[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen-unstable] x86/mm: Fix two PAE+paging bugs
# HG changeset patch # User Andres Lagar-Cavilla <andres@xxxxxxxxxxxxxxxx> # Date 1329406982 0 # Node ID b75664e5390583c5d2075c82a14245bc941b3aaf # Parent de4206b6546c96ee890df144326658cb964b534e x86/mm: Fix two PAE+paging bugs In hap_paging_update_modes, we were getting the gpa of the cr3, rather than the gfn. Vmx_load_pdptrs was crashing the host if the cr3 is paged out. Now it will only crash the guest. Signed-off-by: Andres Lagar-Cavilla <andres@xxxxxxxxxxxxxxxx> Signed-off-by: Tim Deegan <tim@xxxxxxx> Committed-by: Tim Deegan <tim@xxxxxxx> --- diff -r de4206b6546c -r b75664e53905 xen/arch/x86/hvm/vmx/vmx.c --- a/xen/arch/x86/hvm/vmx/vmx.c Thu Feb 16 15:43:02 2012 +0000 +++ b/xen/arch/x86/hvm/vmx/vmx.c Thu Feb 16 15:43:02 2012 +0000 @@ -1010,12 +1010,22 @@ if ( (cr3 & 0x1fUL) && !hvm_pcid_enabled(v) ) goto crash; - mfn = mfn_x(get_gfn(v->domain, cr3 >> PAGE_SHIFT, &p2mt)); - if ( !p2m_is_ram(p2mt) ) + mfn = mfn_x(get_gfn_unshare(v->domain, cr3 >> PAGE_SHIFT, &p2mt)); + if ( !p2m_is_ram(p2mt) || !mfn_valid(mfn) || + /* If we didn't succeed in unsharing, get_page will fail + * (page still belongs to dom_cow) */ + !get_page(mfn_to_page(mfn), v->domain) ) { + /* Ideally you don't want to crash but rather go into a wait + * queue, but this is the wrong place. We're holding at least + * the paging lock */ + gdprintk(XENLOG_ERR, + "Bad cr3 on load pdptrs gfn %lx mfn %lx type %d\n", + cr3 >> PAGE_SHIFT, mfn, (int) p2mt); put_gfn(v->domain, cr3 >> PAGE_SHIFT); goto crash; } + put_gfn(v->domain, cr3 >> PAGE_SHIFT); p = map_domain_page(mfn); @@ -1043,7 +1053,7 @@ vmx_vmcs_exit(v); unmap_domain_page(p); - put_gfn(v->domain, cr3 >> PAGE_SHIFT); + put_page(mfn_to_page(mfn)); return; crash: diff -r de4206b6546c -r b75664e53905 xen/arch/x86/mm/hap/hap.c --- a/xen/arch/x86/mm/hap/hap.c Thu Feb 16 15:43:02 2012 +0000 +++ b/xen/arch/x86/mm/hap/hap.c Thu Feb 16 15:43:02 2012 +0000 @@ -786,7 +786,7 @@ static void hap_update_paging_modes(struct vcpu *v) { struct domain *d = v->domain; - unsigned long cr3_gfn = v->arch.hvm_vcpu.guest_cr[3]; + unsigned long cr3_gfn = v->arch.hvm_vcpu.guest_cr[3] >> PAGE_SHIFT; p2m_type_t t; /* We hold onto the cr3 as it may be modified later, and _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |