arch/x86/kvm/mmu_audit.c

   1 /*
   2  * mmu_audit.c:
   3  *
   4  * Audit code for KVM MMU
   5  *
   6  * Copyright (C) 2006 Qumranet, Inc.
   7  * Copyright 2010 Red Hat, Inc. and/or its affiliates.
   8  *
   9  * Authors:
  10  *   Yaniv Kamay  <yaniv@qumranet.com>
  11  *   Avi Kivity   <avi@qumranet.com>
  12  *   Marcelo Tosatti <mtosatti@redhat.com>
  13  *   Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
  14  *
  15  * This work is licensed under the terms of the GNU GPL, version 2.  See
  16  * the COPYING file in the top-level directory.
  17  *
  18  */
  19
  20 #include <linux/ratelimit.h>
  21
  22 #define audit_printk(kvm, fmt, args...)         \
  23         printk(KERN_ERR "audit: (%s) error: "   \
  24                 fmt, audit_point_name[kvm->arch.audit_point], ##args)
  25
  26 typedef void (*inspect_spte_fn) (struct kvm_vcpu *vcpu, u64 *sptep, int level);
  27
  28 static void __mmu_spte_walk(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
  29                             inspect_spte_fn fn, int level)
  30 {
  31         int i;
  32
  33         for (i = 0; i < PT64_ENT_PER_PAGE; ++i) {
  34                 u64 *ent = sp->spt;
  35
  36                 fn(vcpu, ent + i, level);
  37
  38                 if (is_shadow_present_pte(ent[i]) &&
  39                       !is_last_spte(ent[i], level)) {
  40                         struct kvm_mmu_page *child;
  41
  42                         child = page_header(ent[i] & PT64_BASE_ADDR_MASK);
  43                         __mmu_spte_walk(vcpu, child, fn, level - 1);
  44                 }
  45         }
  46 }
  47
  48 static void mmu_spte_walk(struct kvm_vcpu *vcpu, inspect_spte_fn fn)
  49 {
  50         int i;
  51         struct kvm_mmu_page *sp;
  52
  53         if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
  54                 return;
  55
  56         if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
  57                 hpa_t root = vcpu->arch.mmu.root_hpa;
  58
  59                 sp = page_header(root);
  60                 __mmu_spte_walk(vcpu, sp, fn, PT64_ROOT_LEVEL);
  61                 return;
  62         }
  63
  64         for (i = 0; i < 4; ++i) {
  65                 hpa_t root = vcpu->arch.mmu.pae_root[i];
  66
  67                 if (root && VALID_PAGE(root)) {
  68                         root &= PT64_BASE_ADDR_MASK;
  69                         sp = page_header(root);
  70                         __mmu_spte_walk(vcpu, sp, fn, 2);
  71                 }
  72         }
  73
  74         return;
  75 }
  76
  77 typedef void (*sp_handler) (struct kvm *kvm, struct kvm_mmu_page *sp);
  78
  79 static void walk_all_active_sps(struct kvm *kvm, sp_handler fn)
  80 {
  81         struct kvm_mmu_page *sp;
  82
  83         list_for_each_entry(sp, &kvm->arch.active_mmu_pages, link)
  84                 fn(kvm, sp);
  85 }
  86
  87 static void audit_mappings(struct kvm_vcpu *vcpu, u64 *sptep, int level)
  88 {
  89         struct kvm_mmu_page *sp;
  90         gfn_t gfn;
  91         pfn_t pfn;
  92         hpa_t hpa;
  93
  94         sp = page_header(__pa(sptep));
  95
  96         if (sp->unsync) {
  97                 if (level != PT_PAGE_TABLE_LEVEL) {
  98                         audit_printk(vcpu->kvm, "unsync sp: %p "
  99                                      "level = %d\n", sp, level);
 100                         return;
 101                 }
 102         }
 103
 104         if (!is_shadow_present_pte(*sptep) || !is_last_spte(*sptep, level))
 105                 return;
 106
 107         gfn = kvm_mmu_page_get_gfn(sp, sptep - sp->spt);
 108         pfn = gfn_to_pfn_atomic(vcpu->kvm, gfn);
 109
 110         if (is_error_pfn(pfn)) {
 111                 kvm_release_pfn_clean(pfn);
 112                 return;
 113         }
 114
 115         hpa =  pfn << PAGE_SHIFT;
 116         if ((*sptep & PT64_BASE_ADDR_MASK) != hpa)
 117                 audit_printk(vcpu->kvm, "levels %d pfn %llx hpa %llx "
 118                              "ent %llxn", vcpu->arch.mmu.root_level, pfn,
 119                              hpa, *sptep);
 120 }
 121
 122 static void inspect_spte_has_rmap(struct kvm *kvm, u64 *sptep)
 123 {
 124         unsigned long *rmapp;
 125         struct kvm_mmu_page *rev_sp;
 126         gfn_t gfn;
 127
 128
 129         rev_sp = page_header(__pa(sptep));
 130         gfn = kvm_mmu_page_get_gfn(rev_sp, sptep - rev_sp->spt);
 131
 132         if (!gfn_to_memslot(kvm, gfn)) {
 133                 if (!printk_ratelimit())
 134                         return;
 135                 audit_printk(kvm, "no memslot for gfn %llx\n", gfn);
 136                 audit_printk(kvm, "index %ld of sp (gfn=%llx)\n",
 137                        (long int)(sptep - rev_sp->spt), rev_sp->gfn);
 138                 dump_stack();
 139                 return;
 140         }
 141
 142         rmapp = gfn_to_rmap(kvm, gfn, rev_sp->role.level);
 143         if (!*rmapp) {
 144                 if (!printk_ratelimit())
 145                         return;
 146                 audit_printk(kvm, "no rmap for writable spte %llx\n",
 147                              *sptep);
 148                 dump_stack();
 149         }
 150 }
 151
 152 static void audit_sptes_have_rmaps(struct kvm_vcpu *vcpu, u64 *sptep, int level)
 153 {
 154         if (is_shadow_present_pte(*sptep) && is_last_spte(*sptep, level))
 155                 inspect_spte_has_rmap(vcpu->kvm, sptep);
 156 }
 157
 158 static void audit_spte_after_sync(struct kvm_vcpu *vcpu, u64 *sptep, int level)
 159 {
 160         struct kvm_mmu_page *sp = page_header(__pa(sptep));
 161
 162         if (vcpu->kvm->arch.audit_point == AUDIT_POST_SYNC && sp->unsync)
 163                 audit_printk(vcpu->kvm, "meet unsync sp(%p) after sync "
 164                              "root.\n", sp);
 165 }
 166
 167 static void check_mappings_rmap(struct kvm *kvm, struct kvm_mmu_page *sp)
 168 {
 169         int i;
 170
 171         if (sp->role.level != PT_PAGE_TABLE_LEVEL)
 172                 return;
 173
 174         for (i = 0; i < PT64_ENT_PER_PAGE; ++i) {
 175                 if (!is_rmap_spte(sp->spt[i]))
 176                         continue;
 177
 178                 inspect_spte_has_rmap(kvm, sp->spt + i);
 179         }
 180 }
 181
 182 static void audit_write_protection(struct kvm *kvm, struct kvm_mmu_page *sp)
 183 {
 184         struct kvm_memory_slot *slot;
 185         unsigned long *rmapp;
 186         u64 *spte;
 187
 188         if (sp->role.direct || sp->unsync || sp->role.invalid)
 189                 return;
 190
 191         slot = gfn_to_memslot(kvm, sp->gfn);
 192         rmapp = &slot->rmap[sp->gfn - slot->base_gfn];
 193
 194         spte = rmap_next(kvm, rmapp, NULL);
 195         while (spte) {
 196                 if (is_writable_pte(*spte))
 197                         audit_printk(kvm, "shadow page has writable "
 198                                      "mappings: gfn %llx role %x\n",
 199                                      sp->gfn, sp->role.word);
 200                 spte = rmap_next(kvm, rmapp, spte);
 201         }
 202 }
 203
 204 static void audit_sp(struct kvm *kvm, struct kvm_mmu_page *sp)
 205 {
 206         check_mappings_rmap(kvm, sp);
 207         audit_write_protection(kvm, sp);
 208 }
 209
 210 static void audit_all_active_sps(struct kvm *kvm)
 211 {
 212         walk_all_active_sps(kvm, audit_sp);
 213 }
 214
 215 static void audit_spte(struct kvm_vcpu *vcpu, u64 *sptep, int level)
 216 {
 217         audit_sptes_have_rmaps(vcpu, sptep, level);
 218         audit_mappings(vcpu, sptep, level);
 219         audit_spte_after_sync(vcpu, sptep, level);
 220 }
 221
 222 static void audit_vcpu_spte(struct kvm_vcpu *vcpu)
 223 {
 224         mmu_spte_walk(vcpu, audit_spte);
 225 }
 226
 227 static void kvm_mmu_audit(void *ignore, struct kvm_vcpu *vcpu, int point)
 228 {
 229         static DEFINE_RATELIMIT_STATE(ratelimit_state, 5 * HZ, 10);
 230
 231         if (!__ratelimit(&ratelimit_state))
 232                 return;
 233
 234         vcpu->kvm->arch.audit_point = point;
 235         audit_all_active_sps(vcpu->kvm);
 236         audit_vcpu_spte(vcpu);
 237 }
 238
 239 static bool mmu_audit;
 240
 241 static void mmu_audit_enable(void)
 242 {
 243         int ret;
 244
 245         if (mmu_audit)
 246                 return;
 247
 248         ret = register_trace_kvm_mmu_audit(kvm_mmu_audit, NULL);
 249         WARN_ON(ret);
 250
 251         mmu_audit = true;
 252 }
 253
 254 static void mmu_audit_disable(void)
 255 {
 256         if (!mmu_audit)
 257                 return;
 258
 259         unregister_trace_kvm_mmu_audit(kvm_mmu_audit, NULL);
 260         tracepoint_synchronize_unregister();
 261         mmu_audit = false;
 262 }
 263
 264 static int mmu_audit_set(const char *val, const struct kernel_param *kp)
 265 {
 266         int ret;
 267         unsigned long enable;
 268
 269         ret = strict_strtoul(val, 10, &enable);
 270         if (ret < 0)
 271                 return -EINVAL;
 272
 273         switch (enable) {
 274         case 0:
 275                 mmu_audit_disable();
 276                 break;
 277         case 1:
 278                 mmu_audit_enable();
 279                 break;
 280         default:
 281                 return -EINVAL;
 282         }
 283
 284         return 0;
 285 }
 286
 287 static struct kernel_param_ops audit_param_ops = {
 288         .set = mmu_audit_set,
 289         .get = param_get_bool,
 290 };
 291
 292 module_param_cb(mmu_audit, &audit_param_ops, &mmu_audit, 0644);