Re: [PATCH v3 9/9] x86/P2M: relax permissions of PVH Dom0's MMIO entries

[Jan Beulich <jbeulich@xxxxxxxx>]

On 23.09.2021 13:54, Roger Pau Monné wrote:
> On Thu, Sep 23, 2021 at 01:32:52PM +0200, Jan Beulich wrote:
>> On 23.09.2021 13:10, Roger Pau Monné wrote:
>>> On Tue, Sep 21, 2021 at 09:21:11AM +0200, Jan Beulich wrote:
>>>> --- a/xen/arch/x86/mm/p2m.c
>>>> +++ b/xen/arch/x86/mm/p2m.c
>>>> @@ -1319,6 +1319,18 @@ static int set_typed_p2m_entry(struct do
>>>>              return -EPERM;
>>>>          }
>>>>  
>>>> +        /*
>>>> +         * Gross bodge, to go away again rather sooner than later:
>>>> +         *
>>>> +         * For MMIO allow access permissions to accumulate, but only for 
>>>> Dom0.
>>>> +         * Since set_identity_p2m_entry() and set_mmio_p2m_entry() differ 
>>>> in
>>>> +         * the way they specify "access", this will allow the ultimate 
>>>> result
>>>> +         * to be independent of the sequence of operations.
>>>
>>> Wouldn't it be better to 'fix' those operations so that they can work
>>> together?
>>
>> Yes, but then we should do this properly by removing all abuse of
>> p2m_access_t.
> 
> I'm not sure I follow what that abuse is.

As was clarified, p2m_access_t should be solely used by e.g.
introspection agents, who are then the entity responsible for
resolving the resulting faults. Any other uses (to e.g. merely
restrict permissions for other reasons) are really abuses. That
is, if e.g. a r/o direct-MMIO mapping is needed, this should not
be expressed as (p2m_mmio_direct, p2m_access_r) tuple, but would
require a distinct p2m_mmio_direct_ro type.

>>> It's my understanding that set_identity_p2m_entry is the one that has
>>> strong requirements regarding the access permissions, as on AMD ACPI
>>> tables can specify how should regions be mapped.
>>>
>>> A possible solution might be to make set_mmio_p2m_entry more tolerant
>>> to how present mappings are handled. For once that function doesn't
>>> let callers specify access permissions, so I would consider that if a
>>> mapping is present on the gfn and it already points to the requested
>>> mfn no error should be returned to the caller. At the end the 'default
>>> access' for that gfn -> mfn relation is the one established by
>>> set_identity_p2m_entry and shouldn't be subject to the p2m default
>>> access.
>>
>> I think further reducing access is in theory supposed to be possible.
> 
> Couldn't an access reduction introduce issues, kind of similar to what
> would happen if the regions are unmapped? (and that XSA-378 addressed)
> 
> I think whatever permissions set_identity_p2m_entry sets should be
> mandatory ones, and no changes should be allowed. That would maybe
> require introducing a new p2m type (p2m_mmio_mandatory) in order to
> differentiate firmware mandatory MMIO mappings from the rest.

Hmm, indeed. No deviation in either direction should be permitted.

Jan