EPT Violation on system shutdown

[sruffell]

Just taking a note so I do not forget.

With a busybox-based initramfs run as init, on shutdown in the guest I see the following error.

Kernel memory protection disabled.
Run /sbin/init as init process
  with arguments:
    /sbin/init
  with environment:
    HOME=/
    TERM=linux
    rodata=0

Please press Enter to activate this console.
/ # reboot
/ # umount: can't unmount /: Invalid argument
swapoff: can't open '/etc/fstab': No such file or directory
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
reboot: Restarting system
reboot: machine restart
[  35.112449] MYTHRIL-INFO: exit reason = ExitReason { flags: (empty), info: EptViolation(EptInformation { read: false, write: true, exec: false, read_allowed: false, write_allowed: false, priv_exec_allowed: false, user_exec_allowed: false, guest_linear_addr: Some(GuestPhysAddr(0xffffffffff5fc000)), after_page_translation: true, user_mode_address: false, read_write_page: false, nx_page: false, nmi_unblocking_iret: false, guest_phys_addr: GuestPhysAddr(0xfec00000) }) }
[  35.227635] MYTHRIL-ERROR: Panic in src/vmexit.rs at (52, 9):
[  35.246688] MYTHRIL-ERROR: Failed to handle vmexit: InvalidValue("Unsupported mmio instruction: Inc_r32 (rip=0xffffffff810212ad, bytes=[68, 137, 0])")

The initramfs and config used to generate this error is at https://github.com/sruffell/mythril/commits/b19c8a84f71d2ab225faa9a372aa305c6368f8be

[sruffell]

Running against the current master, there is no crash, but instead the result is a triple fault:

[  37.461642] MYTHRIL-INFO: VMCS:
 Guest State:
  CR0=0x80050033(shadow=0x0) CR3=0x9c000 CR4=0x1226b0(shadow=0x0)
  EFER=0xd01
  RSP=0xffffc900008b3dc0 RIP=0xffffffff81021d75
  RFLAGS=0x10047 DR7=0x400
  CS: selector=0x10 base=0x0 limit=0xffffffff ar=0xa09b
  DS: selector=0x0 base=0x0 limit=0xffffffff ar=0x1c000
  SS: selector=0x18 base=0x0 limit=0xffffffff ar=0xc093
  ES: selector=0x0 base=0x0 limit=0xffffffff ar=0x1c000
  FS: selector=0x0 base=0x7f029ea7c6a0 limit=0xffffffff ar=0x1c000
  GS: selector=0x0 base=0xffff88803ec00000 limit=0xffffffff ar=0x1c000
  LDTR: selector=0x0 base=0x0 limit=0xffffffff ar=0x1c000
  GDTR: base=0xfffffe0000001000 limit=0x7f
  IDTR: base=0xfffffe0000000000 limit=0xfff
[  37.606702] MYTHRIL-ERROR: Panic in src/vcpu.rs at (688, 17):
[  37.616462] MYTHRIL-ERROR: No handler for exit reason: ExitReason { flags: (empty), info: TripleFault }

After which mythril will spin waiting for a signal from the host user. The kernel will use a triple fault during reboot as the last resort in case any of the other (ACPI, BIOS, EFI, etc..) mechanisms fail, and therefore we're most likely hitting that condition.

https://github.com/torvalds/linux/blob/9ccce092fc64d19504fa54de4fd659e279cc92e7/arch/x86/kernel/reboot.c#L617-L679

Ideally mythril would support the ACPI reboot mechanism without letting the kernel get to the triplefault (which on baremetal would cause the CPU to jump to it's reset vector).