Re: Mem_event API and MEM_EVENT_REASON_SINGLESTEP

[Razvan Cojocaru <rzvncj@gmail.com>]

>> I do see single step mem_events after. I've tried it on a SMP HVM
>> Slackware guest. What behaviour am I observing? The gla and gfn values
>> are being printed out - but I don't know how to detect a write operation
>> based on them. Tim Deegan has kindly suggested that I pass those values
> 
> You will not be able to detect a write event based on them as you have
> marked the page rwx. One option is to mark the page rx and continue
> single stepping the page. The on the next write to that page should
> give you a write violation and there you can stop single stepping the
> page.

I'm not trying to detect a write event - the write event has already
been detected: before the "case MEM_EVENT_REASON_VIOLATION" part of the
code, I've put "xc_hvm_set_mem_access(xch, domain_id, default_access, 0,
xenaccess->domain_info->max_pages);". Default_access, in the
xen-access.c file, is rx, and after_first_access is rwx.

What I am trying to do is catch the first write operation (that's why
I'm single stepping), not the first write mem_event.

My scenario is this: I'd like to mark _all_ of the domain's pages rw,
then when I get a write mem_event, mark only one page rwx, allow that
write (single stepping), then mark that one page rw again. This would
allow me to catch more than one write per unique domain page, as
xen-access.c does. Xen-access.c does not catch subsequent writes to a
page once it received a write mem_event about it.

Thanks,
Razvan Cojocaru