Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1871c602 authored by Gleb Natapov's avatar Gleb Natapov Committed by Marcelo Tosatti
Browse files

KVM: x86 emulator: fix memory access during x86 emulation 



Currently when x86 emulator needs to access memory, page walk is done with
broadest permission possible, so if emulated instruction was executed
by userspace process it can still access kernel memory. Fix that by
providing correct memory access to page walker during emulation.

Signed-off-by: default avatarGleb Natapov <gleb@redhat.com>
Cc: stable@kernel.org
Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
parent a0044755

arch/x86/include/asm/kvm_emulate.h

+12 −2
Original line number Diff line number Diff line
@@ -54,13 +54,23 @@ struct x86_emulate_ctxt; 
struct x86_emulate_ops {

	/*

	 * read_std: Read bytes of standard (non-emulated/special) memory.

	 *           Used for instruction fetch, stack operations, and others.

	 *           Used for descriptor reading.

	 *  @addr:  [IN ] Linear address from which to read.

	 *  @val:   [OUT] Value read from memory, zero-extended to 'u_long'.

	 *  @bytes: [IN ] Number of bytes to read from memory.

	 */

	int (*read_std)(unsigned long addr, void *val,

			unsigned int bytes, struct kvm_vcpu *vcpu);

			unsigned int bytes, struct kvm_vcpu *vcpu, u32 *error);



	/*

	 * fetch: Read bytes of standard (non-emulated/special) memory.

	 *        Used for instruction fetch.

	 *  @addr:  [IN ] Linear address from which to read.

	 *  @val:   [OUT] Value read from memory, zero-extended to 'u_long'.

	 *  @bytes: [IN ] Number of bytes to read from memory.

	 */

	int (*fetch)(unsigned long addr, void *val,

			unsigned int bytes, struct kvm_vcpu *vcpu, u32 *error);



	/*

	 * read_emulated: Read bytes from emulated/special memory area.

arch/x86/include/asm/kvm_host.h

+6 −1
Original line number Diff line number Diff line
@@ -243,7 +243,8 @@ struct kvm_mmu { 
	void (*new_cr3)(struct kvm_vcpu *vcpu);

	int (*page_fault)(struct kvm_vcpu *vcpu, gva_t gva, u32 err);

	void (*free)(struct kvm_vcpu *vcpu);

	gpa_t (*gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t gva);

	gpa_t (*gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t gva, u32 access,

			    u32 *error);

	void (*prefetch_page)(struct kvm_vcpu *vcpu,

			      struct kvm_mmu_page *page);

	int (*sync_page)(struct kvm_vcpu *vcpu,
@@ -660,6 +661,10 @@ void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu); 
int kvm_mmu_load(struct kvm_vcpu *vcpu);

void kvm_mmu_unload(struct kvm_vcpu *vcpu);

void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu);

gpa_t kvm_mmu_gva_to_gpa_read(struct kvm_vcpu *vcpu, gva_t gva, u32 *error);

gpa_t kvm_mmu_gva_to_gpa_fetch(struct kvm_vcpu *vcpu, gva_t gva, u32 *error);

gpa_t kvm_mmu_gva_to_gpa_write(struct kvm_vcpu *vcpu, gva_t gva, u32 *error);

gpa_t kvm_mmu_gva_to_gpa_system(struct kvm_vcpu *vcpu, gva_t gva, u32 *error);



int kvm_emulate_hypercall(struct kvm_vcpu *vcpu);

arch/x86/kvm/emulate.c

+3 −3
Original line number Diff line number Diff line
@@ -616,7 +616,7 @@ static int do_fetch_insn_byte(struct x86_emulate_ctxt *ctxt, 


	if (linear < fc->start || linear >= fc->end) {

		size = min(15UL, PAGE_SIZE - offset_in_page(linear));

		rc = ops->read_std(linear, fc->data, size, ctxt->vcpu);

		rc = ops->fetch(linear, fc->data, size, ctxt->vcpu, NULL);

		if (rc)

			return rc;

		fc->start = linear;
@@ -671,11 +671,11 @@ static int read_descriptor(struct x86_emulate_ctxt *ctxt, 
		op_bytes = 3;

	*address = 0;

	rc = ops->read_std((unsigned long)ptr, (unsigned long *)size, 2,

			   ctxt->vcpu);

			   ctxt->vcpu, NULL);

	if (rc)

		return rc;

	rc = ops->read_std((unsigned long)ptr + 2, address, op_bytes,

			   ctxt->vcpu);

			   ctxt->vcpu, NULL);

	return rc;

}

arch/x86/kvm/mmu.c

+7 −10
Original line number Diff line number Diff line
@@ -138,12 +138,6 @@ module_param(oos_shadow, bool, 0644); 
#define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | PT_USER_MASK \

			| PT64_NX_MASK)



#define PFERR_PRESENT_MASK (1U << 0)

#define PFERR_WRITE_MASK (1U << 1)

#define PFERR_USER_MASK (1U << 2)

#define PFERR_RSVD_MASK (1U << 3)

#define PFERR_FETCH_MASK (1U << 4)



#define RMAP_EXT 4



#define ACC_EXEC_MASK    1
@@ -1632,7 +1626,7 @@ struct page *gva_to_page(struct kvm_vcpu *vcpu, gva_t gva) 
{

	struct page *page;



	gpa_t gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, gva);

	gpa_t gpa = kvm_mmu_gva_to_gpa_read(vcpu, gva, NULL);



	if (gpa == UNMAPPED_GVA)

		return NULL;
@@ -2155,8 +2149,11 @@ void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu) 
	spin_unlock(&vcpu->kvm->mmu_lock);

}



static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr)

static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr,

				  u32 access, u32 *error)

{

	if (error)

		*error = 0;

	return vaddr;

}
@@ -2740,7 +2737,7 @@ int kvm_mmu_unprotect_page_virt(struct kvm_vcpu *vcpu, gva_t gva) 
	if (tdp_enabled)

		return 0;



	gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, gva);

	gpa = kvm_mmu_gva_to_gpa_read(vcpu, gva, NULL);



	spin_lock(&vcpu->kvm->mmu_lock);

	r = kvm_mmu_unprotect_page(vcpu->kvm, gpa >> PAGE_SHIFT);
@@ -3237,7 +3234,7 @@ static void audit_mappings_page(struct kvm_vcpu *vcpu, u64 page_pte, 
		if (is_shadow_present_pte(ent) && !is_last_spte(ent, level))

			audit_mappings_page(vcpu, ent, va, level - 1);

		else {

			gpa_t gpa = vcpu->arch.mmu.gva_to_gpa(vcpu, va);

			gpa_t gpa = kvm_mmu_gva_to_gpa_read(vcpu, va, NULL);

			gfn_t gfn = gpa >> PAGE_SHIFT;

			pfn_t pfn = gfn_to_pfn(vcpu->kvm, gfn);

			hpa_t hpa = (hpa_t)pfn << PAGE_SHIFT;

arch/x86/kvm/mmu.h

+6 −0
Original line number Diff line number Diff line
@@ -42,6 +42,12 @@ 
#define PT_DIRECTORY_LEVEL 2

#define PT_PAGE_TABLE_LEVEL 1



#define PFERR_PRESENT_MASK (1U << 0)

#define PFERR_WRITE_MASK (1U << 1)

#define PFERR_USER_MASK (1U << 2)

#define PFERR_RSVD_MASK (1U << 3)

#define PFERR_FETCH_MASK (1U << 4)



int kvm_mmu_get_spte_hierarchy(struct kvm_vcpu *vcpu, u64 addr, u64 sptes[4]);



static inline void kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)