑地址 = 线性地址
3. 物理地址 physical address
   • 硬件真实的内存地址
   • 如果没有开启分页, pa = la
   • 开启分页后，la 经过硬件转换才能得到 pa

     [  CPU  ]
       |   |
       |   |  (Logic Address)
       |   |
       v   v
[Segment Translation] (Selector/Offset/gdtr)
       |   |
       |   |  (Linear Address)
       |   |
       v   v
[  Page Translation ] (Paging/cr3/PD/PT)
       |   |
       |   |  (Physical Address)
       |   |
       v   v
    [  Memory  ]

分页代码讲解

../../study/os/xv6-public/mmu.h

// A virtual address 'la' has a three-part structure as follows:
//
// +--------10------+-------10-------+---------12----------+
// | Page Directory |   Page Table   | Offset within Page  |
// |      Index     |      Index     |                     |
// +----------------+----------------+---------------------+
//  \--- PDX(va) --/ \--- PTX(va) --/

// page directory index
#define PDX(va)         (((uint)(va) >> PDXSHIFT) & 0x3FF)

// page table index
#define PTX(va)         (((uint)(va) >> PTXSHIFT) & 0x3FF)

qemu 调试过程

(qemu) info mem
0000000080000000-0000000080100000 0000000000100000 -rw
0000000080100000-0000000080108000 0000000000008000 -r-
0000000080108000-000000008e000000 000000000def8000 -rw
00000000fe000000-0000000100000000 0000000002000000 -rw
(qemu) xp/8x 0x3ff000 + 0x200*4
00000000003ff800: 0x003fe027 0x003fd007 0x003fc007 0x003fb007
00000000003ff810: 0x003fa007 0x003f9007 0x003f8007 0x003f7007
(qemu) xp/8x 0x3fe000 + 0x103*4
00000000003fe40c: 0x00103001 0x00104001 0x00105001 0x00106021
00000000003fe41c: 0x00107001 0x00108003 0x00109003 0x0010a003
(qemu) xp/8x 0x103086
0000000000103086: 0x000185e8 0xf760e800 0xabe8ffff 0xe8000038
0000000000103096: 0x00000376 0xfff331e8 0xd9bce8ff 0x27e8ffff
(qemu)

gdb 调试过程

(gdb) n
=> 0x80103086 <main+38>:        call   0x80103210 <mpinit>
22        mpinit();                               // detect other processors
(gdb) source custom.gdb
(gdb) idx 0x80103086
VA(0x80103086): PDX=0x200 PTX=0x103 OFFSET=0x86
(gdb) p/x $cr3
$1 = 0x3ff000
(gdb) ppn 0x003fe027
PTE(0x3fe027): PPN=0x3fe000 FLAGS=0x27
(gdb) ppn 0x00103001
PTE(0x103001): PPN=0x103000 FLAGS=0x1
(gdb) p/x 0x103000 | 0x86
$2 = 0x103086
(gdb) x/8x 0x80103086
0x80103086 <main+38>:   0x000185e8      0xf760e800      0xabe8ffff      0xe8000038
0x80103096 <main+54>:   0x00000376      0xfff331e8      0xd9bce8ff      0x27e8ffff
(gdb)