[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH RFC V4 0/5] Basic guest memory introspection support

  • To: "xen-devel@xxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxx>
  • From: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
  • Date: Wed, 06 Aug 2014 18:58:55 +0300
  • Cc: Kevin Tian <kevin.tian@xxxxxxxxx>, Ian Campbell <ian.campbell@xxxxxxxxxx>, Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Ian Jackson <ian.jackson@xxxxxxxxxxxxx>, Jan Beulich <JBeulich@xxxxxxxx>, Eddie Dong <eddie.dong@xxxxxxxxx>, Jun Nakajima <jun.nakajima@xxxxxxxxx>
  • Comment: DomainKeys? See http://domainkeys.sourceforge.net/
  • Delivery-date: Wed, 06 Aug 2014 15:59:01 +0000
  • Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=bitdefender.com; b=v7q+jY+TmMpj8ODOtBLNDoqN9F0N231g4PWYPE0u6MRkKDVaarSvE25SXIWhbC22J+xBxqbYKYu2WbjOkG+Lv2EGQ+4xk3bCl542685E7bcMrteZug8nIjZfi+0RZ5stF2GzuCYGismW/70qRox63gt/Mb2NwtbLJ055EDydA2kXWNuLgUuYESN353mPo6Mqs07q5NZS9PLkjJdEWvIRjt//adMjzKym/ZWEjcve33ePBgVQw6nsX522uakGb8cBOUq9GLjncm1iX4YuEGT43d7FdluFHToIcD+ZYmGI1H/vHKP8zG8alcXZKSF31waApepBGtI0M5ZyxyXDvIfy8Q==; h=Received:Received:Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:Content-Type:Content-Transfer-Encoding:X-BitDefender-Scanner:X-BitDefender-Spam:X-BitDefender-SpamStamp:X-BitDefender-CF-Stamp;
  • List-id: Xen developer discussion <xen-devel.lists.xen.org>


Thank you for your comments (with special thanks to Jan Beulich), I've
addressed them and this is the V5 series.

As stated originally, we had to modify Xen in order to be able to detect
rootkits in HVM guests, in a way that allows an application that runs in
dom0 (or a similarly privileged domain) to control what the guest is
allowed to do once a threat is detected. This has been done over the
mem_event mechanism.

To this end, we needed to:

1. Be able to execute the current instruction without allowing it to
write to memory. This is done based on new mem_event response
fields sent from the controlling application.

2. Have the guest as responsive as possible amid all the processing. So
we had to cache some information with each mem_event sent.

3. Not allow the hypervisor to disable sending information about
interesting MSR events.

4. Add an additional mem_event type, namely a VMCALL event - in order to
do its work, our application occasionally triggers VMCALLs in the guest
(not included in the current series, but included in the initial RFC

5. Add an additional libxc function that allows triggering page faults
in the guest.

Changes since V4:
 - Addressed discussed issues (please see individual patches for


xen: Handle resumed instruction based on previous mem_event reply
xen, libxc: Request page fault injection via libxc
xen: Force-enable relevant MSR events; optimize the number of sent MSR
xen: Optimize introspection access to guest state
xen: Emulate with no writes

Razvan Cojocaru

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.