From: Paolo Bonzini <pbonzini@redhat.com>
To: Alexander Binun <binun@cs.bgu.ac.il>
Cc: yagel@cs.bgu.ac.il, kahilm@post.bgu.ac.il,
Stefan Hajnoczi <stefanha@gmail.com>,
qemu-devel@nongnu.org, boaz.menuhin@gmail.com,
markbl@post.bgu.ac.il
Subject: Re: [Qemu-devel] different IDTs of the same VCPU
Date: Mon, 17 Mar 2014 13:20:00 +0100 [thread overview]
Message-ID: <5326E870.5040802@redhat.com> (raw)
In-Reply-To: <201403171154.s2HBsj6M009513@indigo.cs.bgu.ac.il>
Il 17/03/2014 12:54, Alexander Binun ha scritto:
> Dear friends, great thanks!
>
> To summarize: we are trying to monitor VCPU IDT changes that are done
> by external parties (e.g. rootkits) and not by intra-KVM machinery.
> Are there parameters that witness such changes ?
There is no way to intercept changes to the interrupt descriptor table.
You can:
* look at the IDTR values on every vmexit, including before injecting an
interrupt, but that won't protect from hijacking software interrupts
such as int $0x80;
* protect the IDT from writing using KVM's page table mechanisms, but
that won't catch the case when the IDT is changed to a whole new page.
Paolo
prev parent reply other threads:[~2014-03-17 12:20 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-07 14:47 [Qemu-devel] sniffing traffic between VMs Alexander Binun
2013-10-10 9:02 ` Stefan Hajnoczi
2013-10-10 11:00 ` [Qemu-devel] kvm binary is deprecated Alexander Binun
2013-10-11 9:05 ` Stefan Hajnoczi
2013-10-12 14:45 ` Alexander Binun
2013-10-14 9:12 ` Stefan Hajnoczi
2013-10-14 10:36 ` Alexander Binun
2013-10-14 14:16 ` Stefan Hajnoczi
2013-10-24 9:23 ` [Qemu-devel] kvm binary is deprecated - solved! Alexander Binun
2013-10-24 9:49 ` Stefan Hajnoczi
2013-10-24 9:54 ` [Qemu-devel] observing VM actions Alexander Binun
2013-12-18 11:53 ` [Qemu-devel] sniffing traffic between virtual machines Alexander Binun
2013-12-19 9:05 ` Stefan Hajnoczi
2014-03-05 16:35 ` [Qemu-devel] kill /destroy a VM - help Alexander Binun
2014-03-06 10:22 ` Stefan Hajnoczi
2014-03-06 10:31 ` Alexander Binun
2014-03-06 11:28 ` Paolo Bonzini
2014-03-06 15:54 ` [Qemu-devel] kill /destroy a VM - still hangs! Alexander Binun
2014-03-09 15:40 ` [Qemu-devel] trying to kill a VM Alexander Binun
2014-03-13 12:59 ` [Qemu-devel] different IDTs of the same VCPU Alexander Binun
2014-03-13 15:15 ` Paolo Bonzini
2014-03-17 11:54 ` Alexander Binun
2014-03-17 12:20 ` Paolo Bonzini [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5326E870.5040802@redhat.com \
--to=pbonzini@redhat.com \
--cc=binun@cs.bgu.ac.il \
--cc=boaz.menuhin@gmail.com \
--cc=kahilm@post.bgu.ac.il \
--cc=markbl@post.bgu.ac.il \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@gmail.com \
--cc=yagel@cs.bgu.ac.il \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).