x86: cleanup after making various page table manipulation operations preemptible

This drops the "preemptible" parameters from various functions where
now they can't (or shouldn't, validated by assertions) be run in non-
preemptible mode anymore, to prove that manipulations of at least L3
and L4 page tables and page table entries are now always preemptible,
i.e. the earlier patches actually fulfill their purpose of fixing the
resulting security issue.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tim Deegan <tim@xen.org>
master commit: b965b31a6bce8c37e67e525fae6da0e2f26d6b2e
master date: 2013-05-02 17:04:14 +0200

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 9a3448867de0fc6fc6ff6be5445518d0f0d6121d..7b544b27e8b072138757ee565717456a6f0a810b 100644 (file)
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -1855,7 +1855,7 @@ static int relinquish_memory(
         }
 
         if ( test_and_clear_bit(_PGT_pinned, &page->u.inuse.type_info) )
-            ret = put_page_and_type_preemptible(page, 1);
+            ret = put_page_and_type_preemptible(page);
         switch ( ret )
         {
         case 0:

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index b7fc4cb6b1e7ea01d65eabaaf1f07ce94242afd1..29b0ede4b0316f12b7ef264bce3c7fd9809ee01c 100644 (file)
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -969,7 +969,7 @@ get_page_from_l2e(
 define_get_linear_pagetable(l3);
 static int
 get_page_from_l3e(
-    l3_pgentry_t l3e, unsigned long pfn, struct domain *d, int partial, int preemptible)
+    l3_pgentry_t l3e, unsigned long pfn, struct domain *d, int partial)
 {
     int rc;
 
@@ -983,7 +983,7 @@ get_page_from_l3e(
     }
 
     rc = get_page_and_type_from_pagenr(
-        l3e_get_pfn(l3e), PGT_l2_page_table, d, partial, preemptible);
+        l3e_get_pfn(l3e), PGT_l2_page_table, d, partial, 1);
     if ( unlikely(rc == -EINVAL) && get_l3_linear_pagetable(l3e, pfn, d) )
         rc = 0;
 
@@ -994,7 +994,7 @@ get_page_from_l3e(
 define_get_linear_pagetable(l4);
 static int
 get_page_from_l4e(
-    l4_pgentry_t l4e, unsigned long pfn, struct domain *d, int partial, int preemptible)
+    l4_pgentry_t l4e, unsigned long pfn, struct domain *d, int partial)
 {
     int rc;
 
@@ -1008,7 +1008,7 @@ get_page_from_l4e(
     }
 
     rc = get_page_and_type_from_pagenr(
-        l4e_get_pfn(l4e), PGT_l3_page_table, d, partial, preemptible);
+        l4e_get_pfn(l4e), PGT_l3_page_table, d, partial, 1);
     if ( unlikely(rc == -EINVAL) && get_l4_linear_pagetable(l4e, pfn, d) )
         rc = 0;
 
@@ -1162,8 +1162,10 @@ static int put_page_from_l2e(l2_pgentry_t l2e, unsigned long pfn)
 static int __put_page_type(struct page_info *, int preemptible);
 
 static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
-                             int partial, int preemptible)
+                             int partial, bool_t defer)
 {
+    struct page_info *pg;
+
     if ( !(l3e_get_flags(l3e) & _PAGE_PRESENT) || (l3e_get_pfn(l3e) == pfn) )
         return 1;
 
@@ -1182,41 +1184,45 @@ static int put_page_from_l3e(l3_pgentry_t l3e, unsigned long pfn,
     }
 #endif
 
+    pg = l3e_get_page(l3e);
+
     if ( unlikely(partial > 0) )
     {
-        ASSERT(preemptible >= 0);
-        return __put_page_type(l3e_get_page(l3e), preemptible);
+        ASSERT(!defer);
+        return __put_page_type(pg, 1);
     }
 
-    if ( preemptible < 0 )
+    if ( defer )
     {
-        current->arch.old_guest_table = l3e_get_page(l3e);
+        current->arch.old_guest_table = pg;
         return 0;
     }
 
-    return put_page_and_type_preemptible(l3e_get_page(l3e), preemptible);
+    return put_page_and_type_preemptible(pg);
 }
 
 #if CONFIG_PAGING_LEVELS >= 4
 static int put_page_from_l4e(l4_pgentry_t l4e, unsigned long pfn,
-                             int partial, int preemptible)
+                             int partial, bool_t defer)
 {
     if ( (l4e_get_flags(l4e) & _PAGE_PRESENT) && 
          (l4e_get_pfn(l4e) != pfn) )
     {
+        struct page_info *pg = l4e_get_page(l4e);
+
         if ( unlikely(partial > 0) )
         {
-            ASSERT(preemptible >= 0);
-            return __put_page_type(l4e_get_page(l4e), preemptible);
+            ASSERT(!defer);
+            return __put_page_type(pg, 1);
         }
 
-        if ( preemptible < 0 )
+        if ( defer )
         {
-            current->arch.old_guest_table = l4e_get_page(l4e);
+            current->arch.old_guest_table = pg;
             return 0;
         }
 
-        return put_page_and_type_preemptible(l4e_get_page(l4e), preemptible);
+        return put_page_and_type_preemptible(pg);
     }
     return 1;
 }
@@ -1429,7 +1435,7 @@ static int alloc_l2_table(struct page_info *page, unsigned long type,
     return rc > 0 ? 0 : rc;
 }
 
-static int alloc_l3_table(struct page_info *page, int preemptible)
+static int alloc_l3_table(struct page_info *page)
 {
     struct domain *d = page_get_owner(page);
     unsigned long  pfn = page_to_mfn(page);
@@ -1476,11 +1482,10 @@ static int alloc_l3_table(struct page_info *page, int preemptible)
                 rc = get_page_and_type_from_pagenr(l3e_get_pfn(pl3e[i]),
                                                    PGT_l2_page_table |
                                                    PGT_pae_xen_l2,
-                                                   d, partial, preemptible);
+                                                   d, partial, 1);
         }
         else if ( !is_guest_l3_slot(i) ||
-                  (rc = get_page_from_l3e(pl3e[i], pfn, d,
-                                          partial, preemptible)) > 0 )
+                  (rc = get_page_from_l3e(pl3e[i], pfn, d, partial)) > 0 )
             continue;
 
         if ( rc == -EAGAIN )
@@ -1524,7 +1529,7 @@ static int alloc_l3_table(struct page_info *page, int preemptible)
 }
 
 #if CONFIG_PAGING_LEVELS >= 4
-static int alloc_l4_table(struct page_info *page, int preemptible)
+static int alloc_l4_table(struct page_info *page)
 {
     struct domain *d = page_get_owner(page);
     unsigned long  pfn = page_to_mfn(page);
@@ -1536,8 +1541,7 @@ static int alloc_l4_table(struct page_info *page, int preemptible)
           i++, partial = 0 )
     {
         if ( !is_guest_l4_slot(d, i) ||
-             (rc = get_page_from_l4e(pl4e[i], pfn, d,
-                                     partial, preemptible)) > 0 )
+             (rc = get_page_from_l4e(pl4e[i], pfn, d, partial)) > 0 )
             continue;
 
         if ( rc == -EAGAIN )
@@ -1582,7 +1586,7 @@ static int alloc_l4_table(struct page_info *page, int preemptible)
     return rc > 0 ? 0 : rc;
 }
 #else
-#define alloc_l4_table(page, preemptible) (-EINVAL)
+#define alloc_l4_table(page) (-EINVAL)
 #endif
 
 
@@ -1634,7 +1638,7 @@ static int free_l2_table(struct page_info *page, int preemptible)
     return err;
 }
 
-static int free_l3_table(struct page_info *page, int preemptible)
+static int free_l3_table(struct page_info *page)
 {
     struct domain *d = page_get_owner(page);
     unsigned long pfn = page_to_mfn(page);
@@ -1647,7 +1651,7 @@ static int free_l3_table(struct page_info *page, int preemptible)
     do {
         if ( is_guest_l3_slot(i) )
         {
-            rc = put_page_from_l3e(pl3e[i], pfn, partial, preemptible);
+            rc = put_page_from_l3e(pl3e[i], pfn, partial, 0);
             if ( rc < 0 )
                 break;
             partial = 0;
@@ -1674,7 +1678,7 @@ static int free_l3_table(struct page_info *page, int preemptible)
 }
 
 #if CONFIG_PAGING_LEVELS >= 4
-static int free_l4_table(struct page_info *page, int preemptible)
+static int free_l4_table(struct page_info *page)
 {
     struct domain *d = page_get_owner(page);
     unsigned long pfn = page_to_mfn(page);
@@ -1684,7 +1688,7 @@ static int free_l4_table(struct page_info *page, int preemptible)
 
     do {
         if ( is_guest_l4_slot(d, i) )
-            rc = put_page_from_l4e(pl4e[i], pfn, partial, preemptible);
+            rc = put_page_from_l4e(pl4e[i], pfn, partial, 0);
         if ( rc < 0 )
             break;
         partial = 0;
@@ -1704,7 +1708,7 @@ static int free_l4_table(struct page_info *page, int preemptible)
     return rc > 0 ? 0 : rc;
 }
 #else
-#define free_l4_table(page, preemptible) (-EINVAL)
+#define free_l4_table(page) (-EINVAL)
 #endif
 
 static int page_lock(struct page_info *page)
@@ -1925,7 +1929,6 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
                         l3_pgentry_t nl3e, 
                         unsigned long pfn,
                         int preserve_ad,
-                        int preemptible,
                         struct vcpu *vcpu)
 {
     l3_pgentry_t ol3e;
@@ -1965,7 +1968,7 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
             return rc ? 0 : -EFAULT;
         }
 
-        rc = get_page_from_l3e(nl3e, pfn, d, 0, preemptible);
+        rc = get_page_from_l3e(nl3e, pfn, d, 0);
         if ( unlikely(rc < 0) )
             return rc;
         rc = 0;
@@ -1992,7 +1995,7 @@ static int mod_l3_entry(l3_pgentry_t *pl3e,
         pae_flush_pgd(pfn, pgentry_ptr_to_slot(pl3e), nl3e);
     }
 
-    put_page_from_l3e(ol3e, pfn, 0, -preemptible);
+    put_page_from_l3e(ol3e, pfn, 0, 1);
     return rc;
 }
 
@@ -2003,7 +2006,6 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
                         l4_pgentry_t nl4e, 
                         unsigned long pfn,
                         int preserve_ad,
-                        int preemptible,
                         struct vcpu *vcpu)
 {
     struct domain *d = vcpu->domain;
@@ -2036,7 +2038,7 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
             return rc ? 0 : -EFAULT;
         }
 
-        rc = get_page_from_l4e(nl4e, pfn, d, 0, preemptible);
+        rc = get_page_from_l4e(nl4e, pfn, d, 0);
         if ( unlikely(rc < 0) )
             return rc;
         rc = 0;
@@ -2055,7 +2057,7 @@ static int mod_l4_entry(l4_pgentry_t *pl4e,
         return -EFAULT;
     }
 
-    put_page_from_l4e(ol4e, pfn, 0, -preemptible);
+    put_page_from_l4e(ol4e, pfn, 0, 1);
     return rc;
 }
 
@@ -2177,10 +2179,12 @@ static int alloc_page_type(struct page_info *page, unsigned long type,
         rc = alloc_l2_table(page, type, preemptible);
         break;
     case PGT_l3_page_table:
-        rc = alloc_l3_table(page, preemptible);
+        ASSERT(preemptible);
+        rc = alloc_l3_table(page);
         break;
     case PGT_l4_page_table:
-        rc = alloc_l4_table(page, preemptible);
+        ASSERT(preemptible);
+        rc = alloc_l4_table(page);
         break;
     case PGT_seg_desc_page:
         rc = alloc_segdesc_page(page);
@@ -2274,10 +2278,12 @@ int free_page_type(struct page_info *page, unsigned long type,
         if ( !(type & PGT_partial) )
             page->nr_validated_ptes = L3_PAGETABLE_ENTRIES;
 #endif
-        rc = free_l3_table(page, preemptible);
+        ASSERT(preemptible);
+        rc = free_l3_table(page);
         break;
     case PGT_l4_page_table:
-        rc = free_l4_table(page, preemptible);
+        ASSERT(preemptible);
+        rc = free_l4_table(page);
         break;
     default:
         MEM_LOG("type %lx pfn %lx\n", type, page_to_mfn(page));
@@ -2766,7 +2772,7 @@ static int put_old_guest_table(struct vcpu *v)
     if ( !v->arch.old_guest_table )
         return 0;
 
-    switch ( rc = put_page_and_type_preemptible(v->arch.old_guest_table, 1) )
+    switch ( rc = put_page_and_type_preemptible(v->arch.old_guest_table) )
     {
     case -EINTR:
     case -EAGAIN:
@@ -2798,7 +2804,7 @@ int vcpu_destroy_pagetables(struct vcpu *v)
         if ( paging_mode_refcounts(v->domain) )
             put_page(page);
         else
-            rc = put_page_and_type_preemptible(page, 1);
+            rc = put_page_and_type_preemptible(page);
     }
 
 #ifdef __x86_64__
@@ -2824,7 +2830,7 @@ int vcpu_destroy_pagetables(struct vcpu *v)
             if ( paging_mode_refcounts(v->domain) )
                 put_page(page);
             else
-                rc = put_page_and_type_preemptible(page, 1);
+                rc = put_page_and_type_preemptible(page);
         }
         if ( !rc )
             v->arch.guest_table_user = pagetable_null();
@@ -2853,7 +2859,7 @@ int new_guest_cr3(unsigned long mfn)
                     l4e_from_pfn(
                         mfn,
                         (_PAGE_PRESENT|_PAGE_RW|_PAGE_USER|_PAGE_ACCESSED)),
-                    pagetable_get_pfn(curr->arch.guest_table), 0, 1, curr);
+                    pagetable_get_pfn(curr->arch.guest_table), 0, curr);
         switch ( rc )
         {
         case 0:
@@ -2916,7 +2922,7 @@ int new_guest_cr3(unsigned long mfn)
         if ( paging_mode_refcounts(d) )
             put_page(page);
         else
-            switch ( rc = put_page_and_type_preemptible(page, 1) )
+            switch ( rc = put_page_and_type_preemptible(page) )
             {
             case -EINTR:
                 rc = -EAGAIN;
@@ -3225,7 +3231,7 @@ long do_mmuext_op(
                 break;
             }
 
-            switch ( rc = put_page_and_type_preemptible(page, 1) )
+            switch ( rc = put_page_and_type_preemptible(page) )
             {
             case -EINTR:
             case -EAGAIN:
@@ -3291,7 +3297,7 @@ long do_mmuext_op(
                 if ( paging_mode_refcounts(d) )
                     put_page(page);
                 else
-                    switch ( rc = put_page_and_type_preemptible(page, 1) )
+                    switch ( rc = put_page_and_type_preemptible(page) )
                     {
                     case -EINTR:
                         rc = -EAGAIN;
@@ -3817,7 +3823,7 @@ long do_mmu_update(
                     }
 
                     rc = mod_l3_entry(va, l3e, mfn,
-                                      cmd == MMU_PT_UPDATE_PRESERVE_AD, 1, v);
+                                      cmd == MMU_PT_UPDATE_PRESERVE_AD, v);
                     okay = !rc;
                 }
                 break;
@@ -3849,7 +3855,7 @@ long do_mmu_update(
                     }
 
                     rc = mod_l4_entry(va, l4e, mfn,
-                                      cmd == MMU_PT_UPDATE_PRESERVE_AD, 1, v);
+                                      cmd == MMU_PT_UPDATE_PRESERVE_AD, v);
                     okay = !rc;
                 }
                 break;

diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
index ecf93c2b5c595cb35305aa4f672e3ecd0030a6a2..df7161a42621474131bebe692915b6a3b2cf5c36 100644 (file)
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -347,15 +347,10 @@ static inline void put_page_and_type(struct page_info *page)
     put_page(page);
 }
 
-static inline int put_page_and_type_preemptible(struct page_info *page,
-                                                int preemptible)
+static inline int put_page_and_type_preemptible(struct page_info *page)
 {
-    int rc = 0;
+    int rc = put_page_type_preemptible(page);
 
-    if ( preemptible )
-        rc = put_page_type_preemptible(page);
-    else
-        put_page_type(page);
     if ( likely(rc == 0) )
         put_page(page);
     return rc;