From: Paolo Bonzini <pbonzini@redhat.com>
To: Alexander Binun <binun@cs.bgu.ac.il>
Cc: yagel@cs.bgu.ac.il, kahilm@post.bgu.ac.il,
Stefan Hajnoczi <stefanha@gmail.com>,
qemu-devel@nongnu.org, boaz.menuhin@gmail.com,
markbl@post.bgu.ac.il
Subject: Re: [Qemu-devel] different IDTs of the same VCPU
Date: Mon, 17 Mar 2014 13:20:00 +0100 [thread overview]
Message-ID: <5326E870.5040802@redhat.com> (raw)
In-Reply-To: <201403171154.s2HBsj6M009513@indigo.cs.bgu.ac.il>
Il 17/03/2014 12:54, Alexander Binun ha scritto:
> Dear friends, great thanks!
>
> To summarize: we are trying to monitor VCPU IDT changes that are done
> by external parties (e.g. rootkits) and not by intra-KVM machinery.
> Are there parameters that witness such changes ?
There is no way to intercept changes to the interrupt descriptor table.
You can:
* look at the IDTR values on every vmexit, including before injecting an
interrupt, but that won't protect from hijacking software interrupts
such as int $0x80;
* protect the IDT from writing using KVM's page table mechanisms, but
that won't catch the case when the IDT is changed to a whole new page.
Paolo
prev parent reply other threads:[~2014-03-17 12:20 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-07 14:47 [Qemu-devel] sniffing traffic between VMs Alexander Binun
2013-10-10 9:02 ` Stefan Hajnoczi
2013-10-10 11:00 ` [Qemu-devel] kvm binary is deprecated Alexander Binun
2013-10-11 9:05 ` Stefan Hajnoczi
2013-10-12 14:45 ` Alexander Binun
2013-10-14 9:12 ` Stefan Hajnoczi
2013-10-14 10:36 ` Alexander Binun
2013-10-14 14:16 ` Stefan Hajnoczi
2013-10-24 9:23 ` [Qemu-devel] kvm binary is deprecated - solved! Alexander Binun
2013-10-24 9:49 ` Stefan Hajnoczi
2013-10-24 9:54 ` [Qemu-devel] observing VM actions Alexander Binun
2013-12-18 11:53 ` [Qemu-devel] sniffing traffic between virtual machines Alexander Binun
2013-12-19 9:05 ` Stefan Hajnoczi
2014-03-05 16:35 ` [Qemu-devel] kill /destroy a VM - help Alexander Binun
2014-03-06 10:22 ` Stefan Hajnoczi
2014-03-06 10:31 ` Alexander Binun
2014-03-06 11:28 ` Paolo Bonzini
2014-03-06 15:54 ` [Qemu-devel] kill /destroy a VM - still hangs! Alexander Binun
2014-03-09 15:40 ` [Qemu-devel] trying to kill a VM Alexander Binun
2014-03-13 12:59 ` [Qemu-devel] different IDTs of the same VCPU Alexander Binun
2014-03-13 15:15 ` Paolo Bonzini
2014-03-17 11:54 ` Alexander Binun
2014-03-17 12:20 ` Paolo Bonzini [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5326E870.5040802@redhat.com \
--to=pbonzini@redhat.com \
--cc=binun@cs.bgu.ac.il \
--cc=boaz.menuhin@gmail.com \
--cc=kahilm@post.bgu.ac.il \
--cc=markbl@post.bgu.ac.il \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@gmail.com \
--cc=yagel@cs.bgu.ac.il \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.