[PATCH RFC 0/9] Basic guest memory introspection support

[PATCH RFC 0/9] Basic guest memory introspection support

[Razvan Cojocaru]

Hello,

We had to modify Xen in order to be able to detect rootkits in HVM
guests, in a way that allows an application that runs in dom0 (or a
similarly privileged domain) to control what the guest is allowed to do
once a threat is detected. This has been done over the mem_event mechanism.

To this end, we needed to:

1. Be able to execute the current instruction without allowing it to
write to memory. Also, be able to skip the current instruction
completely (increment the guest's instruction pointer by the length of
the current instruction). This is done based on new mem_event response
fields sent from the controlling application.

2. Have the guest as responsive as possible amid all the processing. So
we had to cache some information, namely a set of registers, with each
mem_event sent.

3. Not allow the hypervisor to disable sending information about
interesting MSR events.

4. Add an additional mem_event type, namely a VMCALL event - in order to
do its work, our application occasionally triggers VMCALLs in the guest.

5. Add an additional libxc function that allows triggering page faults
in the guest.

6. Since we're emulating the current instruction so that the guest can
continue to run without lifting memory access restrictions, we've
encountered problems with some instructions that Xen couldn't emulate.
Our solution was a combination of working the 'accessed' and 'dirty'
bits, and adding a re-execution mechanism for execute faults.

7. To make sure that pages that we've marked as interesting don't have
their permissions reset.

Please note that while these patches can be applied directly to Xen
master, we've tested them against commit
4bd78937ec324bcef4e29ef951e0ff9815770de1 (which was roughly before the
new xc_mem_access_enable() came into libxc).

Patch list:

xen: Emulate with no writes; compute current instruction length
xen: Optimize introspection access to guest state
xen: Force-enable relevant MSR events; optimize the number of sent MSR
events
xenctrl: Make the headers C++ friendly
xen: Support for VMCALL mem_events
xen, libxc: Request page fault injection via libxc
xen: Handle resumed instruction based on previous mem_event reply
xen: Generic instruction re-execution mechanism for execute faults
mm: mark pages that have their permissions controlled by a domain


All the best,
Razvan Cojocaru

Re: [PATCH RFC 0/9] Basic guest memory introspection support

[Jan Beulich]

>>> On 02.07.14 at 15:34, <rcojocaru@bitdefender.com> wrote:
> 4. Add an additional mem_event type, namely a VMCALL event - in order to
> do its work, our application occasionally triggers VMCALLs in the guest.

That seems like bending the mem_event interface quite a bit - VMCALL
isn't really memory (or event) specific.

Jan

Re: [PATCH RFC 0/9] Basic guest memory introspection support

[Razvan Cojocaru]

On 07/02/2014 05:30 PM, Jan Beulich wrote:
>>>> On 02.07.14 at 15:34, <rcojocaru@bitdefender.com> wrote:
>> 4. Add an additional mem_event type, namely a VMCALL event - in order to
>> do its work, our application occasionally triggers VMCALLs in the guest.
> 
> That seems like bending the mem_event interface quite a bit - VMCALL
> isn't really memory (or event) specific.

First, thank you for the reply.

I don't disagree that it's somewhat bending mem_event, however in the
context of our application it became necessary to know exactly when a
triggered VMCALL occured, so conceptually this was a noteworthy event
for us.

As for using mem_event for it, we chose it because it seems to be the
closest thing to a standard Xen way of handling events, it is quite
stable, and we thought it might not be such a stretch since there's also
MEM_EVENT_REASON_SINGLESTEP.

We thought that adding an extra mem_event type would solve the problem
while adding as little unnecessary complications to the existing code,
and making it as trouble-free as possible for Xen maintainers / testers.


Thanks again,
Razvan Cojocaru

Re: [PATCH RFC 0/9] Basic guest memory introspection support

[Mihai Donțu]

On Wed, 02 Jul 2014 15:30:24 +0100 Jan Beulich wrote:
> >>> On 02.07.14 at 15:34, <rcojocaru@bitdefender.com> wrote:
> > 4. Add an additional mem_event type, namely a VMCALL event - in
> > order to do its work, our application occasionally triggers VMCALLs
> > in the guest.
> 
> That seems like bending the mem_event interface quite a bit - VMCALL
> isn't really memory (or event) specific.

Indeed. We've used that existing communication channel to carry MSR
change events as well. Maybe in the feature we could rework the whole
thing (mem, MSRs, VMCALL) under a new name, like 'guest events'.

-- 
Mihai DONȚU

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH RFC 0/9] Basic guest memory introspection support

[Mihai Donțu]

[-- Attachment #1.1: Type: text/plain, Size: 748 bytes --]

On Wednesday 02 July 2014 17:50:53 Mihai Donțu wrote:
> On Wed, 02 Jul 2014 15:30:24 +0100 Jan Beulich wrote:
> > >>> On 02.07.14 at 15:34, <rcojocaru@bitdefender.com> wrote:
> > > 4. Add an additional mem_event type, namely a VMCALL event - in
> > > order to do its work, our application occasionally triggers
> > > VMCALLs in the guest.
> > 
> > That seems like bending the mem_event interface quite a bit - VMCALL
> > isn't really memory (or event) specific.
> 
> Indeed. We've used that existing communication channel to carry MSR
> change events as well. Maybe in the feature we could rework the whole
> thing (mem, MSRs, VMCALL) under a new name, like 'guest events'.

Corrected Răzvan's email address. 

-- 
Mihai DONȚU

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel