1. CS444/544 Operating Systems II Virtual Memory
Yeongjin Jang
04/09/19

2. Recap – Real Mode Real mode segmentation, how? What is A20?
seg * 16 + offset
[b000:b7ff] => 0xb000 * xb7ff = 0xbb7ff
What is A20?
[f800:8001] => 0x100001?
[f800:8001] => 0x1?
FYI, segment registers are:
%cs – code segment
%ds – data segment
%es – extra segment
%fs
%gs
%ss – stack segment
Image from:

3. Recap - JOS Boot Sequence
0xf000:0xffff – BIOS
Loads boot sector – runs 0x7c00
Enable A20
Enable protected mode (enabling 4GB memory access)
Read kernel ELF (Executable Linkable Format) …

4. No Memory Privilege in Real Mode
Main Memory
Program A
Suppose two program runs at the same time
Program A attempts to modify memory used by program B
No SECURITY!
Program B

5. i386 Protected Mode Look at GDT (Global Descriptor Table)
Indexed by a segment register
(selector)
Retrieve base address
Address = base + offset
Can access if (offset < limit) or
Can access if (offset < limit * 4096)
Depending on the values in flags!
Images from:

6. i386 Protected Mode Base Limit Any 32-bit address
20-bit, but could be multiplied by 4096 bytes
E.g., 1 means 4096, 2 means 8192, etc.
Images from:

7. i386 Protected Mode G - Granularity (0 = byte, 1 = page)
0: Limit will be byte granularity (i.e., limit, only access 220, 1MB)
1: Limit will be page granularity (i.e., limit * 4096, 220 * 216 = 232)
D – Default operand size (0 = 16-bit, 1 = 32-bit)
Set the values of IP/SP with respect to this bit
R,X – Readable/Executable
DPL – Descriptor Privilege Level (a.k.a. Ring Level)
0 (highest priv), 1, 2, 3 (lowest priv)
For more information:

8. Protected Mode - Examples
0x0:0x8080
Base: 0x0
Limit (addr): 0xfffff000
Offset: 0x8080
Address: 0x8080
GDT index
32-bit Base
20-bit Limit
12-bit Flags 16 0x
0x1
G=1 8 0x
0x80000
0x0
0xfffff

9. Protected Mode - Examples
0x8:0x8080
Base: 0x
Limit (addr): 0x
Offset: 0x8080
Address: 0x
GDT index
32-bit Base
20-bit Limit
12-bit Flags 16 0x
0x1
G=1 8 0x
0x80000
0x0
0xfffff

10. Protected Mode - Examples
0x10:0x333
Base: 0x
Limit (addr): 0x1000
Offset: 0x333
Address: 0x
0x10:0x8080
Offset: 0x8080
Offset > limit
Access denied!
GDT index
32-bit Base
20-bit Limit
12-bit Flags 16 0x
0x1
G=1 8 0x
0x80000
0x0
0xfffff

11. Protected Mode – Memory Privilege
DPL (Descriptor Privilege Level)
Protected mode – four levels of memory privilege
0 – highest, OS kernel
1 – OS kernel
2 – highest user-level privilege
3 – user-level privilege
Kernel: for privileged OS operations…
User: for unprivileged applications…

12. Protected Mode – Memory Privilege
No memory privilege in real mode
Protected mode – four levels of memory privilege
0 – highest, OS kernel
1 – OS kernel
2 – highest user-level privilege
3 – user-level privilege
Typically, 0 is for kernel, 3 is for user…
Image from:

13. Descriptor Privilege Level Defines Ring Level
CPL = Current Privilege Level
Defined in the last 2 bits of the %cs register
You can change %cs only via lcall/ljmp/trap/int
GDT index
32-bit Base
20-bit Limit
12-bit Flags
16 USER 0x
0x1
G=1, DPL=3
8 KERNEL 0x
0x80000
G=1, DPL=0
0 KERNEL
0x0
0xfffff

14. Descriptor Privilege Level Defines Ring Level
CPL = Current Privilege Level
Defined in the last 2 bits of the %cs register
You can change %cs only via lcall/ljmp/trap/int
Examples
%cs == 0x8 == 1000 in binary, last 2 bits are ZERO -> KERNEL!
%cs == 0x == in binary, last 2 bits are 3 -> USER!
%cs == 0x == in binary, last 2 bits are 0 -> KERNEL!
%cs == 0xb == 1011….
GDT index
32-bit Base
20-bit Limit
12-bit Flags
16 USER 0x
0x1
G=1, DPL=3
8 KERNEL 0x
0x80000
G=1, DPL=0
0 KERNEL
0x0
0xfffff

15. Descriptor Privilege Level Defines Ring Level
CPL = Current Privilege Level
Defined in the last 2 bits of the %cs register
You can change %cs only via lcall/ljmp/trap/int
mov %ax, %cs  impossible!
Can only move down…
CPL==0, then ljmp 0x3:0x1234 is possible
CPL==3, then ljmp 0x0:0x1234 is impossible
GDT index
32-bit Base
20-bit Limit
12-bit Flags
16 USER 0x
0x1
G=1, DPL=3
8 KERNEL 0x
0x80000
G=1, DPL=0
0 KERNEL
0x0
0xfffff

16. x86 Memory Privileges CPL = Current Privilege Level
Defined in the last 2 bits of the %cs register
You can only change %cs via lcall/ljmp/trap/int
RPL = Requester Privilege Level
Defined in the last 2 bits of any segment register
DPL = Descriptor Privilege Level
Defined in the GDT
Ring switch rule
CPL <= DPL
RPL <= DPL
Must meet both conditions..

17. Enabling Protected Mode (part 1): Create Global Descriptor Table (GDT)
In boot/boot.S
%cs to point 0 ~ 0xffffffff in DPL 0
%ds to point 0 ~ 0xffffffff in DPL 0
Only kernel can access those two segment
GDT index
32-bit Base
20-bit Limit
12-bit Flags 16
0x0
0xfffff
G=1,W
DPL=0 8
G=1, XR DPL=0

18. Enabling Protected Mode (part 2): Change CR0 (Control Register 0)
Set PE (Protected enabled) to 1 will enable Protected Mode
In JOS:
Load GDT
Read CR0, store it to eax
Set PE_ON (1) on eax
Put eax back to CR0
(PE_ON to CR0!!)

19. How to Change CPL? ljmp (instruction) Long jump
0x8 == 1000, Last 2 bits are zero..

20. Protected Mode Summary
Segment access via GDT
Base + Offset < Limit * 4096
Last two bits in %cs segment - CPL
Memory Privilege - Ring level
0 for OS kernel
3 for user application
Changing CR0 to enable protected mode
CR0_PE_ON == 1, set via eax
Changing CPL?
ljmp %cs:xxxxx, set the last 2 bits of %cs as 0 for kernel..

21. Virtual Memory
Three goals
Transparency
Efficiency
Protection

22. Uniprogramming Environment
Free (576 KB)
0x10000 ~ 0xa0000
(64KB ~ 640KB)
Run one program
The program can use memory space freely…
Stack - 1
Program Data - 1
Program Code - 1 OS
0x00000 ~ 0x10000
(0 ~ 64KB)

23. Uniprogramming Environment
Free (576 KB)
0x10000 ~ 0xa0000
(64KB ~ 640KB)
Run one program
The program can use memory space freely…
Stack - 1
Stack (64KB)
0x80000 ~ 0x90000
(512KB ~ 576KB)
Program Data - 1
Program Data (64 KB)
0x40000 ~ 0x50000
(256KB ~ 320KB)
Program Code - 1 OS
0x00000 ~ 0x10000
(0 ~ 64KB)

24. Uniprogramming Environment
Free (64 KB)
0x90000 ~ 0xa0000
(576KB ~ 640KB)
Run one program
The program can use memory space freely…
Stack - 1 (64KB)
0x80000 ~ 0x90000
(512KB ~ 576KB)
Free (192 KB)
0x50000 ~ 0x80000
(320KB ~ 512KB)
Program Data - 1 (64 KB)
0x40000 ~ 0x50000
(256KB ~ 320KB)
Free (64 KB)
0x30000 ~ 0x40000
(192KB ~ 256KB)
Program Code - 1 (128KB)
0x10000 ~ 0x30000
(64KB ~ 192KB) OS
0x00000 ~ 0x10000
(0 ~ 64KB)

25. Multi-programming Environment
Free (64 KB)
0x90000 ~ 0xa0000
(576KB ~ 640KB)
Run two programs
Stack - 1 (64KB)
0x80000 ~ 0x90000
(512KB ~ 576KB)
Stack - 2 (64KB)
Free (192 KB)
0x50000 ~ 0x80000
(320KB ~ 512KB)
Program Data - 2 (64 KB)
Program Data - 1 (64 KB)
0x40000 ~ 0x50000
(256KB ~ 320KB)
Free (64 KB)
0x30000 ~ 0x40000
(192KB ~ 256KB)
Program Code - 2 (128KB)
Program Code - 1 (128KB)
0x10000 ~ 0x30000
(64KB ~ 192KB) OS
0x00000 ~ 0x10000
(0 ~ 64KB)

26. Multi-programming Environment
Stack - 2 (64KB)
Free (64 KB)
0x90000 ~ 0xa0000
(576KB ~ 640KB)
Run two programs
System’s memory usage determines allocation
Program need to be aware of the environment
Where does system loads my code?
You can’t determine… system does..
Stack - 1 (64KB)
0x80000 ~ 0x90000
(512KB ~ 576KB)
Free (192 KB)
0x50000 ~ 0x80000
(320KB ~ 512KB)
Program Code - 2 (128KB)
Program Data - 1 (64 KB)
0x40000 ~ 0x50000
(256KB ~ 320KB)
Program Data - 2 (64 KB)
Free (64 KB)
0x30000 ~ 0x40000
(192KB ~ 256KB)
Program Code - 1 (128KB)
0x10000 ~ 0x30000
(64KB ~ 192KB)
No Transparency… OS
0x00000 ~ 0x10000
(0 ~ 64KB)

27. Multi-programming Environment
Free (64 KB)
0x90000 ~ 0xa0000
(576KB ~ 640KB)
Run two programs
Stack - 1 (64KB)
0x80000 ~ 0x90000
(512KB ~ 576KB)
Stack - 2 (64KB)
Free (96 KB)
0x68000 ~ 0x80000
(416KB ~ 512KB)
Program Data - 2 (64 KB)
Program Data - 1 (64 KB)
0x58000 ~ 0x68000
(352KB ~ 416KB)
Free (128 KB)
0x38000 ~ 0x58000
(224KB ~ 352KB)
Program Code - 2 (160KB)
Program Code - 1 (160KB)
0x10000 ~ 0x38000
(64KB ~ 224KB) OS
0x00000 ~ 0x10000
(0 ~ 64KB)

28. Multi-programming Environment
Stack - 2 (64KB)
Free (64 KB)
0x90000 ~ 0xa0000
(576KB ~ 640KB)
Run two programs
Program size: 64KB + 64KB + 160K = 288KB
Free mem
= 288KB
Cannot run Program – 2
Can’t fit…
Stack - 1 (64KB)
0x80000 ~ 0x90000
(512KB ~ 576KB)
Program Data - 2 (64 KB)
Free (96 KB)
0x68000 ~ 0x80000
(416KB ~ 512KB)
Program Data - 1 (64 KB)
0x58000 ~ 0x68000
(352KB ~ 416KB)
Program Code - 2 (160KB)
Free (128 KB)
0x38000 ~ 0x58000
(224KB ~ 352KB)
Program Code - 1 (160KB)
0x10000 ~ 0x38000
(64KB ~ 224KB) OS
0x00000 ~ 0x10000
(0 ~ 64KB)
Not efficient.. Suffers memory fragmentation problem..

29. Multi-programming Environment
Stack - 2 (64KB)
Free (64 KB)
0x90000 ~ 0xa0000
(576KB ~ 640KB)
Run two programs
What if Program-2’s stack underflows?
What if Program-2’s data overflows?
Without virtual memory
Programs can affect to the other’s execution
Stack (64KB)
0x80000 ~ 0x90000
(512KB ~ 576KB)
Program Code - 2 (128KB)
Free (192 KB)
0x50000 ~ 0x80000
(320KB ~ 512KB)
Program Data (64 KB)
0x40000 ~ 0x50000
(256KB ~ 320KB)
Program Data - 2 (64 KB)
Free (64 KB)
0x30000 ~ 0x40000
(192KB ~ 256KB)
Program Code (128KB)
0x10000 ~ 0x30000
(64KB ~ 192KB) OS
0x00000 ~ 0x10000
(0 ~ 64KB)
No isolation. Security problem.

30. Virtual Memory Three goals
Transparency: does not need to know system’s internal state
Program A is loaded at 0x Can Program B be loaded at 0x ?
Efficiency: do not waste memory; manage memory fragmentation
Can Program B (288KB) be loaded if 288 KB of memory is free, regardless of its allocation?
Protection: isolate program’s execution environment
Can we prevent an overflow from Program A from overwriting Program B’s data?

31. Paging A method of implementing virtual memory
Split memory into multiple 4,096 byte blocks (12-bit)
Last 3 digits of page address are ZERO (in hexadecimal)
Having an indirect map between virtual page and physical page
Set an arbitrary virtual address for a page, e.g., 0x
Set a physical address to that page as a map, e.g., 0x32000
0x ~ 0x81815fff will be translated into
0x32000 ~ 0x32fff

32. Virtual Memory - Paging
Physical Memory
Having an indirect table that maps virt-addr to phys-addr
Stack
0xbffdf000
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x14000
0xbffdf000
0x12000 …
Program code
0x14000
Program code
0x804a000
Program code 0x
Stack
0x12000
Program code 0x
Program code
0x11000
Program code
0x10000

33. Paging: Virtual Memory
Physical Memory
Stack-2
0x17000
Having an indirect table that maps virt-addr to phys-addr
Stack-2
0xbffdf000
Stack
0xbffdf000
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x14000
0xbffdf000
0x12000 …
Program code-2
0x16000
Program code-2
0x15000
Program code
0x14000
Program code-2
0x804a000
Program code
0x804a000
Program code-2
0x13000
Virtual-2
Physical-2 0x
0x13000 0x
0x15000
0x804a000
0x16000
0xbffdf000
0x17000 …
Program code-2 0x
Program code 0x
Stack
0x12000
Program code-2 0x
Program code 0x
Program code
0x11000
Program code
0x10000

34. Paging: Virtual Memory
Transparency: does not need to know system’s internal state
Program A is loaded at 0x
Can Program B be loaded at 0x ?
Paging: Virtual Memory
Physical Memory
Stack-2
0x17000
Having an indirect table that maps virt-addr to phys-addr
Stack-2
0xbffdf000
Stack
0xbffdf000
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x14000
0xbffdf000
0x12000 …
Program code-2
0x16000
Program code-2
0x15000
Program code
0x14000
Program code-2
0x804a000
Program code
0x804a000
Program code-2
0x13000
Virtual-2
Physical-2 0x
0x13000 0x
0x15000
0x804a000
0x16000
0xbffdf000
0x17000 …
Program code-2 0x
Program code 0x
Stack
0x12000
Program code-2 0x
Program code 0x
Program code
0x11000
Program code
0x10000

35. Paging: Virtual Memory
Efficiency: do not waste memory
Can Program B (288KB) be loaded if
only 288 KB of memory is free, regardless of its allocation?
Paging: Virtual Memory
Physical Memory
Stack-2
0x17000
Having an indirect table that maps virt-addr to phys-addr
Stack-2
0xbffdf000
Stack
0xbffdf000
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x14000
0xbffdf000
0x12000 …
Program code-2
0x16000
Program code-2
0x15000
Program code
0x14000
Program code-2
0x804a000
Program code
0x804a000
Program code-2
0x13000
Virtual-2
Physical-2 0x
0x13000 0x
0x15000
0x804a000
0x16000
0xbffdf000
0x17000 …
Program code-2 0x
Program code 0x
Stack
0x12000
Program code-2 0x
Program code 0x
Program code
0x11000
Program code
0x10000

36. Paging: Virtual Memory
Protection: isolate program’s execution environment
Can we prevent an overflow from Program A from overwriting Program B’s data?
Paging: Virtual Memory
Stack-2
0xbffdf000
Stack
0xbffdf000
No mappings,
FAULT!
No mappings,
FAULT!
Program code-2
0x804a000
Program code
0x804a000
Program code-2 0x
Program code 0x
Program code-2 0x
Program code 0x

37. Page Table
A table that stores virtual address to physical address mapping…
We need to create this per each process…
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x14000
0xbffdf000
0x12000 …
Virtual-2
Physical-2 0x
0x13000 0x
0x15000
0x804a000
0x16000
0xbffdf000
0x17000 …

38. Page Directory / Table We access page table by virtual address
Page size: 4 KB (12bits)
Page number: 20 bits
What is the page number and offset of 0x
0xb7ff3100 31 12
Page number
Offset

39. Page Directory / Table In x86 (32-bit), CPU uses 2-level page table
10-bit directory index
10-bit page table index
12-bit offset 31 12
Page number
Offset
Directory Index
(10-bits)
Table index
(10-bits) 31 22 12

40. Virtual address (32-bits)
Address Translation 31 12
Virtual address (32-bits)
Page number (20-bits)
Offset (12-bits)
Directory Index
(10-bits)
Table index
(10-bits) 31 22 12
Page Directory Entry
Addr PT 1 2
1024
Page Table Entry
Addr page 1 2
1024

41. Address Translation Example31 12 0x
Page number (20-bits)
0x08048
Offset (12-bits)
0x000
Directory Index
(10-bits)
0x20
Table index
(10-bits)
0x48 31 22 12
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x50000
Page Directory Entry
Addr PT1 ..
Addr PT2
0x20
Addr PT10
0x3ff
Addr PT500
PT 10
Page Table Entry
NO MAPPING
0x48
0x10000
0x49
0x11000
0x4a
0x50000
Physical access

42. Page Table Entry
Address translation is from virtual page to physical page
E.g., 0x > 0x11000
We do not need to translate lower 12 bits
E.g., 0x > 0x x001 -> 0x x001
So page table entry only uses higher 20 bits to store physical page address
Lower 12 bits remaining as the same
We do not translate the lower 12 bits!

43. Address Translation Examples
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x14000
0xbffdf000
0x12000 0x 0x
Virtual addresss 0x
Virtual page number: 0x8048
Offset: 0x338
Physical page number: 0x10
Physical address: 0x10 (000) + 0x338 = 0x10338
Virtual address 0x443325af
Virtual page number: 0x44332
Offset: 0x5af
Physical page number: 0x33885
Physical address: 0x x5af = 0x338855af
Virtual
Physical
0x8048
0x10
0x8049
0x11
0x804a
0x14
0xbffdf
0x12
0x44332
0x33885

44. PDE, PTE 0: kernel, 1: user Page Directory Entry Addr PT1 .. Addr PT2
Addr PT1 ..
Addr PT2
0x20
Addr PT10
0x3ff
Addr PT500
PT 10
Page Table Entry
NO MAPPING
0x48
0x10000
0x49
0x11000
0x4a
0x50000

45. Paging in x86 Can be enabled via CR0
Page table address (physical) need to be stored at CR3

46. Paging in x86
Virtual Address

47. Paging in x86 In JOS (kern/entry.S)
After CR0_PG is up (paging is turned on)
All address access regarded as virtual address
Set cr3 to point the address of page directory
Turn on CR0_PG!

48. How can we access physical address
After CR0_PG is up (paging is turned on)
All address access regarded as virtual address
What if we would like to access the physical address 0x100010?
Our kernel is at physical address 0x ~ 0x110000
What’s the virtual addresses of those area?

49. How can we access physical address
4GB virtual address space
256 MB physical address space
In JOS, we will map 0xf ~ 0xffffffff to
Physical address
0x ~ 0x0fffffff
256 MB Region
0xf > 0x
0xf > 0x
0xf – 0xffffffff
(256MB)

50. In kern/entrypgdir.c Entry_pgdir only contains two entries;
0 ~ 0x to 0 ~ 0x (not writable)
0xf ~ 0xf to 0 ~ 0x (writable)

51. In kern/entrypgdir.c 0xf0001000 will consult entry_pgtable[1]
-> 0x | PTE_P | PTE_W
Phyaddr: 0x1000

52. Page A page Why having a block?
A 4,096 (4 KB) block of memory
Why having a block?
How large does the page table should be to map 4GB (32-bit space)?
If a block is 1GB – 4 entries * pointer (32-bit, 4byte) = 16 byte long
If a block is 4MB – 1024 entries * pointer = 4,096 bytes, 4KB long
If a block is 4KB – entries * pointer = 4MB long
If a block is 1 byte – entries = 4GB… NONO…
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x50000
Design consideration:
Size of page table matters!

53. Page (cont’d) A page Why 4KB in Intel x86?
A 4,096 (4 KB) block of memory
Why 4KB in Intel x86?
How much memory do you need to allocate 1 byte?
1GB page – 1GB
4MB page – 4MB
4KB page – 4KB
1B page – 1B
Virtual
Physical 0x
0x10000 0x
0x11000
0x804a000
0x50000
Design consideration:
Memory fragmentation matters!

54. Page Size / Page Table Size
If a page size is too small, it requires a big page table
1B, 4GB
4KB, 4MB
4MB, 4KB
1G, 16B
If a page size is too big, unused memory in a page will be wasted
1B - 1B (no waste)
4KB – 1B
4MB – 1B
1G – 1B

55. x86 Memory Access