From patchwork Wed Jan 20 15:38:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Beulich X-Patchwork-Id: 8072631 Return-Path: X-Original-To: patchwork-xen-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id A2156BEEE5 for ; Wed, 20 Jan 2016 15:40:29 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id CDD62204A9 for ; Wed, 20 Jan 2016 15:40:28 +0000 (UTC) Received: from lists.xen.org (lists.xenproject.org [50.57.142.19]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 06540204A7 for ; Wed, 20 Jan 2016 15:40:28 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1aLuq2-0005zK-7V; Wed, 20 Jan 2016 15:38:26 +0000 Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1aLuq1-0005z7-Nf for xen-devel@lists.xenproject.org; Wed, 20 Jan 2016 15:38:25 +0000 Received: from [85.158.143.35] by server-1.bemta-4.messagelabs.com id 14/EB-09708-1F9AF965; Wed, 20 Jan 2016 15:38:25 +0000 X-Env-Sender: JBeulich@suse.com X-Msg-Ref: server-14.tower-21.messagelabs.com!1453304299!11150337!1 X-Originating-IP: [137.65.248.74] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 7.35.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 52114 invoked from network); 20 Jan 2016 15:38:24 -0000 Received: from prv-mh.provo.novell.com (HELO prv-mh.provo.novell.com) (137.65.248.74) by server-14.tower-21.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 20 Jan 2016 15:38:24 -0000 Received: from INET-PRV-MTA by prv-mh.provo.novell.com with Novell_GroupWise; Wed, 20 Jan 2016 08:38:18 -0700 Message-Id: <569FB7F902000078000C93DA@prv-mh.provo.novell.com> X-Mailer: Novell GroupWise Internet Agent 14.2.0 Date: Wed, 20 Jan 2016 08:38:17 -0700 From: "Jan Beulich" To: "xen-devel" Mime-Version: 1.0 Cc: Andrew Cooper , Keir Fraser Subject: [Xen-devel] [PATCH] x86: constrain MFN range Dom0 may access X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP ... to that covered by the physical address width supported by the processor. This implicitly avoids Dom0 (accidentally or due to some kind of abuse) passing out of range addresses to a guest, which in turn eliminates this only possibility for PV guests to create PTEs with one or more reserved bits set. Note that this is not a security issue due to XSA-77. Signed-off-by: Jan Beulich x86: constrain MFN range Dom0 may access ... to that covered by the physical address width supported by the processor. This implicitly avoids Dom0 (accidentally or due to some kind of abuse) passing out of range addresses to a guest, which in turn eliminates this only possibility for PV guests to create PTEs with one or more reserved bits set. Note that this is not a security issue due to XSA-77. Signed-off-by: Jan Beulich --- a/xen/arch/x86/domain_build.c +++ b/xen/arch/x86/domain_build.c @@ -1533,7 +1533,7 @@ int __init construct_dom0( /* The hardware domain is initially permitted full I/O capabilities. */ rc |= ioports_permit_access(d, 0, 0xFFFF); - rc |= iomem_permit_access(d, 0UL, ~0UL); + rc |= iomem_permit_access(d, 0UL, (1UL << (paddr_bits - PAGE_SHIFT)) - 1); rc |= irqs_permit_access(d, 1, nr_irqs_gsi - 1); /* --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -4604,7 +4604,7 @@ struct memory_map_context static int _handle_iomem_range(unsigned long s, unsigned long e, struct memory_map_context *ctxt) { - if ( s > ctxt->s ) + if ( s > ctxt->s && !(s >> (paddr_bits - PAGE_SHIFT)) ) { e820entry_t ent; XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_param; Reviewed-by: Andrew Cooper --- a/xen/arch/x86/domain_build.c +++ b/xen/arch/x86/domain_build.c @@ -1533,7 +1533,7 @@ int __init construct_dom0( /* The hardware domain is initially permitted full I/O capabilities. */ rc |= ioports_permit_access(d, 0, 0xFFFF); - rc |= iomem_permit_access(d, 0UL, ~0UL); + rc |= iomem_permit_access(d, 0UL, (1UL << (paddr_bits - PAGE_SHIFT)) - 1); rc |= irqs_permit_access(d, 1, nr_irqs_gsi - 1); /* --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -4604,7 +4604,7 @@ struct memory_map_context static int _handle_iomem_range(unsigned long s, unsigned long e, struct memory_map_context *ctxt) { - if ( s > ctxt->s ) + if ( s > ctxt->s && !(s >> (paddr_bits - PAGE_SHIFT)) ) { e820entry_t ent; XEN_GUEST_HANDLE_PARAM(e820entry_t) buffer_param;