From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 12 Dec 2017 13:30:17 +0000 (+0100)
Subject: x86/paging: don't unconditionally BUG() on finding SHARED_M2P_ENTRY
X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~939
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=b4d0218cff66b7eaa9c9b8dc9bd71e7b089b016d;p=xen.git

x86/paging: don't unconditionally BUG() on finding SHARED_M2P_ENTRY

PV guests can fully control the values written into the P2M.

This is XSA-251.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/xen/arch/x86/mm/paging.c b/xen/arch/x86/mm/paging.c
index 1e2c9ba4cc..755a8f83ca 100644
--- a/xen/arch/x86/mm/paging.c
+++ b/xen/arch/x86/mm/paging.c
@@ -274,7 +274,7 @@ void paging_mark_pfn_dirty(struct domain *d, pfn_t pfn)
         return;
 
     /* Shared MFNs should NEVER be marked dirty */
-    BUG_ON(SHARED_M2P(pfn_x(pfn)));
+    BUG_ON(paging_mode_translate(d) && SHARED_M2P(pfn_x(pfn)));
 
     /*
      * Values with the MSB set denote MFNs that aren't really part of the