WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

[Xen-devel] Re: How to intercept memory operation in Xen

To: Abhinav Srivastava <abhinavs_iitkgp@xxxxxxxxxxx>
Subject: [Xen-devel] Re: How to intercept memory operation in Xen
From: Anthony Liguori <aliguori@xxxxxxxxxx>
Date: Mon, 13 Nov 2006 12:34:20 -0600
Cc: xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxx>
Delivery-date: Mon, 13 Nov 2006 10:34:41 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <20061113172557.34567.qmail@xxxxxxxxxxxxxxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <20061113172557.34567.qmail@xxxxxxxxxxxxxxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Thunderbird 1.5.0.7 (X11/20060918)
Abhinav Srivastava wrote:

Hi all,

I am new to the Xen and currently using Xen 3.0.3. My goal is to provide memory logging facility in Dom0. If any guest domain (DomU) application tries to access any memory area, I would like to know in dom0 what area they are accessing. So that if any user space applications try to access kernel memory then i can see in dom0 and using my detection system, i can say that it is illegal memory request as user space applications are not allowed to use kernel memory. I have three Qs related to this:

You would have a much easier time just modifying the Linux kernel. Xen isn't going to help you much here.

1) Is this doable?

Exceptions do go through the hypervisor however page faults are not usually a sign of something bad happening. Linux, for instance, uses copy-on-write and on-demand paging which means in many circumstances, page faults are not a sign of misuse of memory.

I don't think there's any generic way of identifying whether a page fault is a "good" page fault or a "bad" page fault at the hypervisor level. The hypervisor merely forwards the fault to the guest and the guest then decides what action to take (update a page table, kill a process, etc.). To complicate matters further, some apps catch SEGV and handle it themselves. That makes the potential recovery behavior totally non-deterministic. You could potentially try to track heuristically whether a PTE update occurs after a page fault at the hypervisor level but that would be easily defeatable (which means it isn't useful for an IDS system). At the end of the day, you really have to modify the domU kernel.

You should look at some of the bug reporting tools in Linux. They seem to be doing something to hook all process crashes. Ubuntu has a new bug crash tool that you could probably start with. This would put you in domU userspace though...

Regards,

Anthony Liguori

2) If yes, how should I start with? Do i need to intercept hypercalls? If yes, how to do this?

3) To intercept memory operation, do i need to change in the Xen code? If yes, it would be great if you could point me exact file where changes are to be made.

4) Can it be done using some application or IDS in dom0 with some hooks without changing the Xen code?

I would really appreciate your help.

Thanks,
Abhi

------------------------------------------------------------------------
Find out what India is talking about on - Yahoo! Answers India <http://us.rd.yahoo.com/mail/in/yanswers/*http://in.answers.yahoo.com/> Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW <http://us.rd.yahoo.com/mail/in/messengertagline/*http://in.messenger.yahoo.com>


------------------------------------------------------------------------

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel

<Prev in Thread] Current Thread [Next in Thread>