LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Avi Kivity <avi@qumranet.com>
To: kvm-devel@lists.sourceforge.net
Cc: linux-kernel@vger.kernel.org, Avi Kivity <avi@qumranet.com>
Subject: [PATCH 36/41] KVM: x86 emulator: fix bit string operations operand size
Date: Sun,  1 Apr 2007 17:35:33 +0300	[thread overview]
Message-ID: <11754381392948-git-send-email-avi@qumranet.com> (raw)
In-Reply-To: <11754381393714-git-send-email-avi@qumranet.com>

On x86, bit operations operate on a string of bits that can reside in
multiple words.  For example, 'btsl %eax, (blah)' will touch the word
at blah+4 if %eax is between 32 and 63.

The x86 emulator compensates for that by advancing the operand address
by (bit offset / BITS_PER_LONG) and truncating the bit offset to the
range (0..BITS_PER_LONG-1).  This has a side effect of forcing the operand
size to 8 bytes on 64-bit hosts.

Now, a 32-bit guest goes and fork()s a process.  It write protects a stack
page at 0xbffff000 using the 'btr' instruction, at offset 0xffc in the page
table, with bit offset 1 (for the write permission bit).

The emulator now forces the operand size to 8 bytes as previously described,
and an innocent page table update turns into a cross-page-boundary write,
which is assumed by the mmu code not to be a page table, so it doesn't
actually clear the corresponding shadow page table entry.  The guest and
host permissions are out of sync and guest memory is corrupted soon
afterwards, leading to guest failure.

Fix by not using BITS_PER_LONG as the word size; instead use the actual
operand size, so we get a 32-bit write in that case.

Note we still have to teach the mmu to handle cross-page-boundary writes
to guest page table; but for now this allows Damn Small Linux 0.4 (2.4.20)
to boot.

Signed-off-by: Avi Kivity <avi@qumranet.com>
---
 drivers/kvm/x86_emulate.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/kvm/x86_emulate.c b/drivers/kvm/x86_emulate.c
index 7513cdd..bcf872b 100644
--- a/drivers/kvm/x86_emulate.c
+++ b/drivers/kvm/x86_emulate.c
@@ -833,8 +833,9 @@ done_prefixes:
 		dst.ptr = (unsigned long *)cr2;
 		dst.bytes = (d & ByteOp) ? 1 : op_bytes;
 		if (d & BitOp) {
-			dst.ptr += src.val / BITS_PER_LONG;
-			dst.bytes = sizeof(long);
+			unsigned long mask = ~(dst.bytes * 8 - 1);
+
+			dst.ptr = (void *)dst.ptr + (src.val & mask) / 8;
 		}
 		if (!(d & Mov) && /* optimisation - avoid slow emulated read */
 		    ((rc = ops->read_emulated((unsigned long)dst.ptr,
-- 
1.5.0.5


  reply	other threads:[~2007-04-01 14:38 UTC|newest]

Thread overview: 42+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-04-01 14:34 [PATCH 00/41] kvm updates for 2.6.22 Avi Kivity
2007-04-01 14:34 ` [PATCH 01/41] KVM: Fix guest register corruption on paravirt hypercall Avi Kivity
2007-04-01 14:34   ` [PATCH 02/41] KVM: Use the generic skip_emulated_instruction() in hypercall code Avi Kivity
2007-04-01 14:35     ` [PATCH 03/41] KVM: Use own minor number Avi Kivity
2007-04-01 14:35       ` [PATCH 04/41] KVM: Export <linux/kvm.h> Avi Kivity
2007-04-01 14:35         ` [PATCH 05/41] KVM: Fix bogus sign extension in mmu mapping audit Avi Kivity
2007-04-01 14:35           ` [PATCH 06/41] KVM: Use a shared page for kernel/user communication when runing a vcpu Avi Kivity
2007-04-01 14:35             ` [PATCH 07/41] KVM: Do not communicate to userspace through cpu registers during PIO Avi Kivity
2007-04-01 14:35               ` [PATCH 08/41] KVM: Handle cpuid in the kernel instead of punting to userspace Avi Kivity
2007-04-01 14:35                 ` [PATCH 09/41] KVM: Remove the 'emulated' field from the userspace interface Avi Kivity
2007-04-01 14:35                   ` [PATCH 10/41] KVM: Remove minor wart from KVM_CREATE_VCPU ioctl Avi Kivity
2007-04-01 14:35                     ` [PATCH 11/41] KVM: Renumber ioctls Avi Kivity
2007-04-01 14:35                       ` [PATCH 12/41] KVM: Add method to check for backwards-compatible API extensions Avi Kivity
2007-04-01 14:35                         ` [PATCH 13/41] KVM: Allow userspace to process hypercalls which have no kernel handler Avi Kivity
2007-04-01 14:35                           ` [PATCH 14/41] KVM: Fold kvm_run::exit_type into kvm_run::exit_reason Avi Kivity
2007-04-01 14:35                             ` [PATCH 15/41] KVM: Add a special exit reason when exiting due to an interrupt Avi Kivity
2007-04-01 14:35                               ` [PATCH 16/41] KVM: Initialize the apic_base msr on svm too Avi Kivity
2007-04-01 14:35                                 ` [PATCH 17/41] KVM: Add guest mode signal mask Avi Kivity
2007-04-01 14:35                                   ` [PATCH 18/41] KVM: Allow kernel to select size of mmap() buffer Avi Kivity
2007-04-01 14:35                                     ` [PATCH 19/41] KVM: Future-proof argument-less ioctls Avi Kivity
2007-04-01 14:35                                       ` [PATCH 20/41] KVM: Avoid guest virtual addresses in string pio userspace interface Avi Kivity
2007-04-01 14:35                                         ` [PATCH 21/41] KVM: MMU: Remove unnecessary check for pdptr access Avi Kivity
2007-04-01 14:35                                           ` [PATCH 22/41] KVM: MMU: Remove global pte tracking Avi Kivity
2007-04-01 14:35                                             ` [PATCH 23/41] KVM: Workaround vmx inability to virtualize the reset state Avi Kivity
2007-04-01 14:35                                               ` [PATCH 24/41] KVM: Remove set_cr0_no_modeswitch() arch op Avi Kivity
2007-04-01 14:35                                                 ` [PATCH 25/41] KVM: Modify guest segments after potentially switching modes Avi Kivity
2007-04-01 14:35                                                   ` [PATCH 26/41] KVM: Hack real-mode segments on vmx from KVM_SET_SREGS Avi Kivity
2007-04-01 14:35                                                     ` [PATCH 27/41] KVM: Don't allow the guest to turn off the cpu cache Avi Kivity
2007-04-01 14:35                                                       ` [PATCH 28/41] KVM: Remove unused and write-only variables Avi Kivity
2007-04-01 14:35                                                         ` [PATCH 29/41] KVM: Handle writes to MCG_STATUS msr Avi Kivity
2007-04-01 14:35                                                           ` [PATCH 30/41] KVM: SVM: forbid guest to execute monitor/mwait Avi Kivity
2007-04-01 14:35                                                             ` [PATCH 31/41] KVM: MMU: Fix hugepage pdes mapping same physical address with different access Avi Kivity
2007-04-01 14:35                                                               ` [PATCH 32/41] KVM: SVM: Ensure timestamp counter monotonicity Avi Kivity
2007-04-01 14:35                                                                 ` [PATCH 33/41] KVM: Remove unused function Avi Kivity
2007-04-01 14:35                                                                   ` [PATCH 34/41] KVM: Use list_move() Avi Kivity
2007-04-01 14:35                                                                     ` [PATCH 35/41] KVM: Remove debug message Avi Kivity
2007-04-01 14:35                                                                       ` Avi Kivity [this message]
2007-04-01 14:35                                                                         ` [PATCH 37/41] KVM: Add mmu cache clear function Avi Kivity
2007-04-01 14:35                                                                           ` [PATCH 38/41] KVM: Simply gfn_to_page() Avi Kivity
2007-04-01 14:35                                                                             ` [PATCH 39/41] KVM: Add physical memory aliasing feature Avi Kivity
2007-04-01 14:35                                                                               ` [PATCH 40/41] KVM: Add fpu get/set operations Avi Kivity
2007-04-01 14:35                                                                                 ` [PATCH 41/41] KVM: SVM: enable LBRV virtualization if available Avi Kivity

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=11754381392948-git-send-email-avi@qumranet.com \
    --to=avi@qumranet.com \
    --cc=kvm-devel@lists.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    --subject='Re: [PATCH 36/41] KVM: x86 emulator: fix bit string operations operand size' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).