blob: 3c008a9bc258919cb73e0cc5a0cebaaebb357556 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
From: Jan Beulich <jbeulich@suse.com>
Subject: VT-d: fix reduced page table levels support when sharing tables
domain_pgd_maddr() contains logic to adjust the root address to be put
in the context entry in case 4-level page tables aren't supported by an
IOMMU. This logic may not be bypassed when sharing page tables.
This is CVE-2021-28710 / XSA-390.
Fixes: 25ccd093425c ("iommu: remove the share_p2m operation")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -340,19 +340,21 @@ static uint64_t domain_pgd_maddr(struct
{
pagetable_t pgt = p2m_get_pagetable(p2m_get_hostp2m(d));
- return pagetable_get_paddr(pgt);
+ pgd_maddr = pagetable_get_paddr(pgt);
}
-
- if ( !hd->arch.vtd.pgd_maddr )
+ else
{
- /* Ensure we have pagetables allocated down to leaf PTE. */
- addr_to_dma_page_maddr(d, 0, 1);
-
if ( !hd->arch.vtd.pgd_maddr )
- return 0;
- }
+ {
+ /* Ensure we have pagetables allocated down to leaf PTE. */
+ addr_to_dma_page_maddr(d, 0, 1);
- pgd_maddr = hd->arch.vtd.pgd_maddr;
+ if ( !hd->arch.vtd.pgd_maddr )
+ return 0;
+ }
+
+ pgd_maddr = hd->arch.vtd.pgd_maddr;
+ }
/* Skip top levels of page tables for 2- and 3-level DRHDs. */
for ( agaw = level_to_agaw(4);
|
