Finally,
we get to the x64 virtual address translations that
happens today for 64‑bit systems.
The basic ideas are the same; it's just the same mechanism is
extended to cover very large addresses.
And remember that we have only 48 bits that are using today's systems.
And so we are looking only in the 48 bits,
which are the extreme 24 bits on one side and 24 bits
on the other side of the address,
where the middle 16 bits don't really matter for address translation,
so I'm not showing that, but we're just looking at these 48 bits.
And so the same ideas apply, but now we have more levels of interaction,
and the highest data structure here is known as page map level 4.
Intel, at some point,
decided to ditch these names like page directory
table pointers and things like that, and decided to start using numbers because,
obviously, these kinds of naming do not scale very well.
So we have again the page map level 4,
that would be the data structure that is always in physical memory,
and it's pointed to buy CR3 when translation is happening,
based on this process that is currently in scope,
that means one of its threats is executing,
and of course,
the KPROCESS structure holds onto this information so that when
the context switch occurs between threats,
if a different process has to be present now,
then that data, that address, can be extracted from that KPROCESS.
And again,
you have these 9‑bit skeins _____ because every entry is 8 bytes in size,
and it wasn't increased until now.
It hasn't increased yet, and it's not really needed at this point.
There are enough bits there to go around.
So again, we have the first 9 bits, the upper 9 bits,
selecting particular PFN,
and that PFN points to one of the possible 512 page directory pointer tables,
so we have one of those being used right now.
And again, we have more 9 bits coming from the page directory pointer,
pointing to a particular PFN that points to a particular page directory,
that again, could be one of 512 possible page directories.
And the same thing continues with page tables by
selecting a particular page table.
And finally, the PFN here, which is the PTE,
the page table entry,
will point to the beginning of a page as usual where the offset will serve
as the offset to that particular byte within that page.
So exactly the same idea as before is simply extended.
So why is it called page map level 4?
Well, you'll notice that's the fourth level here.
So that's level 1, level 2, level 3, and level 4.
And another thing we can see here is that you might recall from the
beginning of this course when we talked about the fact that Intel
supports now 57 bits in virtual address space,
which Windows currently doesn't use, but we'll use in the future,
and you might be wondering where that number 57 is coming from.
So now it's perhaps more obvious, because if we add 9 to 48, we get to 57.
So essentially, we have another full layer of translation,
and in fact, in that case,
the singleton entity there is known as page map level 5,
or PML5 if you look that up in Intel's documentation.
So that's the idea.
It's the same thing, just extended by yet another full layer of translation,
which consists of more, 9 bits more, and this is why we get to 57.
This is how that number came to be.
It's not really random, it has full meaning.
In the 48 bits case,
you can see that this entire set of addresses is full so we have 9 bits,
9 bits, all the way around; there's nothing less than that.
So this is how 64‑bit address translation works today,
and obviously,
there is an overhead here for accessing all these data structures here,
in order just to figure out where to actually make the access.
And again, this brings me back to the translation lookaside buffer cache,
which is super important in this case to make these things faster when you access similar or close‑by memory.