好友
阅读权限 10
听众
最后登录 1970-1-1
先普及一下TLB的作用和实验的思路,然后直接上代码
In a multiprocessor system, each CPU has its own TLB, called the local TLB of the CPU. Contrary to the hardware cache, the corresponding entries of the TLB need not be synchronized, because processes running on the existing CPUs may associate the same linear address with different physical ones. 简单翻译:cpu每个核都有一个TLB
源码一共就两个文件,一个是a.asm 汇编文件extern p1:qwordextern p2:qwordextern p3:qwordextern p1_first :qwordextern p1PteBase:qwordextern p2PteBase:qword
.CODEIdtEntry PROC swapgs int 3 mov rax,qword ptr [p1];下面三句将p1变量的地址加入TLB mov rbx,[rax] mov p1_first,rbx ;下面两句刷新TLB ;mov rax,cr3 ;mov cr3,rax
mov rax,p1PteBase mov rbx,p2PteBase mov rbx,[rbx] mov [rax],rbx ;物理页改完之后 mov rax,qword ptr [p1] mov rbx,[rax] mov p3,rbx
swapgs iretq
IdtEntry ENDP
go PROC int 20h ret go ENDP
END一个是.cpp文件
#include<Windows.h>#include<intrin.h>#include<iostream>using namespace std;#define g_PTE_BASE 0xFFFFF68000000000#define g_PDE_BASE 0xFFFFF6FB40000000#define g_PPE_BASE 0xFFFFF6FB7DA00000#define g_PXE_BASE 0xFFFFF6FB7DBED000#define PTE_BASE(va) ((ULONG_PTR)(((((va & 0xffffffffffff) >> 12)) << 3) + g_PTE_BASE))#define PDE_BASE(va) ((ULONG_PTR)(((((va & 0xffffffffffff) >> 21)) << 3) + g_PDE_BASE))#define PPE_BASE(va) ((ULONG_PTR)(((((va & 0xffffffffffff) >> 30)) << 3) + g_PPE_BASE))#define PXE_BASE(va) ((ULONG_PTR)(((((va & 0xffffffffffff) >> 39)) << 3) + g_PXE_BASE))extern "C"{ extern void go(); extern void IdtEntry(); ULONG_PTR p1; ULONG_PTR p2; ULONG_PTR p1_first=0; ULONG_PTR p3; ULONG_PTR p1PteBase; ULONG_PTR p2PteBase;}
using namespace std;int main(){ //eq fffff800`00b95280 4000ee00`00105940 //eq fffff800`00b95288 00000001 if ((ULONG64)IdtEntry != 0x140005940) { cout << hex << (ULONG64)IdtEntry; getchar(); return -1; } p1 = (ULONG_PTR)VirtualAlloc(NULL, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); p2 = (ULONG_PTR)VirtualAlloc(NULL, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); *(DWORD*)p1 = 4; *(DWORD*)p2 = 8; if (p1 == 0 || p2 == 0) { cout << "p1 || p2 null" << endl; } else { cout << hex << "p1 " << p1 << " p2 " << p2 << endl; } p1PteBase = PTE_BASE((ULONG_PTR)p1); p2PteBase = PTE_BASE((ULONG_PTR)p2);
go(); //DebugBreak(); //cout << "物理页改完之后a " << *(DWORD*)p1; //出错 printf("a first %d\n",p1_first); printf("物理页改完之后a %d", p3); getchar(); return 0;}
实验思路
找到 2 个变量 A , B (这两个变量最好在不同的页上,比较方便,也不容易出问题) 提示:用VirtualAlloc 给 A,B分配0x1000字节的内存,确保在不同的页上。 或者用周壑的办法,定义2个节,节是肯定要按页对齐的,但是我觉得这样比较麻烦,就直接用API搞了 A=0 B=1 先读取A的值,然后将B的物理页挂给A,再读A的值。
不刷新TLB和刷新TLB的结果是不同的,TLB的作用就是可以少进行页表翻译找物理地址,从而更快的找到物理地址,读写内存。
发帖前要善用【论坛搜索 】 功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。