[PATCH 2/6] xen/gnttab: Disallow GNTTABOP_cache_flush from non-direct-mapped domains

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

cache_flush() opereates on maddr_to_mfn(cflush->a.dev_bus_addr), which is an
address space layering violation.

Restrict the hypercall to direct-mapped domains.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Stefano Stabellini <sstabellini@xxxxxxxxxx>
CC: Julien Grall <julien@xxxxxxx>
CC: Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
CC: Bertrand Marquis <bertrand.marquis@xxxxxxx>
CC: Michal Orzel <michal.orzel@xxxxxxx>
CC: Jan Beulich <jbeulich@xxxxxxxx>
CC: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
CC: Teddy Astie <teddy.astie@xxxxxxxxxx>

It also malfunctions when an SMMU is using non-identity mappings.

Linux never checks for errors, which hides all the ways in which this
hypercall is broken.
---
 xen/common/grant_table.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 2285c4aee8d6..d42bd5fb83fd 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3704,6 +3704,9 @@ 
gnttab_cache_flush(XEN_GUEST_HANDLE_PARAM(gnttab_cache_flush_t) uop,
     unsigned int i;
     gnttab_cache_flush_t op;
 
+    if ( !is_domain_direct_mapped(current->domain) )
+        return -EOPNOTSUPP;
+
     for ( i = 0; i < count; i++ )
     {
         if ( i && hypercall_preempt_check() )
-- 
2.39.5