Re: Missing EPT misconfiguration check?

On 08.12.2016 23:27, Mike Larkin wrote:
> While tracking down an EPT misconfiguration bug I'm seeing in some of my
> code (on real hardware), I ran the same code in bochs. I never saw the
> misconfiguration occur.

I recall similar issues we had a few years back. At that time the speci-
fication clearly stated that hardware shall ignore all reserved bits. If
nobody adapted the specification until today, the bug you are seeing is
neither in your program or Bochs, it's in your hardware.

IMHO, iff the specification still tells to ignore reserved bits, Bochs
should only print a warning that this may cause issues on broken hard-
ware.

Nico

> 
> Curious, I broke in to the running guest VM in bochs and saw this EPT 
> configuration:
> 
> EPT PML4: 0x000000000ec7a027    E W R
> EPT PDPE: 0x000000000ec79027    E W R
> EPT  PDE: 0x000000000ea49067    E W R
> EPT  PTE: 0x00000000075df437    E W R ignore_pat WB
> 
> The first three levels of this should be triggering misconfigurations due 
> to bit 5 (0x20) being set in the PML4, PDPE, and PDE entries, and also
> due to bit 6 (0x40) being set in the PDE. This is the same misconfiguration
> I'm seeing on real hardware.
> 
> In bochs cpu/paging.cc, these restrictions are even called out:
> 
> //                   Format of a EPT Entry
> // -----------------------------------------------------------
> // 00    | Read access
> // 01    | Write access
> // 02    | Execute Access
> // 05-03 | EPT Memory type (for leaf entries, reserved otherwise)
> // 06    | Ignore PAT memory type (for leaf entries, reserved otherwise)
> // 07    | Page Size, must be 1 to indicate a Large Page
> // 08    | Accessed bit (if supported, ignored otherwise)
> // 09    | Dirty bit (for leaf entries, if supported, ignored otherwise)
> // 11-10 | (ignored)
> // PA-12 | Physical address
> // 51-PA | Reserved (must be zero)
> // 63-52 | (ignored)
> // -----------------------------------------------------------
> 
> It does appear that bochs is checking the 51-PA range, as well as ensuring
> if bit 7 is set properly (it's only supported in certain levels).
> 
> It looks like bochs needs the following check as well? Does this make sense?
> 
> -ml


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi