I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it to a right physical address?

Let's take for example VA 0x30000 on an x86 non-PAE Windows system. Splitting it into 3 groups we have

0000000000 | 0000110000 | 000000000000

Page Directory Index = 0x0

Page Table Index = 0x30

Physical Offset = 0x0

We get PD's physical address from CR3 and discover that it's PDE has the Present bit cleared. Is it possible to write in physical memory (at pd[pdi]) a valid PDE (in essence, set the Present bit) and then traverse all the tables (marking entries as present) and finally had the VA to be valid for a certain PA so that future attempts at translating it will be successful? Can one even write directly to a physical address from a kernel module?

  • 1
    A cleared Present bit might mean it's just the PDE that's missing, bit it might also mean the page is paged out, or hasn't ever been read (in case of memory mapped files), or ... The best you can do is probably try to read the VA, let the OS handle the resulting page fault, then repeat your mapping procedure. – Guntram Blohm Oct 15 '14 at 15:22
  • @Guntram Blohm so it's not enough just to update every paging structure to have valid entries and flush the TLB. I suppose I can't find a in-depth description on how Windows does this things, right? So I should start looking at how this things are done on Linux to get a better idea. – user3002428 Oct 15 '14 at 17:25
  • Right, you can't just mark it present because it might not have any physical memory associated with it at that time. The principle for handling it is essentially the same between Linux and Windows. – peter ferrie Oct 16 '14 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.