windows 处理页表

Process Page Tables

提问by Jimmy

I'm interested in gaining a greater understanding of the virtual memory and page mechanism, specifically for Windows x86 systems. From what I have gathered from various online resources (including other questions posted on SO),

我有兴趣更深入地了解虚拟内存和页面机制，特别是对于 Windows x86 系统。从我从各种在线资源中收集的信息（包括发布在 SO 上的其他问题），

1) The individual page tables for each process are located within the kernel address space of that same process.

1) 每个进程的单独页表位于同一进程的内核地址空间内。

2) There is only a single page table per process, containing the mapping of virtual pages onto physical pages (or frames).

2）每个进程只有一个页表，包含虚拟页到物理页（或帧）的映射。

3) The physical address corresponding to a given virtual address is calculated by the memory management unit (MMU) essentially by using the first 20 bits of the provided virtual address as the index of the page table, using that index to retrieve the beginning address of the physical frame and then applying some offset to that address according to the remaining 12 bits of the virtual address.

3）给定虚拟地址对应的物理地址是由内存管理单元（MMU）计算出来的，本质上是使用提供的虚拟地址的前20位作为页表的索引，使用该索引来检索起始地址物理帧，然后根据虚拟地址的剩余 12 位对该地址应用一些偏移量。

Are these three statements correct? Or am I misinterpreting the information?

这三个说法正确吗？还是我误解了信息？

回答by Abhay Buch

So, first lets clarify some things:

所以，首先让我们澄清一些事情：

1. In the case of the x86 architecture, it is not the operating system that determines the paging policy, it is the CPU (more specifically it's MMU). How the operating system views the paging system is independent of the the way it is implemented. As a commenter rightly pointed out, there is an OS specific component to paging models. This is subordinate to the hardware's way of doing things.
2. 32 bit and 64 bit x86 processors have different paging schemes so you can't really talk about the x86 paging model without also specifying the word size of the processor.

1. 在 x86 架构的情况下，决定分页策略的不是操作系统，而是 CPU（更具体地说是 MMU）。操作系统如何看待分页系统与其实现方式无关。正如评论者正确指出的那样，分页模型有一个特定于操作系统的组件。这是从属于硬件的做事方式。
2. 32 位和 64 位 x86 处理器具有不同的分页方案，因此您不能在不指定处理器字长的情况下真正谈论 x86 分页模型。

What follows is a massively condensed version of the 32 bit x86 paging model, using the simplest version of it. There are many additional tweaks that are possible and I know that various OS's make use of them. I'm not going into those because I'm not really familiar with the internals of most OS's and because you really shouldn't go into that until you have a grasp on the simpler stuff. If you want the to know all of the wonderful quirks of the x86 paging model, you can go to the Intel docs: Intel System Programming Guide

接下来是 32 位 x86 分页模型的大规模压缩版本，使用它的最简单版本。还有许多其他的调整是可能的，我知道各种操作系统都在使用它们。我不会深入研究这些，因为我对大多数操作系统的内部结构并不十分熟悉，而且在您掌握更简单的东西之前，您真的不应该深入研究。如果您想了解 x86 分页模型的所有精彩怪癖，您可以访问英特尔文档：英特尔系统编程指南

In the simplest paging model, the memory space is divided into 4KB blocks called pages. A contiguous chunk of 1024 of these is mapped to a page table (which is also 4KB in size). For a further level of indirection, All 1024 page tables are mapped to a 4KB page directory and the base of this directory sits in a special register %cr3in the processor. This two level structure is in place because most memory spaces in the OS are sparsewhich means that most of it is unused. You don't want to keep a bunch of page tables around for memory that isn't touched.

在最简单的分页模型中，内存空间被划分为称为页的 4KB 块。其中的 1024 个连续块被映射到一个页表（大小也是 4KB）。对于更进一步的间接层，所有 1024 个页表都映射到一个 4KB 的页目录，并且该目录的基址位于%cr3处理器的一个特殊寄存器中。之所以采用这种两级结构，是因为操作系统中的大多数内存空间都是稀疏的，这意味着大部分内存空间都没有使用。您不想为未触及的内存保留一堆页表。

When you get a memory address, the most significant 10 bits index into the page directory, which gives you the base of the page table. The next 10 bits index into that page table to give you the base of the physical page (also called the physical frame). Finally, the last 12 bits index into the frame. The MMU does all of this for you, assuming you've set %cr3to the correct value.

当你得到一个内存地址时，最重要的 10 位索引到页目录中，它为你提供了页表的基础。接下来的 10 位索引到该页表中，为您提供物理页（也称为物理帧）的基础。最后，最后 12 位索引到帧中。假设您已设置%cr3为正确的值，MMU 会为您完成所有这些工作。

64 bit systems have a 4 levelpaging system because their memory spaces are much more sparse. Also, it is possible to page sizes that are not 4KB.

64 位系统有一个4 级分页系统，因为它们的内存空间要稀疏得多。此外，页面大小可能不是 4KB。

To actually get to your questions:

要真正回答您的问题：

1. All of this paging information (tables, directories etc) sits in kernel memory. Note that kernel memory is one big chuck and there is no concept of having kernel memory for a single process.
2. There is only one page directoryper process. This is because the page directory defines a memory space and each process has exactly one memory space.
3. The last paragraph above gives you the way an address is chopped up.

1. 所有这些分页信息（表、目录等）都位于内核内存中。请注意，内核内存是一大块，并且没有为单个进程提供内核内存的概念。
2. 每个进程只有一个页面目录。这是因为页目录定义了一个内存空间，每个进程只有一个内存空间。
3. 上面的最后一段为您提供了地址的切分方式。

Edit: Clean up and minor modifications.

编辑：清理和小的修改。

回答by Jerry Coffin

Overall that's pretty much correct.

总的来说，这是非常正确的。

If memory serves, a few details are a bit off though:

如果没记错的话，有一些细节有点不对劲：

1. The paging for the kernel memory doesn't change per-process, so all the page tables are always visible to the kernel.
2. In theory, there's also a segment-based translation step. Most practical systems (e.g., *BSD, Linux, Windows, OS/X), however, use segments with their base set to 0 and limit set to the address space limit, so this step ends up as essentially a NOP.

1. 内核内存的分页不会改变每个进程，所以所有的页表对内核总是可见的。
2. 理论上，还有一个基于段的翻译步骤。然而，大多数实际系统（例如，*BSD、Linux、Windows、OS/X）使用的段的基数设置为 0，限制设置为地址空间限制，因此这一步最终实际上是一个 NOP。