Re: [Xen-devel] [PATCH RFC V11 0/5] Basic guest memory introspection support

[Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>]

On Tue, Sep 02, 2014 at 06:37:09PM +0300, Razvan Cojocaru wrote:
> I apologize, I've sent this as a duplicate V10.
> Here it is, resent (correctly) as V11. Sorry.

You also have the RFC part on the patchset. Is that intentional?
Some maintainers (looks at himself) ignore (well, put it in the
'todo pile' to be exact) patches like that until they are
more mature (non-RFC) and then they will review them.

I think the RFC part of the patches has been rubbed up as
the design is pretty baked?

> 
> As stated originally, we had to modify Xen in order to be able to detect
> rootkits in HVM guests, in a way that allows an application that runs in
> dom0 (or a similarly privileged domain) to control what the guest is
> allowed to do once a threat is detected. This has been done over the
> mem_event mechanism.
> 
> To this end, we needed to:
> 
> 1. Be able to execute the current instruction without allowing it to
> write to memory. This is done based on new mem_event response
> fields sent from the controlling application.
> 
> 2. Have the guest as responsive as possible amid all the processing. So
> we had to cache some information with each mem_event sent.
> 
> 3. Not allow the hypervisor to disable sending information about
> interesting MSR events.
> 
> 4. Add an additional mem_event type, namely a VMCALL event - in order to
> do its work, our application occasionally triggers VMCALLs in the guest
> (not included in the current series, but included in the initial RFC
> series).
> 
> 5. Add an additional libxc function that allows triggering page faults
> in the guest.
> 
> Changes since V9:
>  - The "xen, libxc: Request page fault injection via libxc" has
>    been reworked to extend HVMOP_inject_trap instead of a new
>    libxc hypercall.
> 
> Patches:
> 
> xen: Handle resumed instruction based on previous mem_event reply
> xen, libxc: Request page fault injection via libxc
> xen, libxc: Force-enable relevant MSR events
> xen: Optimize introspection access to guest state
> xen: Emulate with no writes
> 
> 
> Thanks,
> Razvan Cojocaru
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel