mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath
All changes in writeability and cacheability must go through full re-validation. Rework the logic as a whitelist, to make it clearer to follow. This is XSA-182 Reported-by: Jérémie Boutoille <jboutoille@ext.quarkslab.com> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Tim Deegan <tim@xen.org>
This commit is contained in:
Andrew Cooper committed
1 parent
0a8c94fae9
commit
f009300d7e
2 files changed
+17
-12
No files matched your search
+16
-12
@@ -1711,6 +1711,14 @@ static inline int update_intpte(intpte_t *p,
|
||||
_t ## e_get_intpte(_o), _t ## e_get_intpte(_n), \
|
||||
(_m), (_v), (_ad))
|
||||
|
||||
/*
|
||||
* PTE flags that a guest may change without re-validating the PTE.
|
||||
* All other bits affect translation, caching, or Xen's safety.
|
||||
*/
|
||||
#define FASTPATH_FLAG_WHITELIST \
|
||||
(_PAGE_NX_BIT | _PAGE_AVAIL_HIGH | _PAGE_AVAIL | _PAGE_GLOBAL | \
|
||||
_PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_USER)
|
||||
|
||||
/* Update the L1 entry at pl1e to new value nl1e. */
|
||||
static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
|
||||
unsigned long gl1mfn, int preserve_ad,
|
||||
@@ -1751,9 +1759,8 @@ static int mod_l1_entry(l1_pgentry_t *pl1e, l1_pgentry_t nl1e,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
/* Fast path for identical mapping, r/w, presence, and cachability. */
|
||||
if ( !l1e_has_changed(ol1e, nl1e,
|
||||
PAGE_CACHE_ATTRS | _PAGE_RW | _PAGE_PRESENT) )
|
||||
/* Fast path for sufficiently-similar mappings. */
|
||||
if ( !l1e_has_changed(ol1e, nl1e, ~FASTPATH_FLAG_WHITELIST) )
|
||||
{
|
||||
adjust_guest_l1e(nl1e, pt_dom);
|
||||
if ( UPDATE_ENTRY(l1, pl1e, ol1e, nl1e, gl1mfn, pt_vcpu,
|
||||
@@ -1835,11 +1842,8 @@ static int mod_l2_entry(l2_pgentry_t *pl2e,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
/* Fast path for identical mapping and presence. */
|
||||
if ( !l2e_has_changed(ol2e, nl2e,
|
||||
unlikely(opt_allow_superpage)
|
||||
? _PAGE_PSE | _PAGE_RW | _PAGE_PRESENT
|
||||
: _PAGE_PRESENT) )
|
||||
/* Fast path for sufficiently-similar mappings. */
|
||||
if ( !l2e_has_changed(ol2e, nl2e, ~FASTPATH_FLAG_WHITELIST) )
|
||||
{
|
||||
adjust_guest_l2e(nl2e, d);
|
||||
if ( UPDATE_ENTRY(l2, pl2e, ol2e, nl2e, pfn, vcpu, preserve_ad) )
|
||||
@@ -1904,8 +1908,8 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
/* Fast path for identical mapping and presence. */
|
||||
if ( !l3e_has_changed(ol3e, nl3e, _PAGE_PRESENT) )
|
||||
/* Fast path for sufficiently-similar mappings. */
|
||||
if ( !l3e_has_changed(ol3e, nl3e, ~FASTPATH_FLAG_WHITELIST) )
|
||||
{
|
||||
adjust_guest_l3e(nl3e, d);
|
||||
rc = UPDATE_ENTRY(l3, pl3e, ol3e, nl3e, pfn, vcpu, preserve_ad);
|
||||
@@ -1968,8 +1972,8 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
/* Fast path for identical mapping and presence. */
|
||||
if ( !l4e_has_changed(ol4e, nl4e, _PAGE_PRESENT) )
|
||||
/* Fast path for sufficiently-similar mappings. */
|
||||
if ( !l4e_has_changed(ol4e, nl4e, ~FASTPATH_FLAG_WHITELIST) )
|
||||
{
|
||||
adjust_guest_l4e(nl4e, d);
|
||||
rc = UPDATE_ENTRY(l4, pl4e, ol4e, nl4e, pfn, vcpu, preserve_ad);
|
||||
|
||||
@@ -307,6 +307,7 @@ void paging_init(void);
|
||||
#define _PAGE_AVAIL2 _AC(0x800,U)
|
||||
#define _PAGE_AVAIL _AC(0xE00,U)
|
||||
#define _PAGE_PSE_PAT _AC(0x1000,U)
|
||||
#define _PAGE_AVAIL_HIGH (_AC(0x7ff, U) << 12)
|
||||
/* non-architectural flags */
|
||||
#define _PAGE_PAGED 0x2000U
|
||||
#define _PAGE_SHARED 0x4000U
|
||||
|
||||