From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andres Lagar-Cavilla Subject: [PATCH 4 of 4] x86/mm: Fix two PAE+paging bugs Date: Wed, 15 Feb 2012 22:42:28 -0500 Message-ID: <62b1fe67b8d1bb48932f.1329363748@xdev.gridcentric.ca> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: xen-devel@lists.xensource.com Cc: andres@gridcentric.ca, tim@xen.org, olaf@aepfle.de, adin@gridcentric.ca List-Id: xen-devel@lists.xenproject.org xen/arch/x86/hvm/vmx/vmx.c | 16 +++++++++++++--- xen/arch/x86/mm/hap/hap.c | 2 +- 2 files changed, 14 insertions(+), 4 deletions(-) In hap_paging_update_modes, we were getting the gpa of the cr3, rather than the gfn. Vmx_load_pdptrs was crashing the host if the cr3 is paged out. Now it will only crash the guest. Signed-off-by: Andres Lagar-Cavilla diff -r 7a1d415a71d0 -r 62b1fe67b8d1 xen/arch/x86/hvm/vmx/vmx.c --- a/xen/arch/x86/hvm/vmx/vmx.c +++ b/xen/arch/x86/hvm/vmx/vmx.c @@ -1010,12 +1010,22 @@ static void vmx_load_pdptrs(struct vcpu if ( (cr3 & 0x1fUL) && !hvm_pcid_enabled(v) ) goto crash; - mfn = mfn_x(get_gfn(v->domain, cr3 >> PAGE_SHIFT, &p2mt)); - if ( !p2m_is_ram(p2mt) ) + mfn = mfn_x(get_gfn_unshare(v->domain, cr3 >> PAGE_SHIFT, &p2mt)); + if ( !p2m_is_ram(p2mt) || !mfn_valid(mfn) || + /* If we didn't succeed in unsharing, get_page will fail + * (page still belongs to dom_cow) */ + !get_page(mfn_to_page(mfn), v->domain) ) { + /* Ideally you don't want to crash but rather go into a wait + * queue, but this is the wrong place. We're holding at least + * the paging lock */ + gdprintk(XENLOG_ERR, + "Bad cr3 on load pdptrs gfn %"PRIx64" mfn %"PRIx64 + " type %d\n",cr3 >> PAGE_SHIFT, mfn, (int)p2mt); put_gfn(v->domain, cr3 >> PAGE_SHIFT); goto crash; } + put_gfn(v->domain, cr3 >> PAGE_SHIFT); p = map_domain_page(mfn); @@ -1043,7 +1053,7 @@ static void vmx_load_pdptrs(struct vcpu vmx_vmcs_exit(v); unmap_domain_page(p); - put_gfn(v->domain, cr3 >> PAGE_SHIFT); + put_page(mfn_to_page(mfn)); return; crash: diff -r 7a1d415a71d0 -r 62b1fe67b8d1 xen/arch/x86/mm/hap/hap.c --- a/xen/arch/x86/mm/hap/hap.c +++ b/xen/arch/x86/mm/hap/hap.c @@ -786,7 +786,7 @@ hap_paging_get_mode(struct vcpu *v) static void hap_update_paging_modes(struct vcpu *v) { struct domain *d = v->domain; - unsigned long cr3_gfn = v->arch.hvm_vcpu.guest_cr[3]; + unsigned long cr3_gfn = v->arch.hvm_vcpu.guest_cr[3] >> PAGE_SHIFT; p2m_type_t t; /* We hold onto the cr3 as it may be modified later, and