Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
I think nobody is responding because you haven''t provided enough
information about what it is you are trying to do... and resending the same
message doesn''t help.
For example, if you are "extending" the instruction set (e.g. using an
illegal opcode to do something useful), that would be very different than
trapping memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven’t provided enough information
about what it is you are trying to do... and resending the same message doesn’t
help.
For example, if you are “extending” the instruction set (e.g. using an illegal
opcode to do something useful), that would be very different than trapping
memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
On Mon, 2010-11-08 at 05:14 +0000, Nimgaonkar, Satyajeet wrote:> Hi, > I am sorry if I have not provided provided enough information about > the functionality that I want to implement. But my problem is that > even I new to Xen and trying to understand my way around it. With > regards to the functionality that I want to implement, I wish to > modify the behavior of the VCPU in xen. As a starting point, I just > want to add simple memory integrity block within the VCPU. I am really > not sure what would be the best way to do this so I need some > suggestions on that too. > Thanks. I hope that helps too.You have been asked concrete questions on what is to be implemented and responded with "modify the behaviour of xen" which is sufficiently vague as to be meaningless. Therefore it is very difficult to know what to recommend. Adding a "memory integrity block" within the VCPU sounds simple, I assume this "memory integrity block" is some kind of data structure. In which case, look inside xen/include/sched.h for struct vcpu. (?) Gianni _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
I''m not asking you to describe the Xen functionality. I am asking you
to describe in more detail the modification to the processor
functionality/behavior that you are trying to achieve. I don''t know
what a "simple memory integrity block" does and searching for it
doesn''t find anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by the
physical CPU == PCPU). The only way to change the VCPU behavior is to cause
some kind of trap or fault or exception to occur on the PCPU, which gets
intercepted by the processor and then control is turned over to privileged
software (in this case Xen). Xen has a lot of code that handles many many
different kinds of traps/faults/exceptions. Your VCPU will need to execute an
instruction that causes a trap or fault or exception and then you will need to
add code to Xen to recognize your special one and do something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
_____
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven''t provided enough
information about what it is you are trying to do... and resending the same
message doesn''t help.
For example, if you are "extending" the instruction set (e.g. using an
illegal opcode to do something useful), that would be very different than
trapping memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Nimgaonkar, Satyajeet writes ("RE: [Xen-devel] VCPU
Structure"):> I am sorry if I have not provided provided enough information
> about the functionality that I want to implement. But my problem
> is that even I new to Xen and trying to understand my way around
> it. With regards to the functionality that I want to implement, I
> wish to modify the behavior of the VCPU in xen. As a starting
> point, I just want to add simple memory integrity block within
> the VCPU. I am really not sure what would be the best way to do
> this so I need some suggestions on that too.
I think you have misunderstood the assignment you have been set by
your tutor.
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi Dan,
A memory integrity block is a simple hash function that computes the
hash of all the memory at prticular instant of time and stores it in a secure
memory location. This allows to detect an attack from an adversary who is trying
to alter the memory values. At a lter instant of time, the hash of memory is
again computed and if the two hash values match then we conclude that no attack
was performed and they don''t match we conclude that an attack has been
performed.
I hope that explains the functionality that I want to add to the
VCPU. Can you please tell me where should I add the trapping code with in the
VPCU, I mean which file should I look at. Also please can you tell me where
exactly with in xen should I add the special code. I see the VCPU structure is
present in xen/include/xen/sched.h. Is it the correct place to look for.
Thanks.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 7:42 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I’m not asking you to describe the Xen functionality. I am asking you to
describe in more detail the modification to the processor functionality/behavior
that you are trying to achieve. I don’t know what a “simple memory integrity
block” does and searching for it doesn’t find anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by the
physical CPU == PCPU). The only way to change the VCPU behavior is to cause
some kind of trap or fault or exception to occur on the PCPU, which gets
intercepted by the processor and then control is turned over to privileged
software (in this case Xen). Xen has a lot of code that handles many many
different kinds of traps/faults/exceptions. Your VCPU will need to execute an
instruction that causes a trap or fault or exception and then you will need to
add code to Xen to recognize your special one and do something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven’t provided enough information
about what it is you are trying to do... and resending the same message doesn’t
help.
For example, if you are “extending” the instruction set (e.g. using an illegal
opcode to do something useful), that would be very different than trapping
memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi Satyajeet -
No, you still will need to be much more precise. Computing a hash of ALL memory
on the system will take a very long time, and SOME memory is almost certain to
change (perhaps even while computing the hash) if anything at all is running on
the system, whether or not an attack is performed. Do you want to compute a
hash of some specific range of memory? Or all guest memory for some specific
guest? And memory is not specific to one VCPU, so it is not something that you
add to a VCPU. How frequently do you want to compute the hash? And how
frequently do you want to check for a match? And how do you determine when you
want to cause the hash to be taken or checked? And do you need to store
multiple values for different ranges/guests?
Systems programming (in Xen or Linux or anywhere) is very complex and it is
important that you describe a very precise detailed plan for what you want to do
- flow chart, cause and effect, etc - before it is possible to help you.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Monday, November 08, 2010 9:31 AM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Dan,
A memory integrity block is a simple hash function that computes the
hash of all the memory at prticular instant of time and stores it in a secure
memory location. This allows to detect an attack from an adversary who is trying
to alter the memory values. At a lter instant of time, the hash of memory is
again computed and if the two hash values match then we conclude that no attack
was performed and they don''t match we conclude that an attack has been
performed.
I hope that explains the functionality that I want to add to the
VCPU. Can you please tell me where should I add the trapping code with in the
VPCU, I mean which file should I look at. Also please can you tell me where
exactly with in xen should I add the special code. I see the VCPU structure is
present in xen/include/xen/sched.h. Is it the correct place to look for.
Thanks.
Regards,
Satyajeet
_____
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 7:42 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I''m not asking you to describe the Xen functionality. I am asking you
to describe in more detail the modification to the processor
functionality/behavior that you are trying to achieve. I don''t know
what a "simple memory integrity block" does and searching for it
doesn''t find anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by the
physical CPU == PCPU). The only way to change the VCPU behavior is to cause
some kind of trap or fault or exception to occur on the PCPU, which gets
intercepted by the processor and then control is turned over to privileged
software (in this case Xen). Xen has a lot of code that handles many many
different kinds of traps/faults/exceptions. Your VCPU will need to execute an
instruction that causes a trap or fault or exception and then you will need to
add code to Xen to recognize your special one and do something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
_____
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven''t provided enough
information about what it is you are trying to do... and resending the same
message doesn''t help.
For example, if you are "extending" the instruction set (e.g. using an
illegal opcode to do something useful), that would be very different than
trapping memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi Dan,
I want to compute the hash for a specific memory range and not all
the memory. Also I havent decided the frequency of calculating the hash and
matching it. But I wonder how will that affect the functionality and
modification that I intend to do?
Thanks.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 10:59 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Satyajeet –
No, you still will need to be much more precise. Computing a hash of ALL memory
on the system will take a very long time, and SOME memory is almost certain to
change (perhaps even while computing the hash) if anything at all is running on
the system, whether or not an attack is performed. Do you want to compute a
hash of some specific range of memory? Or all guest memory for some specific
guest? And memory is not specific to one VCPU, so it is not something that you
add to a VCPU. How frequently do you want to compute the hash? And how
frequently do you want to check for a match? And how do you determine when you
want to cause the hash to be taken or checked? And do you need to store
multiple values for different ranges/guests?
Systems programming (in Xen or Linux or anywhere) is very complex and it is
important that you describe a very precise detailed plan for what you want to do
– flow chart, cause and effect, etc – before it is possible to help you.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Monday, November 08, 2010 9:31 AM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Dan,
A memory integrity block is a simple hash function that computes the
hash of all the memory at prticular instant of time and stores it in a secure
memory location. This allows to detect an attack from an adversary who is trying
to alter the memory values. At a lter instant of time, the hash of memory is
again computed and if the two hash values match then we conclude that no attack
was performed and they don''t match we conclude that an attack has been
performed.
I hope that explains the functionality that I want to add to the
VCPU. Can you please tell me where should I add the trapping code with in the
VPCU, I mean which file should I look at. Also please can you tell me where
exactly with in xen should I add the special code. I see the VCPU structure is
present in xen/include/xen/sched.h. Is it the correct place to look for.
Thanks.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 7:42 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I’m not asking you to describe the Xen functionality. I am asking you to
describe in more detail the modification to the processor functionality/behavior
that you are trying to achieve. I don’t know what a “simple memory integrity
block” does and searching for it doesn’t find anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by the
physical CPU == PCPU). The only way to change the VCPU behavior is to cause
some kind of trap or fault or exception to occur on the PCPU, which gets
intercepted by the processor and then control is turned over to privileged
software (in this case Xen). Xen has a lot of code that handles many many
different kinds of traps/faults/exceptions. Your VCPU will need to execute an
instruction that causes a trap or fault or exception and then you will need to
add code to Xen to recognize your special one and do something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven’t provided enough information
about what it is you are trying to do... and resending the same message doesn’t
help.
For example, if you are “extending” the instruction set (e.g. using an illegal
opcode to do something useful), that would be very different than trapping
memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi Dan,
I have created a custom hypercall, would it be possible to transfert
the control from the hypercall handler to the VCPU structure. With regards to
modifying the VCPU, can you please redirect me to any code examples containing
trapping/exception/faulting the CPU. Also for the memory integrity hash block
that I wish to add to the VCPU, I will compute the hash for a pre-defined range
of memory and match it every day i.e. 24 hours.
Thank you very much.
Regards,
Satyajeet
________________________________
From: xen-devel-bounces@lists.xensource.com
[xen-devel-bounces@lists.xensource.com] on behalf of Nimgaonkar, Satyajeet
[SatyajeetNimgaonkar@my.unt.edu]
Sent: Monday, November 08, 2010 11:58 AM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Dan,
I want to compute the hash for a specific memory range and not all
the memory. Also I havent decided the frequency of calculating the hash and
matching it. But I wonder how will that affect the functionality and
modification that I intend to do?
Thanks.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 10:59 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Satyajeet –
No, you still will need to be much more precise. Computing a hash of ALL memory
on the system will take a very long time, and SOME memory is almost certain to
change (perhaps even while computing the hash) if anything at all is running on
the system, whether or not an attack is performed. Do you want to compute a
hash of some specific range of memory? Or all guest memory for some specific
guest? And memory is not specific to one VCPU, so it is not something that you
add to a VCPU. How frequently do you want to compute the hash? And how
frequently do you want to check for a match? And how do you determine when you
want to cause the hash to be taken or checked? And do you need to store
multiple values for different ranges/guests?
Systems programming (in Xen or Linux or anywhere) is very complex and it is
important that you describe a very precise detailed plan for what you want to do
– flow chart, cause and effect, etc – before it is possible to help you.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Monday, November 08, 2010 9:31 AM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Dan,
A memory integrity block is a simple hash function that computes the
hash of all the memory at prticular instant of time and stores it in a secure
memory location. This allows to detect an attack from an adversary who is trying
to alter the memory values. At a lter instant of time, the hash of memory is
again computed and if the two hash values match then we conclude that no attack
was performed and they don''t match we conclude that an attack has been
performed.
I hope that explains the functionality that I want to add to the
VCPU. Can you please tell me where should I add the trapping code with in the
VPCU, I mean which file should I look at. Also please can you tell me where
exactly with in xen should I add the special code. I see the VCPU structure is
present in xen/include/xen/sched.h. Is it the correct place to look for.
Thanks.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 7:42 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I’m not asking you to describe the Xen functionality. I am asking you to
describe in more detail the modification to the processor functionality/behavior
that you are trying to achieve. I don’t know what a “simple memory integrity
block” does and searching for it doesn’t find anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by the
physical CPU == PCPU). The only way to change the VCPU behavior is to cause
some kind of trap or fault or exception to occur on the PCPU, which gets
intercepted by the processor and then control is turned over to privileged
software (in this case Xen). Xen has a lot of code that handles many many
different kinds of traps/faults/exceptions. Your VCPU will need to execute an
instruction that causes a trap or fault or exception and then you will need to
add code to Xen to recognize your special one and do something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven’t provided enough information
about what it is you are trying to do... and resending the same message doesn’t
help.
For example, if you are “extending” the instruction set (e.g. using an illegal
opcode to do something useful), that would be very different than trapping
memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi Satyajeet -
I''m still not quite sure I understand, though your description is
getting better.
A hypercall executes on a VCPU on a PCPU. One can''t transfer control
to a VCPU structure; a VCPU structure contains data. Are you doing a different
memory integrity hash block for each VCPU in each guest? Or one for each guest?
Or is it one for the entire physical system? If it is one for each VCPU in each
guest, yes, you will need to store the pre-defined range and the results of the
hash in the VCPU structure and your "compute hash" hypercall would
store those values and your "check hash" hypercall would verify the
value (and return success or failure). If this is what you plan to do, you do
not need a trap/exception/fault as the hypercall replaces that.
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Tuesday, November 09, 2010 10:07 AM
To: Nimgaonkar, Satyajeet; Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Dan,
I have created a custom hypercall, would it be possible to transfert
the control from the hypercall handler to the VCPU structure. With regards to
modifying the VCPU, can you please redirect me to any code examples containing
trapping/exception/faulting the CPU. Also for the memory integrity hash block
that I wish to add to the VCPU, I will compute the hash for a pre-defined range
of memory and match it every day i.e. 24 hours.
Thank you very much.
Regards,
Satyajeet
_____
From: xen-devel-bounces@lists.xensource.com
[xen-devel-bounces@lists.xensource.com] on behalf of Nimgaonkar, Satyajeet
[SatyajeetNimgaonkar@my.unt.edu]
Sent: Monday, November 08, 2010 11:58 AM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Dan,
I want to compute the hash for a specific memory range and not all
the memory. Also I havent decided the frequency of calculating the hash and
matching it. But I wonder how will that affect the functionality and
modification that I intend to do?
Thanks.
Regards,
Satyajeet
_____
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 10:59 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Satyajeet -
No, you still will need to be much more precise. Computing a hash of ALL memory
on the system will take a very long time, and SOME memory is almost certain to
change (perhaps even while computing the hash) if anything at all is running on
the system, whether or not an attack is performed. Do you want to compute a
hash of some specific range of memory? Or all guest memory for some specific
guest? And memory is not specific to one VCPU, so it is not something that you
add to a VCPU. How frequently do you want to compute the hash? And how
frequently do you want to check for a match? And how do you determine when you
want to cause the hash to be taken or checked? And do you need to store
multiple values for different ranges/guests?
Systems programming (in Xen or Linux or anywhere) is very complex and it is
important that you describe a very precise detailed plan for what you want to do
- flow chart, cause and effect, etc - before it is possible to help you.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Monday, November 08, 2010 9:31 AM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi Dan,
A memory integrity block is a simple hash function that computes the
hash of all the memory at prticular instant of time and stores it in a secure
memory location. This allows to detect an attack from an adversary who is trying
to alter the memory values. At a lter instant of time, the hash of memory is
again computed and if the two hash values match then we conclude that no attack
was performed and they don''t match we conclude that an attack has been
performed.
I hope that explains the functionality that I want to add to the
VCPU. Can you please tell me where should I add the trapping code with in the
VPCU, I mean which file should I look at. Also please can you tell me where
exactly with in xen should I add the special code. I see the VCPU structure is
present in xen/include/xen/sched.h. Is it the correct place to look for.
Thanks.
Regards,
Satyajeet
_____
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Monday, November 08, 2010 7:42 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I''m not asking you to describe the Xen functionality. I am asking you
to describe in more detail the modification to the processor
functionality/behavior that you are trying to achieve. I don''t know
what a "simple memory integrity block" does and searching for it
doesn''t find anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by the
physical CPU == PCPU). The only way to change the VCPU behavior is to cause
some kind of trap or fault or exception to occur on the PCPU, which gets
intercepted by the processor and then control is turned over to privileged
software (in this case Xen). Xen has a lot of code that handles many many
different kinds of traps/faults/exceptions. Your VCPU will need to execute an
instruction that causes a trap or fault or exception and then you will need to
add code to Xen to recognize your special one and do something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
_____
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven''t provided enough
information about what it is you are trying to do... and resending the same
message doesn''t help.
For example, if you are "extending" the instruction set (e.g. using an
illegal opcode to do something useful), that would be very different than
trapping memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Dan Magenheimer writes ("RE: [Xen-devel] VCPU
Structure"):> I''m still not quite sure I understand, though your description is
> getting better.
Are you sure that your patience with this enquirer is really a virtue
in this context ?
xen-devel is not a list that should be used for people who need help
with their homework.
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi,
I accept that I may have been unclear and not specific with my requests, but
I am currently working on a complex research project and so it makes it
difficult to understand all its aspects in entirety. I apologize for it and also
appreciate your patience and assistance.
Now I precisely know what exactly I want to achieve and I would appreciate
if I get some help on it.
I have implemented a custom hypercall in xen. Now i need to get hold off the
memory that is being assigned to the process (i.e. the function that is calling
the hypercall). I intend to do this from the hypercall handler. Once I have this
memory info, I will compute the hash of it and store it in the VCPU structure.
Any sample code or examples on this would help a lot.
I hope this makes sense. Thanks a lot for the constant help.
Regards,
Satyajeet
________________________________________
From: Ian Jackson [Ian.Jackson@eu.citrix.com]
Sent: Tuesday, November 09, 2010 12:21 PM
To: Dan Magenheimer
Cc: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Dan Magenheimer writes ("RE: [Xen-devel] VCPU
Structure"):> I''m still not quite sure I understand, though your description is
> getting better.
Are you sure that your patience with this enquirer is really a virtue
in this context ?
xen-devel is not a list that should be used for people who need help
with their homework.
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Satyajeet
I think, describing exact details of "memory integrity block" and its
relevance to VCPU modification would help the conversation.
-Kaushik
From: xen-devel-bounces@lists.xensource.com
[mailto:xen-devel-bounces@lists.xensource.com] On Behalf Of Dan Magenheimer
Sent: Monday, November 08, 2010 5:43 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I''m not asking you to describe the Xen functionality. I am asking you
to
describe in more detail the modification to the processor
functionality/behavior that you are trying to achieve. I don''t know
what a
"simple memory integrity block" does and searching for it
doesn''t find
anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by
the physical CPU == PCPU). The only way to change the VCPU behavior is to
cause some kind of trap or fault or exception to occur on the PCPU, which
gets intercepted by the processor and then control is turned over to
privileged software (in this case Xen). Xen has a lot of code that handles
many many different kinds of traps/faults/exceptions. Your VCPU will need
to execute an instruction that causes a trap or fault or exception and then
you will need to add code to Xen to recognize your special one and do
something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to
Xen and trying to understand my way around it. With regards to the
functionality that I want to implement, I wish to modify the behavior of the
VCPU in xen. As a starting point, I just want to add simple memory integrity
block within the VCPU. I am really not sure what would be the best way to do
this so I need some suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
_____
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven''t provided enough
information
about what it is you are trying to do... and resending the same message
doesn''t help.
For example, if you are "extending" the instruction set (e.g. using an
illegal opcode to do something useful), that would be very different than
trapping memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that
the VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Hi Kaushik,
Here is what I wish to do.
I have implemented a custom hypercall in xen. Now i need to
access the memory pages that are being assigned to a particular process. I
intend to do this from the hypercall handler itself. Once I have these memory
pages, I will compute the hash (Memory Integrity block) of it and store it in
the VCPU structure. This will help me save the state of the memory for a
particular process. Later I can check if some modification have been done to the
process by computing and matching the hash value with the one saved in the VCPU.
It would be great if you could give me some insight on how to
achieve this. Any sample code or examples on this would help a lot.
Thanks a lot.
Regards,
Satyajeet
________________________________
From: Kaushik Barde [kbarde@huawei.com]
Sent: Thursday, November 11, 2010 4:47 PM
To: ''Dan Magenheimer''; Nimgaonkar, Satyajeet; ''Xen
Devel''
Subject: RE: [Xen-devel] VCPU Structure
Satyajeet
I think, describing exact details of “memory integrity block” and its relevance
to VCPU modification would help the conversation.
-Kaushik
From: xen-devel-bounces@lists.xensource.com
[mailto:xen-devel-bounces@lists.xensource.com] On Behalf Of Dan Magenheimer
Sent: Monday, November 08, 2010 5:43 AM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I’m not asking you to describe the Xen functionality. I am asking you to
describe in more detail the modification to the processor functionality/behavior
that you are trying to achieve. I don’t know what a “simple memory integrity
block” does and searching for it doesn’t find anything helpful.
Nearly all instructions in the VCPU are executed directly in hardware (by the
physical CPU == PCPU). The only way to change the VCPU behavior is to cause
some kind of trap or fault or exception to occur on the PCPU, which gets
intercepted by the processor and then control is turned over to privileged
software (in this case Xen). Xen has a lot of code that handles many many
different kinds of traps/faults/exceptions. Your VCPU will need to execute an
instruction that causes a trap or fault or exception and then you will need to
add code to Xen to recognize your special one and do something special with it.
Does that help?
Dan
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Sunday, November 07, 2010 10:14 PM
To: Dan Magenheimer; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
Hi,
I am sorry if I have not provided provided enough information about the
functionality that I want to implement. But my problem is that even I new to Xen
and trying to understand my way around it. With regards to the functionality
that I want to implement, I wish to modify the behavior of the VCPU in xen. As a
starting point, I just want to add simple memory integrity block within the
VCPU. I am really not sure what would be the best way to do this so I need some
suggestions on that too.
Thanks. I hope that helps too.
Regards,
Satyajeet
________________________________
From: Dan Magenheimer [dan.magenheimer@oracle.com]
Sent: Thursday, November 04, 2010 7:25 PM
To: Nimgaonkar, Satyajeet; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
I think nobody is responding because you haven’t provided enough information
about what it is you are trying to do... and resending the same message doesn’t
help.
For example, if you are “extending” the instruction set (e.g. using an illegal
opcode to do something useful), that would be very different than trapping
memory accesses that meet a certain criteria.
From: Nimgaonkar, Satyajeet [mailto:SatyajeetNimgaonkar@my.unt.edu]
Sent: Thursday, November 04, 2010 2:52 PM
To: Xen Devel; Dan Magenheimer
Subject: [Xen-devel] VCPU Structure
Hi,
I want to modify the VCPU structure to implement memory integrity
functionality (i.e. memory hash function), such that the VCPU functionality
incorporates memory integrity. Also once this is done, I want make sure that the
VMs i create (Dom0 and Domu) run on this modified VCPU itself.
Can anyone please tell me where should I look for to implement this.
Thank you very much.
Regards,
Satyajeet
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
On Fri, 2010-11-12 at 17:43 +0000, Nimgaonkar, Satyajeet wrote:> Hi Kaushik, > Here is what I wish to do. > I have implemented a custom hypercall in xen. Now i > need to access the memory pages that are being assigned to a > particular process. I intend to do this from the hypercall handler > itself. Once I have these memory pages, I will compute the hash > (Memory Integrity block) of it and store it in the VCPU structure. > This will help me save the state of the memory for a particular > process. Later I can check if some modification have been done to the > process by computing and matching the hash value with the one saved in > the VCPU. > It would be great if you could give me some insight on > how to achieve this. Any sample code or examples on this would help a > lot. > Thanks a lot.One way would be to use the MMU, you can mark those pages read-only in the page table and then you will get a pagefault for any write to such a page. In the fault handler you would mark the page as modified and unprotect it by setting it read/write again. That would save a lot of time doing expensive calculations when you could just use the existing hardware acceleration designed for exactly this purpose. See Volume 3, Chapter 4 of the Intel architecture software developers manual. Gianni _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Hi Gianni,
Thanks for your reply. I would certainly prefer to lock the pages
instead. I checked the source code and in libxc/xc_domain.c, I see some code on
locking the pages for a hypercall. I my case too, i need to lock memory pages
assigned to a hypercall. Is that a right place I am looking at or can you please
redirect me some code samples about locking memory pages.
Thanks once again.
Regards,
Satyajeet
________________________________________
From: Gianni Tedesco [gianni.tedesco@citrix.com]
Sent: Friday, November 12, 2010 12:00 PM
To: Nimgaonkar, Satyajeet
Cc: Kaushik Barde; Xen Devel
Subject: RE: [Xen-devel] VCPU Structure
On Fri, 2010-11-12 at 17:43 +0000, Nimgaonkar, Satyajeet
wrote:> Hi Kaushik,
> Here is what I wish to do.
> I have implemented a custom hypercall in xen. Now i
> need to access the memory pages that are being assigned to a
> particular process. I intend to do this from the hypercall handler
> itself. Once I have these memory pages, I will compute the hash
> (Memory Integrity block) of it and store it in the VCPU structure.
> This will help me save the state of the memory for a particular
> process. Later I can check if some modification have been done to the
> process by computing and matching the hash value with the one saved in
> the VCPU.
> It would be great if you could give me some insight on
> how to achieve this. Any sample code or examples on this would help a
> lot.
> Thanks a lot.
One way would be to use the MMU, you can mark those pages read-only in
the page table and then you will get a pagefault for any write to such a
page. In the fault handler you would mark the page as modified and
unprotect it by setting it read/write again.
That would save a lot of time doing expensive calculations when you
could just use the existing hardware acceleration designed for exactly
this purpose.
See Volume 3, Chapter 4 of the Intel architecture software developers
manual.
Gianni
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel