Re: Hypervisor to dom0 communication

[Mark Williamson <mark.williamson@cl.cam.ac.uk>]

> I am working on a security tool that monitors various components (IDT,
> SSDT, etc) of a domU using VM introspection.  Currently, we're using a
> polling method to monitor these in-core structions.  We would like to be
> able to use a blocking method instead.  I.e. specify "interesting" memory
> ranges and then wait until they are modified.

Sounds sensible.

> How can I get the hypervisor to alert a kernel module loaded in dom0 that
> something has happened?  Can the alert include extra information such as
> the address that was modified?

Use a VIRQ to notify the dom0 kernel (search for VIRQ_* in 
xen/include/public/xen.h).  That's just an event notification, so you need to 
include some other means of getting the data.  At this point you could just 
do a hypercall - which I assume is how you're currently polling so it might 
be the most backwards-compatible way.

Another way of doing things would be to set up a shared memory region for your 
communication channel and stuff information in there at the same time as 
sending the VIRQ to dom0.  You could also, if it suited your purposes, do the 
VIRQ and shared memory interactions directly from dom0's userspace and avoid 
the need for a kernel module altogether.  See xen/common/trace.c and 
tools/xentrace/* for an example of this being done.

Yet another alternative would be to use the trace buffer itself and convey 
information using trace events.  The trace buffer currently doesn't guarantee 
not to drop messages so you'd need to either modify it to support lossless 
semantics somehow or work around this in your code.

Cheers,
Mark

-- 
Push Me Pull You - Distributed SCM tool (http://www.cl.cam.ac.uk/~maw48/pmpu/)