[Xen-changelog] [xen master] xen/arm: Set foreign page type to p2m_map_foreign

[patchbot@xxxxxxx]

commit 8e3079c48187aa6d04686ddb51afa10234cdbcf0
Author:     Julien Grall <julien.grall@xxxxxxxxxx>
AuthorDate: Tue Dec 17 16:27:57 2013 +0000
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Wed Dec 18 14:32:55 2013 +0000

    xen/arm: Set foreign page type to p2m_map_foreign
    
    Xen needs to know that the current page belongs to another domain. Also take
    a reference to this page.
    
    The current process to add a foreign page is:
       1) get the page from the foreign p2m
       2) take a reference on the page with the foreign domain in parameters
       3) add the page to the current domain p2m
    
    If the foreign domain drops the page:
        - before 2), get_page will return NULL because the page doesn't
        belong anymore to the domain
        - after 2), the current domain already have a reference. Write will
        occur to an old page which is not yet released. It can corrupt the 
foreign
        domain.
    
    Signed-off-by: Julien Grall <julien.grall@xxxxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---
 xen/arch/arm/mm.c         |   38 ++++++++++++++++++++++++++++++--------
 xen/include/asm-arm/p2m.h |    1 +
 2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c
index c351b1f..8250e65 100644
--- a/xen/arch/arm/mm.c
+++ b/xen/arch/arm/mm.c
@@ -977,6 +977,7 @@ static int xenmem_add_to_physmap_one(
 {
     unsigned long mfn = 0;
     int rc;
+    p2m_type_t t;
 
     switch ( space )
     {
@@ -1009,22 +1010,33 @@ static int xenmem_add_to_physmap_one(
         
         d->arch.grant_table_gpfn[idx] = gpfn;
 
+        t = p2m_ram_rw;
+
         spin_unlock(&d->grant_table->lock);
         break;
     case XENMAPSPACE_shared_info:
-        if ( idx == 0 )
-            mfn = virt_to_mfn(d->shared_info);
-        else
+        if ( idx != 0 )
             return -EINVAL;
+
+        mfn = virt_to_mfn(d->shared_info);
+        t = p2m_ram_rw;
+
         break;
     case XENMAPSPACE_gmfn_foreign:
     {
-        paddr_t maddr;
         struct domain *od;
+        struct page_info *page;
+        p2m_type_t p2mt;
         od = rcu_lock_domain_by_any_id(foreign_domid);
         if ( od == NULL )
             return -ESRCH;
 
+        if ( od == d )
+        {
+            rcu_unlock_domain(od);
+            return -EINVAL;
+        }
+
         rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od);
         if ( rc )
         {
@@ -1032,15 +1044,25 @@ static int xenmem_add_to_physmap_one(
             return rc;
         }
 
-        maddr = p2m_lookup(od, pfn_to_paddr(idx), NULL);
-        if ( maddr == INVALID_PADDR )
+        /* Take reference to the foreign domain page.
+         * Reference will be released in XENMEM_remove_from_physmap */
+        page = get_page_from_gfn(od, idx, &p2mt, P2M_ALLOC);
+        if ( !page )
         {
             dump_p2m_lookup(od, pfn_to_paddr(idx));
             rcu_unlock_domain(od);
             return -EINVAL;
         }
 
-        mfn = maddr >> PAGE_SHIFT;
+        if ( !p2m_is_ram(p2mt) )
+        {
+            put_page(page);
+            rcu_unlock_domain(od);
+            return -EINVAL;
+        }
+
+        mfn = page_to_mfn(page);
+        t = p2m_map_foreign;
 
         rcu_unlock_domain(od);
         break;
@@ -1051,7 +1073,7 @@ static int xenmem_add_to_physmap_one(
     }
 
     /* Map at new location. */
-    rc = guest_physmap_add_page(d, gpfn, mfn, 0);
+    rc = guest_physmap_add_entry(d, gpfn, mfn, 0, t);
 
     return rc;
 }
diff --git a/xen/include/asm-arm/p2m.h b/xen/include/asm-arm/p2m.h
index 8b7b6d0..53b3266 100644
--- a/xen/include/asm-arm/p2m.h
+++ b/xen/include/asm-arm/p2m.h
@@ -47,6 +47,7 @@ typedef enum {
 } p2m_type_t;
 
 #define p2m_is_foreign(_t)  ((_t) == p2m_map_foreign)
+#define p2m_is_ram(_t)      ((_t) == p2m_ram_rw || (_t) == p2m_ram_ro)
 
 /* Initialise vmid allocator */
 void p2m_vmid_allocator_init(void);
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog