Method for protecting jailhouse hvc super-system call

Abstract

The present application relates to a jailhouse hvc super system call security protection method, comprising loading a jailhouse management driver jailhouse.ko; the jailhouse.ko obtains the address information of the current module in the module initialization process; the jailhouse.ko remaps the memory region reserved for the hypervisor to the virtual kernel address that the current jailhouse.ko can access, and then writes the module address information into the memory region designed for storing the jailhouse.ko module address information in the reserved memory region.The present application verifies the legality of the source of the hvc instruction in the hypervisor, thereby ensuring that the hypervisor only serves legal hvc requests and preventing illegal hvc requests, achieving the effect of preventing malicious attackers from abusing hvc instructions to damage the system or perform denial-of-service attacks.

Description

Technical Field

[0001] This invention relates to the field of security and control technology for virtualization driver technology, specifically to a security protection method for jailhouse HVC super system calls. Background Technology

[0002] Jailhouse is a statically partitioned virtualization solution that does not support any device emulation. Jailhouse loads and runs a specific management driver in the root cell, which enables and disables the jailhouse hypervisor function, as well as creates, runs, and destroys non-root cell virtual machines, through HVC super system calls. This introduces a new attack surface.

[0003] The current jailhouse solution uses HVC instructions to initiate calls to the hypervisor service to achieve corresponding management functions. However, the hypervisor does not verify the source of these HVC instructions. Root cell or non-root cell attackers could potentially abuse the HVC super system call, thereby compromising the current jailhouse hypervisor functionality and availability. This is because the current hypervisor lacks the ability to distinguish between HVC instructions from non-root cells and non-jailhouse management drivers requesting hypervisor services. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a security protection method for jailhouse HVC super system calls, comprising the following steps:

[0005] Step S1: Load the jailhouse management driver jailhouse.ko;

[0006] Step S2: jailhouse.ko obtains the address information of the current module during module initialization;

[0007] Step S3: jailhouse.ko remaps the memory region reserved for the hypervisor to the virtual kernel address that jailhouse.ko can access. Then, it writes the module address information obtained in step S2 into the area in the reserved memory region that has been designed to store the jailhouse.ko module address information.

[0008] Step S4: Complete the initialization process of subsequent modules of jailhouse.ko.

[0009] In step S2, the address information of the currently loaded module, including the base address and length, is obtained through / proc / modules.

[0010] This also includes the following steps:

[0011] Step S5: Execute jailhouse cmd management commands using the jailhouse user-space tool;

[0012] Step S6: The jailhouse user-space tool sends the command to the corresponding processing function registered in jailhouse.ko via ioctl;

[0013] Step S7: jailhouse.ko invokes the hvc command to request the hypervisor service based on different user commands;

[0014] Step S8: When the hypervisor handles the HVC active trap request of jailhouse.ko, it first obtains the per_cpu data structure of the current CPU, gets the current cell structure from it, and determines whether it is equal to the global variable rootcell. If it is not equal, it records the alarm information and returns directly. If it is equal to root cell, it executes step S9.

[0015] Step S9: Obtain the virtual kernel address corresponding to the HVC instruction trap. If the address falls within the virtual kernel address range of jailhouse.ko that was saved beforehand, it means that it is a valid HVC request. Allow it to proceed normally and continue executing the subsequent code. Otherwise, record the alarm information and return directly.

[0016] In step S9, the virtual kernel address corresponding to the hvc instruction trap is obtained by reading the FAR_EL2 register.

[0017] This invention verifies the legitimacy of the source of HVC commands in the hypervisor, thereby ensuring that the hypervisor only serves legitimate HVC requests and blocking illegitimate HVC requests. This prevents malicious attackers from abusing HVC commands to damage the system or launch denial-of-service attacks. Attached Figure Description

[0018] Figure 1 The flowchart of the security protection method for jailhouse HVC super system calls of this invention during the deployment phase.

[0019] Figure 2 The flowchart of the security protection method for jailhouse HVC super system calls of the present invention during the verification phase. Detailed Implementation

[0020] To gain a better understanding of the technical solution and beneficial effects of the present invention, the technical solution of the present invention and its beneficial effects are described in detail below with reference to the accompanying drawings.

[0021] This invention proposes a security protection method based on virtual address ranges. The hypervisor will only process HVC instructions from legitimate jailhouse management drivers in a specific root cell, and other illegal HVC instructions will be treated as abnormal requests and ignored.

[0022] When jailhouse loads its own management driver, it writes the module address information of its own driver module (including base address and length, etc.) into the reserved memory area of ​​jailhouse hypervisor. In this way, the hypervisor can perform address verification on the source of HVC instruction addresses. Only HVC requests that fall within the legal address range are allowed to continue to execute subsequent code normally; otherwise, it will return directly and prevent illegal requests.

[0023] Figure 1 and Figure 2 The following are flowcharts illustrating the implementation of the jailhouse HVC super system call security protection method of the present invention during the deployment and implementation phases, respectively. Figure 1 and Figure 2 As shown, in the specific implementation, the official jailhouse version and an ARM Linux physical machine are used.

[0024] I. Deployment Process

[0025] 1. After the Linux physical machine boots up normally, the jailhouse management driver jailhouse.ko can be loaded automatically at startup or by the user through tools such as insmod.

[0026] 2. During module initialization, jailhouse.ko obtains module information such as the base address and length of the currently loaded module through / proc / modules. / proc / modules is a system directory that can retrieve information about all loaded modules in the system, such as their load addresses and lengths.

[0027] 3. jailhouse.ko remaps the memory area reserved for the hypervisor to the virtual kernel address that the current jailhouse.ko can access. Then, it writes the module address information of the current jailhouse.ko obtained above into the memory area in the reserved memory area that has been designed to store the module address information of jailhouse.ko.

[0028] 4. Continue to complete the initialization process of jailhouse.ko's subsequent modules.

[0029] II. Verification Process

[0030] 1. Users execute management commands such as enable, create, and delete using the jailhouse user-space tool, jailhouse cmd. jailhouse cmd is the jailhouse command-line tool that supports a range of commands, including enable, create, and delete. Figure 2 The “jailhouse_cmd_xxxx processing entry” indicates the execution of jailhouse cmd commands, where “xxxx” corresponds to specific management commands such as enable, create, delete, etc.

[0031] 2. The jailhouse user-space tool uses ioctl to send commands to the corresponding processing functions registered in jailhouse.ko. ioctl is a common interaction method between user-space tools and kernel-space drivers.

[0032] 3. jailhouse.ko invokes hvc instructions to request the hypervisor service based on different user commands.

[0033] 4. When the hypervisor handles the HVC active trap request from jailhouse.ko, it first obtains the per_cpu data structure of the current CPU, gets the current cell structure from it, and determines whether it is equal to the global variable root cell. If it is not equal, it records an alarm message and returns directly. If it is equal to root cell, it executes step 5. 5. It obtains the virtual kernel address corresponding to the HVC instruction trap (which can be done by reading the FAR_EL2 register). If the address falls within the pre-saved virtual kernel address range of jailhouse.ko (using base address + length), it means that it is a valid HVC request, and it is allowed to proceed normally and continue to execute subsequent code. If not, it records an alarm message and returns directly.

[0034] In this invention, jailhouse.ko is a kernel-mode driver for loading jailhouse hypervisor firmware for users. Its purpose is to respond to user operation commands, such as enabling jailhouse hypervisor and creating or deleting virtual machines (nonroot cells).

[0035] In this invention, the so-called hypervisor refers to the jailhouse hypervisor, which is responsible for creating and managing virtual machines (non-root cells), etc.

[0036] This invention verifies the legitimacy of the source of HVC commands in the hypervisor, thereby ensuring that the hypervisor only serves legitimate HVC requests and blocking illegitimate HVC requests. This prevents malicious attackers from abusing HVC commands to damage the system or launch denial-of-service attacks.

[0037] Although the present invention has been described using the above preferred embodiments, it is not intended to limit the scope of protection of the present invention. Any changes and modifications made by those skilled in the art to the above embodiments without departing from the spirit and scope of the present invention shall still fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

1. A security protection method for jailhouse HVC super system calls, characterized in that, Includes the following steps: Step S1: Load the jailhouse management driver jailhouse.ko; Step S2: jailhouse.ko obtains the address information of the current module during module initialization; Step S3: jailhouse.ko remaps the memory region reserved for the hypervisor to the virtual kernel address that jailhouse.ko can access. Then, it writes the module address information obtained in step S2 into the area in the reserved memory region that has been designed to store the jailhouse.ko module address information. Step S4: Complete the initialization process of subsequent modules in jailhouse.ko; Step S5: Execute jailhouse cmd management commands using the jailhouse user-space tool; Step S6: The jailhouse user-space tool sends the command to the corresponding processing function registered in jailhouse.ko via ioctl; Step S7: jailhouse.ko invokes the hvc command to request the hypervisor service based on different user commands; Step S8: When the hypervisor handles the HVC active trap request of jailhouse.ko, it first obtains the per_cpu data structure of the current CPU, gets the current cell structure from it, and determines whether it is equal to the global variable root cell. If it is not equal, it records the alarm information and returns directly. If it is equal to root cell, it executes step S9. Step S9: Obtain the virtual kernel address corresponding to the HVC instruction trap. If the address falls within the virtual kernel address range of jailhouse.ko that was saved beforehand, it means that it is a valid HVC request. Allow it to proceed normally and continue executing the subsequent code. Otherwise, record the alarm information and return directly.

2. The security protection method for jailhouse HVC super system calls as described in claim 1, characterized in that, In step S2, the address information of the currently loaded module, including the base address and length, is obtained through / proc / modules.

3. The security protection method for jailhouse HVC super system calls as described in claim 1, characterized in that, In step S9, the virtual kernel address corresponding to the hvc instruction trap is obtained by reading the FAR_EL2 register.

Images