CODEWITHSUNDEEP
processkernelcpuosdevgdt
2080
2080

Reputation: 1417

How do operating systems isolate processes from each other?

Assuming the CPU is in protected mode:

When a ring-0 kernel sets up a ring-3 userspace process, which CPU-level datastructure does it have to modify to indicate which virtual address space this specific process can access?

Does it just set the Privilege Bit of all other memory segments in the Global Descriptor Table to (Ring) 0?

Upvotes: 1

Views: 601

Answers (2)

jonathan
jonathan

Reputation: 620

Each process will have a set of page tables it uses. On x86 that means a page directory with some page tables. The address to the page directory will be in the CR3 Register. Every set of pagetables will have the kernel mapped (with kernel permissions) so when you do a system call, the kernel can access it's own pages. User processes can't access these pages. When you do a context switch, you change the address in the CR3 register to the page tables of the process that will be executed. Because each process has a different set of pagetables, they will each have a different view on memory. To make sure that no two processes have access to the same physical memory, you should have some kind of physical memory manager, which can be queried for a brand new area of memory that is not yet mapped in any other pagetable.

So as long as each Process struct keeps track of it's own page table structure, the only cpu level datastructure you will have to modify is the CR3 register.

Upvotes: 1

2080
2080

Reputation: 1417

It appears that the Global Descriptor Table (GDT) provides a segmentation mechanism that can be used in conjunction with Paging, but is now considered legacy.

By loading the page directory address into the CR3 control register, the Ring 3 process is restricted to the linear memory defined by the paging mechanism. CR3 can only be changed from Ring 0:

enter image description here

In protected mode, the 2 CPL bits in the CS register indicate which ring/privilege level the CPU is on.

More here:

Upvotes: 0

Related Questions