KVM hook for code integrity checking
Dear KVM developers,
I'm currently working on an open source security patch to use KVM to implement code verification on a guest VM in runtime. Thus, it would be very helpful if someone can point to me the right function or place to look at for adding 2 hooks into the KVM paging code to:
1. Detect a new guest page (which I assume will imply a new pte and imply a new spte).
Currently, I'm considering putting a hook in the function mmu_set_spte(), but may there is a better place.
This hook will be used as the main entry point into the code verification function
2. Detect a write fault to a read-only spte (eg. for the case of updating the dirty bit back to the guest pte)
Unfortunately, I'm unable to find an appropriate place where this actually takes place after reading the code many times.
This hook will be used to prevent a secondary "peek" page from modifying an existing verified code page.
I will gladly contribute my work(my phd thesis) to the list once it is workable, if anyone find it useful.
Thank you in advance.
Regards,
Chun Hui
Quoted 7 lines · Suen Chun Hui
Dear KVM developers,
I'm currently working on an open source security patch to use KVM to implement code verification on a guest VM in runtime. Thus, it would be very helpful if someone can point to me the right function or place to look at for adding 2 hooks into the KVM paging code to:
Quoted 7 lines
1. Detect a new guest page (which I assume will imply a new pte and imply a new spte).
Currently, I'm considering putting a hook in the functionmmu_set_spte(), but may there is a better place.
This hook will be used as the main entry point into the code verification function
This is in general not possible. Hosts with npt or ept will not see new guest ptes.
It could be done with physical pages, but you'll have no way of knowing if the pages are used in userspace, the kernel, or both.
Quoted 7 lines
2. Detect a write fault to a read-only spte (eg. for the case of updating the dirty bit back to the guest pte)
Unfortunately, I'm unable to find an appropriate place where this actually takes place after reading the code many times.
This hook will be used to prevent a secondary "peek" page from modifying an existing verified code page.
set_spte() or mmu_set_spte() may work.
Signature · 1 line
error compiling committee.c: too many arguments to function
Hi,
Thanks for the reply.
Quoted 16 lines · Avi Kivity
Quoted 7 lines · Suen Chun Hui
Dear KVM developers,
I'm currently working on an open source security patch to use KVM to implement code verification on a guest VM in runtime. Thus, it would be very helpful if someone can point to me the right function or place to look at for adding 2 hooks into the KVM paging code to:
Quoted 7 lines
1. Detect a new guest page (which I assume will imply a new pte and imply a new spte).
Currently, I'm considering putting a hook in the functionmmu_set_spte(), but may there is a better place.
This hook will be used as the main entry point into the code verification function
Quoted 3 lines
This is in general not possible. Hosts with npt or ept will not see new guest ptes.
Yes, I was only considering the case of using shadow paging. Would this be possible then, since the walker would have to parse gpte anyway?
Quoted 13 lines
It could be done with physical pages, but you'll have no way of knowing if the pages are used in userspace, the kernel, or both.
Quoted 7 lines
2. Detect a write fault to a read-only spte (eg. for the case of updating the dirty bit back to the guest pte)
Unfortunately, I'm unable to find an appropriate place where this actually takes place after reading the code many times.
This hook will be used to prevent a secondary "peek" page from modifying an existing verified code page.
set_spte()ormmu_set_spte()may work.
Quoted 23 lines · Suen Chun Hui
Hi,
Thanks for the reply.
Quoted 17 lines · Avi Kivity
Quoted 15 lines · Suen Chun Hui
Dear KVM developers,
I'm currently working on an open source security patch to use KVM to implement code verification on a guest VM in runtime. Thus, it would be very helpful if someone can point to me the right function or place to look at for adding 2 hooks into the KVM paging code to:
1. Detect a new guest page (which I assume will imply a new pte and imply a new spte).
Currently, I'm considering putting a hook in the functionmmu_set_spte(), but may there is a better place.
This hook will be used as the main entry point into the code verification function
Quoted 7 lines
Quoted 4 lines
This is in general not possible. Hosts with npt or ept will not see new guest ptes.
Yes, I was only considering the case of using shadow paging. Would this be possible then, since the walker would have to parse gpte anyway?
It's possible, but it's not a good idea to require shadow paging. It's slow and doesn't scale well.
Signature · 1 line
error compiling committee.c: too many arguments to function