[PATCH v2 2/10] KVM: MMU: fix conflict access permissions in directsp

From: Xiao Guangrong
Date: Fri Jun 25 2010 - 08:09:40 EST

In no-direct mapping, we mark sp is 'direct' when we mapping the
guest's larger page, but its access is encoded form upper page-struct
entire not include the last mapping, it will cause access conflict.

For example, have this mapping:
/ PDE1 -> |---|
P[W] | | LPA
\ PDE2 -> |---|

P have two children, PDE1 and PDE2, both PDE1 and PDE2 mapping the
same lage page(LPA). The P's access is WR, PDE1's access is WR,
PDE2's access is RO(just consider read-write permissions here)

When guest access PDE1, we will create a direct sp for LPA, the sp's
access is from P, is W, then we will mark the ptes is W in this sp.

Then, guest access PDE2, we will find LPA's shadow page, is the same as
PDE's, and mark the ptes is RO.

So, if guest access PDE1, the incorrect #PF is occured.

Fixed by encode the last mapping access into direct shadow page

And, it also cleanup the code that directly get the last level's dirty flag

Signed-off-by: Xiao Guangrong <xiaoguangrong@xxxxxxxxxxxxxx>
arch/x86/kvm/paging_tmpl.h | 9 +++++----
1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 37c26cb..e46eb8a 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -306,6 +306,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
gfn_t table_gfn;
int r;
int level;
+ bool dirty = is_dirty_gpte(gw->ptes[gw->level-1]);
pt_element_t curr_pte;
struct kvm_shadow_walk_iterator iterator;

@@ -319,8 +320,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
mmu_set_spte(vcpu, sptep, access,
gw->pte_access & access,
user_fault, write_fault,
- is_dirty_gpte(gw->ptes[gw->level-1]),
- ptwrite, level,
+ dirty, ptwrite, level,
gw->gfn, pfn, false, true);
@@ -335,10 +335,11 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,

if (level <= gw->level) {
- int delta = level - gw->level + 1;
direct = 1;
- if (!is_dirty_gpte(gw->ptes[level - delta]))
+ if (!dirty)
access &= ~ACC_WRITE_MASK;
+ access &= gw->pte_access;
* It is a large guest pages backed by small host pages,
* So we set @direct(@sp->role.direct)=1, and set

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/