[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH RFC 0/9] Basic guest memory introspection support
Hello, We had to modify Xen in order to be able to detect rootkits in HVM guests, in a way that allows an application that runs in dom0 (or a similarly privileged domain) to control what the guest is allowed to do once a threat is detected. This has been done over the mem_event mechanism. To this end, we needed to: 1. Be able to execute the current instruction without allowing it to write to memory. Also, be able to skip the current instruction completely (increment the guest's instruction pointer by the length of the current instruction). This is done based on new mem_event response fields sent from the controlling application. 2. Have the guest as responsive as possible amid all the processing. So we had to cache some information, namely a set of registers, with each mem_event sent. 3. Not allow the hypervisor to disable sending information about interesting MSR events. 4. Add an additional mem_event type, namely a VMCALL event - in order to do its work, our application occasionally triggers VMCALLs in the guest. 5. Add an additional libxc function that allows triggering page faults in the guest. 6. Since we're emulating the current instruction so that the guest can continue to run without lifting memory access restrictions, we've encountered problems with some instructions that Xen couldn't emulate. Our solution was a combination of working the 'accessed' and 'dirty' bits, and adding a re-execution mechanism for execute faults. 7. To make sure that pages that we've marked as interesting don't have their permissions reset. Please note that while these patches can be applied directly to Xen master, we've tested them against commit 4bd78937ec324bcef4e29ef951e0ff9815770de1 (which was roughly before the new xc_mem_access_enable() came into libxc). Patch list: xen: Emulate with no writes; compute current instruction length xen: Optimize introspection access to guest state xen: Force-enable relevant MSR events; optimize the number of sent MSR events xenctrl: Make the headers C++ friendly xen: Support for VMCALL mem_events xen, libxc: Request page fault injection via libxc xen: Handle resumed instruction based on previous mem_event reply xen: Generic instruction re-execution mechanism for execute faults mm: mark pages that have their permissions controlled by a domain All the best, Razvan Cojocaru _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |