[Xen-changelog] [xen stable-4.4] x86/PVH: avoid call to handle_mmio

[patchbot@xxxxxxx]

commit 31e260ceb57e0de5c868581e3937f247fad5e288
Author:     Mukesh Rathor <mukesh.rathor@xxxxxxxxxx>
AuthorDate: Tue Jun 24 09:33:18 2014 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jun 24 09:33:18 2014 +0200

    x86/PVH: avoid call to handle_mmio
    
    handle_mmio() is currently unsafe for pvh guests. A call to it would
    result in call to vioapic_range that will crash xen since the vioapic
    ptr in struct hvm_domain is not initialized for pvh guests.
    
    However, one path exists for such a call. If a pvh guest, dom0 or domU,
    unintentionally touches non-existing memory, an EPT violation would occur.
    This would result in unconditional call to hvm_hap_nested_page_fault. In
    that function, because get_gfn_type_access returns p2m_mmio_dm for non
    existing mfns by default, handle_mmio() will get called. This would result
    in xen crash instead of the guest crash. This patch addresses that.
    
    Signed-off-by: Mukesh Rathor <mukesh.rathor@xxxxxxxxxx>
    master commit: 7c4870915c2d50acbc66347a532e33b452f64f17
    master date: 2014-06-04 11:27:50 +0200
---
 xen/arch/x86/hvm/hvm.c |    5 +++++
 xen/arch/x86/hvm/io.c  |    2 ++
 2 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 216c3f2..00ca528 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -1527,6 +1527,11 @@ int hvm_hap_nested_page_fault(paddr_t gpa,
          (access_w && (p2mt == p2m_ram_ro)) )
     {
         put_gfn(p2m->domain, gfn);
+
+        rc = 0;
+        if ( unlikely(is_pvh_vcpu(v)) )
+            goto out;
+
         if ( !handle_mmio() )
             hvm_inject_hw_exception(TRAP_gp_fault, 0);
         rc = 1;
diff --git a/xen/arch/x86/hvm/io.c b/xen/arch/x86/hvm/io.c
index bf6309d..247fb7e 100644
--- a/xen/arch/x86/hvm/io.c
+++ b/xen/arch/x86/hvm/io.c
@@ -178,6 +178,8 @@ int handle_mmio(void)
     struct hvm_vcpu_io *vio = &curr->arch.hvm_vcpu.hvm_io;
     int rc;
 
+    ASSERT(!is_pvh_vcpu(curr));
+
     hvm_emulate_prepare(&ctxt, guest_cpu_user_regs());
 
     rc = hvm_emulate_one(&ctxt);
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog