Re: [Qemu-devel] Dump guest page table inside QEMU makes system hang

[Max Filippov]

On Tue, Aug 21, 2012 at 10:19 PM, Blue Swirl <address@hidden> wrote:
> On Tue, Aug 21, 2012 at 7:21 AM, 陳韋任 (Wei-Ren Chen)
> <address@hidden> wrote:
>> Hi all,
>>
>>   I want to dump guest page table when guest writes to cr3,
>> the code snipt below,
>>
>> ---
>> uint32_t pgd[1024][1024]; // guest page table
>> static void dump_guest_pgtable(target_ulong cr3)
>> {
>>     int i, j;
>>     uint32_t phyaddr = cr3;
>>     uint32_t val;
>>
>>     for (i = 0; i < NUM_ENTRY; ++i)
>>     {
>>         phyaddr += i * 4;
>>         for (j = 0; j < NUM_ENTRY; ++j)
>>         {
>>             cpu_physical_memory_read(phyaddr, &val, 4);
>>             pgd[i][j] = val;
>>         }
>>     }
>> }
>>
>> void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3)
>> {
>>     env->cr[3] = new_cr3; // guest cr3
>>
>>     if (env->cr[0] & CR0_PG_MASK) {
>>         tlb_flush(env, 0);
>>
>>         // dump guest page table by using guest cr3
>>         dump_guest_pgtable(new_cr3);
>>     }
>> }
>> ---
>>
>>   The system will hang while booting. However, if I comment
>> cpu_physical_memory_read in function dump_guest_pgtable, there
>> is no problem. What I am missing here? Thanks.
>
> cpu_physical_memory_read() can cause faults or other side effects like
> MMIO. Using cpu_get_phys_page_debug() may help.
>

Maybe you just need to avoid accessing unsuitable physical addresses?
Or maybe 'if (env->cr[0] & CR0_PG_MASK)' is not strong enough, may
(CR0_PG_MASK | CR0_PE_MASK) be better?

At what stage does it hang? What CR3 value changes are observed before
the hang?

-- 
Thanks.
-- Max