Re: [Xen-ia64-devel] PATCH: cleanup of tlbflush

[Isaku Yamahata <yamahata@xxxxxxxxxxxxx>]

On Thu, May 11, 2006 at 10:39:52AM +0800, Tian, Kevin wrote:

> >It will get an undesirable result or xen destroys it as a result.
> >The issue here is that trusting dom0 when unmapping granted pages
> >may affect a whole system or xen itself potentially.
> 
> Xen itself will not be affected. The granted frame or mapping virtual 
> address always belong to domain, instead of xen itself.

Xen can be affected potentially.
It is possible for a domain to return pages to xen
by XENMEM_decrease_reservation.
Please consider followings
1. domain A grants dom0 to map a page.
2. dom0 maps the page, accesses it and unmaps it lying virtual address.
3. xen flushes it but the virtual address is wrong.
   Here dom0 might be able to access the page.
4. domain A returns the page to xen by XENMEM_decrease_reservation.
5. Xen reuses the page for its own purpose.
6. dom0 overwrites the page via the true virtual address.
   Xen's data are destroyed.

Presumably at 4./5. xen can defer freeing the page.


> Dom0 can't destroy data of xen. If yes, that's a bug.
>
> Dom0 can destroy data of any other domain. No way to prevent that 
> by Xen.
> 
> So dom0 needs to be well cooperative with Xen to ensure a safe environment.

agreed.

-- 
yamahata

_______________________________________________
Xen-ia64-devel mailing list
Xen-ia64-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ia64-devel