NetTLP: Physical Memory Introspection


The NetTLP adapter can be considered as a channel to manipulate the host memory from a remote host. So, researchers and developers can implement their memory introspection methods for physical machines on top of LibTLP and IP network stack without special hardware dedicated to the methods (excluding the NetTLP adapter).

An example, process-list

As an example of diverting NetTLP for physical memory introspection, we introduce process-list command. It is very similar to (and inspired from) an example of LibVMI, but our process-list command works for physical machines. The LibTLP repository contains the process-list implementation. So, for trying physical memory introspection, set up a NetTLP environment with getting started first.

After setting up your NetTLP environment, you see the process-list command in libtlp/apps directory.

$ ls libtlp/apps/
Makefile    dma_read	 pgd-walk        psmem                    tlpperf.c   dma_read.c	 pgd-walk.c      psmem.c                  util.h
codedump    dma_write	 process-list	 thread_affinity_apple.h
codedump.c  dma_write.c  process-list.c  tlpperf

The process-list command is executed on the device host. It gathers process information from the adapter host by DMA reads through the NetTLP adapter. As a starting point, it needs file of the target host. So, copy /boot/`uname -r` from the adapter host to the device host. More specifically, the process-list command finds an address of task_struct representing the first process (swapper with PID 0) from the specified and then starts to walk through task_struct structures of the adapter host using DMA reads.

After bringing the file to the device host, we can execute the process-list command as with the dma_read command explained at the Example applications page.

$ ./process-list -r -b 1b:00 -s
PhyAddr             PID STAT COMMAND
0x00000003411740      0 R    swapper/0
0x0000087c331dc0      1 S    systemd
0x00000874961dc0    656 S    lvmetad
0x000008748cbb80   1046 S    irqbalance
0x000008748c8000   1048 S    atd
0x000008748cd940   1053 S    lxcfs
0x0000086ac71dc0   1071 S    rsyslogd
0x0000086cd05940   1086 S    accounts-daemon
0x00000869300000   1089 S    snapd
0x00000869301dc0   1097 S    networkd-dispat
0x00000869305940   1098 S    dbus-daemon
0x00000871255940   1143 S    systemd-logind
0x00000877538000   1152 S    cron
0x00000877539dc0   1156 S    sshd
0x0000082a548000  19529 S    sshd
0x00000876811dc0  19648 S    sshd
0x00000874a4bb80  19649 S    zsh
0x0000087753d940   1206 S    polkitd
0x00000869521dc0   1261 S    agetty
0x00000878109dc0   1539 S    unattended-upgr
0x000007a8498000  21461 S    systemd-udevd
0x000008746e8000  30382 S    systemd-network
0x00000878498000  30417 S    systemd-resolve
0x0000087849d940  30440 S    systemd-timesyn
0x00000878499dc0  30468 S    systemd-journal
0x0000087769d940  19531 S    systemd
0x00000874be3b80  19532 S    (sd-pam)
0x0000087c335940      2 S    kthreadd
0x0000087c333b80      3 D    rcu_gp
0x0000087c330000      4 D    rcu_par_gp
0x0000087c353b80      6 D    kworker/0:0H
0x0000087c351dc0      8 D    mm_percpu_wq
0x0000087c399dc0      9 S    ksoftirqd/0
0x0000087c39d940     10 D    rcu_sched

... snipped ...