[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v6 14/14] arm/mem_access: Walk the guest's pt in software
In this commit, we make use of the gpt walk functionality introduced in the previous commits. If mem_access is active, hardware-based gva to ipa translation might fail, as gva_to_ipa uses the guest's translation tables, access to which might be restricted by the active VTTBR. To side-step potential translation errors in the function p2m_mem_access_check_and_get_page due to restricted memory (e.g. to the guest's page tables themselves), we walk the guest's page tables in software. Signed-off-by: Sergej Proskurin <proskurin@xxxxxxxxxxxxx> Acked-by: Tamas K Lengyel <tamas@xxxxxxxxxxxxx> --- Cc: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx> Cc: Tamas K Lengyel <tamas@xxxxxxxxxxxxx> Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx> Cc: Julien Grall <julien.grall@xxxxxxx> --- v2: Check the returned access rights after walking the guest's page tables in the function p2m_mem_access_check_and_get_page. v3: Adapt Function names and parameter. v4: Comment why we need to fail if the permission flags that are requested by the caller do not satisfy the mapped page. Cosmetic fix that simplifies the if-statement checking for the GV2M_WRITE permission. v5: Move comment to ease code readability. --- xen/arch/arm/mem_access.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/xen/arch/arm/mem_access.c b/xen/arch/arm/mem_access.c index bcf49f5c15..a58611daed 100644 --- a/xen/arch/arm/mem_access.c +++ b/xen/arch/arm/mem_access.c @@ -22,6 +22,7 @@ #include <xen/vm_event.h> #include <public/vm_event.h> #include <asm/event.h> +#include <asm/guest_walk.h> static int __p2m_get_mem_access(struct domain *d, gfn_t gfn, xenmem_access_t *access) @@ -101,6 +102,7 @@ p2m_mem_access_check_and_get_page(vaddr_t gva, unsigned long flag, const struct vcpu *v) { long rc; + unsigned int perms; paddr_t ipa; gfn_t gfn; mfn_t mfn; @@ -110,8 +112,35 @@ p2m_mem_access_check_and_get_page(vaddr_t gva, unsigned long flag, struct p2m_domain *p2m = &v->domain->arch.p2m; rc = gva_to_ipa(gva, &ipa, flag); + + /* + * In case mem_access is active, hardware-based gva_to_ipa translation + * might fail. Since gva_to_ipa uses the guest's translation tables, access + * to which might be restricted by the active VTTBR, we perform a gva to + * ipa translation in software. + */ if ( rc < 0 ) - goto err; + { + /* + * The software gva to ipa translation can still fail, e.g., if the gva + * is not mapped. + */ + if ( guest_walk_tables(v, gva, &ipa, &perms) < 0 ) + goto err; + + /* + * Check permissions that are assumed by the caller. For instance in + * case of guestcopy, the caller assumes that the translated page can + * be accessed with requested permissions. If this is not the case, we + * should fail. + * + * Please note that we do not check for the GV2M_EXEC permission. Yet, + * since the hardware-based translation through gva_to_ipa does not + * test for execute permissions this check can be left out. + */ + if ( (flag & GV2M_WRITE) && !(perms & GV2M_WRITE) ) + goto err; + } gfn = gaddr_to_gfn(ipa); -- 2.13.2 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx https://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |