Search papers, labs, and topics across Lattice.
This paper introduces RealmEye, the first virtual machine introspection (VMI) system designed specifically for Arm CCA Realm VMs, addressing the critical need for external inspection of confidential VMs (CVMs) that are otherwise isolated from their owners. By implementing introspection logic within the Realm Management Monitor (RMM) at R-EL2, RealmEye maintains hardware-enforced separation between the introspection monitor and the monitored VM, ensuring that no agents run inside the Realm and the Realm remains unmodified. The system effectively detects malicious activities such as process hiding and syscall-table hooking, while enabling interoperability with existing VMI tools without modification.
RealmEye reveals that even in highly isolated environments, effective introspection can be achieved without compromising the security of confidential VMs.
Confidential VMs (CVMs) have become the dominant substrate for sensitive cloud workloads, from financial services to privacy-preserving AI inference. The hardware isolation that protects these CVMs from a malicious cloud also blinds their owners to what runs inside them: kernel rootkits planted via network or supply-chain attacks can hide processes, tamper with kernel data, and exfiltrate model weights under the cover of the same isolation that defends the VM. Tenants therefore need to inspect a running CVM from outside, yet classical VM introspection (VMI) presupposes a trusted Hypervisor, which CVMs exclude from the TCB. The state-of-the-art CVM-VMI system, 00SEVen, restores introspection on AMD SEV-SNP via an in-VM agent at a privileged tier (VMPL0), a mechanism that does not exist on Arm CCA, leaving Realm VMs without any introspection solution. We present RealmEye, the first VMI system for Arm CCA Realm VMs. RealmEye places the entire introspection logic inside the Realm Management Monitor (RMM) at R-EL2, achieving hardware-enforced separation between the monitor and the monitored VM: no agent runs inside the Realm, and the Realm remains unmodified. RealmEye reads Realm memory and registers, suspends the VM for consistent snapshots, and traps page-level accesses, without relying on any in-VM interface. A periodic, self-driven trigger mode keeps scan timing internal to the RMM, preventing the Hypervisor from colluding with in-Realm rootkits. Results are returned to the remote owner over a hardware-attested channel, and a CCA driver backend lets existing tools such as LibVMI and DRAKVUF interoperate with RealmEye unchanged. On the Arm FVP, RealmEye detects process hiding and syscall-table hooking by Diamorphine, and its in-RMM cost is linearly predictable from primitive invocation counts.
