diff options
Diffstat (limited to 'system/xen/xsa/xsa390.patch')
| -rw-r--r-- | system/xen/xsa/xsa390.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/system/xen/xsa/xsa390.patch b/system/xen/xsa/xsa390.patch new file mode 100644 index 0000000000000..3c008a9bc2589 --- /dev/null +++ b/system/xen/xsa/xsa390.patch @@ -0,0 +1,46 @@ +From: Jan Beulich <jbeulich@suse.com> +Subject: VT-d: fix reduced page table levels support when sharing tables + +domain_pgd_maddr() contains logic to adjust the root address to be put +in the context entry in case 4-level page tables aren't supported by an +IOMMU. This logic may not be bypassed when sharing page tables. + +This is CVE-2021-28710 / XSA-390. + +Fixes: 25ccd093425c ("iommu: remove the share_p2m operation") +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Reviewed-by: Kevin Tian <kevin.tian@intel.com> + +--- a/xen/drivers/passthrough/vtd/iommu.c ++++ b/xen/drivers/passthrough/vtd/iommu.c +@@ -340,19 +340,21 @@ static uint64_t domain_pgd_maddr(struct + { + pagetable_t pgt = p2m_get_pagetable(p2m_get_hostp2m(d)); + +- return pagetable_get_paddr(pgt); ++ pgd_maddr = pagetable_get_paddr(pgt); + } +- +- if ( !hd->arch.vtd.pgd_maddr ) ++ else + { +- /* Ensure we have pagetables allocated down to leaf PTE. */ +- addr_to_dma_page_maddr(d, 0, 1); +- + if ( !hd->arch.vtd.pgd_maddr ) +- return 0; +- } ++ { ++ /* Ensure we have pagetables allocated down to leaf PTE. */ ++ addr_to_dma_page_maddr(d, 0, 1); + +- pgd_maddr = hd->arch.vtd.pgd_maddr; ++ if ( !hd->arch.vtd.pgd_maddr ) ++ return 0; ++ } ++ ++ pgd_maddr = hd->arch.vtd.pgd_maddr; ++ } + + /* Skip top levels of page tables for 2- and 3-level DRHDs. */ + for ( agaw = level_to_agaw(4); |