73291eb01a
automatically update UEFI boot binary xen.spec - Upstream patches from Jan 51d5334e-x86-mm-Ensure-useful-progress-in-alloc_l2_table.patch 51dd155c-adjust-x86-EFI-build.patch 51e63d80-x86-cpuidle-Change-logging-for-unknown-APIC-IDs.patch 51e6540d-x86-don-t-use-destroy_xen_mappings-for-vunmap.patch 51e7963f-x86-time-Update-wallclock-in-shared-info-when-altering-domain-time-offset.patch 51ffd577-fix-off-by-one-mistakes-in-vm_alloc.patch 51ffd5fd-x86-refine-FPU-selector-handling-code-for-XSAVEOPT.patch 520114bb-Nested-VMX-Flush-TLBs-and-Caches-if-paging-mode-changed.patch 520a5504-VMX-add-boot-parameter-to-enable-disable-APIC-v-dynamically.patch 520a24f6-x86-AMD-Fix-nested-svm-crash-due-to-assertion-in-__virt_to_maddr.patch 520a2570-x86-AMD-Inject-GP-instead-of-UD-when-unable-to-map-vmcb.patch 520b4b60-VT-d-protect-against-bogus-information-coming-from-BIOS.patch 520b4bda-x86-MTRR-fix-range-check-in-mtrr_add_page.patch 520cb8b6-x86-time-fix-check-for-negative-time-in-__update_vcpu_system_time.patch 520d417d-xen-Add-stdbool.h-workaround-for-BSD.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=266
139 lines
3.9 KiB
Diff
139 lines
3.9 KiB
Diff
# Commit 85fc517ec3055e8e8d9c9e36e15a81e630237252
|
|
# Date 2013-08-13 14:22:14 +0200
|
|
# Author Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/AMD: Fix nested svm crash due to assertion in __virt_to_maddr
|
|
|
|
Fix assertion in __virt_to_maddr when starting nested SVM guest
|
|
in debug mode. Investigation has shown that svm_vmsave/svm_vmload
|
|
make use of __pa() with invalid address.
|
|
|
|
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
|
|
Reviewed-by: Tim Deegan <tim@xen.org>
|
|
|
|
--- a/xen/arch/x86/hvm/svm/svm.c
|
|
+++ b/xen/arch/x86/hvm/svm/svm.c
|
|
@@ -1792,6 +1792,32 @@ svm_vmexit_do_vmrun(struct cpu_user_regs
|
|
return;
|
|
}
|
|
|
|
+static struct page_info *
|
|
+nsvm_get_nvmcb_page(struct vcpu *v, uint64_t vmcbaddr)
|
|
+{
|
|
+ p2m_type_t p2mt;
|
|
+ struct page_info *page;
|
|
+ struct nestedvcpu *nv = &vcpu_nestedhvm(v);
|
|
+
|
|
+ if ( !nestedsvm_vmcb_map(v, vmcbaddr) )
|
|
+ return NULL;
|
|
+
|
|
+ /* Need to translate L1-GPA to MPA */
|
|
+ page = get_page_from_gfn(v->domain,
|
|
+ nv->nv_vvmcxaddr >> PAGE_SHIFT,
|
|
+ &p2mt, P2M_ALLOC | P2M_UNSHARE);
|
|
+ if ( !page )
|
|
+ return NULL;
|
|
+
|
|
+ if ( !p2m_is_ram(p2mt) || p2m_is_readonly(p2mt) )
|
|
+ {
|
|
+ put_page(page);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ return page;
|
|
+}
|
|
+
|
|
static void
|
|
svm_vmexit_do_vmload(struct vmcb_struct *vmcb,
|
|
struct cpu_user_regs *regs,
|
|
@@ -1799,7 +1825,7 @@ svm_vmexit_do_vmload(struct vmcb_struct
|
|
{
|
|
int ret;
|
|
unsigned int inst_len;
|
|
- struct nestedvcpu *nv = &vcpu_nestedhvm(v);
|
|
+ struct page_info *page;
|
|
|
|
if ( (inst_len = __get_instruction_length(v, INSTR_VMLOAD)) == 0 )
|
|
return;
|
|
@@ -1810,13 +1836,18 @@ svm_vmexit_do_vmload(struct vmcb_struct
|
|
goto inject;
|
|
}
|
|
|
|
- if (!nestedsvm_vmcb_map(v, vmcbaddr)) {
|
|
- gdprintk(XENLOG_ERR, "VMLOAD: mapping vmcb failed, injecting #UD\n");
|
|
+ page = nsvm_get_nvmcb_page(v, vmcbaddr);
|
|
+ if ( !page )
|
|
+ {
|
|
+ gdprintk(XENLOG_ERR,
|
|
+ "VMLOAD: mapping failed, injecting #UD\n");
|
|
ret = TRAP_invalid_op;
|
|
goto inject;
|
|
}
|
|
|
|
- svm_vmload(nv->nv_vvmcx);
|
|
+ svm_vmload_pa(page_to_maddr(page));
|
|
+ put_page(page);
|
|
+
|
|
/* State in L1 VMCB is stale now */
|
|
v->arch.hvm_svm.vmcb_in_sync = 0;
|
|
|
|
@@ -1835,7 +1866,7 @@ svm_vmexit_do_vmsave(struct vmcb_struct
|
|
{
|
|
int ret;
|
|
unsigned int inst_len;
|
|
- struct nestedvcpu *nv = &vcpu_nestedhvm(v);
|
|
+ struct page_info *page;
|
|
|
|
if ( (inst_len = __get_instruction_length(v, INSTR_VMSAVE)) == 0 )
|
|
return;
|
|
@@ -1846,14 +1877,17 @@ svm_vmexit_do_vmsave(struct vmcb_struct
|
|
goto inject;
|
|
}
|
|
|
|
- if (!nestedsvm_vmcb_map(v, vmcbaddr)) {
|
|
- gdprintk(XENLOG_ERR, "VMSAVE: mapping vmcb failed, injecting #UD\n");
|
|
+ page = nsvm_get_nvmcb_page(v, vmcbaddr);
|
|
+ if ( !page )
|
|
+ {
|
|
+ gdprintk(XENLOG_ERR,
|
|
+ "VMSAVE: mapping vmcb failed, injecting #UD\n");
|
|
ret = TRAP_invalid_op;
|
|
goto inject;
|
|
}
|
|
|
|
- svm_vmsave(nv->nv_vvmcx);
|
|
-
|
|
+ svm_vmsave_pa(page_to_maddr(page));
|
|
+ put_page(page);
|
|
__update_guest_eip(regs, inst_len);
|
|
return;
|
|
|
|
--- a/xen/include/asm-x86/hvm/svm/svm.h
|
|
+++ b/xen/include/asm-x86/hvm/svm/svm.h
|
|
@@ -41,18 +41,21 @@
|
|
#define SVM_REG_R14 (14)
|
|
#define SVM_REG_R15 (15)
|
|
|
|
-static inline void svm_vmload(void *vmcb)
|
|
+#define svm_vmload(x) svm_vmload_pa(__pa(x))
|
|
+#define svm_vmsave(x) svm_vmsave_pa(__pa(x))
|
|
+
|
|
+static inline void svm_vmload_pa(paddr_t vmcb)
|
|
{
|
|
asm volatile (
|
|
".byte 0x0f,0x01,0xda" /* vmload */
|
|
- : : "a" (__pa(vmcb)) : "memory" );
|
|
+ : : "a" (vmcb) : "memory" );
|
|
}
|
|
|
|
-static inline void svm_vmsave(void *vmcb)
|
|
+static inline void svm_vmsave_pa(paddr_t vmcb)
|
|
{
|
|
asm volatile (
|
|
".byte 0x0f,0x01,0xdb" /* vmsave */
|
|
- : : "a" (__pa(vmcb)) : "memory" );
|
|
+ : : "a" (vmcb) : "memory" );
|
|
}
|
|
|
|
static inline void svm_invlpga(unsigned long vaddr, uint32_t asid)
|