arch/x86/kvm/mmu_audit.c

   1 /*
   2  * mmu_audit.c:
   3  *
   4  * Audit code for KVM MMU
   5  *
   6  * Copyright (C) 2006 Qumranet, Inc.
   7  * Copyright 2010 Red Hat, Inc. and/or its affiliates.
   8  *
   9  * Authors:
  10  *   Yaniv Kamay  <yaniv@qumranet.com>
  11  *   Avi Kivity   <avi@qumranet.com>
  12  *   Marcelo Tosatti <mtosatti@redhat.com>
  13  *   Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
  14  *
  15  * This work is licensed under the terms of the GNU GPL, version 2.  See
  16  * the COPYING file in the top-level directory.
  17  *
  18  */
  19
  20 #include <linux/ratelimit.h>
  21
  22 #define audit_printk(kvm, fmt, args...)         \
  23         printk(KERN_ERR "audit: (%s) error: "   \
  24                 fmt, audit_point_name[kvm->arch.audit_point], ##args)
  25
  26 typedef void (*inspect_spte_fn) (struct kvm_vcpu *vcpu, u64 *sptep, int level);
  27
  28 static void __mmu_spte_walk(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
  29                             inspect_spte_fn fn, int level)
  30 {
  31         int i;
  32
  33         for (i = 0; i < PT64_ENT_PER_PAGE; ++i) {
  34                 u64 *ent = sp->spt;
  35
  36                 fn(vcpu, ent + i, level);
  37
  38                 if (is_shadow_present_pte(ent[i]) &&
  39                       !is_last_spte(ent[i], level)) {
  40                         struct kvm_mmu_page *child;
  41
  42                         child = page_header(ent[i] & PT64_BASE_ADDR_MASK);
  43                         __mmu_spte_walk(vcpu, child, fn, level - 1);
  44                 }
  45         }
  46 }
  47
  48 static void mmu_spte_walk(struct kvm_vcpu *vcpu, inspect_spte_fn fn)
  49 {
  50         int i;
  51         struct kvm_mmu_page *sp;
  52
  53         if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
  54                 return;
  55
  56         if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
  57                 hpa_t root = vcpu->arch.mmu.root_hpa;
  58
  59                 sp = page_header(root);
  60                 __mmu_spte_walk(vcpu, sp, fn, PT64_ROOT_LEVEL);
  61                 return;
  62         }
  63
  64         for (i = 0; i < 4; ++i) {
  65                 hpa_t root = vcpu->arch.mmu.pae_root[i];
  66
  67                 if (root && VALID_PAGE(root)) {
  68                         root &= PT64_BASE_ADDR_MASK;
  69                         sp = page_header(root);
  70                         __mmu_spte_walk(vcpu, sp, fn, 2);
  71                 }
  72         }
  73
  74         return;
  75 }
  76
  77 typedef void (*sp_handler) (struct kvm *kvm, struct kvm_mmu_page *sp);
  78
  79 static void walk_all_active_sps(struct kvm *kvm, sp_handler fn)
  80 {
  81         struct kvm_mmu_page *sp;
  82
  83         list_for_each_entry(sp, &kvm->arch.active_mmu_pages, link)
  84                 fn(kvm, sp);
  85 }
  86
  87 static void audit_mappings(struct kvm_vcpu *vcpu, u64 *sptep, int level)
  88 {
  89         struct kvm_mmu_page *sp;
  90         gfn_t gfn;
  91         pfn_t pfn;
  92         hpa_t hpa;
  93
  94         sp = page_header(__pa(sptep));
  95
  96         if (sp->unsync) {
  97                 if (level != PT_PAGE_TABLE_LEVEL) {
  98                         audit_printk(vcpu->kvm, "unsync sp: %p "
  99                                      "level = %d\n", sp, level);
 100                         return;
 101                 }
 102
 103                 if (*sptep == shadow_notrap_nonpresent_pte) {
 104                         audit_printk(vcpu->kvm, "notrap spte in unsync "
 105                                      "sp: %p\n", sp);
 106                         return;
 107                 }
 108         }
 109
 110         if (sp->role.direct && *sptep == shadow_notrap_nonpresent_pte) {
 111                 audit_printk(vcpu->kvm, "notrap spte in direct sp: %p\n",
 112                              sp);
 113                 return;
 114         }
 115
 116         if (!is_shadow_present_pte(*sptep) || !is_last_spte(*sptep, level))
 117                 return;
 118
 119         gfn = kvm_mmu_page_get_gfn(sp, sptep - sp->spt);
 120         pfn = gfn_to_pfn_atomic(vcpu->kvm, gfn);
 121
 122         if (is_error_pfn(pfn)) {
 123                 kvm_release_pfn_clean(pfn);
 124                 return;
 125         }
 126
 127         hpa =  pfn << PAGE_SHIFT;
 128         if ((*sptep & PT64_BASE_ADDR_MASK) != hpa)
 129                 audit_printk(vcpu->kvm, "levels %d pfn %llx hpa %llx "
 130                              "ent %llxn", vcpu->arch.mmu.root_level, pfn,
 131                              hpa, *sptep);
 132 }
 133
 134 static void inspect_spte_has_rmap(struct kvm *kvm, u64 *sptep)
 135 {
 136         unsigned long *rmapp;
 137         struct kvm_mmu_page *rev_sp;
 138         gfn_t gfn;
 139
 140
 141         rev_sp = page_header(__pa(sptep));
 142         gfn = kvm_mmu_page_get_gfn(rev_sp, sptep - rev_sp->spt);
 143
 144         if (!gfn_to_memslot(kvm, gfn)) {
 145                 if (!printk_ratelimit())
 146                         return;
 147                 audit_printk(kvm, "no memslot for gfn %llx\n", gfn);
 148                 audit_printk(kvm, "index %ld of sp (gfn=%llx)\n",
 149                        (long int)(sptep - rev_sp->spt), rev_sp->gfn);
 150                 dump_stack();
 151                 return;
 152         }
 153
 154         rmapp = gfn_to_rmap(kvm, gfn, rev_sp->role.level);
 155         if (!*rmapp) {
 156                 if (!printk_ratelimit())
 157                         return;
 158                 audit_printk(kvm, "no rmap for writable spte %llx\n",
 159                              *sptep);
 160                 dump_stack();
 161         }
 162 }
 163
 164 static void audit_sptes_have_rmaps(struct kvm_vcpu *vcpu, u64 *sptep, int level)
 165 {
 166         if (is_shadow_present_pte(*sptep) && is_last_spte(*sptep, level))
 167                 inspect_spte_has_rmap(vcpu->kvm, sptep);
 168 }
 169
 170 static void audit_spte_after_sync(struct kvm_vcpu *vcpu, u64 *sptep, int level)
 171 {
 172         struct kvm_mmu_page *sp = page_header(__pa(sptep));
 173
 174         if (vcpu->kvm->arch.audit_point == AUDIT_POST_SYNC && sp->unsync)
 175                 audit_printk(vcpu->kvm, "meet unsync sp(%p) after sync "
 176                              "root.\n", sp);
 177 }
 178
 179 static void check_mappings_rmap(struct kvm *kvm, struct kvm_mmu_page *sp)
 180 {
 181         int i;
 182
 183         if (sp->role.level != PT_PAGE_TABLE_LEVEL)
 184                 return;
 185
 186         for (i = 0; i < PT64_ENT_PER_PAGE; ++i) {
 187                 if (!is_rmap_spte(sp->spt[i]))
 188                         continue;
 189
 190                 inspect_spte_has_rmap(kvm, sp->spt + i);
 191         }
 192 }
 193
 194 static void audit_write_protection(struct kvm *kvm, struct kvm_mmu_page *sp)
 195 {
 196         struct kvm_memory_slot *slot;
 197         unsigned long *rmapp;
 198         u64 *spte;
 199
 200         if (sp->role.direct || sp->unsync || sp->role.invalid)
 201                 return;
 202
 203         slot = gfn_to_memslot(kvm, sp->gfn);
 204         rmapp = &slot->rmap[sp->gfn - slot->base_gfn];
 205
 206         spte = rmap_next(kvm, rmapp, NULL);
 207         while (spte) {
 208                 if (is_writable_pte(*spte))
 209                         audit_printk(kvm, "shadow page has writable "
 210                                      "mappings: gfn %llx role %x\n",
 211                                      sp->gfn, sp->role.word);
 212                 spte = rmap_next(kvm, rmapp, spte);
 213         }
 214 }
 215
 216 static void audit_sp(struct kvm *kvm, struct kvm_mmu_page *sp)
 217 {
 218         check_mappings_rmap(kvm, sp);
 219         audit_write_protection(kvm, sp);
 220 }
 221
 222 static void audit_all_active_sps(struct kvm *kvm)
 223 {
 224         walk_all_active_sps(kvm, audit_sp);
 225 }
 226
 227 static void audit_spte(struct kvm_vcpu *vcpu, u64 *sptep, int level)
 228 {
 229         audit_sptes_have_rmaps(vcpu, sptep, level);
 230         audit_mappings(vcpu, sptep, level);
 231         audit_spte_after_sync(vcpu, sptep, level);
 232 }
 233
 234 static void audit_vcpu_spte(struct kvm_vcpu *vcpu)
 235 {
 236         mmu_spte_walk(vcpu, audit_spte);
 237 }
 238
 239 static void kvm_mmu_audit(void *ignore, struct kvm_vcpu *vcpu, int point)
 240 {
 241         static DEFINE_RATELIMIT_STATE(ratelimit_state, 5 * HZ, 10);
 242
 243         if (!__ratelimit(&ratelimit_state))
 244                 return;
 245
 246         vcpu->kvm->arch.audit_point = point;
 247         audit_all_active_sps(vcpu->kvm);
 248         audit_vcpu_spte(vcpu);
 249 }
 250
 251 static bool mmu_audit;
 252
 253 static void mmu_audit_enable(void)
 254 {
 255         int ret;
 256
 257         if (mmu_audit)
 258                 return;
 259
 260         ret = register_trace_kvm_mmu_audit(kvm_mmu_audit, NULL);
 261         WARN_ON(ret);
 262
 263         mmu_audit = true;
 264 }
 265
 266 static void mmu_audit_disable(void)
 267 {
 268         if (!mmu_audit)
 269                 return;
 270
 271         unregister_trace_kvm_mmu_audit(kvm_mmu_audit, NULL);
 272         tracepoint_synchronize_unregister();
 273         mmu_audit = false;
 274 }
 275
 276 static int mmu_audit_set(const char *val, const struct kernel_param *kp)
 277 {
 278         int ret;
 279         unsigned long enable;
 280
 281         ret = strict_strtoul(val, 10, &enable);
 282         if (ret < 0)
 283                 return -EINVAL;
 284
 285         switch (enable) {
 286         case 0:
 287                 mmu_audit_disable();
 288                 break;
 289         case 1:
 290                 mmu_audit_enable();
 291                 break;
 292         default:
 293                 return -EINVAL;
 294         }
 295
 296         return 0;
 297 }
 298
 299 static struct kernel_param_ops audit_param_ops = {
 300         .set = mmu_audit_set,
 301         .get = param_get_bool,
 302 };
 303
 304 module_param_cb(mmu_audit, &audit_param_ops, &mmu_audit, 0644);