This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] Logging Access to HDD

To: Michal Novotny <minovotn@xxxxxxxxxx>
Subject: Re: [Xen-devel] Logging Access to HDD
From: Sebastian Biedermann <biedermann@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Date: Tue, 19 Apr 2011 14:52:42 +0200
Cc: James Harper <james.harper@xxxxxxxxxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Tue, 19 Apr 2011 05:53:53 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <4DAD5BD6.7090809@xxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <4DAD5296.70204@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> <AEC6C66638C05B468B556EA548C1A77D01CC8B2B@trantor> <4DAD5968.1030408@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> <4DAD5BD6.7090809@xxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv: Gecko/20110303 Lightning/1.0b2 Thunderbird/3.1.9
Am 19.04.2011 11:54, schrieb Michal Novotny:
On 04/19/2011 11:44 AM, Sebastian Biedermann wrote:
Am 19.04.2011 11:35, schrieb James Harper:
Dear List,

I´m working in research and I tought this list could be
a good adress for my questions.

I want to log the disk accesses of the virtual hvm instances running in Xen.
That means for the start I want to log the write querys of a running
domU instance in the dom0 instance.

So I´m trying to modify the Xen 3.2.1 source code,
but actually I was not able to find a good entry point to do this.

For now, I want to log the disk accesses of a running windows 7 domU
The best what could happenis that I could see even the source and target
of a hdd write query.

Does anyone have an idea how I could do this on a good way?
Which Xen source file / function should I modify? Where is the best
entry point to do this?
HVM access can either be emulated PCI IDE, or PV. For the emulated access you 
would hook into qemu, I think. For PV access you would need to hook into 
whatever block device backend you are using.

Do you just want to count reads and writes, or do you want to log every single 
byte read/written?

I dont need to log every single byte, it would be enough to know which
file is accessed by the domU inside its image.
So when I use HVM I need to modify qemu and not the xen source?


Sebastian, QEMU is used by Xen for HVM guests. It's in the Xen source
codes in the tools/ioemu-dir so look there and here it depends on disk
type you're having - whether SCSI or IDE disk or whether you're using PV
drivers. This can be found in the Xen domain configuration, i.e. if
you're using file:/path/to/image,xvda then you're using PV drivers (they
have to be installed in the guest), for hda instead of xvda you're using
IDE disk and for sda instead of xvda you're using SCSI disk. If you're
using PV drivers then you have to modify the PV drivers themselves and
not QEMU so I'd recommend to use SCSI or IDE disk instead. For SCSI disk
it's the best since you have the logic in the ioemu-dir/hw/scsi-disk.c


Okay, that sounds good, I will try to modifiy the ioemu ide drivers
to see which sectors are used and I will try to match these sectors to
the upper layer of the image of the guestU tofind out which
data files are accessed. Hope that works :-)

Thank you!

Sebastian Biedermann
Security Engineering Group
Technische Universität Darmstadt
Mornewegstraße 32, 64293 Darmstadt
Phone: +49-6151-16-75146

This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity
to whom they are addressed. If you have received this email
in error please notify the sender.

Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>