[Xen-changelog] [xen master] x86/PVH: avoid call to handle_mmio

[patchbot@xxxxxxx]

commit 7c4870915c2d50acbc66347a532e33b452f64f17
Author:     Mukesh Rathor <mukesh.rathor@xxxxxxxxxx>
AuthorDate: Wed Jun 4 11:27:50 2014 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jun 4 11:27:50 2014 +0200

    x86/PVH: avoid call to handle_mmio
    
    handle_mmio() is currently unsafe for pvh guests. A call to it would
    result in call to vioapic_range that will crash xen since the vioapic
    ptr in struct hvm_domain is not initialized for pvh guests.
    
    However, one path exists for such a call. If a pvh guest, dom0 or domU,
    unintentionally touches non-existing memory, an EPT violation would occur.
    This would result in unconditional call to hvm_hap_nested_page_fault. In
    that function, because get_gfn_type_access returns p2m_mmio_dm for non
    existing mfns by default, handle_mmio() will get called. This would result
    in xen crash instead of the guest crash. This patch addresses that.
    
    Signed-off-by: Mukesh Rathor <mukesh.rathor@xxxxxxxxxx>
---
 xen/arch/x86/hvm/hvm.c |    5 +++++
 xen/arch/x86/hvm/io.c  |    2 ++
 2 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 163e62a..4f993f4 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2743,6 +2743,11 @@ int hvm_hap_nested_page_fault(paddr_t gpa,
          (access_w && (p2mt == p2m_ram_ro)) )
     {
         put_gfn(p2m->domain, gfn);
+
+        rc = 0;
+        if ( unlikely(is_pvh_vcpu(v)) )
+            goto out;
+
         if ( !handle_mmio() )
             hvm_inject_hw_exception(TRAP_gp_fault, 0);
         rc = 1;
diff --git a/xen/arch/x86/hvm/io.c b/xen/arch/x86/hvm/io.c
index a8fe0aa..b2b7b27 100644
--- a/xen/arch/x86/hvm/io.c
+++ b/xen/arch/x86/hvm/io.c
@@ -84,6 +84,8 @@ int handle_mmio(void)
     struct hvm_vcpu_io *vio = &curr->arch.hvm_vcpu.hvm_io;
     int rc;
 
+    ASSERT(!is_pvh_vcpu(curr));
+
     hvm_emulate_prepare(&ctxt, guest_cpu_user_regs());
 
     rc = hvm_emulate_one(&ctxt);
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog