Hypervisor-Enforced Kernel Integrity (Heki) for KVM
summary
Heki is a KVM-based prototype that moves kernel self-protection out of the kernel by enforcing control-register pinning and page permissions via EPT/GFN attributes; it implements a new GFN attribute management model, a P-page attribute (PES) tracker and a km-to-VMM interface that traps set_memory_ operations and logs them. It currently protects static K sections and adds dynamic kernel mapping protection for modules, kprobes, ftrace and eBPF JIT, but guest-side policy (signing BPF, legitimizing kprobe/patching changes) remains unresolved. VMM notification and version management* are present; demos and patches exist but upstreaming and policy decisions are pending.
AI-written summary · about
chapters (10)
- 0:00Introduction and motivation
- 1:05Problem of kernel integrity
- 6:16Trust model and initial setup
- 10:57KVM implementation details
- 14:05Guest-side memory protection
- 17:19Guest-side challenges
- 21:52Hypervisor vs guest security
- 27:53Security boundary benefits
- 31:51Policy and policy management
- 37:10Future work and Q&A
related talks
39mHeki: Hypervisor-Enforced Kernel Integrity for Linux with KVM
26mHypervisor Based Integrity: Protect Guest Kernel in Cloud
18mGuest Memory Protection -- Current Status and Future
38mKernel Hardening: Protecting the Protection Mechanisms
50mProtected KVM on Arm64: A Technical Deep Dive
25mProtecting from MaliciousHypervisor Using AMD SEV-SNP
19mEPK: Scalable and Efficient Memory Protection Keys
37mHardware Error Handling Improvement for Reliable KVM Hypervisor