WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] Windows SMP

To: James Harper <james.harper@xxxxxxxxxxxxxxxx>, Venefax <venefax@xxxxxxxxx>, Dirk Utterback <dirk.utterback@xxxxxxxxx>
Subject: Re: [Xen-devel] Windows SMP
From: Keir Fraser <keir.fraser@xxxxxxxxxxxxx>
Date: Mon, 29 Dec 2008 09:16:53 +0000
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Mon, 29 Dec 2008 01:17:18 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <AEC6C66638C05B468B556EA548C1A77D01550111@trantor>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index: AclpXq3FDdh9/hRMR7SA68V92eNifgAAPoJwAAAyQsAAADKfEAALC0YVAAATS8AAAMFZnAAAQgAQAABjQWcAAA25MAAAqk/Y
Thread-topic: [Xen-devel] Windows SMP
User-agent: Microsoft-Entourage/12.15.0.081119
On 29/12/2008 09:03, "James Harper" <james.harper@xxxxxxxxxxxxxxxx> wrote:

>> You could get similar results by putting static
> Windows-kernel-specific
>> fixup tables in your drivers,
> 
> As in 'write bytes to offset x into kernel function y', with x depending
> on the exact kernel build? Wouldn't the rootkit detectors complain about
> that?

I'm not actually sure on rootkit-detector compatibility with this approach.
I know that the built-in tripwire capabilities of some 64-bit Windows
versions would be a problem, but then they tend to have lazy TPR, and also
they write to the TPR with MOV CR8, which can usually be handled efficiently
by HVM-capable CPUs anyway, so no patching is required.

Any software-based approach is going to involve patching, so I'd cross the
rootkit-detector bridge when/if we come to it. I haven't heard or read of
any complaints in this regard so far.

>> or I'd be open to having a KVM type of
>> interaction between Xen and your GPLPV drivers. Putting the payload in
> the
>> generic virtual BIOS seemed kind of gross to me.
> 
> Is it possible for a virtualised DomU to trap the MMIO write itself, or
> can it only be trapped by the hypervisor?

It could, by trapping all accesses to the APIC page (remove mapping, hook
page-fault handler). It's going to be much easier to get help from the
hypervisor!

> Btw, is it the vmexit that is slow about these TPR writes, or is it the
> writes themselves?

Both. As well as the VMEXIT you have a run through the instruction emulator
and into the apic device model. It sucks pretty bad if you do it often.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel

<Prev in Thread] Current Thread [Next in Thread>