turnstile

Turnstile enforces guest kernel integrity through EPT and NPT write interception for Xen HVM guests.

It uses second level address translation fault handling to protect guest kernel text and read only data. The hypervisor intercepts EPT violations and NPT faults that target protected guest physical address ranges, applies the configured policy and recognizes legitimate kernel self modification patterns.

Components

Turnstile consists of three components:

• A Xen hypervisor patch that implements violation detection and policy enforcement.

• A Dom0 userspace controller that performs guest introspection and configures protected ranges.

• An optional guest kernel module that negotiates explicit write grants through hypercalls for livepatch compatibility.

Violation interception

Write faults against protected guest physical addresses cause a VM exit with the EPT violation or NPT fault reason. The Turnstile hook extracts the faulting GPA, guest RIP, CR3 and instruction bytes before invoking the policy engine and delegating to the standard p2m fault handler.

Implicit detection

Turnstile recognizes legitimate kernel text modifications without explicit hypercall coordination:

• Five byte NOP to call patching at function entry points (0x0f 0x1f 0x44 0x00 0x00 to 0xe8 rel32).

• jump_label modifications that replace NOP instructions with jumps using __jump_table metadata.

Detection correlates faulting addresses with uploaded symbol metadata. Function entry points and jump table entries are extracted from the vmlinux ELF image and adjusted for the KASLR slide, allowing the hypervisor to make implicit grant decisions without modifying the guest.

Explicit grants

For livepatch and other intentional kernel modifications, the guest module issues TURNSTILE_OP_REQUEST_WRITE hypercalls that specify a GPA range and timeout. The hypervisor grants temporary write permission, records the grant and bounds it by a configurable expiry.

KASLR handling

The Dom0 controller detects the KASLR slide by scanning guest physical memory for the startup_64 instruction sequence. It checks 2 MiB aligned addresses between 0x1000000 and 0x40000000, locates the physical base of the kernel text and calculates the runtime slide relative to the vmlinux link address.

Build

Hypervisor

./build-xen-turnstile.sh hypervisor

This requires the standard Xen build dependencies and dev86, which is available from the AUR on Arch Linux. The build script was developed on Arch Linux using i3.

Dom0

cd turnstile-ctl
cargo build --release

Optional disassembly support is provided by iced-x86:

cargo build --release --features disasm

Guest

cd turnstile-guest
make
insmod turnstile_guest.ko

Usage

Protect a guest

turnstile-ctl protect <domid> /path/to/vmlinux

This extracts the kernel layout, detects the KASLR slide, uploads metadata, configures protected ranges and enables the audit policy.

Monitor violations

turnstile-ctl monitor <domid> /path/to/vmlinux --interval-ms 50

This polls the violation ring buffer, resolves addresses to symbols and displays the instruction bytes associated with each fault.

Select a policy

turnstile-ctl policy <domid> enforce
turnstile-ctl policy <domid> audit
turnstile-ctl policy <domid> disabled

Display statistics

turnstile-ctl stats <domid>