[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PATCH v9 00/11] acquire_resource size and external IPT monitoring
Combined series (as they are dependent). First, the resource size fixes, and then the external IPT monitoring built on top. Some patches got committed before the feature freeze date last Friday. This is the remainder. Everything is suitably reviewed now, unless anyone has any last minute urgent issues. Therefore, I'd like to request a release exception. Patch 1 is a bugfix, and the last in a long line of fixes to the acquire_resource hypercall. Technically it ought not to need a release ack at this point. The rest of the patches are a feature, originally contributed by CERT.PL for a project they are working on, which got blocked for reasons outside of their control (blocked on my acquire_resource fixes, and the extreme quantity of security work this release cycle). Intel Processor Trace is a debugging/diagnostic feature, which allows for reconstruction of the exact execution path of the target. As implemented here, a monitoring agent can trace execution within the guest. There are two production users of this already. 1) KFX - https://github.com/intel/kernel-fuzzer-for-xen-project This is a project lead by Tamas which is a fuzzer based on Xen, with AFL running in dom0, and backended with introspection and VMFork/reset for injecting data and parallel testing. It uses IPT (this series) to feed the taken-path back to AFL, is far more convenient than recompiling the subject-under-test, and is far faster than using breakpoints for path reconstruction. 2) Drakvuf Sandbox - https://github.com/CERT-Polska/drakvuf-sandbox This project, lead by a team at CERT is an automatic malware-analysis SaaS offering, which will inspect suspicious files and attempt to provoke them to extract their payload, with introspection stepping in once it is fully unpacked, to inspect and classify the malware. Both are very exciting projects, and the addition of IPT support like this helps keep Xen at the forefront of hypervisor introspection technologies. When I've got enough free time to do some paperwork, I'm intending to add IPT as tech-preview (in particular - there are some hardware errata which concern me, and an as-yet uninvestigated exclusion vs LBR as a hardware restriction). It has active downstream users and extensive testing, as well as being fairly isolated in terms of interactions with the rest of Xen, so the changes of a showstopper affecting other features is very slim. Andrew Cooper (1): xen/memory: Fix mapping grant tables with XENMEM_acquire_resource Michał Leszczyński (7): xen/domain: Add vmtrace_size domain creation parameter tools/[lib]xl: Add vmtrace_buf_size parameter xen/memory: Add a vmtrace_buf resource type x86/vmx: Add Intel Processor Trace support xen/domctl: Add XEN_DOMCTL_vmtrace_op tools/libxc: Add xc_vmtrace_* functions tools/misc: Add xen-vmtrace tool Tamas K Lengyel (3): xen/vmtrace: support for VM forks x86/vm_event: Carry the vmtrace buffer position in vm_event x86/vm_event: add response flag to reset vmtrace buffer docs/man/xl.cfg.5.pod.in | 9 ++ tools/golang/xenlight/helpers.gen.go | 2 + tools/golang/xenlight/types.gen.go | 1 + tools/include/libxl.h | 7 ++ tools/include/xenctrl.h | 73 +++++++++++ tools/libs/ctrl/Makefile | 1 + tools/libs/ctrl/xc_vmtrace.c | 128 ++++++++++++++++++++ tools/libs/light/libxl_cpuid.c | 1 + tools/libs/light/libxl_create.c | 1 + tools/libs/light/libxl_types.idl | 4 + tools/misc/.gitignore | 1 + tools/misc/Makefile | 7 ++ tools/misc/xen-cpuid.c | 2 +- tools/misc/xen-vmtrace.c | 166 +++++++++++++++++++++++++ tools/xl/xl_parse.c | 4 + xen/arch/x86/domain.c | 23 ++++ xen/arch/x86/domctl.c | 55 +++++++++ xen/arch/x86/hvm/vmx/vmcs.c | 19 ++- xen/arch/x86/hvm/vmx/vmx.c | 180 +++++++++++++++++++++++++++- xen/arch/x86/mm/mem_sharing.c | 3 + xen/arch/x86/vm_event.c | 10 ++ xen/common/compat/memory.c | 114 ++++++++++++++---- xen/common/domain.c | 64 ++++++++++ xen/common/grant_table.c | 3 + xen/common/memory.c | 153 ++++++++++++++++++----- xen/common/vm_event.c | 3 + xen/include/asm-arm/vm_event.h | 6 + xen/include/asm-x86/cpufeature.h | 1 + xen/include/asm-x86/hvm/hvm.h | 72 +++++++++++ xen/include/asm-x86/hvm/vmx/vmcs.h | 4 + xen/include/asm-x86/msr.h | 32 +++++ xen/include/asm-x86/vm_event.h | 2 + xen/include/public/arch-x86/cpufeatureset.h | 1 + xen/include/public/domctl.h | 38 ++++++ xen/include/public/memory.h | 1 + xen/include/public/vm_event.h | 11 ++ xen/include/xen/sched.h | 6 + xen/xsm/flask/hooks.c | 1 + 38 files changed, 1150 insertions(+), 59 deletions(-) create mode 100644 tools/libs/ctrl/xc_vmtrace.c create mode 100644 tools/misc/xen-vmtrace.c -- 2.11.0
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |