diff mbox

[v5,09/10] xen/arm: Set foreign page type to p2m_map_foreign

Message ID 1387215452-10951-10-git-send-email-julien.grall@linaro.org
State Superseded, archived
Headers show

Commit Message

Julien Grall Dec. 16, 2013, 5:37 p.m. UTC 
Xen needs to know that the current page belongs to another domain. Also take
a reference to this page.

The current process to add a foreign page is:
   1) get the page from the foreign p2m
   2) take a reference on the page with the foreign domain in parameters
   3) add the page to the current domain p2m

If the foreign domain drops the page:
    - before 2), get_page will return NULL because the page doesn't
    belong anymore to the domain
    - after 2), the current domain already have a reference. Write will
    occur to an old page which is not yet released. It can corrupt the foreign
    domain.

Signed-off-by: Julien Grall <julien.grall@linaro.org>

---
    Changes in v5:
        - Missing rcu_unlock_domain in one path
        - Check if the foreign page is RAM
    Changes in v4:
        - Typo s/release/released/
        - Improve commit message
    Changes in v3:
        - Typoes
        - Check if the foreign domain is different from the current domain

    Changes in v2:
        - Even if gcc is buggy (see http://gcc.gnu.org/bugzilla/show_bug.cgi?id=18501)
        define p2m type per mapspace to let the compiler warns about unitialized
        values.
---
 xen/arch/arm/mm.c         |   38 ++++++++++++++++++++++++++++++--------
 xen/include/asm-arm/p2m.h |    1 +
 2 files changed, 31 insertions(+), 8 deletions(-)

Comments

Ian Campbell Dec. 17, 2013, 11:34 a.m. UTC | #1 
On Mon, 2013-12-16 at 17:37 +0000, Julien Grall wrote:
> Xen needs to know that the current page belongs to another domain. Also take
> a reference to this page.
> 
> The current process to add a foreign page is:
>    1) get the page from the foreign p2m
>    2) take a reference on the page with the foreign domain in parameters
>    3) add the page to the current domain p2m
> 
> If the foreign domain drops the page:
>     - before 2), get_page will return NULL because the page doesn't
>     belong anymore to the domain
>     - after 2), the current domain already have a reference. Write will
>     occur to an old page which is not yet released. It can corrupt the foreign
>     domain.
> 
> Signed-off-by: Julien Grall <julien.grall@linaro.org>

Acked-by: Ian Campbell <ian.campbell@citrix.com>

Ian.
diff mbox

Patch

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index b1222be..6829822 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -977,6 +977,7 @@  static int xenmem_add_to_physmap_one(
 {
     unsigned long mfn = 0;
     int rc;
+    p2m_type_t t;
 
     switch ( space )
     {
@@ -1009,22 +1010,33 @@  static int xenmem_add_to_physmap_one(
         
         d->arch.grant_table_gpfn[idx] = gpfn;
 
+        t = p2m_ram_rw;
+
         spin_unlock(&d->grant_table->lock);
         break;
     case XENMAPSPACE_shared_info:
-        if ( idx == 0 )
-            mfn = virt_to_mfn(d->shared_info);
-        else
+        if ( idx != 0 )
             return -EINVAL;
+
+        mfn = virt_to_mfn(d->shared_info);
+        t = p2m_ram_rw;
+
         break;
     case XENMAPSPACE_gmfn_foreign:
     {
-        paddr_t maddr;
         struct domain *od;
+        struct page_info *page;
+        p2m_type_t p2mt;
         od = rcu_lock_domain_by_any_id(foreign_domid);
         if ( od == NULL )
             return -ESRCH;
 
+        if ( od == d )
+        {
+            rcu_unlock_domain(od);
+            return -EINVAL;
+        }
+
         rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od);
         if ( rc )
         {
@@ -1032,15 +1044,25 @@  static int xenmem_add_to_physmap_one(
             return rc;
         }
 
-        maddr = p2m_lookup(od, pfn_to_paddr(idx), NULL);
-        if ( maddr == INVALID_PADDR )
+        /* Take reference to the foreign domain page.
+         * Reference will be released in XENMEM_remove_from_physmap */
+        page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC);
+        if ( !page )
         {
             dump_p2m_lookup(od, pfn_to_paddr(idx));
             rcu_unlock_domain(od);
             return -EINVAL;
         }
 
-        mfn = maddr >> PAGE_SHIFT;
+        if ( !p2m_is_ram(p2mt) )
+        {
+            put_page(page);
+            rcu_unlock_domain(od);
+            return -EINVAL;
+        }
+
+        mfn = page_to_mfn(page);
+        t = p2m_map_foreign;
 
         rcu_unlock_domain(od);
         break;
@@ -1051,7 +1073,7 @@  static int xenmem_add_to_physmap_one(
     }
 
     /* Map at new location. */
-    rc = guest_physmap_add_page(d, gpfn, mfn, 0);
+    rc = guest_physmap_add_entry(d, gpfn, mfn, 0, t);
 
     return rc;
 }
diff --git a/xen/include/asm-arm/p2m.h b/xen/include/asm-arm/p2m.h
index ac2b6fa..6a185db 100644
--- a/xen/include/asm-arm/p2m.h
+++ b/xen/include/asm-arm/p2m.h
@@ -47,6 +47,7 @@  typedef enum {
 } p2m_type_t;
 
 #define p2m_is_foreign(_t)  ((_t) == p2m_map_foreign)
+#define p2m_is_ram(_t)      ((_t) == p2m_ram_rw || (_t) == p2m_ram_ro)
 
 /* Initialise vmid allocator */
 void p2m_vmid_allocator_init(void);