Re: Missing EPT misconfiguration check?

On Fri, Dec 09, 2016 at 02:47:38PM +0200, Stanislav wrote:
> Let me know if the patch solves your issue:
> 

I'm pretty sure this will work. I have something nearly identical
in my tree and it does indeed detect the misconfigurations.

Thanks Stanislav.

-ml

> Index: paging.cc
> ===================================================================
> --- paging.cc	(revision 12984)
> +++ paging.cc	(working copy)
> @@ -1823,6 +1823,13 @@
>        ppf += (bx_phy_address)(guest_paddr & offset_mask);
>        break;
>      }
> +
> +    // EPT non leaf entry, check for reserved bits
> +    if ((curr_entry >> 3) & 0xf) {
> +      BX_DEBUG(("EPT %s: EPT misconfiguration, reserved bits set for
> non-leaf entry", bx_paging_level[leaf]));
> +      vmexit_reason = VMX_VMEXIT_EPT_MISCONFIGURATION;
> +      break;
> +    }
>    }
>  
>    if (!vmexit_reason && (access_mask & combined_access) != access_mask) {
> 
> -----Original Message-----
> From: Mike Larkin [mailto:[email protected]] 
> Sent: Friday, December 09, 2016 12:27 AM
> To: [email protected]
> Subject: [Bochs-developers] Missing EPT misconfiguration check?
> 
> While tracking down an EPT misconfiguration bug I'm seeing in some of my
> code (on real hardware), I ran the same code in bochs. I never saw the
> misconfiguration occur.
> 
> Curious, I broke in to the running guest VM in bochs and saw this EPT
> configuration:
> 
> EPT PML4: 0x000000000ec7a027    E W R
> EPT PDPE: 0x000000000ec79027    E W R
> EPT  PDE: 0x000000000ea49067    E W R
> EPT  PTE: 0x00000000075df437    E W R ignore_pat WB
> 
> The first three levels of this should be triggering misconfigurations due to
> bit 5 (0x20) being set in the PML4, PDPE, and PDE entries, and also due to
> bit 6 (0x40) being set in the PDE. This is the same misconfiguration I'm
> seeing on real hardware.
> 
> In bochs cpu/paging.cc, these restrictions are even called out:
> 
> //                   Format of a EPT Entry
> // -----------------------------------------------------------
> // 00    | Read access
> // 01    | Write access
> // 02    | Execute Access
> // 05-03 | EPT Memory type (for leaf entries, reserved otherwise)
> // 06    | Ignore PAT memory type (for leaf entries, reserved otherwise)
> // 07    | Page Size, must be 1 to indicate a Large Page
> // 08    | Accessed bit (if supported, ignored otherwise)
> // 09    | Dirty bit (for leaf entries, if supported, ignored otherwise)
> // 11-10 | (ignored)
> // PA-12 | Physical address
> // 51-PA | Reserved (must be zero)
> // 63-52 | (ignored)
> // -----------------------------------------------------------
> 
> It does appear that bochs is checking the 51-PA range, as well as ensuring
> if bit 7 is set properly (it's only supported in certain levels).
> 
> It looks like bochs needs the following check as well? Does this make sense?
> 
> -ml
> 
> 
> Index: cpu/paging.cc
> ===================================================================
> --- cpu/paging.cc	(revision 12984)
> +++ cpu/paging.cc	(working copy)
> @@ -1805,6 +1805,12 @@
>  
>      if (leaf == BX_LEVEL_PTE) break;
>  
> +    if (curr_entry & 0x60) {
> +      BX_DEBUG(("EPT %s: reserved bit is set 0x" FMT_ADDRX64,
> bx_paging_level[leaf], curr_entry));
> +      vmexit_reason = VMX_VMEXIT_EPT_MISCONFIGURATION;
> +      break;
> +    }
> +
>      if (curr_entry & 0x80) {
>        if (leaf > (BX_LEVEL_PDE +
> !!is_cpu_extension_supported(BX_ISA_1G_PAGES))) {
>          BX_DEBUG(("EPT %s: PS bit set !", bx_paging_level[leaf]));
> 
> ----------------------------------------------------------------------------
> --
> Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
> Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> bochs-developers mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/bochs-developers
> 

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi