Please do not top post.

On 12/02/15 18:19, D'Mita Levy wrote:
Andrew,

My apologies if my logic is flawed or what I am describing is convoluted - I am a student doing research into Xen and trying my best to grasp what is going on, also my ASM is subpar. I have read a paper on system call interception ( https://hal.inria.fr/inria-00431031/PDF/Technical_Report_Syscall_Interception.pdf ) - page 10 describes disabling fast system calls by commenting out some code in the do_set_trap_table() function and logging the calls along with other guest info. My concern is that this may be a dated methodology as the paper was written in 2009 but also that this will only work for x86 and not x86_64 systems; including possible loss of performance since fast calls tend to run better on x86 series processor systems. My goal is to identify when a guest makes a hypercall requesting HYPERVISOR_......grant_table_op(),  mmu_update(), set_trap_table(), essentially I would love to be able to say...if trapcode = xxx printk("Hypercall xxx\n") has occurred but I am unsure what would be a good route to do something like that.

For something written in 2009, that has aged surprisingly well, given that it refers to exact snippets of code.  It will however fail to catch any system call made using sysenter or syscall.

However, intercepting system calls in a PV guest is completely different to intercepting hypercalls, and the described method will not help you in this case.

My original point still stands.  You cannot put a printk in hypercall handlers such as mmu_update and grant_table_op.  Xen will be completely crippled under the spew of all the logging.

Have you considered using xentrace?

~Andrew