From mboxrd@z Thu Jan 1 00:00:00 1970 From: Suen Chun Hui Subject: KVM hook for code integrity checking Date: Fri, 30 Apr 2010 16:53:57 +0200 Message-ID: <4BDAEF05.1030507@tum.de> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit To: kvm@vger.kernel.org Return-path: Received: from mailrelay2.lrz-muenchen.de ([129.187.254.102]:44514 "EHLO mailrelay2.lrz-muenchen.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933091Ab0D3Sn5 (ORCPT ); Fri, 30 Apr 2010 14:43:57 -0400 Received: from [129.187.105.6] ([129.187.105.6] [129.187.105.6]) by mailout.lrz-muenchen.de with ESMTP for kvm@vger.kernel.org; Fri, 30 Apr 2010 16:53:57 +0200 Sender: kvm-owner@vger.kernel.org List-ID: Dear KVM developers, I'm currently working on an open source security patch to use KVM to implement code verification on a guest VM in runtime. Thus, it would be very helpful if someone can point to me the right function or place to look at for adding 2 hooks into the KVM paging code to: 1. Detect a new guest page (which I assume will imply a new pte and imply a new spte). Currently, I'm considering putting a hook in the function mmu_set_spte(), but may there is a better place. This hook will be used as the main entry point into the code verification function 2. Detect a write fault to a read-only spte (eg. for the case of updating the dirty bit back to the guest pte) Unfortunately, I'm unable to find an appropriate place where this actually takes place after reading the code many times. This hook will be used to prevent a secondary "peek" page from modifying an existing verified code page. I will gladly contribute my work(my phd thesis) to the list once it is workable, if anyone find it useful. Thank you in advance. Regards, Chun Hui