diff options
| author | Avi Kivity <avi@qumranet.com> | 2008-07-13 10:33:54 +0200 |
|---|---|---|
| committer | Avi Kivity <avi@qumranet.com> | 2008-07-20 11:42:40 +0200 |
| commit | 722c05f2192070bac0208b2c16ce13929b32d92f (patch) | |
| tree | 918037277cd65ec4abc1a9b5b15dcf0b8bb8fe25 /arch | |
| parent | KVM: x86 emulator: emulate clflush (diff) | |
| download | linux-722c05f2192070bac0208b2c16ce13929b32d92f.tar.xz linux-722c05f2192070bac0208b2c16ce13929b32d92f.zip | |
KVM: MMU: Fix potential race setting upper shadow ptes on nonpae hosts
The direct mapped shadow code (used for real mode and two dimensional paging)
sets upper-level ptes using direct assignment rather than calling
set_shadow_pte(). A nonpae host will split this into two writes, which opens
up a race if another vcpu accesses the same memory area.
Fix by calling set_shadow_pte() instead of assigning directly.
Noticed by Izik Eidus.
Signed-off-by: Avi Kivity <avi@qumranet.com>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/kvm/mmu.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c index 7f57da663826..b0e4ddca6c18 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -1189,9 +1189,10 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write, return -ENOMEM; } - table[index] = __pa(new_table->spt) - | PT_PRESENT_MASK | PT_WRITABLE_MASK - | shadow_user_mask | shadow_x_mask; + set_shadow_pte(&table[index], + __pa(new_table->spt) + | PT_PRESENT_MASK | PT_WRITABLE_MASK + | shadow_user_mask | shadow_x_mask); } table_addr = table[index] & PT64_BASE_ADDR_MASK; } |