Re: [PATCH] xen: Disable REP MOVSD optimization if introspection is active

[Razvan Cojocaru <rcojocaru@bitdefender.com>]

On 10/27/2014 12:50 PM, Andrew Cooper wrote:
> On 27/10/14 10:37, Razvan Cojocaru wrote:
>> REP MOVSD emulation is optimized to write several pages at once
>> if possible. While this is a very good thing in general, it
>> can interfere with a memory introspection application's ability
>> to detect suspect behaviour, since it supresses potentially
>> telling future page faults. This patch disables the optimization,
>> gated on introspection being active for the domain.
> 
> An individual rep_movs() call should only optimise to within the current
> page, then break back out to the emulator when passing the page boundary.
> 
> How does this suppress pagefaults?

You're right, sorry for the confusion. Indeed, although we do need (and
have tested) the patch, its description is misleading (and wrong, as
you've rigtly noticed).

Rep_movs() does indeed optimise within the current page, however the
introspection application looks at the EPT mem_event parameters in order
to decide what to do, and the problem is that for the optimized cases
only one mem_event is being sent (for the first MOV) with the initial
gpa and gla. Then no more events are being sent for the rest of the
operation in that page, which is confusing for a client application
expecting to be called for each actual write to a protected page.

If you feel that the patch is acceptable, I'll correct the description
when submitting V2.


Thanks,
Razvan