Enhance protection from security bugs in the Xen hypervisor Anthony - - PowerPoint PPT Presentation

▶
enhance protection from security bugs in the xen
SMART_READER_LITE
LIVE PREVIEW

Enhance protection from security bugs in the Xen hypervisor Anthony - - PowerPoint PPT Presentation

Jul 03, 2023 653 likes •859 views

Enhance protection from security bugs in the Xen hypervisor Anthony PERARD Xen architecture Dom0 VMs QEMU Xen Scheduler MMU vPIC Memory CPUs I/O HW Emulation in hypervisor For performance Examples: Interrupt controller

slide-1
SLIDE 1

Enhance protection from security bugs in the Xen hypervisor

Anthony PERARD

slide-2
SLIDE 2

Xen architecture

HW Xen Scheduler MMU vPIC Memory CPUs I/O Dom0 QEMU VMs

slide-3
SLIDE 3

Emulation in hypervisor

  • For performance
  • Examples:

– Interrupt controller – Real mode emulation – Timers

slide-4
SLIDE 4

Emulation in hypervisor

  • For performance
  • Examples:

– Interrupt controller – Real mode emulation – Timers

  • Have same privilege as the hypervisor
slide-5
SLIDE 5

Reduce severity of bugs

  • Deprivilege emulator execution
  • Different memory space
  • User mode
slide-6
SLIDE 6

Deprivileged mode

  • Prepare page tables for user access
slide-7
SLIDE 7

Deprivileged mode

  • Prepare page tables for user access
  • Emulator code into different section

– .hvm_deprivileged_enhancement.text

slide-8
SLIDE 8

Deprivileged mode

  • Prepare page tables for user access
  • Emulator code into different section
  • Have context switch:

– vmx_ctxt_switch_from() – Save EFER, then allow sysret/syscall – Save registers – Setup new stack for depriv mode – Sysret – Now in user mode, call the function

slide-9
SLIDE 9

Deprivileged mode

  • Prepare page tables for user access
  • Emulator code into different section
  • Have context switch
  • Jump table for switch statement issue

– .rodata

slide-10
SLIDE 10

Bad behavior

  • What if there is a bug in the emulator?

– Access other memory? – Infinite loop? – Other exception?

slide-11
SLIDE 11

Bad behavior

  • Trap handlers for exception:

– Page fault – General exception – ...

slide-12
SLIDE 12

Bad behavior

  • Trap handlers for exception:

– Page fault – General exception – ...

→ crash domain!

slide-13
SLIDE 13

Bad behavior

  • Trap handlers for exception:

– Page fault – General exception – ...

→ crash domain!

  • Infinit loop?

– Watchdog

slide-14
SLIDE 14

Bad behavior

  • Trap handlers for exception:

– Page fault – General exception – ...

→ crash domain!

  • Infinit loop?

– Watchdog → crash domain

slide-15
SLIDE 15

Syscall from depriv mode

  • Do privileged command while in depriv mode
slide-16
SLIDE 16

Syscall from depriv mode

  • Do privileged command while in depriv mode

– Set a number in a register, then syscall

slide-17
SLIDE 17

Syscall from depriv mode

  • Do privileged command while in depriv mode

– Set a number in a register, then syscall

  • Problem, syscall use same return path

– Have a syscall number for actual return

slide-18
SLIDE 18

Conclusion

  • Optimisation
  • Benchmark
  • Do not trust depriv mode
  • Work in progress
slide-19
SLIDE 19

Conclusion

  • Optimisation
  • Benchmark
  • Do not trust depriv mode
  • Work in progress
  • Proof-of-concept by Ben Catterall
  • Look for “deprivileged mode” in xen-devel

archive

– http://lists.xen.org/archives/html/xen-devel/

slide-20
SLIDE 20

Question?

  • Look for “deprivileged mode” in xen-devel

archive

– http://lists.xen.org/archives/html/xen-devel/