4 * Audit code for KVM MMU
6 * Copyright (C) 2006 Qumranet, Inc.
7 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
10 * Yaniv Kamay <yaniv@qumranet.com>
11 * Avi Kivity <avi@qumranet.com>
12 * Marcelo Tosatti <mtosatti@redhat.com>
13 * Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
15 * This work is licensed under the terms of the GNU GPL, version 2. See
16 * the COPYING file in the top-level directory.
20 #include <linux/ratelimit.h>
22 char const *audit_point_name
[] = {
31 #define audit_printk(kvm, fmt, args...) \
32 printk(KERN_ERR "audit: (%s) error: " \
33 fmt, audit_point_name[kvm->arch.audit_point], ##args)
35 typedef void (*inspect_spte_fn
) (struct kvm_vcpu
*vcpu
, u64
*sptep
, int level
);
37 static void __mmu_spte_walk(struct kvm_vcpu
*vcpu
, struct kvm_mmu_page
*sp
,
38 inspect_spte_fn fn
, int level
)
42 for (i
= 0; i
< PT64_ENT_PER_PAGE
; ++i
) {
45 fn(vcpu
, ent
+ i
, level
);
47 if (is_shadow_present_pte(ent
[i
]) &&
48 !is_last_spte(ent
[i
], level
)) {
49 struct kvm_mmu_page
*child
;
51 child
= page_header(ent
[i
] & PT64_BASE_ADDR_MASK
);
52 __mmu_spte_walk(vcpu
, child
, fn
, level
- 1);
57 static void mmu_spte_walk(struct kvm_vcpu
*vcpu
, inspect_spte_fn fn
)
60 struct kvm_mmu_page
*sp
;
62 if (!VALID_PAGE(vcpu
->arch
.mmu
.root_hpa
))
65 if (vcpu
->arch
.mmu
.root_level
== PT64_ROOT_LEVEL
) {
66 hpa_t root
= vcpu
->arch
.mmu
.root_hpa
;
68 sp
= page_header(root
);
69 __mmu_spte_walk(vcpu
, sp
, fn
, PT64_ROOT_LEVEL
);
73 for (i
= 0; i
< 4; ++i
) {
74 hpa_t root
= vcpu
->arch
.mmu
.pae_root
[i
];
76 if (root
&& VALID_PAGE(root
)) {
77 root
&= PT64_BASE_ADDR_MASK
;
78 sp
= page_header(root
);
79 __mmu_spte_walk(vcpu
, sp
, fn
, 2);
86 typedef void (*sp_handler
) (struct kvm
*kvm
, struct kvm_mmu_page
*sp
);
88 static void walk_all_active_sps(struct kvm
*kvm
, sp_handler fn
)
90 struct kvm_mmu_page
*sp
;
92 list_for_each_entry(sp
, &kvm
->arch
.active_mmu_pages
, link
)
96 static void audit_mappings(struct kvm_vcpu
*vcpu
, u64
*sptep
, int level
)
98 struct kvm_mmu_page
*sp
;
103 sp
= page_header(__pa(sptep
));
106 if (level
!= PT_PAGE_TABLE_LEVEL
) {
107 audit_printk(vcpu
->kvm
, "unsync sp: %p "
108 "level = %d\n", sp
, level
);
113 if (!is_shadow_present_pte(*sptep
) || !is_last_spte(*sptep
, level
))
116 gfn
= kvm_mmu_page_get_gfn(sp
, sptep
- sp
->spt
);
117 pfn
= gfn_to_pfn_atomic(vcpu
->kvm
, gfn
);
119 if (is_error_pfn(pfn
)) {
120 kvm_release_pfn_clean(pfn
);
124 hpa
= pfn
<< PAGE_SHIFT
;
125 if ((*sptep
& PT64_BASE_ADDR_MASK
) != hpa
)
126 audit_printk(vcpu
->kvm
, "levels %d pfn %llx hpa %llx "
127 "ent %llxn", vcpu
->arch
.mmu
.root_level
, pfn
,
131 static void inspect_spte_has_rmap(struct kvm
*kvm
, u64
*sptep
)
133 static DEFINE_RATELIMIT_STATE(ratelimit_state
, 5 * HZ
, 10);
134 unsigned long *rmapp
;
135 struct kvm_mmu_page
*rev_sp
;
138 rev_sp
= page_header(__pa(sptep
));
139 gfn
= kvm_mmu_page_get_gfn(rev_sp
, sptep
- rev_sp
->spt
);
141 if (!gfn_to_memslot(kvm
, gfn
)) {
142 if (!__ratelimit(&ratelimit_state
))
144 audit_printk(kvm
, "no memslot for gfn %llx\n", gfn
);
145 audit_printk(kvm
, "index %ld of sp (gfn=%llx)\n",
146 (long int)(sptep
- rev_sp
->spt
), rev_sp
->gfn
);
151 rmapp
= gfn_to_rmap(kvm
, gfn
, rev_sp
->role
.level
);
153 if (!__ratelimit(&ratelimit_state
))
155 audit_printk(kvm
, "no rmap for writable spte %llx\n",
161 static void audit_sptes_have_rmaps(struct kvm_vcpu
*vcpu
, u64
*sptep
, int level
)
163 if (is_shadow_present_pte(*sptep
) && is_last_spte(*sptep
, level
))
164 inspect_spte_has_rmap(vcpu
->kvm
, sptep
);
167 static void audit_spte_after_sync(struct kvm_vcpu
*vcpu
, u64
*sptep
, int level
)
169 struct kvm_mmu_page
*sp
= page_header(__pa(sptep
));
171 if (vcpu
->kvm
->arch
.audit_point
== AUDIT_POST_SYNC
&& sp
->unsync
)
172 audit_printk(vcpu
->kvm
, "meet unsync sp(%p) after sync "
176 static void check_mappings_rmap(struct kvm
*kvm
, struct kvm_mmu_page
*sp
)
180 if (sp
->role
.level
!= PT_PAGE_TABLE_LEVEL
)
183 for (i
= 0; i
< PT64_ENT_PER_PAGE
; ++i
) {
184 if (!is_rmap_spte(sp
->spt
[i
]))
187 inspect_spte_has_rmap(kvm
, sp
->spt
+ i
);
191 static void audit_write_protection(struct kvm
*kvm
, struct kvm_mmu_page
*sp
)
193 struct kvm_memory_slot
*slot
;
194 unsigned long *rmapp
;
197 if (sp
->role
.direct
|| sp
->unsync
|| sp
->role
.invalid
)
200 slot
= gfn_to_memslot(kvm
, sp
->gfn
);
201 rmapp
= &slot
->rmap
[sp
->gfn
- slot
->base_gfn
];
203 spte
= rmap_next(kvm
, rmapp
, NULL
);
205 if (is_writable_pte(*spte
))
206 audit_printk(kvm
, "shadow page has writable "
207 "mappings: gfn %llx role %x\n",
208 sp
->gfn
, sp
->role
.word
);
209 spte
= rmap_next(kvm
, rmapp
, spte
);
213 static void audit_sp(struct kvm
*kvm
, struct kvm_mmu_page
*sp
)
215 check_mappings_rmap(kvm
, sp
);
216 audit_write_protection(kvm
, sp
);
219 static void audit_all_active_sps(struct kvm
*kvm
)
221 walk_all_active_sps(kvm
, audit_sp
);
224 static void audit_spte(struct kvm_vcpu
*vcpu
, u64
*sptep
, int level
)
226 audit_sptes_have_rmaps(vcpu
, sptep
, level
);
227 audit_mappings(vcpu
, sptep
, level
);
228 audit_spte_after_sync(vcpu
, sptep
, level
);
231 static void audit_vcpu_spte(struct kvm_vcpu
*vcpu
)
233 mmu_spte_walk(vcpu
, audit_spte
);
236 static bool mmu_audit
;
237 static struct jump_label_key mmu_audit_key
;
239 static void __kvm_mmu_audit(struct kvm_vcpu
*vcpu
, int point
)
241 static DEFINE_RATELIMIT_STATE(ratelimit_state
, 5 * HZ
, 10);
243 if (!__ratelimit(&ratelimit_state
))
246 vcpu
->kvm
->arch
.audit_point
= point
;
247 audit_all_active_sps(vcpu
->kvm
);
248 audit_vcpu_spte(vcpu
);
251 static inline void kvm_mmu_audit(struct kvm_vcpu
*vcpu
, int point
)
253 if (static_branch((&mmu_audit_key
)))
254 __kvm_mmu_audit(vcpu
, point
);
257 static void mmu_audit_enable(void)
262 jump_label_inc(&mmu_audit_key
);
266 static void mmu_audit_disable(void)
271 jump_label_dec(&mmu_audit_key
);
275 static int mmu_audit_set(const char *val
, const struct kernel_param
*kp
)
278 unsigned long enable
;
280 ret
= strict_strtoul(val
, 10, &enable
);
298 static struct kernel_param_ops audit_param_ops
= {
299 .set
= mmu_audit_set
,
300 .get
= param_get_bool
,
303 module_param_cb(mmu_audit
, &audit_param_ops
, &mmu_audit
, 0644);