From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yacine HEBBAL Subject: Re: gva_to_gpa function internals Date: Tue, 1 Dec 2015 23:07:56 +0100 Message-ID: <565E1A3C.7090101@esi.dz> References: <565E11B0.7050201@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: QUOTED-PRINTABLE To: Paolo Bonzini , kvm@vger.kernel.org Return-path: Received: from mail-wm0-f54.google.com ([74.125.82.54]:37799 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756868AbbLAWHz (ORCPT ); Tue, 1 Dec 2015 17:07:55 -0500 Received: by wmww144 with SMTP id w144so32521871wmw.0 for ; Tue, 01 Dec 2015 14:07:53 -0800 (PST) In-Reply-To: <565E11B0.7050201@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: In fact, my tool walks through paging data structures (entry by entry)=20 using the function "kvm_read_guest" (sorry i don't have my machine with= =20 me right now to poste my code :-( ). for example to read PDPTEs, I do something like this: for(i =3D 0; i < 32; i=3D i + 8) { kvm_read_guest(kvm, cr3 + i, &pdepte, 8); } I use the same logique for PDEs and PTEs (of couse by masking the flags= =20 bits to walk from one level to another) I hope this explains a little more. I'll poste more code tomorrow to give more details. Le 01/12/2015 22:31, Paolo Bonzini a =E9crit : > > On 01/12/2015 19:30, Yacine HEBBAL wrote: >> Hi all, >> I'm trying to build some tools on top of kvm in order to debug, moni= tor and >> reverse engineer the guest OS (ubuntu 12.04, 32 bits) >> One of my tools walks through (and prints) the guest paging data str= uctures >> as following: cr3 -> pdpte -> pde -> pte -> page (PAE paging, 32 bit= s) >> >> According to my logs some accessed kernel PTEs are not present (pte = =3D >> 9090909090909090) in all processes address spaces (even from init pr= ocess >> cr3), however when I use the function kvm_read_guest_virt_helper on = their >> corresponding virtual addresses (GVAs), I get a correct content (con= tent >> correctness checked using system.map file). >> Just after calling kvm_read_guest_virt_helper, I check again the PTE >> corresponding to the read gva, I see that they are unmapped (invalid= , always >> 9090909090909090) >> >> I investigated a little the code of kvm_read_guest_virt_helper, this >> function calls vcpu->arch.walk_mmu->gva_to_gpa(vcpu, gva, ...) which= in turn >> calls other functions until FNAME(walk_addr_generic) which seems to = do the >> translation. >> walk_addr_generic seems to do the translation starting from cr3 of t= he >> current process (in line: mmu->get_cr3(vcpu);) and works fine regard= less of >> the identity of the current process (i.e. current cr3). >> >> So how the function gva_to_gpa is able to the read correctly any GVA= that my >> tool sees invalid (unmapped) in the paging structures, knowing that = my tool >> is able to read and display correctly a content of (thousands) many = other GVAs ? >> I would be very thankful for any feedback :) > Unfortunately that's impossible to know without knowing your tool. H= ow > does it read guest memory? > > Paolo --=20 Hebbal Yacine PhD student Tel +33 6 45 42 10 96