From patchwork Tue Apr 26 10:23:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 12826861 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D56CCC433F5 for ; Tue, 26 Apr 2022 10:24:10 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.313699.531391 (Exim 4.92) (envelope-from ) id 1njIMR-0008C8-2f; Tue, 26 Apr 2022 10:23:59 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 313699.531391; Tue, 26 Apr 2022 10:23:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1njIMQ-0008C1-Vi; Tue, 26 Apr 2022 10:23:58 +0000 Received: by outflank-mailman (input) for mailman id 313699; Tue, 26 Apr 2022 10:23:57 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1njIMP-0006S6-C6 for xen-devel@lists.xenproject.org; Tue, 26 Apr 2022 10:23:57 +0000 Received: from de-smtp-delivery-102.mimecast.com (de-smtp-delivery-102.mimecast.com [194.104.109.102]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id fa69d5e6-c54a-11ec-a405-831a346695d4; Tue, 26 Apr 2022 12:23:56 +0200 (CEST) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-ve1eur02lp2055.outbound.protection.outlook.com [104.47.6.55]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id de-mta-31-05FTq-RQNNW-XRPLGOZsDA-2; Tue, 26 Apr 2022 12:23:54 +0200 Received: from DU2PR04MB8616.eurprd04.prod.outlook.com (2603:10a6:10:2db::16) by AM6PR04MB4245.eurprd04.prod.outlook.com (2603:10a6:209:4f::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.21; Tue, 26 Apr 2022 10:23:51 +0000 Received: from DU2PR04MB8616.eurprd04.prod.outlook.com ([fe80::5cb0:5195:4203:7c2f]) by DU2PR04MB8616.eurprd04.prod.outlook.com ([fe80::5cb0:5195:4203:7c2f%9]) with mapi id 15.20.5186.021; Tue, 26 Apr 2022 10:23:51 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: fa69d5e6-c54a-11ec-a405-831a346695d4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=mimecast20200619; t=1650968636; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7XE0MZ5Q/V0/alHvDtFRmInLwfamZyLpxplt2pkODz8=; b=P0MJVeAB6UEjCsi/r6Zlz39ExjXLUzY3kMOcCk+zPodraQb/llf4r59p5IZHFRDAXFrjZZ ByDrrHZ6lTjjO7V8V30UBoBxpOJX4vcJ2DMk1z94yMmdgcCbsLGS05phvXDFFAPCblwl7C CillbuAGf8NO6ifT3jtQxLwUVB8emIA= X-MC-Unique: 05FTq-RQNNW-XRPLGOZsDA-2 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=O57Qh6FhRQ0Xc8/yaMe26SYHIOBBRcV2A2QXeyX2OtPC2q6IPpiysUXiPnFcyFzK9ZK3NdyvU9LAD5qRTxE45NOAdPmhJUzo8t4ziMBciMqjiDAk5K8l3dwjNx9CISK0WKlEN0xWM+bns4vNnhkiHHfX9eLcSub2wj0cpgfKfJcD2pdu5Ujx+/q/GTw8RMNRCCRPHFBk8Wg5cHPjaxz7Xw/2jsdb/hR9wtuQQzTOBHqyhSc6MgwWt8Yhn/EKqfIJKolxlRFKy8bZdF3epQ23qNO7C4JYXBtJLVaVct+BhMjmo8UXtpePgRp2g8rfhPPVqH7OADWwN6RY6pWWVyN9dw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7XE0MZ5Q/V0/alHvDtFRmInLwfamZyLpxplt2pkODz8=; b=FV7IjQn4DEXPLLcYFUqPyaSY5ExVF2ELKJzKoGyAL3xY9IYC61MWgcXt6WQRmICs2p/ZsRKhjqqz3IZIX64objIj9H+hU3nARo2ZrvD04Jzkr+cp3UMJXolKUcEq4THV6GppxfSpVYgvRt0Jz1tEB1unfcAuDkXUThboyQRNayLyvWCa2/VoczsJkBqifxzehKAPNnIjf+ehKle0U863YZRie42XwmPlf12HwFB9p5uOmYiKgMUEEyFOwLYun0Y3MD04Kkrd+H4Tr6T63gAcq7KNFRgvMIIHjUe9EQrkQl9qvZA2jcO1ZpaGGEtEQCVcKaHLBs2B16YfgGkBiP3rQA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=suse.com; dmarc=pass action=none header.from=suse.com; dkim=pass header.d=suse.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=suse.com; Message-ID: <1744d775-4446-69b4-152f-c81d36e4996c@suse.com> Date: Tue, 26 Apr 2022 12:23:49 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.8.1 Subject: [PATCH v3 4/8] libxenguest: restrict PV guest size Content-Language: en-US From: Jan Beulich To: "xen-devel@lists.xenproject.org" Cc: Andrew Cooper , Wei Liu , Juergen Gross , George Dunlap , Anthony Perard References: In-Reply-To: X-ClientProxiedBy: AM6P193CA0064.EURP193.PROD.OUTLOOK.COM (2603:10a6:209:8e::41) To DU2PR04MB8616.eurprd04.prod.outlook.com (2603:10a6:10:2db::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 635dfd18-0c15-4153-b886-08da276edb94 X-MS-TrafficTypeDiagnostic: AM6PR04MB4245:EE_ X-LD-Processed: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba,ExtFwd X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: DjYboPnQ/p/2Zsazk6LIrJywIyRlsHPxOTqzm7vuLH9yYmk1Hum3hbf/znFQH6c7N+frPkUQ3w3AyKHs01lUFLY0l+HrXqy4QGDdMgj06eW2ij0H7A1MSH7oBpHd1XbYVDoqgyV/4DxhS+WKofJwBjkOoGPoozLvqL1vwa0MHDEnCLCXFSqjpgRLwQk0Kl7w3N71xxl2QzqsFLnF6qh+9IT3hvcEzzw8x5noMBUTnOALNKkEIaW3sx5sPE1A4R65TeuGnXhTjmW8Rzjv6MU+1yEUbDb9Zp3WFWcrtT8TyiwkztcjBki4cD0gzpMMGfI8Q52+BiQUCMz8FtLcgYLOCm2gdmX2gjWvpjrFboR95j1mrMPRBFHZcBhxw4Y6fpdeRxARCdttidEXmgjSFaKiVvsD7n7gOI43cfrW9dUB1B79bWvijqhcID5L6Pcs0g7ZDV3Z8Lg+HNPbY/vPi+DE3vIfgfDLXmOor8XjvhcGaM/LIJT4TMdNn/xuoXb+GDhJ9x9LGlqIptGZ7T6BVdY2ptLV3ZoGOBifsfvfRG144BDy3t4SJJRXlBGymYj/ILUUPmzFmz279WuhgqaRky6z81XK11N1p1MjXI4NbGr9WMRXPLG4jDLeJMhfIJOKEtGy3pmkvWBBcqUlWpNyTU6/SfxtR7RJfY78ikiTFm3YrD/FCeQHoKzBTT6zuFVBHfcyu4363Qme6p0yUlg6p5q0Hd/g0s09Cq1614jy7rYxGYU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU2PR04MB8616.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230001)(366004)(2616005)(31696002)(508600001)(6506007)(6512007)(6916009)(86362001)(186003)(36756003)(31686004)(8936002)(4326008)(38100700002)(2906002)(5660300002)(66556008)(66476007)(66946007)(26005)(316002)(54906003)(6486002)(83380400001)(8676002)(43740500002)(45980500001);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?nMlnGopt2mzgzsvz4ya/5T65JB0J?= =?utf-8?q?gqOECG/YtIUTBk08dTQzKkYu2+ZRaslM+2cZFVMAbSz5mcM3WSNM/VkXuvlAOXWcV?= =?utf-8?q?ipl0AB05TJJw8NYWjH9V437S+9mHQLg/qlu8V9vWTRhOeYZzp2ClVgMrmzib/OL0j?= =?utf-8?q?N1fdYqwLsvHfSrqc7kSsnk7IVsAHMVRTzC/oPmb5zCI5jCCvZcK/C8POif7qkThD2?= =?utf-8?q?WutYB3mjsKWiHghm2m7PdOSXkj3dbqAWzUi5e8wkzEMvYRMe8WkHRYnG/7HYqEvLW?= =?utf-8?q?o0WEsKjZv4OE7swA9/GYAu00Ug09lQHUjV8oz2ahaCOZnC09jRYJjMw6OT9tTu+/c?= =?utf-8?q?nrCqdFGdxo7nb772KCHZpeZaUz05zUol2rgkF2ODqA7BlvRrgqw3bZ1IhOuu8eIVg?= =?utf-8?q?u+O1S2vJqzwaR30mkj/0xh+G9+GLpE+iZiclZVDJ1O1uS5eT/tUIwE3xAdoc9yUfl?= =?utf-8?q?VNMq6Ee5OKg28QTg+/t3Jkhsry+/ZiVIr0i/A10I1lW0FzRvpLcPCyxdpzj5dK1bb?= =?utf-8?q?v3z6HmZXTS8XW9CwFy2D/AwWfvUZJi6WgAReVilw93m9+hcEDMNgKbUwLOpsLWbpH?= =?utf-8?q?37mqHj5w5w2NSIqDRAhMDeZAJdIwxLEKuZ9YnT74aA9jea5VtgiaSq3oNaBtquMQD?= =?utf-8?q?P4ZtdurUDEo8w8wpa+wrE7gy3bpihBxFpfQlHKpMgmm02l3zFN8U5pBRsGlJmkm+N?= =?utf-8?q?7x2Ijf5t+5rPcPKXv15dA5C9q/WVViDsjNGoAddHRalrUHj3+xKx6IR09m6TA+EHH?= =?utf-8?q?zCEu02Bu0/fzUoNmkBqiyUCtaMFkHEhtJEiImXmVkGaReMrmF6onEvvH9FlFmgD1/?= =?utf-8?q?oCjVStcJJO1SP0dS0HQXpdRfMlLx8Kvp9tRddExACUgMGudclYTAD2Ki5HePscRkh?= =?utf-8?q?83ubSX217b9BVkitQuUPrrlpLBLPKOdjsdjE5d95PEv+8FYfO7lOOki3y4IIHPq1L?= =?utf-8?q?l9mVF3W024UvjzMoz2MhRfUEp5yIKZxNcYR2+hzwGDoUXqibbYyhOl+aTFa/Ozxqr?= =?utf-8?q?xZCkJFg/dj/tvpsxUzZP3w71IN01UcTswM/HpvluK3bgvpuMLLvxGnnD7aOpdICme?= =?utf-8?q?yyLdVf69kd5329KXKeiddSRRZa3H7O5kx5nl0MTOYy9antkQ0YF0pjUdt448cxRZt?= =?utf-8?q?Or92MLSDt301rwei9tgfcccjbAWCcwn8HI6zxgBoHGgAQXzauvOUvEqHF02RkwbnK?= =?utf-8?q?jA5qzvOg89xMu9iClt6qA4PEIJQaMSvSJTJmgJtlAsj7gHE9KC7bCKxRJbPLnT0gj?= =?utf-8?q?xlcGjPMMi5/Uj7Ijf4utwUaYJY2KflDwqTqra+OhD7fRYOIYOgtyqze9sa9SuIGeZ?= =?utf-8?q?vm3tC0metSMr4abnhH8O98rgoFcGmxUosKm8jkVwpupP/yL9+5ySx6aw2/AiddmdL?= =?utf-8?q?zxsjyvDJyG3DpaDW+N2Vbio+V4FXDNtHGJ9ZQ7Xcbqza2YkTiV0BBrvtIhP/Gg99Z?= =?utf-8?q?mFjFQbCL3BDxAwBeD9S0si52X/g9W3obzKyvWdmVfIPbbld7HsAKh2Uel1uYxuHDs?= =?utf-8?q?fVkWpwRyu7j4mdooUKrCgXszIggaOba0jL+sg8qnM/HpdaXU7b/iS0EIaKH5IArH3?= =?utf-8?q?Ov8qKfxq7nePM/hh7XhKBENcxwEdPBH4xVb8lDiBVg/hIPPk8sFI4jfrYvdu6v2Bl?= =?utf-8?q?R5QA7g1CisaSKlrpXYY3SEydQ38w17ug=3D=3D?= X-OriginatorOrg: suse.com X-MS-Exchange-CrossTenant-Network-Message-Id: 635dfd18-0c15-4153-b886-08da276edb94 X-MS-Exchange-CrossTenant-AuthSource: DU2PR04MB8616.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Apr 2022 10:23:51.1282 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: tlmkGKa4+uwA2DbbFUXoZap0+sx7AubJo80rVCAlQk0SrCi9WrspeGs4jTAckoYAISmG12e6sSUXAgf+/9aYWA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR04MB4245 The P2M, the use of PFNs, and hence the maximum valid PFN are purely software constructs in PV. In principle a guest is free to use arbitrary PFNs. However, at least page table normalization requires that PFN space be, like MFN space, limited to the architectural 40 bits (52 address bits). And of course a 32-bit tool stack places further constraints. Bounding the values also makes sure that various subsequent calculations won't truncate values and then continue with inconsistencies (see e.g. fl_entries vs ctx->x86.pv.p2m_frames in map_p2m_tree()). While there correct an adjacent error message with wrong way round wording in restore code and another slightly malformed and misleading (off by one) one in core dumping code. Signed-off-by: Jan Beulich --- v2: Integrate into series. --- In case the save/restore changes don't make it obvious enough: It escapes me why struct xc_sr_rec_x86_pv_p2m_frames has p2m_pfns[] with uint64_t element type but {start,end}_pfn both as uint32_t. Imo all three can sensibly only ever be of the same type. --- a/tools/include/xen-tools/libs.h +++ b/tools/include/xen-tools/libs.h @@ -13,6 +13,10 @@ #define ARRAY_SIZE(a) (sizeof(a) / sizeof(*a)) #endif +#ifndef sizeof_field +#define sizeof_field(type, field) sizeof(((type *)0)->field) +#endif + #ifndef MAX #define MAX(x, y) ((x) > (y) ? (x) : (y)) #endif --- a/tools/libs/guest/xg_core_x86.c +++ b/tools/libs/guest/xg_core_x86.c @@ -59,6 +59,43 @@ xc_core_arch_memory_map_get(xc_interface if ( xc_domain_nr_gpfns(xch, info->domid, &p2m_size) < 0 ) return -1; + if ( !p2m_size ) + { + ERROR("Cannot map a guest without P2M"); + errno = ENODATA; + return -1; + } + + if ( !info->hvm ) + { + unsigned int guest_width; + + if ( xc_domain_get_guest_width(xch, info->domid, &guest_width) != 0 ) + { + PERROR("Cannot get address size for PV guest"); + return -1; + } + + if ( p2m_size == (guest_width > 4 ? ~0UL : ~0U) ) + { + ERROR("Cannot map a PV guest with invalid P2M"); + errno = ENODATA; + return -1; + } + } + +#ifndef __i386__ + if ( (p2m_size - 1) >> 40 ) +#else + /* Very large domains (> 1TB) will exhaust virtual address space. */ + if ( (p2m_size - 1) >> 28 ) +#endif + { + ERROR("Cannot map a guest with P2M size %#lx", p2m_size); + errno = EOPNOTSUPP; + return -1; + } + map = malloc(sizeof(*map)); if ( map == NULL ) { @@ -333,10 +370,30 @@ xc_core_arch_map_p2m_rw(xc_interface *xc if ( dinfo->p2m_size < info->nr_pages ) { - ERROR("p2m_size < nr_pages -1 (%lx < %lx", dinfo->p2m_size, info->nr_pages - 1); + ERROR("p2m_size < nr_pages (%lx < %lx)", dinfo->p2m_size, info->nr_pages); goto out; } + if ( !info->hvm && dinfo->p2m_size == (dinfo->guest_width > 4 ? ~0UL : ~0U) ) + { + ERROR("Cannot r/%c-map a PV guest with invalid P2M", rw ? 'w' : 'o'); + errno = ENODATA; + return -1; + } + +#ifndef __i386__ + if ( (dinfo->p2m_size - 1) >> 40 ) +#else + /* Very large domains (> 1TB) will exhaust virtual address space. */ + if ( (dinfo->p2m_size - 1) >> 28 ) +#endif + { + ERROR("Cannot r/%c-map a guest with P2M size %#lx", + rw ? 'w' : 'o', dinfo->p2m_size); + errno = EOPNOTSUPP; + return -1; + } + p2m_cr3 = GET_FIELD(live_shinfo, arch.p2m_cr3, dinfo->guest_width); p2m_frame_list = p2m_cr3 ? xc_core_arch_map_p2m_list_rw(xch, dinfo, dom, live_shinfo, p2m_cr3) --- a/tools/libs/guest/xg_sr_restore_x86_pv.c +++ b/tools/libs/guest/xg_sr_restore_x86_pv.c @@ -709,10 +709,23 @@ static int handle_x86_pv_p2m_frames(stru return -1; } +#ifdef __i386__ + /* Very large domains (> 1TB) will exhaust virtual address space. */ + if ( data->end_pfn >> 28 ) +#elif 0 /* sizeof(data->end_pfn) > 4 */ + if ( data->end_pfn >> (ctx->x86.pv.width > 4 ? 40 : 32) ) +#else + if ( 0 ) +#endif + { + ERROR("End pfn in stream (%#x) too large", data->end_pfn); + return -1; + } + if ( data->start_pfn > data->end_pfn ) { - ERROR("End pfn in stream (%#x) exceeds Start (%#x)", - data->end_pfn, data->start_pfn); + ERROR("Start pfn in stream (%#x) exceeds End (%#x)", + data->start_pfn, data->end_pfn); return -1; } --- a/tools/libs/guest/xg_sr_save_x86_pv.c +++ b/tools/libs/guest/xg_sr_save_x86_pv.c @@ -464,11 +464,40 @@ static int map_p2m_list(struct xc_sr_con */ static int map_p2m(struct xc_sr_context *ctx) { + xc_interface *xch = ctx->xch; uint64_t p2m_cr3; + uint64_t max_pfn = GET_FIELD(ctx->x86.pv.shinfo, arch.max_pfn, + ctx->x86.pv.width); + + if ( !max_pfn ) + { + ERROR("Cannot save a guest without P2M"); + errno = ENODATA; + return -1; + } + + if ( max_pfn-- == (ctx->x86.pv.width > 4 ? ~0UL : ~0U) ) + { + ERROR("Cannot save a guest with invalid P2M"); + errno = ENODATA; + return -1; + } + +#ifndef __i386__ + if ( max_pfn >> (sizeof_field(struct xc_sr_rec_x86_pv_p2m_frames, + end_pfn) > 4 ? 40 : 32) ) +#else + /* Very large domains (> 1TB) will exhaust virtual address space. */ + if ( max_pfn >> 28 ) +#endif + { + ERROR("Cannot save a guest with maximum PFN %#"PRIx64, max_pfn); + errno = EOPNOTSUPP; + return -1; + } ctx->x86.pv.p2m_generation = ~0ULL; - ctx->x86.pv.max_pfn = GET_FIELD(ctx->x86.pv.shinfo, arch.max_pfn, - ctx->x86.pv.width) - 1; + ctx->x86.pv.max_pfn = max_pfn; p2m_cr3 = GET_FIELD(ctx->x86.pv.shinfo, arch.p2m_cr3, ctx->x86.pv.width); return p2m_cr3 ? map_p2m_list(ctx, p2m_cr3) : map_p2m_tree(ctx);