| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <ZddlbkG9j8UjhaWs@google.com>
Date: Thu, 22 Feb 2024 15:17:02 +0000
From: Sebastian Ene <sebastianene@...gle.com>
To: catalin.marinas@....com, gshan@...hat.com, james.morse@....com,
mark.rutland@....com, maz@...nel.org, oliver.upton@...ux.dev,
rananta@...gle.com, ricarkol@...gle.com, ryan.roberts@....com,
shahuang@...hat.com, suzuki.poulose@....com, will@...nel.org,
yuzenghui@...wei.com
Cc: kvmarm@...ts.linux.dev, linux-arm-kernel@...ts.infradead.org,
linux-kernel@...r.kernel.org, kernel-team@...roid.com,
vdonnefort@...gle.com
Subject: Re: [PATCH v6 4/6] KVM: arm64: Register ptdump with debugfs on guest
creation
On Tue, Feb 20, 2024 at 03:10:33PM +0000, Sebastian Ene wrote:
> While arch/*/mem/ptdump handles the kernel pagetable dumping code,
> introduce KVM/ptdump which shows the guest stage-2 pagetables. The
> separation is necessary because most of the definitions from the
> stage-2 pagetable reside in the KVM path and we will be invoking
> functionality **specific** to KVM.
>
> When a guest is created, register a new file entry under the guest
> debugfs dir which allows userspace to show the contents of the guest
> stage-2 pagetables when accessed.
>
> Signed-off-by: Sebastian Ene <sebastianene@...gle.com>
> ---
> arch/arm64/kvm/Kconfig | 13 ++++++
> arch/arm64/kvm/Makefile | 1 +
> arch/arm64/kvm/debug.c | 8 ++++
> arch/arm64/kvm/kvm_ptdump.h | 20 +++++++++
> arch/arm64/kvm/ptdump.c | 88 +++++++++++++++++++++++++++++++++++++
> 5 files changed, 130 insertions(+)
> create mode 100644 arch/arm64/kvm/kvm_ptdump.h
> create mode 100644 arch/arm64/kvm/ptdump.c
>
> diff --git a/arch/arm64/kvm/Kconfig b/arch/arm64/kvm/Kconfig
> index 27ca89b628a0..83ca07d16cf4 100644
> --- a/arch/arm64/kvm/Kconfig
> +++ b/arch/arm64/kvm/Kconfig
> @@ -67,4 +67,17 @@ config PROTECTED_NVHE_STACKTRACE
>
> If unsure, or not using protected nVHE (pKVM), say N.
>
> +config PTDUMP_STAGE2_DEBUGFS
> + bool "Present the stage-2 pagetables to debugfs"
> + depends on PTDUMP_DEBUGFS && KVM
> + default n
> + help
> + Say Y here if you want to show the stage-2 kernel pagetables
> + layout in a debugfs file. This information is only useful for kernel developers
> + who are working in architecture specific areas of the kernel.
> + It is probably not a good idea to enable this feature in a production
> + kernel.
> +
> + If in doubt, say N.
> +
> endif # VIRTUALIZATION
> diff --git a/arch/arm64/kvm/Makefile b/arch/arm64/kvm/Makefile
> index c0c050e53157..190eac17538c 100644
> --- a/arch/arm64/kvm/Makefile
> +++ b/arch/arm64/kvm/Makefile
> @@ -23,6 +23,7 @@ kvm-y += arm.o mmu.o mmio.o psci.o hypercalls.o pvtime.o \
> vgic/vgic-its.o vgic/vgic-debug.o
>
> kvm-$(CONFIG_HW_PERF_EVENTS) += pmu-emul.o pmu.o
> +kvm-$(CONFIG_PTDUMP_STAGE2_DEBUGFS) += ptdump.o
>
> always-y := hyp_constants.h hyp-constants.s
>
> diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
> index 8725291cb00a..ff97af2c0513 100644
> --- a/arch/arm64/kvm/debug.c
> +++ b/arch/arm64/kvm/debug.c
> @@ -14,6 +14,8 @@
> #include <asm/kvm_arm.h>
> #include <asm/kvm_emulate.h>
>
> +#include <kvm_ptdump.h>
> +
> #include "trace.h"
>
> /* These are the bits of MDSCR_EL1 we may manipulate */
> @@ -342,3 +344,9 @@ void kvm_arch_vcpu_put_debug_state_flags(struct kvm_vcpu *vcpu)
> vcpu_clear_flag(vcpu, DEBUG_STATE_SAVE_SPE);
> vcpu_clear_flag(vcpu, DEBUG_STATE_SAVE_TRBE);
> }
> +
> +int kvm_arch_create_vm_debugfs(struct kvm *kvm)
> +{
> + kvm_ptdump_guest_register(kvm);
> + return 0;
> +}
> diff --git a/arch/arm64/kvm/kvm_ptdump.h b/arch/arm64/kvm/kvm_ptdump.h
> new file mode 100644
> index 000000000000..5e8a655605f1
> --- /dev/null
> +++ b/arch/arm64/kvm/kvm_ptdump.h
> @@ -0,0 +1,20 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Copyright (C) Google, 2023
> + * Author: Sebastian Ene <sebastianene@...gle.com>
> + */
> +
> +#ifndef __KVM_PTDUMP_H
> +#define __KVM_PTDUMP_H
> +
> +#include <linux/kvm_host.h>
> +#include <asm/ptdump.h>
> +
> +
> +#ifdef CONFIG_PTDUMP_STAGE2_DEBUGFS
> +void kvm_ptdump_guest_register(struct kvm *kvm);
> +#else
> +static inline void kvm_ptdump_guest_register(struct kvm *kvm) {}
> +#endif /* CONFIG_PTDUMP_STAGE2_DEBUGFS */
> +
> +#endif /* __KVM_PTDUMP_H */
> diff --git a/arch/arm64/kvm/ptdump.c b/arch/arm64/kvm/ptdump.c
> new file mode 100644
> index 000000000000..9b04c24bb9be
> --- /dev/null
> +++ b/arch/arm64/kvm/ptdump.c
> @@ -0,0 +1,88 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Debug helper used to dump the stage-2 pagetables of the system and their
> + * associated permissions.
> + *
> + * Copyright (C) Google, 2023
> + * Author: Sebastian Ene <sebastianene@...gle.com>
> + */
> +#include <linux/debugfs.h>
> +#include <linux/kvm_host.h>
> +#include <linux/seq_file.h>
> +
> +#include <asm/kvm_pgtable.h>
> +#include <kvm_ptdump.h>
> +
> +
> +static int kvm_ptdump_visitor(const struct kvm_pgtable_visit_ctx *ctx,
> + enum kvm_pgtable_walk_flags visit)
> +{
> + struct pg_state *st = ctx->arg;
> + struct ptdump_state *pt_st = &st->ptdump;
> +
> + note_page(pt_st, ctx->addr, ctx->level, ctx->old);
> + return 0;
> +}
> +
> +static int kvm_ptdump_show_common(struct seq_file *m,
> + struct kvm_pgtable *pgtable,
> + struct pg_state *parser_state)
> +{
> + struct kvm_pgtable_walker walker = (struct kvm_pgtable_walker) {
> + .cb = kvm_ptdump_visitor,
> + .arg = parser_state,
> + .flags = KVM_PGTABLE_WALK_LEAF,
> + };
> +
> + return kvm_pgtable_walk(pgtable, 0, BIT(pgtable->ia_bits), &walker);
> +}
> +
> +static int kvm_ptdump_guest_show(struct seq_file *m, void *)
^
FIXME: Here I need to specify an argument name as building with clang
complaints about this.
> +{
> + struct kvm *kvm = m->private;
> + struct kvm_s2_mmu *mmu = &kvm->arch.mmu;
> + struct pg_state parser_state = {0};
> + int ret;
> +
> + write_lock(&kvm->mmu_lock);
> + ret = kvm_ptdump_show_common(m, mmu->pgt, &parser_state);
> + write_unlock(&kvm->mmu_lock);
> +
> + return ret;
> +}
> +
> +static int kvm_ptdump_guest_open(struct inode *m, struct file *file)
> +{
> + struct kvm *kvm = m->i_private;
> + int ret;
> +
> + if (!kvm_get_kvm_safe(kvm))
> + return -ENOENT;
> +
> + ret = single_open(file, kvm_ptdump_guest_show, m->i_private);
> + if (ret < 0)
> + kvm_put_kvm(kvm);
> +
> + return ret;
> +}
> +
> +static int kvm_ptdump_guest_close(struct inode *m, struct file *file)
> +{
> + struct kvm *kvm = m->i_private;
> +
> + kvm_put_kvm(kvm);
> + return single_release(m, file);
> +}
> +
> +static const struct file_operations kvm_ptdump_guest_fops = {
> + .open = kvm_ptdump_guest_open,
> + .read = seq_read,
> + .llseek = seq_lseek,
> + .release = kvm_ptdump_guest_close,
> +};
> +
> +void kvm_ptdump_guest_register(struct kvm *kvm)
> +{
> + debugfs_create_file("stage2_page_tables", 0400, kvm->debugfs_dentry,
> + kvm, &kvm_ptdump_guest_fops);
> +}
> --
> 2.44.0.rc0.258.g7320e95886-goog
>
Powered by blists - more mailing lists