On 19.07.2019 17:23, Razvan Cojocaru wrote: > On 7/19/19 4:38 PM, Jan Beulich wrote: >> On 19.07.2019 15:30, Razvan Cojocaru wrote: >>> On 7/19/19 4:18 PM, Jan Beulich wrote: >>>> On 19.07.2019 14:34, Alexandru Stefan ISAILA wrote: >>>>> On 18.07.2019 15:58, Jan Beulich wrote: >>>>>> On 03.07.2019 12:56, Alexandru Stefan ISAILA wrote: >>>>>>> A/D bit writes (on page walks) can be considered benign by an >>>>>>> introspection >>>>>>> agent, so receiving vm_events for them is a pessimization. We try >>>>>>> here to >>>>>>> optimize by fitering these events out. >>>>>> >>>>>> But you add the sending of more events - how does "filter out" match >>>>>> the actual implementation? >>>>> >>>>> The events are send only if there is a mem access violation >>>>> therefore we >>>>> are filtering and only sending the events that are interesting to >>>>> introspection. >>>> >>>> Where is it that you prevent any event from being sent? As said, >>>> reading the patch I only see new sending sites to get added. >>> >>> If we don't emulate, we would receive the page-walk-generated events >>> _and_ the touching-the-page-the-instruction-is-touching events. >> >> Since the patch here alters emulation paths only, how do you know >> whether to emulate? In order to not receive undue events it would >> seem to me that you'd first have to intercept the guest on insns >> of interest ... Overall I think that the patch description, while >> it has improved, is still lacking sufficient information for a >> person like me (not knowing much about your monitor tools) to be >> able to sensibly review this (which includes understanding the >> precise scenario you want to improve). > > If the hardware exits because of an EPT fault caused by a page walk, we > end up in p2m_mem_access_check(), at which point we need to decide if we > want to send out a vm_event or not. > > If we were to send out this vm_event, and it would then be magically > treated so that we get to actually run the instruction at RIP, said > instruction might also hit a protected page and provoke a vm_event. > > Now, if npfec.kind != npfec_kind_with_gla, then we're in the page walk > case, and so in this case only, and only if > d->arch.monitor.inguest_pagefault_disabled is true, we would choose to > do this emulation trick: emulate _the_page_walk_ while ignoring the EPT, > but don't ignore the EPT for the emulation of the actual instruction. > > So where in the first case we would have 2 EPT events, in the second we > only have one (or if the instruction at RIP does not trigger an EPT > event, we would have 1 event in the first case, and none in the second). > Hence the filtering mentioned. > > So to answer your question: "how do you know whether to emulate", we do > so only if npfec.kind != npfec_kind_with_gla && > d->arch.monitor.inguest_pagefault_disabled. > > I hope this clears it up somewhat. >
To summarize the changes needed for the next version, apart from the code changes, is the description good or do I have to add something else? Thanks, Alex _______________________________________________ Xen-devel mailing list [email protected] https://lists.xenproject.org/mailman/listinfo/xen-devel
