* [Qemu-devel] [PATCH] target-i386: Mask NX bit from cpu_get_phys_page_debug result
@ 2012-03-06 12:23 Jan Kiszka
2012-03-06 12:56 ` Avi Kivity
0 siblings, 1 reply; 6+ messages in thread
From: Jan Kiszka @ 2012-03-06 12:23 UTC (permalink / raw)
To: qemu-devel, Anthony Liguori, Blue Swirl; +Cc: Avi Kivity
This was a long pending bug, now revealed by the assert in
phys_page_find that stumbled over the large page index returned by
cpu_get_phys_page_debug for NX-marked pages.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
Was easily triggerable by attaching gdb to the guest and doing some
backtraces that reached into stack addresses.
target-i386/helper.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/target-i386/helper.c b/target-i386/helper.c
index af6bba2..40fe407 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -947,7 +947,7 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
}
page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1);
- paddr = (pte & TARGET_PAGE_MASK) + page_offset;
+ paddr = (pte & TARGET_PAGE_MASK & ~PG_NX_MASK) + page_offset;
return paddr;
}
--
1.7.3.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] target-i386: Mask NX bit from cpu_get_phys_page_debug result
2012-03-06 12:23 [Qemu-devel] [PATCH] target-i386: Mask NX bit from cpu_get_phys_page_debug result Jan Kiszka
@ 2012-03-06 12:56 ` Avi Kivity
2012-03-06 13:07 ` Avi Kivity
0 siblings, 1 reply; 6+ messages in thread
From: Avi Kivity @ 2012-03-06 12:56 UTC (permalink / raw)
To: Jan Kiszka; +Cc: Blue Swirl, Anthony Liguori, qemu-devel
On 03/06/2012 02:23 PM, Jan Kiszka wrote:
> This was a long pending bug, now revealed by the assert in
> phys_page_find that stumbled over the large page index returned by
> cpu_get_phys_page_debug for NX-marked pages.
>
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>
> Was easily triggerable by attaching gdb to the guest and doing some
> backtraces that reached into stack addresses.
>
> target-i386/helper.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/target-i386/helper.c b/target-i386/helper.c
> index af6bba2..40fe407 100644
> --- a/target-i386/helper.c
> +++ b/target-i386/helper.c
> @@ -947,7 +947,7 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
> }
>
> page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1);
> - paddr = (pte & TARGET_PAGE_MASK) + page_offset;
> + paddr = (pte & TARGET_PAGE_MASK & ~PG_NX_MASK) + page_offset;
> return paddr;
> }
>
Should we not, in addition, mask the software available bits (53-62 IIRC)?
--
error compiling committee.c: too many arguments to function
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] target-i386: Mask NX bit from cpu_get_phys_page_debug result
2012-03-06 12:56 ` Avi Kivity
@ 2012-03-06 13:07 ` Avi Kivity
2012-03-06 14:22 ` [Qemu-devel] [PATCH v2] " Jan Kiszka
0 siblings, 1 reply; 6+ messages in thread
From: Avi Kivity @ 2012-03-06 13:07 UTC (permalink / raw)
To: Jan Kiszka; +Cc: Blue Swirl, Anthony Liguori, qemu-devel
On 03/06/2012 02:56 PM, Avi Kivity wrote:
> > diff --git a/target-i386/helper.c b/target-i386/helper.c
> > index af6bba2..40fe407 100644
> > --- a/target-i386/helper.c
> > +++ b/target-i386/helper.c
> > @@ -947,7 +947,7 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
> > }
> >
> > page_offset = (addr & TARGET_PAGE_MASK) & (page_size - 1);
> > - paddr = (pte & TARGET_PAGE_MASK) + page_offset;
> > + paddr = (pte & TARGET_PAGE_MASK & ~PG_NX_MASK) + page_offset;
> > return paddr;
> > }
> >
>
> Should we not, in addition, mask the software available bits (53-62 IIRC)?
>
Also intermediate PTEs want this treatment, not just the last one.
--
error compiling committee.c: too many arguments to function
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Qemu-devel] [PATCH v2] target-i386: Mask NX bit from cpu_get_phys_page_debug result
2012-03-06 13:07 ` Avi Kivity
@ 2012-03-06 14:22 ` Jan Kiszka
2012-03-06 14:31 ` Avi Kivity
2012-03-11 16:07 ` Blue Swirl
0 siblings, 2 replies; 6+ messages in thread
From: Jan Kiszka @ 2012-03-06 14:22 UTC (permalink / raw)
To: Blue Swirl, Anthony Liguori, qemu-devel; +Cc: Avi Kivity
This was a long pending bug, now revealed by the assert in
phys_page_find that stumbled over the large page index returned by
cpu_get_phys_page_debug for NX-marked pages: We need to mask out NX and
all user-definable bits 52..62 from PDEs and the final PTE to avoid
corrupting physical addresses.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
Changes in v2 (as suggested by Avi):
- Mask PDEs as well
- Mask user-definable bits
target-i386/cpu.h | 1 +
target-i386/helper.c | 13 +++++++------
2 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 196b0c5..36e3d29 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -241,6 +241,7 @@
#define PG_DIRTY_MASK (1 << PG_DIRTY_BIT)
#define PG_PSE_MASK (1 << PG_PSE_BIT)
#define PG_GLOBAL_MASK (1 << PG_GLOBAL_BIT)
+#define PG_HI_USER_MASK 0x7ff0000000000000LL
#define PG_NX_MASK (1LL << PG_NX_BIT)
#define PG_ERROR_W_BIT 1
diff --git a/target-i386/helper.c b/target-i386/helper.c
index af6bba2..f4f3c27 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -885,8 +885,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
if (!(pml4e & PG_PRESENT_MASK))
return -1;
- pdpe_addr = ((pml4e & ~0xfff) + (((addr >> 30) & 0x1ff) << 3)) &
- env->a20_mask;
+ pdpe_addr = ((pml4e & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
+ (((addr >> 30) & 0x1ff) << 3)) & env->a20_mask;
pdpe = ldq_phys(pdpe_addr);
if (!(pdpe & PG_PRESENT_MASK))
return -1;
@@ -900,8 +900,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
return -1;
}
- pde_addr = ((pdpe & ~0xfff) + (((addr >> 21) & 0x1ff) << 3)) &
- env->a20_mask;
+ pde_addr = ((pdpe & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
+ (((addr >> 21) & 0x1ff) << 3)) & env->a20_mask;
pde = ldq_phys(pde_addr);
if (!(pde & PG_PRESENT_MASK)) {
return -1;
@@ -912,11 +912,12 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */
} else {
/* 4 KB page */
- pte_addr = ((pde & ~0xfff) + (((addr >> 12) & 0x1ff) << 3)) &
- env->a20_mask;
+ pte_addr = ((pde & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
+ (((addr >> 12) & 0x1ff) << 3)) & env->a20_mask;
page_size = 4096;
pte = ldq_phys(pte_addr);
}
+ pte &= ~(PG_NX_MASK | PG_HI_USER_MASK);
if (!(pte & PG_PRESENT_MASK))
return -1;
} else {
--
1.7.3.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH v2] target-i386: Mask NX bit from cpu_get_phys_page_debug result
2012-03-06 14:22 ` [Qemu-devel] [PATCH v2] " Jan Kiszka
@ 2012-03-06 14:31 ` Avi Kivity
2012-03-11 16:07 ` Blue Swirl
1 sibling, 0 replies; 6+ messages in thread
From: Avi Kivity @ 2012-03-06 14:31 UTC (permalink / raw)
To: Jan Kiszka; +Cc: Blue Swirl, Anthony Liguori, qemu-devel
On 03/06/2012 04:22 PM, Jan Kiszka wrote:
> This was a long pending bug, now revealed by the assert in
> phys_page_find that stumbled over the large page index returned by
> cpu_get_phys_page_debug for NX-marked pages: We need to mask out NX and
> all user-definable bits 52..62 from PDEs and the final PTE to avoid
> corrupting physical addresses.
>
>
Reviewed-by: Avi Kivity <avi@redhat.com>
--
error compiling committee.c: too many arguments to function
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH v2] target-i386: Mask NX bit from cpu_get_phys_page_debug result
2012-03-06 14:22 ` [Qemu-devel] [PATCH v2] " Jan Kiszka
2012-03-06 14:31 ` Avi Kivity
@ 2012-03-11 16:07 ` Blue Swirl
1 sibling, 0 replies; 6+ messages in thread
From: Blue Swirl @ 2012-03-11 16:07 UTC (permalink / raw)
To: Jan Kiszka; +Cc: Anthony Liguori, qemu-devel, Avi Kivity
Thanks, applied.
On Tue, Mar 6, 2012 at 14:22, Jan Kiszka <jan.kiszka@siemens.com> wrote:
> This was a long pending bug, now revealed by the assert in
> phys_page_find that stumbled over the large page index returned by
> cpu_get_phys_page_debug for NX-marked pages: We need to mask out NX and
> all user-definable bits 52..62 from PDEs and the final PTE to avoid
> corrupting physical addresses.
>
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>
> Changes in v2 (as suggested by Avi):
> - Mask PDEs as well
> - Mask user-definable bits
>
> target-i386/cpu.h | 1 +
> target-i386/helper.c | 13 +++++++------
> 2 files changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/target-i386/cpu.h b/target-i386/cpu.h
> index 196b0c5..36e3d29 100644
> --- a/target-i386/cpu.h
> +++ b/target-i386/cpu.h
> @@ -241,6 +241,7 @@
> #define PG_DIRTY_MASK (1 << PG_DIRTY_BIT)
> #define PG_PSE_MASK (1 << PG_PSE_BIT)
> #define PG_GLOBAL_MASK (1 << PG_GLOBAL_BIT)
> +#define PG_HI_USER_MASK 0x7ff0000000000000LL
> #define PG_NX_MASK (1LL << PG_NX_BIT)
>
> #define PG_ERROR_W_BIT 1
> diff --git a/target-i386/helper.c b/target-i386/helper.c
> index af6bba2..f4f3c27 100644
> --- a/target-i386/helper.c
> +++ b/target-i386/helper.c
> @@ -885,8 +885,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
> if (!(pml4e & PG_PRESENT_MASK))
> return -1;
>
> - pdpe_addr = ((pml4e & ~0xfff) + (((addr >> 30) & 0x1ff) << 3)) &
> - env->a20_mask;
> + pdpe_addr = ((pml4e & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
> + (((addr >> 30) & 0x1ff) << 3)) & env->a20_mask;
> pdpe = ldq_phys(pdpe_addr);
> if (!(pdpe & PG_PRESENT_MASK))
> return -1;
> @@ -900,8 +900,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
> return -1;
> }
>
> - pde_addr = ((pdpe & ~0xfff) + (((addr >> 21) & 0x1ff) << 3)) &
> - env->a20_mask;
> + pde_addr = ((pdpe & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
> + (((addr >> 21) & 0x1ff) << 3)) & env->a20_mask;
> pde = ldq_phys(pde_addr);
> if (!(pde & PG_PRESENT_MASK)) {
> return -1;
> @@ -912,11 +912,12 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
> pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */
> } else {
> /* 4 KB page */
> - pte_addr = ((pde & ~0xfff) + (((addr >> 12) & 0x1ff) << 3)) &
> - env->a20_mask;
> + pte_addr = ((pde & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) +
> + (((addr >> 12) & 0x1ff) << 3)) & env->a20_mask;
> page_size = 4096;
> pte = ldq_phys(pte_addr);
> }
> + pte &= ~(PG_NX_MASK | PG_HI_USER_MASK);
> if (!(pte & PG_PRESENT_MASK))
> return -1;
> } else {
> --
> 1.7.3.4
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-03-11 16:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-06 12:23 [Qemu-devel] [PATCH] target-i386: Mask NX bit from cpu_get_phys_page_debug result Jan Kiszka
2012-03-06 12:56 ` Avi Kivity
2012-03-06 13:07 ` Avi Kivity
2012-03-06 14:22 ` [Qemu-devel] [PATCH v2] " Jan Kiszka
2012-03-06 14:31 ` Avi Kivity
2012-03-11 16:07 ` Blue Swirl
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).