From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mukesh Rathor Subject: [V1 PATCH] PVH: avoid call to handle_mmio Date: Tue, 3 Jun 2014 15:00:02 -0700 Message-ID: <1401832802-27118-2-git-send-email-mukesh.rathor@oracle.com> References: <1401832802-27118-1-git-send-email-mukesh.rathor@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wrwki-0004SL-Ol for xen-devel@lists.xenproject.org; Tue, 03 Jun 2014 22:00:17 +0000 In-Reply-To: <1401832802-27118-1-git-send-email-mukesh.rathor@oracle.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xenproject.org Cc: keir.xen@gmail.com, JBeulich@suse.com List-Id: xen-devel@lists.xenproject.org handle_mmio() is currently unsafe for pvh guests. A call to it would result in call to vioapic_range that will crash xen since the vioapic ptr in struct hvm_domain is not initialized for pvh guests. However, one path exists for such a call. If a pvh guest, dom0 or domU, unintentionally touches non-existing memory, an EPT violation would occur. This would result in unconditional call to hvm_hap_nested_page_fault. In that function, because get_gfn_type_access returns p2m_mmio_dm for non existing mfns by default, handle_mmio() will get called. This would result in xen crash instead of the guest crash. This patch addresses that. Signed-off-by: Mukesh Rathor --- xen/arch/x86/hvm/hvm.c | 5 +++++ xen/arch/x86/hvm/io.c | 2 ++ 2 files changed, 7 insertions(+) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index efbf6d9..51089b3 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -2079,6 +2079,11 @@ int hvm_hap_nested_page_fault(paddr_t gpa, (access_w && (p2mt == p2m_ram_ro)) ) { put_gfn(p2m->domain, gfn); + + rc = 0; + if ( unlikely(is_pvh_vcpu(v)) ) + goto out; + if ( !handle_mmio() ) hvm_inject_hw_exception(TRAP_gp_fault, 0); rc = 1; diff --git a/xen/arch/x86/hvm/io.c b/xen/arch/x86/hvm/io.c index e6cb5e2..b53395e 100644 --- a/xen/arch/x86/hvm/io.c +++ b/xen/arch/x86/hvm/io.c @@ -84,6 +84,8 @@ int handle_mmio(void) struct hvm_vcpu_io *vio = &curr->arch.hvm_vcpu.hvm_io; int rc; + ASSERT(!is_pvh_vcpu(current)); + hvm_emulate_prepare(&ctxt, guest_cpu_user_regs()); rc = hvm_emulate_one(&ctxt); -- 1.8.3.1