KVM-VMI / libvmi

The official home of the LibVMI project is at https://github.com/libvmi/libvmi.
GNU Lesser General Public License v3.0
12 stars 9 forks source link

KVM: handle instruction emulation response for any kind of events #39

Open Wenzel opened 3 years ago

Wenzel commented 3 years ago

Instruction emulation response is currently only available as a kvmi_event_pf_reply response: https://github.com/KVM-VMI/kvm/blob/kvmi-v7/Documentation/virt/kvm/kvmi.rst#10-kvmi_event_pf

Libvmi has the VMI_EVENT_RESPONSE_SET_EMUL_INSN event response that could be implemented for the KVM driver. An example already demonstrate how to use it: https://github.com/KVM-VMI/libvmi/blob/master/examples/breakpoint-emulate-example.c#L87

It would be handy for the instruction emulation response in KVM to not be limited only for pagefaults.

The use case behind this is to return the original opcode when breakpoint was hit, previously replaced by an int 3 opcode. This allows to have relatively cheap race condition free breakpoints with Libvmi / KVM.

The fallback solution right now is to use recoiling: https://github.com/KVM-VMI/libvmi/blob/master/examples/breakpoint-recoil-example.c

cc @mdontu, @adlazar, @tklengyel

wangbaba523 commented 3 years ago

Hello, I try to use recoiling like 'breakpoint-recoil-example.c',but the bp event enters an infinite loop. VEE2M%HF6)7EG%%(49MO%UH QXOLQ1GNZUZIJMN~Y~9M ~N

Wenzel commented 3 years ago

@wangbaba523 , create a dedicated issue as this has nothing to do with this one.

wangbaba523 commented 3 years ago

Oh,I try to use below relatively cheap race condition free breakpoints with Libvmi / KVM ,But it can't run successfully!

The fallback solution right now is to use recoiling: https://github.com/KVM-VMI/libvmi/blob/master/examples/breakpoint-recoil-example.c