RealmEye: Virtual Machine Introspection for Arm CCA Realm VMs

• URL: http://arxiv.org/abs/2608.12822v1
• Date: Thu, 13 Aug 2026 04:53:49 GMT
• Title: RealmEye: Virtual Machine Introspection for Arm CCA Realm VMs
• Abstract summary: We present RealmEye, the first VMI system for Arm CCA Realm.<n> RealmEye reads Realm memory and registers, suspends the VM for consistent snapshots, and traps page-level accesses.<n>Results are returned to the remote owner over a hardware-at-tested channel.
• Score: 7.862662747901769
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Confidential VMs (CVMs) have become the dominant substrate for sensitive cloud workloads, from financial services to privacy-preserving AI inference. The hardware isolation that protects these CVMs from a malicious cloud also blinds their owners to what runs inside them: kernel rootkits planted via network or supply-chain attacks can hide processes, tamper with kernel data, and exfiltrate model weights under the cover of the same isolation that defends the VM. Tenants therefore need to inspect a running CVM from outside, yet classical VM introspection (VMI) presupposes a trusted Hypervisor, which CVMs exclude from the TCB. The state-of-the-art CVM-VMI system, 00SEVen, restores introspection on AMD SEV-SNP via an in-VM agent at a privileged tier (VMPL0), a mechanism that does not exist on Arm CCA, leaving Realm VMs without any introspection solution. We present RealmEye, the first VMI system for Arm CCA Realm VMs. RealmEye places the entire introspection logic inside the Realm Management Monitor (RMM) at R-EL2, achieving hardware-enforced separation between the monitor and the monitored VM: no agent runs inside the Realm, and the Realm remains unmodified. RealmEye reads Realm memory and registers, suspends the VM for consistent snapshots, and traps page-level accesses, without relying on any in-VM interface. A periodic, self-driven trigger mode keeps scan timing internal to the RMM, preventing the Hypervisor from colluding with in-Realm rootkits. Results are returned to the remote owner over a hardware-attested channel, and a CCA driver backend lets existing tools such as LibVMI and DRAKVUF interoperate with RealmEye unchanged. On the Arm FVP, RealmEye detects process hiding and syscall-table hooking by Diamorphine, and its in-RMM cost is linearly predictable from primitive invocation counts.

Related papers

• Show-Harness: Just a VLM Agent Can Play Robots [53.80887083886227]
  Embodied vision-language models (VLMs) exhibit broad intelligence about the world, yet translating this intelligence into robot control remains challenging.<n>We present Show-Harness, an Embodied Harness that enablesVLMs to "play" robots through a compact semantic interface linking intent to action.<n>We further develop GUMI, which extends the same semantic action space to GUI-based demonstration collection, allowing humans and agents to "play" robots across embodiments without specialized teleoperation hardware.
  arXiv  Detail & Related papers  (2026-09-09T17:53:38Z)
• EventVLA: Event-Driven Visual Evidence Memory for Long-Horizon Vision-Language-Action Policies [68.812675280427]
  EventVLA is an end-to-end framework founded on the concept of sparse visual evidence memory.<n>KEM directly predicts future probabilities from the VLA's latent embeddings to autonomously capture and store sparse, task-critical visual events.<n>We propose RoboTwin-MeM, a diagnostic benchmark designed to evaluate non-Markovian manipulation tasks with interactive visual evidence.
  arXiv  Detail & Related papers  (2026-06-18T11:11:37Z)
• STAMP: Training Explicit Memory for Mobile GUI Agents in Controllable and Scalable Virtual Environments [63.39393178045112]
  Mobile agents excel at immediate reactive control but frequently fail in realistic, longhorizon tasks that require memory.<n>We present STAMP, a framework that trains explicit memory in mobile agents through controllable virtual environments.<n>The resulting StampGUI agent sets a new high watermark on our Memory-World benchmark, demonstrating exceptional memory accuracy and task resilience.
  arXiv  Detail & Related papers  (2026-05-28T04:00:13Z)
• Sentinel-VLA: A Metacognitive VLA Model with Active Status Monitoring for Dynamic Reasoning and Error Recovery [62.75419724651416]
  We introduce textbfSentinel-VLA, a metacognitive VLA model equipped with an active sentinel'' module to monitor real-time execution status.<n>All training data is automatically generated and annotated through our designed pipeline.<n>Real-world experiments demonstrate that Sentinel-VLA boosts the task success rate by over 30% compared to the SOTA model, PI0.
  arXiv  Detail & Related papers  (2026-05-02T02:10:54Z)
• pokiSEC: A Multi-Architecture, Containerized Ephemeral Malware Detonation Sandbox [41.99844472131922]
  pokiSEC is a lightweight, ephemeral malware detonation sandbox inside a Docker container.<n> pokiSEC integrates QEMU with hardware acceleration (KVM when available) and exposes a browser-based workflow.<n>We validate pokiSEC on Apple Silicon and Ubuntu (AMD64)
  arXiv  Detail & Related papers  (2025-12-24T00:38:40Z)
• Proof of Cloud: Data Center Execution Assurance for Confidential VMs [3.3382699707745522]
  Data Center Execution Assurance (DCEA) is a design generating "Proofs of Cloud"<n>DCEA binds a CVM to its underlying platform using vTPM-anchored measurements, ensuring CVM launch evidence and TPM quotes refer to the same physical chassis.<n>Our approach applies to CVMs accessing vTPMs and running on top of software stacks fully controlled by the cloud provider.
  arXiv  Detail & Related papers  (2025-10-14T13:01:48Z)
• MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agents [60.92962583528122]
  Recent advances in operating system (OS) agents have enabled vision-language models (VLMs) to directly control a user's computer.<n>We uncover a novel attack vector against these OS agents: Malicious Image Patches (MIPs)<n>MIPs adversarially perturbed screen regions that, when captured by an OS agent, induce it to perform harmful actions by exploiting specific APIs.
  arXiv  Detail & Related papers  (2025-03-13T18:59:12Z)
• Devlore: Extending Arm CCA to Integrated Devices A Journey Beyond Memory to Interrupt Isolation [10.221747752230131]
  Arm Confidential Computing Architecture executes sensitive computation in an abstraction called realm. CCA does not allow integrated devices on the platform to access realm. We present Devlore which allows realm to directly access integrated peripherals.
  arXiv  Detail & Related papers  (2024-08-11T17:33:48Z)
• SNPGuard: Remote Attestation of SEV-SNP VMs Using Open Source Tools [3.7752830020595796]
  Cloud computing is a ubiquitous solution to handle today's complex computing demands. VM-based Trusted Execution Environments (TEEs) are a promising solution to solve this issue. They provide strong isolation guarantees to lock out the cloud service provider.
  arXiv  Detail & Related papers  (2024-06-03T10:48:30Z)
• WeSee: Using Malicious #VC Interrupts to Break AMD SEV-SNP [2.8436446946726557]
  AMD SEV-SNP offers VM-level trusted execution environments (TEEs) to protect sensitive cloud workloads. WeSee attack injects malicious #VC into a victim VM's CPU to compromise the security guarantees of AMD SEV-SNP. Case-studies demonstrate that WeSee can leak sensitive VM information (kTLS keys for NGINX), corrupt kernel data (firewall rules), and inject arbitrary code.
  arXiv  Detail & Related papers  (2024-04-04T15:30:13Z)
• Heckler: Breaking Confidential VMs with Malicious Interrupts [2.650561978417805]
  Heckler is a new attack wherein the hypervisor injects malicious non-timer interrupts to break the confidentiality and integrity of CVMs. With AMD SEV-SNP and Intel TDX, we demonstrate Heckler on OpenSSH and to bypass authentication.
  arXiv  Detail & Related papers  (2024-04-04T11:37:59Z)
• VMAgent: Scheduling Simulator for Reinforcement Learning [44.026076801936874]
  A novel simulator called VMAgent is introduced to help RL researchers better explore new methods. VMAgent is inspired by practical virtual machine (VM) scheduling tasks. From the VM scheduling perspective, VMAgent also helps to explore better learning-based scheduling solutions.
  arXiv  Detail & Related papers  (2021-12-09T09:18:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.