Re: [RFC PATCH V3 18/22] Implement EVTCHNOP_register_extended

[David Vrabel <david.vrabel@citrix.com>]

On 27/02/13 14:34, Wei Liu wrote:
> Note: this call always fails as it is not yet completed.
> 
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
> ---
>  xen/common/event_channel.c |   56 ++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 56 insertions(+)
> 
> diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
> index 26daa7e..bb6e5f9 100644
> --- a/xen/common/event_channel.c
> +++ b/xen/common/event_channel.c
> @@ -1204,6 +1204,34 @@ static long evtchn_register_3level(evtchn_register_3level_t *arg)
>      return rc;
>  }
>  
> +/*
> + * NOTE to extneded event channel users:
> + * extended channels are likely to consume lots large global mapping
> + * area in Xen. For example, 3-level event channel consumes 16 +
> + * nr_vcpus pages global mapping area.
> + */
> +static long evtchn_register_extended(struct evtchn_register_extended *reg)
> +{
> +    struct domain *d = current->domain;
> +    int rc;
> +
> +    spin_lock(&d->event_lock);
> +
> +    switch ( reg->cmd )
> +    {
> +    case EVTCHN_EXTENDED_NONE:
> +    default:
> +        rc = -EINVAL;
> +    case EVTCHN_EXTENDED_L3:
> +        rc = evtchn_register_3level(&reg->u.l3);
> +        break;
> +    }
> +
> +    spin_unlock(&d->event_lock);
> +
> +    return rc;
> +}
> +
>  long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
>  {
>      long rc;
> @@ -1312,6 +1340,19 @@ long do_event_channel_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
>          break;
>      }
>  
> +    case EVTCHNOP_register_extended: {
> +        struct evtchn_register_extended reg;
> +
> +        if ( copy_from_guest(&reg, arg, 1) != 0 )
> +            return -EFAULT;

If the guest's idea of the size of struct evtchn_register_extended is
smaller than Xen's, then Xen may try to copy more data that is actually
available.  This may then return -EFAULT unexpectedly if the guest
allocated the structure at the end of a page and the following page is
not mapped.

David