High Performance VM Introspection

on YouTube ↗25m

" summary

Claims a concrete reduction in hypervisor exits by moving page-table filtering into the guest: a tiny, dynamically injected kernel stub uses the #VE virtualization exception to convert many EPT violations into in-guest exceptions, decodes or emulates only the relevant writes (only ~8% of page-table writes are relevant), and switches EPT views via VMFUNC to isolate the stub in a trusted physical address space. Benchmarks on Redstone show up to 3× faster page loads in Chrome.

AI-written summary · about

" chapters (14)

1. 0:00Intro
2. 1:13About Bitdefender
3. 2:09About the Speakers
4. 2:59HOTEL TRANSYLVANIA
5. 6:01APT Lifecycle
6. 7:31APT Dwell Time
7. 8:00Carbanak APT
8. 11:27HVI Crash Course
9. 12:46HVI Deployment Models
10. 16:13Main Performance Limitations
11. 17:22Improving Page-Table Monitoring
12. 21:03Performance Figures
13. 21:42Takeaways
14. 23:10Resources

" related talks

• 32mSeeing Through The Same Lens...Siqi Zhao, Wen Xu, Dawu Gu, Xuhua Ding · 26th USENIX Security Symposium (USENIX Security '17)
• 12mSecurity and Performance in the Delegated User-level VirtualizationJiahao Chen, Haibo Chen, Haibing Guan, Binyu Zang, Zeyu Mi, Dingji Li, Yuxuan Liu · OSDI 2023
• 53mXenpwn: Breaking Paravirtualized DevicesFelix Wilhelm · Black Hat USA 2016
• 14mInside Out: A Paradigm Shift in VM IntrospectionThomas Pasquier, Dufy Teguia, Louis Duval, Teo Pisenti, Kahina Lazri, Daniel Hagimont, Renaud Lachaize, Alain Tchana · 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI '26)
• 18mGuest Memory Protection -- Current Status and FutureIsaku Yamahata · KVM Forum 2020
• 26mHypervisor Based Integrity: Protect Guest Kernel in CloudNing Yang, Forrest Yuan Yu · KVM Forum 2020
• 44mMoRE Shadow Walker: The Progression of TLB-Splitting on x86Jacob I. Torrey · Black Hat USA 2014
• 49mKVM Address Space IsolationAlexandre Chartre · KVM Forum 2020