1

perf is able to record multiple fields such as addr, ip, timestamp. It also can record general registers as seen at https://github.com/torvalds/linux/blob/master/tools/perf/arch/x86/util/perf_regs.c. But I can't find any related document about recording control registers using perf. So how can I achieve that using perf? Are there any other tools available?

awws
  • 51
  • 1
  • 5

1 Answers1

2

You cannot record control register values using perf tools. The list of registers that you can sample using --intr-regs option is limited to the registers listed here. You can confirm this by looking here.

The registers that can be accessed by the perf events module is architecture dependent, as can be seen here and here. Including selective register states into the perf record/script output has been introduced by this commit. This means, all of perf would be limited to using the registers that have been specified and nothing more.

There are other questions/answers here, that tell you some ways of writing a program/kernel module to access the control registers. On top of this, you can use QEMU (in TCG mode) and run your program inside the VM. You can then print register state periodically (at the end of each TB - where you'll see all register values). There are designated emulators like GDB also, which might help you.

Edit -

There is one way by which cr3 register values can be recorded. You can use IntelPT to record control flow information for a program, during its execution. IntelPT tracks changes to CR3 registers with the help of the PIP packet. You can use the traces generated by IntelPT to track and determine the CR3 values.

Arnabjyoti Kalita
  • 2,325
  • 1
  • 18
  • 31
  • I want to get the cr3 value of perf-like events from outside of the virtual machine. Is there any other hardware features supporting this? – awws Jan 07 '21 at 08:14
  • Yes, you can use IntelPT to record CR3 values. I have added an edit to my original answer. Please look at it. – Arnabjyoti Kalita Jan 07 '21 at 11:51