From patchwork Wed May 11 15:17:24 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 776092 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter2.kernel.org (8.14.4/8.14.3) with ESMTP id p4BFhIo8024447 for ; Wed, 11 May 2011 15:43:18 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752067Ab1EKPmK (ORCPT ); Wed, 11 May 2011 11:42:10 -0400 Received: from mail-wy0-f174.google.com ([74.125.82.174]:38226 "EHLO mail-wy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754289Ab1EKPmF (ORCPT ); Wed, 11 May 2011 11:42:05 -0400 Received: by mail-wy0-f174.google.com with SMTP id 21so481132wya.19 for ; Wed, 11 May 2011 08:42:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer :in-reply-to:references; bh=OnkNLctj93GBOsTXryaTeq9xQe/8Ud9p1RyrfyD/OXs=; b=XbIcUZ3MIcOsR2PC7twzWcimmVnwkc9wA0pFeV/6IFWJjuk4kUSpRquFpiIECruR6z QJDaqWCYun8HcTEvQCB8i1NxoWTYCvjfp9mcuZcvgu32OPDgnVZkXvcEsZ1YMnaNuFeL OKOpu5jgSJ83eS0vCX1KHjWhUodZRQFZenl9c= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; b=uo32LL22/bKg2IVf+2ksjYSiuxJjQWZgu9asN/Chf4btE2N5M4XWWkcmg/54VaLkfz mP6UyG77NIgr7h+hR6t1Tl8U/ESsL0UOe33FzGiCEU9UlqQNp2SB8HN6A6gbQz5jRmAG 9YMnGA70IeGA5HxUGKAKrwgVb9FTjYYQo0sls= Received: by 10.227.183.76 with SMTP id cf12mr10113215wbb.66.1305127062280; Wed, 11 May 2011 08:17:42 -0700 (PDT) Received: from localhost.localdomain ([188.120.134.217]) by mx.google.com with ESMTPS id w25sm170262wbd.22.2011.05.11.08.17.40 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 11 May 2011 08:17:41 -0700 (PDT) From: levinsasha928@gmail.com To: penberg@kernel.org Cc: mingo@elte.hu, asias.hejun@gmail.com, prasadjoshi124@gmail.com, avi@redhat.com, gorcunov@gmail.com, kvm@vger.kernel.org, Sasha Levin Subject: [PATCH 2/3 V3] kvm tools: Prevent PFN wraparound Date: Wed, 11 May 2011 18:17:24 +0300 Message-Id: <4dcaa895.5925e30a.0f9e.125d@mx.google.com> X-Mailer: git-send-email 1.7.5.rc3 In-Reply-To: <1305127045-3532-1-git-send-email-a> References: <1305127045-3532-1-git-send-email-a> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Wed, 11 May 2011 15:43:18 +0000 (UTC) From: Sasha Levin queue->pfn may be used to point at addresses larger than 32 bit. Prevent a wraparound when shifting it left. Changes in V2: - Use helper function. Changes in V3: - Add warning for using guest_pfn_to_host() on 32-bit hosts. Signed-off-by: Sasha Levin --- tools/kvm/include/kvm/virtio.h | 10 ++++++++++ tools/kvm/virtio/blk.c | 2 +- tools/kvm/virtio/console.c | 2 +- tools/kvm/virtio/net.c | 2 +- tools/kvm/virtio/rng.c | 2 +- 5 files changed, 14 insertions(+), 4 deletions(-) diff --git a/tools/kvm/include/kvm/virtio.h b/tools/kvm/include/kvm/virtio.h index 7f92dea..bea63df 100644 --- a/tools/kvm/include/kvm/virtio.h +++ b/tools/kvm/include/kvm/virtio.h @@ -36,6 +36,16 @@ static inline bool virt_queue__available(struct virt_queue *vq) return vq->vring.avail->idx != vq->last_avail_idx; } +/* + * Warning: on 32-bit hosts, shifting pfn left may cause a truncation of pfn values + * higher than 4GB - thus, pointing to the wrong area in guest virtual memory space + * and breaking the virt queue which owns this pfn. + */ +static inline void *guest_pfn_to_host(struct kvm *kvm, u32 pfn) +{ + return guest_flat_to_host(kvm, (unsigned long)pfn << 12); +} + struct vring_used_elem *virt_queue__set_used_elem(struct virt_queue *queue, u32 head, u32 len); u16 virt_queue__get_iov(struct virt_queue *queue, struct iovec iov[], u16 *out, u16 *in, struct kvm *kvm); diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c index 12c7029..9f1aa1d 100644 --- a/tools/kvm/virtio/blk.c +++ b/tools/kvm/virtio/blk.c @@ -197,7 +197,7 @@ static bool virtio_blk_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &bdev->vqs[bdev->queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_pfn_to_host(self, queue->pfn); vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c index f9031cb..87b816a 100644 --- a/tools/kvm/virtio/console.c +++ b/tools/kvm/virtio/console.c @@ -199,7 +199,7 @@ static bool virtio_console_pci_io_out(struct kvm *self, u16 port, void *data, in queue = &cdev.vqs[cdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_pfn_to_host(self, queue->pfn); vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c index 8d430e3..3f3ee22 100644 --- a/tools/kvm/virtio/net.c +++ b/tools/kvm/virtio/net.c @@ -245,7 +245,7 @@ static bool virtio_net_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &net_device.vqs[net_device.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_pfn_to_host(self, queue->pfn); vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c index f692dfd..1951d0d1c 100644 --- a/tools/kvm/virtio/rng.c +++ b/tools/kvm/virtio/rng.c @@ -129,7 +129,7 @@ static bool virtio_rng_pci_io_out(struct kvm *kvm, u16 port, void *data, int siz queue = &rdev.vqs[rdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(kvm, queue->pfn << 12); + p = guest_pfn_to_host(kvm, queue->pfn); vring_init(&queue->vring, VIRTIO_RNG_QUEUE_SIZE, p, 4096);