Re: [Xen-devel] [VMI] How to add support for MOV-TO-DRx events ?

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 09/05/2019 22:10, Razvan Cojocaru wrote:
> On 5/9/19 11:57 PM, Mathieu Tarral wrote:
>> Hi,
>>
>> following a previous conversation, i would like to catch MOV-TO-DRx VMI 
>> events to prevent the guest from disabling my hardware breakpoints.
>>
>> @Tamas pointed me to this header:
>> https://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=xen/include/public/vm_event.h;h=b2bafc0d77f9758e42b0d53c05a7e6bb86c86686;hb=HEAD#l154
>>
>> And, as far as I can tell, I have to
>> - add a new REASON
>> #define VM_EVENT_REASON_WRITE_DEBUGREG      15
>>
>> - add a new struct
>> struct vm_event_write_debugreg {
>>     uint32_t index;
>>     uint32_t _pad;
>>     uint64_t new_value;
>>     uint64_t old_value;
>> };
>>
>> - insert it into the vm_event_st union
>>
>> Can you give me more pointer and guidance how to implement this into Xen ?
> You probably want to change the write_debugreg() macro into a function
> that does what's currently being done + send out the vm_event. You also
> probably need to think about whether you want the write to be
> preemptable or not (I'm guessing you don't, in which case it's all simpler).

write_debugreg() is for Xen modifying the real debug registers, so
mustn't contain any VMI pieces.

Mathieu: I'm afraid this isn't going to be a trivial piece of
development, but if you're up for the challenge then fantastic and I'll
do my best to guide you through it.

Lets focus on HVM for now.  Both VT-x and SVM have intercepts which
cause a VMExit for accesses to the debug registers.  Indeed - Xen
already uses these for lazy context switching of %dr state, given how
rarely guests actually touch the registers.

See the existing {svm,vmx}_dr_access() functions in
xen/arch/x86/hvm/{svm,vmx}/{svm,vmx}.c.  By default, we run the VCPU
with DR interception enabled, and when the guest first touches any debug
registers, we context switch them into hardware.

On vcpu context switch, we only pro-actively restore the debug registers
if debugging is currently active.  See {svm,vmx}_ctxt_switch_{to,from}()
and the calls to {svm,vmx}_restore_dr().

What we'll have to do is end up in a position where we can have some
real %dr settings given by the VMI agent, and some shadow %dr settings
which the guest interacts with.  Also I should warn you at this point
that, because of how the registers work, It will not be possible to have
guest-shadowed %dr functioning at the same time as VMI-provided %dr
settings.

I guess the main usecase here is simply hiding from the guest kernel
that debugging activities are in use, and we are ok to break the real
use of gdb/other inside the guest?  Razvan/Tamas: As your the
maintainers, it is your call, ultimately.


Anyway, before we start wiring up the VMI interface, we need to support
MOV-DR in the emulator for HVM guests, for which support is currently
missing.

Mathieu: Are you able to set up a development environment which lets you
modify and rebuild Xen, and which you can use
http://xenbits.xen.org/docs/xtf/ from?  This will be the easiest way to
get started.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel