Date: Thu, 19 Jul 2018 23:37:59 +0200 From: Ahmed Abd El Mawgood <ahmedsoliman0x666@...il.com> To: kvm@...r.kernel.org, Kernel Hardening <kernel-hardening@...ts.openwall.com>, virtualization@...ts.linux-foundation.org, linux-doc@...r.kernel.org, x86@...nel.org Cc: Paolo Bonzini <pbonzini@...hat.com>, rkrcmar@...hat.com, nathan Corbet <corbet@....net>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, hpa@...or.com, Kees Cook <keescook@...omium.org>, Ard Biesheuvel <ard.biesheuvel@...aro.org>, David Hildenbrand <david@...hat.com>, Boris Lukashev <blukashev@...pervictus.com>, David Vrabel <david.vrabel@...anix.com>, nigel.edwards@....com, Rik van Riel <riel@...riel.com> Subject: Memory Read Only Enforcement: VMM assisted kernel rootkit mitigation for KVM Hi, This is my first set of patches that works as I would expect, and the third revision I sent to mailing lists. Following up with my previous discussions about kernel rootkit mitigation via placing R/O protection on critical data structure, static data, privileged registers with static content. These patches present the first part where it is only possible to place these protections on memory pages. Feature-wise, this set of patches is incomplete in the sense of: - They still don't protect privileged registers - They don't protect guest TLB from malicious gva -> gpa page mappings. But they provide sketches for a basic working design. Note that I am totally noob and it took lots of time and effort to get to this point. So sorry in advance if I overlooked something. [PATCH 1/3] [RFC V3] KVM: X86: Memory ROE documentation [PATCH 2/3] [RFC V3] KVM: X86: Adding arbitrary data pointer in kvm memslot itterator functions [PATCH 3/3] [RFC V3] KVM: X86: Adding skeleton for Memory ROE Summery: Documentation/virtual/kvm/hypercalls.txt | 14 ++++ arch/x86/include/asm/kvm_host.h | 11 ++- arch/x86/kvm/Kconfig | 7 ++ arch/x86/kvm/mmu.c | 127 ++++++++++++++++++++++--------- arch/x86/kvm/x86.c | 82 +++++++++++++++++++- include/linux/kvm_host.h | 3 + include/uapi/linux/kvm_para.h | 1 + virt/kvm/kvm_main.c | 29 ++++++- 8 files changed, 232 insertions(+), 42 deletions(-)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.