Struct BreakpointController

pub struct BreakpointController<Driver>
where
    Driver: VmiDriver,
    <Driver::Architecture as Architecture>::EventReason: EventReason<Architecture = Driver::Architecture>,
{ /* private fields */ }

Uses software breakpoint instructions (like INT3 on x86) to implement breakpoints.

When a breakpoint is inserted, the memory page is marked as execute-only - meaning the guest can execute code from the page but cannot read or modify it without triggering an exception. This effectively hides the breakpoint from the guest.

When a VCPU executes the breakpoint instruction, a VmiEvent is generated with a reason indicating a software breakpoint. The user can verify if this event came from a breakpoint manager using BreakpointManager::contains_by_event or BreakpointManager::get_by_event.

If a VCPU tries to read from or write to a page containing breakpoints, a VmiEvent is generated with a memory access reason.

Read access exceptions can typically be handled by (fast-)single-stepping the instruction in an unmodified default_view.

Write exceptions need careful consideration as they could overwrite breakpoint instructions - you can either ignore them or remove the affected breakpoint from the manager.

Implementations

impl<Driver> BreakpointController<Driver>

where Driver: VmiDriver, <Driver::Architecture as Architecture>::EventReason: EventReason<Architecture = Driver::Architecture>,

pub fn is_breakpoint( vmi: &VmiCore<Driver>, event: &VmiEvent<Driver::Architecture>, ) -> Result<bool, VmiError>

Checks if the given event was caused by a software breakpoint.

Trait Implementations

impl<Driver> TapController for BreakpointController<Driver>

where Driver: VmiDriver, <Driver::Architecture as Architecture>::EventReason: EventReason<Architecture = Driver::Architecture>,

type Driver = Driver

VMI driver type.

fn new() -> Self

Creates a new TapController.

fn check_event( &self, event: &VmiEvent<Driver::Architecture>, ) -> Option<(View, Gfn)>

Checks if the given event was caused by a breakpoint.

fn insert_breakpoint( &mut self, vmi: &VmiCore<Driver>, pa: Pa, view: View, ) -> Result<(), VmiError>

Inserts a breakpoint at the given physical address.

fn remove_breakpoint( &mut self, vmi: &VmiCore<Driver>, pa: Pa, view: View, ) -> Result<(), VmiError>

Removes a breakpoint at the given physical address.

fn monitor( &mut self, vmi: &VmiCore<Driver>, gfn: Gfn, view: View, ) -> Result<(), VmiError>

Monitors the given guest frame number.

fn unmonitor( &mut self, vmi: &VmiCore<Driver>, gfn: Gfn, view: View, ) -> Result<(), VmiError>

Unmonitors the given guest frame number.