From: "Yang, Sheng" <sheng.yang@intel.com>
To: Avi Kivity <avi@qumranet.com>
Cc: kvm@vger.kernel.org
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae
Date: Mon, 1 Sep 2008 17:32:55 +0800 [thread overview]
Message-ID: <200809011732.55508.sheng.yang@intel.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 1357 bytes --]
From: Sheng Yang <sheng.yang@intel.com>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae
EPT is 4 level by default in 32pae (48bits), but virtual address only
got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to
fetch level 4 index.
Fix it by extend virtual address to 64bits in any condition.
Signed-off-by: Sheng Yang <sheng.yang@intel.com>
---
arch/x86/kvm/mmu.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f33c594..8ca9aad 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
int level;
int r;
u64 *sptep;
+ u64 ext_addr = addr;
unsigned index;
shadow_addr = vcpu->arch.mmu.root_hpa;
@@ -954,7 +955,12 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
}
while (level >= PT_PAGE_TABLE_LEVEL) {
- index = SHADOW_PT_INDEX(addr, level);
+ /*
+ * SHADOW_PT_INDEX is overflow with EPT in 32pae mode. Because
+ * EPT is 4 level (48bits) by default, but the addr got only 32
+ * bits. Extend addr to 64 bit.
+ */
+ index = SHADOW_PT_INDEX(ext_addr, level);
sptep = ((u64 *)__va(shadow_addr)) + index;
r = walker->entry(walker, vcpu, addr, sptep, level);
if (r)
--
1.5.4.5
[-- Attachment #2: 0001-KVM-MMU-Fix-overflow-of-SHADOW_PT_INDEX-with-EPT-i.patch --]
[-- Type: text/x-diff, Size: 1476 bytes --]
From d04ca5ce11171da3ba0f3523767cdb4f35731476 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@intel.com>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae
EPT is 4 level by default in 32pae (48bits), but virtual address only
got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to
fetch level 4 index.
Fix it by extend virtual address to 64bits in any condition.
Signed-off-by: Sheng Yang <sheng.yang@intel.com>
---
arch/x86/kvm/mmu.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f33c594..8ca9aad 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
int level;
int r;
u64 *sptep;
+ u64 ext_addr = addr;
unsigned index;
shadow_addr = vcpu->arch.mmu.root_hpa;
@@ -954,7 +955,12 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
}
while (level >= PT_PAGE_TABLE_LEVEL) {
- index = SHADOW_PT_INDEX(addr, level);
+ /*
+ * SHADOW_PT_INDEX is overflow with EPT in 32pae mode. Because
+ * EPT is 4 level (48bits) by default, but the addr got only 32
+ * bits. Extend addr to 64 bit.
+ */
+ index = SHADOW_PT_INDEX(ext_addr, level);
sptep = ((u64 *)__va(shadow_addr)) + index;
r = walker->entry(walker, vcpu, addr, sptep, level);
if (r)
--
1.5.4.5
next reply other threads:[~2008-09-01 9:30 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-01 9:32 Yang, Sheng [this message]
2008-09-01 9:40 ` [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae Avi Kivity
2008-09-01 10:31 ` Sheng Yang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200809011732.55508.sheng.yang@intel.com \
--to=sheng.yang@intel.com \
--cc=avi@qumranet.com \
--cc=kvm@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox