9

Imagine a 32-bit x86 computer with less than 3 gigabytes of memory with CPU set up with disabled paging and flat segment descriptors (0x0 as base, 0xffffffff as an effective limit for both data and code).

What happens when an instruction in ring0 tries to use a mov instruction to reference a physical address that is not backed by any memory address?

QEMU emulation just stalls with an error like "fatal: Trying to execute code outside RAM or ROM".

These exceptions are related to memory issues:

  1. It shouldn't be "Segment Not Present (#NP)": it only happens when segment registers are loaded, but I can actually load flat segments without problems.
  2. "Stack Fault (#SS)" should not be generated, because the code doesn't reference stack.
  3. "General Protection (#GP)" shouldn't happen because the code is running in ring-0 and segments are set up to allow access to every physical address.
  4. Paging is disabled, so it's not a "Page Fault (#PF)" either.
  5. And it's not an alignment problem, so it shouldn't trigger "Alignment Check (#AC)".

I ran out of options and I don't know what should happen.

2
  • What is your programming problem? The correct answer from a programming standpoint is "Don't do that." Feb 17, 2014 at 5:13
  • Note that physical address space includes an MMIO region where devices have their MMIO registers. e.g. on a PC typically between 768MiB and 1GiB, IIRC. As well as ROM. So "nonexistant phys address" means not RAM, ROM, or MMIO. Dec 8, 2021 at 9:06

2 Answers 2

6

If paging is disabled and the current segment's limit is 4GiB (in 32-bit mode) there are no "nonexisting" addresses:

All 2^32 possible addresses exist in this case and can be read and written.

What happens if a read or write operation to an address where no RAM, ROM, etc is located is done depends on the hardware outside the CPU and not on the CPU itself.

A write operation to such an address will typically be ignored and a read operation will typically result in a non-sense value (on most PCs the "all-ones" value like 0xFF, 0xFFFF, 0xFFFFFFFF).

Theoretically such an address access may cause an interrupt or even crash the computer depending on the address. However this is not done by the CPU itself but by other hardware components.

Execution of code on such an address is basically nothing but a read access from that address.

4
  • Reading a "nonsense value" is how the computer can figure out on startup how much memory is installed...
    – Kerrek SB
    Feb 17, 2014 at 9:20
  • 1
    @KerrekSB: To check if a given address is RAM you write a value to the RAM and read the value back. To be sure you should to this with a different value, too. However it is impossible to find out if a certain address contains ROM (containing bytes with the value 0xFF) or simply nothing! Feb 17, 2014 at 11:38
  • @MartinRosenau : This is one reason I'd use int 15h/AX=E820h (fall back to AX=E802h/8800h if need be) to map memory finding the usable RAM before entering protected mode. On a side note BIOS extensions in ROM (below 1mb and above A000:0000) can be discovered by scanning memory in 2kb blocks looking for 0x55, 0xAA in the first 2 bytes. If found the third byte will contain the number of 512 byte blocks that the BIOS extension consumes. Oct 30, 2015 at 22:19
  • I think that it depends on how the CPU is implemented. According to 8086 datasheet, there's a READY signal that is the acknowledgement from the addressed memory or I/O device that it will complete the data transfer.
    – youfu
    Dec 20, 2017 at 4:38
5

My understanding is that non-paged memory accesses go directly to bus, leading to undefined behavior (depends on the chipset, bus type etc.) -- See Manual Probing

Note: You will never get an error from trying to read/write memory that does not exist -- this is important to understand: you will not get valid results, but you won't get an error, either.

1
  • Depending upon the hardware design, that may or may not be true. Some processors may not have synchronizers on the incoming data bus, and may rely upon external hardware to ensure that the bus state doesn't change while it's being sampled. If the bus is floating, and happens to change at just the wrong time, it could cause rather "interesting" consequences, the least astonishing of which might be that on architectures where load instructions set or clear flags based on the value read, the flags might be inconsistent with the reported value.
    – supercat
    Aug 12, 2016 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.