Re: [Xen-devel] [RFC PATCH] x86/pagewalk: Honor SMAP_CHECK_DISABLED

[Jason Andryuk <jandryuk@xxxxxxxxx>]

On Mon, May 7, 2018 at 4:05 PM, Andrew Cooper <andrew.cooper3@xxxxxxxxxx> wrote:
> On 07/05/2018 20:57, Jason Andryuk wrote:
>> commit 4c5d78a10dc89427140a50a1df5a0b8e9f073e82 (x86/pagewalk:
>> Re-implement the pagetable walker) removed honoring the
>> smap_check_policy of the running VCPU.  guest_walk_tables is used by
>> copy_{to,from}_guest for HVMs, so it is called when the hypervisor is
>> copying data and SMAP is inappropriate to enforce.
>>
>> The out-of-tree v4v hypercall copies a domain's source buffer into a
>> different domain's destination ring.  For an HVM, the kernel makes the
>> hypercall from ring 0, so the userspace buffer access looks like a SMAP
>> violation.  In Xen 4.6, v4v could set SMAP_CHECK_DISABLED to avoid this
>> SMAP failure, but that no longer works since the re-write.
>>
>> Signed-off-by: Jason Andryuk <jandryuk@xxxxxxxxx>
>
> I'm sorry, but no.  It is never appropriate to ignore the guest paging
> settings.  The correct fix here is in the kernel, to surround the v4v
> hypercall handler with stac/clac to whitelist userspace accesses.  See
> the implementation of the privcmd hypercall which already does this.

Oh, I didn't realize stac/clac are already used with a hypercall.
Thanks for the pointer.

> If I could go back in time and nack the introduction of
> smap_check_policy, I would.  As it stands, I'm (slowly) removing its
> use, and will eventually delete it.

I think you are close.  It seems to me smap_check_policy is set but not used.

Regards,
Jason

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel