Why does the contents of the CR3 register change each time it is read from the kernel module?

Question

I wrote a kernel driver to analyze Linux kernel page tables. I found that whenever I read the CR3 register, from inside the driver the contents of CR3 change every time it reads !

Why is this happening? If the driver starts in kernel mode, CR3 should point to the kernel page directory (on the right?), Then why does CR3 change every time?

If CR3 continues to change, how would the memory access with the driver go as expected?

Answer 1

As already mentioned, you see "pagetable" for the current process. With x86, entering privilege level below 3 does not change the page table. This is why most operating systems reserve sections of the virtual address space for the kernel. The memory in this space is mapped into each process. The memory in the kernel address space can be hidden from the user mode code by setting the u / s flag in the page frame to "0". This means that it is "system" memory, and not as user memory.

Changing the page table is usually done after switching to kernel mode, so kernel memory should be part of the process address space. He would not know where to find these data structures otherwise. The one exception is the "system management mode", which transparently switches address spaces. Suppose this can only happen in response to "interruption of system control", requires special hardware support from the motherboard, and by design cannot be suppressed by the operating system or respond to it.

In addition, in protected mode, the manipulation of the page table is always performed by the OS, after switching to kernel mode. This is part of why the “mode switch” is faster than the full context switch.

Answer 2

CR3 is a directory pointer. It will change every time the address space changes at least. There is no single “sound” memory space. In most memory models (all?), The CR3 value that you see will be specific to the context of the address space you are in (for example, what process are you processing syscall from, etc.).