When we try to read/write some data to/from a specific address we must know where the first page directory is stored and the address we want translate.

As for the first page directory (as far as I know linux uses 4-level paging, so the first one should be PGD), and for Intel - CR3 register will contain the address of PGD, but where the virtual address is stored? How will MMU understand that it should translate exactly this or that address?

UPD: I think I should clarify my question and provide a few details how I see that:

As I understood, when some virtual address's gonna be translated we have next steps:

  1. Check the TLB.
  2. If TLB hits then we have physical address (PA)
  3. If it does not, we have to process translation fault
  4. During translation fault we have to walk through software page tables to find the PA.
  5. Here have to switch to kernel mode. (Btw, I know that usually kernel page tables and user page tables are the same, the difference is only in privileges, so is there a way that we won't switch to kernel mode?)
  6. Then we're gonna set CR3 register to PGD address (or another top level page directory)
  7. Now that's our work to walk through this table or not? If software should do it on its own then we know that VA (Virtual Address) within some var and can look for PA in page tables??? Or this work on MMU (or like smth that) and it will go through these tables and as for CR3 will know where the PGD, but how it can understand what address this is translating? Is it in some register or already loaded somewhere in memory?

Thank you for your time!

  • This is covered in some depth at sxia.medium.com/… and wiki.osdev.org/Memory_Management_Unit
    – steve
    Aug 12, 2022 at 8:07
  • "When we try… we must know…" Errrr ? It certainly depends how you are accessing what (since common methods are designed to abstract all that knowledge) Do you mean you are accessing the memory via /dev/mem ?
    – MC68020
    Aug 12, 2022 at 8:10
  • @MC68020, not really, I meant that within paged address translation process in order to translate virtual address into physical one we find the address of PGD (which is in CR3) then looking for entry there (usually index is 9 bits of the virtual address) and the same for PUD, PMD, etc. But according to this translation we know where the PGD is stored (CR3), but where the virtual address is stored for now, that we want to translate into physical?
    – k1r1t0
    Aug 12, 2022 at 9:25
  • Then you actually mean "When the cpu tries to read/write…" In other words irrespective of whatever program / driver used to actually read or write ? BTW linux also supports 5-level paging kernel.org/doc/html/latest/x86/x86_64/5level-paging.html
    – MC68020
    Aug 12, 2022 at 9:47
  • And if I then correctly understand your question then the mmu knows how it should remap thanks to the virtual memory map kernel.org/doc/html/latest/x86/x86_64/mm.html
    – MC68020
    Aug 12, 2022 at 9:52

1 Answer 1


The steps you’ve listed aren’t quite right; hopefully fixing that will allow you to understand what’s going on.

  1. The CPU attempts to access memory (e.g. to read an instruction, or because the current instruction accesses memory) — this is where the virtual address comes from.

  2. Check the TLB.

  3. If the TLB has an entry for the virtual address, we’ve got the corresponding physical address.

  4. Otherwise, the MMU has to handle the TLB miss (it’s not a fault on x86; it gets counted but the kernel isn’t aware of it).

  5. The MMU walks through the pages tables, potentially starting at the value stored in CR3. It knows the virtual address it needs to resolve, from step 0.

  6. There’s no switch to kernel mode, this is all handled by the MMU (on x86).

  7. CR3 and the page tables had to be set up before the memory access, nothing is changed here. (See this in-depth analysis of pagewalk coherence.)

Some architectures (MIPS, I think) do involve the kernel when handling a TLB miss; in such cases the virtual address which needs to be handled is provided in the fault information.

  • 3. Is this not what is named "translation fault" ? Hence, triggering the cpu to start walking tables from a specific address in RAM (CR3) ? (on x86) therefore 4. I am not sure the MMU is the right subject for the verb and 5 even less sure.
    – MC68020
    Aug 12, 2022 at 13:19
  • Great answer, but under "translation fault" I meant TLB miss not page fault, so I'm still thinking this term is correct here. And as I understand MMU always keep an eye on any VA, so when the cpu tries to access any VA, MMU will handle this try and translate the address if it is not in TLB, right? And how MMU will do that is implementation specific things?
    – k1r1t0
    Aug 12, 2022 at 13:34
  • @MC68020 3. a fault means the operating system is involved (see page fault for example); that’s not the case here. 4. At a high level, as far as the rest of the CPU is concerned, the MMU takes care of the page walk; the page walk is transparent to everything else (apart from the added delay), unless the page walk itself causes a page fault (as can happen on Windows for example). Of course since all x86 CPUs have a built-in MMU now, the distinction is somewhat tenuous (which I suspect is why most texts talk about the CPU walking the page tables). Aug 12, 2022 at 13:41
  • @k1r1t0 as above, a fault means the operating system is involved, which isn’t the case here. The MMU doesn’t really “keep an eye” on any VA; it’s invoked explicitly on any CPU-based memory access. It does more than VA-to-PA translation, it also checks permissions, page presence etc. Aug 12, 2022 at 13:42
  • @StephenKitt, could you share some link where I can find more details about MMU?
    – k1r1t0
    Aug 12, 2022 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .