Date: Tue, 18 Dec 2018 12:32:02 +0200 From: Konstantin Belousov <kostikbel@gmail.com> To: Alexander Lochmann <alexander.lochmann@tu-dortmund.de> Cc: freebsd-stable@freebsd.org, Horst Schirmeier <horst.schirmeier@tu-dortmund.de> Subject: Re: Address Collision using i386 4G/4G Memory Split Message-ID: <20181218103202.GF60291@kib.kiev.ua> In-Reply-To: <24cb941b-1d27-1621-f437-18ed3b22cc7d@tu-dortmund.de> References: <38ad0d50-c776-9deb-d56b-db8db548cefc@tu-dortmund.de> <20181218052738.GZ60291@kib.kiev.ua> <40f4db11-84cb-9b8d-2eb5-5882ad01d1d8@tu-dortmund.de> <20181218100159.GE60291@kib.kiev.ua> <24cb941b-1d27-1621-f437-18ed3b22cc7d@tu-dortmund.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Dec 18, 2018 at 11:22:53AM +0100, Alexander Lochmann wrote: > > >> Some context: We are doing VM-based tracing in the FreeBSD kernel. For > >> that, we observe parts of the kernel memory (allocations, accesses,...). > >> Before 12.0 we simply knew that kernel addresses that we logged were > >> unique. Moreover, when a memory access to a region of interest happened > >> we knew that could only be kernel memory. > >> We know have to ensure that we only record memory accesses that happen > >> within the kernel. > >> Our approach is to record the kernels value for the CR3 register, and > >> record memory accesses if the CR3 registers holds the aforementioned value. > > You must use CPL to see if the current operation mode is user or kernel. > > If user, nothing should be done (this would avoid vm86). If kernel, you > > need to compare current %cr3 with IdlePTD (IdlePTDP for PAE case). > > > Thanks for the advice! We'll include that in our toolchain. > Do you use PLs other than 0(=kernel) and 3(=user)? No, only 0 and 3. But be careful with vm86 (I am not sure how your VM reports it to your instrumentation).
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20181218103202.GF60291>