[Question] Switching VCPU CPL from the hypervisor ?

[Question] Switching VCPU CPL from the hypervisor ?

[Yacine HEBBAL]

Hi,
I working on an application in which I control an arbitrary process to
execute an a given code (injected code for example). I want the process I'm
controlling to execute my code with root privilege. Is it possible to
arbitrary switch vcpu cpl to 0 from the hypervisor level (process is in user
mode) ? I'm aware that I can do this using some hacks and emulation or by
controlling the process just after it enters or just before it quits kernel
mode (but I need to wait and intercept these events). Is there a
straightforward technique to switch vcpu cpl from the hypervisor level at
demand ?

Re: [Question] Switching VCPU CPL from the hypervisor ?

[Paolo Bonzini]

On 15/12/2015 17:20, Yacine HEBBAL wrote:
> Hi,
> I working on an application in which I control an arbitrary process to
> execute an a given code (injected code for example). I want the process I'm
> controlling to execute my code with root privilege. Is it possible to
> arbitrary switch vcpu cpl to 0 from the hypervisor level (process is in user
> mode) ? I'm aware that I can do this using some hacks and emulation or by
> controlling the process just after it enters or just before it quits kernel
> mode (but I need to wait and intercept these events). Is there a
> straightforward technique to switch vcpu cpl from the hypervisor level at
> demand ?

Would a hypercall do?  VMCALL can be executed from CPL 3.

Paolo

Re: [Question] Switching VCPU CPL from the hypervisor ?

[Yacine HEBBAL]

> 
> Would a hypercall do?  VMCALL can be executed from CPL 3.
> 
> Paolo
> --
> 
> 

What I want to do is: when a controlled process is in user mode, i change
its cpl to 0, force it to execute a code that is injected in the VM, set
back its cpl to 3 and let it run like if nothing happened

Yacine

Re: [Question] Switching VCPU CPL from the hypervisor ?

[Paolo Bonzini]

On 15/12/2015 18:02, Hebbal Yacine wrote:
> What I want to do is: when a controlled process is in user mode, i
> change its cpl to 0, force it to execute a code that is injected in the
> VM, set back its cpl to 3 and let it run like if nothing happened

Could you inject an SMI and place your code in the guest firmware's SMM
handler?  What input is needed by this CPL=0 code?

Paolo

Re: [Question] Switching VCPU CPL from the hypervisor ?

[Yacine HEBBAL]

Paolo Bonzini <pbonzini <at> redhat.com> writes:
> On 15/12/2015 18:02, Hebbal Yacine wrote:
> > What I want to do is: when a controlled process is in user mode, i
> > change its cpl to 0, force it to execute a code that is injected in the
> > VM, set back its cpl to 3 and let it run like if nothing happened
> 
> Could you inject an SMI and place your code in the guest firmware's SMM
> handler?  What input is needed by this CPL=0 code?
> 
> Paolo

I think the the solution follows this logic, meaning we inject an interrupt,
intercept execution of its handler (cpl is 0), save cpu context, execute the
code we want, push a return address, and force the process to execute IRET
instruction which will complete the cleaning, restore cpl to 3 and let the
process resume its normal execution. I'll continue to dig this to see if
there is any better approach, thanks for your help :)


Yacine