From mboxrd@z Thu Jan 1 00:00:00 1970 From: Razvan Cojocaru Subject: [PATCH RFC V11 0/5] Basic guest memory introspection support Date: Tue, 02 Sep 2014 18:37:09 +0300 Message-ID: <5405E425.9070604@bitdefender.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: kevin.tian@intel.com, ian.campbell@citrix.com, stefano.stabellini@eu.citrix.com, andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com, Tim Deegan , Jan Beulich , Eddie Dong , Jun Nakajima List-Id: xen-devel@lists.xenproject.org I apologize, I've sent this as a duplicate V10. Here it is, resent (correctly) as V11. Sorry. As stated originally, we had to modify Xen in order to be able to detect rootkits in HVM guests, in a way that allows an application that runs in dom0 (or a similarly privileged domain) to control what the guest is allowed to do once a threat is detected. This has been done over the mem_event mechanism. To this end, we needed to: 1. Be able to execute the current instruction without allowing it to write to memory. This is done based on new mem_event response fields sent from the controlling application. 2. Have the guest as responsive as possible amid all the processing. So we had to cache some information with each mem_event sent. 3. Not allow the hypervisor to disable sending information about interesting MSR events. 4. Add an additional mem_event type, namely a VMCALL event - in order to do its work, our application occasionally triggers VMCALLs in the guest (not included in the current series, but included in the initial RFC series). 5. Add an additional libxc function that allows triggering page faults in the guest. Changes since V9: - The "xen, libxc: Request page fault injection via libxc" has been reworked to extend HVMOP_inject_trap instead of a new libxc hypercall. Patches: xen: Handle resumed instruction based on previous mem_event reply xen, libxc: Request page fault injection via libxc xen, libxc: Force-enable relevant MSR events xen: Optimize introspection access to guest state xen: Emulate with no writes Thanks, Razvan Cojocaru _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel