KVM: MMU: Extend kvm_mmu_page->slot_bitmap size
PATCH 1/2 KVM: MMU: Extend kvm_mmu_page->slot_bitmap size
Otherwise set_bit() for private memory slot(above KVM_MEMORY_SLOTS) would corrupted memory in 32bit host.
Signed-off-by Sheng Yang <[email protected]>
--- arch/x86/kvm/mmu.c | 6 +++--- include/asm-x86/kvm_host.h | 8 +++++--- 2 files changed, 8 insertions(+), 6 deletions(-)
arch/x86/kvm/mmu.c +3 -3
@@ -789,7 +789,7 @@ static struct kvm_mmu_page *kvm_mmu_alloc_page(struct kvm_vcpu *vcpu,set_page_private (virt_to_page (sp->spt), (unsigned long )sp);list_add (&sp->link, &vcpu->kvm->arch.active_mmu_pages);ASSERT (is_empty_shadow_page (sp->spt)); - sp->slot_bitmap =0 ; +bitmap_zero (sp->slot_bitmap,KVM_MEMORY_SLOTS +KVM_PRIVATE_MEM_SLOTS ); sp->multimapped =0 ; sp->parent_pte = parent_pte; --vcpu->kvm->arch.n_free_mmu_pages;
@@ -1364,7 +1364,7 @@ static void page_header_update_slot(struct kvm *kvm, void *pte, gfn_t gfn)int slot =memslot_id (kvm,gfn_to_memslot (kvm, gfn));struct kvm_mmu_page *sp =page_header (__pa (pte)); -__set_bit (slot, &sp->slot_bitmap); +__set_bit (slot, sp->slot_bitmap); }static void mmu_convert_notrap (struct kvm_mmu_page *sp)
@@ -2564,7 +2564,7 @@ void kvm_mmu_slot_remove_write_access(struct kvm *kvm, int slot)int i;u64 *pt; -if (!test_bit (slot, &sp->slot_bitmap)) +if (!test_bit (slot, sp->slot_bitmap))continue ; pt = sp->spt;
include/asm-x86/kvm_host.h +5 -3
@@ -192,9 +192,11 @@ struct kvm_mmu_page {u64 *spt;/* hold the gfn of each spte inside spt */ gfn_t *gfns; -unsigned long slot_bitmap;/* One bit set per slot which has memory -* in this shadow page. -*/ +/* +* One bit set per slot which has memory +* in this shadow page. +*/ +DECLARE_BITMAP (slot_bitmap,KVM_MEMORY_SLOTS +KVM_PRIVATE_MEM_SLOTS );int multimapped;/* More than one parent_pte? */ int root_count;/* Currently serving as active root */ bool unsync;
Signature · 1 line
1.5.4.5
PATCH 2/2 KVM: VMX: Move private memory slot position
PCI device assignment would map guest MMIO spaces as separate slot, so it is possible that the device has more than 2 MMIO spaces and overwrite current private memslot.
The patch move private memory slot to the top of userspace visible memory slots.
Signed-off-by Sheng Yang <[email protected]>
--- arch/x86/kvm/vmx.c | 2 +- arch/x86/kvm/vmx.h | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-)
arch/x86/kvm/vmx.c +1 -1
@@ -2513,7 +2513,7 @@ static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr) {int ret;struct kvm_userspace_memory_region tss_mem = { - .slot =8 , + .slot =TSS_PRIVATE_MEMSLOT , .guest_phys_addr = addr, .memory_size =PAGE_SIZE *3 , .flags =0 ,
arch/x86/kvm/vmx.h +3 -2
@@ -338,8 +338,9 @@ enum vmcs_field {#define AR_RESERVD_MASK 0xfffe0f00 -#define APIC_ACCESS_PAGE_PRIVATE_MEMSLOT 9 -#define IDENTITY_PAGETABLE_PRIVATE_MEMSLOT 10 +#define TSS_PRIVATE_MEMSLOT (KVM_MEMORY_SLOTS + 0) +#define APIC_ACCESS_PAGE_PRIVATE_MEMSLOT (KVM_MEMORY_SLOTS + 1) +#define IDENTITY_PAGETABLE_PRIVATE_MEMSLOT (KVM_MEMORY_SLOTS + 2)#define VMX_NR_VPIDS (1 << 16)#define VMX_VPID_EXTENT_SINGLE_CONTEXT 1
Signature · 1 line
1.5.4.5
Avi Kivity
AppliedQuoted 3 lines · Sheng Yang
Otherwise
set_bit()for private memoryslot(above KVM_MEMORY_SLOTS)would corrupted memory in 32bit host.
Applied both patches, thanks.
Signature · 1 line
error compiling committee.c: too many arguments to function