Module management in a protected kernel environment
AssigneeRed Hat Israel, Ltd.
InventorsMichael Tsirkin, Paolo Bonzini
Life of this patent
Estimating the term…
Abstract
Methods, systems, and computer program products are included for performing module unloading in a protected kernel environment. A method includes loading a module into a kernel, the module including an exit function. The kernel provides, to a hypervisor, a memory location corresponding to the exit function of the module. A kernel protection feature is activated. After activating the kernel protection feature, the hypervisor detects an attempt to execute the exit function. The hypervisor determines that the attempt to execute the exit function corresponds to the memory location provided to the hypervisor. Based on the determining, the hypervisor allows execution of the exit function.
Claims20
A method for performing module unloading in a protected kernel environment, the method comprising:
- loading a module into a kernel, the module including an exit function;
- providing, to a hypervisor, a memory location corresponding to the exit function of the module;
- activating a protection feature corresponding to the kernel;
- after activating the protection feature, detecting an attempt to execute the exit function;
- determining, by the hypervisor, that the attempt to execute the exit function corresponds to the memory location provided to the hypervisor;
- and
- based on the determining, allowing execution of the exit function.
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- providing, to a hypervisor, a memory location corresponding to an exit function of a module of a kernel;
- activating a protection feature corresponding to the kernel;
- after activating the protection feature, detecting an attempt to execute at least one instruction included in the exit function;
- determining, by the hypervisor, that the attempt to execute the at least one instruction included in the exit function corresponds to the memory location provided to the hypervisor;
- and
- based on the determining, allowing execution of the at least one instruction included in the exit function.
A system comprising:
- a kernel that is provided by a hypervisor;
- a module that is loaded by the kernel, the module including an exit function;
- a protection feature that is activated to lock an access permission corresponding to the exit function;
- and
- one or more processors that execute instructions provided by the hypervisor to:
- detect an attempt to execute the exit function;
- and
- based on the detecting, unlock the access permission and modify the access permission to include execute access
Dependencies are inferred from the claim text.