The Method About Identification of the Guest OS Process From VMM At Running Time
The Method About Identification of the Guest OS Process From VMM At Running Time
康华 ：主要从事 Linux 操作系统内核、虚拟机、Linux 技术标准、计算机安全、软件测试等领域的研究与开发工作，曾就职 MII-HP 软件实验室 、瞬联软件公司/MOTOROLA，现就职于Lenovo研究院 。其所合写的Linux专栏见http://www.csdn.net/subject/linux/。 如果需要可以联系通过 [email protected] （MSN）联系我.
PRINCIPLE
It’s principle is：VMM take advantage of the timing and information that GOS trapped into VMM while GOS is doing process switch (need access to the privilege register CR3 by process switch routing , which will cause a trap ) to establish and maintain a GOS processes track record (GPTR) vector．GPTR comprise：1．GOS process page directory address (GPPDA) which will be gotten form privilege register CR3 while GOS trapped ；2．GOS process name or id which can be gotten form GOS’s process descriptor or appointed to a unique identify if cannot get descriptor. So that ,we are able to using GPTR vector to identify the current process of GOS form VMM at run-time by comparing GPTR’s GPPDA and current process page table address of GOS caught when GOS doing process switch.
The method of finding GOS’s process descriptor is OS-dependence, for instance , Linux current process descriptor is connected with kernel stack within 2 linked pages ,so we can locate the current process descriptor by analyzing kernel stack pointer( kernel stack pointer stored in SP reigster will be caught by VMM when process switch) ; For windows system , locating current process descriptor is more easy . The current process descriptor can be gotten form PRCB (processor control block), and location of PRCB if fixed per processor
IMPLEMENT SKETCH
1 VMM catch the vmexit result from doing process swich
2 VMM get the page table directory address (GPPDA) of the process to be run. from CR3 register and get the stack top pointer (which may be kernel stack or interrupt stack)from ESP register
3 VMM find out the current process(current process is scheduling out and the process to be run is scheduling in at this vmexit time) descriptor address by parse stack top pointor.
4 VMM find out the current process readable name(GPRID) from process descriptor.
5 VMM record the GPPDA that got last round and GPRID that get this round together as a key/value pair.
6 VMM normal execute process.
Notation
1 Method of locating Linux process descriptor
movl $0xffffe000,%ecx /* or 0xfffffe000 for 8KB kernel stacks */
andl %esp,%ecx
movl (%ecx),p /* p pointe to current process descriptor */
2 process switch