Re: KVM hook for code integrity checking

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 05/06/2010 07:51 AM, Suen Chun Hui wrote:
Hi,

Thanks for the reply.

On 05/05/2010 11:05 AM, Avi Kivity wrote:
On 04/30/2010 05:53 PM, Suen Chun Hui wrote:
Dear KVM developers,

I'm currently working on an open source security patch to use KVM to
implement code verification on a guest VM in runtime. Thus, it would be
very helpful if someone can point to me the right function or place to
look at for adding 2 hooks into the KVM paging code to:

1. Detect a new guest page (which I assume will imply a new pte and
imply a new spte).
Currently, I'm considering putting a hook in the function
mmu_set_spte(), but may there is a better place.
This hook will be used as the main entry point into the code
verification function

This is in general not possible.  Hosts with npt or ept will not see
new guest ptes.

Yes, I was only considering the case of using shadow paging. Would this
be possible then, since the walker would have to parse gpte anyway?

It's possible, but it's not a good idea to require shadow paging. It's slow and doesn't scale well.

--
error compiling committee.c: too many arguments to function

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux