Page Mapping

Hello,

This might be very trivial question for people in this mailing list. I need to know if my understanding is correct.

We are doing some experiment with Linux kernel for security. Right now, we are trying to see some behavior in the Linux memory management. I am trying to track and possibly scan (for now) all the pages that's just brought into the memory. I am doing this in i386 arch and Linux kernel 2.4.22.

I think it would be good to do it in: mm/memory.c in do_no_page(). At the end of the function, I have references to pte_t and page struct of the fresh new page that's just brought in from disk (not swapped).

This is diagram the diagram I'm going to refer:
http://www.skynet.ie/~mel/projects/vm/guide/html/understand/node24.html

From my understanding from the diagram of Linear Address to Page conversion (please let me know if I'm correct or misunderstood). The struct "pte_t->pte_low" an entry if PTE table, is the base 'physical' address of the page. In this case I can just use it to reference the page. I can't find any other conversion method to get another address.

Assuming I have that address, can I just direct reference that address (assuming the address is physical and from kernel mode) or do I have to use some methods to access the page content?

How do I know the size of the page that's filled though? I can't see that information from the page struct.

Thanks in Advance for comments and information.

Kuas

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Sorry, please ignore some of the previous question.

I found the answer in Intel Developer guide v3. 'pte_t' consists of the base physical address of the page (20 MSB of pte_t) and page flags (12 LSB of pte_t). So to get the address, I just have to mask the pte_t with PAGE_MASK.

Now the next question is can I just use that address and refer to it right away? Like using a pointer? Or I still have to use some MMU mechanism?

And I don't see anywhere in the page struct to know how big is the page filled? I don't think every page has all 4 KB filled, right? Or are all the pages zeroed out before being reassigned? So I still can read the whole page, just the last bytes will be 0x00 if it's not used.

Kuas.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

No, it's a physical address. Normally, pointers inside the kernel contain virtual addresses, and the MMU will translate them into physical addresses automatically.

If you know the page is present in RAM and you want to access the contents of the page, you can convert it to a virtual address and then use that address. There's the "phys_to_virt" function that you can use.

I think that anonymous pages are usually set up copy-on-write from the ZERO_PAGE. They'll be all zero in parts of the page that haven't been modified.

--Ed L Cashin            |   PGP public key:
  [email protected]        |   http://noserose.net/e/pgp/

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected].  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Ed L Cashin <[email protected]> writes:

...

I should have mentioned that looking at get_user_pages in mm/memory.c first is a good idea. It will help remind you of all the synchronization issues.

--Ed L Cashin            |   PGP public key:
  [email protected]        |   http://noserose.net/e/pgp/

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected].  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>