Re: [Xen-devel] [RFC] x86: possible problem with guest_walk_tables()

[Tim Deegan <Tim.Deegan@xxxxxxxxxx>]

At 11:45 +0000 on 21 Mar (1300707922), Jan Beulich wrote:
> The PSE handling doesn't check bits 1...8 (or 1...9 for non-PAE guests)
> being zero, thus allowing bad (not 2Mb/4Mb aligned) large pages to be
> handled (afaict potentially allowing the guest to access foreign memory).

I don't think this allows access to foreign memory, since these
pagetables are in GFN-space. 

> Below is a possible fix, but unfortunately it doesn't work for
> GUEST_PAGING_LEVELS == 2, since _PAGE_INVALID_BITS is zero
> there.

What does real hardware do in this case?  IIRC 32-bit non-PAE doesn't
have an "invlid bit set" error code to use in pagefaults.
/me supposes he had better check...

Tim.

> Would defining _PAGE_INVALID_BITS to any bit mask between
> 0x80000000 and  0xfffff000 there be in conflict with anything?
> 
> --- a/xen/arch/x86/mm/guest_walk.c
> +++ b/xen/arch/x86/mm/guest_walk.c
> @@ -231,9 +231,15 @@ guest_walk_tables(struct vcpu *v, struct
>              /* _PAGE_PSE_PAT not set: remove _PAGE_PAT from flags. */
>              flags &= ~_PAGE_PAT;
>  
> +#define GUEST_L2_GFN_ALIGN (1 << (GUEST_L2_PAGETABLE_SHIFT - \
> +                                  GUEST_L1_PAGETABLE_SHIFT))
> +        if ( gfn_x(start) & (GUEST_L2_GFN_ALIGN - 1) & ~0x1 )
> +            rc |= _PAGE_INVALID_BITS;
> +
>          /* Increment the pfn by the right number of 4k pages.  
> -         * The ~0x1 is to mask out the PAT bit mentioned above. */
> -        start = _gfn((gfn_x(start) & ~0x1) + guest_l1_table_offset(va));
> +         * Mask out PAT and invalid bits. */
> +        start = _gfn((gfn_x(start) & ~(GUEST_L2_GFN_ALIGN - 1)) +
> +                     guest_l1_table_offset(va));
>          gw->l1e = guest_l1e_from_gfn(start, flags);
>          gw->l1mfn = _mfn(INVALID_MFN);
>      } 
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel

-- 
Tim Deegan <Tim.Deegan@xxxxxxxxxx>
Principal Software Engineer, Xen Platform Team
Citrix Systems UK Ltd.  (Company #02937203, SL9 0BG)

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel