Re: [Xen-devel] [PATCH v02 6/7] arm: introduce do_translate_pagetable hypercall

[Andrii Tseglytskyi <andrii.tseglytskyi@xxxxxxxxxxxxxxx>]

Hi Ian,

On Wed, Jul 16, 2014 at 6:43 PM, Ian Campbell <Ian.Campbell@xxxxxxxxxx> wrote:
> On Fri, 2014-07-04 at 15:35 +0100, Julien Grall wrote:
>> Hi Andrii,
>>
>> On 26/06/14 12:07, Andrii Tseglytskyi wrote:
>> > +long do_translate_pagetable(int cmd, 
>> > XEN_GUEST_HANDLE_PARAM(xen_pagetable_addr_t) pgt_addr)
>> > +{
>> > +    struct xen_pagetable_addr pgt;
>> > +    struct mmu_info *mmu = NULL;
>> > +
>> > +    if ( copy_from_guest(&pgt, pgt_addr, 1) )
>> > +        return -EFAULT;
>> > +
>> > +    mmu = mmu_lookup(pgt.reg);
>> > +    if ( !mmu )
>> > +    {
>> > +        pr_mmu("can't get mmu for addr 0x%08x", pgt.reg);
>> > +        return -EINVAL;
>> > +    }
>> > +
>> > +    pgt.maddr = mmu_translate_pagetable(mmu, pgt.paddr);
>> > +
>> > +    return copy_to_guest(pgt_addr, &pgt, 1);
>> > +}
>> > +
>>
>> AFAIU, nothing prevents a malicious guest to call this hypercall and
>> screw the pagetable of the MMU.
>
> It's R/O, isn't it?
>
> (I sure hope so!)
>

I'll implement security check here. For now it is a hole.

> Ian.
>
>



-- 

Andrii Tseglytskyi | Embedded Dev
GlobalLogic
www.globallogic.com

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel