- PDF Free Download

Size: px

Start display at page:

Download ""

Clarence Stanley
5 years ago
Views:

12 Extended Page Tables (EPT) A VMM must protect host physical memory Multiple guest operating systems share the same host physical memory VMM typically implements protections through page-table shadowing in software Page-table shadowing accounts for a large portion of virtualization overheads VM exits due to: #PF, INVLPG, MOV CR3 Goal of EPT is to reduce these overheads

13 What Is EPT? CR3 EPT Base Pointer (EPTP) Guest Linear Address Guest IA-32 Page Tables Guest Physical Address Extended Page Tables Host Physical Address Extended Page Table A new page-table structure, under the control of the VMM Defines mapping between guest- and host-physical addresses EPT base pointer (new VMCS field) points to the EPT page tables EPT (optionally) activated on VM entry, deactivated on VM exit Guest has full control over its own IA-32 page tables No VM exits due to guest page faults, INVLPG, or CR3 changes

14 EPT Translation: Details CR3 Guest Linear Address Host Physical Address + EPT Tables Page Directory + EPT Tables Page Table + EPT Tables Guest Physical Page Base Address Guest Physical Address All guest-physical memory addresses go through EPT tables (CR3, PDE, PTE, etc.) Above example is for 2-level table for 32-bit address space Translation possible for other page-table formats (e.g., PAE)

20 VT-d Overview: Intel Virtualization Technology For Directed I/O

21 Options For I/O Virtualization Monolithic Model Service VM Model Pass-through Model Service VMs Guest VMs VM 0 VM n VM 0 VM n Guest OS and Apps Guest OS and Apps I/O Services VM 0 VM n Guest OS and Apps Guest OS and Apps I/O Services Device Drivers Guest OS and Apps Device Drivers Device Drivers Device Drivers Hypervisor Hypervisor Hypervisor Shared Devices Shared Devices Assigned Devices Pro: Higher Performance Pro: I/O Device Sharing Pro: VM Migration Con: Larger Hypervisor Pro: High Security Pro: I/O Device Sharing Pro: VM Migration Con: Lower Performance Pro: Highest Performance Pro: Smaller Hypervisor Pro: Device assisted sharing Con: Migration Challenges VT-d Goal: Support all Models

22 VT-d Overview VT-d is platform infrastructure for I/O virtualization Defines architecture for DMA remapping Implemented as part of platform core logic Will be supported broadly in Intel server and client chipsets CPU CPU System Bus VT-d Integrated Devices North Bridge PCIe* Root Ports DRAM PCI Express South Bridge PCI, LPC, Legacy devices,

23 VT-d Usage Basic infrastructure for I/O virtualization Enable direct assignment of I/O devices to unmodified or paravirtualized VMs Improves system reliability Contain and report errant DMA to software Enhances security Support multiple protection domains under SW control Provide foundation for building trusted I/O capabilities Other usages Generic facility for DMA scatter/gather Overcome addressability limitations on legacy devices

VT-d Architecture Detail DMA Requests Device ID Virtual Address Length Bus 255 Bus N Dev 31, Func 7 Dev P, Func 2 Page Frame Fault Generation Bus 0 Dev P, Func 1 Dev 0, Func 0 4KB Page Tables DMA

24 VT-d Architecture Detail DMA Requests Device ID Virtual Address Length Bus 255 Bus N Dev 31, Func 7 Dev P, Func 2 Page Frame Fault Generation Bus 0 Dev P, Func 1 Dev 0, Func 0 4KB Page Tables DMA Remapping Engine Translation Cache Device Assignment Structures Device D1 Device D2 Address Translation Structures Context Cache Address Translation Structures Memory Access with System Physical Address Memory-resident Partitioning And Translation Structures

25 VT-d: Remapping Structures VT-d hardware selects page-table based on source of DMA request Requestor ID (bus / device / function) in request identifies DMA source VT-d Device Assignment Entry Rsvd Domain ID Rsvd Address Width 63 0 Address Space Root Pointer Rsvd Ext. Controls Controls P VT-d supports hierarchical page tables for address translation Page directories and page tables are 4 KB in size 4KB base page size with support for larger page sizes Support for DMA snoop control through page table entries VT-d Page Table Entry 63 Rsvd Page-Frame / Page-Table Address Available SP Rsvd Ext. Controls W R 0

26 VT-d: Hardware Page Walk Requestor ID DMA Virtual Address 15 Bus Device Func b b Level-4 table offset Level-3 table offset Level-2 table offset Level-1 table offset 11 Page Offset 0 Base Device Assignment Tables Level-4 Page Table Example Device Assignment Table Entry specifying 4-level page table Level-3 Page Table Level-2 Page Table Level-1 Page Table Page

27 VT-d: Translation Caching Architecture supports caching of remapping structures Context Cache: Caches frequently used device-assignment entries IOTLB: Caches frequently used translations (results of page walk) Non-leaf Cache: Caches frequently used page-directory entries When updating VT-d translation structures, software enforces consistency of these caches Architecture supports global, domain-selective, and page-range invalidations of these caches Primary invalidation interface through MMIO registers for synchronous invalidations Extended invalidation interface for queued invalidations

28 VT-x & VT-d Working Together Virtual Machines Virtual Machine Monitor (VMM) Logical Processors VT-x Binary Translation Paravirtualization Page-table Shadowing Physical Memory IO-Device Emulation Interrupt Virtualization DMA Remap VT-d I/O Devices Hardware Virtualization Mechanisms under VMM Control

29 How Intel Virtualization Technology Address Virtualization Challenges Reduced Complexity VT-x removes need for binary translation / paravirtualization Can avoid I/O emulation for direct-mapped I/O devices Improved Functionality 64-bit guest OS support, remove limitations of paravirtualization Can grant Guest OS direct access to modern physical I/O devices Enhanced Reliability and Protection Simplified VMM reduces trusted computing base (TCB) DMA errors logged and reported to software Improved Performance Hardware support reduces address-translation overheads No need for shadow page tables (saves memory)

30 Delivering Intel VT Established Intel Virtualization Technology Specifications for Intel based platforms For the IA-32 Intel Architecture (Jan 2005) VT-x For the Intel Itanium Architecture (Jan 2005) VT-i For Directed I/O Architecture (March 2006) VT-d See Shipping Intel based platforms enabled with Intel VT VT-x: Desktop in 2005, Mobile platforms and Intel Xeon processor based servers and workstations in 2006 VT-i: Later in 2006, Intel Itanium processor based servers VT-d: Intel is enabling VMM vendors with VT-d silicon in 2006

31 Demo: KVM and QEMU

32 CCS 07, Alexandria, VA, Oct 29 Nov 2, 2007 Stealthy Malware Detection Through VMM-based Out-ofthe-Box Semantic View Reconstruction Xuxian Jiang, Xinyuan Wang, Dongyan Xu North Carolina State University George Mason University Purdue University

33 Motivation Internet malware remains a top threat Malware: viruses, worms, rootkits, spyware, bots

34 Motivation Recent Trend on Rootkits Viruses/worms/bots, PUPs, 400% growth 700% growth Q1 of 2005 Source: McAfee Avert Lab Report (April 2006)

35 Existing Defenses (e.g., Anti-Virus Software) Running inside the monitored system Advantages They can see everything (e.g., files, processes, ) Disadvantages Once compromised by advanced stealthy malware, they may not see anything! IE Firefox VirusScan OS Kernel

36 Key observation Existing Defenses Both anti-virus software and vulnerable software are running inside the same system Hard to guarantee tamper-resistance Solution: Out-of-the-box defense IE Firefox VirusScan Virtual Machine OS KernelMonitor (VMM)

37 The Semantic-Gap Challenge VirusScan Semantic Gap Guest OS Virtual Machine Monitor (e.g., VMware, Xen, QEMU) What we can observe? Low-level states Memory pages, disk blocks, Low-level events Privileged instructions, Interrupts, I/O access, What we want to observe? High-level states w/ semantic info. Files, processes, high-level events w/ semantic info. System calls, context switches,

38 Main Contribution VMwatcher: A systematic approach to bridge the semantic gap Reconstructing semantic objects and events from low-level VMM observations IE Firefox Capability I: Out-of-the-box execution of commodity anti-malware software OS Kernel VMwatcher Capability II: Virtual Machine Monitor (VMM) View comparison-based stealthy malware detection

39 VMwatcher: Bridging the Semantic Gap Step 1: Procuring low-level VM states and events Disk blocks, memory pages, registers, Traps, interrupts, VM Introspection Step 2: Reconstructing high-level semantic view Files, directories, processes, and kernel modules, System calls, context switches, Guest View Casting

40 Step 1: VM Introspection Raw VMM Observations Virtual Machines (VMs) VM Disk Image VM Physical Memory VM Hardware State (e.g., registers) VM-related low-level events (e.g., interrupts) VMware Academic Program

all necessary semantic definitions of data

41 Step 2: Guest View Casting VirusScan Cross-view Semantic Gap VMwatcher Guest OS Virtual Machine Monitor (VMM) Disk Key observation: The guest OS already contains all necessary semantic definitions of data structures as well as functionalities to construct the semantic view

Guest View Casting Raw VMM Observations Casted Guest Functions & Data Structures Reconstructed Semantic View VM Disk Image VM Physical Memory Device drivers, file system drivers Memory translation,

42 Guest View Casting Raw VMM Observations Casted Guest Functions & Data Structures Reconstructed Semantic View VM Disk Image VM Physical Memory Device drivers, file system drivers Memory translation, task_struct, mm_struct VM Hardware State (e.g., registers) VM-related low-level events (e.g., interrupts) CR3, MSR_SYSENTER_CS, MSR_SYSENTER_EIP/ESP Event semantics Event-specific arguments Syscalls, Context switches,... Demo clip (3.5mins):

43 Guest View Casting on Memory State (Linux) Process List Process Memory Layout

44 Guest Memory Addressing Traditional memory addressing Given a VA, MMU translates VA to PA OSes used to map with known PA Linux: VA 0xc == PA 0x0 Windows: VA 0x == PA 0x0 VM complicates the translation Emulated Address Translation Guest virtual -> guest physical Reverse Address Translation Guest physical -> host physical VM Introspection

45 Evaluation Effectiveness Cross-view malware detection Exp. I: Cross-view detection on volatile state Exp. II: Cross-view detection on persistent state Exp. III: Cross-view detection on both volatile and persistent state Out-of-the-box execution of commodity anti-malware software Exp. IV: Symantec AntiVirus Exp. V: Windows Defender Performance Difference between internal scanning & external scanning

46 Exp. I: Cross-view detection on volatile memory state Experiment Setup Guest VM: Windows XP (SP2) Windows Fu Rootkit Host OS: Scientific Linux 4.4 VMM: VMware Server Diff VMwatcher view Inside-the-box view

47 Exp. II: Cross-view detection on persistent disk state Experiment Setup Guest VM: A Redhat 7.2-based honeypot Linux SHv4 rootkit Host OS: Windows XP (SP2) VMM: VMware Server Diff VMwatcher view Inside-the-box view

49 Experiment (IV) Experiment Setup Both guest OS and host OS run Windows XP (SP2) VMM: VMware Server Running Symantec AntiVirus Twice Outside Inside Hacker Defender NTRootkit

50 Internal Scanning Result Diff External Scanning Result

51 Performance Internal scanning time vs. external scanning time Comparison of Scanning Time Scanning Time (min:sec) 19:12 14:24 9:36 4:48 0: files Symantec AntiVirus files Micorsoft Window s Defender files Micorsoft Malicious Softw are Removal files Kaspersky Anti-Virus 5.5 F-PROT AntiVirus Internal Scanning Time External Scanning Time files files files McAfee VirsScan Sophos Anti-Virus Internal scanning takes longer to complete!

52 Related Work Enhancing security with virtualization (Livewire[Garfinkel03], IntroVirt[Joshi05], HyperSpector[Kourai05]) Focusing on targeted attacks with specialized IDSes Cross-view detection (Strider GhostBuster[Wang05], RootkitRevealer/ Blacklight/IceSword/ ) Either destroying the volatile state or obtaining two internal views Secure monitors CoPilot[Petroni04], Terra[Garfinkel03], shype[sailer05], SecVisor[Perrig07],TRANGO,

53 Conclusions VMwatcher A systematic approach that bridges the semantic gap and enables two unique malware detection capabilities: Cross-view malware detection Out-of-the-box execution of commodity antimalware software

Intel Virtualization Technology Roadmap and VT-d Support in Xen

Intel Virtualization Technology Roadmap and VT-d Support in Xen Jun Nakajima Intel Open Source Technology Center Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS.