Re: Can't map the page referenced by HVM-DomU CR3 in Dom0

[david <david_n@gmx.at>]

On 04/18/2011 11:34 AM, Tim Deegan wrote:
> At 14:45 +0100 on 15 Apr (1302878734), david wrote:
>> I'm trying to access the page containing the paging information for a
>> DomU from Dom0.
>>
>> I'm doing that by translating the address contained in the DomU CR3
>> register with xc_translate_foreign_address (libxc) and try to map the
>> returned frame number with xc_map_foreign_range.
>>
>> The problem is, that the return value from xc_translate_foreign_address
>> is 0 (guest cr3 is 0x002f3000 in my case), which indicates an error
>> (corresponding to the code comments). After some debugging I have
>> discovered, that pte becomes 0 when level=2 and therefore the function
>> returns 0 on line 79:
>
> How often does this happen?  On every attempt or only from time to time?
> Have you checked (say, from inside the guest) that the level-2 PTE isn't
> actually zero?

hi,

it happens for every cr3 value. I made some quick and dirty code, which 
reads 10 different cr3 values and tries to map the corresponding page:

----------------------------------------------------------------------
...
...
int crfinder = 1;

if(crfinder == 1){
         int m;
         unsigned long cr3s[10] = {0};
         unsigned long mfn = 0;
         vcpu_guest_context_any_t *ctxt = 
malloc(sizeof(vcpu_guest_context_any_t));
         unsigned long cr3 = ctxt->c.ctrlreg[3];

         while(1 == 1){

                 xc_vcpu_getcontext(xcinterface, domain, 
dominfo.max_vcpu_id, ctxt);
                 cr3 = ctxt->c.ctrlreg[3];

                 for(m = 0; m < 10; m++){

                         //already stored?
                         if(cr3s[m] == cr3){

                                 break;
                         //checked all stored cr3 values?
                         }else if (cr3s[m] != 0){

                                 continue;
                         //obviously new one found
                         }else{
                                 cr3s[m] = cr3;
                                 printf("new cr3 found %08x, stored in 
%d\n", cr3, m);

                                 mfn = 
xc_translate_foreign_address(xcinterface, domain, 0, cr3s[m]);
                                 printf("calculated mfn %08d for address 
%08x\n", mfn, cr3s[m]);
                                 break;
                         }
                 }

                 if(m == 10)
                        return 0;
         }
}
----------------------------------------------------------------------

the corresponding output is:

new cr3 found 002f3000, stored in 0
calculated mfn 00000000 for address 002f3000
new cr3 found 06ac01a0, stored in 1
calculated mfn 00000000 for address 06ac01a0
new cr3 found 06ac0040, stored in 2
calculated mfn 00000000 for address 06ac0040
new cr3 found 06ac00a0, stored in 3
calculated mfn 00000000 for address 06ac00a0
new cr3 found 06ac01e0, stored in 4
calculated mfn 00000000 for address 06ac01e0
new cr3 found 06ac0320, stored in 5
calculated mfn 00000000 for address 06ac0320
new cr3 found 06ac02a0, stored in 6
calculated mfn 00000000 for address 06ac02a0
new cr3 found 06ac01c0, stored in 7
calculated mfn 00000000 for address 06ac01c0
new cr3 found 06ac0200, stored in 8
calculated mfn 00000000 for address 06ac0200
new cr3 found 06ac0060, stored in 9
calculated mfn 00000000 for address 06ac0060

so, every try to translate a cr3 address to a frame number (I don't know 
what's the correct wording for frame numbers in hvm domains, .. mfn?) 
ends in 0. Maybe it's a failure in my code? I can't find it currently :) 
... I'm trying now, to read the cr3 values inside the domain, to check 
if the values are the same.

greets,
david


>
> Cheers,
>
> Tim.
>