[lkml]   [2010]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH v3 1/11] KVM: MMU: fix writable sync sp mapping
    While we sync many unsync sp at one time(in mmu_sync_children()),
    we may mapping the spte writable, it's dangerous, if one unsync
    sp's mapping gfn is another unsync page's gfn.

    For example:

    SP1.pte[0] = P
    SP2.gfn's pfn = P
    [SP1.pte[0] = SP2.gfn's pfn]

    First, we write protected SP1 and SP2, but SP1 and SP2 are still the
    unsync sp.

    Then, sync SP1 first, it will detect SP1.pte[0].gfn only has one unsync-sp,
    that is SP2, so it will mapping it writable, but we plan to sync SP2 soon,
    at this point, the SP2->unsync is not reliable since later we sync SP2 but
    SP2->gfn is already writable.

    So the final result is: SP2 is the sync page but SP2.gfn is writable.

    This bug will corrupt guest's page table, fixed by mark read-only mapping
    if the mapped gfn has shadow pages.

    Signed-off-by: Xiao Guangrong <>
    arch/x86/kvm/mmu.c | 5 ++++-
    1 files changed, 4 insertions(+), 1 deletions(-)

    diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
    index 045a0f9..24290f8 100644
    --- a/arch/x86/kvm/mmu.c
    +++ b/arch/x86/kvm/mmu.c
    @@ -1810,11 +1810,14 @@ static int mmu_need_write_protect(struct kvm_vcpu *vcpu, gfn_t gfn,
    bool need_unsync = false;

    for_each_gfn_indirect_valid_sp(vcpu->kvm, s, gfn, node) {
    + if (!can_unsync)
    + return 1;
    if (s->role.level != PT_PAGE_TABLE_LEVEL)
    return 1;

    if (!need_unsync && !s->unsync) {
    - if (!can_unsync || !oos_shadow)
    + if (!oos_shadow)
    return 1;
    need_unsync = true;

     \ /
      Last update: 2010-06-30 10:09    [W:0.027 / U:5.080 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site