Suspicious code in p2m_set_altp2m_mem_access

Suspicious code in p2m_set_altp2m_mem_access

[Alexandru Stefan ISAILA]

Hi all,

I came across some code in the p2m_set_altp2m_mem_access() that does not 
seem right. On the invalid mfn branch there is a try to set_entry() and 
if that is not successful then the function does not return and calls 
set_entry again for PAGE_ORDER_4K even if there was a check that page 
order is different from PAGE_ORDER_4K.

http://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=xen/arch/x86/mm/mem_access.c;h=a144bb0ce494318b0493dcff31bb5e4e8a742969;hb=refs/heads/staging#l272

Is this behavior wanted?

Regards,
Alex
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: Suspicious code in p2m_set_altp2m_mem_access

[George Dunlap]

> On Apr 3, 2019, at 3:52 PM, Alexandru Stefan ISAILA <aisaila@bitdefender.com> wrote:
> 
> Hi all,
> 
> I came across some code in the p2m_set_altp2m_mem_access() that does not 
> seem right. On the invalid mfn branch there is a try to set_entry() and 
> if that is not successful then the function does not return and calls 
> set_entry again for PAGE_ORDER_4K even if there was a check that page 
> order is different from PAGE_ORDER_4K.
> 
> http://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=xen/arch/x86/mm/mem_access.c;h=a144bb0ce494318b0493dcff31bb5e4e8a742969;hb=refs/heads/staging#l272
> 
> Is this behavior wanted?

Yes.

The code checks to see if the *altp2m* for that entry is invalid.  If so, it then goes and reads the *hostp2m*.  If the altp2m entry is invalid, and the hostp2m entry is valid, *and* the hostp2m entry is > 4k (say, 2MiB), then it first makes a complete copy of the hostp2m entry, then does the originally-requested (4k) write.

The result of the first write will be a 2MiB entry that’s a copy of the hostpm; the result of the second write will be to break that 2MiB entry into 4k entries, then overwrite that single entry.

 -George


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel