保护模式的软件体系结构课件.ppt

1、第三章 80386DX 保护模式的软件体系结构 P255,Line 4:8x256=2048,LIMIT=07FF16P269,Line-10:FE16=111111102n上电或复位时，进入实模式。nWindows/Linux在实模式下进行初始化，之后便立即转到保护模式。n用控制寄存器CR0可以实现实模式与保护模式的转换。n保护模式提供了支持片内存贮器管理技术、虚拟存贮技术、存贮器分段分页保护技术。这些技术为微机环境下实现多任务操作系统提供了有力的支持。Protected-Mode Register Model保护模式的寄存器模型nGDTR:全局描述符表寄存器 nLDTR:局部描述符表寄存器

2、 nIDTR:中断描述符表寄存器 nTR:任务寄存器 nEIP:32 bits in lengthnEFLAGSnCR0,CR1,CR2,CR3nDR0-DR7(Debug registers)nTR6-TR7(Test registers)EIPCSDSSSESFSGSAXBXCXDXSPBPSIDIEFLAGSGDTRIDTRLDTRCR0CR1CR2CR3TRDR0DR1DR2DR3DR4DR5DR6DR7TR6TR7LimitLimitBaseBase0151647MSWProtected-Mode Register Model保护模式的寄存器模型nGDTR:global descri

3、ptor tablenLDTR:local descriptor tablenIDTR:interrupt descriptor tablenTR:task registernEIP:32 bits in lengthnEFLAGSnCR0,CR1,CR2,CR3nDR0-DR7(Debug registers)nTR6-TR7(Test registers)EIPCSDSSSESFSGSAXBXCXDXSPBPSIDIEFLAGSGDTRIDTRLDTRCR0CR1CR2CR3TRDR0DR1DR2DR3DR4DR5DR6DR7TR6TR7LimitLimitBaseBase0151647M

4、SW段描述符n分段/分页n存贮器的虚拟地址须先由分段部件转换为线性地址，再由分页部件转换为物理地址。n虚拟地址/线性地址/物理地址n线性地址由段基址和段内偏移量相加得到。段内偏移量位（段最大4GB），段基地址仍然由位的段寄存器选择。n段描述符n段寄存器的内容，是个被称为段描述符的索引值，所检索到的表项叫做段描述符，每个段描述符含个字节，其中包括了位的段基址。n段描述符在全局/局部描述符表（GDT/LDT)中。全局描述符表GDTn全局存贮器是一种共享系统资源，该存贮器可以被的所有任务访问。n全局描述符表GDT是用来定义全局存贮器空间的一种机制，它用段描述符说明一个全局存贮器中的段，每个GDT最多

5、含有8192个描述符。GDT是位于存贮器中，用全局描述符表寄存器GDTR指出它的位置和大小。nTSS/Gate等位于GDT中nLIMIT=size-1BASELIMIT0471615081911全局描述符表GDT全局描述符表寄存器GDTR)MAX:64k bytes 8K entriesn例8.1(p252)n例8.2中断描述符表IDT n每个中断门描述符包含个字节nIDT最多包含256个门描述符 n中断门指出的是中断服务程序的入口 n中断/异常BASELIMIT047161502551中断门描述符表 IDT中断门描述符表寄存器IDTRMAX:2k bytes 256 entriesn例8.3

6、(p255)n例8.4n和的值必须在进入保护模式之前装入。局部描述符表n保护模式提供了多任务的环境n系统中设置一个公用的全局描述符表n和所有任务有关的公用段的描述符放在全局描述符表中。n每个任务建一个局部描述符表n定义的是某项任务用到的局部存贮器地址空间。n只含有与系统中某一个任务相关的各个段的描述符n每一任务的代码段、数据段、堆栈段与系统其它部分隔离开。n每项任务都有自己的（且每项任务只能有个）n保护模式的软件系统可能有多个局部描述符表nLDTR是一个位的选择符n指向了一个LDT描述符(在GDT中）nLDT描述符（而不是LDTR)指出了LDT的位置和大小LIMITBASELIMITBASEs

7、elector0001515153131GDTRLDTRLDTRcacheprogram invisibleGDTLDT0LDTnControl RegistersnMSW:CR0nthe lower 5 bits of CR0 are system-control flagsnPE:protected-mode enable bitnAt reset,PE is cleared.(real mode)nSet PE to 1 to enter protected modenOnce in protected mode,386 cannot be switched back to real m

8、ode under SW control01523317CR0CR3CR2CR1RESERVEDRESERVEDPage Fault Linear AddressPage Directory Base RegisterPGMPEMTSRPEMP:math presentEM:emulateR:extension typeTS:task switched控制寄存器 n机器状态字 :CR0n低位是系统控制标志 nPE:保护模式允许标志 nAt reset,PE is cleared.(real mode)nSet PE to 1 to enter protected modenOnce in pr

9、otected mode,286 cannot be switched back to real mode under SW control01523317CR0CR3CR2CR1RESERVEDRESERVEDPage Fault Linear AddressPage Directory Base RegisterPGMPEMTSRPEMP:运算协处理器存在位 EM:软件模拟器执行数学运算 R:=0,80287;=1,80387TS:task switched8.2.5 任务寄存器 n位的选择符，其内容为索引值n选中的是描述符 n每个任务都有属于自己的任务状态段 n描述符放在全局描述符表中

10、nTSS:task state segment;information needed to initiate the task,such as initial values for the user-accessible registersPhysical MemoryGDTTSSTSS descriptorTRBASELIMIT0151647n例8.5(p257)n例8.6nSoft-ICEnCtrl+DnHnx8.2.6 改变功能的寄存器：段寄存器段寄存器nCS:EIP=0008:804F1266 SS:ESP=0010:8053CED8nEAX=FFDFFCD4 EBX=FFDFF000

11、 ECX=00002F26 EDX=00000000nESI=805453E0 EDI=80545640 EBP=FFDFF980 EFL=00000206nDS=0023 ES=0023 FS=0030 GS=0000段寄存器的格式段寄存器的格式,16位位1-0Requested PrivilegeLevel(RPL)Indicates selector privilegelevel desired2Table Indicator(TI)TI=0 use global descriptor table(GDT)TI=1 use local descriptor table(LDT)15-3I

12、ndexselect descriptor entry in table INDEX TI RPLn例8.7(p258)nExample:CS:1007H,GDT base 00100000H,LDT base 00120000Hn(CS)=0001 0000 0000 0111:RPL=3,TI=1,Index=0001 0000 0000 0nAddress of the segment descriptor=00120000H+1000H=00121000H8.2.6 改变功能的寄存器：EFLAGSnVM:virtual 8086 Mode-system flagnset only in

13、 Protected Mode by IRET instruction and by task switchesnunaffected by POPFnRF:resume flag-system flagnin conjunction with the debug register breakpointsnNT:nested task flag-system flagnindicates that the execution of this task is nested within another tasknIOPL:input/output privilege flag-system fl

14、agnindicates the numerically maximum CPL value permitted to execute I/O instructionsP.280EFL=00000206 PF IF IOPL=0TI8.3 Protected Memory Management and Address TranslationnVirtual Address and Virtual Address Spacenvirtual address:selector(16-bit):offset(32-bit)selectoroffset4732310INDEXn214(16,384=1

15、6K)unique segments of memory,each of which has a maximum size of 4G bytesnTotal virtual address space=246,64 TBnWhy not 248?n1KB=1024B,1MB=1024KB,1GB=1024B,1TB=1024GB,1PB=1024TBRPL8.3.2 虚拟地址空间的分段 Global segment 8191Local address space 32 TerabytesGlobal address space 32 TerabytesVirtual Address Spac

16、e64 TerabytesnSegment Partitioning of the Virtual Address SpaceLocal segment 8191Local segment 1Local segment 0Global segment 1Global segment 0小结nGDTR(GDT)nIDTR(IDT)nLDTR(LDT)nTRnEFLAGS (IOPL,VM)nCR03(PE,PG)nCS,DS,ES,FS,GS,SS(selector)nApplication Program:a collection of tasksntask:a group of progra

17、m routines that together perform a specific functionnA task can activate both global and local segments of memoryTask 1Local AddressSpaceGlobal AddressSpaceTask 3Local AddressSpaceTask 2Local AddressSpaceTask 1 Virtual Address SpaceTask 2 Virtual Address SpaceTask 3 Virtual Address Space8.3.2 虚拟地址空间

18、的分段8.3.3 物理地址空间和虚实地址转换 Physical Address Space and Virtual-to-Physical Address Translationn物理地址是从微处理器引脚上输出的地址信号。有条地址引脚，可以寻址的物理地址空间。n采用分段和分页机制，将位的虚拟地址映射到位的物理地址。n先由分段单元将虚拟地址进行段转换，产生位的线性地址。如果禁止分页，该线性地址就是物理地址。如果允许分页，由分页机制将线性地址转换为位的物理地址。n在地址转换过程中，如果要访向的段或页当前不在内存，则由操作系统的存贮器管理程序将其由磁盘调入内存，而将旧的段或页调往磁盘。这个过程称为交

19、换(swap)。8.3.3 物理地址空间和虚实地址转换 Physical Address Space and Virtual-to-Physical Address Translation8.3.3 物理地址空间和虚实地址转换 Physical Address Space and Virtual-to-Physical Address TranslationSELECTOROFFSETSEGMENTTRANSLATIONPG?DIR PAGE OFFSET310PAGETRANSLATION PHYSICAL ADDRESS PAGING DISABLEDPAGING ENABLEDLOGIC

20、AL ADDRESSLINEAR ADDRESS8.3.3 物理地址空间和虚实地址转换SELECTOROFFSETSEGMENTTRANSLATIONPG?DIR PAGE OFFSET310PAGETRANSLATION PHYSICAL ADDRESS PAGING DISABLEDPAGING ENABLEDLOGICAL ADDRESSLINEAR ADDRESS8.3.4 段式地址转换 8.3.4 段式地址转换 Data SegmentDescriptorCache RegisterSelector Offset(DS)DataSegmentLDTOperandSegmentDesc

21、riptor(EBX)n假定分页被关闭nDS-2007HnMOV EAX,DS:EBXnDS的第2位：nTI若为0？nTI=0:GDTnTI=1:LDT8.3.4 段式地址转换CSDSSSESFSGSProgrammeraccessibleSelectorsTransparently Loaded by MPUAccess RightsBase AddressLimit0192051526364-bit SegmentDescriptorCache Registersn段描述符自动装入与选择符对应的位段描述符缓存器。n好处？8.3.4 段式地址转换n例8.8n禁止分页时，线性地址等于物理地址。

22、8.3.5 虚地址空间的分页和虚实地址转换 Segmentation:4GB physical memory-organized into segments that can be any size from 1 byte to 4G bytePaging:1,048,576 pages that are each 4K(4096)bytes longPage 1Page 04KB4KB4KB4KBPage 1,048,494Page 1,048,575.PhysicalAddressspace.SELECTOROFFSETSEGMENTTRANSLATIONPG?DIR PAGE OFFSE

23、T310PAGETRANSLATION PHYSICAL ADDRESS PAGING DISABLEDPAGING ENABLEDLOGICAL ADDRESSLINEAR ADDRESS8.3.5 虚地址空间的分页和虚实地址转换 Linear Address从何而来？黑色方框的边界代表什么意思？8.3.5 虚地址空间的分页和虚实地址转换 8.3.5 虚地址空间的分页和虚实地址转换 n分页管理是在分段管理机制下工作。n分页的优越性在于，多任务系统中有了分页功能，就可以把每个活动任务当前需要的少量页面放在主存中，而勿需将当前段整段调入主存，从而提高了存取效率。n的线性地址空间划分成页,每页的长

24、度为n页表目录表和页表n实现线性地址向物理地址的二级转换过程n线性地址:目录 位 ，页 位 ，偏移 位 8.3.5 虚地址空间的分页和虚实地址转换 n:页目录基址寄存器.n页表目录的地址由的最高位指出n的低位,为什么？n页表目录：占字节n索引值最大为项，每项的内容为一个页表描述符，占个字节。n页表描述符的其高位给出了页表基地址。n线性地址中页（位）的值也是索引值，它指示被访问的页在页表中的序号。n根据页表基地址和表内索引值可以找到页描述符，页描述符也占字节，它的高位给出了页物理基地址。页表同样占字节。n以页地址为基址，加上线性地址中的位偏移量，便得到操作数的位物理地址。8.3.5 虚地址空间的

25、分页和虚实地址转换 nTLB:转换检测缓冲器Translation Lookaside Buffern页表描述符n页描述符n片内转换检测缓冲器中保存了个页、页表描述符，共，它们都是最近使用过的。如果页表和页的描述符己经被缓存，该操作数的物理地址则无需再经二级转换而可以直接引用。这样免去了两次访存的时间开销。n98%的存取可以直接由TLB命中nFor many common multi-tasking systems,the TLB will have a hit rate of about 98%.This means that the processor will only have to

26、access the two-level page structure on 2%of all memory references.linear address which caused the page fault.Linear Address FormatDIRECTORYPAGEOFFSET01112212231OperandPDBR(CR3)Translationlookasidebuffer(TLB)Page Frame,页Page directory table，页表目录Page table，页表Page table entry，页描述符Page directory entry，页

27、表描述符TLB(Translation Lookaside Buffer)maintaining 32 sets of table entries128 KB of paged memory are always directly accessible8.4 描述符和页表项Page Table Entries(P271)P:Present bit P=1the entry is valid and is available for use in address translationP=0the entry is undefined or not present in physical mem

28、ory:page faultA:AccessedD:Dirty bitAVL:For OS usageU/S,R/WU/SR/WUserSupervisor00NoneR/W01None R/W10 Read-onlyR/W11R/WR/WR/WPU/SAVL00AD00BASE ADDRESS 31-120111231n例8.11(p272)nPage Directory Physical=0E964000Page Directory Physical=0E9640000e964000 67 20 53 0E 67 B0 F9 0D-67 A0 87 0E 67 50 34 0B g S.g

29、.g.gP4.0e964000 67 20 53 0E 67 B0 F9 0D-67 A0 87 0E 67 50 34 0B g S.g.g.gP4.0e964100 0e964100 67 10 4E 0E67 10 4E 0E 00 00 00 00-00 00 00 00 00 00 00 00 g.N.00 00 00 00-00 00 00 00 00 00 00 00 g.N.0e4e1000 0e4e1000 25 E0 D6 0E25 E0 D6 0E 25 40 FC 00-00 00 00 00 25 40 FC 00-00 00 00 00 25 60 FC 0025

30、60 FC 00%.%.%.%.%.0e4e1010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .0e4e1010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .0e4e1020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .0e4e1020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 .0e4e1030 00 00 00 00 00 00 00 00-00 00 00 00 25 20

31、 EA 0E .%.0e4e1030 00 00 00 00 00 00 00 00-00 00 00 00 25 20 EA 0E .%.0e4e1040 00 00 00 00 67 40 27 0F-67 E0 7A 00 00 00 00 00 .g.g.z.0e4e1040 00 00 00 00 67 40 27 0F-67 E0 7A 00 00 00 00 00 .g.g.z.0e4e1050 67 30 E8 0E 0e4e1050 67 30 E8 0E 25 00 DB 0E25 00 DB 0E-00 00 00 00 00 00 00 00 g0.%.-00 00 0

32、0 00 00 00 00 00 g0.%.nLinear Addr:10000000 Phys AddrLinear Addr:10000000 Phys Addr:0ed6e000:0ed6e000nLinear Addr:?Phys AddrLinear Addr:?Phys Addr:00fc6000:00fc6000nLinear Addr:10014000 Phys AddrLinear Addr:10014000 Phys Addr:?:?nLinear Addr:10015000 Phys AddrLinear Addr:10015000 Phys Addr:0edb0000:

33、0edb0000n10015000H=0001 0000 0000 0001 0101 0000 0000 0000bnBit31-22=0001000000b=040H (offset is 040H x 4=0100H)nBit21-12=0000010101b=015H (offset is 015H x 4=0054H)8.4 描述符和页表项 Descriptor(P266)nDescriptor:nthe element by which the on-chip memory manager hardware manages the segmentation of the 80386

34、DXs 64T-byte virtual memory address space.nOne descriptor exists for each segment of memory in virtual address space.nData,LDT,TSS,Gate,Interruptn8 bytes long and contains three kinds of informationnLimit(20 bit)nBase(32 bit)nAccess Rights(12 bit)nTypes of segment descriptorsnsystem segment descript

35、or(s=0),non-system segment descriptor(s=1)(code and data)Segment DescriptorsSEGMENT LIMIT 15.0SEGMENT BASE 15.0 BASE 23.16 BASE 31.24GD0LIMIT19.16PDPLSTYPEA0347AVL02316158724318.4 描述符和页表项Descriptors and Page Table EntriesSEGMENT LIMIT 15.0SEGMENT BASE 15.0 BASE 23.16 BASE 31.24G X 0LIMIT19.16P DPL S

36、 TYPEA0347AVL02316 15872431Bit Position Name Function 7 6-5 4 Present(P)Descriptor Privilege Level(DPL)Segment Descriptor Type(S)P=1 Segment is mapped into physical memory P=0 No mapping to physical memory exists,base and limit are not used Segment privilege attribute used in privilege tests S=1 Cod

37、e or Data segment descriptor S=0 System segment Descriptor or Gate Descriptor 3 2 1 Executable(E)Expansion Direction(ED)Writeable(W)E=0 Data segment descriptor type is:ED=0 Expand Up segment,offsets must be limit.W=0 Data segment may not be written into W=1 Data segment may be written into 3 2 1 Exe

38、cutable(E)Conforming(C)Readable(R)E=1 Code segment descriptor type is:C=1 Code segment may only be executed When CPL=?DPL and CPL remains unchanged R=0 Code segment may not be read R=1 Code segment may be read 0 Accessed(A)A=0 Segment has not been accessed A=1 Segment selector has been loaded into s

39、egment register or used by selector test instruction if datasegment(S=1,E=0)if codesegment(S=1,E=1)TypeFieldDefinitionS=0,P280,Fig 8.34Descriptor FormatG:granularity bitG=1 Page(the lowest 12 bits of segment base address should be zero)G=0 Byte(1MB max)D:default length for operands and effective add

40、resses D=132-bit operationD=016-bit operationAVL:programmer availableExample:Ex 8.9:Access Rights byte FEH=1111 1110S=1P=1 Segment is mapped into physical memoryDPL=11 Privilege level 3E=1 executable code segmentC=1 confirming code segmentR=1readable code segmentA=0segment has not been accessedAcces

41、s Rights byte F2H=1111 0010?Loading Descriptor from Descriptor Table(Fig 8.21)LDTRdescriptorCSdescriptor00A00000HFFFFHGDTR00A00000H00A0FFFFH2000HLDTR00A02007H00A02000H00008290000000FFFF0FFE60FFFF00000090000H FFFFH00900000H0090FFFFH1005HCS0060000H FFFFH00901007H00901000H0060FFFFH00600000HGDT(64KB)LDT

42、(64KB)CODESEGMENT(1 MB)SYSTEM MEMORYUSER MEMORYCS=1003H,如何?Fig 8.23 系统段(S=0)Ex:8.10System descriptor Access Right byte:82H82H=1000 0010:P=1 present in physical memoryDPL=00=privilege level 0S=0 system segmentType=0010=local descriptor tableFig 8.23 系统段(S=0)System descriptor Access Right byte:82H82H=

43、1000 0010:S=0 system segment,Type=0010=local descriptor table,DPL=00=privilege level 0,P=1 present in physical memoryNameValueDescriptionType0123456789ABCDEFReservedAvailable 80286 TSSLDTBusy 80286 TSSCall GateTask Gate80286 Interrupt gate80286 Trap gateReservedAvailable 80386 TSSReservedBusy 80386

44、TSS80386 Call GateReserved80386 Interrupt Gate80386 Trap GateP01Descriptor contents are not validDescriptor contents are validDPL0-3Descriptor Privilege level 0,1,2,or 3BASE32-bitnumberBase address of special system data segment in memoryLIMIT20-bitnumberOffset of last byte in segment from the base0

45、4SEGMENT LIMIT 15.0SEGMENT BASE 15.0 BASE 23.16 BASE 31.24G X 0LIMIT19.16P DPL 0 TYPE A37AVL02316 15872432GDTbaseGDTbase=0003F000 Limit=03FF=0003F000 Limit=03FF0003F000 00 00 00 00 00 00 00 00-FF FF 00 00 00 9B CF 00 .0003F000 00 00 00 00 00 00 00 00-FF FF 00 00 00 9B CF 00 .0003F010 FF FF 00 00 00

46、93 CF 00-FF FF 00 00 00 FB CF 00 .0003F010 FF FF 00 00 00 93 CF 00-FF FF 00 00 00 FB CF 00 .0003F020 FF FF 00 00 00 F3 CF 00-AB 20 00 20 04 8B 00 80 .0003F020 FF FF 00 00 00 F3 CF 00-AB 20 00 20 04 8B 00 80 .0003F030 01 00 00 F0 DF 93 C0 FF-FF 0F 00 00 00 F3 40 00 .0003F030 01 00 00 F0 DF 93 C0 FF-F

47、F 0F 00 00 00 F3 40 00 .0003F040 FF FF 00 04 00 F2 00 00-00 00 00 00 00 00 00 00 .0003F040 FF FF 00 04 00 F2 00 00-00 00 00 00 00 00 00 00 .n0008 Code32 00000000 FFFFFFFF 0 P RE0008 Code32 00000000 FFFFFFFF 0 P REn0010 Data32 00000000 FFFFFFFF 0 P RW0010 Data32 00000000 FFFFFFFF 0 P RWn001B Code32 0

48、0000000 FFFFFFFF 3 P RE001B Code32 00000000 FFFFFFFF 3 P REn0023 Data32 00000000 FFFFFFFF 3 P RW0023 Data32 00000000 FFFFFFFF 3 P RWn0028 TSS32 80042000 000020AB 0 P B0028 TSS32 80042000 000020AB 0 P Bn0030 Data32 FFDFF000 00001FFF 0 P RW0030 Data32 FFDFF000 00001FFF 0 P RWn003B Data32 00000000 0000

49、0FFF 3 P RW003B Data32 00000000 00000FFF 3 P RWn0043 Data16 00000400 0000FFFF 3 P RW0043 Data16 00000400 0000FFFF 3 P RWn0048 Reserved 00000000 00000000 0 NP0048 Reserved 00000000 00000000 0 NP段描述符的例子SEGMENT LIMIT 15.0SEGMENT BASE 15.0 BASE 23.16 BASE 31.24G X 0LIMIT19.16P DPL S TYPEA0347AVL02316 15

50、872431PDPL1580 0 TYPE TYPE 1 1 1 1 C R AC R A1 0 E W A1 0 E W A8.5 Protected-Mode System-Control Instruction SetInstructionDescriptionModeLGDT SLoad the global descriptor table registerBothSGDT DStore the global descriptor table registerBothLIDT SLoad the interrupt descriptor table registerBothSIDT