From: Roger Pau Monné <roger.pau@citrix.com>
Date: Fri, 23 Jan 2015 14:15:30 +0000 (+0100)
Subject: x86/pvh: check permissions when adding MMIO regions
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~3869
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks://%22/%22http:/www.example.com/cgi/%22https:/%22bookmarks:/%22?a=commitdiff_plain;h=631136c7db91b18a125549b52585fc8e133a6711;p=xen.git

x86/pvh: check permissions when adding MMIO regions

Check that MMIO regions added to PVH Dom0 are allowed. Previously a PVH Dom0
would have access to the full MMIO range.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---

diff --git a/xen/arch/x86/domain_build.c b/xen/arch/x86/domain_build.c
index 01cfa58746..2f9aaf95e6 100644
--- a/xen/arch/x86/domain_build.c
+++ b/xen/arch/x86/domain_build.c
@@ -320,11 +320,24 @@ static __init void pvh_add_mem_mapping(struct domain *d, unsigned long gfn,
 {
     unsigned long i;
     p2m_access_t a;
+    mfn_t omfn;
+    p2m_type_t t;
     int rc;
 
-    a = p2m_get_hostp2m(d)->default_access;
     for ( i = 0; i < nr_mfns; i++ )
     {
+        if ( !iomem_access_permitted(d, mfn + i, mfn + i) )
+        {
+            omfn = get_gfn_query_unlocked(d, gfn + i, &t);
+            guest_physmap_remove_page(d, gfn + i, mfn_x(omfn), PAGE_ORDER_4K);
+            continue;
+        }
+
+        if ( rangeset_contains_singleton(mmio_ro_ranges, mfn + i) )
+            a = p2m_access_rx;
+        else
+            a = p2m_access_rwx;
+
         if ( (rc = set_mmio_p2m_entry(d, gfn + i, _mfn(mfn + i), a)) )
             panic("pvh_add_mem_mapping: gfn:%lx mfn:%lx i:%ld rc:%d\n",
                   gfn, mfn, i, rc);