From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: Emulating in response of an int3 vm_event Date: Tue, 1 Dec 2015 10:51:17 +0000 Message-ID: <565D7BA5.90205@citrix.com> References: <565CE349.4070207@bitdefender.com> <565D7923.5080806@citrix.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7221346523386224324==" Return-path: Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1a3iWq-0006Ux-0W for xen-devel@lists.xenproject.org; Tue, 01 Dec 2015 10:51:24 +0000 In-Reply-To: <565D7923.5080806@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Tamas K Lengyel , Razvan Cojocaru Cc: Xen-devel , Jan Beulich List-Id: xen-devel@lists.xenproject.org --===============7221346523386224324== Content-Type: multipart/alternative; boundary="------------010107050308060106060604" --------------010107050308060106060604 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit On 01/12/15 10:40, Andrew Cooper wrote: > On 01/12/15 01:21, Tamas K Lengyel wrote: >> >> >> On Mon, Nov 30, 2015 at 7:01 PM, Razvan Cojocaru >> > wrote: >> >> On 12/01/2015 01:32 AM, Tamas K Lengyel wrote: >> > Hi all, >> > I'm trying to extend the current vm_event system to be able to >> emulate >> > over an in-guest breakpoint using the >> VM_EVENT_FLAG_SET_EMUL_READ_DATA >> > feature. The idea is to have the vm_event listener send back the >> > contents of the memory that was overwritten by the breakpoint >> > instruction, have Xen emulate one instruction, and resume execution >> > normally afterwards. This would eliminate the need of removing the >> > breakpoint, singlestepping, and placing the breakpoint back again. >> > >> > Unfortunately I encounter this crash when I call >> > hvm_mem_access_emulate_one in the event response handler: >> > >> > (XEN) vm_event.c:72:d0v0 Checking flags on int3 response 37 >> > (XEN) Xen BUG at /share/src/xen/xen/include/asm/hvm/vmx/vmx.h:372 >> > > This BUG() is the cause of the crash. > > It is a bad parameter to VMREAD, by the looks of it. Jan: This is a good example of why unlikely regions should have symbols. The stack trace from this bug is actively misleading because the symbol information for %eip is wrong. ~Andrew --------------010107050308060106060604 Content-Type: text/html; charset="windows-1252" Content-Length: 3322 Content-Transfer-Encoding: quoted-printable
On 01/12/15 10:40, Andrew Cooper wrote:
On 01/12/15 01:21, Tamas K Lengyel wrote:


On Mon, Nov 30, 2015 at 7:01 PM, Razvan Cojocaru <rcojocaru@bitdefender.com> wrote:
On 12/01/2015 01:32 AM, Tamas K Lengyel wrote:
> Hi all,
> I'm trying to extend the current vm_event system to be able to emulate
> over an in-guest breakpoint using the VM_EVENT_FLAG_SET_EMUL_READ_DATA
> feature. The idea is to have the vm_event listener send back the
> contents of the memory that was overwritten by the breakpoint
> instruction, have Xen emulate one instruction, and resume execution
> normally afterwards. This would eliminate the need of removing the
> breakpoint, singlestepping, and placing the breakpoint back again.
>
> Unfortunately I encounter this crash when I call
> hvm_mem_access_emulate_one in the event response handler:
>
> (XEN) vm_event.c:72:d0v0 Checking flags on int3 response 37
> (XEN) Xen BUG at /share/src/xen/xen/include/asm/hvm/vmx/vmx.h:372

This BUG() is the cause of the crash.

It is a bad parameter to VMREAD, by the looks of it.

Jan: This is a good example of why unlikely regions should have symbols.=A0 The stack trace from this bug is actively misleading because the symbol information for %eip is wrong.

~Andrew
--------------010107050308060106060604-- --===============7221346523386224324== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============7221346523386224324==--