[RFC PATCH v5 00/20] VM introspection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This patch series proposes a VM introspection subsystem for KVM (KVMi).

The previous RFC can be read here: https://marc.info/?l=kvm&m=151362403331566

This iteration brings, mostly:
  - an improved remote mapping (moved to the mm/ tree)
  - single-step support for #PF events and as an workaround to unimplemented
    instructions from the x86 emulator that may need to be handled on EPT
    violations VMEXITS
  - a new ioctl to allow the introspection tool to remove its hooks from
    guest before it is suspended or live migrated
  - more bugfixes and a lot of stability

Still not implemented yet (even if some are documented) are virtualized
exceptions, EPT views and SPP (Sub Page Protection).

We're still looking forward to add kvm unit tests for this VM
introspection system now that we've integrated it in our products and
in our internal tests framework.

Changes since v4:
  - move the new and improved remote mapping code to the mm/ tree
  - add two VM events (in addition to vCPU events) - KVMI_EVENT_CREATE_VCPU
        and KVMI_EVENT_UNHOOK - controlled by KVMI_CONTROL_VM_EVENTS
  - add KVM_INTROSPECTION_UNHOOK ioctl to support suspend, snapshot
        and live migration
  - use KVMI_PAUSE_ALL_VCPUS instead of KVMI_PAUSE_VCPU (temporarily)
  - fix the reinjection of guest breakpoints
  - add single-stepping
  - extend KVMI_EVENT_PF to support single-stepping and to reduce
        the number of events on REP prefixed instructions
  - allow the guest to update A/D bits when the page tables are tracked
        (write protected)
  - extend page tracking to pass the gva in addition to gpa
  - make small changes to the wire protocol (error codes, padding, names)
  - extend struct kvm_introspection (ioctl KVM_INTROSPECTION) with the guest's uuid
  - change the maximum message size to 4K (from 64K)
  - fix more bugs

Changes since v3:
  - move the accept/handshake worker to QEMU
  - extend and use the 'page_track' infrastructure to intercept page
    accesses during emulation
  - remove the 0x40000000-0x40001fff range from monitored MSR-s
  - make small changes to the wire protocol (error codes, padding, names)
  - simplify KVMI_PAUSE_VCPU
  - add new commands: KVMI_GET_MAP_TOKEN, KVMI_GET_XSAVE
  - add pat to KVMI_EVENT
  - document KVM_HC_MEM_MAP and KVM_HC_MEM_UNMAP hypercalls

Changes since v2:
  - make small changes to the wire protocol (eg. use kvmi_error_code
    with every command reply, a few renames, etc.)
  - removed '_x86' from x86 specific structure names. Architecture
    specific structures will have the same name.
  - drop KVMI_GET_MTRR_TYPE and KVMI_GET_MTRRS (use KVMI_SET_REGISTERS)
  - drop KVMI_EVENT_ACTION_SET_REGS (use KVMI_SET_REGISTERS)
  - remove KVMI_MAP_PHYSICAL_PAGE_TO_GUEST and KVMI_UNMAP_PHYSICAL_PAGE_FROM_GUEST
    (to be replaced by a token+hypercall pair)
  - extend KVMI_GET_VERSION with allowed commnd/event masks
  - replace KVMI_PAUSE_GUEST/KVMI_UNPAUSE_GUEST with KVMI_PAUSE_VCPU
  - replace KVMI_SHUTDOWN_GUEST with KVMI_EVENT_ACTION_CRASH
  - replace KVMI_GET_XSAVE_INFO with KVMI_GET_CPUID
  - merge KVMI_INJECT_PAGE_FAULT and KVMI_INJECT_BREAKPOINT
    in KVMI_INJECT_EXCEPTION
  - replace event reply flags with ALLOW/SKIP/RETRY/CRASH actions
  - make KVMI_SET_REGISTERS work with vCPU events only
  - add EPT view support in KVMI_GET_PAGE_ACCESS/KVMI_SET_PAGE_ACCESS
  - add support for multiple pages in KVMI_GET_PAGE_ACCESS/KVMI_SET_PAGE_ACCESS
  - add (back) KVMI_READ_PHYSICAL/KVMI_WRITE_PHYSICAL
  - add KVMI_CONTROL_VE
  - add cstar to KVMI_EVENT
  - add new events: KVMI_EVENT_VCPU_PAUSED, KVMI_EVENT_CREATE_VCPU, 
    KVMI_EVENT_DESCRIPTOR_ACCESS, KVMI_EVENT_SINGLESTEP
  - add new sections: "Introspection capabilities", "Live migrations",
    "Guest snapshots with memory", "Memory access safety"
  - document the hypercall used by the KVMI_EVENT_HYPERCALL command
    (was KVMI_EVENT_USER_CALL)

Changes since v1:
  - add documentation and ABI [Paolo, Jan]
  - drop all the other patches for now [Paolo]
  - remove KVMI_GET_GUESTS, KVMI_EVENT_GUEST_ON, KVMI_EVENT_GUEST_OFF,
    and let libvirt/qemu handle this [Stefan, Paolo]
  - change the license from LGPL to GPL [Jan]
  - remove KVMI_READ_PHYSICAL and KVMI_WRITE_PHYSICAL (not used anymore)
  - make the interface a little more consistent


Adalbert Lazăr (8):
  kvm: document the VM introspection ioctl-s and capability
  kvm: extend to accomodate the VM introspection subsystem
  kvm: add the VM introspection subsystem
  kvm: x86: hook in kvmi_msr_event()
  kvm: x86: hook in kvmi_breakpoint_event()
  kvm: x86: hook in kvmi_cr_event()
  kvm: x86: hook in kvmi_xsetbv_event()
  kvm: x86: handle the introspection hypercalls

Mihai DONTU (8):
  kvm: document the VM introspection API
  kvm: document the VM introspection hypercalls
  kvm: add the VM introspection API/ABI headers
  kvm: x86: do not unconditionally patch the hypercall instruction
    during emulation
  kvm: page track: add support for preread, prewrite and preexec
  kvm: x86: hook in the VM introspection subsystem
  kvm: x86: hook the single-step events
  kvm: x86: hook in kvmi_trap_event()

Mircea Cîrjaliu (2):
  mm: add support for remote mapping
  add memory map/unmap support for VM introspection on the guest side

Nicușor Cîțu (2):
  kvm: x86: add tracepoints for interrupt and exception injections
  kvm: x86: intercept accesses to IDTR, GDTR, LDTR and TR

 Documentation/virtual/kvm/api.txt        |   59 +
 Documentation/virtual/kvm/hypercalls.txt |   68 +-
 Documentation/virtual/kvm/kvmi.rst       | 1351 +++++++++++++
 arch/x86/Kconfig                         |    9 +
 arch/x86/include/asm/kvm_emulate.h       |    1 +
 arch/x86/include/asm/kvm_host.h          |   21 +-
 arch/x86/include/asm/kvm_page_track.h    |   33 +-
 arch/x86/include/asm/kvmi_guest.h        |   10 +
 arch/x86/include/asm/vmx.h               |    2 +
 arch/x86/include/uapi/asm/kvmi.h         |  234 +++
 arch/x86/kernel/Makefile                 |    1 +
 arch/x86/kernel/kvmi_mem_guest.c         |   26 +
 arch/x86/kvm/Kconfig                     |    6 +
 arch/x86/kvm/Makefile                    |    1 +
 arch/x86/kvm/emulate.c                   |    9 +-
 arch/x86/kvm/mmu.c                       |  168 +-
 arch/x86/kvm/mmu.h                       |    4 +
 arch/x86/kvm/page_track.c                |  147 +-
 arch/x86/kvm/svm.c                       |  133 +-
 arch/x86/kvm/trace.h                     |  118 +-
 arch/x86/kvm/vmx.c                       |  158 +-
 arch/x86/kvm/x86.c                       |  290 ++-
 drivers/gpu/drm/i915/gvt/kvmgt.c         |    2 +-
 include/linux/kvm_host.h                 |   15 +
 include/linux/kvmi.h                     |   86 +
 include/linux/mm.h                       |   13 +
 include/linux/rmap.h                     |    1 +
 include/linux/swait.h                    |   11 +
 include/trace/events/kvmi.h              |  665 +++++++
 include/uapi/linux/kvm.h                 |   12 +
 include/uapi/linux/kvm_para.h            |   11 +-
 include/uapi/linux/kvmi.h                |  192 ++
 kernel/signal.c                          |    1 +
 mm/Kconfig                               |    9 +
 mm/Makefile                              |    1 +
 mm/gup.c                                 |    1 +
 mm/huge_memory.c                         |    1 +
 mm/internal.h                            |    5 -
 mm/mempolicy.c                           |    1 +
 mm/mmap.c                                |    1 +
 mm/mmu_notifier.c                        |    1 +
 mm/pgtable-generic.c                     |    1 +
 mm/remote_mapping.c                      | 1438 ++++++++++++++
 mm/rmap.c                                |   39 +-
 mm/swapfile.c                            |    1 +
 virt/kvm/kvm_main.c                      |   34 +-
 virt/kvm/kvmi.c                          | 2246 ++++++++++++++++++++++
 virt/kvm/kvmi_int.h                      |  202 ++
 virt/kvm/kvmi_mem.c                      |  330 ++++
 virt/kvm/kvmi_mem_guest.c                |  364 ++++
 virt/kvm/kvmi_msg.c                      | 1278 ++++++++++++
 51 files changed, 9651 insertions(+), 160 deletions(-)
 create mode 100644 Documentation/virtual/kvm/kvmi.rst
 create mode 100644 arch/x86/include/asm/kvmi_guest.h
 create mode 100644 arch/x86/include/uapi/asm/kvmi.h
 create mode 100644 arch/x86/kernel/kvmi_mem_guest.c
 create mode 100644 include/linux/kvmi.h
 create mode 100644 include/trace/events/kvmi.h
 create mode 100644 include/uapi/linux/kvmi.h
 create mode 100644 mm/remote_mapping.c
 create mode 100644 virt/kvm/kvmi.c
 create mode 100644 virt/kvm/kvmi_int.h
 create mode 100644 virt/kvm/kvmi_mem.c
 create mode 100644 virt/kvm/kvmi_mem_guest.c
 create mode 100644 virt/kvm/kvmi_msg.c




[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux