From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: Emulating in response of an int3 vm_event Date: Tue, 1 Dec 2015 10:40:35 +0000 Message-ID: <565D7923.5080806@citrix.com> References: <565CE349.4070207@bitdefender.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7981056615440405763==" Return-path: Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1a3iMV-0005L6-U1 for xen-devel@lists.xenproject.org; Tue, 01 Dec 2015 10:40:44 +0000 In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Tamas K Lengyel , Razvan Cojocaru Cc: Xen-devel List-Id: xen-devel@lists.xenproject.org --===============7981056615440405763== Content-Type: multipart/alternative; boundary="------------050007010705020308030203" --------------050007010705020308030203 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit On 01/12/15 01:21, Tamas K Lengyel wrote: > > > On Mon, Nov 30, 2015 at 7:01 PM, Razvan Cojocaru > > wrote: > > On 12/01/2015 01:32 AM, Tamas K Lengyel wrote: > > Hi all, > > I'm trying to extend the current vm_event system to be able to > emulate > > over an in-guest breakpoint using the > VM_EVENT_FLAG_SET_EMUL_READ_DATA > > feature. The idea is to have the vm_event listener send back the > > contents of the memory that was overwritten by the breakpoint > > instruction, have Xen emulate one instruction, and resume execution > > normally afterwards. This would eliminate the need of removing the > > breakpoint, singlestepping, and placing the breakpoint back again. > > > > Unfortunately I encounter this crash when I call > > hvm_mem_access_emulate_one in the event response handler: > > > > (XEN) vm_event.c:72:d0v0 Checking flags on int3 response 37 > > (XEN) Xen BUG at /share/src/xen/xen/include/asm/hvm/vmx/vmx.h:372 > This BUG() is the cause of the crash. It is a bad parameter to VMREAD, by the looks of it. ~Andrew --------------050007010705020308030203 Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: 7bit
On 01/12/15 01:21, Tamas K Lengyel wrote:


On Mon, Nov 30, 2015 at 7:01 PM, Razvan Cojocaru <rcojocaru@bitdefender.com> wrote:
On 12/01/2015 01:32 AM, Tamas K Lengyel wrote:
> Hi all,
> I'm trying to extend the current vm_event system to be able to emulate
> over an in-guest breakpoint using the VM_EVENT_FLAG_SET_EMUL_READ_DATA
> feature. The idea is to have the vm_event listener send back the
> contents of the memory that was overwritten by the breakpoint
> instruction, have Xen emulate one instruction, and resume execution
> normally afterwards. This would eliminate the need of removing the
> breakpoint, singlestepping, and placing the breakpoint back again.
>
> Unfortunately I encounter this crash when I call
> hvm_mem_access_emulate_one in the event response handler:
>
> (XEN) vm_event.c:72:d0v0 Checking flags on int3 response 37
> (XEN) Xen BUG at /share/src/xen/xen/include/asm/hvm/vmx/vmx.h:372

This BUG() is the cause of the crash.

It is a bad parameter to VMREAD, by the looks of it.

~Andrew
--------------050007010705020308030203-- --===============7981056615440405763== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============7981056615440405763==--