Topic 02: 5-Level Hardware MMU Page Table Walking (Virtual to Physical)

Target Duration: 2–4 minutes (~300–450 spoken words)
Focus: Pointwise verbal delivery covering MMU address translation, 5-level page table navigation (PGD, P4D, PUD, PMD, PTE), entry validation, cross-architecture PFN extraction, and user-space pagemap verification.

🎙️ Pointwise Spoken Speech (Word-for-Word Delivery)

• Opening & Scope:
  "In lkm3.c:23 and chardev.c:24, I implemented a manual 5-level page table walk to resolve virtual memory addresses to physical RAM frames, simulating the exact translation steps performed by the CPU's Memory Management Unit (MMU) on Linux 6.1."

• Step 1: Accessing the Process Memory Descriptor (mm_struct):
  "First, given a target task, I acquired its memory descriptor via task->mm (1/lkm3.c:45). In Linux, the root of the per-process page table is stored in mm->pgd (1/lkm3.c:48), which is loaded into the CPU's CR3 control register on x86_64 during a context switch. If task->mm is null, it indicates a kernel thread, which borrows memory contexts and has no private user address space."

• Step 2: 5-Level Traversal Sequence:
  "Next, I walked the five hierarchical page table levels supported in Linux 6.1 using the kernel's offset macros:

  1. pgd = pgd_offset(mm, vaddr) (1/lkm3.c:48) to find the Page Global Directory entry.
  2. p4d = p4d_offset(pgd, vaddr) (1/lkm3.c:55) for the Page 4th Directory.
  3. pud = pud_offset(p4d, vaddr) (1/lkm3.c:62) for the Page Upper Directory.
  4. pmd = pmd_offset(pud, vaddr) (1/lkm3.c:69) for the Page Middle Directory.
  5. pte = pte_offset_kernel(pmd, vaddr) (1/lkm3.c:76) for the final Page Table Entry pointing to the physical frame."

• Step 3: Defending Against Unmapped and Bad Entries:
  "Then, at every single stage of the walk, defensive validation was mandatory. If an intermediate directory pointer is empty or points to a non-existent table, dereferencing it causes an immediate kernel crash. I verified every level using pgd_none(), !pgd_present(), and pgd_bad() (1/lkm3.c:49-53) checks. If any entry failed validation, the module aborted cleanly, reporting that the virtual page was not backed by physical memory."

• Step 4: Physical Address Calculation & Cross-Arch Portability:
  "Once I reached a valid leaf pte, I computed the physical address using the formula: $$\text{PhysAddr} = (\text{pte\_pfn}(*\text{pte}) \ll \text{PAGE\_SHIFT}) \mid (\text{vaddr} \ \& \ \sim\text{PAGE\_MASK})$$ To ensure cross-architecture portability across x86_64 and arm64, I deliberately avoided architecture-specific bitmasks like PTE_PFN_MASK or PTE_ADDR_MASK. Instead, I used the architecture-agnostic pte_pfn() (1/lkm3.c:83) macro to extract the Page Frame Number, guaranteeing consistent behavior regardless of hardware bit shifts (implemented identically in 2.1/chardev.c:64)."

• Step 5: User-Space Verification via /proc/self/pagemap:
  "Finally, to prove correctness, I built a user-space client (dev_user.c:39-58) that allocated dynamic heap memory, queried the module via ioctl for its physical address, and cross-referenced the result by reading /proc/self/pagemap. The physical frame address returned by my page table walk matched /proc/self/pagemap with 100% bitwise accuracy."

📋 Step-by-Step Summary (What, How & Why)

❓ Anticipated Interview Questions & Crisp Answers

Q1: Why did you implement a manual 5-level page table walk in Ring 0 instead of using existing kernel APIs like get_user_pages() or /proc/[pid]/pagemap?

Answer: get_user_pages() (GUP) forcibly faults in unmapped pages, pins physical frames into memory, and alters process state. A memory inspection tool or translation driver must be non-intrusive—observing page residency without mutating state or triggering disk/swap I/O. /proc/[pid]/pagemap is a user-space pseudo-file requiring VFS file reads, context switches, and string parsing. A manual walk in Ring 0 directly reads the MMU radix tree in real time with microsecond latency and zero side effects.

Q2: What crashes or edge cases did you encounter when walking page tables, and how did you prevent kernel panics?

Answer: Two fatal failure modes occurred: 1) Kernel threads have task->mm == NULL, so attempting to read mm->pgd causes an immediate null pointer dereference panic. 2) Because Linux uses demand paging, memory allocated with malloc() or mmap() does not have physical frames populated until the first byte write. Attempting to traverse intermediate directory pointers when entries are empty (pgd_none, p4d_none, pud_none, pmd_none, pte_none) or marked bad (*_bad()) triggers kernel page faults in Ring 0. We guarded every single level with defensive _none and _bad validation before advancing to the next level.

Q3: How did you verify that your calculated physical address was bit-for-bit accurate?

Answer: We wrote a dedicated user-space verification harness (dev_user.c) that allocated a page, wrote a unique signature into it, and resolved its physical page frame number (PFN) via /proc/self/pagemap by seeking to (vaddr / PAGE_SIZE) * sizeof(uint64_t) and masking bit 63 (present) and bits 0-54 (PFN). We then sent that same virtual address to our kernel character driver via ioctl. The harness cross-referenced the driver's returned physical address against (pagemap_pfn << 12) | page_offset, proving bit-for-bit translation accuracy.