Dynamic VM Monitoring using Hypervisor Probes Z. J. Estrada , C. Pham, F. Deng, L. Yan, Z. Kalbarczyk, R. K. Iyer European Dependable Computing Conference 2015-09-09 ECE ILLINOIS 1 Department of Electrical and Computer Engineering
Dynamic VM Monitoring Goal On-demand VM Monitoring to reduce the effort required to harden computing systems against failures and attacks. � Uptime requirements � Effort required � QA concerns � Lack of knowledge ECE ILLINOIS 2 Department of Electrical and Computer Engineering
VM Monitoring Reliability & Security Monitoring Recording and analyzing a computer system to detect failures and attacks. ◮ Passive - polling based ◮ Active - event based ECE ILLINOIS 3 Department of Electrical and Computer Engineering
VM Monitoring Applications VM OS Hypervisor KVM ECE ILLINOIS 4 Department of Electrical and Computer Engineering
VM Monitoring Applications VM OS Hypervisor KVM Monitor ECE ILLINOIS 4 Department of Electrical and Computer Engineering
VM Monitoring Applications VM OS Hypervisor KVM ECE ILLINOIS 4 Department of Electrical and Computer Engineering
VM Monitor Monitor is running inside the hypervisor ECE ILLINOIS 5 Department of Electrical and Computer Engineering
VM Monitor VM execution reaches a hook ECE ILLINOIS 5 Department of Electrical and Computer Engineering
VM Monitor Control is transferred to the monitor ECE ILLINOIS 5 Department of Electrical and Computer Engineering
VM Monitor The monitor performs its monitoring function ECE ILLINOIS 5 Department of Electrical and Computer Engineering
VM Monitor Control is transferred back to the VM ECE ILLINOIS 5 Department of Electrical and Computer Engineering
VM Monitor The VM resumes normal execution ECE ILLINOIS 5 Department of Electrical and Computer Engineering
Hook-Based VM Monitoring Previous techniques: + Active monitoring + Protected hooks − Guest OS only - no userspace − Not dynamic - boot time config − Require guest OS modifications ECE ILLINOIS 6 Department of Electrical and Computer Engineering
Goals Hook-based monitoring should: + be protected from attacks in the VM + be simple to use + not require guest OS modification + be runtime adaptable + allow for arbitrary hook placement ECE ILLINOIS 7 Department of Electrical and Computer Engineering
Hypervisor Probes ECE ILLINOIS 8 Department of Electrical and Computer Engineering
Hardware Assisted Virt. Host Mode Guest Mode (root) (non-root) User User VMEntry Kernel VMExit Kernel ECE ILLINOIS 9 Department of Electrical and Computer Engineering
Hypervisor Probes ◮ Event on guest execution ◮ Event transfers control to hypervisor (VM Exit) ◮ Perform monitoring after that event ◮ Hooks added/removed at runtime ◮ Monitors applications and the guest OS ECE ILLINOIS 10 Department of Electrical and Computer Engineering
Hprobe Architecture Host System VM Probe Probe Probe Status Hprobe Checker user agent Set/Remove probes ioctl (…) Detector 1 Event Forwarder Insert/Remove probes Hprobe Detector 2 Helper APIs Set single step Kernel agent KVM Hypervisor Detector n Host Linux kernel ECE ILLINOIS 11 Department of Electrical and Computer Engineering
Hprobes API int HPROBE_add_probe( ); int HPROBE_remove_probe( ); ◮ addr info : gva+cr3 ◮ vmid : unique id for VM ◮ vcpu type : vcpu state ECE ILLINOIS 12 Department of Electrical and Computer Engineering
Probe ⇒ Event Forwarder Hypervisor VM ... pushl %eax incl %eax decl %ebx ... ECE ILLINOIS 13 Department of Electrical and Computer Engineering
Probe ⇒ Event Forwarder Hypervisor VM ... pushl %eax int3 decl %ebx ... ECE ILLINOIS 13 Department of Electrical and Computer Engineering
Probe ⇒ Event Forwarder Hypervisor VM probe hit handler() (int3) Detector ... pushl %eax int3 decl %ebx ... ECE ILLINOIS 13 Department of Electrical and Computer Engineering
Probe ⇒ Event Forwarder Hypervisor VM probe hit handler() (int3) Reset inst. ... pushl %eax incl %eax decl %ebx ... ECE ILLINOIS 13 Department of Electrical and Computer Engineering
Probe ⇒ Event Forwarder Hypervisor VM probe hit handler() (int3) Reset inst. ... single execute pushl %eax inst. step incl %eax decl %ebx ... ECE ILLINOIS 13 Department of Electrical and Computer Engineering
Probe ⇒ Event Forwarder Hypervisor VM probe hit handler() (int3) Reset inst. ... single execute pushl %eax inst. step int3 decl %ebx rewrite trap ... int3 ECE ILLINOIS 13 Department of Electrical and Computer Engineering
Probe ⇒ Event Forwarder Hypervisor VM probe hit handler() (int3) Reset inst. ... single execute pushl %eax inst. step int3 decl %ebx rewrite trap ... int3 ... resume ECE ILLINOIS 13 Department of Electrical and Computer Engineering
Userspace Probe Challenge Guest Page Tables ECE ILLINOIS 14 Department of Electrical and Computer Engineering
Userspace Probe Challenge Guest Page Tables ECE ILLINOIS 14 Department of Electrical and Computer Engineering
Userspace Probe Challenge Guest Page Tables ECE ILLINOIS 14 Department of Electrical and Computer Engineering
Extended Page Tables (EPT) [1] ◮ Guest OS has full control over PTs ◮ 2nd set of HW PTs for GPA → HPA ◮ Use EPT to write-protect Guest Page Table [1] http://www-archive.xenproject.org/files/xensummit 4/VT roadmap d Nakajima.pdf ECE ILLINOIS 15 Department of Electrical and Computer Engineering
Goals Hook-based monitoring should: + be protected from attacks in the VM + be simple to use + not require guest OS modification + be runtime adaptable + allow for arbitrary hook placement ECE ILLINOIS 16 Department of Electrical and Computer Engineering
Goals Hook-based monitoring should: � be protected from attacks in the VM + be simple to use + not require guest OS modification + be runtime adaptable + allow for arbitrary hook placement ECE ILLINOIS 16 Department of Electrical and Computer Engineering
Goals Hook-based monitoring should: � be protected from attacks in the VM � be simple to use + not require guest OS modification + be runtime adaptable + allow for arbitrary hook placement ECE ILLINOIS 16 Department of Electrical and Computer Engineering
Goals Hook-based monitoring should: � be protected from attacks in the VM � be simple to use � not require guest OS modification + be runtime adaptable + allow for arbitrary hook placement ECE ILLINOIS 16 Department of Electrical and Computer Engineering
Goals Hook-based monitoring should: � be protected from attacks in the VM � be simple to use � not require guest OS modification � be runtime adaptable + allow for arbitrary hook placement ECE ILLINOIS 16 Department of Electrical and Computer Engineering
Goals Hook-based monitoring should: � be protected from attacks in the VM � be simple to use � not require guest OS modification � be runtime adaptable � allow for arbitrary hook placement ECE ILLINOIS 16 Department of Electrical and Computer Engineering
Hprobe Microbenchmarks ◮ probe @ noop kernel function ◮ execute 1M times VM Hypervisor insert probe kernel kernel record start/stop time hypercall user user [2] [2] Adapted from an image by Fei Deng ECE ILLINOIS 17 Department of Electrical and Computer Engineering
Hprobe Single Probe Latency 4.5 4.0 3.5 Time ( µ s) 3.0 2.5 2.0 2.6GHz E5430 2.2-3.0GHz E5-2660 Harpertown (2007) Sandy Bridge (2012) ECE ILLINOIS 18 Department of Electrical and Computer Engineering
Hook-based VM Monitoring Name Latency User Dynamic Modifications Lares 28 µ s No No Hypervisor/Guest SIM 0.40 µ s No No Hypervisor/Guest hprobes 2.6 µ s Yes Yes Hypervisor ECE ILLINOIS 19 Department of Electrical and Computer Engineering
Hook-based VM Monitoring Name Latency User Dynamic Modifications Lares 28 µ s No No Hypervisor/Guest SIM 0.40 µ s No No Hypervisor/Guest hprobes 2.6 µ s Yes Yes Hypervisor ◮ as-a-Service is worth slight performance cost ECE ILLINOIS 19 Department of Electrical and Computer Engineering
Detectors What detectors can we build with hprobes? ECE ILLINOIS 20 Department of Electrical and Computer Engineering
Detectors What detectors can we build with hprobes? ◮ Arbitrarily chose events ◮ On-demand ◮ Access to VM memory & CPU state ECE ILLINOIS 20 Department of Electrical and Computer Engineering
Heartbeat/watchdog App Detector ECE ILLINOIS 21 Department of Electrical and Computer Engineering
Heartbeat/watchdog App e b o r P t r e s n I Detector ECE ILLINOIS 21 Department of Electrical and Computer Engineering
Heartbeat/watchdog App e b P o r r o P b e t r e H s i t n I Detector ECE ILLINOIS 21 Department of Electrical and Computer Engineering
Heartbeat/watchdog App e b P o r r o P b e t r e H s i t n I Detector reset timer ECE ILLINOIS 21 Department of Electrical and Computer Engineering
Recommend
More recommend
