[xen master] VT-d: fix reduced page table levels support when sharing tables

[patchbot@xxxxxxx]

commit 02b46377b69feb6dd3649f037e17684af9fb7853
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Fri Nov 19 15:14:08 2021 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Nov 19 15:14:08 2021 +0100

    VT-d: fix reduced page table levels support when sharing tables
    
    domain_pgd_maddr() contains logic to adjust the root address to be put
    in the context entry in case 4-level page tables aren't supported by an
    IOMMU. This logic may not be bypassed when sharing page tables.
    
    This is CVE-2021-28710 / XSA-390.
    
    Fixes: 25ccd093425c ("iommu: remove the share_p2m operation")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>
    Release-Acked-by: Ian Jackson <iwj@xxxxxxxxxxxxxx>
---
 xen/drivers/passthrough/vtd/iommu.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/xen/drivers/passthrough/vtd/iommu.c 
b/xen/drivers/passthrough/vtd/iommu.c
index 7b8337017a..f9ce402f22 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -340,19 +340,21 @@ static uint64_t domain_pgd_maddr(struct domain *d, 
unsigned int nr_pt_levels)
     {
         pagetable_t pgt = p2m_get_pagetable(p2m_get_hostp2m(d));
 
-        return pagetable_get_paddr(pgt);
+        pgd_maddr = pagetable_get_paddr(pgt);
     }
-
-    if ( !hd->arch.vtd.pgd_maddr )
+    else
     {
-        /* Ensure we have pagetables allocated down to leaf PTE. */
-        addr_to_dma_page_maddr(d, 0, 1);
-
         if ( !hd->arch.vtd.pgd_maddr )
-            return 0;
-    }
+        {
+            /* Ensure we have pagetables allocated down to leaf PTE. */
+            addr_to_dma_page_maddr(d, 0, 1);
 
-    pgd_maddr = hd->arch.vtd.pgd_maddr;
+            if ( !hd->arch.vtd.pgd_maddr )
+                return 0;
+        }
+
+        pgd_maddr = hd->arch.vtd.pgd_maddr;
+    }
 
     /* Skip top levels of page tables for 2- and 3-level DRHDs. */
     for ( agaw = level_to_agaw(4);
--
generated by git-patchbot for /home/xen/git/xen.git#master