Can x86 cpu read or write on physical address which is larger than RAM?

Question

I'm doing operating system lab on QEMU. I found that read/write is allowed when accessing physical address after paging which is larger than RAM. Is it the same condition on a real x86 machine? Will x32 or x64 cause different results?

Answer 1

The physical address space contains RAM, ROM, memory mapped devices (some PCI and some built into the chipset) and unused space.

An OS can access all of it, including unused space (even though there's no sane reason to deliberately access unused space).

The total amount of physical address space depends on the CPU, and is a "size in bits" (which you can obtain from the CPUID instruction) that ranges from 32 bits to 52 bits, but is often in the 36 to 48 bits range. If you try to use paging to access a "too high, not supported by the CPU" physical address you will get a General Protection Exception (because the "not supported by CPU physical address bits" are treated as reserved and the CPU checks if reserved bits are set in page table entries, etc).

Note that when writing an OS (for modern CPUs) it's easier to assume that physical addresses are 64 bits (regardless of what the CPU supports) and that the physical address space includes a reserved area that can't be accessed (where the size of the reserved area depends on what the CPU supports); as this simplifies code and data structures used for physical memory management (e.g. C has a uint64_t type but nothing has a uint52_t).

I'm doing operating system lab on QEMU. I found that read/write is allowed when accessing physical address after paging which is larger than RAM. Is it the same condition on a real x86 machine?

Yes; both Qemu and real hardware work the same.

Will x32 or x64 cause different results?

The CPU supports several types of paging structures - "plain 32-bit paging", PSE36, PAE (Physical Address Extensions), and long mode. For x32 you can't use long mode paging, but PAE normally has the same layout and the same physical address restrictions (the only case where it doesn't is some Xeon Phi accelerator cards).

If x32 is using "plain 32-bit paging" physical addresses will be restricted to 32 bits; and if it's using PSE36 physical addresses will be restricted to 36 bits.

The other possibility is that x32 isn't using any paging at all. In this case addresses are masked so that only 32 bits can be used (e.g. if you create a segment with a base address of 0xFFFFF000 and "high enough" limit; then use an offset within the segment that's 0x00001000 or more, the result will be masked causing physical addresses to wrap around; like (0xFFFFF000 + 0x00001234) & 0xFFFFFFFF = 0x00000234).

Apart from that, it still works the same (you can still accessed unused parts of the physical address space, there's just less of it, and you might not be able to access all RAM).