KVM: VMX: EPT misconfiguration handler

Handler for EPT misconfiguration which checks for valid state
in the shadow pagetables, printing the spte on each level.

The separate WARN_ONs are useful for kerneloops.org.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 6610181..94c07ad 100644 (file)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3227,6 +3227,89 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
        return kvm_mmu_page_fault(vcpu, gpa & PAGE_MASK, 0);
 }
 
+static u64 ept_rsvd_mask(u64 spte, int level)
+{
+       int i;
+       u64 mask = 0;
+
+       for (i = 51; i > boot_cpu_data.x86_phys_bits; i--)
+               mask |= (1ULL << i);
+
+       if (level > 2)
+               /* bits 7:3 reserved */
+               mask |= 0xf8;
+       else if (level == 2) {
+               if (spte & (1ULL << 7))
+                       /* 2MB ref, bits 20:12 reserved */
+                       mask |= 0x1ff000;
+               else
+                       /* bits 6:3 reserved */
+                       mask |= 0x78;
+       }
+
+       return mask;
+}
+
+static void ept_misconfig_inspect_spte(struct kvm_vcpu *vcpu, u64 spte,
+                                      int level)
+{
+       printk(KERN_ERR "%s: spte 0x%llx level %d\n", __func__, spte, level);
+
+       /* 010b (write-only) */
+       WARN_ON((spte & 0x7) == 0x2);
+
+       /* 110b (write/execute) */
+       WARN_ON((spte & 0x7) == 0x6);
+
+       /* 100b (execute-only) and value not supported by logical processor */
+       if (!cpu_has_vmx_ept_execute_only())
+               WARN_ON((spte & 0x7) == 0x4);
+
+       /* not 000b */
+       if ((spte & 0x7)) {
+               u64 rsvd_bits = spte & ept_rsvd_mask(spte, level);
+
+               if (rsvd_bits != 0) {
+                       printk(KERN_ERR "%s: rsvd_bits = 0x%llx\n",
+                                        __func__, rsvd_bits);
+                       WARN_ON(1);
+               }
+
+               if (level == 1 || (level == 2 && (spte & (1ULL << 7)))) {
+                       u64 ept_mem_type = (spte & 0x38) >> 3;
+
+                       if (ept_mem_type == 2 || ept_mem_type == 3 ||
+                           ept_mem_type == 7) {
+                               printk(KERN_ERR "%s: ept_mem_type=0x%llx\n",
+                                               __func__, ept_mem_type);
+                               WARN_ON(1);
+                       }
+               }
+       }
+}
+
+static int handle_ept_misconfig(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+{
+       u64 sptes[4];
+       int nr_sptes, i;
+       gpa_t gpa;
+
+       gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+
+       printk(KERN_ERR "EPT: Misconfiguration.\n");
+       printk(KERN_ERR "EPT: GPA: 0x%llx\n", gpa);
+
+       nr_sptes = kvm_mmu_get_spte_hierarchy(vcpu, gpa, sptes);
+
+       for (i = PT64_ROOT_LEVEL; i > PT64_ROOT_LEVEL - nr_sptes; --i)
+               ept_misconfig_inspect_spte(vcpu, sptes[i-1], i);
+
+       kvm_run->exit_reason = KVM_EXIT_UNKNOWN;
+       kvm_run->hw.hardware_exit_reason = EXIT_REASON_EPT_MISCONFIG;
+
+       return 0;
+}
+
 static int handle_nmi_window(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
        u32 cpu_based_vm_exec_control;
@@ -3306,8 +3389,9 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu,
        [EXIT_REASON_APIC_ACCESS]             = handle_apic_access,
        [EXIT_REASON_WBINVD]                  = handle_wbinvd,
        [EXIT_REASON_TASK_SWITCH]             = handle_task_switch,
-       [EXIT_REASON_EPT_VIOLATION]           = handle_ept_violation,
        [EXIT_REASON_MCE_DURING_VMENTRY]      = handle_machine_check,
+       [EXIT_REASON_EPT_VIOLATION]           = handle_ept_violation,
+       [EXIT_REASON_EPT_MISCONFIG]           = handle_ept_misconfig,
 };
 
 static const int kvm_vmx_max_exit_handlers =