2014-07-09 17:21:41

by Boris Ostrovsky

Subject: [PATCH] espfix/xen: Fix allocation of pages for paravirt page tables

init_espfix_ap() is currently off by one level when informing hypervisor
that allocated pages will be used for ministacks' page tables.

The most immediate effect of this on a PV guest is that if
'stack_page = __get_free_page()' returns a non-zeroed-out page the hypervisor
will refuse to use it for a page table (which it shouldn't be anyway). This will
result in warnings by both Xen and Linux.

More importantly, a subsequent write to that page (again, by a PV guest) is
likely to result in fatal page fault.

Signed-off-by: Boris Ostrovsky <[email protected]>
---
arch/x86/kernel/espfix_64.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index 6afbb16..94d857f 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -175,7 +175,7 @@ void init_espfix_ap(void)
if (!pud_present(pud)) {
pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
- paravirt_alloc_pud(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
+ paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
for (n = 0; n < ESPFIX_PUD_CLONES; n++)
set_pud(&pud_p[n], pud);
}
@@ -185,7 +185,7 @@ void init_espfix_ap(void)
if (!pmd_present(pmd)) {
pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
- paravirt_alloc_pmd(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
+ paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
for (n = 0; n < ESPFIX_PMD_CLONES; n++)
set_pmd(&pmd_p[n], pmd);
}
@@ -193,7 +193,6 @@ void init_espfix_ap(void)
pte_p = pte_offset_kernel(&pmd, addr);
stack_page = (void *)__get_free_page(GFP_KERNEL);
pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
- paravirt_alloc_pte(&init_mm, __pa(stack_page) >> PAGE_SHIFT);
for (n = 0; n < ESPFIX_PTE_CLONES; n++)
set_pte(&pte_p[n*PTE_STRIDE], pte);

--
1.8.1.4

2014-07-09 18:13:17

by Konrad Rzeszutek Wilk

Subject: Re: [PATCH] espfix/xen: Fix allocation of pages for paravirt page tables

On Wed, Jul 09, 2014 at 01:18:18PM -0400, Boris Ostrovsky wrote:
> init_espfix_ap() is currently off by one level when informing hypervisor
> that allocated pages will be used for ministacks' page tables.
>
> The most immediate effect of this on a PV guest is that if
> 'stack_page = __get_free_page()' returns a non-zeroed-out page the hypervisor
> will refuse to use it for a page table (which it shouldn't be anyway). This will
> result in warnings by both Xen and Linux.
>
> More importantly, a subsequent write to that page (again, by a PV guest) is
> likely to result in fatal page fault.
>
> Signed-off-by: Boris Ostrovsky <[email protected]>

Reviewed-by: Konrad Rzeszutek Wilk <[email protected]>

<sigh>
> ---
> arch/x86/kernel/espfix_64.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
> index 6afbb16..94d857f 100644
> --- a/arch/x86/kernel/espfix_64.c
> +++ b/arch/x86/kernel/espfix_64.c
> @@ -175,7 +175,7 @@ void init_espfix_ap(void)
> if (!pud_present(pud)) {
> pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
> pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
> - paravirt_alloc_pud(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
> + paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
> for (n = 0; n < ESPFIX_PUD_CLONES; n++)
> set_pud(&pud_p[n], pud);
> }
> @@ -185,7 +185,7 @@ void init_espfix_ap(void)
> if (!pmd_present(pmd)) {
> pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
> pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
> - paravirt_alloc_pmd(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
> + paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
> for (n = 0; n < ESPFIX_PMD_CLONES; n++)
> set_pmd(&pmd_p[n], pmd);
> }
> @@ -193,7 +193,6 @@ void init_espfix_ap(void)
> pte_p = pte_offset_kernel(&pmd, addr);
> stack_page = (void *)__get_free_page(GFP_KERNEL);
> pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
> - paravirt_alloc_pte(&init_mm, __pa(stack_page) >> PAGE_SHIFT);
> for (n = 0; n < ESPFIX_PTE_CLONES; n++)
> set_pte(&pte_p[n*PTE_STRIDE], pte);
>
> --
> 1.8.1.4
>

2014-07-14 22:25:21

by tip-bot for Vasyl Gomonovych

Subject: [tip:x86/urgent] x86/espfix/xen: Fix allocation of pages for paravirt page tables

Commit-ID: 8762e5092828c4dc0f49da5a47a644c670df77f3
Gitweb: http://git.kernel.org/tip/8762e5092828c4dc0f49da5a47a644c670df77f3
Author: Boris Ostrovsky <[email protected]>
AuthorDate: Wed, 9 Jul 2014 13:18:18 -0400
Committer: H. Peter Anvin <[email protected]>
CommitDate: Mon, 14 Jul 2014 13:47:32 -0700

x86/espfix/xen: Fix allocation of pages for paravirt page tables

init_espfix_ap() is currently off by one level when informing hypervisor
that allocated pages will be used for ministacks' page tables.

The most immediate effect of this on a PV guest is that if
'stack_page = __get_free_page()' returns a non-zeroed-out page the hypervisor
will refuse to use it for a page table (which it shouldn't be anyway). This will
result in warnings by both Xen and Linux.

More importantly, a subsequent write to that page (again, by a PV guest) is
likely to result in fatal page fault.

Signed-off-by: Boris Ostrovsky <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Reviewed-by: Konrad Rzeszutek Wilk <[email protected]>
Signed-off-by: H. Peter Anvin <[email protected]>
Cc: <[email protected]>
---
arch/x86/kernel/espfix_64.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index 6afbb16..94d857f 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -175,7 +175,7 @@ void init_espfix_ap(void)
if (!pud_present(pud)) {
pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
- paravirt_alloc_pud(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
+ paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
for (n = 0; n < ESPFIX_PUD_CLONES; n++)
set_pud(&pud_p[n], pud);
}
@@ -185,7 +185,7 @@ void init_espfix_ap(void)
if (!pmd_present(pmd)) {
pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
- paravirt_alloc_pmd(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
+ paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
for (n = 0; n < ESPFIX_PMD_CLONES; n++)
set_pmd(&pmd_p[n], pmd);
}
@@ -193,7 +193,6 @@ void init_espfix_ap(void)
pte_p = pte_offset_kernel(&pmd, addr);
stack_page = (void *)__get_free_page(GFP_KERNEL);
pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
- paravirt_alloc_pte(&init_mm, __pa(stack_page) >> PAGE_SHIFT);
for (n = 0; n < ESPFIX_PTE_CLONES; n++)
set_pte(&pte_p[n*PTE_STRIDE], pte);