Re: [PATCH v2][4.15] x86: mirror compat argument translation area for 32-bit PV

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Mon, Feb 22, 2021 at 04:50:14PM +0100, Jan Beulich wrote:
> Now that we guard the entire Xen VA space against speculative abuse
> through hypervisor accesses to guest memory, the argument translation
> area's VA also needs to live outside this range, at least for 32-bit PV
> guests. To avoid extra is_hvm_*() conditionals, use the alternative VA
> uniformly.
> 
> While this could be conditionalized upon CONFIG_PV32 &&
> CONFIG_SPECULATIVE_HARDEN_GUEST_ACCESS, omitting such extra conditionals
> keeps the code more legible imo.
> 
> Fixes: 4dc181599142 ("x86/PV: harden guest memory accesses against 
> speculative abuse")
> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
> Release-Acked-by: Ian Jackson <iwj@xxxxxxxxxxxxxx>

Acked-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>

One comment nit below.

> ---
> v2: Rename PERDOMAIN2_VIRT_START to PERDOMAIN_ALT_VIRT_START.
> 
> --- a/xen/arch/x86/mm.c
> +++ b/xen/arch/x86/mm.c
> @@ -1727,6 +1727,11 @@ void init_xen_l4_slots(l4_pgentry_t *l4t
>                 (ROOT_PAGETABLE_FIRST_XEN_SLOT + slots -
>                  l4_table_offset(XEN_VIRT_START)) * sizeof(*l4t));
>      }
> +
> +    /* Slot 511: Per-domain mappings mirror. */
> +    if ( !is_pv_64bit_domain(d) )
> +        l4t[l4_table_offset(PERDOMAIN_ALT_VIRT_START)] =
> +            l4e_from_page(d->arch.perdomain_l3_pg, __PAGE_HYPERVISOR_RW);
>  }
>  
>  bool fill_ro_mpt(mfn_t mfn)
> --- a/xen/include/asm-x86/config.h
> +++ b/xen/include/asm-x86/config.h
> @@ -159,11 +159,11 @@ extern unsigned char boot_edid_info[128]
>   *    1:1 direct mapping of all physical memory.
>  #endif
>   *  0xffff880000000000 - 0xffffffffffffffff [120TB,             PML4:272-511]
> - *    PV: Guest-defined use.
> + *    PV (64-bit): Guest-defined use.
>   *  0xffff880000000000 - 0xffffff7fffffffff [119.5TB,           PML4:272-510]
>   *    HVM/idle: continuation of 1:1 mapping
>   *  0xffffff8000000000 - 0xffffffffffffffff [512GB, 2^39 bytes  PML4:511]
> - *    HVM/idle: unused
> + *    HVM / 32-bit PV: Secondary per-domain mappings.

I would use "Mirrored per-domain mappings." to make it clear this is
indented to be backed up by the same physical range as the original
per-domain mappings.

Thanks, Roger.