linux-kernel - Re: [PATCH v2 2/2] KVM: Fix writeback on page boundary that propagate changes in spite of #PF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 26 Jan 2012 13:54:09 +0200
From:	Gleb Natapov <gleb@...hat.com>
To:	Nadav Amit <nadav.amit@...il.com>
Cc:	Avi Kivity <avi@...hat.com>, Nadav Amit <namit@...technion.ac.il>,
	Marcelo Tosatti <mtosatti@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
	kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 2/2] KVM: Fix writeback on page boundary that
 propagate changes in spite of #PF

On Sun, Jan 22, 2012 at 01:01:18PM +0200, Nadav Amit wrote:
> Consider the case in which an instruction emulation writeback is performed on a page boundary.
> In such case, if a #PF occurs on the second page, the write to the first page already occurred and cannot be retracted.
> Therefore, validation of the second page access must be performed prior to writeback.
> 
Patch is corrupted.

> Signed-off-by: Nadav Amit <nadav.amit@...il.com>
> ---
> arch/x86/kvm/x86.c |   60 +++++++++++++++++++++++++++++----------------------
> 1 files changed, 34 insertions(+), 26 deletions(-)
> 
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 05fd3d7..0e86f3a 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -3689,33 +3689,27 @@ static struct read_write_emulator_ops write_emultor = {
> 	.write = true,
> };
> 
> -static int emulator_read_write_onepage(unsigned long addr, void *val,
> +static int emulator_read_write_onepage(gpa_t gpa, void *val,
> 				       unsigned int bytes,
> -				       struct x86_exception *exception,
> 				       struct kvm_vcpu *vcpu,
> -				       struct read_write_emulator_ops *ops)
> +				       struct read_write_emulator_ops *ops,
> +				       bool mmio)
> {
> -	gpa_t gpa;
> -	int handled, ret;
> +	int handled;
> 	bool write = ops->write;
> 
> 	if (ops->read_write_prepare &&
> 		  ops->read_write_prepare(vcpu, val, bytes))
> 		return X86EMUL_CONTINUE;
> 
> -	ret = vcpu_mmio_gva_to_gpa(vcpu, addr, &gpa, exception, write);
> -
> -	if (ret < 0)
> -		return X86EMUL_PROPAGATE_FAULT;
> -
> 	/* For APIC access vmexit */
> -	if (ret)
> -		goto mmio;
> +	if (mmio)
> +		goto do_mmio;
> 
> 	if (ops->read_write_emulate(vcpu, gpa, val, bytes))
> 		return X86EMUL_CONTINUE;
> 
> -mmio:
> +do_mmio:
> 	/*
> 	 * Is this MMIO handled locally?
> 	 */
> @@ -3744,24 +3738,38 @@ int emulator_read_write(struct x86_emulate_ctxt *ctxt, unsigned long addr,
> 			struct read_write_emulator_ops *ops)
> {
> 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
> +	int i, rc;
> +	bool write = ops->write;
> +	gpa_t gpa[2];
> +	int npages = (((addr + bytes - 1) ^ addr) & PAGE_MASK) ? 2 : 1;
> +	unsigned int offset[2] = {0};
> +	unsigned int p_bytes[2] = {bytes, 0};
> +	bool mmio[2];
> +
> +	if (npages == 2) {
> +		p_bytes[0] = offset[1] = -addr & ~PAGE_MASK;
> +		p_bytes[1] = bytes - p_bytes[0];
> +	}
> +
> +	/* First check there is no page-fault on the next page */
> +	for (i = 0; i < npages; i++) {
> +		rc = vcpu_mmio_gva_to_gpa(vcpu, addr + offset[i], &gpa[i],
> +			exception, write);
> +		if (rc < 0)
> +			return X86EMUL_PROPAGATE_FAULT;
> +		mmio[i] = (rc > 0);
> +	}
> 
> -	/* Crossing a page boundary? */
> -	if (((addr + bytes - 1) ^ addr) & PAGE_MASK) {
> -		int rc, now;
> -
> -		now = -addr & ~PAGE_MASK;
> -		rc = emulator_read_write_onepage(addr, val, now, exception,
> -						 vcpu, ops);
> -
> +	/* Actual read/write */
> +	for (i = 0; i < npages; i++) {
> +		rc = emulator_read_write_onepage(gpa[i], val + offset[i],
> +						 p_bytes[i], vcpu, ops,
> +						 mmio[i]);
> 		if (rc != X86EMUL_CONTINUE)
> 			return rc;
> -		addr += now;
> -		val += now;
> -		bytes -= now;
> 	}
> 
> -	return emulator_read_write_onepage(addr, val, bytes, exception,
> -					   vcpu, ops);
> +	return X86EMUL_CONTINUE;
> }
> 
> static int emulator_read_emulated(struct x86_emulate_ctxt *ctxt,
> -- 
> 1.7.4.1
> 

--
			Gleb.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/