From mboxrd@z Thu Jan 1 00:00:00 1970 From: Razvan Cojocaru Subject: Re: Blocking CR and MSR writes via mem_access? Date: Thu, 02 Oct 2014 14:54:45 +0300 Message-ID: <542D3D05.8020806@bitdefender.com> References: <542D2DA7.1060903@bitdefender.com> <542D55AE020000780003BEFB@mail.emea.novell.com> <542D3B0B.9070808@bitdefender.com> <542D3C4C.7080307@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <542D3C4C.7080307@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Andrew Cooper , Jan Beulich Cc: "xen-devel@lists.xen.org" List-Id: xen-devel@lists.xenproject.org On 10/02/14 14:51, Andrew Cooper wrote: > On 02/10/14 12:46, Razvan Cojocaru wrote: >> On 10/02/14 14:39, Jan Beulich wrote: >>>>>> On 02.10.14 at 12:49, wrote: >>>> Currently hvm_memory_event_cr3() and the other hvm_memory_event_*() >>>> functions in hvm.c can pause the VCPU and send a mem_event with the new >>>> value of the respective register, but especially in the case of CR >>>> events (as opposed to MSR events), this is done _after_ the value is set >>>> (please see hvm_set_cr3() in hvm.c). >>>> >>>> It would be interesting from a memory introspection application's point >>>> of view to be able to receive a mem_event _before_ the value is set, and >>>> important to be able to veto the change. >>> So what do you expect the effect of denying the write to be? >>> Wouldn't crashing the guest explicitly have about the same effect? >> Thanks for the quick reply! >> >> Denying a normal, legitimate write, would indeed be a problem along the >> lines of what you are describing, but the point would be to block >> malicious writes that would modify the SYSCALL entry point, disable SMAP >> / SMEP, and so on. > > So your use case is to protect a running VM which is under active attack > without crashing the domain wholesale? > > I presume you then want to degrade the illegitimate writes to nops? Yes, pretty much. Thanks, Razvan Cojocaru