[Lguest] probing the guest os kernel code ?

[dylan]

Rusty Russell 写道:

> > On Wed, 25 Nov 2009 06:01:04 pm dylan wrote:
>   
>> >> I want to collect informations about guest os,so i probing the guest
>> >> os code using kprobe.
>> >> First, I run a guest os(linux-2.6.31) using lguest, and insmod the
>> >> fellow module--the code is as follows.
>> >>
>> >> @%@%> insmod /home/lguest_kprobe_example.ko
>> >> [ 11.592410] Planted kprobe at c0163430
>> >>
>> >> Results is right above,but when I run command "dmeg" to view the
>> >> print information,the results are fellows:
>> >>
>> >> @%@%> dmesg
>> >> [ 85.056197] pre_handler1: p->addr = 0xc0163430, ip = c0163431, flags
>> >> = 0x286
>> >> [ 85.056249] pre_handler2: p->symbol_name=do_fork, p->opcode=85
>> >> lguest: Bad address 0xc3a37c34
>>     
> >
> > I'm not surprised. We don't let the guest set debug registers or such. No
> > doubt the breakpoint instruction jumps to hyperspace.
> >
> > I've cc'd some kprobes people, in case they want to add debug register
> > support to lguest
> > Cheers,
> > Rusty.
> >
>   
Thank you for your answers,but I have some questions.

I have perused the code of kprobes, especially the process of int3
exception ,debug exception and notifier mechanism.
However, I have not found any places associated with debug registers
about above problems.I find some snippets about my questions in kernel
code.
(1) arch/x86/kernel/kprobes.c
int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
unsigned long val, void *data)
{
struct die_args *args = data;
int ret = NOTIFY_DONE;
*if (args->regs && user_mode_vm(args->regs)) return ret;
*
switch (val) {
case DIE_INT3:
if (kprobe_handler(args->regs))
ret = NOTIFY_STOP;
break;
case DIE_DEBUG:
if (post_kprobe_handler(args->regs))
ret = NOTIFY_STOP;
break;
case DIE_GPF:
/*
* To be potentially processing a kprobe fault and to
* trust the result from kprobe_running(), we have
* be non-preemptible.
*/
if (!preemptible() && kprobe_running() &&
kprobe_fault_handler(args->regs, args->trapnr))
ret = NOTIFY_STOP;
break;
default:
break;
}
return ret;
}

The red code indicates if the args->regs is from user vm mode , then the
funciton will return and do nothings. (2) Indeed, lguest don't support
the debug registers.But I don't think kprobes use debug registers.

__________________________________________________
赶快注册雅虎超大容量免费邮箱?
http://cn.mail.yahoo.com