Re: [Xen-devel] Mapping active GDT

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 11/03/2017 03:58, Boris Ostrovsky wrote:
> On 03/10/2017 09:39 PM, Boris Ostrovsky wrote:
>> I am looking into GDT remap series [0] which crashes PV guests and it
>> seems that the problem lies in the fact that we cannot establish new
>> mapping to an already existing GDT.
>>
>> The mapping is created by
>>
>> +static inline void setup_fixmap_gdt(int cpu)
>> +{
>> +       __set_fixmap(get_cpu_gdt_ro_index(cpu),
>> +                    __pa(get_cpu_gdt_rw(cpu)), PAGE_KERNEL);
>> +}
>>
>> with get_cpu_gdt_rw(cpu) being the current GDT pointer. This results in
>>
>> (XEN) mm.c:2570:d94v0 Bad type (saw 5400000000000001 != exp
>> 7000000000000000) for mfn 1538fb (pfn 3e809)
>> (XEN) mm.c:1022:d94v0 Could not get page type PGT_writable_page
>> (XEN) mm.c:1074:d94v0 Error getting mfn 1538fb (pfn 3e809) from L1 entry
>> 80000001538fb063 for l1e_owner=94, pg_owner=94

The problem here is that you are trying to create a writeable mapping to
the GDT frame.

Allowing the guest writeable access would be a security hole, as it is
trivial to escalate privilege under those circumstances.

~Andrew

>>
>> (after a small change to xen_set_fixmap(), which I think was missing)
>>
>> Before I try to come up with a fix I wanted to check here to see if this
>> (not being able to map active GDT) is indeed the case.
> Uhm.. Nevermind. The change in xen_set_fixmap() is probably sufficient.
>
> I was working with wrong branch ;-( Sorry for the noise.
>
> -boris
>
>> -boris
>>
>>
>> [0]
>> https://lists.xenproject.org/archives/html/xen-devel/2017-03/msg00869.html
>>
>>
>> _______________________________________________
>> Xen-devel mailing list
>> Xen-devel@xxxxxxxxxxxxx
>> https://lists.xen.org/xen-devel


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel