1. 1 iAPX86 Systems Electronic Computers LM

2. 2 X86 Registers 0781531 ALAHAX BLBHBX CLCHCX DLDHDX SI DI BP SP EAX EBX ECX EDX ESI EDI EBP ESP 07815 CS SS DS ES FS GS DATA 031 IP EF Floating Point registers (8 x 80 bit stack). In the new 64 bit systems more registers (R8, R9…R16) are present 031 FLAGS

3. 3 X86 Segmentation (32 bit Systems) Protection and segment access control to check the access rights and the address correctness Multiple “environments”: each one must be separated and protected from the others (multiple concurrent users- processes) Operating systems support x86 Address Memory Translation control Address Memory 8086

4. Rivisited segmentation 4 The segmentation is a memory management scheme which reflects the programmer’s point of view A program is a segment collection: main program, procedures, functions, objects, local and global variables, stack etc. that is modules with consistent information to be stored in memory in general in non consecutive addresses (at module level) The segmentation allows the relocation and the sharing of data Fragmentation is a possible drawback (external, not that of paging) for instance if paging not implemented or disabled If a system access control must implemented a control mechanism is required This is achieved by means of a segment table which for each segment indicates the initial address, the size, its characteristics (valid/invalid, read/write, user/supervisor etc.) pointed by a segment table register. A further register storing the register table size is used for protection (Segment Table Length Register): a segment number k is valid if and only if k<STLR. Eachis Ogni entry is a segment descriptor Since the segments are of variable size a dynamic memory allocation is required.

5. 5 Segment descriptors Each segment is an «object» which is described by a segment descriptor which defines: The initial address in the virtual address space The segment length The access rights (read, write, execute etc.) The privilege level (security level) which a program must exibit to access the segment (see later) Whether it is a data or code segment or other types of segments The presence in the main memory Whether an access to the segment was made (not whether it was written – dirty segment)

6. 6 Segment descriptor AV: available for the software BASE: base starting address (32 bit) DB: segment parallelism (16/32 bit operands) PL privilege level (see later) G: granularity (segment size- multiple of 1 or 4096 bytes) segment 1B-1MB or 4KB-4GB LIMIT: segment limit ( 20 bit – see G bit) P: segment present in memory S: descriptor type (system/user) TYPE: segment type (data/code – R/W - Expand down-up) The files have different meanings according to the Type and other parameters 64 bit 8 bytes Please notice that no fields are availabe to determine the «age» of the segment for replacement policies (only the – accessed – bit can be used) : this is due to the fact that normally the systems are paged More modern descriptors for higher parallelism are slightly different Example. Data segment descriptor 31 24 19 16 14 13 11 8 7 0 Base 31:24G DBDB 0 AVAV Limit 19-16 P PLPL SType Base 23:16 Limit 15:00Base 15:00

7. 7 Descriptors 31 24 19 16 14 13 11 8 7 0 Base 31:24G DBDB 0 AVAV Limit 19-16 P PLPL SType Base 23:16 Limit 15:00Base 15:00 PLPL SType P > Present in memory (code/data) oppure valid/invalid (for OS segments and gates) PL > Protection level S > = 1 code(data (user) ; = 0 system or gates segments Type > 16 different types (really 32 because the meaning depends on S too) Access Right Byte P

8. 8 Data descriptors P PLPL 1Type Access Right Byte C/DEWA C/D Data/code (0 data). E Expand down or upward (stack) W Write – read only or R/W A Accessed (System ->only by OS usable– level 0 see later) S = 1 non system

9. 9 Code descriptors P PLPL 1Type Access Right Byte C/DCRA C/D Code/Data C 0/1 Confrming descriptor (see later)) R 0/1 read only or R/W A Accessed S = 1 non system

10. 10 Data Segments Non System 0000Not yet accessed segment, read only, upward expansion 0001The same but accessed 0010Not yet accessed segment, read/write, upward expansion (normal data segment) 0011The same but accessed 0100Not yet accessed segment, read only, downward expansion (call gate see later) 0101The same but accessed 0110Not yet accessed segment, read/write, downward expansion (normale stack segment) 0111The same but accessed C/D E(xp.) W A(ccessed) Descrizione

11. 11 Descriptors tables In the x86 systems each segment is found through its descriptor whch can be located in two different tables: GDT (Global Descriptor Table) or LDT (Local Descriptor Table). The GDT stores all descriptors of the segments used by the OS and is always present in memory. There is a LDT for each active process in the system. To access memory (both for data and code) an access to GDT or LDT is required (but there is obviously a descriptor caching mecahnism – see. later). Typical descriptors of the LDTs are data, segments, code. There are also task descriptors (see later) The CS, SS, DS etc. do not store physical addresses but selectors which lead to the segment descriptors storing all information of the segment

12. 12 Addressing SELECTOROFFSET 48 bit pointer (16+32) 0 313247 Access Rights Limit Initial address datum Limit address GDT or LDT segment descriptor The computed address is a linear or virtual address An address of iAPX86 systems is a string of 48 bits (16 bit for the selector and 32 bit for the in-segment offset) Segment Segment initial address (in the segment register

13. 13 GDT Since the index is stored in the first 13 bits of the selector (the other bits are for control) the GDT can store up to 8192 8 bytes selectors (64 Kbytes). The same for each LDT (and IDT – see later) GDT N N-1 N-2 --- 0 1 2 3 4 BASE LIMIT GDTR Global Descriptor Table Register Index SELECTOR CPU Registers The base address value and the limit of the GDT must be stored by the OS during the initial configuration phase through privileged instruction (see later)

14. 14 LDT BASE LIMIT GDT N N-1 N-2 --- 0 1 2 3 4 GDTR LDT N N-1 N-2 --- 0 1 2 3 4 There is a LDTR register storing a selector which points to the current LDT descriptor. The LDT is therefore a segment of the GDT. The register can be loded by a privileged instruction LDTR

15. 15 LDT Local Descriptor Table contents: Task code, data and stack The call gates (see later) The task gates which allow to trigger the execution of other tasks A Local Descriptor Table contains all descriptors of a task (process) defined in the system. In particular the DFTR stores the selector of the LDT of the process presently executed

16. 16 Aliasing But since all data of the LDT or GDT or DT are segments descriptors how can the OS modify the their contents since there are no specific access instructions ? ALIAS Since a segment is a portion of physical memory nothing prevents a double description of the same area with different access rights. N N-1 3 2 1 0 GDT K X Y X an Y are is the same memory area which is however described by two different descriptors i.e. one (X) code and the other (Y) data. The compiler, for instance, when generates the code writes in the segment through descriptor Y (enable write) but when the segment must be executed the OS uses descriptor Y. Obviously the OS must be aware of this aliasing because when X (Y) is deleted from memory or saved in disk all alised descriptors must be updatesd. For the entire GDT and LDT there is an alias.

17. 17 Selectors 2 1 0315 INDEX T I RPL Segment selector (Segment register content) TI: Table Identifier (0 >GDT – 1 > LDT) RPL: Privilege level (see protection later) 13 bit -> 8192 selectors INDEX: descriptor table index

18. 18 In iAPX86 too this mean to insert 00D0 in DS but 00D0 is a selector 0000000011010000 pointing the twentyseventh descriptor (do not forget 0) of the GDT (11010 H =26 D ) with privilege level 00 ! If the segment base address in the descriptor is 0000F5D0 the byte at virtual address 0000F5D3 is read (instruction offset is 3) ! An example mov ax, 00D0 mov ds, ax mov dl,[3] In 8086 this means to insert 00D0 in DS and to store in the dl the fourth byte (do not forget that there is also byte 0) of the segment - location 00D03

19. 19 Descriptors caching The descriptors of all segments pointed by the segment registers are stored in small caches of 8 bytes linked to the segment registers. These caches are loaded when a new selector is loaded in a segment register.. This prevents that for each memory access an access to the descriptor table is needed.

20. 20 Fulls addressing in iAPX86 selector SS GS FS ES DS CS Access Rights SS Limit Base Address Access Rights GS Limit Base Address Access Rights FS Limit Base Address Access Rights ES Limit Base Address Access Rights DS Limit Base Address Access Rights CS Limit Base Address Index Register Scale X + Displacement + LINEAR ADDRESS DESCRIPTOR REGISTERS CACHE Offset Base Register

21. Scaling 21 Segment Base Address CS, DS, ES FS, GS, ES Base Register EAX, EBX, ECX, EDX EBP, ESI, EDI, ESP Index Register EAX, EBX, ECX, EDX EBP, ESI, EDI Scale Factor Displacement Effective Address EX: mov EAX, [EBX][ECX*4 + 6] (total displacement) 0, 1, 2,4,8

22. 22 Offset EAX EBX ECX EDX ESP EBP ESI EDI EAX EBX ECX EDX EBP ESI EDI * 12481248 0-bit 8-bit 16-bit 32-bit Offset= Base + (Index*Scale) + Displacement BaseIndexScaleDisplacement mov eax, darray[edx*4] ; In eax (32 bit) a dword (dword – 4 bytes) of an array of dwords mov eax, [esi*8][edi] ; In eax a dword of an array of quadwords

23. 23 iAPX86 (32 bit) full addressing 0 selector SELECTOR OFFSET 0 Address DIR Linear address OFFSET TABLE Each task has its own page table loaded for each context change The OS services are started by software interrupts CR3 31 22 21 12 11 DIR ENTRY P.TBL.ENTRY OP. Descriptor 15310 20 bit address + 12 bit info 1024 slots 20 bit address + 12 bit info Physical address in CR3

24. Paged addressing 24 0 DIR TABLE 31 22 21 12 11 OFFSET 4 K pages 0 DIR 31 22 21 OFFSET 4 M pages If the pages are 4 MB the offset in page is 22 bit and therefore the page table selection bit are only those of first level, that is bit 31-22

25. 25 Page table descriptors (I level) Avail0 Available for software Page size (4K/4M) II level table used Page cache disable Supervisor Writable 11 9 8 7 6 5 4 3 2 1 0 A PCDPCD PWTPWT UWP Page write through Present 0 PSPS The physical address of the first level table is pointed by the system register CR3 If the addressing is two-levels in the field 31-12 the physical address of the II level table (aligned !!) is stored which is indexed through the TABLE value to obtain the initial physical address (aligned !!) of the requested page If the page size is 4MB in the field 31-22 the initial physical address (aligned !!) of the requested page is stored If the page size is 4KB (two level addressing) PCD e PWT indicate whether the II level table items are cacheable and the used policy (WT or WB). The cacheability and the PWT of the I level table is stored in CR3. If the page size is 4MB the field 21-12 is void and the PCD/PWT bit have the same meaning of the corresponding bit of the two-level scheme (that is indicate the policy of the page and not of its address) Accessible only from Protection Level 0,1,2 Page Directory Element (DIR field) 31 12 Initial address 31:12

26. 26 Page table descriptors (II level – if any) Page Table Entry (Table fiels of the virtual address) 31 12 Page base address 31:12 Avail0 D Available for software Dirty (written) Used Page cache disable User/Supervisor Writable 11 9 8 7 6 5 4 3 2 1 0 A PCDPCD PWTPWT UWP Not used Page write through Present in memory Indicate whether the page data are cacheable and their policy (WB or WT). For the protection (see later) first the segment descriptor is checked then the page protection. Very often for the page tables PWT=1: then no write-back problems occur See later

27. 27 Sharing and protection Process 1 page table Memory Bit di controllo Pointers Flags Disk addresses Read/write access Read only access Process 2 page table

28. 28 I and II level page fault What in case of a page fault? The linear address is saved in CR2 (hardware – see later) A software interrupt n. 14 is generated The triggered routine reads CR2 OS call to find a free or replaceable page Disk driver call The new initial address is stored in the II level table IRET which restarts the page-faulted instruction

29. 29 Caches and page tables A I or II level table stores data which must be available for the OS and therefore must be possibly cacheable. The use policy can be determined singularly for each level Page directory base address CR3 control register Reserved PCDPCD PWTPWT Reserv. 31 12 11 5 4 3 2 0 1/0 Data of the Ist level table can be cacheable. In case of 4MB pages these infos are related to the only table (Ist level) If cacheable WB or WT The page (pointed byt I or II level tables) policies are defined in the page descriptors (previously described) The physical initial address of the Ist level page (1024 elements) (different for each process) is stored in the 20 MSbits Physical Address

30. 30 System registers 031 CR0 CR1 CR2 CR3 CR4 RESERVED 1601547 BASE LIMIT GDTR IDTR SELECTOR 015 SELECTOR TR LDTR The system registers load and store are carried out by specific privileged instructions (ex. LTR – Load Task Register – LGDT – Load Global Descriptor Table etc.)

31. 31 CR0 0 12345 3130 181716 29 PG Paging enable CD Cache disable NW Not writethrough AM Alignment mask (align check) WP Write protect (supervisor is not allowed to write user pages) TS task switched (save e restore Floating Point) R Reserved PE Protection enabled NB: Paging enable is valid only if PE=1 CACHE control PGPG CDCD NWNW R AMAM R WPWP NENE R TSTS EMEM 1 PEPE R NE Numeric Error EM Escape Instruction Trapped

32. 32 Page Fault CR2 031 PAGE FAULT LINEAR ADDRESS

33. 33 CR4 CR4 control register 31 7 6 5 4 3 2 1 0 Reserved MCEMCE 0 PSEPSE DEDE TSDTSD PVIPVI VMEVME Machine check enable (i.e. unaligned data) Page Size (4K/4M) Debugging extensions Time stamp disable Protected Mode Virtual Interrupt Virtual 8086 Mode Extensions If pagig is disabled virtual and physical addresses coincide iAPX86 systems can be segmented only, paged only (defining only one big segment – see Linux) and segmented and paged In the new systems bit 7 indicates whether page tables can be shared among many processes. Bit 5 allows 36 bit addressing