[Xen-devel] [PATCH RFC 0/9] Basic guest memory introspection support

[Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>]

Hello,

We had to modify Xen in order to be able to detect rootkits in HVM
guests, in a way that allows an application that runs in dom0 (or a
similarly privileged domain) to control what the guest is allowed to do
once a threat is detected. This has been done over the mem_event mechanism.

To this end, we needed to:

1. Be able to execute the current instruction without allowing it to
write to memory. Also, be able to skip the current instruction
completely (increment the guest's instruction pointer by the length of
the current instruction). This is done based on new mem_event response
fields sent from the controlling application.

2. Have the guest as responsive as possible amid all the processing. So
we had to cache some information, namely a set of registers, with each
mem_event sent.

3. Not allow the hypervisor to disable sending information about
interesting MSR events.

4. Add an additional mem_event type, namely a VMCALL event - in order to
do its work, our application occasionally triggers VMCALLs in the guest.

5. Add an additional libxc function that allows triggering page faults
in the guest.

6. Since we're emulating the current instruction so that the guest can
continue to run without lifting memory access restrictions, we've
encountered problems with some instructions that Xen couldn't emulate.
Our solution was a combination of working the 'accessed' and 'dirty'
bits, and adding a re-execution mechanism for execute faults.

7. To make sure that pages that we've marked as interesting don't have
their permissions reset.

Please note that while these patches can be applied directly to Xen
master, we've tested them against commit
4bd78937ec324bcef4e29ef951e0ff9815770de1 (which was roughly before the
new xc_mem_access_enable() came into libxc).

Patch list:

xen: Emulate with no writes; compute current instruction length
xen: Optimize introspection access to guest state
xen: Force-enable relevant MSR events; optimize the number of sent MSR
events
xenctrl: Make the headers C++ friendly
xen: Support for VMCALL mem_events
xen, libxc: Request page fault injection via libxc
xen: Handle resumed instruction based on previous mem_event reply
xen: Generic instruction re-execution mechanism for execute faults
mm: mark pages that have their permissions controlled by a domain


All the best,
Razvan Cojocaru

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel