| Message ID | 4F561D8A.4010404@siemens.com |
|---|---|
| State | New |
| Headers | show |
On 03/06/2012 04:22 PM, Jan Kiszka wrote: > This was a long pending bug, now revealed by the assert in > phys_page_find that stumbled over the large page index returned by > cpu_get_phys_page_debug for NX-marked pages: We need to mask out NX and > all user-definable bits 52..62 from PDEs and the final PTE to avoid > corrupting physical addresses. > > Reviewed-by: Avi Kivity <avi@redhat.com>
Thanks, applied. On Tue, Mar 6, 2012 at 14:22, Jan Kiszka <jan.kiszka@siemens.com> wrote: > This was a long pending bug, now revealed by the assert in > phys_page_find that stumbled over the large page index returned by > cpu_get_phys_page_debug for NX-marked pages: We need to mask out NX and > all user-definable bits 52..62 from PDEs and the final PTE to avoid > corrupting physical addresses. > > Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> > --- > > Changes in v2 (as suggested by Avi): > - Mask PDEs as well > - Mask user-definable bits > > target-i386/cpu.h | 1 + > target-i386/helper.c | 13 +++++++------ > 2 files changed, 8 insertions(+), 6 deletions(-) > > diff --git a/target-i386/cpu.h b/target-i386/cpu.h > index 196b0c5..36e3d29 100644 > --- a/target-i386/cpu.h > +++ b/target-i386/cpu.h > @@ -241,6 +241,7 @@ > #define PG_DIRTY_MASK (1 << PG_DIRTY_BIT) > #define PG_PSE_MASK (1 << PG_PSE_BIT) > #define PG_GLOBAL_MASK (1 << PG_GLOBAL_BIT) > +#define PG_HI_USER_MASK 0x7ff0000000000000LL > #define PG_NX_MASK (1LL << PG_NX_BIT) > > #define PG_ERROR_W_BIT 1 > diff --git a/target-i386/helper.c b/target-i386/helper.c > index af6bba2..f4f3c27 100644 > --- a/target-i386/helper.c > +++ b/target-i386/helper.c > @@ -885,8 +885,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr) > if (!(pml4e & PG_PRESENT_MASK)) > return -1; > > - pdpe_addr = ((pml4e & ~0xfff) + (((addr >> 30) & 0x1ff) << 3)) & > - env->a20_mask; > + pdpe_addr = ((pml4e & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) + > + (((addr >> 30) & 0x1ff) << 3)) & env->a20_mask; > pdpe = ldq_phys(pdpe_addr); > if (!(pdpe & PG_PRESENT_MASK)) > return -1; > @@ -900,8 +900,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr) > return -1; > } > > - pde_addr = ((pdpe & ~0xfff) + (((addr >> 21) & 0x1ff) << 3)) & > - env->a20_mask; > + pde_addr = ((pdpe & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) + > + (((addr >> 21) & 0x1ff) << 3)) & env->a20_mask; > pde = ldq_phys(pde_addr); > if (!(pde & PG_PRESENT_MASK)) { > return -1; > @@ -912,11 +912,12 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr) > pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */ > } else { > /* 4 KB page */ > - pte_addr = ((pde & ~0xfff) + (((addr >> 12) & 0x1ff) << 3)) & > - env->a20_mask; > + pte_addr = ((pde & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) + > + (((addr >> 12) & 0x1ff) << 3)) & env->a20_mask; > page_size = 4096; > pte = ldq_phys(pte_addr); > } > + pte &= ~(PG_NX_MASK | PG_HI_USER_MASK); > if (!(pte & PG_PRESENT_MASK)) > return -1; > } else { > -- > 1.7.3.4
diff --git a/target-i386/cpu.h b/target-i386/cpu.h index 196b0c5..36e3d29 100644 --- a/target-i386/cpu.h +++ b/target-i386/cpu.h @@ -241,6 +241,7 @@ #define PG_DIRTY_MASK (1 << PG_DIRTY_BIT) #define PG_PSE_MASK (1 << PG_PSE_BIT) #define PG_GLOBAL_MASK (1 << PG_GLOBAL_BIT) +#define PG_HI_USER_MASK 0x7ff0000000000000LL #define PG_NX_MASK (1LL << PG_NX_BIT) #define PG_ERROR_W_BIT 1 diff --git a/target-i386/helper.c b/target-i386/helper.c index af6bba2..f4f3c27 100644 --- a/target-i386/helper.c +++ b/target-i386/helper.c @@ -885,8 +885,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr) if (!(pml4e & PG_PRESENT_MASK)) return -1; - pdpe_addr = ((pml4e & ~0xfff) + (((addr >> 30) & 0x1ff) << 3)) & - env->a20_mask; + pdpe_addr = ((pml4e & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) + + (((addr >> 30) & 0x1ff) << 3)) & env->a20_mask; pdpe = ldq_phys(pdpe_addr); if (!(pdpe & PG_PRESENT_MASK)) return -1; @@ -900,8 +900,8 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr) return -1; } - pde_addr = ((pdpe & ~0xfff) + (((addr >> 21) & 0x1ff) << 3)) & - env->a20_mask; + pde_addr = ((pdpe & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) + + (((addr >> 21) & 0x1ff) << 3)) & env->a20_mask; pde = ldq_phys(pde_addr); if (!(pde & PG_PRESENT_MASK)) { return -1; @@ -912,11 +912,12 @@ target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr) pte = pde & ~( (page_size - 1) & ~0xfff); /* align to page_size */ } else { /* 4 KB page */ - pte_addr = ((pde & ~0xfff) + (((addr >> 12) & 0x1ff) << 3)) & - env->a20_mask; + pte_addr = ((pde & ~0xfff & ~(PG_NX_MASK | PG_HI_USER_MASK)) + + (((addr >> 12) & 0x1ff) << 3)) & env->a20_mask; page_size = 4096; pte = ldq_phys(pte_addr); } + pte &= ~(PG_NX_MASK | PG_HI_USER_MASK); if (!(pte & PG_PRESENT_MASK)) return -1; } else {
This was a long pending bug, now revealed by the assert in phys_page_find that stumbled over the large page index returned by cpu_get_phys_page_debug for NX-marked pages: We need to mask out NX and all user-definable bits 52..62 from PDEs and the final PTE to avoid corrupting physical addresses. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> --- Changes in v2 (as suggested by Avi): - Mask PDEs as well - Mask user-definable bits target-i386/cpu.h | 1 + target-i386/helper.c | 13 +++++++------ 2 files changed, 8 insertions(+), 6 deletions(-)