2012-10-03 00:08:01 +02:00
|
|
|
# HG changeset patch
|
|
|
|
|
# User Daniel De Graaf <dgdegra@tycho.nsa.gov>
|
|
|
|
|
# Date 1348653367 -7200
|
|
|
|
|
# Node ID 8278d7d8fa485996f51134c5265fceaf239adf6a
|
|
|
|
|
# Parent b83f414ccf7a6e4e077a10bc422cf3f6c7d30566
|
|
|
|
|
x86: check remote MMIO remap permissions
|
|
|
|
|
|
|
|
|
|
When a domain is mapping pages from a different pg_owner domain, the
|
|
|
|
|
iomem_access checks are currently only applied to the pg_owner domain,
|
|
|
|
|
potentially allowing a domain with a more restrictive iomem_access
|
|
|
|
|
policy to have the pages mapped into its page tables. To catch this,
|
|
|
|
|
also check the owner of the page tables. The current domain does not
|
|
|
|
|
need to be checked because the ability to manipulate a domain's page
|
|
|
|
|
tables implies full access to the target domain, so checking that
|
|
|
|
|
domain's permission is sufficient.
|
|
|
|
|
|
|
|
|
|
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
|
|
|
|
|
Committed-by: Jan Beulich <jbeulich@suse.com>
|
|
|
|
|
|
2013-01-14 18:52:04 +01:00
|
|
|
Index: xen-4.2.0-testing/xen/arch/x86/mm.c
|
|
|
|
|
===================================================================
|
|
|
|
|
--- xen-4.2.0-testing.orig/xen/arch/x86/mm.c
|
|
|
|
|
+++ xen-4.2.0-testing/xen/arch/x86/mm.c
|
|
|
|
|
@@ -883,6 +883,19 @@ get_page_from_l1e(
|
2012-10-03 00:08:01 +02:00
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
+ if ( pg_owner != l1e_owner &&
|
|
|
|
|
+ !iomem_access_permitted(l1e_owner, mfn, mfn) )
|
|
|
|
|
+ {
|
|
|
|
|
+ if ( mfn != (PADDR_MASK >> PAGE_SHIFT) ) /* INVALID_MFN? */
|
|
|
|
|
+ {
|
|
|
|
|
+ MEM_LOG("Dom%u attempted to map I/O space %08lx in dom%u to dom%u",
|
|
|
|
|
+ curr->domain->domain_id, mfn, pg_owner->domain_id,
|
|
|
|
|
+ l1e_owner->domain_id);
|
|
|
|
|
+ return -EPERM;
|
|
|
|
|
+ }
|
|
|
|
|
+ return -EINVAL;
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
|
|
if ( !(l1f & _PAGE_RW) ||
|
|
|
|
|
!rangeset_contains_singleton(mmio_ro_ranges, mfn) )
|
|
|
|
|
return 0;
|
