[PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

[PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

[Yang, Sheng]

[-- Attachment #1: Type: text/plain, Size: 1357 bytes --]

From: Sheng Yang <sheng.yang@intel.com>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

EPT is 4 level by default in 32pae (48bits), but virtual address only
got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to
fetch level 4 index.

Fix it by extend virtual address to 64bits in any condition.

Signed-off-by: Sheng Yang <sheng.yang@intel.com>
---
 arch/x86/kvm/mmu.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f33c594..8ca9aad 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	int level;
 	int r;
 	u64 *sptep;
+	u64 ext_addr = addr;
 	unsigned index;

 	shadow_addr = vcpu->arch.mmu.root_hpa;
@@ -954,7 +955,12 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	}

 	while (level >= PT_PAGE_TABLE_LEVEL) {
-		index = SHADOW_PT_INDEX(addr, level);
+		/*
+		 * SHADOW_PT_INDEX is overflow with EPT in 32pae mode. Because
+		 * EPT is 4 level (48bits) by default, but the addr got only 32
+		 * bits. Extend addr to 64 bit.
+		 */
+		index = SHADOW_PT_INDEX(ext_addr, level);
 		sptep = ((u64 *)__va(shadow_addr)) + index;
 		r = walker->entry(walker, vcpu, addr, sptep, level);
 		if (r)
--
1.5.4.5


[-- Attachment #2: 0001-KVM-MMU-Fix-overflow-of-SHADOW_PT_INDEX-with-EPT-i.patch --]
[-- Type: text/x-diff, Size: 1476 bytes --]

From d04ca5ce11171da3ba0f3523767cdb4f35731476 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@intel.com>
Date: Mon, 1 Sep 2008 17:28:59 +0800
Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

EPT is 4 level by default in 32pae (48bits), but virtual address only
got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to
fetch level 4 index.

Fix it by extend virtual address to 64bits in any condition.

Signed-off-by: Sheng Yang <sheng.yang@intel.com>
---
 arch/x86/kvm/mmu.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f33c594..8ca9aad 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	int level;
 	int r;
 	u64 *sptep;
+	u64 ext_addr = addr;
 	unsigned index;
 
 	shadow_addr = vcpu->arch.mmu.root_hpa;
@@ -954,7 +955,12 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
 	}
 
 	while (level >= PT_PAGE_TABLE_LEVEL) {
-		index = SHADOW_PT_INDEX(addr, level);
+		/*
+		 * SHADOW_PT_INDEX is overflow with EPT in 32pae mode. Because
+		 * EPT is 4 level (48bits) by default, but the addr got only 32
+		 * bits. Extend addr to 64 bit.
+		 */
+		index = SHADOW_PT_INDEX(ext_addr, level);
 		sptep = ((u64 *)__va(shadow_addr)) + index;
 		r = walker->entry(walker, vcpu, addr, sptep, level);
 		if (r)
-- 
1.5.4.5

Re: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

[Avi Kivity]

Yang, Sheng wrote:
> From: Sheng Yang <sheng.yang@intel.com>
> Date: Mon, 1 Sep 2008 17:28:59 +0800
> Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae
>
> EPT is 4 level by default in 32pae (48bits), but virtual address only
> got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to
> fetch level 4 index.
>
> Fix it by extend virtual address to 64bits in any condition.
>
>   

Good catch.

> Signed-off-by: Sheng Yang <sheng.yang@intel.com>
> ---
>  arch/x86/kvm/mmu.c |    8 +++++++-
>  1 files changed, 7 insertions(+), 1 deletions(-)
>
> diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
> index f33c594..8ca9aad 100644
> --- a/arch/x86/kvm/mmu.c
> +++ b/arch/x86/kvm/mmu.c
> @@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
>  	int level;
>  	int r;
>  	u64 *sptep;
> +	u64 ext_addr = addr;
>   

addr isn't really a gva_t; it is a pga_t when using direct mappings.

So how about changing walk_shadow() and its callbacks to use u64 instead 
of gva_t instead?


-- 
error compiling committee.c: too many arguments to function

Re: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae

[Sheng Yang]

On Mon, Sep 01, 2008 at 12:40:04PM +0300, Avi Kivity wrote:
> Yang, Sheng wrote:
>> From: Sheng Yang <sheng.yang@intel.com>
>> Date: Mon, 1 Sep 2008 17:28:59 +0800
>> Subject: [PATCH] KVM: MMU: Fix overflow of SHADOW_PT_INDEX with EPT in 32pae
>>
>> EPT is 4 level by default in 32pae (48bits), but virtual address only
>> got 32 bits. This result in SHADOW_PT_INDEX() overflow when try to
>> fetch level 4 index.
>>
>> Fix it by extend virtual address to 64bits in any condition.
>>
>>   
>
> Good catch.
>
>> Signed-off-by: Sheng Yang <sheng.yang@intel.com>
>> ---
>>  arch/x86/kvm/mmu.c |    8 +++++++-
>>  1 files changed, 7 insertions(+), 1 deletions(-)
>>
>> diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
>> index f33c594..8ca9aad 100644
>> --- a/arch/x86/kvm/mmu.c
>> +++ b/arch/x86/kvm/mmu.c
>> @@ -943,6 +943,7 @@ static int walk_shadow(struct kvm_shadow_walk *walker,
>>  	int level;
>>  	int r;
>>  	u64 *sptep;
>> +	u64 ext_addr = addr;
>>   
>
> addr isn't really a gva_t; it is a pga_t when using direct mappings.
>
> So how about changing walk_shadow() and its callbacks to use u64 instead  
> of gva_t instead?

Yeah, that's better, would update the patch soon. :)

--
regards
Yang, Sheng
>
>
> -- 
> error compiling committee.c: too many arguments to function
>
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html