How to achieve page_protect in kvmi

[qth1991]

Hi,I'm interested in introspected VM, I find that you make "kvm_slot_page_track_add_page" to set one slot of write_protect.But I can't find what new processes have you added in "handle_ept_violation" if this slot trigger write_protect. Could you tell me ? By the way I can't find the function implementation code of "trace_kvm_page_faule"、"trace_kvmi_set_gfn_access"...etc. Thank you!

[adlazar]

From handle_ept_violation()/kvm_mmu_page_fault() the instruction (which caused the vmexit) will be emulated. The write callbacks (e.g. emulator_write_phys()) used by the emulator will call kvm_page_track_prewrite() which calls kvmi_track_prewrite().

You can find the trace functions in arch/x86/kvm/trace.h and include/trace/events/kvmi.h.

You can browse the introspection patches starting with 40d62ae from Aug 8.