vm.fail
hypervisor kernel integrity enforcement via EPT/NPT write interception for Xen/HVM guests
2.7 kB
116 lines
1use std::os::raw::c_ulong;
2
3pub const HYPERVISOR_TURNSTILE: c_ulong = 50;
4
5pub const TURNSTILE_OP_SET_POLICY: u32 = 0;
6pub const TURNSTILE_OP_PROTECT_RANGE: u32 = 1;
7pub const TURNSTILE_OP_UNPROTECT_RANGE: u32 = 2;
8pub const TURNSTILE_OP_REQUEST_WRITE: u32 = 3;
9pub const TURNSTILE_OP_GET_VIOLATIONS: u32 = 4;
10pub const TURNSTILE_OP_GET_STATS: u32 = 5;
11pub const TURNSTILE_OP_UPLOAD_METADATA: u32 = 6;
12
13pub const TURNSTILE_POLICY_DISABLED: u32 = 0;
14pub const TURNSTILE_POLICY_AUDIT: u32 = 1;
15pub const TURNSTILE_POLICY_ENFORCE: u32 = 2;
16
17pub const TURNSTILE_MAX_RANGES: usize = 256;
18pub const TURNSTILE_RING_SIZE: usize = 4096;
19pub const TURNSTILE_MAX_FUNC_ENTRIES: usize = 65536;
20pub const TURNSTILE_MAX_JUMP_ENTRIES: usize = 32768;
21
22pub const TURNSTILE_META_FUNC_ENTRIES: u32 = 0;
23pub const TURNSTILE_META_JUMP_ENTRIES: u32 = 1;
24
25#[repr(C)]
26#[derive(Debug, Clone, Copy, Default)]
27pub struct TurnstileViolation {
28 pub timestamp: u64,
29 pub gpa: u64,
30 pub rip: u64,
31 pub cr3: u64,
32 pub access_flags: u32,
33 pub response: u32,
34 pub insn_bytes: [u8; 16],
35 pub seq: u32,
36 pub _pad: u32,
37}
38
39#[repr(C)]
40#[derive(Debug, Clone, Copy, Default)]
41pub struct TurnstileRange {
42 pub gpa_start: u64,
43 pub length: u64,
44 pub original_type: u32,
45 pub flags: u32,
46}
47
48#[repr(C)]
49#[derive(Debug, Clone, Copy, Default)]
50pub struct TurnstileStats {
51 pub violations_total: u64,
52 pub violations_blocked: u64,
53 pub violations_allowed: u64,
54 pub implicit_ftrace: u64,
55 pub implicit_static_key: u64,
56 pub explicit_write_grants: u64,
57 pub ring_overflows: u64,
58}
59
60#[repr(C)]
61#[derive(Debug, Clone, Copy)]
62pub struct TurnstileOpSetPolicy {
63 pub policy: u32,
64 pub _pad: u32,
65}
66
67#[repr(C)]
68#[derive(Debug, Clone, Copy)]
69pub struct TurnstileOpProtectRange {
70 pub gpa_start: u64,
71 pub length: u64,
72}
73
74#[repr(C)]
75#[derive(Debug, Clone, Copy)]
76pub struct TurnstileOpRequestWrite {
77 pub gpa_start: u64,
78 pub length: u64,
79 pub timeout_ms: u32,
80 pub _pad: u32,
81}
82
83#[repr(C)]
84#[derive(Debug, Clone, Copy)]
85pub struct TurnstileOpGetViolations {
86 pub buffer_ptr: u64,
87 pub max_entries: u32,
88 pub entries_returned: u32,
89 pub overflow_count: u32,
90 pub _pad: u32,
91}
92
93#[repr(C)]
94#[derive(Debug, Clone, Copy)]
95pub struct TurnstileOpUploadMetadata {
96 pub buffer_ptr: u64,
97 pub metadata_type: u32,
98 pub count: u32,
99}
100
101#[repr(C)]
102#[derive(Debug, Clone, Copy)]
103pub struct JumpEntryUpload {
104 pub code_addr: u64,
105 pub target_addr: u64,
106 pub key_addr: u64,
107}
108
109#[repr(C)]
110#[derive(Debug)]
111pub struct PrivcmdHypercall {
112 pub op: c_ulong,
113 pub arg: [c_ulong; 5],
114}
115
116nix::ioctl_readwrite!(privcmd_hypercall, b'P', 0, PrivcmdHypercall);