Xen devel - Dec 2008 - Intercepting memory operations of a guest

Hi all,

I''m wanting to modify some xen source code for the purposes of some
research, exploration, and testing of some security concepts.

I have a few questions after looking through the source.

All of the below applies to 32-bit guests.

#1: Is there anyway possible to trap/insert some code at/hook into, any
modification of a PV guest''s page table. Anything like a hypercall
handler I
can plugin to, a function or series of functions that always gets called,
something I can provide a call back to, or anything else?

#2: For some research purposes, I plan on replicating portions of the page
table of a guest, only those pages of the guest''s kernel. I hope to do
this
by the supervisory bit being set; however, I welcome any suggestions of a
better approach to detecting when kernel pages are being modified?

In general, to explain any questions I haven''t specifically asked
above; I''m
looking for the appropriate place in xen to intercept any writes, reads, and
executes of a guest''s memory.

Also, would such activities be easier or more difficult with hvm guests?
Since xen has to provide hvm guests an individual CR3, would such a place be
much easier to hook into because of any abstraction layers that already
exist for such things?

The only reason I picked pv guests was that the semantics of what is a
kernel page and what is not might not be as easy to determine in an hvm
guest, but perhaps this is not the case?

Thanks for any assistance.

Take care,
Sina


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

At 01:15 -0500 on 07 Dec (1228612537), Sina Bahram
wrote:
> #1: Is there anyway possible to trap/insert some code at/hook into, any
> modification of a PV guest''s page table. Anything like a hypercall
handler I
> can plugin to, a function or series of functions that always gets called,
> something I can provide a call back to, or anything else?
PV guest pagetable modifications are made through the MMU hypercalls in
arch/x86/mm.c, and the ptwr functions.  Eventually, I believer they all
call down to adjust_guest_l*e() or alloc_l*_table().  Or, you could
enable shadow pagetables and intercept shadow_set_l*e() and
sh_destroy_l*_shadow() in arch/x86/mm/shadow/multi.c

Intercepting those points doesn''t catch _every_ change to a guest
pagetable but it is guaranteed to catch changes that could be seen by
the hardware MMU.
 
> Also, would such activities be easier or more difficult with hvm guests?
If you''re using shadow mode, then the interception points would be the
same.  For hap (aka NPT/EPT) I can''t think of an easy way to intercept
pagetable changes. 

Cheers,

Tim.

-- 
Tim Deegan <Tim.Deegan@citrix.com>
Principal Software Engineer, Citrix Systems (R&D) Ltd.
[Company #02300071, SL9 0DZ, UK.]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Hi Tim,

Thanks for your reply.

What do you mean by the statement that it won''t catch "all
changes" but only
those seen by the mmu?
 
Also, where can I read more about what enabling shadow page tables means for
pv guests?

The concept I want to implement is very similar, so I''d love to take
advantage of that, if I can.

Take care,
Sina

-----Original Message-----
From: Tim Deegan [mailto:Tim.Deegan@citrix.com] 
Sent: Monday, December 08, 2008 5:12 AM
To: Sina Bahram
Cc: xen-devel@lists.xensource.com
Subject: Re: [Xen-devel] Intercepting memory operations of a guest

At 01:15 -0500 on 07 Dec (1228612537), Sina Bahram
wrote:
> #1: Is there anyway possible to trap/insert some code at/hook into, any
> modification of a PV guest''s page table. Anything like a hypercall
handler
I
> can plugin to, a function or series of functions that always gets called,
> something I can provide a call back to, or anything else?
PV guest pagetable modifications are made through the MMU hypercalls in
arch/x86/mm.c, and the ptwr functions.  Eventually, I believer they all
call down to adjust_guest_l*e() or alloc_l*_table().  Or, you could
enable shadow pagetables and intercept shadow_set_l*e() and
sh_destroy_l*_shadow() in arch/x86/mm/shadow/multi.c

Intercepting those points doesn''t catch _every_ change to a guest
pagetable but it is guaranteed to catch changes that could be seen by
the hardware MMU.
 
> Also, would such activities be easier or more difficult with hvm guests?
If you''re using shadow mode, then the interception points would be the
same.  For hap (aka NPT/EPT) I can''t think of an easy way to intercept
pagetable changes. 

Cheers,

Tim.

-- 
Tim Deegan <Tim.Deegan@citrix.com>
Principal Software Engineer, Citrix Systems (R&D) Ltd.
[Company #02300071, SL9 0DZ, UK.]


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Hi,

At 11:54 -0500 on 08 Dec (1228737297), Sina Bahram
wrote:
> What do you mean by the statement that it won''t catch "all
changes" but only
> those seen by the mmu?
 
You might not see changes made before a pagetable is used for the first
time, or after it stops being used.  Potentially you might miss other
changes as well.  But you are guaranteed that if any pagetable state is
ever seen by the hardware, (that is, used in a VA->PA translation) you
will have seen that state first.
> Also, where can I read more about what enabling shadow page tables means
for
> pv guests?
Not much documentation, I''m afraid.  The source code has some comments
in it (xen/arch/x86/mm/shadow/*) and there''s always the live-migration
paper for an overview, though implementation details there are quite out
of date:
http://www.cl.cam.ac.uk/research/srg/netos/papers/2005-nsdi-migration.pdf
 
Cheers,

Tim.

-- 
Tim Deegan <Tim.Deegan@citrix.com>
Principal Software Engineer, Citrix Systems (R&D) Ltd.
[Company #02300071, SL9 0DZ, UK.]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Hi Tim,

Thanks for your response.

I''ll do some more poking around, and come back with any further
questions.

Take care,
Sina
 

-----Original Message-----
From: Tim Deegan [mailto:Tim.Deegan@citrix.com] 
Sent: Tuesday, December 09, 2008 5:09 AM
To: Sina Bahram
Cc: xen-devel@lists.xensource.com
Subject: Re: [Xen-devel] Intercepting memory operations of a guest

Hi,

At 11:54 -0500 on 08 Dec (1228737297), Sina Bahram
wrote:
> What do you mean by the statement that it won''t catch "all
changes" but
only
> those seen by the mmu?
 
You might not see changes made before a pagetable is used for the first
time, or after it stops being used.  Potentially you might miss other
changes as well.  But you are guaranteed that if any pagetable state is
ever seen by the hardware, (that is, used in a VA->PA translation) you
will have seen that state first.
> Also, where can I read more about what enabling shadow page tables means
for
> pv guests?
Not much documentation, I''m afraid.  The source code has some comments
in it (xen/arch/x86/mm/shadow/*) and there''s always the live-migration
paper for an overview, though implementation details there are quite out
of date:
http://www.cl.cam.ac.uk/research/srg/netos/papers/2005-nsdi-migration.pdf
 
Cheers,

Tim.

-- 
Tim Deegan <Tim.Deegan@citrix.com>
Principal Software Engineer, Citrix Systems (R&D) Ltd.
[Company #02300071, SL9 0DZ, UK.]


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel