From: "Jan Beulich" <JBeulich@suse.com>
To: xen-devel <xen-devel@lists.xenproject.org>
Cc: Tim Deegan <tim@xen.org>
Subject: [PATCH] NPT: temporarily retain page table mapping in do_recalc()
Date: Mon, 05 May 2014 11:31:55 +0100 [thread overview]
Message-ID: <536784BB020000780000EF15@mail.emea.novell.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 3462 bytes --]
Commit b3e024f3 ("x86/NPT: don't walk page tables when changing types
on a range") neglected the fact that p2m_next_level() replaces the
previous level's mapping with the new level's one, hence dereferencing
a stale pointer the translation for which may no longer be available
(timing dependent). Add a parameter to that function allowing the
caller to request that the mapping be retained (the unmapping will be
taken care of by the caller then).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/mm/p2m-pt.c
+++ b/xen/arch/x86/mm/p2m-pt.c
@@ -172,7 +172,7 @@ static void p2m_add_iommu_flags(l1_pgent
static int
p2m_next_level(struct p2m_domain *p2m, void **table,
unsigned long *gfn_remainder, unsigned long gfn, u32 shift,
- u32 max, unsigned long type)
+ u32 max, unsigned long type, bool_t unmap)
{
l1_pgentry_t *l1_entry;
l1_pgentry_t *p2m_entry;
@@ -280,7 +280,8 @@ p2m_next_level(struct p2m_domain *p2m, v
}
next = map_domain_page(l1e_get_pfn(*p2m_entry));
- unmap_domain_page(*table);
+ if ( unmap )
+ unmap_domain_page(*table);
*table = next;
return 0;
@@ -319,7 +320,7 @@ static int p2m_pt_set_recalc_range(struc
err = p2m_next_level(p2m, &table, &gfn_remainder, first_gfn,
i * PAGETABLE_ORDER, 1 << PAGETABLE_ORDER,
- pgt[i - 1]);
+ pgt[i - 1], 1);
if ( err )
goto out;
}
@@ -386,7 +387,7 @@ static int do_recalc(struct p2m_domain *
err = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
level * PAGETABLE_ORDER, 1 << PAGETABLE_ORDER,
- pgt[level - 1]);
+ pgt[level - 1], 0);
if ( err )
goto out;
@@ -416,6 +417,7 @@ static int do_recalc(struct p2m_domain *
clear_recalc(l1, e);
p2m->write_p2m_entry(p2m, gfn, pent, e, level + 1);
}
+ unmap_domain_page((void *)((unsigned long)pent & PAGE_MASK));
}
pent = p2m_find_entry(table, &gfn_remainder, gfn,
@@ -519,7 +521,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
table = map_domain_page(mfn_x(pagetable_get_mfn(p2m_get_pagetable(p2m))));
rc = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
L4_PAGETABLE_SHIFT - PAGE_SHIFT,
- L4_PAGETABLE_ENTRIES, PGT_l3_page_table);
+ L4_PAGETABLE_ENTRIES, PGT_l3_page_table, 1);
if ( rc )
goto out;
@@ -565,7 +567,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
{
rc = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
L3_PAGETABLE_SHIFT - PAGE_SHIFT,
- L3_PAGETABLE_ENTRIES, PGT_l2_page_table);
+ L3_PAGETABLE_ENTRIES, PGT_l2_page_table, 1);
if ( rc )
goto out;
}
@@ -574,7 +576,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
{
rc = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
L2_PAGETABLE_SHIFT - PAGE_SHIFT,
- L2_PAGETABLE_ENTRIES, PGT_l1_page_table);
+ L2_PAGETABLE_ENTRIES, PGT_l1_page_table, 1);
if ( rc )
goto out;
[-- Attachment #2: NPT-recalc-keep-mapping.patch --]
[-- Type: text/plain, Size: 3517 bytes --]
NPT: temporarily retain page table mapping in do_recalc()
Commit b3e024f3 ("x86/NPT: don't walk page tables when changing types
on a range") neglected the fact that p2m_next_level() replaces the
previous level's mapping with the new level's one, hence dereferencing
a stale pointer the translation for which may no longer be available
(timing dependent). Add a parameter to that function allowing the
caller to request that the mapping be retained (the unmapping will be
taken care of by the caller then).
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/xen/arch/x86/mm/p2m-pt.c
+++ b/xen/arch/x86/mm/p2m-pt.c
@@ -172,7 +172,7 @@ static void p2m_add_iommu_flags(l1_pgent
static int
p2m_next_level(struct p2m_domain *p2m, void **table,
unsigned long *gfn_remainder, unsigned long gfn, u32 shift,
- u32 max, unsigned long type)
+ u32 max, unsigned long type, bool_t unmap)
{
l1_pgentry_t *l1_entry;
l1_pgentry_t *p2m_entry;
@@ -280,7 +280,8 @@ p2m_next_level(struct p2m_domain *p2m, v
}
next = map_domain_page(l1e_get_pfn(*p2m_entry));
- unmap_domain_page(*table);
+ if ( unmap )
+ unmap_domain_page(*table);
*table = next;
return 0;
@@ -319,7 +320,7 @@ static int p2m_pt_set_recalc_range(struc
err = p2m_next_level(p2m, &table, &gfn_remainder, first_gfn,
i * PAGETABLE_ORDER, 1 << PAGETABLE_ORDER,
- pgt[i - 1]);
+ pgt[i - 1], 1);
if ( err )
goto out;
}
@@ -386,7 +387,7 @@ static int do_recalc(struct p2m_domain *
err = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
level * PAGETABLE_ORDER, 1 << PAGETABLE_ORDER,
- pgt[level - 1]);
+ pgt[level - 1], 0);
if ( err )
goto out;
@@ -416,6 +417,7 @@ static int do_recalc(struct p2m_domain *
clear_recalc(l1, e);
p2m->write_p2m_entry(p2m, gfn, pent, e, level + 1);
}
+ unmap_domain_page((void *)((unsigned long)pent & PAGE_MASK));
}
pent = p2m_find_entry(table, &gfn_remainder, gfn,
@@ -519,7 +521,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
table = map_domain_page(mfn_x(pagetable_get_mfn(p2m_get_pagetable(p2m))));
rc = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
L4_PAGETABLE_SHIFT - PAGE_SHIFT,
- L4_PAGETABLE_ENTRIES, PGT_l3_page_table);
+ L4_PAGETABLE_ENTRIES, PGT_l3_page_table, 1);
if ( rc )
goto out;
@@ -565,7 +567,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
{
rc = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
L3_PAGETABLE_SHIFT - PAGE_SHIFT,
- L3_PAGETABLE_ENTRIES, PGT_l2_page_table);
+ L3_PAGETABLE_ENTRIES, PGT_l2_page_table, 1);
if ( rc )
goto out;
}
@@ -574,7 +576,7 @@ p2m_pt_set_entry(struct p2m_domain *p2m,
{
rc = p2m_next_level(p2m, &table, &gfn_remainder, gfn,
L2_PAGETABLE_SHIFT - PAGE_SHIFT,
- L2_PAGETABLE_ENTRIES, PGT_l1_page_table);
+ L2_PAGETABLE_ENTRIES, PGT_l1_page_table, 1);
if ( rc )
goto out;
[-- Attachment #3: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next reply other threads:[~2014-05-05 10:32 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-05 10:31 Jan Beulich [this message]
2014-05-06 9:33 ` [PATCH] NPT: temporarily retain page table mapping in do_recalc() Ian Campbell
2014-05-06 9:54 ` Andrew Cooper
2014-05-06 10:02 ` Jan Beulich
2014-05-06 10:09 ` Ian Campbell
2014-05-06 10:45 ` Tim Deegan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=536784BB020000780000EF15@mail.emea.novell.com \
--to=jbeulich@suse.com \
--cc=tim@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.