Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1199675 > unrolled thread

[PATCH 0/9] KVM: MMU: fix and improve validation of mmio page fault

Back to article view | Back to linux.kernel

Contents

  [PATCH 0/9] KVM: MMU: fix and improve validation of mmio page fault Xiao Guangrong <guangrong.xiao@linux.intel.com> - 2015-08-04 13:10 +0200
    Re: [PATCH 0/9] KVM: MMU: fix and improve validation of mmio page  fault Xiao Guangrong <guangrong.xiao@linux.intel.com> - 2015-08-04 13:20 +0200

#1199675 — [PATCH 0/9] KVM: MMU: fix and improve validation of mmio page fault

Current code validating mmio #PF is buggy, it was spotted by Pavel
Shirshov, the bug is that qemu complained with "KVM: unknown exit,
hardware reason 31" and KVM shown these info:
[84245.284948] EPT: Misconfiguration.
[84245.285056] EPT: GPA: 0xfeda848
[84245.285154] ept_misconfig_inspect_spte: spte 0x5eaef50107 level 4
[84245.285344] ept_misconfig_inspect_spte: spte 0x5f5fadc107 level 3
[84245.285532] ept_misconfig_inspect_spte: spte 0x5141d18107 level 2
[84245.285723] ept_misconfig_inspect_spte: spte 0x52e40dad77 level 1

This is because we got a mmio #PF and the handler see the mmio spte
becomes normal (points to the ram page)

However, this is valid after introducing fast mmio spte invalidation which
increases the generation-number instead of zapping mmio sptes, a example
is as follows:
1. QEMU drops mmio region by adding a new memslot
2. invalidate all mmio sptes
3.

        VCPU 0                        VCPU 1
    access the invalid mmio spte
    
                            access the region originally was MMIO before
                            set the spte to the normal ram map

    mmio #PF
    check the spte and see it becomes normal ram mapping !!!

The first patch simply fixes the bug by dropping the validation in mmio
handler which is good for backport

Later patches enable fully check reserved bits for shadow page table
entries, since shadow page table and guest page table have the some
format, this patches reuse the logic which checks reserved bits on
guest pte to check sptes

Xiao Guangrong (9):
  KVM: MMU: fix validation of mmio page fault
  KVM: MMU: move FNAME(is_rsvd_bits_set) to mmu.c
  KVM: MMU: introduce rsvd_bits_validate
  KVM: MMU: split reset_rsvds_bits_mask
  KVM: MMU: split reset_rsvds_bits_mask_ept
  KVM: MMU: introduce the framework to check reserved bits on sptes
  KVM: MMU: introduce is_shadow_rsvd_bits_set()
  KVM: MMU: fully check reserved bits for sptes
  KVM: VMX: drop ept misconfig check

 arch/x86/include/asm/kvm_host.h |   9 +-
 arch/x86/kvm/mmu.c              | 284 ++++++++++++++++++++++++----------------
 arch/x86/kvm/mmu.h              |   4 +-
 arch/x86/kvm/paging_tmpl.h      |  13 +-
 arch/x86/kvm/svm.c              |   1 +
 arch/x86/kvm/vmx.c              |  74 +----------
 arch/x86/kvm/x86.c              |   3 +-
 7 files changed, 187 insertions(+), 201 deletions(-)

-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1199682 — Re: [PATCH 0/9] KVM: MMU: fix and improve validation of mmio page fault

CCed Pavel Shirshov <ru.pchel@gmail.com>

Sorry, git tool missed to CC mail to the person tagged with "Reported-by"
and "Tested-by". :(

On 08/04/2015 06:59 PM, Xiao Guangrong wrote:
> Current code validating mmio #PF is buggy, it was spotted by Pavel
> Shirshov, the bug is that qemu complained with "KVM: unknown exit,
> hardware reason 31" and KVM shown these info:
> [84245.284948] EPT: Misconfiguration.
> [84245.285056] EPT: GPA: 0xfeda848
> [84245.285154] ept_misconfig_inspect_spte: spte 0x5eaef50107 level 4
> [84245.285344] ept_misconfig_inspect_spte: spte 0x5f5fadc107 level 3
> [84245.285532] ept_misconfig_inspect_spte: spte 0x5141d18107 level 2
> [84245.285723] ept_misconfig_inspect_spte: spte 0x52e40dad77 level 1
>
> This is because we got a mmio #PF and the handler see the mmio spte
> becomes normal (points to the ram page)
>
> However, this is valid after introducing fast mmio spte invalidation which
> increases the generation-number instead of zapping mmio sptes, a example
> is as follows:
> 1. QEMU drops mmio region by adding a new memslot
> 2. invalidate all mmio sptes
> 3.
>
>          VCPU 0                        VCPU 1
>      access the invalid mmio spte
>
>                              access the region originally was MMIO before
>                              set the spte to the normal ram map
>
>      mmio #PF
>      check the spte and see it becomes normal ram mapping !!!
>
> The first patch simply fixes the bug by dropping the validation in mmio
> handler which is good for backport
>
> Later patches enable fully check reserved bits for shadow page table
> entries, since shadow page table and guest page table have the some
> format, this patches reuse the logic which checks reserved bits on
> guest pte to check sptes
>
> Xiao Guangrong (9):
>    KVM: MMU: fix validation of mmio page fault
>    KVM: MMU: move FNAME(is_rsvd_bits_set) to mmu.c
>    KVM: MMU: introduce rsvd_bits_validate
>    KVM: MMU: split reset_rsvds_bits_mask
>    KVM: MMU: split reset_rsvds_bits_mask_ept
>    KVM: MMU: introduce the framework to check reserved bits on sptes
>    KVM: MMU: introduce is_shadow_rsvd_bits_set()
>    KVM: MMU: fully check reserved bits for sptes
>    KVM: VMX: drop ept misconfig check
>
>   arch/x86/include/asm/kvm_host.h |   9 +-
>   arch/x86/kvm/mmu.c              | 284 ++++++++++++++++++++++++----------------
>   arch/x86/kvm/mmu.h              |   4 +-
>   arch/x86/kvm/paging_tmpl.h      |  13 +-
>   arch/x86/kvm/svm.c              |   1 +
>   arch/x86/kvm/vmx.c              |  74 +----------
>   arch/x86/kvm/x86.c              |   3 +-
>   7 files changed, 187 insertions(+), 201 deletions(-)
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web