我正在使用Rust和 NASM 汇编程序编写64位高半内核。我正在使用Multiboot2（ GRUB2 ）兼容的引导加载程序来初始加载我的内核。当我的内核在 QEMU 中运行时，我遇到了页面错误错误（0x0e异常），我不明白为什么。我得到的问题出现在我的汇编代码中，然后才到达Rust写的代码。
我正在设置分页，以便内存看起来像：
0000000000000000: 0000000000000000 --PDA---W
0000000000200000: 0000000000200000 --P-----W
ffffff0000000000: 0000000000000000 --P-----W
ffffff7f80000000: 0000000000000000 X-P------
（这是我的意图，以及来自 QEMU 的info mem的结果）
表格如下：
p4: # pml4
0o000 <- p3_low | PRESENT | WRITABLE
0o776 <- p3_hgh | PRESENT | WRITABLE
p3_low: # pdpte
0o000 <- p2_low | PRESENT | WRITABLE
p3_hgh: # pdpte
0o000 <- p2_krn | PRESENT | WRITABLE
0o667 <- p2_mbi | PRESENT | WRITABLE
p2_low: # pde
0o000 <- 0o000000_000_000_000_000_0000 | PRESENT | WRITABLE | PAGESIZE
0o001 <- 0o000000_000_000_001_000_0000 | PRESENT | WRITABLE | PAGESIZE
p2_krn: # pde
0o000 <- 0o000000_000_000_000_000_0000 | PRESENT | WRITABLE | PAGESIZE
p2_mbi: # pde
0o000 <- 0o000000_000_000_000_000_0000 | PRESENT | PAGESIZE | NOEXEC
其他一切都归零了。
我的项目的相关代码在这些文件中：
macros64.asm：
%macro pte_write 4
mov rax, %4
or rax, %3
mov qword [%1+8*%2], rax
%endmacro
paging64.asm：
extern kernel_start
extern kernel_end
p_present equ (1<<0)
p_writable equ (1<<1)
p_user equ (1<<2)
p_pagesize equ (1<<7)
p_noexec equ (1<<63)
[section .text]
enable_paging:
; Calculate start and end address of the multiboot2 info structure.
mov r9, rdi
mov r10, r9
add r10d, dword [r9]
and r9, 0xfffffffffffff000
shr r10, 12
inc r10
shl r10, 12
; Clear out all the page tables.
movaps xmm1, [blank]
mov rcx, page_tables_start
.clear_page_tables_loop:
movaps [rcx], xmm1
add rcx, 16
cmp rcx, page_tables_end
jl .clear_page_tables_loop
; TODO Uncomment the recursive page mappings once things actually work -- for now, they just make "info tlb" in QEMU annoying to read.
; Fill out the P4 table.
pte_write p4, 0o000, p3_low, p_present | p_writable
pte_write p4, 0o776, p3_hgh, p_present | p_writable
; pte_write p4, 0o777, p4, p_present | p_writable | p_noexec
; Fill out the P3 tables.
pte_write p3_low, 0o000, p2_low, p_present | p_writable
; pte_write p3_low, 0o777, p3_low, p_present | p_writable | p_noexec
pte_write p3_hgh, 0o000, p2_krn, p_present | p_writable
pte_write p3_hgh, 0o776, p2_mbi, p_present | p_writable
; pte_write p3_hgh, 0o777, p3_hgh, p_present | p_writable | p_noexec
; Identity map the lowest 2MiB.
pte_write p2_low, 0o000, 0o000000_000_000_000_000_0000, p_present | p_writable | p_pagesize
pte_write p2_low, 0o001, 0o000000_000_000_001_000_0000, p_present | p_writable | p_pagesize
; pte_write p2_low, 0o777, p2_low, p_present | p_writable | p_noexec
; Map the kernel.
xor rcx, rcx
mov rsi, kernel_start
.kernel_loop:
pte_write p2_krn, rcx, rsi, p_present | p_writable | p_pagesize
inc rcx
add rsi, 0o000000_000_000_001_000_0000
cmp rsi, kernel_end
jb .kernel_loop
; Map the multiboot2 information structure.
xor rcx, rcx
mov rsi, r9
.mbi_loop:
pte_write p2_mbi, rcx, rsi, p_present | p_pagesize | p_noexec
inc rcx
add rsi, 0o000000_000_000_001_000_0000
cmp rsi, r10
jb .mbi_loop
; Load the new page table. We don't need to flush the TLB because we moved into CR3.
mov rax, p4
mov cr3, rax
; Return.
ret
[section .data]
align 0x10
blank: times 0x10 db 0x00
[section .bss]
alignb 4096
page_tables_start:
p4: resb 4096
p3_low: resb 4096
p3_hgh: resb 4096
p2_low: resb 4096
p2_krn: resb 4096
p2_mbi: resb 4096
page_tables_end:
start64.asm：
bits 64
extern kmain
global start64
%include "macros64.asm"
%include "paging64.asm"
[section .text]
;; The entry point for 64-bit code. We expect the address of the multiboot2
;; info structure in rdi.
start64:
; Save the address of the multiboot2 info structure.
push rdi
; Clear interrupts. If we get an interrupt before we have an IDT, we'll
; triple fault. We can re-enable it from Rust, later.
cli
; Nuke the segment registers.
mov rax, 0x10
mov ss, ax
mov ds, ax
mov es, ax
mov fs, ax
mov gs, ax
; Set up paging.
call enable_paging
; The first argument to kmain is the multiboot2 info structure. We need to
; adjust the address to the new higher-half location.
pop rdi
mov rax, 0xffffff7f80000000
add rdi, rax
; DEBUG
mov dword [0xb8004], 0xf021f021
mov rbx, [rdi]
mov dword [0xb8000], 0xf021f021
hlt
; Call kmain. It's more than 4GiB away, so we have to do an indirect call.
mov rax, kmain
call rax
; kmain should never return; call halt if it does.
jmp halt
halt:
; Write "kexit?!?" to the upper right corner.
mov dword [0xb8000], 0x4f654f6b
mov dword [0xb8004], 0x4f694f78
mov dword [0xb8008], 0x4f3f4f74
mov dword [0xb800c], 0x4f3f4f21
; Disable interrupts and halt.
cli
hlt
; Just in case... something? happens.
jmp halt
将新页表移动到 CR3 后，执行正确。但是，一旦我尝试从start64.asm中的高内存中读取值，我就会出现页面错误。故障发生在这一行：
mov rbx, [rdi]
之前的行mov dword [0xb8004], 0xf021f021正确地将!!写入屏幕。 [rdi]是可以找到Multiboot2信息记录的高半地址。
完整代码的副本可在my GIT repository。
中找到答案 0 :(得分：3)
我将根据我做的另一项实验进行有根据的猜测。我怀疑如果你要向后滚动并查看抛出的异常（其中一个图像的开头被切断），你会在 QEMU 中看到这样的输出：
check_exception old: 0xffffffff new 0xe 0: v=0e e=0009 i=0 cpl=0 ... [snip]
特别是，您将寻找以new 0xe开头的异常，即页面错误异常。我为了简洁而剪短了。
在第二行，您可能会看到e=0009。这是在进入页面处理程序之前将在堆栈上推送的错误代码。您没有页面处理程序，因此您将三重故障，之后您将获得其他异常。
0x0009的错误代码是什么意思？ OSDev Wiki有一个描述：
31 4 0 +---+-- --+---+---+---+---+---+---+ | Reserved | I | R | U | W | P | +---+-- --+---+---+---+---+---+---+ P 1 bit - Present - When set, the page fault was caused by a page-protection violation. When not set, it was caused by a non-present page. W 1 bit - Write - When set, the page fault was caused by a page write. When not set, it was caused by a page read. U 1 bit - User - When set, the page fault was caused while CPL = 3. This does not necessarily mean that the page fault was a privilege violation. R 1 bit - Reserved write - When set, the page fault was caused by reading a 1 in a reserved field. I 1 bit - Instruction Fetch - When set, the page fault was caused by an instruction fetch.
您的值e=0009是01001的一个掩码。这意味着发生页面保护违规（而不是页面不存在错误），这意味着读取了1来自保留的领域。
有问题的保留字段（位）位于页表层次结构底部的页表（PT）的实际页表条目（PTE）中。当使用2MB页面大小和否 Page Attribute Tables时，页面表中的PTE必须将位12到20设置为零。您当前的代码就是这种情况。保留位是特殊的，如果它们包含值1，那么您将在 QEMU 输出中得到e=0009。
要解决此问题，您必须确保实际页表（PT）中的页表条目（PTE）将这些位设置为0.快速破解可能是在macros64.asm中执行此类操作：
%macro pte_write 4
mov rax, %4
or rax, %3
mov qword [%1+8*%2], rax
%endmacro
%macro pte_write_res 4
mov rax, %4
mov r11, 0x7fffffffffe00000
and r11, %3
or rax, r11
mov qword [%1+8*%2], rax
%endmacro
主要区别在于pte_write_res通过将保留位设为0来专门执行规则。然后，您必须修改使用这些宏的代码。在您的情况下，它似乎位于paging64.asm内的这两个位置：
.kernel_loop:
pte_write p2_krn, rcx, rsi, p_present | p_writable | p_pagesize
inc rcx
现在会变成：
.kernel_loop:
pte_write_res p2_krn, rcx, rsi, p_present | p_writable | p_pagesize
inc rcx
并且
.mbi_loop:
pte_write p2_mbi, rcx, rsi, p_present | p_pagesize | p_noexec
inc rcx
现在会变成：
.mbi_loop:
pte_write_res p2_mbi, rcx, rsi, p_present | p_pagesize | p_noexec
inc rcx
在这两种情况下，我们需要写入页表的页表项，其中 RSI 可能设置了我们需要为0的位。