This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] [RESEND] Question about recursive mappings

To: xen-devel@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-devel] [RESEND] Question about recursive mappings
From: Mathieu Ropert <mro@xxxxxxxxxx>
Date: Mon, 22 May 2006 17:18:12 +0200
Delivery-date: Tue, 23 May 2006 02:14:48 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <4471814E.2070302@xxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <4471814E.2070302@xxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla Thunderbird 1.0.8 (X11/20060502)
Done some investingations in the mm code of Xen, i think the problem is that linear page tables entries are checked only on level 4 entries. In my case, my recursive entry is in a L3 table, already validated as another type, hence not "valid" for Xen. Will authorizing L3 or L2 recursive mappings induce a security hole or vulnerability? If not, I'll try to make a patch to address this issue (any hint welcome :)).


Mathieu Ropert wrote:

[Previous one didn't hit list after 3 days, trying a resend, sorry if both finally show up]


are recursive mappings (ie: a page table entry pointing back to itself)
supported by Xen (on x86_64 at least)?
I'm asking cause i'm seeing many error logs from get_page_type() telling
something like "saw L3_page_table expected L2_page_table" or "saw
L4_page_table expected L3_page_table" (finally leading to a failing mmu_update, i guess others happens on user pagetables switches).
Or maybe is there any workaround needed? (I think i saw something like
setting entry to 0 first then to the recursive entry somewhere, but
can't remember where).
By the way, i'm using recursive mappings in kernel page directory (which
seems ok) and i temporay make user page directory recursive when i map
a user PGD in kernel space (mapping user PGD to a L4 entry of kernel tables, then using kernel L4 slot and user PGD recursive entry to access user page tables).

Done some little research about the problem. Seems like NetBSD use the same thing and works, but there is no x86_64 ports for now. I'm starting to think that may be a x86_64 issue, maybe because recursive mappings don't lead to conflicting types with only 2 levels. Xen interface states that a page can only be of one type (PGD, PT, LDT, GDT and R/W). I don't know why there is a need to distinguish page table levels, but i'm afraid this restriction will conflit with some MMU implementation on x86_64 like NetBSD and OpenBSD, and maybe others (FreeBSD on top of my mind, don't know how much the pmap implementation diverged).



Xen-devel mailing list

Xen-devel mailing list