From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38750) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WlFBF-0005ej-Dw for qemu-devel@nongnu.org; Fri, 16 May 2014 06:16:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WlFB6-0005n9-3c for qemu-devel@nongnu.org; Fri, 16 May 2014 06:15:57 -0400 Received: from e06smtp10.uk.ibm.com ([195.75.94.106]:36862) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WlFB5-0005mz-R1 for qemu-devel@nongnu.org; Fri, 16 May 2014 06:15:48 -0400 Received: from /spool/local by e06smtp10.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 16 May 2014 11:15:46 +0100 Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id 219671B0806E for ; Fri, 16 May 2014 11:15:59 +0100 (BST) Received: from d06av03.portsmouth.uk.ibm.com (d06av03.portsmouth.uk.ibm.com [9.149.37.213]) by b06cxnps3074.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id s4GAFhUa2949434 for ; Fri, 16 May 2014 10:15:43 GMT Received: from d06av03.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id s4GAFhHU028065 for ; Fri, 16 May 2014 04:15:43 -0600 Date: Fri, 16 May 2014 12:15:40 +0200 From: Greg Kurz Message-ID: <20140516121540.0e39c90d@bahia.local> In-Reply-To: References: <20140516090322.78f174a3@bahia.local> <20140516115158.301d8fc7@bahia.local> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] dump-guest-memory command? List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jun Koi Cc: "qemu-devel@nongnu.org" On Fri, 16 May 2014 17:59:25 +0800 Jun Koi wrote: > On Fri, May 16, 2014 at 5:51 PM, Greg Kurz wrote: > > > On Fri, 16 May 2014 16:40:23 +0800 > > Jun Koi wrote: > > > On Fri, May 16, 2014 at 3:03 PM, Greg Kurz > > wrote: > > > > > > > On Fri, 16 May 2014 14:24:16 +0800 > > > > Jun Koi wrote: > > > > > Hi, > > > > > > > > > > Anybody please help me on this dump-guest-memory command? How does > > the > > > > > virtual memory map to the dumped file? > > > > > > > > > > For example, if x86 register RIP points to 0x12345, how does that > > map to > > > > > the dump file? Meaning how can I find where this address 0x12345 in > > the > > > > > dump? > > > > > > > > > > I tried, but couldnt find much documentation on this command. > > > > > > > > > > Thank you a lot, > > > > > Jun > > > > > > > > Hi Jun, > > > > > > > > The dump file is in ELF format and data is written in ELF notes. > > > > Use readelf -a on the file and you'll get something like the > > > > following at the end of the output: > > > > > > > > ... > > > > > > > > Notes at offset 0x000001c8 with length 0x00000328: > > > > Owner Data size Description > > > > CORE 0x00000150 NT_PRSTATUS (prstatus > > structure) > > > > QEMU 0x000001b0 Unknown note type: (0x00000000) > > > > > > > > The registers sit in the NT_PRSTATUS note (hence somewhere offset > > > > 0x000001c8 and 0x000001c8+0x00000150+0x14 (the latter is the ELF note > > > > header size). Be aware that intel is little endian: if RIP is > > 0x00012345, > > > > you need to look for '45 23 01 00' in the file. > > > > > > > > > > > Thanks so much, but perhaps you misunderstood my question? What I want to > > > know is how to map 0x12345 (virtual address) back to the dump file. > > > > > > > Heh... sorry for that, morning isn't the best time to answer questions I > > guess ;) > > > > > For example, if 0x12345 was executing some filesystem code at the time I > > > dumped the VM, then I can locate exactly that code in the dumpfile, > > thanks > > > to the given RIP address (which is 0x12345 in this example) > > > > > > I hope I explain my idea clear enough this time? > > > > > > > Yeah. Maybe the crash utility (http://people.redhat.com/anderson) can > > help. > > > > > but my VM is not Linux, so is this tool helpful? > > some questions: > > - is it true that dump-guest-memory just write down physical memory page, > and does not consider the virtual-memory concept? > > - if above is true, how can i translate virtual address to physical > address? (since only after that i can map my virtual address to its > position in the dumpfile) > > thanks! > Jun > from dump.c: static int write_elf64_load(DumpState *s, MemoryMapping *memory_mapping, int phdr_index, hwaddr offset, hwaddr filesz) { Elf64_Phdr phdr; int ret; int endian = s->dump_info.d_endian; memset(&phdr, 0, sizeof(Elf64_Phdr)); phdr.p_type = cpu_convert_to_target32(PT_LOAD, endian); phdr.p_offset = cpu_convert_to_target64(offset, endian); phdr.p_paddr = cpu_convert_to_target64(memory_mapping->phys_addr, endian); phdr.p_filesz = cpu_convert_to_target64(filesz, endian); phdr.p_memsz = cpu_convert_to_target64(memory_mapping->length, endian); phdr.p_vaddr = cpu_convert_to_target64(memory_mapping->virt_addr, endian); It looks like the information is part of the ELF program header. Cheers. -- Gregory Kurz kurzgreg@fr.ibm.com gkurz@linux.vnet.ibm.com Software Engineer @ IBM/Meiosys http://www.ibm.com Tel +33 (0)562 165 496 "Anarchy is about taking complete responsibility for yourself." Alan Moore.