4,2 Segmentation and Paging under Windows

know where these structures reside from the perspective of the program's

linear address space.

contains 1BE02867 contains 00ACF847

The third line specifies the contents of the PDE and PTE in hex format. PDEs

and PTEs arc just binary structures that are 4 bytes in length (assuming a 32-

bit physical address space where PAE has not been enabled).

pfn lbe02 ---DA--UWEV pfn acf ---D---UWEV

The fourth line decomposes these hexadecimal values into their constituent

parts: a physical base address and a status flag. Note that the base physical

addresses stored in the PDE and PTE are displayed in the 20-bit page frame

format, where least-significant 12 bits are not shown and assumed to be zero

Table 4.3 describes what these flag codes signify.

Table 4.3 PDE/PTE Flags

Bit

Bit Set

Bit Clear

Meaning

0

V

—

Page/page table is valid (present in memory)

1

W

R

Page/page table writable (as opposed to being read-only)

2

u

K

Owner is user/kernel

3

T

—

Write-through caching is enabled for this page/page table

4

N

—

Page/page table caching is disabled

5

A

—

Page/page table has been accessed (read from, written to)

6

D

—

Page is dirty (has been written to)

7

L

—

Page is larger than 4 KB

8

G

—

Indicates a global page (related to TLBs')

9

C

—

Copy on write has been enabled

E

—

The page being referenced contains executable code

'TLBs =

= translation look-alike buffers

As a useful exercise, let's take an arbitrary set of linear addresses, ranging

from 0x00000000 to OxFFFFFFFF, and run the Ipte command on them to see

what conclusions we can make from investigating the contents of their PDEs

and PTEs.

Parti I 125