Re: [Xen-devel] SVM NPT mem_access and npfec.insn_fetch

[Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>]

On 03/31/2018 12:14 AM, Andrew Cooper wrote:
> On 30/03/2018 22:06, Razvan Cojocaru wrote:
>> Hello,
>>
>> We've been trying to enable mem_access events for SVM, and we do receive
>> some events with xen-access if we set the pages read-only. However, the
>> exec xen-access tests fails, because it appears that npfec.insn_fetch is
>> always 0 here (or at least we haven't seen it to be 1 in a lot of testing):
>>
>> index 569b124..d518c94 100644
>> --- a/xen/arch/x86/hvm/hvm.c
>> +++ b/xen/arch/x86/hvm/hvm.c
>> @@ -1835,6 +1835,13 @@ int hvm_hap_nested_page_fault(paddr_t gpa,
>> unsigned long gla,
>>              break;
>>          }
>>
>> +        printk("pae: %d, nx: %d, gfn: 0x%lx access %d violation %d read %d"
>> +               " write %d insn %d present %d glav %d kind %d \n",
>> +               !!(curr->arch.hvm_vcpu.guest_cr[4] & X86_CR4_PAE),
>> +               !!(curr->arch.hvm_vcpu.guest_efer & EFER_NX), gfn,
>> +               p2ma, violation, npfec.read_access, npfec.write_access,
>> +               npfec.insn_fetch, npfec.present, npfec.gla_valid,
>> npfec.kind);
>> +
>>          if ( violation )
>>          {
>>              /* Should #VE be emulated for this fault? */
>>
>> This patch does not require anything else, just start an HVM guest on an
>> AMD host. It outputs things like:
>>
>> (XEN) pae: 1, nx: 1, gfn: 0xf0235 access 7 violation 0 read 1 write 1
>> insn 0 present 1 glav 0 kind 2
>> [...]
>> What are we missing?
> 
> Look at p2m-pt.c and check whether NX is being properly set in the NPT
> tables when you select XENMEM_access_rw ?  NPT pagetables have an
> identical format and layout to regular PAE pagetables.
We weren't setting it at all. Just stored the restrictions in a
newly-added integer in struct page_info (suggestions for the best place
to store them are welcome), and fed them back to whatever function was
asking for them from there.

Did a quick test and setting _PAGE_NX_BIT as well seems to be the way to
go indeed.


Thanks,
Razvan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel