[xen staging] xen/arm: Harden the P2M code in p2m_remove_mapping()

[patchbot@xxxxxxx]

commit 5a4a2cef085d74a247663ed210e9398264ce3fc8
Author:     Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>
AuthorDate: Sat Jul 16 17:56:57 2022 +0300
Commit:     Julien Grall <jgrall@xxxxxxxxxx>
CommitDate: Wed Jul 20 19:12:22 2022 +0100

    xen/arm: Harden the P2M code in p2m_remove_mapping()
    
    Borrow the x86's check from p2m_remove_page() which was added
    by the following commit: c65ea16dbcafbe4fe21693b18f8c2a3c5d14600e
    "x86/p2m: don't assert that the passed in MFN matches for a remove"
    and adjust it to the Arm code base.
    
    Basically, this check will be strictly needed for the xenheap pages
    after applying a subsequent commit which will introduce xenheap based
    M2P approach on Arm. But, it will be a good opportunity to harden
    the P2M code for *every* RAM pages since it is possible to remove
    any GFN - MFN mapping currently on Arm (even with the wrong helpers).
    
    Suggested-by: Julien Grall <jgrall@xxxxxxxxxx>
    Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>
    Reviewed-by: Julien Grall <jgrall@xxxxxxxxxx>
---
 xen/arch/arm/p2m.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
index d00c2e462a..46ee675409 100644
--- a/xen/arch/arm/p2m.c
+++ b/xen/arch/arm/p2m.c
@@ -1308,11 +1308,39 @@ static inline int p2m_remove_mapping(struct domain *d,
                                      mfn_t mfn)
 {
     struct p2m_domain *p2m = p2m_get_hostp2m(d);
+    unsigned long i;
     int rc;
 
     p2m_write_lock(p2m);
+    /*
+     * Before removing the GFN - MFN mapping for any RAM pages make sure
+     * that there is no difference between what is already mapped and what
+     * is requested to be unmapped.
+     * If they don't match bail out early. For instance, this could happen
+     * if two CPUs are requesting to unmap the same P2M entry concurrently.
+     */
+    for ( i = 0; i < nr; )
+    {
+        unsigned int cur_order;
+        p2m_type_t t;
+        mfn_t mfn_return = p2m_get_entry(p2m, gfn_add(start_gfn, i), &t, NULL,
+                                         &cur_order, NULL);
+
+        if ( p2m_is_any_ram(t) &&
+             (!mfn_valid(mfn) || !mfn_eq(mfn_add(mfn, i), mfn_return)) )
+        {
+            rc = -EILSEQ;
+            goto out;
+        }
+
+        i += (1UL << cur_order) -
+             ((gfn_x(start_gfn) + i) & ((1UL << cur_order) - 1));
+    }
+
     rc = p2m_set_entry(p2m, start_gfn, nr, INVALID_MFN,
                        p2m_invalid, p2m_access_rwx);
+
+out:
     p2m_write_unlock(p2m);
 
     return rc;
--
generated by git-patchbot for /home/xen/git/xen.git#staging