[Xen-devel] [PATCH 8 of 8] Tools: After a helper maps a ring, yank it from the guest physmap

[Andres Lagar-Cavilla <andres@xxxxxxxxxxxxxxxx>]

 tools/tests/xen-access/xen-access.c |  5 +++++
 tools/xenpaging/xenpaging.c         |  5 +++++
 2 files changed, 10 insertions(+), 0 deletions(-)


This limits the ability of the guest to play around with its own rings, and DoS
itself.

Signed-off-by: Andres Lagar-Cavilla <andres@xxxxxxxxxxxxxxxx>

diff -r b8c6f0af992a -r 13cddd7608bd tools/tests/xen-access/xen-access.c
--- a/tools/tests/xen-access/xen-access.c
+++ b/tools/tests/xen-access/xen-access.c
@@ -269,6 +269,11 @@ xenaccess_t *xenaccess_init(xc_interface
                    (mem_event_sring_t *)xenaccess->mem_event.ring_page,
                    PAGE_SIZE);
 
+    /* Now that the ring is set, remove it from the guest's physmap */
+    if ( xc_domain_decrease_reservation_exact(xch, 
+                    xenaccess->mem_event.domain_id, 1, 0, &ring_pfn) )
+        PERROR("Failed to remove ring from guest physmap");
+
     /* Get platform info */
     xenaccess->platform_info = malloc(sizeof(xc_platform_info_t));
     if ( xenaccess->platform_info == NULL )
diff -r b8c6f0af992a -r 13cddd7608bd tools/xenpaging/xenpaging.c
--- a/tools/xenpaging/xenpaging.c
+++ b/tools/xenpaging/xenpaging.c
@@ -420,6 +420,11 @@ static struct xenpaging *xenpaging_init(
                    (mem_event_sring_t *)paging->mem_event.ring_page,
                    PAGE_SIZE);
 
+    /* Now that the ring is set, remove it from the guest's physmap */
+    if ( xc_domain_decrease_reservation_exact(xch, 
+                    paging->mem_event.domain_id, 1, 0, &ring_pfn) )
+        PERROR("Failed to remove ring from guest physmap");
+
     /* Get max_pages from guest if not provided via cmdline */
     if ( !paging->max_pages )
     {

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel