lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 25 Jun 2010 20:06:05 +0800 From: Xiao Guangrong <xiaoguangrong@...fujitsu.com> To: Avi Kivity <avi@...hat.com> CC: Marcelo Tosatti <mtosatti@...hat.com>, LKML <linux-kernel@...r.kernel.org>, KVM list <kvm@...r.kernel.org> Subject: [PATCH v2 3/10] KVM: MMU: fix direct sp's access corruptted Consider using small page to fit guest's large page mapping: If the mapping is writable but the dirty flag is not set, we will find the read-only direct sp and setup the mapping, then if the write #PF occur, we will mark this mapping writable in the read-only direct sp, now, other real read-only mapping will happily write it without #PF. It may hurt guest's COW Fixed by re-install the mapping when write #PF occur. Signed-off-by: Xiao Guangrong <xiaoguangrong@...fujitsu.com> --- arch/x86/kvm/mmu.c | 3 ++- arch/x86/kvm/paging_tmpl.h | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletions(-) diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index 556a798..0412ba4 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -153,7 +153,8 @@ module_param(oos_shadow, bool, 0644); #define CREATE_TRACE_POINTS #include "mmutrace.h" -#define SPTE_HOST_WRITEABLE (1ULL << PT_FIRST_AVAIL_BITS_SHIFT) +#define SPTE_HOST_WRITEABLE (1ULL << PT_FIRST_AVAIL_BITS_SHIFT) +#define SPTE_NO_DIRTY (2ULL << PT_FIRST_AVAIL_BITS_SHIFT) #define SHADOW_PT_INDEX(addr, level) PT64_INDEX(addr, level) diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h index e46eb8a..fdba751 100644 --- a/arch/x86/kvm/paging_tmpl.h +++ b/arch/x86/kvm/paging_tmpl.h @@ -325,6 +325,20 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr, break; } + if (*sptep & SPTE_NO_DIRTY) { + struct kvm_mmu_page *child; + + WARN_ON(level != gw->level); + WARN_ON(!is_shadow_present_pte(*sptep)); + if (dirty) { + child = page_header(*sptep & + PT64_BASE_ADDR_MASK); + mmu_page_remove_parent_pte(child, sptep); + __set_spte(sptep, shadow_trap_nonpresent_pte); + kvm_flush_remote_tlbs(vcpu->kvm); + } + } + if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep)) continue; @@ -365,6 +379,10 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr, } } + if (level == gw->level && !dirty && + access & gw->pte_access & ACC_WRITE_MASK) + spte |= SPTE_NO_DIRTY; + spte = __pa(sp->spt) | PT_PRESENT_MASK | PT_ACCESSED_MASK | PT_WRITABLE_MASK | PT_USER_MASK; -- 1.6.1.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists