linux-kernel - [PATCH v2 2/2] KVM: Fix writeback on page boundary that propagate changes in spite of #PF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <CEFC4249-A4B6-4533-A568-89E3050BAF8D@gmail.com>
Date:	Sun, 22 Jan 2012 13:01:18 +0200
From:	Nadav Amit <nadav.amit@...il.com>
To:	Avi Kivity <avi@...hat.com>
Cc:	Nadav Amit <namit@...technion.ac.il>,
	Marcelo Tosatti <mtosatti@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
	kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
	Gleb Natapov <gleb@...hat.com>
Subject: [PATCH v2 2/2] KVM: Fix writeback on page boundary that propagate changes in spite of #PF

Consider the case in which an instruction emulation writeback is performed on a page boundary.
In such case, if a #PF occurs on the second page, the write to the first page already occurred and cannot be retracted.
Therefore, validation of the second page access must be performed prior to writeback.

Signed-off-by: Nadav Amit <nadav.amit@...il.com>
---
arch/x86/kvm/x86.c |   60 +++++++++++++++++++++++++++++----------------------
1 files changed, 34 insertions(+), 26 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 05fd3d7..0e86f3a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3689,33 +3689,27 @@ static struct read_write_emulator_ops write_emultor = {
	.write = true,
};

-static int emulator_read_write_onepage(unsigned long addr, void *val,
+static int emulator_read_write_onepage(gpa_t gpa, void *val,
				       unsigned int bytes,
-				       struct x86_exception *exception,
				       struct kvm_vcpu *vcpu,
-				       struct read_write_emulator_ops *ops)
+				       struct read_write_emulator_ops *ops,
+				       bool mmio)
{
-	gpa_t gpa;
-	int handled, ret;
+	int handled;
	bool write = ops->write;

	if (ops->read_write_prepare &&
		  ops->read_write_prepare(vcpu, val, bytes))
		return X86EMUL_CONTINUE;

-	ret = vcpu_mmio_gva_to_gpa(vcpu, addr, &gpa, exception, write);
-
-	if (ret < 0)
-		return X86EMUL_PROPAGATE_FAULT;
-
	/* For APIC access vmexit */
-	if (ret)
-		goto mmio;
+	if (mmio)
+		goto do_mmio;

	if (ops->read_write_emulate(vcpu, gpa, val, bytes))
		return X86EMUL_CONTINUE;

-mmio:
+do_mmio:
	/*
	 * Is this MMIO handled locally?
	 */
@@ -3744,24 +3738,38 @@ int emulator_read_write(struct x86_emulate_ctxt *ctxt, unsigned long addr,
			struct read_write_emulator_ops *ops)
{
	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
+	int i, rc;
+	bool write = ops->write;
+	gpa_t gpa[2];
+	int npages = (((addr + bytes - 1) ^ addr) & PAGE_MASK) ? 2 : 1;
+	unsigned int offset[2] = {0};
+	unsigned int p_bytes[2] = {bytes, 0};
+	bool mmio[2];
+
+	if (npages == 2) {
+		p_bytes[0] = offset[1] = -addr & ~PAGE_MASK;
+		p_bytes[1] = bytes - p_bytes[0];
+	}
+
+	/* First check there is no page-fault on the next page */
+	for (i = 0; i < npages; i++) {
+		rc = vcpu_mmio_gva_to_gpa(vcpu, addr + offset[i], &gpa[i],
+			exception, write);
+		if (rc < 0)
+			return X86EMUL_PROPAGATE_FAULT;
+		mmio[i] = (rc > 0);
+	}

-	/* Crossing a page boundary? */
-	if (((addr + bytes - 1) ^ addr) & PAGE_MASK) {
-		int rc, now;
-
-		now = -addr & ~PAGE_MASK;
-		rc = emulator_read_write_onepage(addr, val, now, exception,
-						 vcpu, ops);
-
+	/* Actual read/write */
+	for (i = 0; i < npages; i++) {
+		rc = emulator_read_write_onepage(gpa[i], val + offset[i],
+						 p_bytes[i], vcpu, ops,
+						 mmio[i]);
		if (rc != X86EMUL_CONTINUE)
			return rc;
-		addr += now;
-		val += now;
-		bytes -= now;
	}

-	return emulator_read_write_onepage(addr, val, bytes, exception,
-					   vcpu, ops);
+	return X86EMUL_CONTINUE;
}

static int emulator_read_emulated(struct x86_emulate_ctxt *ctxt,
-- 
1.7.4.1


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/