From nobody Thu May 2 04:02:22 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1614245474; cv=none; d=zohomail.com; s=zohoarc; b=iZ1Z+xpx1FY9548ZjtsR01umtT4nmAW9rR0RLYwEMtFwmJi6HzHsv6IwHqmZiKShZqD6tbVj/JgYYGV3kCMHE/puFUXHMX8HfOUsKv9dwnYcPMn+3DrDQ8tzvVhqB1tTxa7RvHCrcdsVCc8T2uyhHZm/3F2tYqw3tAwE0nuNra8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1614245474; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=k5zZu7hjg52cgojELw71rkpoVSlk7KP4+FpJe/naTbE=; b=ZMZ7s8UILyOKuVFGd7Z6Td2oMHsAVTPDdbZCc3DlCg0bVRhsCFwjqaY2oHJgFV3+u7Lg8nBg0RAGqycYFtb7aNvh1PtHWCJ3Z8TWJ9iu7QhIWt12AWjZJsCzuCFSnl2QdQy6Z8rIeR2NKv/+gfszsQtwLYxxDTOyIiEClmSkI0w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) header.from= Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 161424547419365.4827860964349; Thu, 25 Feb 2021 01:31:14 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.89652.169025 (Exim 4.92) (envelope-from ) id 1lFCyy-0001if-CM; Thu, 25 Feb 2021 09:30:52 +0000 Received: by outflank-mailman (output) from mailman id 89652.169025; Thu, 25 Feb 2021 09:30:52 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1lFCyy-0001iY-7Q; Thu, 25 Feb 2021 09:30:52 +0000 Received: by outflank-mailman (input) for mailman id 89652; Thu, 25 Feb 2021 09:30:50 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1lFCyw-0001iT-NS for xen-devel@lists.xenproject.org; Thu, 25 Feb 2021 09:30:50 +0000 Received: from mx2.suse.de (unknown [195.135.220.15]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 668af6fa-de4b-468b-8874-511155fb9473; Thu, 25 Feb 2021 09:30:49 +0000 (UTC) Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id DD387AC1D; Thu, 25 Feb 2021 09:30:48 +0000 (UTC) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 668af6fa-de4b-468b-8874-511155fb9473 X-Virus-Scanned: by amavisd-new at test-mx.suse.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1614245449; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=k5zZu7hjg52cgojELw71rkpoVSlk7KP4+FpJe/naTbE=; b=BO1GKhddZRGNlok9epDuUTki4R+GcGUaS5IGt+lGtcvMU3Kd8u4XHtnOBxAajscA4n7eQN i07pclDiNBlaGVZqUspJ1uZSNhDiy+hy06xPJk79wvsjh9KMvlzTKQ9/+kuEeYhQ5vqIqk w21els91RR3fiacJsf3nSZsoM1/QVDE= From: Jan Beulich Subject: [PATCH v3][4.15] x86: mirror compat argument translation area for 32-bit PV To: "xen-devel@lists.xenproject.org" Cc: Andrew Cooper , Wei Liu , =?UTF-8?Q?Roger_Pau_Monn=c3=a9?= , Ian Jackson Message-ID: Date: Thu, 25 Feb 2021 10:30:49 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.7.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Language: en-US Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @suse.com) Now that we guard the entire Xen VA space against speculative abuse through hypervisor accesses to guest memory, the argument translation area's VA also needs to live outside this range, at least for 32-bit PV guests. To avoid extra is_hvm_*() conditionals, use the alternative VA uniformly. While this could be conditionalized upon CONFIG_PV32 && CONFIG_SPECULATIVE_HARDEN_GUEST_ACCESS, omitting such extra conditionals keeps the code more legible imo. Fixes: 4dc181599142 ("x86/PV: harden guest memory accesses against speculat= ive abuse") Signed-off-by: Jan Beulich Acked-by: Roger Pau Monn=C3=A9 Release-Acked-by: Ian Jackson --- v3: Use address range in lower half of address space. v2: Rename PERDOMAIN2_VIRT_START to PERDOMAIN_ALT_VIRT_START. --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -1691,6 +1691,13 @@ void init_xen_l4_slots(l4_pgentry_t *l4t l4t[l4_table_offset(PERDOMAIN_VIRT_START)] =3D l4e_from_page(d->arch.perdomain_l3_pg, __PAGE_HYPERVISOR_RW); =20 + /* Slot 4: Per-domain mappings mirror. */ + BUILD_BUG_ON(IS_ENABLED(CONFIG_PV32) && + !l4_table_offset(PERDOMAIN_ALT_VIRT_START)); + if ( !is_pv_64bit_domain(d) ) + l4t[l4_table_offset(PERDOMAIN_ALT_VIRT_START)] =3D + l4t[l4_table_offset(PERDOMAIN_VIRT_START)]; + /* Slot 261-: text/data/bss, RW M2P, vmap, frametable, directmap. */ #ifndef NDEBUG if ( short_directmap && --- a/xen/include/asm-x86/config.h +++ b/xen/include/asm-x86/config.h @@ -170,7 +170,11 @@ extern unsigned char boot_edid_info[128] * Guest-defined use. * 0x00000000f5800000 - 0x00000000ffffffff [168MB, PML4:0] * Read-only machine-to-phys translation table (GUEST ACCESSIBLE). - * 0x0000000100000000 - 0x00007fffffffffff [128TB-4GB, PML4:0-255] + * 0x0000000100000000 - 0x000001ffffffffff [2TB-4GB, PML4:0-3] + * Unused / Reserved for future use. + * 0x0000020000000000 - 0x0000027fffffffff [512GB, 2^39 bytes, PML4:4] + * Mirror of per-domain mappings (for argument translation area; also H= VM). + * 0x0000028000000000 - 0x00007fffffffffff [125.5TB, PML4:5-255] * Unused / Reserved for future use. */ =20 @@ -207,6 +211,8 @@ extern unsigned char boot_edid_info[128] #define PERDOMAIN_SLOTS 3 #define PERDOMAIN_VIRT_SLOT(s) (PERDOMAIN_VIRT_START + (s) * \ (PERDOMAIN_SLOT_MBYTES << 20)) +/* Slot 4: mirror of per-domain mappings (for compat xlat area accesses). = */ +#define PERDOMAIN_ALT_VIRT_START PML4_ADDR(260 % 256) /* Slot 261: machine-to-phys conversion table (256GB). */ #define RDWR_MPT_VIRT_START (PML4_ADDR(261)) #define RDWR_MPT_VIRT_END (RDWR_MPT_VIRT_START + MPT_VIRT_SIZE) --- a/xen/include/asm-x86/x86_64/uaccess.h +++ b/xen/include/asm-x86/x86_64/uaccess.h @@ -1,7 +1,17 @@ #ifndef __X86_64_UACCESS_H #define __X86_64_UACCESS_H =20 -#define COMPAT_ARG_XLAT_VIRT_BASE ((void *)ARG_XLAT_START(current)) +/* + * With CONFIG_SPECULATIVE_HARDEN_GUEST_ACCESS (apparent) PV guest accesses + * are prohibited to touch the Xen private VA range. The compat argument + * translation area, therefore, can't live within this range. Domains + * (potentially) in need of argument translation (32-bit PV, possibly HVM)= get + * a secondary mapping installed, which needs to be used for such accesses= in + * the PV case, and will also be used for HVM to avoid extra conditionals. + */ +#define COMPAT_ARG_XLAT_VIRT_BASE ((void *)ARG_XLAT_START(current) + \ + (PERDOMAIN_ALT_VIRT_START - \ + PERDOMAIN_VIRT_START)) #define COMPAT_ARG_XLAT_SIZE (2*PAGE_SIZE) struct vcpu; int setup_compat_arg_xlat(struct vcpu *v);