From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <ian.campbell@citrix.com>
Subject: Re: [PATCH V13 3/7] xen/arm: Allow hypervisor access to
 mem_access protected pages
Date: Thu, 12 Mar 2015 15:54:48 +0000
Message-ID: <1426175688.32572.25.camel@citrix.com>
References: <1425677073-13729-1-git-send-email-tklengyel@sec.in.tum.de>
	<1425677073-13729-4-git-send-email-tklengyel@sec.in.tum.de>
	<55019996.9050208@linaro.org>
	<CABfawh=HiWTwOno7WqPTd1BVYq1tz4Jy00Y_k5AHT3zj81rkJQ@mail.gmail.com>
	<5501A831.6010009@linaro.org> <1426174055.32572.10.camel@citrix.com>
	<5501B376.20108@linaro.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <5501B376.20108@linaro.org>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Julien Grall <julien.grall@linaro.org>
Cc: wei.liu2@citrix.com, Stefano Stabellini <stefano.stabellini@eu.citrix.com>, Tim Deegan <tim@xen.org>, Ian Jackson <ian.jackson@eu.citrix.com>, xen-devel@lists.xen.org, stefano.stabellini@citrix.com, Jan Beulich <jbeulich@suse.com>, Keir Fraser <keir@xen.org>, Tamas K Lengyel <tklengyel@sec.in.tum.de>
List-Id: xen-devel@lists.xenproject.org

On Thu, 2015-03-12 at 15:40 +0000, Julien Grall wrote:
> Hi Ian,
> 
> On 12/03/15 15:27, Ian Campbell wrote:
> >> Currently, check_type_get_page emulate only the check for 2). So you may
> >> end up to allow Xen writing in read-only mapping (from the Stage 1 POV).
> >> This was XSA-98.
> > 
> > XSA-98 was purely about stage-2 permissions (e.g. read-only grants). The
> > fact that the resulting patch also checks stage-1 permissions is not a
> > security property AFAICT.
> 
> XSA-98 was for both... Without checking stage-1 permission a userspace
> which can issue an hypercall may be able to write into read-only kernel
> space. Whoops.

XSA-98 doesn't make any mention of this particular attack and talks
solely about guests writing to memory they shouldn't, not processes.

A userspace which can issue a hypercall is already root and has lots of
ways to rewrite kernel memory (starting with /dev/mem).

Anyway, enough splitting hairs: it probably is worth retaining this
behaviour since it seems pretty simple, just make gva_to_ipa_par take
the same flags as gva_to_ma_par and use it in the same way.


Ian.