Skip to contentSkip to conversation

KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

PATCH In review Yang, Sheng 3 participants 3 messages Sep 1, 2008

Subsystems (3)
x86 KVM KVM x86
lore
Share & tools
lore

Yang, Sheng

author
#0 lore raw

PATCH 1/1 KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

From: Sheng Yang <[email protected]>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

EPT is 4 level by default in 32pae (48bits), but virtual address only got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to fetch level 4 index.

Fix it by extend virtual address to 64bits in any condition.

Signed-off-by Sheng Yang <[email protected]>
---
 arch/x86/kvm/mmu.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)
arch/x86/kvm/mmu.c +7 -1
index f33c594..8ca9aad 100644
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	int level;
 	int r;
 	u64 *sptep;
+	u64 ext_addr = addr;
 	unsigned index;
 
 	shadow_addr = vcpu->arch.mmu.root_hpa;

@@ -954,7 +955,12 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	}
 
 	while (level >= PT_PAGE_TABLE_LEVEL) {
-		index = SHADOW_PT_INDEX(addr, level);
+		/*
+		 * SHADOW_PT_INDEX is overflow with EPT in 32pae mode. Because
+		 * EPT is 4 level (48bits) by default, but the addr got only 32
+		 * bits. Extend addr to 64 bit.
+		 */
+		index = SHADOW_PT_INDEX(ext_addr, level);
 		sptep = ((u64 *)__va(shadow_addr)) + index;
 		r = walker->entry(walker, vcpu, addr, sptep, level);
 		if (r)

--
1.5.4.5

From d04ca5ce11171da3ba0f3523767cdb4f35731476 Mon Sep 17 00:00:00 2001
From: Sheng Yang <[email protected]>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

EPT is 4 level by default in 32pae (48bits), but virtual address only got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to fetch level 4 index.

Fix it by extend virtual address to 64bits in any condition.

Signed-off-by Sheng Yang <[email protected]>
---
 arch/x86/kvm/mmu.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)
arch/x86/kvm/mmu.c +7 -1
index f33c594..8ca9aad 100644
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	int level;
 	int r;
 	u64 *sptep;
+	u64 ext_addr = addr;
 	unsigned index;
 
 	shadow_addr = vcpu->arch.mmu.root_hpa;

@@ -954,7 +955,12 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	}
 
 	while (level >= PT_PAGE_TABLE_LEVEL) {
-		index = SHADOW_PT_INDEX(addr, level);
+		/*
+		 * SHADOW_PT_INDEX is overflow with EPT in 32pae mode. Because
+		 * EPT is 4 level (48bits) by default, but the addr got only 32
+		 * bits. Extend addr to 64 bit.
+		 */
+		index = SHADOW_PT_INDEX(ext_addr, level);
 		sptep = ((u64 *)__va(shadow_addr)) + index;
 		r = walker->entry(walker, vcpu, addr, sptep, level);
 		if (r)
Signature · 1 line
1.5.4.5
#1 lore raw
Quoted 11 lines · Sheng

From: Sheng Yang <[email protected]>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

EPT is 4 level by default in 32pae (48bits), but virtual address only got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to fetch level 4 index.

Fix it by extend virtual address to 64bits in any condition.

Good catch.

Quoted 10 lines
Signed-off-by Sheng Yang <[email protected]>
---
 arch/x86/kvm/mmu.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)
arch/x86/kvm/mmu.c +0 -0
index f33c594..8ca9aad 100644

arch/x86/kvm/mmu.c static int walk_shadow(struct kvm_shadow_walk *walker, · line 947

Quoted 5 lines
arch/x86/kvm/mmu.c +1 -0
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	int level;
 	int r;
 	u64 *sptep;
+	u64 ext_addr = addr;

addr isn't really a gva_t; it is a pga_t when using direct mappings.

So how about changing walk_shadow() and its callbacks to use u64 instead of gva_t instead?

Signature · 1 line
error compiling committee.c: too many arguments to function
#2 lore raw
Quoted 33 lines · Avi Kivity
Quoted 11 lines · Sheng

From: Sheng Yang <[email protected]>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

EPT is 4 level by default in 32pae (48bits), but virtual address only got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to fetch level 4 index.

Fix it by extend virtual address to 64bits in any condition.

Good catch.

Quoted 10 lines
Signed-off-by Sheng Yang <[email protected]>
---
 arch/x86/kvm/mmu.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)
arch/x86/kvm/mmu.c +0 -0
index f33c594..8ca9aad 100644

arch/x86/kvm/mmu.c static int walk_shadow(struct kvm_shadow_walk *walker, · line 947

Quoted 5 lines
arch/x86/kvm/mmu.c +1 -0
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	int level;
 	int r;
 	u64 *sptep;
+	u64 ext_addr = addr;

addr isn't really a gva_t; it is a pga_t when using direct mappings.

Quoted 2 lines

So how about changing walk_shadow() and its callbacks to use u64 instead of gva_t instead?

Yeah, that's better, would update the patch soon. :)

--
regards
Yang, Sheng

Quoted 9 lines
Signature · 7 lines
-- 
error compiling committee.c: too many arguments to function

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html