Chapter 8 Hardware Security
8.3 MEMORY PROTECTION
8.3.3 Demand Paging
Some modern machines permit a process to have a virtual memory that is many times the size of the physical memory of the machine; to accomplish this, a demand paging mechanism is used to
PAGE NUMBER OFFSET
pointer to 4 pointer to 0 pointer to 3 pointer to 1 pointer to 6 VIRTUAL ADDRESS MAPPING REGISTERS PHYSICAL MEMORY PAGES 0 1 2 3 4 0 1 2 3 4 5 6
move pages between secondary storage and physical memory, as required. The process must be able to be run without keeping track of which pages are memory-resident. The operating system constructs a table of page descriptors for the entire virtual memory of the process, setting an “on- disk” flag in the descriptors whose pages are not in physical memory (fig. 8-2). When the process references a page, the address translation mechanism sees the “on disk” flag and traps to the operating system, signaling a page fault. The operating system finds a free page in physical memory, reads in the page from disk, resets the descriptor to point to the page, and resumes execution of the process at the point of fault.
Figure 8-2. Demand Paging. In a demand-paged system, some of the pages may not
be in memory. The operating system takes care of reading the contents of the appropriate page from disk, as needed. Shown are two processes that share some of the same physical pages.
In order to minimize disk access time, pages in a demand-paged system tend to be small— equal to the size of a disk block, such as 512 or 1,024 words. Small pages also allow a process to run with a small amount of reserved physical memory. In a non-demand-paged system, where a process’s entire address space must reside in physical memory, page size is less critical. The small size of pages limits their usefulness as a basis for memory protection, as we shall discuss more completely in section 8.3.5. With declining memory costs and faster disks, these trade-offs are changing.
8.3.4 Segmentation
In most systems, the virtual address space of a process is divided into at least two distinct portions, or segments, one for user programs and data (called user space) and the other for the
2 ON DISK 0 ON DISK 1 ON DISK 6 5 4 ON DISK ON DISK ON DISK 3 7 ON DISK 6 5 4 0 1 2 3 4 5 6 7 8 0 1 2 3 4 5 6 7 8 PROCESS A DESCRIPTORS PROCESS B DESCRIPTORS 0 1 2 3 4 5 6 7 PHYSICAL MEMORY PAGES USER SPACE SYSTEM SPACE USER SPACE SYSTEM SPACE
example, all virtual addresses for pages 0–4 are in user space, and virtual addresses for pages 5–8 are in system space. Typically, one copy of the operating system (code and data) lies in memory, shared by all processes. The figure shows the system space for both processes occupying the same physical pages. The user space pages are separate, although some systems allow processes to share selected user pages.
The two-segment scheme is common but limited. The most flexible architecture, the
segmented virtual memory, allows many segments to be included in each process, any of which
can be shared. The virtual address is a two-dimensional value containing a segment number and a segment offset:
Each segment contains an independent identifiable object—a procedure, a large program, the process stack, a shared data area, or the like—and segments need not all be the same size (though there is a maximum, based on the size of the segment offset field). When a process is stepping through consecutive locations in a segment (during program execution, for example, there is no notion of overflowing into the “next” segment when the end of the segment is reached: the segment number of an object bears no relationship to neighboring segment numbers. If the two- dimensional virtual address is treated as a single large number, the virtual address space can be described as being full of holes, each corresponding to the addresses that lie beyond the end of one segment and before the beginning of the next. Though a large number of unused virtual memory locations lie at the end of each segment, no physical memory is wasted by the existence of these holes.
Some machines have memory segments but cannot conveniently map segments to distinct objects, either because the hardware supports too few segments or because the operating system architecture does not permit it. The segmentation is simply a memory-partitioning convenience, and memory addresses flow continuously from one segment into the next.
A translation mechanism for virtual memory addresses that accommodates variable-size segments in conjunction with demand paging requires an extra level of memory descriptor, as shown in figure 8-3. Notice that the segment offset in the virtual address is composed of a page number and a word number. Instead of there being one page table for the whole process, as was the case in figure 8-2, there is a variable length page descriptor table for each segment, and each process has a variable number of segments. The fixed-size pages permit efficient use of physical memory, and the variable-size segments permit efficient sharing of segments among processes. Figure 8-4 illustrates the use of a shared segment. Notice that the segment number of the shared segment can be different for each process. This permits each process to lay out its virtual address space as it chooses, without having to establish any “agreements” ahead of time with other processes that share the same segments.
Figure 8-3. Virtual Address Translation with Segments. A process has a descriptor
base register that points to the segment descriptor table for the process. In a virtual address, the segment number selects a segment descriptor that points to the page table for the segment. The high-order bits in the segment offset constitute the page number, which points to a page descriptor that identifies the location of the page in physical memory. The low-order bits in the segment offset constitute the word number, which identifies the location of the word within the page.
DESCRIPTOR BASE SEGMENT NUMBER
SEGMENT OFFSET PAGE NUMBER WORD NUMBER
VIRTUAL ADDRESS
pointer to page table
pointer to page
word referenced SEGMENT DESCRIPTOR TABLE
(per process)
PAGE DESCRIPTOR TABLE
(per segment)
Figure 8-4. Sharing Segments in a Virtual Memory. Each process has its own
segment descriptor table that specifies page tables for the segments and access modes to the segments. The shared segment ALPHA has one page table, used by both processes. ALPHA is referenced as segment number 3 by process A and as segment number 6 by process B.