From 81e823f1e99b45aae53149b6711b4670c53ef7db Mon Sep 17 00:00:00 2001 From: Michal Orzel Date: Mon, 19 Oct 2026 16:57:25 +0200 Subject: [PATCH] xen/arm: validate max grant frames against the grant table region Per the binding (docs/misc/arm/device-tree/guest.txt), region 0 for mapping grant table is large enough to map the whole grant table. Xen never checks that this holds: - enhanced dom0less domUs are given GUEST_GNTTAB_SIZE (4096 frames), while their limit comes from the max_grant_frames DT property or, if absent, from the gnttab_max_frames command line option or default, neither of which is bounded by the region size, - a dom0less hardware domain is given gnttab_dom0_frames() frames, while the max_grant_frames DT property can raise its limit above that. A guest growing its grant table past the end of the region ends up mapping grant frames over whatever follows it in its address space, e.g. the magic pages at GUEST_MAGIC_BASE for a domU. Validate that the configured max frames can actually fit in the region Xen exposes in make_hypervisor_node(). Fix find_gnttab_region() logic of setting the gnttab_size for hardware domain to allow the max frames up until the size of the text section. Otherwise, the DT setting would only allow to shrink it from the default. Fixes: 79eb2871f25e ("xen/arm: configure dom0less domain for enabling xenstore after boot") Fixes: df68a4cb7ed9 ("xen/arm: Add capabilities to dom0less") Signed-off-by: Michal Orzel Reviewed-by: Stefano Stabellini --- docs/misc/arm/device-tree/booting.txt | 5 ++++- xen/arch/arm/domain_build.c | 16 +++++++++++++++- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/docs/misc/arm/device-tree/booting.txt b/docs/misc/arm/device-tree/booting.txt index 3787d2e2b6..1dfdff0e4f 100644 --- a/docs/misc/arm/device-tree/booting.txt +++ b/docs/misc/arm/device-tree/booting.txt @@ -291,7 +291,10 @@ with the following properties: Optional. A 32-bit integer specifying the maximum number of grant frames the domain is allowed to have. If this property is missing, the value specified by Xen command line parameter gnttab_max_frames (or its default - value if unspecified, i.e. 64) is used. + value if unspecified, i.e. 64) is used. For hardware domain and xen,enhanced + domains (for which Xen advertises /hypervisor node) the limit is based on + the max region size (GUEST_GNTTAB_SIZE for domUs, size of Xen's text section + for hardware domain). A larger value makes the domain fail to build. - max_maptrack_frames diff --git a/xen/arch/arm/domain_build.c b/xen/arch/arm/domain_build.c index 72f6f7539a..1ee1f1f6a7 100644 --- a/xen/arch/arm/domain_build.c +++ b/xen/arch/arm/domain_build.c @@ -1031,6 +1031,8 @@ int __init make_hypervisor_node(struct domain *d, void *fdt = kinfo->fdt; struct membanks *ext_regions = NULL; unsigned int i, nr_ext_regions; + unsigned int gnttab_frames = + gnttab_resource_max_frames(d, XENMEM_resource_grant_table_id_shared); dt_dprintk("Create hypervisor node\n"); @@ -1042,6 +1044,14 @@ int __init make_hypervisor_node(struct domain *d, (sizecells != 1 && sizecells != 2)) panic("Cannot cope with this size\n"); + if ( gnttab_frames > PFN_DOWN(kinfo->gnttab_size) ) + { + printk(XENLOG_ERR + "%pd: grant frames limit (%u) exceeds the region size (%lu frames)\n", + d, gnttab_frames, (unsigned long)PFN_DOWN(kinfo->gnttab_size)); + return -EINVAL; + } + /* See linux Documentation/devicetree/bindings/arm/xen.txt */ res = fdt_begin_node(fdt, "hypervisor"); if ( res ) @@ -1750,6 +1760,9 @@ void __init evtchn_allocate(struct domain *d) static void __init find_gnttab_region(struct domain *d, struct kernel_info *kinfo) { + unsigned int gnttab_frames = + gnttab_resource_max_frames(d, XENMEM_resource_grant_table_id_shared); + /* * The region used by Xen on the memory will never be mapped in DOM0 * memory layout. Therefore it can be used for the grant table. @@ -1758,7 +1771,8 @@ static void __init find_gnttab_region(struct domain *d, * enough space for a large grant table */ kinfo->gnttab_start = __pa(_stext); - kinfo->gnttab_size = gnttab_dom0_frames() << PAGE_SHIFT; + kinfo->gnttab_size = min_t(unsigned int, gnttab_frames, + PFN_DOWN(_etext - _stext)) << PAGE_SHIFT; #ifdef CONFIG_ARM_32 /*