{"id":112255,"date":"2026-04-22T07:00:00","date_gmt":"2026-04-22T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=112255"},"modified":"2026-04-22T13:45:17","modified_gmt":"2026-04-22T20:45:17","slug":"20260422-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20260422-00\/?p=112255","title":{"rendered":"Mapping the page tables into memory via the page tables"},"content":{"rendered":"<p>On the 80386 processor, there is a trick for mapping the page tables into memory: You set a slot in the top-level page directory to point to\u2026 the page directory itself. When you follow through this page directory entry, you end up back at the page directory, and the effect is that the process of mapping a linear address to a physical page ends one stop early.\u00b9 You end up pointing not at the destination page, but at the page table that points at the destination page. From the point of view of the address space, it looks like all of the page tables have been mapped into memory. This makes it easier to edit page directory entries\u00b2 because you can do it within the address space.<\/p>\n<p>I learned about this trick from the developer in charge of the Windows 95 memory manager.\u00b3 He said that this technique was actually suggested by Intel itself. In the literature, it appears to be known as <a href=\"https:\/\/wiki.osdev.org\/Fractal_Page_Mapping\"> fractal page mapping<\/a>.<\/p>\n<p>Seeing as Intel itself suggested the use of this trick, it is hardly a coincidence that the page table and page directory entry formats are conducive to it. The trick carries over to the x86-64 page table structure, and my understanding is that it works for most other processor architectures as well.<\/p>\n<p>\u00b9 And if you access an address within that loopback page directory entry that itself corresponds to the loopback page directory entry, then you stop <i>two<\/i> steps early, allowing you to access the page directory entry.<\/p>\n<p>\u00b2 Or page table entries.<\/p>\n<p>\u00b3 It appears that Windows NT uses the same trick. See slides 36 and 37 of <a href=\"https:\/\/www.cs.fsu.edu\/~zwang\/files\/cop4610\/Fall2016\/windows.pdf\"> Dave Probert&#8217;s 2008 presentation titled Architecture of the Windows Kernel<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So-called &#8220;fractal page mapping&#8221;.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-112255","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"<p>So-called &#8220;fractal page mapping&#8221;.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/112255","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=112255"}],"version-history":[{"count":1,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/112255\/revisions"}],"predecessor-version":[{"id":112256,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/112255\/revisions\/112256"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=112255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=112255"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=112255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}