Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933340AbbHDLFD (ORCPT ); Tue, 4 Aug 2015 07:05:03 -0400 Received: from mga03.intel.com ([134.134.136.65]:21893 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932999AbbHDLE7 (ORCPT ); Tue, 4 Aug 2015 07:04:59 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.15,608,1432623600"; d="scan'208";a="741839408" From: Xiao Guangrong To: pbonzini@redhat.com Cc: gleb@kernel.org, mtosatti@redhat.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Xiao Guangrong Subject: [PATCH 0/9] KVM: MMU: fix and improve validation of mmio page fault Date: Tue, 4 Aug 2015 18:59:12 +0800 Message-Id: <1438685961-8107-1-git-send-email-guangrong.xiao@linux.intel.com> X-Mailer: git-send-email 2.1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2612 Lines: 65 Current code validating mmio #PF is buggy, it was spotted by Pavel Shirshov, the bug is that qemu complained with "KVM: unknown exit, hardware reason 31" and KVM shown these info: [84245.284948] EPT: Misconfiguration. [84245.285056] EPT: GPA: 0xfeda848 [84245.285154] ept_misconfig_inspect_spte: spte 0x5eaef50107 level 4 [84245.285344] ept_misconfig_inspect_spte: spte 0x5f5fadc107 level 3 [84245.285532] ept_misconfig_inspect_spte: spte 0x5141d18107 level 2 [84245.285723] ept_misconfig_inspect_spte: spte 0x52e40dad77 level 1 This is because we got a mmio #PF and the handler see the mmio spte becomes normal (points to the ram page) However, this is valid after introducing fast mmio spte invalidation which increases the generation-number instead of zapping mmio sptes, a example is as follows: 1. QEMU drops mmio region by adding a new memslot 2. invalidate all mmio sptes 3. VCPU 0 VCPU 1 access the invalid mmio spte access the region originally was MMIO before set the spte to the normal ram map mmio #PF check the spte and see it becomes normal ram mapping !!! The first patch simply fixes the bug by dropping the validation in mmio handler which is good for backport Later patches enable fully check reserved bits for shadow page table entries, since shadow page table and guest page table have the some format, this patches reuse the logic which checks reserved bits on guest pte to check sptes Xiao Guangrong (9): KVM: MMU: fix validation of mmio page fault KVM: MMU: move FNAME(is_rsvd_bits_set) to mmu.c KVM: MMU: introduce rsvd_bits_validate KVM: MMU: split reset_rsvds_bits_mask KVM: MMU: split reset_rsvds_bits_mask_ept KVM: MMU: introduce the framework to check reserved bits on sptes KVM: MMU: introduce is_shadow_rsvd_bits_set() KVM: MMU: fully check reserved bits for sptes KVM: VMX: drop ept misconfig check arch/x86/include/asm/kvm_host.h | 9 +- arch/x86/kvm/mmu.c | 284 ++++++++++++++++++++++++---------------- arch/x86/kvm/mmu.h | 4 +- arch/x86/kvm/paging_tmpl.h | 13 +- arch/x86/kvm/svm.c | 1 + arch/x86/kvm/vmx.c | 74 +---------- arch/x86/kvm/x86.c | 3 +- 7 files changed, 187 insertions(+), 201 deletions(-) -- 2.1.0 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/