Machine readable policy for register access permissions
A machine readable policy generated from a policy specification may be obtained. The machine readable policy may specify an exit reason for a virtual processor (vCPU) to exit execution on a host computing system and a set of register access permissions associated with the exit reason. Upon the vCPU exiting for the exit reason, a separation kernel that separates the hypervisor executing on the host computing system from direct hardware access applies the machine readable policy. Applying the machine readable policy includes determining that the hypervisor is requesting access to a register associated with the vCPU, evaluating the access against the set of register access permissions, and allowing the hypervisor to access the register based on the evaluation.
1 . A computer-implemented method, comprising:
obtaining a policy specification that defines:
a plurality of exit reasons for a virtual processor (vCPU) to exit execution on a host computing system; and
respective sets of register access permissions associated with the exit reasons;
generating a machine-readable policy from the policy specification;
running a separation kernel that separates a hypervisor executing on the host computing system from direct hardware access;
executing the vCPU on the host computing system; and
upon the vCPU exiting execution, applying the machine-readable policy by the separation kernel, wherein applying the machine-readable policy includes:
determining an exit reason for the vCPU to exit execution;
determining that the hypervisor is requesting access to a register associated with the vCPU;
evaluating the access against a set of register access permissions corresponding to the exit reason that caused the vCPU to exit execution;
determining that the hypervisor is allowed to access the register; and
allowing the hypervisor to proceed with the access.
2 . The computer-implemented method of claim 1 , wherein the machine-readable policy is usable for formal verification of the separation kernel.
3 . The computer-implemented method of claim 1 , wherein the set of register access permissions includes static access permissions that are based on predetermined values and dynamic access permissions that are based on a runtime context of the vCPU.
4 . The computer-implemented method of claim 3 , wherein evaluating the access against the set of access permissions includes:
determining one or more vCPU register values of the runtime context at a time of exit of the vCPU; and
converting a dynamic access permission into a static access permission using the one or more vCPU register values.
5 . A computer-implemented method, comprising:
obtaining a machine-readable policy generated from a policy specification that defines:
an exit reason for a virtual processor (vCPU) to exit execution on a host computing system; and
a set of register access permissions associated with the exit reason; and
upon the vCPU exiting for the exit reason, applying the machine-readable policy by a separation kernel that separates a hypervisor executing on the host computing system from direct hardware access, wherein applying the machine-readable policy includes:
determining that the hypervisor is requesting access to a register associated with the vCPU;
evaluating the access against the set of register access permissions; and
allowing the hypervisor to access the register based on the evaluation.
6 . The computer-implemented method of claim 5 , wherein the hypervisor is blocked from accessing registers associated with the vCPU during runtime of the vCPU.
7 . The computer-implemented method of claim 5 , wherein the set of register access permissions includes one or more static access permissions that are based on predetermined values.
8 . The computer-implemented method of claim 5 , wherein each static access permission includes:
a register identifier representing a vCPU register that the hypervisor is allowed to access; and
an operation type indicating whether read, write, or both read and write are permitted on the vCPU register.
9 . The computer-implemented method of claim 8 , wherein a static access permission that indicates that the write is permitted further includes information specifying one or more predetermined values that are allowed to be written to the corresponding vCPU register.
10 . The computer-implemented method of claim 8 , wherein a static access permission that indicates that the write is permitted further includes a predetermined mask value to prevent the hypervisor from writing a portion of the vCPU register.
11 . The computer-implemented method of claim 8 , wherein a static access permission that indicates that the read is permitted further includes a predetermined mask value to prevent the hypervisor from reading a portion of the vCPU register.
12 . The computer-implemented method of claim 5 , wherein the set of register access permissions includes one or more dynamic access permissions that are based on a runtime context of the vCPU.
13 . The computer-implemented method of claim 12 , wherein the runtime context includes one or more vCPU register values at a time of exit of the vCPU.
14 . The computer-implemented method of claim 13 , wherein evaluating the access against the set of access permissions includes:
determining the one or more vCPU register values at the time of exit of the vCPU; and
converting a dynamic access permission into a static access permission using the one or more vCPU register values.
15 . The computer-implemented method of claim 5 , wherein the policy specification includes a plurality of exit reasons, and a set of register permissions for each of the exit reasons, and
wherein upon the vCPU exiting, the separation kernel determines which of the exit reasons caused the vCPU to exit, and applies the set of register permissions corresponding to the determined exit reason.
16 . A non-transitory computer readable medium having stored therein instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:
obtaining a machine-readable policy generated from a policy specification that defines:
an exit reason for a virtual processor (vCPU) to exit execution on a host computing system; and
a set of register access permissions associated with the exit reason; and
upon the vCPU exiting for the exit reason, applying the machine-readable policy by a separation kernel that separates a hypervisor executing on the host computing system from direct hardware access, wherein applying the machine-readable policy includes:
determining that the hypervisor is requesting access to a register associated with the vCPU;
evaluating the access against the set of register access permissions; and
allowing the hypervisor to access the register based on the evaluation.
17 . The non-transitory computer readable medium of claim 16 , wherein the set of register access permissions includes one or more static access permissions that are based on predetermined values.
18 . The non-transitory computer readable medium of claim 16 , wherein the set of register access permissions includes one or more dynamic access permissions that are based on a runtime context of the vCPU, and wherein the runtime context includes one or more vCPU register values at a time of exit of the vCPU.
19 . The non-transitory computer readable medium of claim 18 , wherein evaluating the access against the set of access permissions includes:
determining the one or more vCPU register values at the time of exit of the vCPU; and
converting a dynamic access permission into a static access permission using the one or more vCPU register values.
20 . The non-transitory computer readable medium of claim 16 , wherein the policy specification includes a plurality of exit reasons, and a set of register permissions for each of the exit reasons, and
wherein upon the vCPU exiting, the separation kernel determines which of the exit reasons caused the vCPU to exit, and applies the set of register permissions corresponding to the determined exit reason.