From: Xiao Guangrong <guangrong.xiao@linux.intel.com>
To: pbonzini@redhat.com
Cc: gleb@kernel.org, mtosatti@redhat.com, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, ru.pchel@gmail.com,
Xiao Guangrong <guangrong.xiao@linux.intel.com>
Subject: [PATCH v2 0/9] KVM: MMU: fix and improve validation of mmio page fault
Date: Wed, 5 Aug 2015 12:04:18 +0800 [thread overview]
Message-ID: <1438747467-25425-1-git-send-email-guangrong.xiao@linux.intel.com> (raw)
Changelog in v2:
- rename reset_*_rsvds_bits_mask() to reset_*_zero_bits_mask() and
is_shadow_rsvd_bits_set() to is_shadow_zero_bits_set() to better
match what we are checking. Thanks for Paolo's suggestion.
Current code validating mmio #PF is buggy, it was spotted by Pavel
Shirshov, the bug is that qemu complained with "KVM: unknown exit,
hardware reason 31" and KVM shown these info:
[84245.284948] EPT: Misconfiguration.
[84245.285056] EPT: GPA: 0xfeda848
[84245.285154] ept_misconfig_inspect_spte: spte 0x5eaef50107 level 4
[84245.285344] ept_misconfig_inspect_spte: spte 0x5f5fadc107 level 3
[84245.285532] ept_misconfig_inspect_spte: spte 0x5141d18107 level 2
[84245.285723] ept_misconfig_inspect_spte: spte 0x52e40dad77 level 1
This is because we got a mmio #PF and the handler see the mmio spte
becomes normal (points to the ram page)
However, this is valid after introducing fast mmio spte invalidation which
increases the generation-number instead of zapping mmio sptes, a example
is as follows:
1. QEMU drops mmio region by adding a new memslot
2. invalidate all mmio sptes
3.
VCPU 0 VCPU 1
access the invalid mmio spte
access the region originally was MMIO before
set the spte to the normal ram map
mmio #PF
check the spte and see it becomes normal ram mapping !!!
The first patch simply fixes the bug by dropping the validation in mmio
handler which is good for backport
Later patches enable fully check reserved bits for shadow page table
entries, since shadow page table and guest page table have the some
format, this patches reuse the logic which checks reserved bits on
guest pte to check sptes
In order to catching as many bugs as possible, we not only check the
reserved bits on hardware but also check other bits that spte never used
Xiao Guangrong (9):
KVM: MMU: fix validation of mmio page fault
KVM: MMU: move FNAME(is_rsvd_bits_set) to mmu.c
KVM: MMU: introduce rsvd_bits_validate
KVM: MMU: split reset_rsvds_bits_mask
KVM: MMU: split reset_rsvds_bits_mask_ept
KVM: MMU: introduce the framework to check zero bits on sptes
KVM: MMU: introduce is_shadow_zero_bits_set()
KVM: MMU: fully check zero bits for sptes
KVM: VMX: drop ept misconfig check
arch/x86/include/asm/kvm_host.h | 16 ++-
arch/x86/kvm/mmu.c | 283 ++++++++++++++++++++++++----------------
arch/x86/kvm/mmu.h | 4 +-
arch/x86/kvm/paging_tmpl.h | 13 +-
arch/x86/kvm/svm.c | 1 +
arch/x86/kvm/vmx.c | 74 +----------
arch/x86/kvm/x86.c | 3 +-
7 files changed, 193 insertions(+), 201 deletions(-)
--
2.1.0
next reply other threads:[~2015-08-05 4:10 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-05 4:04 Xiao Guangrong [this message]
2015-08-05 4:04 ` [PATCH v2 1/9] KVM: MMU: fix validation of mmio page fault Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 2/9] KVM: MMU: move FNAME(is_rsvd_bits_set) to mmu.c Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 3/9] KVM: MMU: introduce rsvd_bits_validate Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 4/9] KVM: MMU: split reset_rsvds_bits_mask Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 5/9] KVM: MMU: split reset_rsvds_bits_mask_ept Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 6/9] KVM: MMU: introduce the framework to check zero bits on sptes Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 7/9] KVM: MMU: introduce is_shadow_zero_bits_set() Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 8/9] KVM: MMU: fully check zero bits for sptes Xiao Guangrong
2015-08-05 10:12 ` Paolo Bonzini
2015-08-06 2:53 ` Xiao Guangrong
2015-08-05 4:04 ` [PATCH v2 9/9] KVM: VMX: drop ept misconfig check Xiao Guangrong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1438747467-25425-1-git-send-email-guangrong.xiao@linux.intel.com \
--to=guangrong.xiao@linux.intel.com \
--cc=gleb@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mtosatti@redhat.com \
--cc=pbonzini@redhat.com \
--cc=ru.pchel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.