Re: [Xen-devel] [PATCH v7] x86/emulate: Send vm_event from emulate

[Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>]

On 7/19/19 4:38 PM, Jan Beulich wrote:
> On 19.07.2019 15:30, Razvan Cojocaru wrote:
> > On 7/19/19 4:18 PM, Jan Beulich wrote:
> > > On 19.07.2019 14:34, Alexandru Stefan ISAILA wrote:
> > > > On 18.07.2019 15:58, Jan Beulich wrote:
> > > > > On 03.07.2019 12:56, Alexandru Stefan ISAILA wrote:
> > > > > > A/D bit writes (on page walks) can be considered benign by an introspection
> > > > > > agent, so receiving vm_events for them is a pessimization. We try here to
> > > > > > optimize by fitering these events out.
> > > > > But you add the sending of more events - how does "filter out" match
> > > > > the actual implementation?
> > > > The events are send only if there is a mem access violation therefore we
> > > > are filtering and only sending the events that are interesting to
> > > > introspection.
> > > Where is it that you prevent any event from being sent? As said,
> > > reading the patch I only see new sending sites to get added.
> > If we don't emulate, we would receive the page-walk-generated events
> > _and_ the touching-the-page-the-instruction-is-touching events.
> Since the patch here alters emulation paths only, how do you know
> whether to emulate? In order to not receive undue events it would
> seem to me that you'd first have to intercept the guest on insns
> of interest ... Overall I think that the patch description, while
> it has improved, is still lacking sufficient information for a
> person like me (not knowing much about your monitor tools) to be
> able to sensibly review this (which includes understanding the
> precise scenario you want to improve).
If the hardware exits because of an EPT fault caused by a page walk, we 
end up in p2m_mem_access_check(), at which point we need to decide if we 
want to send out a vm_event or not.
If we were to send out this vm_event, and it would then be magically 
treated so that we get to actually run the instruction at RIP, said 
instruction might also hit a protected page and provoke a vm_event.
Now, if npfec.kind != npfec_kind_with_gla, then we're in the page walk 
case, and so in this case only, and only if 
d->arch.monitor.inguest_pagefault_disabled is true, we would choose to 
do this emulation trick: emulate _the_page_walk_ while ignoring the EPT, 
but don't ignore the EPT for the emulation of the actual instruction.
So where in the first case we would have 2 EPT events, in the second we 
only have one (or if the instruction at RIP does not trigger an EPT 
event, we would have 1 event in the first case, and none in the second).
Hence the filtering mentioned.

So to answer your question: "how do you know whether to emulate", we do 
so only if npfec.kind != npfec_kind_with_gla && 
d->arch.monitor.inguest_pagefault_disabled.
I hope this clears it up somewhat.


Thanks,
Razvan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel