[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] dump-guest-memory command?
From: |
Greg Kurz |
Subject: |
Re: [Qemu-devel] dump-guest-memory command? |
Date: |
Fri, 16 May 2014 12:15:40 +0200 |
On Fri, 16 May 2014 17:59:25 +0800
Jun Koi <address@hidden> wrote:
> On Fri, May 16, 2014 at 5:51 PM, Greg Kurz <address@hidden> wrote:
>
> > On Fri, 16 May 2014 16:40:23 +0800
> > Jun Koi <address@hidden> wrote:
> > > On Fri, May 16, 2014 at 3:03 PM, Greg Kurz <address@hidden>
> > wrote:
> > >
> > > > On Fri, 16 May 2014 14:24:16 +0800
> > > > Jun Koi <address@hidden> wrote:
> > > > > Hi,
> > > > >
> > > > > Anybody please help me on this dump-guest-memory command? How does
> > the
> > > > > virtual memory map to the dumped file?
> > > > >
> > > > > For example, if x86 register RIP points to 0x12345, how does that
> > map to
> > > > > the dump file? Meaning how can I find where this address 0x12345 in
> > the
> > > > > dump?
> > > > >
> > > > > I tried, but couldnt find much documentation on this command.
> > > > >
> > > > > Thank you a lot,
> > > > > Jun
> > > >
> > > > Hi Jun,
> > > >
> > > > The dump file is in ELF format and data is written in ELF notes.
> > > > Use readelf -a on the file and you'll get something like the
> > > > following at the end of the output:
> > > >
> > > > ...
> > > >
> > > > Notes at offset 0x000001c8 with length 0x00000328:
> > > > Owner Data size Description
> > > > CORE 0x00000150 NT_PRSTATUS (prstatus
> > structure)
> > > > QEMU 0x000001b0 Unknown note type: (0x00000000)
> > > >
> > > > The registers sit in the NT_PRSTATUS note (hence somewhere offset
> > > > 0x000001c8 and 0x000001c8+0x00000150+0x14 (the latter is the ELF note
> > > > header size). Be aware that intel is little endian: if RIP is
> > 0x00012345,
> > > > you need to look for '45 23 01 00' in the file.
> > > >
> > > >
> > > Thanks so much, but perhaps you misunderstood my question? What I want to
> > > know is how to map 0x12345 (virtual address) back to the dump file.
> > >
> >
> > Heh... sorry for that, morning isn't the best time to answer questions I
> > guess ;)
> >
> > > For example, if 0x12345 was executing some filesystem code at the time I
> > > dumped the VM, then I can locate exactly that code in the dumpfile,
> > thanks
> > > to the given RIP address (which is 0x12345 in this example)
> > >
> > > I hope I explain my idea clear enough this time?
> > >
> >
> > Yeah. Maybe the crash utility (http://people.redhat.com/anderson) can
> > help.
> >
> >
> but my VM is not Linux, so is this tool helpful?
>
> some questions:
>
> - is it true that dump-guest-memory just write down physical memory page,
> and does not consider the virtual-memory concept?
>
> - if above is true, how can i translate virtual address to physical
> address? (since only after that i can map my virtual address to its
> position in the dumpfile)
>
> thanks!
> Jun
>
from dump.c:
static int write_elf64_load(DumpState *s, MemoryMapping *memory_mapping,
int phdr_index, hwaddr offset,
hwaddr filesz)
{
Elf64_Phdr phdr;
int ret;
int endian = s->dump_info.d_endian;
memset(&phdr, 0, sizeof(Elf64_Phdr));
phdr.p_type = cpu_convert_to_target32(PT_LOAD, endian);
phdr.p_offset = cpu_convert_to_target64(offset, endian);
phdr.p_paddr = cpu_convert_to_target64(memory_mapping->phys_addr, endian);
phdr.p_filesz = cpu_convert_to_target64(filesz, endian);
phdr.p_memsz = cpu_convert_to_target64(memory_mapping->length, endian);
phdr.p_vaddr = cpu_convert_to_target64(memory_mapping->virt_addr, endian);
It looks like the information is part of the ELF program header.
Cheers.
--
Gregory Kurz address@hidden
address@hidden
Software Engineer @ IBM/Meiosys http://www.ibm.com
Tel +33 (0)562 165 496
"Anarchy is about taking complete responsibility for yourself."
Alan Moore.
- [Qemu-devel] dump-guest-memory command?, Jun Koi, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Greg Kurz, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Greg Kurz, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Jun Koi, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?,
Greg Kurz <=
- Re: [Qemu-devel] dump-guest-memory command?, Laszlo Ersek, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Jun Koi, 2014/05/16
- Re: [Qemu-devel] dump-guest-memory command?, Laszlo Ersek, 2014/05/16