[Xen-devel] [PATCH 2/7] x86/viridian: fix xen-hvmcrash when vp_assist page is present

[Paul Durrant <paul.durrant@xxxxxxxxxx>]

Currently use of xen-hvmcrash will cause an immediate domain_crash() in
initialize_vp_assist() because it is called from viridian_load_vcpu_ctxt()
without having first cleared any previous mapping.

This patch makes initialize_vp_assist() responsible for clearing previous
mappings, if necessary.

Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
---
Cc: Jan Beulich <jbeulich@xxxxxxxx>
Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/arch/x86/hvm/viridian.c        | 50 +++++++++++++++++++-------------------
 xen/include/asm-x86/hvm/viridian.h |  1 +
 2 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/xen/arch/x86/hvm/viridian.c b/xen/arch/x86/hvm/viridian.c
index d741e81..59d76d5 100644
--- a/xen/arch/x86/hvm/viridian.c
+++ b/xen/arch/x86/hvm/viridian.c
@@ -276,6 +276,22 @@ static void enable_hypercall_page(struct domain *d)
     put_page_and_type(page);
 }
 
+static void teardown_vp_assist(struct vcpu *v)
+{
+    void *va = v->arch.hvm_vcpu.viridian.vp_assist.va;
+    struct page_info *page;
+
+    if ( !va )
+        return;
+
+    v->arch.hvm_vcpu.viridian.vp_assist.va = NULL;
+
+    page = mfn_to_page(domain_page_map_to_mfn(va));
+
+    unmap_domain_page_global(va);
+    put_page_and_type(page);
+}
+
 static void initialize_vp_assist(struct vcpu *v)
 {
     struct domain *d = v->domain;
@@ -288,6 +304,14 @@ static void initialize_vp_assist(struct vcpu *v)
      * enlightenment.
      */
 
+    if ( v->arch.hvm_vcpu.viridian.vp_assist.va )
+    {
+        if ( v->arch.hvm_vcpu.viridian.vp_assist.gmfn == gmfn )
+            return;
+
+        teardown_vp_assist(v);
+    }
+
     if ( !page )
         goto fail;
 
@@ -306,15 +330,8 @@ static void initialize_vp_assist(struct vcpu *v)
 
     clear_page(va);
 
-    /*
-     * If we overwrite an existing address here then something has
-     * gone wrong and a domain page will leak. Instead crash the
-     * domain to make the problem obvious.
-     */
-    if ( v->arch.hvm_vcpu.viridian.vp_assist.va )
-        domain_crash(d);
-
     v->arch.hvm_vcpu.viridian.vp_assist.va = va;
+    v->arch.hvm_vcpu.viridian.vp_assist.gmfn = gmfn;
     return;
 
  fail:
@@ -322,22 +339,6 @@ static void initialize_vp_assist(struct vcpu *v)
              page ? page_to_mfn(page) : mfn_x(INVALID_MFN));
 }
 
-static void teardown_vp_assist(struct vcpu *v)
-{
-    void *va = v->arch.hvm_vcpu.viridian.vp_assist.va;
-    struct page_info *page;
-
-    if ( !va )
-        return;
-
-    v->arch.hvm_vcpu.viridian.vp_assist.va = NULL;
-
-    page = mfn_to_page(domain_page_map_to_mfn(va));
-
-    unmap_domain_page_global(va);
-    put_page_and_type(page);
-}
-
 void viridian_start_apic_assist(struct vcpu *v, int vector)
 {
     uint32_t *va = v->arch.hvm_vcpu.viridian.vp_assist.va;
@@ -513,7 +514,6 @@ int wrmsr_viridian_regs(uint32_t idx, uint64_t val)
 
     case HV_X64_MSR_VP_ASSIST_PAGE:
         perfc_incr(mshv_wrmsr_apic_msr);
-        teardown_vp_assist(v); /* release any previous mapping */
         v->arch.hvm_vcpu.viridian.vp_assist.msr.raw = val;
         dump_vp_assist(v);
         if ( v->arch.hvm_vcpu.viridian.vp_assist.msr.fields.enabled )
diff --git a/xen/include/asm-x86/hvm/viridian.h 
b/xen/include/asm-x86/hvm/viridian.h
index 271c36d..18f1f1a 100644
--- a/xen/include/asm-x86/hvm/viridian.h
+++ b/xen/include/asm-x86/hvm/viridian.h
@@ -23,6 +23,7 @@ struct viridian_vcpu
 {
     struct {
         union viridian_vp_assist msr;
+        unsigned long gmfn;
         void *va;
         int vector;
     } vp_assist;
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel