Re: [PATCH V2] mem_event: Allow emulating an instruction that caused a page fault

[Razvan Cojocaru <rzvncj@gmail.com>]

> The only properly safe way to allow exactly one exception to your rules
> is to emulate the instruction in user-space.  (Well, that or somehow
> move your policy into Xen and do the emulation there, but I'm quite
> strongly opposed to that).

Is there an example of that somewhere in the Xen source code tree?

> If you're just using this to gather statistics about how often a page
> gets written, you could use sampling; you don't need to see _every_
> write.

I'm not gathering statistics.

> It might be helpful if you could give us a clear description of exactly
> what problem you're trying to solve.

I'm watching for suspicious activity on the domU. If any occurs, the 
domU should be paused (at least the VCPU in question). A dom0 userspace 
application should decide what constitutes suspicious activity, with (1) 
the least possible slowing down of the domU, and (2) with as little 
"false positive" writes allowed as possible (ideally zero, if there's a 
way that doesn't go against requirement (1)).

Thanks,
Razvan Cojocaru