[RFC PATCH 00/19] Guest introspection

[Adalbert Lazar <alazar@bitdefender.com>]

This patch series proposes an interface that will allow a guest
introspection tool to monitor and control other guests, in order to
protect them against different forms of exploits. This type of interface
is already present in the XEN hypervisor.

With the current implementation, the introspection tool connects to
the KVMi (the introspection subsystem from KVM) using a vsock socket,
establishes a main communication channel, used for a few messages
(KVMI_EVENT_GUEST_ON, KVMI_EVENT_GUEST_OFF, KVMI_GET_GUESTS and
KVMI_GET_VERSION).

Every KVMI_EVENT_GUEST_ON notification, makes the introspection tool
establish a new connection, used to monitor and control that guest.

In order to control the guests, we found that the following list
of introspection commands/events is required:

Commands - messages sent from introspection tool to KVMi
========

- KVMI_GET_GUEST_INFO

	Get the number of online VCPUs and the TSC speed.

- KVMI_PAUSE_GUEST, KVMI_UNPAUSE_GUEST

	Pause/unpause all VCPUs.

- KVMI_SHUTDOWN_GUEST

- KVMI_GET_REGISTERS

	Get general purpose, special and a small subset of MSRs
	(the ones controlling the syscall behaviour).

- KVMI_SET_REGISTERS

	Set the general purpose registers.

- KVMI_GET_MTRR_TYPE

	Get the guest memory type for a specific physical address.

- KVMI_GET_MTRRS

	Get MSR_IA32_CR_PAT, MSR_MTRRcap and MSR_MTRRdefType.

- KVMI_GET_XSAVE_INFO

	Get vcpu->arch.guest_xstate_size.

- KVMI_GET_PAGE_ACCESS, KVMI_SET_PAGE_ACCESS

	Get/set the spte flags (rwx - present, write & user).

- KVMI_INJECT_PAGE_FAULT, KVMI_INJECT_BREAKPOINT

	Used to instruct the OS to do a page in

- KVMI_READ_PHYSICAL, KVMI_WRITE_PHYSICAL

- KVMI_MAP_PHYSICAL_PAGE_TO_SVA, KVMI_UNMAP_PHYSICAL_PAGE_FROM_SVA

	A faster alternative to read/write messages (above).

- KVMI_EVENT_CONTROL

	Enable event reports (see the event list bellow).

- KVMI_CR_CONTROL, KVMI_MSR_CONTROL

	Filter VCPUs events regarding CR and MSR registers
	(if enabled with KVMI_EVENT_CONTROL).
	
Events - messages sent from KVMi to introspection tool
======

- KVMI_EVENT_GUEST_ON, KVMI_EVENT_GUEST_OFF

	Send the guest UUID.
	On KVMI_EVENT_GUEST_ON, the introspection tool connects back with the UUID,
	in order to establish a control channel for this guest.

- KVMI_EVENT_VCPU

	This message is used to send one of the following events (if
	enabled with KVMI_EVENT_CONTROL - see above), together with
	the registers (see KVMI_GET_REGISTERS). The introspection tool
	can reply with the KVMI_EVENT_SET_REGS flag set and provide new
	values for the registers, as with the KVMI_SET_REGISTERS command.
	
	- KVMI_EVENT_CR

	  A CR register was modified. If the event reporting for this
	  specific CR was enabled with KVMI_CR_CONTROL, send a message to
	  the introspection tool with the CR number, the old value, the
	  new value, and wait for a reply with one or more actions/flags:

	  + KVMI_EVENT_ALLOW    (allow the new value to be set)
	  + KVMI_EVENT_SET_REGS (override the registers)

	  otherwise, block this modification.

	- KVMI_EVENT_MSR

	  Similar with KVMI_EVENT_CR. Filtered with KVMI_MSR_CONTROL.

	- KVMI_EVENT_XSETBV

	  An extended control register was modified. Send the value.
	  The introspection tool can reply with KVMI_EVENT_SET_REGS.

	- KVMI_EVENT_BREAKPOINT

	  A breakpoint was reached. Send the guest address.
	  The introspection tool can reply with KVMI_EVENT_SET_REGS
	  and KVMI_EVENT_ALLOW.

	- KVMI_EVENT_USER_CALL

	  User hypercall.
	  The introspection tool can reply with KVMI_EVENT_SET_REGS.

	- KVMI_EVENT_TRAP

	  A trap will be delivered to the guest (#PF, INT3 etc.).
	  The introspection tool can reply with KVMI_EVENT_SET_REGS.

	- KVMI_EVENT_PAGE_FAULT

	  A hypervisor page fault was encountered.
	  The introspection tool can reply with:
	  + KVMI_EVENT_ALLOW (otherwise EMULATE_FAIL will be returned)
	  + KVMI_EVENT_NOEMU (EMULATE_DONE)
	  + KVMI_EVENT_SET_REGS
	  + KVMI_EVENT_SET_CTX (change the emulation context)

The control channels are handled by workqueue jobs, receiving messages
from the introspection tool and signaling the proper VCPU threads to
act on the message.

Currently, all the commands will pause/unpause the guest, but we will like
to avoid this when possible.

This patch series is not complete. Your input would be greatly appreciated.


Adalbert Lazar (2):
  kvm: Add the introspection subsystem
  kvm: x86: Handle KVM_REQ_INTROSPECTION

Mihai Dontu (17):
  kvm: x86: mmu: Add kvm_mmu_get_spte() and kvm_mmu_set_spte()
  kvm: x86: Add kvm_arch_vcpu_set_regs()
  mm: Add vm_replace_page()
  kvm: Add kvm_enum()
  kvm: Add uuid member in struct kvm + support for KVM_CAP_VM_UUID
  kvm: Add kvm_vm_shutdown()
  kvm: x86: Add kvm_arch_msr_intercept()
  kvm: Hook in kvmi on VM on/off events
  kvm: vmx: Hook in kvmi_page_fault()
  kvm: x86: Hook in kvmi_breakpoint_event()
  kvm: x86: Hook in kvmi_trap_event()
  kvm: x86: Hook in kvmi_cr_event()
  kvm: x86: Hook in kvmi_xsetbv_event()
  kvm: x86: Hook in kvmi_msr_event()
  kvm: x86: Change the emulation context
  kvm: x86: Hook in kvmi_vmcall_event()
  kvm: x86: Set the new spte flags before entering the guest

 arch/x86/include/asm/kvm_host.h |   11 +-
 arch/x86/kvm/Kconfig            |    2 +
 arch/x86/kvm/Makefile           |    1 +
 arch/x86/kvm/mmu.c              |  126 ++-
 arch/x86/kvm/mmu.h              |    3 +
 arch/x86/kvm/svm.c              |   10 +
 arch/x86/kvm/vmx.c              |   79 +-
 arch/x86/kvm/x86.c              |  148 ++-
 include/linux/kvm_host.h        |   36 +
 include/linux/mm.h              |    1 +
 include/uapi/linux/kvm.h        |    2 +
 include/uapi/linux/kvm_para.h   |    4 +
 include/uapi/linux/kvmi.h       |  263 +++++
 mm/memory.c                     |   69 ++
 virt/kvm/kvm_main.c             |   81 ++
 virt/kvm/kvmi.c                 | 2252 +++++++++++++++++++++++++++++++++++++++
 virt/kvm/kvmi.h                 |   42 +
 virt/kvm/kvmi_socket.c          |  412 +++++++
 virt/kvm/kvmi_socket.h          |   33 +
 19 files changed, 3566 insertions(+), 9 deletions(-)
 create mode 100644 include/uapi/linux/kvmi.h
 create mode 100644 virt/kvm/kvmi.c
 create mode 100644 virt/kvm/kvmi.h
 create mode 100644 virt/kvm/kvmi_socket.c
 create mode 100644 virt/kvm/kvmi_socket.h

-- 
2.12.2