> I am working on a security tool that monitors various components (IDT,
> SSDT, etc) of a domU using VM introspection. Currently, we''re
using a
> polling method to monitor these in-core structions. We would like to be
> able to use a blocking method instead. I.e. specify
"interesting" memory
> ranges and then wait until they are modified.
Sounds sensible.
> How can I get the hypervisor to alert a kernel module loaded in dom0 that
> something has happened? Can the alert include extra information such as
> the address that was modified?
Use a VIRQ to notify the dom0 kernel (search for VIRQ_* in
xen/include/public/xen.h). That''s just an event notification, so you
need to
include some other means of getting the data. At this point you could just
do a hypercall - which I assume is how you''re currently polling so it
might
be the most backwards-compatible way.
Another way of doing things would be to set up a shared memory region for your
communication channel and stuff information in there at the same time as
sending the VIRQ to dom0. You could also, if it suited your purposes, do the
VIRQ and shared memory interactions directly from dom0''s userspace and
avoid
the need for a kernel module altogether. See xen/common/trace.c and
tools/xentrace/* for an example of this being done.
Yet another alternative would be to use the trace buffer itself and convey
information using trace events. The trace buffer currently doesn''t
guarantee
not to drop messages so you''d need to either modify it to support
lossless
semantics somehow or work around this in your code.
Cheers,
Mark
--
Push Me Pull You - Distributed SCM tool (http://www.cl.cam.ac.uk/~maw48/pmpu/)
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel