AV
Uploaded byAtul Vaish
PPTX, PDF143 views

x86_system_architecture.pptx

The document provides a comprehensive overview of the architecture and operational modes of Intel's IA-32 and IA-32e processors, including system-level operations, memory management, and control registers. It details various operating modes like protected mode, real address mode, system management mode, and 64-bit mode, highlighting their features and system flag definitions. Additionally, the document explains the segmentation and paging mechanisms that facilitate virtual memory systems in the processor architecture.

Embed presentation

Downloaded 17 times
IoT Internals
Intel Confidential Department or Event Name 2 Intel Confidential Department or Event Name 2 2 Overview of System Level Architecture System level architecture provides framework of registers ,data structures and instructions to support basic operations for application programs . This framework includes :- • Memory management, • Interrupt and exception handling • Task management • Control of multiple processors. Note 2 : “Interrupt and exception handling” & “Control of multiple processors” not covered in this slide deck. Note 1: Resources from Intel 64 and IA-32 Architecture Software Developer Manual Volume 3
Intel Confidential Department or Event Name 3 Intel Confidential Department or Event Name 3 3 Overview of Registers and Data Structures in IA-32 Mode Refer from Intel SDM Vol -3 Refer from Intel SDM Vol -3 Memory Management( Paging) Memory Management (Segmentation) Controlling Processor Task Management Interrupt and Exception Handling
Intel Confidential Department or Event Name 4 Intel Confidential Department or Event Name 4 4 Overview of Registers and Data Structures in IA-32e Mode Refer from Intel SDM Vol -3 Memory Management (Paging) Memory Management (Segmentation) Controlling Processor Task Management Interrupt and Exception Handling Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
5 5 5 Mode of Operation x86 supported modes are below :- Protected Mode Real Address Mode System Management Mode Virtual-8086 Mode 64-bit Mode (IA-32e sub mode) Compatibility Mode (IA-32e sub mode) Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 6 Intel Confidential Department or Event Name 6 6 Protected Mode Native Mode of Processor Provides architectural features like segmentation, paging etc. PE (protection-enable) and PG (paging) bits in CR0 enables protection mode and paging. Segmentation is enabled by default.
Intel Confidential Department or Event Name 7 Intel Confidential Department or Event Name 7 7 Real Address Mode • Following Power-Up or Reset. In this mode , PE bit of CR0 is always zero. • Supports real address memory model. • In this memory model , memory is segmented with an array of 16 segments where each segment is 64KBytes and supports 1 MB memory (16*64KB=1MB,2^20 bytes address space) .
Intel Confidential Department or Event Name 8 Intel Confidential Department or Event Name 8 8 System management Mode (SMM) SMM is special mode which provides an OS or executive with a mechanism to implement power management and OEM differentiation features. This mode is entered through SMI (system management interrupt). In SMM , processor switches to separate address space while saving the context of currently running program or task. Upon returning from SMM (uses RSM instruction), processor is placed back into its state prior to the SMI .
Intel Confidential Department or Event Name 9 Intel Confidential Department or Event Name 9 9 Virtual 8086 Mode Its quasi mode in IA-32 protected mode but not supported in IA-32e mode. It allows processor to execute 8086 software in protected , multi-tasking environment. It uses real address memory model same as used in Real Mode. Setting VM bit in EFLAG register enables this mode.
Intel Confidential Department or Event Name 10 Intel Confidential Department or Event Name 10 10 64-bit Mode (IA-32e sub mode) Supports 64-bit linear addressing and physical memory larger than 64GBytes. LME (long mode enable) and LMA (Long mode active) bits in IA32_EFER (extended MSR) tells if processor is in 64-bit mode. In this, segmentation is partially enabled by treating segment base of CS,DS,ES and SS as zero. Hence it creates a flat 64-bit linear address model.
11 11 11 System Flags System Flags supported by EFLAG/RFLAG register. EFLAG is 32-bit flag register . RFLAG is 64-bit register where upper 32-bit is reserved while lower 32-bit is exactly same as EFLAG. These register manages status, control and debugging. Only privileged code can modify system flags. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 12 Intel Confidential Department or Event Name 12 12 System Flag Definitions
13 13 13 Control Registers Following control registers in x86 • CR0 • CR1 (reserved) • CR2 (contains page fault address) • CR4 • CR8 (available in 64-bit mode only) • XCR0 • PKRU
Intel Confidential Department or Event Name 14 Intel Confidential Department or Event Name 14 14 Basics of Control Registers • Decides operating mode of processor and characteristic of the currently executing task. • They are 32-bit in all 32-bit and compatibility mode and 64-bit in 64-bit mode. • They can be modified by MOV CRn instruction at privilege level 0 only. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 15 Intel Confidential Department or Event Name 15 15 CR0 Bit definitions
Intel Confidential Department or Event Name 16 Intel Confidential Department or Event Name 16 16 CR3 (PDBR- Page directory base register) • Contains physical address (20-bit or 52- bit) of paging structure base (Includes all bits except lower 12-bits given page size is 4KB) • Also contains flags PCD (paging cache disable) and PWT (page write through).These flags control caching of paging structure in processor’s internal data cache. • In PAE mode, it is base address of page- directory pointer table and in IA-32e mode , it is base address of PML4 table.
Intel Confidential Department or Event Name 17 Intel Confidential Department or Event Name 17 17 CR4 Bit definitions
Intel Confidential Department or Event Name 18 Intel Confidential Department or Event Name 18 18 CR8 • Provides read/write access to TPR (task priority register). • Controls priority of external interrupts allowed to interrupt processor . • Setting specific priority in bit 3:0 of CR8 allows only interrupts having priority above that can interrupt processor. • TPR and CR8 together decides which interrupt to be allowed and which are not.
Intel Confidential Department or Event Name 19 Intel Confidential Department or Event Name 19 19 XCR0 (Extended Control Register) • CPUID decides whether XCR0 supported or not. • It provides processor states components in form of 8 bits (1:9). • OS can program these bits and provide context management. • The context management is meant to enable what XSAVE feature can do when these bits are set or cleared. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 20 Intel Confidential Department or Event Name 20 20 PKRU (Protection Key Rights Register) • It provides protection-key feature for 4-level paging. • Allows protections via access-disable (AD) and write-disable (WD) bits for user-mode pages with 16 pairs of {AD , WD}. • 4-bit (59:62 for 64-bit page) mentioned in each page decides the protection key for that page. • Protection is only for Data pages. • RDPKRU and WRPKRU instruction can be used to read/write this register.
21 21 21 Segmentation What is Segmentation? Provides a mechanism of isolating code, data and stack of multiple programs running together. Here , processor’s linear address space is divided in multiple smaller segments. A Segment is addressed by Logical address which is “Segment Selector (16-bit)+ Offset (32-bit)”
Intel Confidential Department or Event Name 22 Intel Confidential Department or Event Name 22 22 Segmentation Contd.. • Segment Selector indexes Global Descriptor table (GDT) or LDT (based on TI=Table indicator) to locate Segment descriptors. • A Segment descriptor has base address, access rights, size of segment, privilege level and segment type. • The offset part of logical address is added to the base address of that segment descriptor and this way a byte is accessed in linear address space. • Compilers , Linkers ,Loaders etc. generate segment selectors and offsets for different parts of a program.
Intel Confidential Department or Event Name 23 Intel Confidential Department or Event Name 23 23 Obtaining Physical Address from Segments (2^13)8192 Descriptors NULL descriptor is used to initialize segment. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 24 Intel Confidential Department or Event Name 24 24 Segment Registers and Segment Descriptor Hidden part/Descriptor Cache/Shadow Register In IA-32e mode , all six segment registers are used but in IA32-e mode, ES,DS and SS are not used, Instead canonical form of linear address references are checked than performing limit checks as done in IA-32 mode. 13-bit Selector Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3 Descriptor Size in IA-32 Mode = 8 Byte Descriptor Size in IA-32e Mode = 16 Byte Total Descriptors = 2^13 = 8192
Intel Confidential Department or Event Name 25 Intel Confidential Department or Event Name 25 25 Segment types and bits’ Details • Type fields decides following – • Data segment - E, W and A bits • Code segment - C, R and A bits • System Segment - LDT,TSS, Call gate, Interrupt gate, Trap gate, Task gate • DPL – take values between 0-3 • G,E,C, Type , Limit and DPL fields defines protection mechanism for that segment. • D/B field decides size for operand , effective address, and stack pointer along with upper bound for SS. When S=1 When S=0 Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3 For SS, if E=1 (expand-down), B field sets limit to 4Gbytes(FFFFFFFF) or 64Kbytes(FFFF).
Intel Confidential Department or Event Name 26 Intel Confidential Department or Event Name 26 26 Code Segment and Data Segment Types E-Expand Direction W – write-enable A - Accessed When S=1 C-Conforming R – Read Enable A - Accessed D/B bit for Data Segment decide upper bound when E bit decides if data segment is expand-down or expand-up segment. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 27 Intel Confidential Department or Event Name 27 27 System Segments and Gates Descriptors When S=0 System Segment Descriptors Call gate Descriptors Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 28 Intel Confidential Department or Event Name 28 28 Instruction impacting Segment Registers and Segment Descriptors These instructions change CS or other segments registers as per their usage.
29 29 29 Paging What is Paging? Provides a virtual memory system where virtual address spaces of program’s execution environment are mapped to physical addresses as needed. It too provides isolations among multiple tasks running together. Here each segment is divided into pages(typically 4KB) and stored on disk or in physical memory.
Intel Confidential Department or Event Name 30 Intel Confidential Department or Event Name 30 30 LME LMA NXE ELFAGS PE,PG and WP PSE,PAE,PGE,PCIDE,SMEP,SMAP,PKE Configuration settings 1- 6 enables paging and control it. Physical address of first paging structure CR2 IA32 extended Feature MSR Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3 1 2 4 3 5 1 2 3 4 5 Paging Configuration 6 6
Intel Confidential Department or Event Name 31 Intel Confidential Department or Event Name 31 31 Three Mods of Paging 32-Bit paging PAE-paging 4-level paging PG=1,PAE=0,LME=0 PG=1,PAE=1,LME=0 PG=1,PAE=1,LME=1, Only in IA-32e Mode MAXPHYADDR = 40-bit Page Size = 4KB,4MB Linear Addr. Width = 32-bit MAXPHYADDR = 52-bit (2^52 = 4PBytes) Page Size = 4KB,2MB Linear Addr. Width = 32-bit Supports NXE MAXPHYADDR = 52-bit Page Size = 4KB,2MB,1GB Linear Addr. Width = 48-bit Supports NXE,PCIDE,PKE
Intel Confidential Department or Event Name 32 Intel Confidential Department or Event Name 32 32 32-bit Paging Structure PDE = Page Directory Entry PTE = Page Table Entry PS = Page Size 1024 Entries 1024 Entries 4096 Entries Physical address 4GB Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 33 Intel Confidential Department or Event Name 33 33 32-bit Paging Cont.… 1024 Entries 4GB Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 34 Intel Confidential Department or Event Name 34 34 Selection of PDE from CR3 Entry (Physical address = 40-bit) 0 31:22 of Linear address 0 1024 PDEs 20 Bits (Notice explanation using colour coding of ellipsis and rows in all slides related with paging bits details)
Intel Confidential Department or Event Name 35 Intel Confidential Department or Event Name 35 35 Using 32-bit PDE to decide on Physical Address for 4-Mbyte Page Size (CR4.PSE=1) 20:13 of PDE 31:22 of PDE 21:0 of linear address Present (P:0) Flag Page Size(PS:7) 4Mbyte Address Space
Intel Confidential Department or Event Name 36 Intel Confidential Department or Event Name 36 36 Selection of PTE (4KByte Page Size) from PDE 31:12 of PDE 21:12 of Linear address 0 1024 PTEs 0 Present (P:0) Flag Page Size(PS:7)
Intel Confidential Department or Event Name 37 Intel Confidential Department or Event Name 37 37 Using 32-bit PTE to get final physical Address for 32-bit Linear address 0 31:12 of PTE 11:0 of Linear address Present (P:0) Flag
Intel Confidential Department or Event Name 38 Intel Confidential Department or Event Name 38 38 PAE Paging and Selection of PDPTE 4 Entries 512 Entries 512 Entries 4096 Entries PDPTE = Page-directory Pointer table PDE = Page Directory Entry PTE = Page Table Entry PS = Page Size M = 52-bit Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 39 Intel Confidential Department or Event Name 39 39 PAE Paging Cont.… Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 40 Intel Confidential Department or Event Name 40 40 Selection of PDE from PDPTEi and Linear address 29:21 of Linear Address 0 Present (P:0) Flag 40 bits(12:51)
Intel Confidential Department or Event Name 41 Intel Confidential Department or Event Name 41 41 52-bit PDE points to 2-Mbyte Page or not based on PS flag? Present (P:0) Flag Page Size(PS:7) 20:0 of Linear Address Depends on IA32_EFER.NX E 31 bits(21:51)
Intel Confidential Department or Event Name 42 Intel Confidential Department or Event Name 42 42 Using 52-bit PDE to select PTE Present (P:0) Flag Page Size(PS:7) 20:12 of Linear Address Depends on IA32_EFER.N XE 40 bits(12:51)
Intel Confidential Department or Event Name 43 Intel Confidential Department or Event Name 43 43 Using 52-bit PTE to get final physical address for given 32-bit linear address Present (P:0) Flag Page Size(PS:7) 11:0 of Linear Address Depends on IA32_EFER.N XE 40 bits(12:51)
Intel Confidential Department or Event Name 44 Intel Confidential Department or Event Name 44 44 4-Level Paging (CR4.PCIDE=0) 512 Entries 512 Entries 512 Entries 512 Entries 4096 Entries PML4 = Page map level 4 PDPTE = Page-directory Pointer table PDE = Page Directory Entry PTE = Page Table Entry PS = Page Size Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 45 Intel Confidential Department or Event Name 45 45 4-Level Paging with 2-Mbyte Page Size 512 Entries 512 Entries 512 Entries 2-MByte Entries Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 46 Intel Confidential Department or Event Name 46 46 4-Level Paging 1-Gbyte page Size 512 Entries 512 Entries 1-Gbyte Entries Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 47 Intel Confidential Department or Event Name 47 47 Selection of PML4E from PML4 table address(M=52 bit) 47:39 of Linear Address 0 40 bits(12:51)
Intel Confidential Department or Event Name 48 Intel Confidential Department or Event Name 48 48 Selection of PDPTE from 52-bit PML4E 38:30 of Linear Address 0 Depends on IA32_EFER.N XE Present (P:0) Flag 40 bits(12:51)
Intel Confidential Department or Event Name 49 Intel Confidential Department or Event Name 49 49 PDPTE points to 1 GB Page or not based on PS flag? 29:0 of Linear Address Page Size(PS) Present (P:0) Flag Depends on CR4.PKE and PKRU register Depends on IA32_EFER.N XE 22 bits(30:51)
Intel Confidential Department or Event Name 50 Intel Confidential Department or Event Name 50 50 Selection of PDE from PDPTE 29:21 of Linear Address Page Size(PS:7) Present (P:0) Flag 0 Depends on IA32_EFER.NXE 40 bits(12:51)
Intel Confidential Department or Event Name 51 Intel Confidential Department or Event Name 51 51 PDE points to 2-Mbyte Page or not based on PS flag? 20:0 of Linear Address Page Size(PS:7) Present (P:0) Flag Depends on CR4.PKE and PKRU register. Depends on IA32_EFER.NX E 31 bits(21:51)
Intel Confidential Department or Event Name 52 Intel Confidential Department or Event Name 52 52 Selection of PTE from PDE 20:12 of Linear Address 0 Page Size(PS:7) Present (P:0) Flag Depends on IA32_EFER.NX E 40 bits(12:51)
Intel Confidential Department or Event Name 53 Intel Confidential Department or Event Name 53 53 Using 52-bit PTE to get final physical address for 48-bit linear address 11:0 of Linear Address Present (P:0) Flag Page Size(PS:7) Depends on IA32_EFER.N XE Depends on CR4.PKE and PKRU register 40 bits(12:51)
Intel Confidential Department or Event Name 54 Intel Confidential Department or Event Name 54 54 Access Rights • Supervisor-mode/user-mode( CPL < 3 or CPL =3) • Implicit Supervisor-mode (accessing system data structures) • Explicit Supervisor-mode • Access rights also gets controlled by U/S bit in paging structures. • CR4.SMAP and EFLAGS.AC decides data reads from user-mode linear address while executing in supervisor mode. • CR0.WP , R/W bit in paging structure ,CR4.SMAP and ELFAGS.AC bits decides data writes for supervisor and user-mode addresses. • IA32_EFER.NXE, CR4.SMEP and XD bit in paging structure decides instruction fetches from supervisor mode as well as user mode addresses. • Access rights in TLBs and paging-structure caches might differ from access rights on paging structures in memory. • Protection keys provide additional mechanism in 4-level paging only to decide on data read/write for user-mode linear addresses. It works in conjunction with CR4.PKE,CR4.WP,PKRU register (32-bit) and RDPKRU/WRPKRU instructions.
Intel Confidential Department or Event Name 55 Intel Confidential Department or Event Name 55 55 Page Fault (PF, exception#14) • Page Fault Happens in two cases • Present flag (P:0) in paging structure is set to “0”. • Present flag is set to “1” but access right is not permitted. • SGX-induced page faults are different than above ordinary page faults. • See the Error Code definitions for more details. Error Code definitions Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 56 Intel Confidential Department or Event Name 56 56 PCID (Process Context Identifiers) • CR4.PCIDE enables this feature for 4-level paging only. • TLB entries and paging structure cache entries are associated with a particular PCID. • A logical processor uses TLB and paging cache entries for current PCID only . • Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 57 Intel Confidential Department or Event Name 57 57 TLB (Translation lookaside buffers) Cache individual translation referenced by page number/frame Each translation entry contains information on physical address of page frame, access rights and memory attributes that help translate linear address to physical address. TLB entries are associated with current PCID. Accessed Flag need to be set to 1 to be cached in TLB.
Intel Confidential Department or Event Name 58 Intel Confidential Department or Event Name 58 58 Global Pages CR4.PGE and G flag in paging structure entry for a page enable this feature. With both above bits set to 1, TLB entry cached for this linear address translation is considered as Global. A logical processor may use this global TLB entry for linear address translation irrespective of different PCID value for that TLB entry.
Intel Confidential Department or Event Name 59 Intel Confidential Department or Event Name 59 59 PML4 Cache Referenced by 47:39 bit of Linear address . It contains respective PML4E entry and its flag details. PDPTE,PDE,PTE and final page entries are derived from the cached 52-bit PML4E entry. PML4E entry is cached only when P flag is set to 1. Cached PML4E entry may differ from PML4E entry in memory.
60 60 60 Privilege levels and Protection How Protection works? Protection mechanism operates at segment level by providing four privilege levels say 0-3 where 0 is highest level of protection and 3 is lowest level of protection. Protection mechanism operates at page level by providing two privilege levels say 0-1 where 0 is for supervisor- mode related page s while 1 is for user mode related pages.
Intel Confidential Department or Event Name 61 Intel Confidential Department or Event Name 61 61 Protection Checks • Before any memory cycle, following checks need to be done and if fails ,it raises an exception. • Limit Check – In 32-bi t mode, checks limit field for valid segment access along with G,E and B bits in segment descriptor and also in descriptor table’s limit fields (GDTR ,LDTR and IDTR). No limit checking in 64-bit mode except descriptor table’s limits. • Type Check – checks for valid loads and attributes in segments like code, data , system ,LDTR and TR. Also perform checks on instruction carrying valid segment addresses or types. • Privilege level Checks - Checks CPL, DPL ,RPL . See the next slide for more details. • Restriction of Addressable domain – Checks addressable domains based on segment privilege levels and page- protection levels. • Restriction of Procedure entry points – Performs Call Gates specific Checks as mentioned in further slide. • Restriction of instruction set – Instruction allow to execute only at higher privilege level but not at lower privilege level. Some examples are LGDT,LLDT LTR , LIDT etc… • Beside these, there are instructions who can perform checks on valid segment accesses. Some examples are LAR,LSL,VERR,VERW,ARPL etc.
Intel Confidential Department or Event Name 62 Intel Confidential Department or Event Name 62 62 Privilege levels •Stored in bit 0 and 1 of CS or SS registers. •Get changed as switches b/w code segments of different CPL. •Different behaviour for Conforming Segment. CPL – •Stored in segment descriptor •Different behaviour for TSS, data segment, call gates, nonconforming and conforming code segments based on CPL of current program accessing them. DPL- •Stored in 0 and 1 of segment selector and acts as override to CPL. •Prevents less privilege application code to access a more privileged code accidentally. •Setting to 0 by software disable RPL check. RPL – • Loads DS only if numerically DPL >= (CPL and RPL) • Loading CS causes control transfer (near jump (no check ) and far jump with check) • Load SS only if DPL=CPL=RPL Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 63 Intel Confidential Department or Event Name 63 63 Call Gates • Reside in GDT or LDT but not in IDT (8-byte/16-byte in length). • Specifies an entry point in a code segment with a DPL and param count on stack switch (only 16/32- bit). • Has following way to get called leading to check validity of control transfer based on CPL,RPL and DPL (follow rules same as for DS in previous slide beside conforming/non-conforming segments). • This call may lead to stack switch if required. Call Gat e Type (0CH -32/64bit 04H-16bit) CALL <Far pointer of Call gate > JMP <Far Pointer of Call gate > Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 64 Intel Confidential Department or Event Name 64 64 Page Level Protection • Segment level protection are done first then page protections are evaluated. • Page-level protection enhance segment level protection by providing more granularity. • Two page-level protections are enabled by using U/S and R/W flag in page table entries. • Supervisor mode has access to all pages in R/W mode while User mode has access to only user level pages unless CR0.WP flag is not set. • XD bit provides additional page level protection in PAE and IA-32e mode. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
65 65 65 Task Management What is task in x86 context? A basic unit of work which processor can dispatch, execute and suspend. A Task is made by execution space and TSS . Execution Space = Code +Stack + Data segments TSS = Above Segments Info + Task State Info + Task Linking Info Task is identified using Segment Selector of it’s TSS. TR (task register) loads segment selector and descriptor information once a task is scheduled for execution while paging information is loaded in CR3 register.
Intel Confidential Department or Event Name 66 Intel Confidential Department or Event Name 66 66 TSS Selection in 32-bit mode LTR and STR loads and stores TR Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 67 Intel Confidential Department or Event Name 67 67 Task-State Segment (TSS) in 32-bit mode Dynamic Fields get updated when a task is suspended. Static Fields  get created when during task creation but doesn’t get changed afterwards. Note :The colour coding above defines dynamic and static fields, respectively. 67H (104-1) max limit for TSS Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 68 Intel Confidential Department or Event Name 68 68 TSS in 64-Bit Mode Interrupt Stack Table (IST) Stack Pointers at priv. levels 0-2 Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
Intel Confidential Department or Event Name 69 Intel Confidential Department or Event Name 69 69 Task Gate • As Task descriptor exists in GDT only hence not every procedure or program can access it . • Task fills the gap as it can exists in GDT,LDT or in IDT . • Based on DPL of procedure and task gate , the corresponding task descriptor in GDT can be accessed. • More than one task gates can point to same TSS descriptor ( as shown in next slide) • Interrupts or exception can be handled through different task specified by Task gate in IDT.
Intel Confidential Department or Event Name 70 Intel Confidential Department or Event Name 70 70 Task Gate Contd… Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
71 71 71 EDK2 Examples for System Architecture Implementation tianocore/edk2: EDK II (github.com)
Intel Confidential Department or Event Name 72 Intel Confidential Department or Event Name 72 72 GDT,IDT, and TSS in BIOS
Intel Confidential Department or Event Name 73 Intel Confidential Department or Event Name 73 73 Enable Paging

More Related Content

PPT
80286 education project compiter application .ppt
bydeepparmar73
 
PDF
80386_AKRay.pdf study computer programme
bydeepparmar73
 
PPTX
32- bit Microprocessor-Indtel 80386.pptx
byYuvraj994432
 
PPTX
Protection mode
byDeepak Kumar
 
PDF
Assembly Language for x86 Processors 7th Edition Chapter 2 : x86 Processor Ar...
byssuser65bfce
 
PPT
PERAN DAN TUGAS OPERATOR KAMERA1.ppt
byHaidzarPratama
 
PDF
Richard_Baker-Intel_I-32_Processor_Architecture_Overview
byRichard Baker
 
PPT
Intel microprocessor history lec12_x86arch.ppt
byjeronimored
 
80286 education project compiter application .ppt
bydeepparmar73
 
80386_AKRay.pdf study computer programme
bydeepparmar73
 
32- bit Microprocessor-Indtel 80386.pptx
byYuvraj994432
 
Protection mode
byDeepak Kumar
 
Assembly Language for x86 Processors 7th Edition Chapter 2 : x86 Processor Ar...
byssuser65bfce
 
PERAN DAN TUGAS OPERATOR KAMERA1.ppt
byHaidzarPratama
 
Richard_Baker-Intel_I-32_Processor_Architecture_Overview
byRichard Baker
 
Intel microprocessor history lec12_x86arch.ppt
byjeronimored
 

Similar to x86_system_architecture.pptx

PPT
x86_1.ppt
byjeronimored
 
PPT
Pentium protected mode.ppt
byPramodBorole2
 
PDF
Intel x86 Architecture
byChangWoo Min
 
PDF
Cao 2012
byRaja Basharat
 
PPTX
UNIT-3.pptx digital electronics system 34
byPOOJABHOITE5
 
PPT
Chapter2.ppt Micrprocessor Berry B Breyb
byshafiq41214
 
PPTX
Protected addressing mode and Paging
bymarada0033
 
PPTX
It322 intro 1
byJ Cza Àkera
 
PPTX
Pai unit 1_l1-l2-l3-l4_upload
byYogesh Deshpande
 
PPTX
Microprocessor - Intel Pentium Series
byLaguna State Polytechnic University
 
PPTX
3_Arch_and_Kernels_for_computer_systems.pptx
byverdemarco991
 
PPTX
Making a Process (Virtualizing Memory)
byDavid Evans
 
PDF
Wintel Hell: průvodce devíti kruhy Dantova technologického pekla / MARTIN HRO...
bySecurity Session
 
PDF
nasm_final
byMuhammed Yazar Y
 
PDF
PAI Unit 2 Segmentation in 80386 microprocessor
byKanchanPatil34
 
PPTX
jdsbfvkjsdbfvbasibgvyisbvilawbvslaksbvlawbvrab
byf20230225
 
PPTX
X86 Architecture
byIGZ Software house
 
PPT
Al2ed chapter3
byAbdullelah Al-Fahad
 
PPTX
Segmentation
byPradyumna Doddala
 
PDF
Mateusz 'j00ru' Jurczyk - Windows Kernel Trap Handler and NTVDM Vulnerabiliti...
byDefconRussia
 
x86_1.ppt
byjeronimored
 
Pentium protected mode.ppt
byPramodBorole2
 
Intel x86 Architecture
byChangWoo Min
 
Cao 2012
byRaja Basharat
 
UNIT-3.pptx digital electronics system 34
byPOOJABHOITE5
 
Chapter2.ppt Micrprocessor Berry B Breyb
byshafiq41214
 
Protected addressing mode and Paging
bymarada0033
 
It322 intro 1
byJ Cza Àkera
 
Pai unit 1_l1-l2-l3-l4_upload
byYogesh Deshpande
 
Microprocessor - Intel Pentium Series
byLaguna State Polytechnic University
 
3_Arch_and_Kernels_for_computer_systems.pptx
byverdemarco991
 
Making a Process (Virtualizing Memory)
byDavid Evans
 
Wintel Hell: průvodce devíti kruhy Dantova technologického pekla / MARTIN HRO...
bySecurity Session
 
nasm_final
byMuhammed Yazar Y
 
PAI Unit 2 Segmentation in 80386 microprocessor
byKanchanPatil34
 
jdsbfvkjsdbfvbasibgvyisbvilawbvslaksbvlawbvrab
byf20230225
 
X86 Architecture
byIGZ Software house
 
Al2ed chapter3
byAbdullelah Al-Fahad
 
Segmentation
byPradyumna Doddala
 
Mateusz 'j00ru' Jurczyk - Windows Kernel Trap Handler and NTVDM Vulnerabiliti...
byDefconRussia
 

Recently uploaded

PPTX
Presentation on Purdue model for control hierarchy
bysamplayz126
 
PPTX
firewall Selection in production life pptx
byssuserb1479b
 
PDF
Handheld_Laser_Welding_Presentation 2.pdf
bysinezioveluz
 
PPTX
Introduction Blockchains and Smart Contracts
bybobinson
 
PDF
Advanced Intrusion Detection and Classification using Transfer Learning with ...
byIJCNCJournal
 
PDF
Introduction to a Owners engineering firm and technical advisors
bykllrabhishek
 
PDF
BE-Python-Lab.pdf taught in msrit bangalore
byqsirius12
 
PPTX
TPM Metrics & Measurement: Drive Performance Excellence with TPM | MaintWiz
byMaintWiz Technologies Private Limited
 
PPTX
Track & Monitor Preventive Maintenance — Best Practices with MaintWiz CMMS
byMaintWiz Technologies Private Limited
 
PPTX
Shutdown Maintenance Explained — Full Plant Turnaround & Best Practices with ...
byMaintWiz Technologies Private Limited
 
PPTX
The Complete Guide to Energy Audits_ Unlocking Savings, Sustainability, and P...
bygreentechnexus2024
 
PPTX
Vertical turbine pump explains installed in power plants
bysadanandyadav25
 
PPTX
The Importance of Maintenance Budgets — Maximize Reliability & Control Costs ...
byMaintWiz Technologies Private Limited
 
PDF
TechSprint: Innovate for Impact Hackathon
byDeepakkumarSingh415123
 
PDF
AI-Driven CTI for Business: Emerging Threats, Attack Strategies, and Defensiv...
byAIRCC Publishing Corporation
 
PDF
Materials Science and Engineering an Introduction 10th Edition PDF
bylagef66927
 
PDF
Nostr : A protocol for freedom of speech
byEmre YILMAZ
 
PPTX
Role of In Vitro and In Vivo Testing biomedical engineering
bymarisudha1
 
PPTX
22304_BCO_CO3_LO4_PPT MSBTE Building construction.pptx
byPrasadBahekar4
 
PPTX
KTU 2024 SCHEME -PEMET 413 COMPOSITE MATERIALS MODULE 1 LECTURE 1.pptx
byVinayB68
 
Presentation on Purdue model for control hierarchy
bysamplayz126
 
firewall Selection in production life pptx
byssuserb1479b
 
Handheld_Laser_Welding_Presentation 2.pdf
bysinezioveluz
 
Introduction Blockchains and Smart Contracts
bybobinson
 
Advanced Intrusion Detection and Classification using Transfer Learning with ...
byIJCNCJournal
 
Introduction to a Owners engineering firm and technical advisors
bykllrabhishek
 
BE-Python-Lab.pdf taught in msrit bangalore
byqsirius12
 
TPM Metrics & Measurement: Drive Performance Excellence with TPM | MaintWiz
byMaintWiz Technologies Private Limited
 
Track & Monitor Preventive Maintenance — Best Practices with MaintWiz CMMS
byMaintWiz Technologies Private Limited
 
Shutdown Maintenance Explained — Full Plant Turnaround & Best Practices with ...
byMaintWiz Technologies Private Limited
 
The Complete Guide to Energy Audits_ Unlocking Savings, Sustainability, and P...
bygreentechnexus2024
 
Vertical turbine pump explains installed in power plants
bysadanandyadav25
 
The Importance of Maintenance Budgets — Maximize Reliability & Control Costs ...
byMaintWiz Technologies Private Limited
 
TechSprint: Innovate for Impact Hackathon
byDeepakkumarSingh415123
 
AI-Driven CTI for Business: Emerging Threats, Attack Strategies, and Defensiv...
byAIRCC Publishing Corporation
 
Materials Science and Engineering an Introduction 10th Edition PDF
bylagef66927
 
Nostr : A protocol for freedom of speech
byEmre YILMAZ
 
Role of In Vitro and In Vivo Testing biomedical engineering
bymarisudha1
 
22304_BCO_CO3_LO4_PPT MSBTE Building construction.pptx
byPrasadBahekar4
 
KTU 2024 SCHEME -PEMET 413 COMPOSITE MATERIALS MODULE 1 LECTURE 1.pptx
byVinayB68
 

x86_system_architecture.pptx

  • 1.
  • 2.
    Intel Confidential Department orEvent Name 2 Intel Confidential Department or Event Name 2 2 Overview of System Level Architecture System level architecture provides framework of registers ,data structures and instructions to support basic operations for application programs . This framework includes :- • Memory management, • Interrupt and exception handling • Task management • Control of multiple processors. Note 2 : “Interrupt and exception handling” & “Control of multiple processors” not covered in this slide deck. Note 1: Resources from Intel 64 and IA-32 Architecture Software Developer Manual Volume 3
  • 3.
    Intel Confidential Department orEvent Name 3 Intel Confidential Department or Event Name 3 3 Overview of Registers and Data Structures in IA-32 Mode Refer from Intel SDM Vol -3 Refer from Intel SDM Vol -3 Memory Management( Paging) Memory Management (Segmentation) Controlling Processor Task Management Interrupt and Exception Handling
  • 4.
    Intel Confidential Department orEvent Name 4 Intel Confidential Department or Event Name 4 4 Overview of Registers and Data Structures in IA-32e Mode Refer from Intel SDM Vol -3 Memory Management (Paging) Memory Management (Segmentation) Controlling Processor Task Management Interrupt and Exception Handling Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 5.
    5 5 5 Mode of Operation x86 supportedmodes are below :- Protected Mode Real Address Mode System Management Mode Virtual-8086 Mode 64-bit Mode (IA-32e sub mode) Compatibility Mode (IA-32e sub mode) Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 6.
    Intel Confidential Department orEvent Name 6 Intel Confidential Department or Event Name 6 6 Protected Mode Native Mode of Processor Provides architectural features like segmentation, paging etc. PE (protection-enable) and PG (paging) bits in CR0 enables protection mode and paging. Segmentation is enabled by default.
  • 7.
    Intel Confidential Department orEvent Name 7 Intel Confidential Department or Event Name 7 7 Real Address Mode • Following Power-Up or Reset. In this mode , PE bit of CR0 is always zero. • Supports real address memory model. • In this memory model , memory is segmented with an array of 16 segments where each segment is 64KBytes and supports 1 MB memory (16*64KB=1MB,2^20 bytes address space) .
  • 8.
    Intel Confidential Department orEvent Name 8 Intel Confidential Department or Event Name 8 8 System management Mode (SMM) SMM is special mode which provides an OS or executive with a mechanism to implement power management and OEM differentiation features. This mode is entered through SMI (system management interrupt). In SMM , processor switches to separate address space while saving the context of currently running program or task. Upon returning from SMM (uses RSM instruction), processor is placed back into its state prior to the SMI .
  • 9.
    Intel Confidential Department orEvent Name 9 Intel Confidential Department or Event Name 9 9 Virtual 8086 Mode Its quasi mode in IA-32 protected mode but not supported in IA-32e mode. It allows processor to execute 8086 software in protected , multi-tasking environment. It uses real address memory model same as used in Real Mode. Setting VM bit in EFLAG register enables this mode.
  • 10.
    Intel Confidential Department orEvent Name 10 Intel Confidential Department or Event Name 10 10 64-bit Mode (IA-32e sub mode) Supports 64-bit linear addressing and physical memory larger than 64GBytes. LME (long mode enable) and LMA (Long mode active) bits in IA32_EFER (extended MSR) tells if processor is in 64-bit mode. In this, segmentation is partially enabled by treating segment base of CS,DS,ES and SS as zero. Hence it creates a flat 64-bit linear address model.
  • 11.
    11 11 11 System Flags System Flagssupported by EFLAG/RFLAG register. EFLAG is 32-bit flag register . RFLAG is 64-bit register where upper 32-bit is reserved while lower 32-bit is exactly same as EFLAG. These register manages status, control and debugging. Only privileged code can modify system flags. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 12.
    Intel Confidential Department orEvent Name 12 Intel Confidential Department or Event Name 12 12 System Flag Definitions
  • 13.
    13 13 13 Control Registers Following controlregisters in x86 • CR0 • CR1 (reserved) • CR2 (contains page fault address) • CR4 • CR8 (available in 64-bit mode only) • XCR0 • PKRU
  • 14.
    Intel Confidential Department orEvent Name 14 Intel Confidential Department or Event Name 14 14 Basics of Control Registers • Decides operating mode of processor and characteristic of the currently executing task. • They are 32-bit in all 32-bit and compatibility mode and 64-bit in 64-bit mode. • They can be modified by MOV CRn instruction at privilege level 0 only. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 15.
    Intel Confidential Department orEvent Name 15 Intel Confidential Department or Event Name 15 15 CR0 Bit definitions
  • 16.
    Intel Confidential Department orEvent Name 16 Intel Confidential Department or Event Name 16 16 CR3 (PDBR- Page directory base register) • Contains physical address (20-bit or 52- bit) of paging structure base (Includes all bits except lower 12-bits given page size is 4KB) • Also contains flags PCD (paging cache disable) and PWT (page write through).These flags control caching of paging structure in processor’s internal data cache. • In PAE mode, it is base address of page- directory pointer table and in IA-32e mode , it is base address of PML4 table.
  • 17.
    Intel Confidential Department orEvent Name 17 Intel Confidential Department or Event Name 17 17 CR4 Bit definitions
  • 18.
    Intel Confidential Department orEvent Name 18 Intel Confidential Department or Event Name 18 18 CR8 • Provides read/write access to TPR (task priority register). • Controls priority of external interrupts allowed to interrupt processor . • Setting specific priority in bit 3:0 of CR8 allows only interrupts having priority above that can interrupt processor. • TPR and CR8 together decides which interrupt to be allowed and which are not.
  • 19.
    Intel Confidential Department orEvent Name 19 Intel Confidential Department or Event Name 19 19 XCR0 (Extended Control Register) • CPUID decides whether XCR0 supported or not. • It provides processor states components in form of 8 bits (1:9). • OS can program these bits and provide context management. • The context management is meant to enable what XSAVE feature can do when these bits are set or cleared. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 20.
    Intel Confidential Department orEvent Name 20 Intel Confidential Department or Event Name 20 20 PKRU (Protection Key Rights Register) • It provides protection-key feature for 4-level paging. • Allows protections via access-disable (AD) and write-disable (WD) bits for user-mode pages with 16 pairs of {AD , WD}. • 4-bit (59:62 for 64-bit page) mentioned in each page decides the protection key for that page. • Protection is only for Data pages. • RDPKRU and WRPKRU instruction can be used to read/write this register.
  • 21.
    21 21 21 Segmentation What is Segmentation? Providesa mechanism of isolating code, data and stack of multiple programs running together. Here , processor’s linear address space is divided in multiple smaller segments. A Segment is addressed by Logical address which is “Segment Selector (16-bit)+ Offset (32-bit)”
  • 22.
    Intel Confidential Department orEvent Name 22 Intel Confidential Department or Event Name 22 22 Segmentation Contd.. • Segment Selector indexes Global Descriptor table (GDT) or LDT (based on TI=Table indicator) to locate Segment descriptors. • A Segment descriptor has base address, access rights, size of segment, privilege level and segment type. • The offset part of logical address is added to the base address of that segment descriptor and this way a byte is accessed in linear address space. • Compilers , Linkers ,Loaders etc. generate segment selectors and offsets for different parts of a program.
  • 23.
    Intel Confidential Department orEvent Name 23 Intel Confidential Department or Event Name 23 23 Obtaining Physical Address from Segments (2^13)8192 Descriptors NULL descriptor is used to initialize segment. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 24.
    Intel Confidential Department orEvent Name 24 Intel Confidential Department or Event Name 24 24 Segment Registers and Segment Descriptor Hidden part/Descriptor Cache/Shadow Register In IA-32e mode , all six segment registers are used but in IA32-e mode, ES,DS and SS are not used, Instead canonical form of linear address references are checked than performing limit checks as done in IA-32 mode. 13-bit Selector Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3 Descriptor Size in IA-32 Mode = 8 Byte Descriptor Size in IA-32e Mode = 16 Byte Total Descriptors = 2^13 = 8192
  • 25.
    Intel Confidential Department orEvent Name 25 Intel Confidential Department or Event Name 25 25 Segment types and bits’ Details • Type fields decides following – • Data segment - E, W and A bits • Code segment - C, R and A bits • System Segment - LDT,TSS, Call gate, Interrupt gate, Trap gate, Task gate • DPL – take values between 0-3 • G,E,C, Type , Limit and DPL fields defines protection mechanism for that segment. • D/B field decides size for operand , effective address, and stack pointer along with upper bound for SS. When S=1 When S=0 Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3 For SS, if E=1 (expand-down), B field sets limit to 4Gbytes(FFFFFFFF) or 64Kbytes(FFFF).
  • 26.
    Intel Confidential Department orEvent Name 26 Intel Confidential Department or Event Name 26 26 Code Segment and Data Segment Types E-Expand Direction W – write-enable A - Accessed When S=1 C-Conforming R – Read Enable A - Accessed D/B bit for Data Segment decide upper bound when E bit decides if data segment is expand-down or expand-up segment. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 27.
    Intel Confidential Department orEvent Name 27 Intel Confidential Department or Event Name 27 27 System Segments and Gates Descriptors When S=0 System Segment Descriptors Call gate Descriptors Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 28.
    Intel Confidential Department orEvent Name 28 Intel Confidential Department or Event Name 28 28 Instruction impacting Segment Registers and Segment Descriptors These instructions change CS or other segments registers as per their usage.
  • 29.
    29 29 29 Paging What is Paging? Providesa virtual memory system where virtual address spaces of program’s execution environment are mapped to physical addresses as needed. It too provides isolations among multiple tasks running together. Here each segment is divided into pages(typically 4KB) and stored on disk or in physical memory.
  • 30.
    Intel Confidential Department orEvent Name 30 Intel Confidential Department or Event Name 30 30 LME LMA NXE ELFAGS PE,PG and WP PSE,PAE,PGE,PCIDE,SMEP,SMAP,PKE Configuration settings 1- 6 enables paging and control it. Physical address of first paging structure CR2 IA32 extended Feature MSR Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3 1 2 4 3 5 1 2 3 4 5 Paging Configuration 6 6
  • 31.
    Intel Confidential Department orEvent Name 31 Intel Confidential Department or Event Name 31 31 Three Mods of Paging 32-Bit paging PAE-paging 4-level paging PG=1,PAE=0,LME=0 PG=1,PAE=1,LME=0 PG=1,PAE=1,LME=1, Only in IA-32e Mode MAXPHYADDR = 40-bit Page Size = 4KB,4MB Linear Addr. Width = 32-bit MAXPHYADDR = 52-bit (2^52 = 4PBytes) Page Size = 4KB,2MB Linear Addr. Width = 32-bit Supports NXE MAXPHYADDR = 52-bit Page Size = 4KB,2MB,1GB Linear Addr. Width = 48-bit Supports NXE,PCIDE,PKE
  • 32.
    Intel Confidential Department orEvent Name 32 Intel Confidential Department or Event Name 32 32 32-bit Paging Structure PDE = Page Directory Entry PTE = Page Table Entry PS = Page Size 1024 Entries 1024 Entries 4096 Entries Physical address 4GB Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 33.
    Intel Confidential Department orEvent Name 33 Intel Confidential Department or Event Name 33 33 32-bit Paging Cont.… 1024 Entries 4GB Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 34.
    Intel Confidential Department orEvent Name 34 Intel Confidential Department or Event Name 34 34 Selection of PDE from CR3 Entry (Physical address = 40-bit) 0 31:22 of Linear address 0 1024 PDEs 20 Bits (Notice explanation using colour coding of ellipsis and rows in all slides related with paging bits details)
  • 35.
    Intel Confidential Department orEvent Name 35 Intel Confidential Department or Event Name 35 35 Using 32-bit PDE to decide on Physical Address for 4-Mbyte Page Size (CR4.PSE=1) 20:13 of PDE 31:22 of PDE 21:0 of linear address Present (P:0) Flag Page Size(PS:7) 4Mbyte Address Space
  • 36.
    Intel Confidential Department orEvent Name 36 Intel Confidential Department or Event Name 36 36 Selection of PTE (4KByte Page Size) from PDE 31:12 of PDE 21:12 of Linear address 0 1024 PTEs 0 Present (P:0) Flag Page Size(PS:7)
  • 37.
    Intel Confidential Department orEvent Name 37 Intel Confidential Department or Event Name 37 37 Using 32-bit PTE to get final physical Address for 32-bit Linear address 0 31:12 of PTE 11:0 of Linear address Present (P:0) Flag
  • 38.
    Intel Confidential Department orEvent Name 38 Intel Confidential Department or Event Name 38 38 PAE Paging and Selection of PDPTE 4 Entries 512 Entries 512 Entries 4096 Entries PDPTE = Page-directory Pointer table PDE = Page Directory Entry PTE = Page Table Entry PS = Page Size M = 52-bit Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 39.
    Intel Confidential Department orEvent Name 39 Intel Confidential Department or Event Name 39 39 PAE Paging Cont.… Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 40.
    Intel Confidential Department orEvent Name 40 Intel Confidential Department or Event Name 40 40 Selection of PDE from PDPTEi and Linear address 29:21 of Linear Address 0 Present (P:0) Flag 40 bits(12:51)
  • 41.
    Intel Confidential Department orEvent Name 41 Intel Confidential Department or Event Name 41 41 52-bit PDE points to 2-Mbyte Page or not based on PS flag? Present (P:0) Flag Page Size(PS:7) 20:0 of Linear Address Depends on IA32_EFER.NX E 31 bits(21:51)
  • 42.
    Intel Confidential Department orEvent Name 42 Intel Confidential Department or Event Name 42 42 Using 52-bit PDE to select PTE Present (P:0) Flag Page Size(PS:7) 20:12 of Linear Address Depends on IA32_EFER.N XE 40 bits(12:51)
  • 43.
    Intel Confidential Department orEvent Name 43 Intel Confidential Department or Event Name 43 43 Using 52-bit PTE to get final physical address for given 32-bit linear address Present (P:0) Flag Page Size(PS:7) 11:0 of Linear Address Depends on IA32_EFER.N XE 40 bits(12:51)
  • 44.
    Intel Confidential Department orEvent Name 44 Intel Confidential Department or Event Name 44 44 4-Level Paging (CR4.PCIDE=0) 512 Entries 512 Entries 512 Entries 512 Entries 4096 Entries PML4 = Page map level 4 PDPTE = Page-directory Pointer table PDE = Page Directory Entry PTE = Page Table Entry PS = Page Size Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 45.
    Intel Confidential Department orEvent Name 45 Intel Confidential Department or Event Name 45 45 4-Level Paging with 2-Mbyte Page Size 512 Entries 512 Entries 512 Entries 2-MByte Entries Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 46.
    Intel Confidential Department orEvent Name 46 Intel Confidential Department or Event Name 46 46 4-Level Paging 1-Gbyte page Size 512 Entries 512 Entries 1-Gbyte Entries Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 47.
    Intel Confidential Department orEvent Name 47 Intel Confidential Department or Event Name 47 47 Selection of PML4E from PML4 table address(M=52 bit) 47:39 of Linear Address 0 40 bits(12:51)
  • 48.
    Intel Confidential Department orEvent Name 48 Intel Confidential Department or Event Name 48 48 Selection of PDPTE from 52-bit PML4E 38:30 of Linear Address 0 Depends on IA32_EFER.N XE Present (P:0) Flag 40 bits(12:51)
  • 49.
    Intel Confidential Department orEvent Name 49 Intel Confidential Department or Event Name 49 49 PDPTE points to 1 GB Page or not based on PS flag? 29:0 of Linear Address Page Size(PS) Present (P:0) Flag Depends on CR4.PKE and PKRU register Depends on IA32_EFER.N XE 22 bits(30:51)
  • 50.
    Intel Confidential Department orEvent Name 50 Intel Confidential Department or Event Name 50 50 Selection of PDE from PDPTE 29:21 of Linear Address Page Size(PS:7) Present (P:0) Flag 0 Depends on IA32_EFER.NXE 40 bits(12:51)
  • 51.
    Intel Confidential Department orEvent Name 51 Intel Confidential Department or Event Name 51 51 PDE points to 2-Mbyte Page or not based on PS flag? 20:0 of Linear Address Page Size(PS:7) Present (P:0) Flag Depends on CR4.PKE and PKRU register. Depends on IA32_EFER.NX E 31 bits(21:51)
  • 52.
    Intel Confidential Department orEvent Name 52 Intel Confidential Department or Event Name 52 52 Selection of PTE from PDE 20:12 of Linear Address 0 Page Size(PS:7) Present (P:0) Flag Depends on IA32_EFER.NX E 40 bits(12:51)
  • 53.
    Intel Confidential Department orEvent Name 53 Intel Confidential Department or Event Name 53 53 Using 52-bit PTE to get final physical address for 48-bit linear address 11:0 of Linear Address Present (P:0) Flag Page Size(PS:7) Depends on IA32_EFER.N XE Depends on CR4.PKE and PKRU register 40 bits(12:51)
  • 54.
    Intel Confidential Department orEvent Name 54 Intel Confidential Department or Event Name 54 54 Access Rights • Supervisor-mode/user-mode( CPL < 3 or CPL =3) • Implicit Supervisor-mode (accessing system data structures) • Explicit Supervisor-mode • Access rights also gets controlled by U/S bit in paging structures. • CR4.SMAP and EFLAGS.AC decides data reads from user-mode linear address while executing in supervisor mode. • CR0.WP , R/W bit in paging structure ,CR4.SMAP and ELFAGS.AC bits decides data writes for supervisor and user-mode addresses. • IA32_EFER.NXE, CR4.SMEP and XD bit in paging structure decides instruction fetches from supervisor mode as well as user mode addresses. • Access rights in TLBs and paging-structure caches might differ from access rights on paging structures in memory. • Protection keys provide additional mechanism in 4-level paging only to decide on data read/write for user-mode linear addresses. It works in conjunction with CR4.PKE,CR4.WP,PKRU register (32-bit) and RDPKRU/WRPKRU instructions.
  • 55.
    Intel Confidential Department orEvent Name 55 Intel Confidential Department or Event Name 55 55 Page Fault (PF, exception#14) • Page Fault Happens in two cases • Present flag (P:0) in paging structure is set to “0”. • Present flag is set to “1” but access right is not permitted. • SGX-induced page faults are different than above ordinary page faults. • See the Error Code definitions for more details. Error Code definitions Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 56.
    Intel Confidential Department orEvent Name 56 Intel Confidential Department or Event Name 56 56 PCID (Process Context Identifiers) • CR4.PCIDE enables this feature for 4-level paging only. • TLB entries and paging structure cache entries are associated with a particular PCID. • A logical processor uses TLB and paging cache entries for current PCID only . • Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 57.
    Intel Confidential Department orEvent Name 57 Intel Confidential Department or Event Name 57 57 TLB (Translation lookaside buffers) Cache individual translation referenced by page number/frame Each translation entry contains information on physical address of page frame, access rights and memory attributes that help translate linear address to physical address. TLB entries are associated with current PCID. Accessed Flag need to be set to 1 to be cached in TLB.
  • 58.
    Intel Confidential Department orEvent Name 58 Intel Confidential Department or Event Name 58 58 Global Pages CR4.PGE and G flag in paging structure entry for a page enable this feature. With both above bits set to 1, TLB entry cached for this linear address translation is considered as Global. A logical processor may use this global TLB entry for linear address translation irrespective of different PCID value for that TLB entry.
  • 59.
    Intel Confidential Department orEvent Name 59 Intel Confidential Department or Event Name 59 59 PML4 Cache Referenced by 47:39 bit of Linear address . It contains respective PML4E entry and its flag details. PDPTE,PDE,PTE and final page entries are derived from the cached 52-bit PML4E entry. PML4E entry is cached only when P flag is set to 1. Cached PML4E entry may differ from PML4E entry in memory.
  • 60.
    60 60 60 Privilege levels and Protection HowProtection works? Protection mechanism operates at segment level by providing four privilege levels say 0-3 where 0 is highest level of protection and 3 is lowest level of protection. Protection mechanism operates at page level by providing two privilege levels say 0-1 where 0 is for supervisor- mode related page s while 1 is for user mode related pages.
  • 61.
    Intel Confidential Department orEvent Name 61 Intel Confidential Department or Event Name 61 61 Protection Checks • Before any memory cycle, following checks need to be done and if fails ,it raises an exception. • Limit Check – In 32-bi t mode, checks limit field for valid segment access along with G,E and B bits in segment descriptor and also in descriptor table’s limit fields (GDTR ,LDTR and IDTR). No limit checking in 64-bit mode except descriptor table’s limits. • Type Check – checks for valid loads and attributes in segments like code, data , system ,LDTR and TR. Also perform checks on instruction carrying valid segment addresses or types. • Privilege level Checks - Checks CPL, DPL ,RPL . See the next slide for more details. • Restriction of Addressable domain – Checks addressable domains based on segment privilege levels and page- protection levels. • Restriction of Procedure entry points – Performs Call Gates specific Checks as mentioned in further slide. • Restriction of instruction set – Instruction allow to execute only at higher privilege level but not at lower privilege level. Some examples are LGDT,LLDT LTR , LIDT etc… • Beside these, there are instructions who can perform checks on valid segment accesses. Some examples are LAR,LSL,VERR,VERW,ARPL etc.
  • 62.
    Intel Confidential Department orEvent Name 62 Intel Confidential Department or Event Name 62 62 Privilege levels •Stored in bit 0 and 1 of CS or SS registers. •Get changed as switches b/w code segments of different CPL. •Different behaviour for Conforming Segment. CPL – •Stored in segment descriptor •Different behaviour for TSS, data segment, call gates, nonconforming and conforming code segments based on CPL of current program accessing them. DPL- •Stored in 0 and 1 of segment selector and acts as override to CPL. •Prevents less privilege application code to access a more privileged code accidentally. •Setting to 0 by software disable RPL check. RPL – • Loads DS only if numerically DPL >= (CPL and RPL) • Loading CS causes control transfer (near jump (no check ) and far jump with check) • Load SS only if DPL=CPL=RPL Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 63.
    Intel Confidential Department orEvent Name 63 Intel Confidential Department or Event Name 63 63 Call Gates • Reside in GDT or LDT but not in IDT (8-byte/16-byte in length). • Specifies an entry point in a code segment with a DPL and param count on stack switch (only 16/32- bit). • Has following way to get called leading to check validity of control transfer based on CPL,RPL and DPL (follow rules same as for DS in previous slide beside conforming/non-conforming segments). • This call may lead to stack switch if required. Call Gat e Type (0CH -32/64bit 04H-16bit) CALL <Far pointer of Call gate > JMP <Far Pointer of Call gate > Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 64.
    Intel Confidential Department orEvent Name 64 Intel Confidential Department or Event Name 64 64 Page Level Protection • Segment level protection are done first then page protections are evaluated. • Page-level protection enhance segment level protection by providing more granularity. • Two page-level protections are enabled by using U/S and R/W flag in page table entries. • Supervisor mode has access to all pages in R/W mode while User mode has access to only user level pages unless CR0.WP flag is not set. • XD bit provides additional page level protection in PAE and IA-32e mode. Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 65.
    65 65 65 Task Management What istask in x86 context? A basic unit of work which processor can dispatch, execute and suspend. A Task is made by execution space and TSS . Execution Space = Code +Stack + Data segments TSS = Above Segments Info + Task State Info + Task Linking Info Task is identified using Segment Selector of it’s TSS. TR (task register) loads segment selector and descriptor information once a task is scheduled for execution while paging information is loaded in CR3 register.
  • 66.
    Intel Confidential Department orEvent Name 66 Intel Confidential Department or Event Name 66 66 TSS Selection in 32-bit mode LTR and STR loads and stores TR Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 67.
    Intel Confidential Department orEvent Name 67 Intel Confidential Department or Event Name 67 67 Task-State Segment (TSS) in 32-bit mode Dynamic Fields get updated when a task is suspended. Static Fields  get created when during task creation but doesn’t get changed afterwards. Note :The colour coding above defines dynamic and static fields, respectively. 67H (104-1) max limit for TSS Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 68.
    Intel Confidential Department orEvent Name 68 Intel Confidential Department or Event Name 68 68 TSS in 64-Bit Mode Interrupt Stack Table (IST) Stack Pointers at priv. levels 0-2 Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 69.
    Intel Confidential Department orEvent Name 69 Intel Confidential Department or Event Name 69 69 Task Gate • As Task descriptor exists in GDT only hence not every procedure or program can access it . • Task fills the gap as it can exists in GDT,LDT or in IDT . • Based on DPL of procedure and task gate , the corresponding task descriptor in GDT can be accessed. • More than one task gates can point to same TSS descriptor ( as shown in next slide) • Interrupts or exception can be handled through different task specified by Task gate in IDT.
  • 70.
    Intel Confidential Department orEvent Name 70 Intel Confidential Department or Event Name 70 70 Task Gate Contd… Reference from Intel® 64 and IA-32 Architecture Software Developer’s Manual Vol 3
  • 71.
    71 71 71 EDK2 Examples for SystemArchitecture Implementation tianocore/edk2: EDK II (github.com)
  • 72.
    Intel Confidential Department orEvent Name 72 Intel Confidential Department or Event Name 72 72 GDT,IDT, and TSS in BIOS
  • 73.
    Intel Confidential Department orEvent Name 73 Intel Confidential Department or Event Name 73 73 Enable Paging