Generating Log of Guest Physical Addresses from a Kernel Function and Perform Analysis at Runtime

[Greg KH]

On Tue, Sep 24, 2019 at 07:10:59PM +0900, Sahibzada Irfanullah wrote:
> Dear All,
> 
> I have asked this question previously, but some people told me to explain
> what I really want to do. First of all, I am completely naïve andnewbie in
> the kernel development.
> 
> I am trying to develop my own program that generate the log of guest
> physical addresses by trying to save the contents of "gpa" variable (which
> is present in the handle_ept_violation()functino in vmx.c ) into my file. I
> have found one sample code online (which uses filp_open(), filp_close(),
> kernel_read(), and kernel_write() functions), this code is working in the
> kernel space as a kernel module, but not working for my task in the
> handle_ept_voilation().
> 
> My actual goal is to generate log of physical addresses for different
> applications by writing them into the file, and then perform some analysis
> at runtime in this function by reading the logs from the log file.
> Furthermore, I want a file which size can dynamically grow as the size of
> log increases.
> 
> I know that reading/writing in a kernel is not a good idea, but due to
> nature of the task, I have to this.

"have to"?

What about a ring buffer that you write to in the kernel and then read
out from in userspace?  You can use debugfs for that.

But really, a simple tracepoint is probably all you need here, and maybe
not even that if you use ftrace.  Have you tried that today?  I doubt
you need any kernel changes at all to get this information directly from
the kernel to userspace.  Look at all of the ebpf and tracing examples
as a way to do this.

good luck!

greg k-h