High Performance VM Introspection

Hypervisor memory introspection is a security solution isolated from the protected virtual machine's operating system by leveraging hardware virtualization technologies. It relies on the second-level address translation (SLAT) mechanism, in order to ...

Hypervisor memory introspection is a security solution isolated from the protected virtual machine's operating system by leveraging hardware virtualization technologies. It relies on the second-level address translation (SLAT) mechanism, in order to enforce restrictions on certain memory areas of the protected VM. In some scenarios this can have a high performance impact, especially due to accesses inside the guest paging structures done by the CPU page walker or the OS memory manager. Most of these accesses are not relevant to the HVI logic. This presentation addresses these issues, promoting an innovative approach on filtering the page-table accesses directly from the guest VM. The filtering is done by a small in-guest agent that uses the virtualization exception (#VE) mechanism: relevant accesses are reported to the main HVI module via a hypercall, while the other accesses are discarded with minimal performance impact. We also discuss a method of protecting the in-guest agent from possible malicious guests by isolating it inside a different physical address space.