search

KVM-VMI / kvm

Fork of KVM with Virtual Machine Introspection patches
Other
33 stars 28 forks source link

KVM: introspection: clarify the information sent for some vCPU events #42

Closed adlazar closed 4 years ago

adlazar commented 4 years ago

hypercall, breakpoint and page fault events

Wenzel commented 4 years ago

Thanks.

Just a quick thing that I noticed while reading the whole document also:

This event is sent when a hypervisor page fault occurs due to a failed permission check in the shadow page tables, the introspection has been permission check in the shadow page tables

Should we use the term Shadow page tables ? To me, this refer to the 2nd level of page tables emulated by the hypervisor (without hardware assistance like EPT/NPT) As KVMi is only implemented when EPT/NPT are available, should we change the vocabulary here maybe ?

I'm not 100% sure here though. What do you think ?

adlazar commented 4 years ago

I've removed these words with the second commit.