plugin_kvm.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527
  1. // SPDX-License-Identifier: LGPL-2.1
  2. /*
  3. * Copyright (C) 2009 Red Hat Inc, Steven Rostedt <[email protected]>
  4. */
  5. #include <stdio.h>
  6. #include <stdlib.h>
  7. #include <string.h>
  8. #include <stdint.h>
  9. #include "event-parse.h"
  10. #include "trace-seq.h"
  11. #ifdef HAVE_UDIS86
  12. #include <udis86.h>
  13. static ud_t ud;
  14. static void init_disassembler(void)
  15. {
  16. ud_init(&ud);
  17. ud_set_syntax(&ud, UD_SYN_ATT);
  18. }
  19. static const char *disassemble(unsigned char *insn, int len, uint64_t rip,
  20. int cr0_pe, int eflags_vm,
  21. int cs_d, int cs_l)
  22. {
  23. int mode;
  24. if (!cr0_pe)
  25. mode = 16;
  26. else if (eflags_vm)
  27. mode = 16;
  28. else if (cs_l)
  29. mode = 64;
  30. else if (cs_d)
  31. mode = 32;
  32. else
  33. mode = 16;
  34. ud_set_pc(&ud, rip);
  35. ud_set_mode(&ud, mode);
  36. ud_set_input_buffer(&ud, insn, len);
  37. ud_disassemble(&ud);
  38. return ud_insn_asm(&ud);
  39. }
  40. #else
  41. static void init_disassembler(void)
  42. {
  43. }
  44. static const char *disassemble(unsigned char *insn, int len, uint64_t rip,
  45. int cr0_pe, int eflags_vm,
  46. int cs_d, int cs_l)
  47. {
  48. static char out[15*3+1];
  49. int i;
  50. for (i = 0; i < len; ++i)
  51. sprintf(out + i * 3, "%02x ", insn[i]);
  52. out[len*3-1] = '\0';
  53. return out;
  54. }
  55. #endif
  56. #define VMX_EXIT_REASONS \
  57. _ER(EXCEPTION_NMI, 0) \
  58. _ER(EXTERNAL_INTERRUPT, 1) \
  59. _ER(TRIPLE_FAULT, 2) \
  60. _ER(PENDING_INTERRUPT, 7) \
  61. _ER(NMI_WINDOW, 8) \
  62. _ER(TASK_SWITCH, 9) \
  63. _ER(CPUID, 10) \
  64. _ER(HLT, 12) \
  65. _ER(INVD, 13) \
  66. _ER(INVLPG, 14) \
  67. _ER(RDPMC, 15) \
  68. _ER(RDTSC, 16) \
  69. _ER(VMCALL, 18) \
  70. _ER(VMCLEAR, 19) \
  71. _ER(VMLAUNCH, 20) \
  72. _ER(VMPTRLD, 21) \
  73. _ER(VMPTRST, 22) \
  74. _ER(VMREAD, 23) \
  75. _ER(VMRESUME, 24) \
  76. _ER(VMWRITE, 25) \
  77. _ER(VMOFF, 26) \
  78. _ER(VMON, 27) \
  79. _ER(CR_ACCESS, 28) \
  80. _ER(DR_ACCESS, 29) \
  81. _ER(IO_INSTRUCTION, 30) \
  82. _ER(MSR_READ, 31) \
  83. _ER(MSR_WRITE, 32) \
  84. _ER(MWAIT_INSTRUCTION, 36) \
  85. _ER(MONITOR_INSTRUCTION, 39) \
  86. _ER(PAUSE_INSTRUCTION, 40) \
  87. _ER(MCE_DURING_VMENTRY, 41) \
  88. _ER(TPR_BELOW_THRESHOLD, 43) \
  89. _ER(APIC_ACCESS, 44) \
  90. _ER(EOI_INDUCED, 45) \
  91. _ER(EPT_VIOLATION, 48) \
  92. _ER(EPT_MISCONFIG, 49) \
  93. _ER(INVEPT, 50) \
  94. _ER(PREEMPTION_TIMER, 52) \
  95. _ER(WBINVD, 54) \
  96. _ER(XSETBV, 55) \
  97. _ER(APIC_WRITE, 56) \
  98. _ER(INVPCID, 58) \
  99. _ER(PML_FULL, 62) \
  100. _ER(XSAVES, 63) \
  101. _ER(XRSTORS, 64)
  102. #define SVM_EXIT_REASONS \
  103. _ER(EXIT_READ_CR0, 0x000) \
  104. _ER(EXIT_READ_CR3, 0x003) \
  105. _ER(EXIT_READ_CR4, 0x004) \
  106. _ER(EXIT_READ_CR8, 0x008) \
  107. _ER(EXIT_WRITE_CR0, 0x010) \
  108. _ER(EXIT_WRITE_CR3, 0x013) \
  109. _ER(EXIT_WRITE_CR4, 0x014) \
  110. _ER(EXIT_WRITE_CR8, 0x018) \
  111. _ER(EXIT_READ_DR0, 0x020) \
  112. _ER(EXIT_READ_DR1, 0x021) \
  113. _ER(EXIT_READ_DR2, 0x022) \
  114. _ER(EXIT_READ_DR3, 0x023) \
  115. _ER(EXIT_READ_DR4, 0x024) \
  116. _ER(EXIT_READ_DR5, 0x025) \
  117. _ER(EXIT_READ_DR6, 0x026) \
  118. _ER(EXIT_READ_DR7, 0x027) \
  119. _ER(EXIT_WRITE_DR0, 0x030) \
  120. _ER(EXIT_WRITE_DR1, 0x031) \
  121. _ER(EXIT_WRITE_DR2, 0x032) \
  122. _ER(EXIT_WRITE_DR3, 0x033) \
  123. _ER(EXIT_WRITE_DR4, 0x034) \
  124. _ER(EXIT_WRITE_DR5, 0x035) \
  125. _ER(EXIT_WRITE_DR6, 0x036) \
  126. _ER(EXIT_WRITE_DR7, 0x037) \
  127. _ER(EXIT_EXCP_DE, 0x040) \
  128. _ER(EXIT_EXCP_DB, 0x041) \
  129. _ER(EXIT_EXCP_BP, 0x043) \
  130. _ER(EXIT_EXCP_OF, 0x044) \
  131. _ER(EXIT_EXCP_BR, 0x045) \
  132. _ER(EXIT_EXCP_UD, 0x046) \
  133. _ER(EXIT_EXCP_NM, 0x047) \
  134. _ER(EXIT_EXCP_DF, 0x048) \
  135. _ER(EXIT_EXCP_TS, 0x04a) \
  136. _ER(EXIT_EXCP_NP, 0x04b) \
  137. _ER(EXIT_EXCP_SS, 0x04c) \
  138. _ER(EXIT_EXCP_GP, 0x04d) \
  139. _ER(EXIT_EXCP_PF, 0x04e) \
  140. _ER(EXIT_EXCP_MF, 0x050) \
  141. _ER(EXIT_EXCP_AC, 0x051) \
  142. _ER(EXIT_EXCP_MC, 0x052) \
  143. _ER(EXIT_EXCP_XF, 0x053) \
  144. _ER(EXIT_INTR, 0x060) \
  145. _ER(EXIT_NMI, 0x061) \
  146. _ER(EXIT_SMI, 0x062) \
  147. _ER(EXIT_INIT, 0x063) \
  148. _ER(EXIT_VINTR, 0x064) \
  149. _ER(EXIT_CR0_SEL_WRITE, 0x065) \
  150. _ER(EXIT_IDTR_READ, 0x066) \
  151. _ER(EXIT_GDTR_READ, 0x067) \
  152. _ER(EXIT_LDTR_READ, 0x068) \
  153. _ER(EXIT_TR_READ, 0x069) \
  154. _ER(EXIT_IDTR_WRITE, 0x06a) \
  155. _ER(EXIT_GDTR_WRITE, 0x06b) \
  156. _ER(EXIT_LDTR_WRITE, 0x06c) \
  157. _ER(EXIT_TR_WRITE, 0x06d) \
  158. _ER(EXIT_RDTSC, 0x06e) \
  159. _ER(EXIT_RDPMC, 0x06f) \
  160. _ER(EXIT_PUSHF, 0x070) \
  161. _ER(EXIT_POPF, 0x071) \
  162. _ER(EXIT_CPUID, 0x072) \
  163. _ER(EXIT_RSM, 0x073) \
  164. _ER(EXIT_IRET, 0x074) \
  165. _ER(EXIT_SWINT, 0x075) \
  166. _ER(EXIT_INVD, 0x076) \
  167. _ER(EXIT_PAUSE, 0x077) \
  168. _ER(EXIT_HLT, 0x078) \
  169. _ER(EXIT_INVLPG, 0x079) \
  170. _ER(EXIT_INVLPGA, 0x07a) \
  171. _ER(EXIT_IOIO, 0x07b) \
  172. _ER(EXIT_MSR, 0x07c) \
  173. _ER(EXIT_TASK_SWITCH, 0x07d) \
  174. _ER(EXIT_FERR_FREEZE, 0x07e) \
  175. _ER(EXIT_SHUTDOWN, 0x07f) \
  176. _ER(EXIT_VMRUN, 0x080) \
  177. _ER(EXIT_VMMCALL, 0x081) \
  178. _ER(EXIT_VMLOAD, 0x082) \
  179. _ER(EXIT_VMSAVE, 0x083) \
  180. _ER(EXIT_STGI, 0x084) \
  181. _ER(EXIT_CLGI, 0x085) \
  182. _ER(EXIT_SKINIT, 0x086) \
  183. _ER(EXIT_RDTSCP, 0x087) \
  184. _ER(EXIT_ICEBP, 0x088) \
  185. _ER(EXIT_WBINVD, 0x089) \
  186. _ER(EXIT_MONITOR, 0x08a) \
  187. _ER(EXIT_MWAIT, 0x08b) \
  188. _ER(EXIT_MWAIT_COND, 0x08c) \
  189. _ER(EXIT_XSETBV, 0x08d) \
  190. _ER(EXIT_NPF, 0x400) \
  191. _ER(EXIT_AVIC_INCOMPLETE_IPI, 0x401) \
  192. _ER(EXIT_AVIC_UNACCELERATED_ACCESS, 0x402) \
  193. _ER(EXIT_ERR, -1)
  194. #define _ER(reason, val) { #reason, val },
  195. struct str_values {
  196. const char *str;
  197. int val;
  198. };
  199. static struct str_values vmx_exit_reasons[] = {
  200. VMX_EXIT_REASONS
  201. { NULL, -1}
  202. };
  203. static struct str_values svm_exit_reasons[] = {
  204. SVM_EXIT_REASONS
  205. { NULL, -1}
  206. };
  207. static struct isa_exit_reasons {
  208. unsigned isa;
  209. struct str_values *strings;
  210. } isa_exit_reasons[] = {
  211. { .isa = 1, .strings = vmx_exit_reasons },
  212. { .isa = 2, .strings = svm_exit_reasons },
  213. { }
  214. };
  215. static const char *find_exit_reason(unsigned isa, int val)
  216. {
  217. struct str_values *strings = NULL;
  218. int i;
  219. for (i = 0; isa_exit_reasons[i].strings; ++i)
  220. if (isa_exit_reasons[i].isa == isa) {
  221. strings = isa_exit_reasons[i].strings;
  222. break;
  223. }
  224. if (!strings)
  225. return "UNKNOWN-ISA";
  226. for (i = 0; strings[i].str; i++)
  227. if (strings[i].val == val)
  228. break;
  229. return strings[i].str;
  230. }
  231. static int print_exit_reason(struct trace_seq *s, struct tep_record *record,
  232. struct tep_event *event, const char *field)
  233. {
  234. unsigned long long isa;
  235. unsigned long long val;
  236. const char *reason;
  237. if (tep_get_field_val(s, event, field, record, &val, 1) < 0)
  238. return -1;
  239. if (tep_get_field_val(s, event, "isa", record, &isa, 0) < 0)
  240. isa = 1;
  241. reason = find_exit_reason(isa, val);
  242. if (reason)
  243. trace_seq_printf(s, "reason %s", reason);
  244. else
  245. trace_seq_printf(s, "reason UNKNOWN (%llu)", val);
  246. return 0;
  247. }
  248. static int kvm_exit_handler(struct trace_seq *s, struct tep_record *record,
  249. struct tep_event *event, void *context)
  250. {
  251. unsigned long long info1 = 0, info2 = 0;
  252. if (print_exit_reason(s, record, event, "exit_reason") < 0)
  253. return -1;
  254. tep_print_num_field(s, " rip 0x%lx", event, "guest_rip", record, 1);
  255. if (tep_get_field_val(s, event, "info1", record, &info1, 0) >= 0
  256. && tep_get_field_val(s, event, "info2", record, &info2, 0) >= 0)
  257. trace_seq_printf(s, " info %llx %llx", info1, info2);
  258. return 0;
  259. }
  260. #define KVM_EMUL_INSN_F_CR0_PE (1 << 0)
  261. #define KVM_EMUL_INSN_F_EFL_VM (1 << 1)
  262. #define KVM_EMUL_INSN_F_CS_D (1 << 2)
  263. #define KVM_EMUL_INSN_F_CS_L (1 << 3)
  264. static int kvm_emulate_insn_handler(struct trace_seq *s,
  265. struct tep_record *record,
  266. struct tep_event *event, void *context)
  267. {
  268. unsigned long long rip, csbase, len, flags, failed;
  269. int llen;
  270. uint8_t *insn;
  271. const char *disasm;
  272. if (tep_get_field_val(s, event, "rip", record, &rip, 1) < 0)
  273. return -1;
  274. if (tep_get_field_val(s, event, "csbase", record, &csbase, 1) < 0)
  275. return -1;
  276. if (tep_get_field_val(s, event, "len", record, &len, 1) < 0)
  277. return -1;
  278. if (tep_get_field_val(s, event, "flags", record, &flags, 1) < 0)
  279. return -1;
  280. if (tep_get_field_val(s, event, "failed", record, &failed, 1) < 0)
  281. return -1;
  282. insn = tep_get_field_raw(s, event, "insn", record, &llen, 1);
  283. if (!insn)
  284. return -1;
  285. disasm = disassemble(insn, len, rip,
  286. flags & KVM_EMUL_INSN_F_CR0_PE,
  287. flags & KVM_EMUL_INSN_F_EFL_VM,
  288. flags & KVM_EMUL_INSN_F_CS_D,
  289. flags & KVM_EMUL_INSN_F_CS_L);
  290. trace_seq_printf(s, "%llx:%llx: %s%s", csbase, rip, disasm,
  291. failed ? " FAIL" : "");
  292. return 0;
  293. }
  294. static int kvm_nested_vmexit_inject_handler(struct trace_seq *s, struct tep_record *record,
  295. struct tep_event *event, void *context)
  296. {
  297. if (print_exit_reason(s, record, event, "exit_code") < 0)
  298. return -1;
  299. tep_print_num_field(s, " info1 %llx", event, "exit_info1", record, 1);
  300. tep_print_num_field(s, " info2 %llx", event, "exit_info2", record, 1);
  301. tep_print_num_field(s, " int_info %llx", event, "exit_int_info", record, 1);
  302. tep_print_num_field(s, " int_info_err %llx", event, "exit_int_info_err", record, 1);
  303. return 0;
  304. }
  305. static int kvm_nested_vmexit_handler(struct trace_seq *s, struct tep_record *record,
  306. struct tep_event *event, void *context)
  307. {
  308. tep_print_num_field(s, "rip %llx ", event, "rip", record, 1);
  309. return kvm_nested_vmexit_inject_handler(s, record, event, context);
  310. }
  311. union kvm_mmu_page_role {
  312. unsigned word;
  313. struct {
  314. unsigned level:4;
  315. unsigned cr4_pae:1;
  316. unsigned quadrant:2;
  317. unsigned direct:1;
  318. unsigned access:3;
  319. unsigned invalid:1;
  320. unsigned efer_nx:1;
  321. unsigned cr0_wp:1;
  322. unsigned smep_and_not_wp:1;
  323. unsigned smap_and_not_wp:1;
  324. unsigned pad_for_nice_hex_output:8;
  325. unsigned smm:8;
  326. };
  327. };
  328. static int kvm_mmu_print_role(struct trace_seq *s, struct tep_record *record,
  329. struct tep_event *event, void *context)
  330. {
  331. unsigned long long val;
  332. static const char *access_str[] = {
  333. "---", "--x", "w--", "w-x", "-u-", "-ux", "wu-", "wux"
  334. };
  335. union kvm_mmu_page_role role;
  336. if (tep_get_field_val(s, event, "role", record, &val, 1) < 0)
  337. return -1;
  338. role.word = (int)val;
  339. /*
  340. * We can only use the structure if file is of the same
  341. * endianness.
  342. */
  343. if (tep_is_file_bigendian(event->tep) ==
  344. tep_is_local_bigendian(event->tep)) {
  345. trace_seq_printf(s, "%u q%u%s %s%s %spae %snxe %swp%s%s%s",
  346. role.level,
  347. role.quadrant,
  348. role.direct ? " direct" : "",
  349. access_str[role.access],
  350. role.invalid ? " invalid" : "",
  351. role.cr4_pae ? "" : "!",
  352. role.efer_nx ? "" : "!",
  353. role.cr0_wp ? "" : "!",
  354. role.smep_and_not_wp ? " smep" : "",
  355. role.smap_and_not_wp ? " smap" : "",
  356. role.smm ? " smm" : "");
  357. } else
  358. trace_seq_printf(s, "WORD: %08x", role.word);
  359. tep_print_num_field(s, " root %u ", event,
  360. "root_count", record, 1);
  361. if (tep_get_field_val(s, event, "unsync", record, &val, 1) < 0)
  362. return -1;
  363. trace_seq_printf(s, "%s%c", val ? "unsync" : "sync", 0);
  364. return 0;
  365. }
  366. static int kvm_mmu_get_page_handler(struct trace_seq *s,
  367. struct tep_record *record,
  368. struct tep_event *event, void *context)
  369. {
  370. unsigned long long val;
  371. if (tep_get_field_val(s, event, "created", record, &val, 1) < 0)
  372. return -1;
  373. trace_seq_printf(s, "%s ", val ? "new" : "existing");
  374. if (tep_get_field_val(s, event, "gfn", record, &val, 1) < 0)
  375. return -1;
  376. trace_seq_printf(s, "sp gfn %llx ", val);
  377. return kvm_mmu_print_role(s, record, event, context);
  378. }
  379. #define PT_WRITABLE_SHIFT 1
  380. #define PT_WRITABLE_MASK (1ULL << PT_WRITABLE_SHIFT)
  381. static unsigned long long
  382. process_is_writable_pte(struct trace_seq *s, unsigned long long *args)
  383. {
  384. unsigned long pte = args[0];
  385. return pte & PT_WRITABLE_MASK;
  386. }
  387. int TEP_PLUGIN_LOADER(struct tep_handle *tep)
  388. {
  389. init_disassembler();
  390. tep_register_event_handler(tep, -1, "kvm", "kvm_exit",
  391. kvm_exit_handler, NULL);
  392. tep_register_event_handler(tep, -1, "kvm", "kvm_emulate_insn",
  393. kvm_emulate_insn_handler, NULL);
  394. tep_register_event_handler(tep, -1, "kvm", "kvm_nested_vmexit",
  395. kvm_nested_vmexit_handler, NULL);
  396. tep_register_event_handler(tep, -1, "kvm", "kvm_nested_vmexit_inject",
  397. kvm_nested_vmexit_inject_handler, NULL);
  398. tep_register_event_handler(tep, -1, "kvmmmu", "kvm_mmu_get_page",
  399. kvm_mmu_get_page_handler, NULL);
  400. tep_register_event_handler(tep, -1, "kvmmmu", "kvm_mmu_sync_page",
  401. kvm_mmu_print_role, NULL);
  402. tep_register_event_handler(tep, -1,
  403. "kvmmmu", "kvm_mmu_unsync_page",
  404. kvm_mmu_print_role, NULL);
  405. tep_register_event_handler(tep, -1, "kvmmmu", "kvm_mmu_zap_page",
  406. kvm_mmu_print_role, NULL);
  407. tep_register_event_handler(tep, -1, "kvmmmu",
  408. "kvm_mmu_prepare_zap_page", kvm_mmu_print_role,
  409. NULL);
  410. tep_register_print_function(tep,
  411. process_is_writable_pte,
  412. TEP_FUNC_ARG_INT,
  413. "is_writable_pte",
  414. TEP_FUNC_ARG_LONG,
  415. TEP_FUNC_ARG_VOID);
  416. return 0;
  417. }
  418. void TEP_PLUGIN_UNLOADER(struct tep_handle *tep)
  419. {
  420. tep_unregister_event_handler(tep, -1, "kvm", "kvm_exit",
  421. kvm_exit_handler, NULL);
  422. tep_unregister_event_handler(tep, -1, "kvm", "kvm_emulate_insn",
  423. kvm_emulate_insn_handler, NULL);
  424. tep_unregister_event_handler(tep, -1, "kvm", "kvm_nested_vmexit",
  425. kvm_nested_vmexit_handler, NULL);
  426. tep_unregister_event_handler(tep, -1, "kvm", "kvm_nested_vmexit_inject",
  427. kvm_nested_vmexit_inject_handler, NULL);
  428. tep_unregister_event_handler(tep, -1, "kvmmmu", "kvm_mmu_get_page",
  429. kvm_mmu_get_page_handler, NULL);
  430. tep_unregister_event_handler(tep, -1, "kvmmmu", "kvm_mmu_sync_page",
  431. kvm_mmu_print_role, NULL);
  432. tep_unregister_event_handler(tep, -1,
  433. "kvmmmu", "kvm_mmu_unsync_page",
  434. kvm_mmu_print_role, NULL);
  435. tep_unregister_event_handler(tep, -1, "kvmmmu", "kvm_mmu_zap_page",
  436. kvm_mmu_print_role, NULL);
  437. tep_unregister_event_handler(tep, -1, "kvmmmu",
  438. "kvm_mmu_prepare_zap_page", kvm_mmu_print_role,
  439. NULL);
  440. tep_unregister_print_function(tep, process_is_writable_pte,
  441. "is_writable_pte");
  442. }