RE: [Xen-users] Tracking DomU memory

["Petersson, Mats" <Mats.Petersson@xxxxxxx>]

> -----Original Message-----
> From: xen-users-bounces@xxxxxxxxxxxxxxxxxxx 
> [mailto:xen-users-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of 
> Diwaker Gupta
> Sent: 15 December 2006 22:56
> To: Security Initiative Team
> Cc: Petersson, Mats; xen-users@xxxxxxxxxxxxxxxxxxx
> Subject: Re: [Xen-users] Tracking DomU memory
> 
> I actually want do to something similar, but simpler. I'm only
> interested in keeping track of pages that a guest domain is accessing
> (both reads and writes). I'm _not_ looking for the *exact* memory
> address -- just the physical page being accessed. Can log dirty be
> modified to keep track of read accesses as well?

This isn't far from what I'm doing (except I need to look at one or a
few pages, which makes life somewhat easier). 

You'd have to change the page-table writes so that they are written with
"not present", and then update your statistics based on the page-fault.
You'll have to "fix" the fault and then reset the page-table, which is
probably easiest done by using the x86_emulate_memop() function
[alternatively, set the trace-bit in the flags on stack before exiting
the PF-handler, take the trace-interrupt, reset the page-table and
continue]. 

However, if you're doing this for every memory access of the guest,
you'll not get much work done... :-(

--
mats
> 
> Thanks,
> Diwaker
> 
> On 10/9/06, Security Initiative Team <passrete@xxxxxxxxx> wrote:
> > My main purpose is to know when a user-level application in DomU
> > is updating its memory.
> > (Tracking changes to the stack segment might be too hard 
> due to frequent
> > memory updates, so maybe only the "text" segment).
> >
> > I want to be able to track this from either Dom0 or the 
> hypervisor layer,
> > whichever is easier.
> >
> > When is ptwr_emulated_update() used and when is do_mmu_update()
> > used?
> >
> > Thanks,
> > -Criag
> >
> >
> > "Petersson, Mats" <Mats.Petersson@xxxxxxx> wrote:
> >
> > What do you ACTUALLY want to do?
> >
> > log-dirty doesn't log to a file - it keeps track of "dirty" 
> pages in a list
> > in memory, but doesn't actually store it in a file [ever, at all].
> >
> > do_mmu_update is possibly a good place to hook into, but it 
> depends on what
> > you want to do... [And it's non-trivial code, so beware of 
> complications
> > from changing it].
> >
> > You may want to look at ptwr_emulated_update, as that's 
> used when the
> > do_mmu_update() hypercall isn't used to update a page-table-entry.
> >
> > --
> > Mats
> >
> >
> >  ________________________________
> -- 
> Web/Blog/Gallery: http://floatingsun.net/blog
> 
> _______________________________________________
> Xen-users mailing list
> Xen-users@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-users
> 
> 
> 



_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users