* [PATCH v3 0/3] xen/privcmd: support for dm_op and restriction
@ 2017-02-13 17:03 Paul Durrant
2017-02-13 17:03 ` [PATCH v3 1/3] xen/privcmd: return -ENOTTY for unimplemented IOCTLs Paul Durrant
` (2 more replies)
0 siblings, 3 replies; 14+ messages in thread
From: Paul Durrant @ 2017-02-13 17:03 UTC (permalink / raw)
To: xen-devel, linux-kernel; +Cc: Paul Durrant
This patch series follows on from my recent Xen series [1], to provide
support in privcmd for de-privileging of device emulators.
[1] https://lists.xen.org/archives/html/xen-devel/2017-01/msg02558.html
Paul Durrant (3):
xen/privcmd: return -ENOTTY for unimplemented IOCTLs
xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT
arch/arm/xen/enlighten.c | 1 +
arch/arm/xen/hypercall.S | 1 +
arch/arm64/xen/hypercall.S | 1 +
arch/x86/include/asm/xen/hypercall.h | 7 ++
drivers/xen/privcmd.c | 226 +++++++++++++++++++++++++++++++++--
include/uapi/xen/privcmd.h | 15 +++
include/xen/arm/hypercall.h | 1 +
include/xen/interface/hvm/dm_op.h | 32 +++++
include/xen/interface/xen.h | 1 +
9 files changed, 276 insertions(+), 9 deletions(-)
create mode 100644 include/xen/interface/hvm/dm_op.h
--
2.1.4
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH v3 1/3] xen/privcmd: return -ENOTTY for unimplemented IOCTLs
2017-02-13 17:03 [PATCH v3 0/3] xen/privcmd: support for dm_op and restriction Paul Durrant
@ 2017-02-13 17:03 ` Paul Durrant
2017-02-13 18:52 ` Boris Ostrovsky
2017-02-13 17:03 ` [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP Paul Durrant
2017-02-13 17:03 ` [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT Paul Durrant
2 siblings, 1 reply; 14+ messages in thread
From: Paul Durrant @ 2017-02-13 17:03 UTC (permalink / raw)
To: xen-devel, linux-kernel; +Cc: Paul Durrant, Boris Ostrovsky, Juergen Gross
The code sets the default return code to -ENOSYS but then overrides this
to -EINVAL in the switch() statement's default case, which is clearly
silly.
This patch removes the override and sets the default return code to
-ENOTTY, which is the conventional return for an unimplemented ioctl.
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
v2:
- Use -ENOTTY rather than -ENOSYS
---
drivers/xen/privcmd.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 6e3306f..5e5c7ae 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -551,7 +551,7 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
static long privcmd_ioctl(struct file *file,
unsigned int cmd, unsigned long data)
{
- int ret = -ENOSYS;
+ int ret = -ENOTTY;
void __user *udata = (void __user *) data;
switch (cmd) {
@@ -572,7 +572,6 @@ static long privcmd_ioctl(struct file *file,
break;
default:
- ret = -EINVAL;
break;
}
--
2.1.4
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-13 17:03 [PATCH v3 0/3] xen/privcmd: support for dm_op and restriction Paul Durrant
2017-02-13 17:03 ` [PATCH v3 1/3] xen/privcmd: return -ENOTTY for unimplemented IOCTLs Paul Durrant
@ 2017-02-13 17:03 ` Paul Durrant
2017-02-13 19:11 ` Boris Ostrovsky
` (2 more replies)
2017-02-13 17:03 ` [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT Paul Durrant
2 siblings, 3 replies; 14+ messages in thread
From: Paul Durrant @ 2017-02-13 17:03 UTC (permalink / raw)
To: xen-devel, linux-kernel; +Cc: Paul Durrant, Boris Ostrovsky, Juergen Gross
Recently a new dm_op[1] hypercall was added to Xen to provide a mechanism
for restricting device emulators (such as QEMU) to a limited set of
hypervisor operations, and being able to audit those operations in the
kernel of the domain in which they run.
This patch adds IOCTL_PRIVCMD_DM_OP as gateway for __HYPERVISOR_dm_op.
NOTE: There is no requirement for user-space code to bounce data through
locked memory buffers (as with IOCTL_PRIVCMD_HYPERCALL) since
privcmd has enough information to lock the original buffers
directly.
[1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=524a98c2
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
v3:
- Add module parameters for max number of dm_op buffers and max buffer
size
- Fix arm build
- Fix commit comment to reflect re-worked patch
v2:
- Lock the user pages rather than bouncing through kernel memory
---
arch/arm/xen/enlighten.c | 1 +
arch/arm/xen/hypercall.S | 1 +
arch/arm64/xen/hypercall.S | 1 +
arch/x86/include/asm/xen/hypercall.h | 7 ++
drivers/xen/privcmd.c | 139 +++++++++++++++++++++++++++++++++++
include/uapi/xen/privcmd.h | 13 ++++
include/xen/arm/hypercall.h | 1 +
include/xen/interface/hvm/dm_op.h | 32 ++++++++
include/xen/interface/xen.h | 1 +
9 files changed, 196 insertions(+)
create mode 100644 include/xen/interface/hvm/dm_op.h
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 11d9f28..81e3217 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -457,4 +457,5 @@ EXPORT_SYMBOL_GPL(HYPERVISOR_tmem_op);
EXPORT_SYMBOL_GPL(HYPERVISOR_platform_op);
EXPORT_SYMBOL_GPL(HYPERVISOR_multicall);
EXPORT_SYMBOL_GPL(HYPERVISOR_vm_assist);
+EXPORT_SYMBOL_GPL(HYPERVISOR_dm_op);
EXPORT_SYMBOL_GPL(privcmd_call);
diff --git a/arch/arm/xen/hypercall.S b/arch/arm/xen/hypercall.S
index a648dfc..b0b80c0 100644
--- a/arch/arm/xen/hypercall.S
+++ b/arch/arm/xen/hypercall.S
@@ -92,6 +92,7 @@ HYPERCALL1(tmem_op);
HYPERCALL1(platform_op_raw);
HYPERCALL2(multicall);
HYPERCALL2(vm_assist);
+HYPERCALL3(dm_op);
ENTRY(privcmd_call)
stmdb sp!, {r4}
diff --git a/arch/arm64/xen/hypercall.S b/arch/arm64/xen/hypercall.S
index 947830a..401ceb7 100644
--- a/arch/arm64/xen/hypercall.S
+++ b/arch/arm64/xen/hypercall.S
@@ -84,6 +84,7 @@ HYPERCALL1(tmem_op);
HYPERCALL1(platform_op_raw);
HYPERCALL2(multicall);
HYPERCALL2(vm_assist);
+HYPERCALL3(dm_op);
ENTRY(privcmd_call)
mov x16, x0
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index a12a047..f6d20f6 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -472,6 +472,13 @@ HYPERVISOR_xenpmu_op(unsigned int op, void *arg)
return _hypercall2(int, xenpmu_op, op, arg);
}
+static inline int
+HYPERVISOR_dm_op(
+ domid_t dom, unsigned int nr_bufs, void *bufs)
+{
+ return _hypercall3(int, dm_op, dom, nr_bufs, bufs);
+}
+
static inline void
MULTI_fpu_taskswitch(struct multicall_entry *mcl, int set)
{
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 5e5c7ae..a33f17e 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -22,6 +22,7 @@
#include <linux/pagemap.h>
#include <linux/seq_file.h>
#include <linux/miscdevice.h>
+#include <linux/moduleparam.h>
#include <asm/pgalloc.h>
#include <asm/pgtable.h>
@@ -32,6 +33,7 @@
#include <xen/xen.h>
#include <xen/privcmd.h>
#include <xen/interface/xen.h>
+#include <xen/interface/hvm/dm_op.h>
#include <xen/features.h>
#include <xen/page.h>
#include <xen/xen-ops.h>
@@ -43,6 +45,17 @@ MODULE_LICENSE("GPL");
#define PRIV_VMA_LOCKED ((void *)1)
+unsigned int privcmd_dm_op_max_num = 16;
+module_param_named(dm_op_max_nr_bufs, privcmd_dm_op_max_num, uint, 0644);
+MODULE_PARM_DESC(dm_op_max_nr_bufs,
+ "Maximum number of buffers per dm_op hypercall");
+
+unsigned int privcmd_dm_op_buf_max_size = XEN_PAGE_SIZE;
+module_param_named(dm_op_buf_max_size, privcmd_dm_op_buf_max_size, uint,
+ 0644);
+MODULE_PARM_DESC(dm_op_buf_max_size,
+ "Maximum size of a dm_op hypercall buffer");
+
static int privcmd_vma_range_is_mapped(
struct vm_area_struct *vma,
unsigned long addr,
@@ -548,6 +561,128 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
goto out;
}
+static int lock_pages(
+ struct privcmd_dm_op_buf kbufs[], unsigned int num,
+ struct page *pages[], unsigned int nr_pages)
+{
+ unsigned int i;
+
+ for (i = 0; i < num; i++) {
+ unsigned int requested;
+ int pinned;
+
+ requested = DIV_ROUND_UP(
+ offset_in_page(kbufs[i].uptr) + kbufs[i].size,
+ PAGE_SIZE);
+ if (requested > nr_pages)
+ return -ENOSPC;
+
+ pinned = get_user_pages_fast(
+ (unsigned long) kbufs[i].uptr,
+ requested, FOLL_WRITE, pages);
+ if (pinned < 0)
+ return pinned;
+
+ nr_pages -= pinned;
+ pages += pinned;
+ }
+
+ return 0;
+}
+
+static void unlock_pages(struct page *pages[], unsigned int nr_pages)
+{
+ unsigned int i;
+
+ if (!pages)
+ return;
+
+ for (i = 0; i < nr_pages; i++) {
+ if (pages[i])
+ put_page(pages[i]);
+ }
+}
+
+static long privcmd_ioctl_dm_op(void __user *udata)
+{
+ struct privcmd_dm_op kdata;
+ struct privcmd_dm_op_buf *kbufs;
+ unsigned int nr_pages = 0;
+ struct page **pages = NULL;
+ struct xen_dm_op_buf *xbufs = NULL;
+ unsigned int i;
+ long rc;
+
+ if (copy_from_user(&kdata, udata, sizeof(kdata)))
+ return -EFAULT;
+
+ if (kdata.num == 0)
+ return 0;
+
+ if (kdata.num > privcmd_dm_op_max_num)
+ return -E2BIG;
+
+ kbufs = kcalloc(kdata.num, sizeof(*kbufs), GFP_KERNEL);
+ if (!kbufs)
+ return -ENOMEM;
+
+ if (copy_from_user(kbufs, kdata.ubufs,
+ sizeof(*kbufs) * kdata.num)) {
+ rc = -EFAULT;
+ goto out;
+ }
+
+ for (i = 0; i < kdata.num; i++) {
+ if (kbufs[i].size > privcmd_dm_op_buf_max_size) {
+ rc = -E2BIG;
+ goto out;
+ }
+
+ if (!access_ok(VERIFY_WRITE, kbufs[i].uptr,
+ kbufs[i].size)) {
+ rc = -EFAULT;
+ goto out;
+ }
+
+ nr_pages += DIV_ROUND_UP(
+ offset_in_page(kbufs[i].uptr) + kbufs[i].size,
+ PAGE_SIZE);
+ }
+
+ pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
+ if (!pages) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ xbufs = kcalloc(kdata.num, sizeof(*xbufs), GFP_KERNEL);
+ if (!xbufs) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ rc = lock_pages(kbufs, kdata.num, pages, nr_pages);
+ if (rc)
+ goto out;
+
+ for (i = 0; i < kdata.num; i++) {
+ set_xen_guest_handle(xbufs[i].h, kbufs[i].uptr);
+ xbufs[i].size = kbufs[i].size;
+ }
+
+ xen_preemptible_hcall_begin();
+ rc = HYPERVISOR_dm_op(kdata.dom, kdata.num, xbufs);
+ xen_preemptible_hcall_end();
+
+out:
+ unlock_pages(pages, nr_pages);
+ kfree(xbufs);
+ kfree(pages);
+ kfree(kbufs);
+
+ return rc;
+}
+
static long privcmd_ioctl(struct file *file,
unsigned int cmd, unsigned long data)
{
@@ -571,6 +706,10 @@ static long privcmd_ioctl(struct file *file,
ret = privcmd_ioctl_mmap_batch(udata, 2);
break;
+ case IOCTL_PRIVCMD_DM_OP:
+ ret = privcmd_ioctl_dm_op(udata);
+ break;
+
default:
break;
}
diff --git a/include/uapi/xen/privcmd.h b/include/uapi/xen/privcmd.h
index 7ddeeda..f8c5d75 100644
--- a/include/uapi/xen/privcmd.h
+++ b/include/uapi/xen/privcmd.h
@@ -77,6 +77,17 @@ struct privcmd_mmapbatch_v2 {
int __user *err; /* array of error codes */
};
+struct privcmd_dm_op_buf {
+ void __user *uptr;
+ size_t size;
+};
+
+struct privcmd_dm_op {
+ domid_t dom;
+ __u16 num;
+ const struct privcmd_dm_op_buf __user *ubufs;
+};
+
/*
* @cmd: IOCTL_PRIVCMD_HYPERCALL
* @arg: &privcmd_hypercall_t
@@ -98,5 +109,7 @@ struct privcmd_mmapbatch_v2 {
_IOC(_IOC_NONE, 'P', 3, sizeof(struct privcmd_mmapbatch))
#define IOCTL_PRIVCMD_MMAPBATCH_V2 \
_IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2))
+#define IOCTL_PRIVCMD_DM_OP \
+ _IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_dm_op))
#endif /* __LINUX_PUBLIC_PRIVCMD_H__ */
diff --git a/include/xen/arm/hypercall.h b/include/xen/arm/hypercall.h
index 9d874db..73db4b2 100644
--- a/include/xen/arm/hypercall.h
+++ b/include/xen/arm/hypercall.h
@@ -53,6 +53,7 @@ int HYPERVISOR_physdev_op(int cmd, void *arg);
int HYPERVISOR_vcpu_op(int cmd, int vcpuid, void *extra_args);
int HYPERVISOR_tmem_op(void *arg);
int HYPERVISOR_vm_assist(unsigned int cmd, unsigned int type);
+int HYPERVISOR_dm_op(domid_t domid, unsigned int nr_bufs, void *bufs);
int HYPERVISOR_platform_op_raw(void *arg);
static inline int HYPERVISOR_platform_op(struct xen_platform_op *op)
{
diff --git a/include/xen/interface/hvm/dm_op.h b/include/xen/interface/hvm/dm_op.h
new file mode 100644
index 0000000..ee9e480
--- /dev/null
+++ b/include/xen/interface/hvm/dm_op.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2016, Citrix Systems Inc
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __XEN_PUBLIC_HVM_DM_OP_H__
+#define __XEN_PUBLIC_HVM_DM_OP_H__
+
+struct xen_dm_op_buf {
+ GUEST_HANDLE(void) h;
+ xen_ulong_t size;
+};
+DEFINE_GUEST_HANDLE_STRUCT(xen_dm_op_buf);
+
+#endif /* __XEN_PUBLIC_HVM_DM_OP_H__ */
diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h
index 1b0d189..4f4830e 100644
--- a/include/xen/interface/xen.h
+++ b/include/xen/interface/xen.h
@@ -81,6 +81,7 @@
#define __HYPERVISOR_tmem_op 38
#define __HYPERVISOR_xc_reserved_op 39 /* reserved for XenClient */
#define __HYPERVISOR_xenpmu_op 40
+#define __HYPERVISOR_dm_op 41
/* Architecture-specific hypercall definitions. */
#define __HYPERVISOR_arch_0 48
--
2.1.4
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT
2017-02-13 17:03 [PATCH v3 0/3] xen/privcmd: support for dm_op and restriction Paul Durrant
2017-02-13 17:03 ` [PATCH v3 1/3] xen/privcmd: return -ENOTTY for unimplemented IOCTLs Paul Durrant
2017-02-13 17:03 ` [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP Paul Durrant
@ 2017-02-13 17:03 ` Paul Durrant
2017-02-13 19:20 ` Boris Ostrovsky
2017-02-15 14:49 ` Boris Ostrovsky
2 siblings, 2 replies; 14+ messages in thread
From: Paul Durrant @ 2017-02-13 17:03 UTC (permalink / raw)
To: xen-devel, linux-kernel; +Cc: Paul Durrant, Boris Ostrovsky, Juergen Gross
The purpose if this ioctl is to allow a user of privcmd to restrict its
operation such that it will no longer service arbitrary hypercalls via
IOCTL_PRIVCMD_HYPERCALL, and will check for a matching domid when
servicing IOCTL_PRIVCMD_DM_OP. The aim of this is to limit the attack
surface for a compromised device model.
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
v3:
- Extend restriction to mapping ioctls
v2:
- Make sure that a restriction cannot be cleared
---
drivers/xen/privcmd.c | 88 +++++++++++++++++++++++++++++++++++++++++-----
include/uapi/xen/privcmd.h | 2 ++
2 files changed, 81 insertions(+), 9 deletions(-)
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index a33f17e..f50d984 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -56,16 +56,25 @@ module_param_named(dm_op_buf_max_size, privcmd_dm_op_buf_max_size, uint,
MODULE_PARM_DESC(dm_op_buf_max_size,
"Maximum size of a dm_op hypercall buffer");
+struct privcmd_data {
+ domid_t domid;
+};
+
static int privcmd_vma_range_is_mapped(
struct vm_area_struct *vma,
unsigned long addr,
unsigned long nr_pages);
-static long privcmd_ioctl_hypercall(void __user *udata)
+static long privcmd_ioctl_hypercall(struct file *file, void __user *udata)
{
+ struct privcmd_data *data = file->private_data;
struct privcmd_hypercall hypercall;
long ret;
+ /* Disallow arbitrary hypercalls if restricted */
+ if (data->domid != DOMID_INVALID)
+ return -EPERM;
+
if (copy_from_user(&hypercall, udata, sizeof(hypercall)))
return -EFAULT;
@@ -242,8 +251,9 @@ static int mmap_gfn_range(void *data, void *state)
return 0;
}
-static long privcmd_ioctl_mmap(void __user *udata)
+static long privcmd_ioctl_mmap(struct file *file, void __user *udata)
{
+ struct privcmd_data *data = file->private_data;
struct privcmd_mmap mmapcmd;
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
@@ -258,6 +268,10 @@ static long privcmd_ioctl_mmap(void __user *udata)
if (copy_from_user(&mmapcmd, udata, sizeof(mmapcmd)))
return -EFAULT;
+ /* If restriction is in place, check the domid matches */
+ if (data->domid != DOMID_INVALID && data->domid != mmapcmd.dom)
+ return -EPERM;
+
rc = gather_array(&pagelist,
mmapcmd.num, sizeof(struct privcmd_mmap_entry),
mmapcmd.entry);
@@ -429,8 +443,10 @@ static int alloc_empty_pages(struct vm_area_struct *vma, int numpgs)
static const struct vm_operations_struct privcmd_vm_ops;
-static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
+static long privcmd_ioctl_mmap_batch(
+ struct file *file, void __user *udata, int version)
{
+ struct privcmd_data *data = file->private_data;
int ret;
struct privcmd_mmapbatch_v2 m;
struct mm_struct *mm = current->mm;
@@ -459,6 +475,10 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
return -EINVAL;
}
+ /* If restriction is in place, check the domid matches */
+ if (data->domid != DOMID_INVALID && data->domid != m.dom)
+ return -EPERM;
+
nr_pages = DIV_ROUND_UP(m.num, XEN_PFN_PER_PAGE);
if ((m.num <= 0) || (nr_pages > (LONG_MAX >> PAGE_SHIFT)))
return -EINVAL;
@@ -603,8 +623,9 @@ static void unlock_pages(struct page *pages[], unsigned int nr_pages)
}
}
-static long privcmd_ioctl_dm_op(void __user *udata)
+static long privcmd_ioctl_dm_op(struct file *file, void __user *udata)
{
+ struct privcmd_data *data = file->private_data;
struct privcmd_dm_op kdata;
struct privcmd_dm_op_buf *kbufs;
unsigned int nr_pages = 0;
@@ -616,6 +637,10 @@ static long privcmd_ioctl_dm_op(void __user *udata)
if (copy_from_user(&kdata, udata, sizeof(kdata)))
return -EFAULT;
+ /* If restriction is in place, check the domid matches */
+ if (data->domid != DOMID_INVALID && data->domid != kdata.dom)
+ return -EPERM;
+
if (kdata.num == 0)
return 0;
@@ -683,6 +708,23 @@ static long privcmd_ioctl_dm_op(void __user *udata)
return rc;
}
+static long privcmd_ioctl_restrict(struct file *file, void __user *udata)
+{
+ struct privcmd_data *data = file->private_data;
+ domid_t dom;
+
+ if (copy_from_user(&dom, udata, sizeof(dom)))
+ return -EFAULT;
+
+ /* Set restriction to the specified domain, or check it matches */
+ if (data->domid == DOMID_INVALID)
+ data->domid = dom;
+ else if (data->domid != dom)
+ return -EINVAL;
+
+ return 0;
+}
+
static long privcmd_ioctl(struct file *file,
unsigned int cmd, unsigned long data)
{
@@ -691,23 +733,27 @@ static long privcmd_ioctl(struct file *file,
switch (cmd) {
case IOCTL_PRIVCMD_HYPERCALL:
- ret = privcmd_ioctl_hypercall(udata);
+ ret = privcmd_ioctl_hypercall(file, udata);
break;
case IOCTL_PRIVCMD_MMAP:
- ret = privcmd_ioctl_mmap(udata);
+ ret = privcmd_ioctl_mmap(file, udata);
break;
case IOCTL_PRIVCMD_MMAPBATCH:
- ret = privcmd_ioctl_mmap_batch(udata, 1);
+ ret = privcmd_ioctl_mmap_batch(file, udata, 1);
break;
case IOCTL_PRIVCMD_MMAPBATCH_V2:
- ret = privcmd_ioctl_mmap_batch(udata, 2);
+ ret = privcmd_ioctl_mmap_batch(file, udata, 2);
break;
case IOCTL_PRIVCMD_DM_OP:
- ret = privcmd_ioctl_dm_op(udata);
+ ret = privcmd_ioctl_dm_op(file, udata);
+ break;
+
+ case IOCTL_PRIVCMD_RESTRICT:
+ ret = privcmd_ioctl_restrict(file, udata);
break;
default:
@@ -717,6 +763,28 @@ static long privcmd_ioctl(struct file *file,
return ret;
}
+static int privcmd_open(struct inode *ino, struct file *file)
+{
+ struct privcmd_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
+
+ if (!data)
+ return -ENOMEM;
+
+ /* DOMID_INVALID implies no restriction */
+ data->domid = DOMID_INVALID;
+
+ file->private_data = data;
+ return 0;
+}
+
+static int privcmd_release(struct inode *ino, struct file *file)
+{
+ struct privcmd_data *data = file->private_data;
+
+ kfree(data);
+ return 0;
+}
+
static void privcmd_close(struct vm_area_struct *vma)
{
struct page **pages = vma->vm_private_data;
@@ -785,6 +853,8 @@ static int privcmd_vma_range_is_mapped(
const struct file_operations xen_privcmd_fops = {
.owner = THIS_MODULE,
.unlocked_ioctl = privcmd_ioctl,
+ .open = privcmd_open,
+ .release = privcmd_release,
.mmap = privcmd_mmap,
};
EXPORT_SYMBOL_GPL(xen_privcmd_fops);
diff --git a/include/uapi/xen/privcmd.h b/include/uapi/xen/privcmd.h
index f8c5d75..63ee95c 100644
--- a/include/uapi/xen/privcmd.h
+++ b/include/uapi/xen/privcmd.h
@@ -111,5 +111,7 @@ struct privcmd_dm_op {
_IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2))
#define IOCTL_PRIVCMD_DM_OP \
_IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_dm_op))
+#define IOCTL_PRIVCMD_RESTRICT \
+ _IOC(_IOC_NONE, 'P', 6, sizeof(domid_t))
#endif /* __LINUX_PUBLIC_PRIVCMD_H__ */
--
2.1.4
^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCH v3 1/3] xen/privcmd: return -ENOTTY for unimplemented IOCTLs
2017-02-13 17:03 ` [PATCH v3 1/3] xen/privcmd: return -ENOTTY for unimplemented IOCTLs Paul Durrant
@ 2017-02-13 18:52 ` Boris Ostrovsky
0 siblings, 0 replies; 14+ messages in thread
From: Boris Ostrovsky @ 2017-02-13 18:52 UTC (permalink / raw)
To: Paul Durrant, xen-devel, linux-kernel; +Cc: Juergen Gross
On 02/13/2017 12:03 PM, Paul Durrant wrote:
> The code sets the default return code to -ENOSYS but then overrides this
> to -EINVAL in the switch() statement's default case, which is clearly
> silly.
>
> This patch removes the override and sets the default return code to
> -ENOTTY, which is the conventional return for an unimplemented ioctl.
>
> Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Applied to for-linus-4.11.
-boris
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-13 17:03 ` [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP Paul Durrant
@ 2017-02-13 19:11 ` Boris Ostrovsky
2017-02-14 9:20 ` Paul Durrant
2017-02-14 17:25 ` Boris Ostrovsky
2017-02-15 14:47 ` Boris Ostrovsky
2 siblings, 1 reply; 14+ messages in thread
From: Boris Ostrovsky @ 2017-02-13 19:11 UTC (permalink / raw)
To: Paul Durrant, xen-devel, linux-kernel; +Cc: Juergen Gross
> diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
> index 5e5c7ae..a33f17e 100644
> --- a/drivers/xen/privcmd.c
> +++ b/drivers/xen/privcmd.c
> @@ -22,6 +22,7 @@
> #include <linux/pagemap.h>
> #include <linux/seq_file.h>
> #include <linux/miscdevice.h>
> +#include <linux/moduleparam.h>
>
> #include <asm/pgalloc.h>
> #include <asm/pgtable.h>
> @@ -32,6 +33,7 @@
> #include <xen/xen.h>
> #include <xen/privcmd.h>
> #include <xen/interface/xen.h>
> +#include <xen/interface/hvm/dm_op.h>
> #include <xen/features.h>
> #include <xen/page.h>
> #include <xen/xen-ops.h>
> @@ -43,6 +45,17 @@ MODULE_LICENSE("GPL");
>
> #define PRIV_VMA_LOCKED ((void *)1)
>
> +unsigned int privcmd_dm_op_max_num = 16;
> +module_param_named(dm_op_max_nr_bufs, privcmd_dm_op_max_num, uint, 0644);
> +MODULE_PARM_DESC(dm_op_max_nr_bufs,
> + "Maximum number of buffers per dm_op hypercall");
> +
> +unsigned int privcmd_dm_op_buf_max_size = XEN_PAGE_SIZE;
These need to be static. (I can fix it when committing.)
And I am still not sure about using XEN_PAGE_SIZE. There is no
dependency in the hypervisor on buffers being page-sized, is there? If
not, XEN_PAGE_SIZE is here just because it happens to be 4K, which is a
reasonable value.
How about just setting it to 4096?
-boris
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT
2017-02-13 17:03 ` [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT Paul Durrant
@ 2017-02-13 19:20 ` Boris Ostrovsky
2017-02-15 14:49 ` Boris Ostrovsky
1 sibling, 0 replies; 14+ messages in thread
From: Boris Ostrovsky @ 2017-02-13 19:20 UTC (permalink / raw)
To: Paul Durrant, xen-devel, linux-kernel; +Cc: Juergen Gross
On 02/13/2017 12:03 PM, Paul Durrant wrote:
> The purpose if this ioctl is to allow a user of privcmd to restrict its
> operation such that it will no longer service arbitrary hypercalls via
> IOCTL_PRIVCMD_HYPERCALL, and will check for a matching domid when
> servicing IOCTL_PRIVCMD_DM_OP.
and IOCTL_PRIVCMD_MMAP*.
> The aim of this is to limit the attack
> surface for a compromised device model.
-boris
^ permalink raw reply [flat|nested] 14+ messages in thread
* RE: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-13 19:11 ` Boris Ostrovsky
@ 2017-02-14 9:20 ` Paul Durrant
2017-02-14 14:11 ` Boris Ostrovsky
0 siblings, 1 reply; 14+ messages in thread
From: Paul Durrant @ 2017-02-14 9:20 UTC (permalink / raw)
To: 'Boris Ostrovsky', xen-devel, linux-kernel; +Cc: Juergen Gross
My previous reply got bounced because my tablet insisted on using HTML...
> -----Original Message-----
>
> These need to be static. (I can fix it when committing.)
Ok, thanks.
>
> And I am still not sure about using XEN_PAGE_SIZE. There is no
> dependency in the hypervisor on buffers being page-sized, is there? If
> not, XEN_PAGE_SIZE is here just because it happens to be 4K, which is a
> reasonable value.
>
> How about just setting it to 4096?
>
I chose XEN_PAGE_SIZE because the hypercall will eventually copy in the buffer so it seemed like a reasonable value to use. If you want to just use 4096 then I am ok with that.
Paul
PS: If you want to change from XEN_PAGE_SIZE to 4096 then I assume you are happy to do this at commit and don't need me to send a v4?
>
> -boris
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-14 9:20 ` Paul Durrant
@ 2017-02-14 14:11 ` Boris Ostrovsky
0 siblings, 0 replies; 14+ messages in thread
From: Boris Ostrovsky @ 2017-02-14 14:11 UTC (permalink / raw)
To: Paul Durrant, xen-devel, linux-kernel; +Cc: Juergen Gross
On 02/14/2017 04:20 AM, Paul Durrant wrote:
> My previous reply got bounced because my tablet insisted on using HTML...
>
>> -----Original Message-----
>>
>> These need to be static. (I can fix it when committing.)
>
> Ok, thanks.
>
>>
>> And I am still not sure about using XEN_PAGE_SIZE. There is no
>> dependency in the hypervisor on buffers being page-sized, is there? If
>> not, XEN_PAGE_SIZE is here just because it happens to be 4K, which is a
>> reasonable value.
>>
>> How about just setting it to 4096?
>>
>
> I chose XEN_PAGE_SIZE because the hypercall will eventually copy in the buffer so it seemed like a reasonable value to use. If you want to just use 4096 then I am ok with that.
>
> Paul
>
> PS: If you want to change from XEN_PAGE_SIZE to 4096 then I assume you are happy to do this at commit and don't need me to send a v4?
Right.
But I also had a question about patch 3 (commit message). I can make the
change when committing as well but I need to make sure you are OK with it.
-boris
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-13 17:03 ` [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP Paul Durrant
2017-02-13 19:11 ` Boris Ostrovsky
@ 2017-02-14 17:25 ` Boris Ostrovsky
2017-02-14 18:38 ` Stefano Stabellini
2017-02-15 14:47 ` Boris Ostrovsky
2 siblings, 1 reply; 14+ messages in thread
From: Boris Ostrovsky @ 2017-02-14 17:25 UTC (permalink / raw)
To: Paul Durrant, xen-devel, linux-kernel, Stefano Stabellini; +Cc: Juergen Gross
On 02/13/2017 12:03 PM, Paul Durrant wrote:
> Recently a new dm_op[1] hypercall was added to Xen to provide a mechanism
> for restricting device emulators (such as QEMU) to a limited set of
> hypervisor operations, and being able to audit those operations in the
> kernel of the domain in which they run.
>
> This patch adds IOCTL_PRIVCMD_DM_OP as gateway for __HYPERVISOR_dm_op.
>
> NOTE: There is no requirement for user-space code to bounce data through
> locked memory buffers (as with IOCTL_PRIVCMD_HYPERCALL) since
> privcmd has enough information to lock the original buffers
> directly.
>
> [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=524a98c2
>
> Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Stefano,
Are you OK with ARM changes?
-boris
> ---
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
>
> v3:
> - Add module parameters for max number of dm_op buffers and max buffer
> size
> - Fix arm build
> - Fix commit comment to reflect re-worked patch
>
> v2:
> - Lock the user pages rather than bouncing through kernel memory
> ---
> arch/arm/xen/enlighten.c | 1 +
> arch/arm/xen/hypercall.S | 1 +
> arch/arm64/xen/hypercall.S | 1 +
> arch/x86/include/asm/xen/hypercall.h | 7 ++
> drivers/xen/privcmd.c | 139 +++++++++++++++++++++++++++++++++++
> include/uapi/xen/privcmd.h | 13 ++++
> include/xen/arm/hypercall.h | 1 +
> include/xen/interface/hvm/dm_op.h | 32 ++++++++
> include/xen/interface/xen.h | 1 +
> 9 files changed, 196 insertions(+)
> create mode 100644 include/xen/interface/hvm/dm_op.h
>
> diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
> index 11d9f28..81e3217 100644
> --- a/arch/arm/xen/enlighten.c
> +++ b/arch/arm/xen/enlighten.c
> @@ -457,4 +457,5 @@ EXPORT_SYMBOL_GPL(HYPERVISOR_tmem_op);
> EXPORT_SYMBOL_GPL(HYPERVISOR_platform_op);
> EXPORT_SYMBOL_GPL(HYPERVISOR_multicall);
> EXPORT_SYMBOL_GPL(HYPERVISOR_vm_assist);
> +EXPORT_SYMBOL_GPL(HYPERVISOR_dm_op);
> EXPORT_SYMBOL_GPL(privcmd_call);
> diff --git a/arch/arm/xen/hypercall.S b/arch/arm/xen/hypercall.S
> index a648dfc..b0b80c0 100644
> --- a/arch/arm/xen/hypercall.S
> +++ b/arch/arm/xen/hypercall.S
> @@ -92,6 +92,7 @@ HYPERCALL1(tmem_op);
> HYPERCALL1(platform_op_raw);
> HYPERCALL2(multicall);
> HYPERCALL2(vm_assist);
> +HYPERCALL3(dm_op);
>
> ENTRY(privcmd_call)
> stmdb sp!, {r4}
> diff --git a/arch/arm64/xen/hypercall.S b/arch/arm64/xen/hypercall.S
> index 947830a..401ceb7 100644
> --- a/arch/arm64/xen/hypercall.S
> +++ b/arch/arm64/xen/hypercall.S
> @@ -84,6 +84,7 @@ HYPERCALL1(tmem_op);
> HYPERCALL1(platform_op_raw);
> HYPERCALL2(multicall);
> HYPERCALL2(vm_assist);
> +HYPERCALL3(dm_op);
>
> ENTRY(privcmd_call)
> mov x16, x0
> diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
> index a12a047..f6d20f6 100644
> --- a/arch/x86/include/asm/xen/hypercall.h
> +++ b/arch/x86/include/asm/xen/hypercall.h
> @@ -472,6 +472,13 @@ HYPERVISOR_xenpmu_op(unsigned int op, void *arg)
> return _hypercall2(int, xenpmu_op, op, arg);
> }
>
> +static inline int
> +HYPERVISOR_dm_op(
> + domid_t dom, unsigned int nr_bufs, void *bufs)
> +{
> + return _hypercall3(int, dm_op, dom, nr_bufs, bufs);
> +}
> +
> static inline void
> MULTI_fpu_taskswitch(struct multicall_entry *mcl, int set)
> {
> diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
> index 5e5c7ae..a33f17e 100644
> --- a/drivers/xen/privcmd.c
> +++ b/drivers/xen/privcmd.c
> @@ -22,6 +22,7 @@
> #include <linux/pagemap.h>
> #include <linux/seq_file.h>
> #include <linux/miscdevice.h>
> +#include <linux/moduleparam.h>
>
> #include <asm/pgalloc.h>
> #include <asm/pgtable.h>
> @@ -32,6 +33,7 @@
> #include <xen/xen.h>
> #include <xen/privcmd.h>
> #include <xen/interface/xen.h>
> +#include <xen/interface/hvm/dm_op.h>
> #include <xen/features.h>
> #include <xen/page.h>
> #include <xen/xen-ops.h>
> @@ -43,6 +45,17 @@ MODULE_LICENSE("GPL");
>
> #define PRIV_VMA_LOCKED ((void *)1)
>
> +unsigned int privcmd_dm_op_max_num = 16;
> +module_param_named(dm_op_max_nr_bufs, privcmd_dm_op_max_num, uint, 0644);
> +MODULE_PARM_DESC(dm_op_max_nr_bufs,
> + "Maximum number of buffers per dm_op hypercall");
> +
> +unsigned int privcmd_dm_op_buf_max_size = XEN_PAGE_SIZE;
> +module_param_named(dm_op_buf_max_size, privcmd_dm_op_buf_max_size, uint,
> + 0644);
> +MODULE_PARM_DESC(dm_op_buf_max_size,
> + "Maximum size of a dm_op hypercall buffer");
> +
> static int privcmd_vma_range_is_mapped(
> struct vm_area_struct *vma,
> unsigned long addr,
> @@ -548,6 +561,128 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
> goto out;
> }
>
> +static int lock_pages(
> + struct privcmd_dm_op_buf kbufs[], unsigned int num,
> + struct page *pages[], unsigned int nr_pages)
> +{
> + unsigned int i;
> +
> + for (i = 0; i < num; i++) {
> + unsigned int requested;
> + int pinned;
> +
> + requested = DIV_ROUND_UP(
> + offset_in_page(kbufs[i].uptr) + kbufs[i].size,
> + PAGE_SIZE);
> + if (requested > nr_pages)
> + return -ENOSPC;
> +
> + pinned = get_user_pages_fast(
> + (unsigned long) kbufs[i].uptr,
> + requested, FOLL_WRITE, pages);
> + if (pinned < 0)
> + return pinned;
> +
> + nr_pages -= pinned;
> + pages += pinned;
> + }
> +
> + return 0;
> +}
> +
> +static void unlock_pages(struct page *pages[], unsigned int nr_pages)
> +{
> + unsigned int i;
> +
> + if (!pages)
> + return;
> +
> + for (i = 0; i < nr_pages; i++) {
> + if (pages[i])
> + put_page(pages[i]);
> + }
> +}
> +
> +static long privcmd_ioctl_dm_op(void __user *udata)
> +{
> + struct privcmd_dm_op kdata;
> + struct privcmd_dm_op_buf *kbufs;
> + unsigned int nr_pages = 0;
> + struct page **pages = NULL;
> + struct xen_dm_op_buf *xbufs = NULL;
> + unsigned int i;
> + long rc;
> +
> + if (copy_from_user(&kdata, udata, sizeof(kdata)))
> + return -EFAULT;
> +
> + if (kdata.num == 0)
> + return 0;
> +
> + if (kdata.num > privcmd_dm_op_max_num)
> + return -E2BIG;
> +
> + kbufs = kcalloc(kdata.num, sizeof(*kbufs), GFP_KERNEL);
> + if (!kbufs)
> + return -ENOMEM;
> +
> + if (copy_from_user(kbufs, kdata.ubufs,
> + sizeof(*kbufs) * kdata.num)) {
> + rc = -EFAULT;
> + goto out;
> + }
> +
> + for (i = 0; i < kdata.num; i++) {
> + if (kbufs[i].size > privcmd_dm_op_buf_max_size) {
> + rc = -E2BIG;
> + goto out;
> + }
> +
> + if (!access_ok(VERIFY_WRITE, kbufs[i].uptr,
> + kbufs[i].size)) {
> + rc = -EFAULT;
> + goto out;
> + }
> +
> + nr_pages += DIV_ROUND_UP(
> + offset_in_page(kbufs[i].uptr) + kbufs[i].size,
> + PAGE_SIZE);
> + }
> +
> + pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
> + if (!pages) {
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + xbufs = kcalloc(kdata.num, sizeof(*xbufs), GFP_KERNEL);
> + if (!xbufs) {
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + rc = lock_pages(kbufs, kdata.num, pages, nr_pages);
> + if (rc)
> + goto out;
> +
> + for (i = 0; i < kdata.num; i++) {
> + set_xen_guest_handle(xbufs[i].h, kbufs[i].uptr);
> + xbufs[i].size = kbufs[i].size;
> + }
> +
> + xen_preemptible_hcall_begin();
> + rc = HYPERVISOR_dm_op(kdata.dom, kdata.num, xbufs);
> + xen_preemptible_hcall_end();
> +
> +out:
> + unlock_pages(pages, nr_pages);
> + kfree(xbufs);
> + kfree(pages);
> + kfree(kbufs);
> +
> + return rc;
> +}
> +
> static long privcmd_ioctl(struct file *file,
> unsigned int cmd, unsigned long data)
> {
> @@ -571,6 +706,10 @@ static long privcmd_ioctl(struct file *file,
> ret = privcmd_ioctl_mmap_batch(udata, 2);
> break;
>
> + case IOCTL_PRIVCMD_DM_OP:
> + ret = privcmd_ioctl_dm_op(udata);
> + break;
> +
> default:
> break;
> }
> diff --git a/include/uapi/xen/privcmd.h b/include/uapi/xen/privcmd.h
> index 7ddeeda..f8c5d75 100644
> --- a/include/uapi/xen/privcmd.h
> +++ b/include/uapi/xen/privcmd.h
> @@ -77,6 +77,17 @@ struct privcmd_mmapbatch_v2 {
> int __user *err; /* array of error codes */
> };
>
> +struct privcmd_dm_op_buf {
> + void __user *uptr;
> + size_t size;
> +};
> +
> +struct privcmd_dm_op {
> + domid_t dom;
> + __u16 num;
> + const struct privcmd_dm_op_buf __user *ubufs;
> +};
> +
> /*
> * @cmd: IOCTL_PRIVCMD_HYPERCALL
> * @arg: &privcmd_hypercall_t
> @@ -98,5 +109,7 @@ struct privcmd_mmapbatch_v2 {
> _IOC(_IOC_NONE, 'P', 3, sizeof(struct privcmd_mmapbatch))
> #define IOCTL_PRIVCMD_MMAPBATCH_V2 \
> _IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2))
> +#define IOCTL_PRIVCMD_DM_OP \
> + _IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_dm_op))
>
> #endif /* __LINUX_PUBLIC_PRIVCMD_H__ */
> diff --git a/include/xen/arm/hypercall.h b/include/xen/arm/hypercall.h
> index 9d874db..73db4b2 100644
> --- a/include/xen/arm/hypercall.h
> +++ b/include/xen/arm/hypercall.h
> @@ -53,6 +53,7 @@ int HYPERVISOR_physdev_op(int cmd, void *arg);
> int HYPERVISOR_vcpu_op(int cmd, int vcpuid, void *extra_args);
> int HYPERVISOR_tmem_op(void *arg);
> int HYPERVISOR_vm_assist(unsigned int cmd, unsigned int type);
> +int HYPERVISOR_dm_op(domid_t domid, unsigned int nr_bufs, void *bufs);
> int HYPERVISOR_platform_op_raw(void *arg);
> static inline int HYPERVISOR_platform_op(struct xen_platform_op *op)
> {
> diff --git a/include/xen/interface/hvm/dm_op.h b/include/xen/interface/hvm/dm_op.h
> new file mode 100644
> index 0000000..ee9e480
> --- /dev/null
> +++ b/include/xen/interface/hvm/dm_op.h
> @@ -0,0 +1,32 @@
> +/*
> + * Copyright (c) 2016, Citrix Systems Inc
> + *
> + * Permission is hereby granted, free of charge, to any person obtaining a copy
> + * of this software and associated documentation files (the "Software"), to
> + * deal in the Software without restriction, including without limitation the
> + * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
> + * sell copies of the Software, and to permit persons to whom the Software is
> + * furnished to do so, subject to the following conditions:
> + *
> + * The above copyright notice and this permission notice shall be included in
> + * all copies or substantial portions of the Software.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
> + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
> + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
> + * DEALINGS IN THE SOFTWARE.
> + */
> +
> +#ifndef __XEN_PUBLIC_HVM_DM_OP_H__
> +#define __XEN_PUBLIC_HVM_DM_OP_H__
> +
> +struct xen_dm_op_buf {
> + GUEST_HANDLE(void) h;
> + xen_ulong_t size;
> +};
> +DEFINE_GUEST_HANDLE_STRUCT(xen_dm_op_buf);
> +
> +#endif /* __XEN_PUBLIC_HVM_DM_OP_H__ */
> diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h
> index 1b0d189..4f4830e 100644
> --- a/include/xen/interface/xen.h
> +++ b/include/xen/interface/xen.h
> @@ -81,6 +81,7 @@
> #define __HYPERVISOR_tmem_op 38
> #define __HYPERVISOR_xc_reserved_op 39 /* reserved for XenClient */
> #define __HYPERVISOR_xenpmu_op 40
> +#define __HYPERVISOR_dm_op 41
>
> /* Architecture-specific hypercall definitions. */
> #define __HYPERVISOR_arch_0 48
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-14 17:25 ` Boris Ostrovsky
@ 2017-02-14 18:38 ` Stefano Stabellini
2017-02-15 9:14 ` Paul Durrant
0 siblings, 1 reply; 14+ messages in thread
From: Stefano Stabellini @ 2017-02-14 18:38 UTC (permalink / raw)
To: Boris Ostrovsky
Cc: Paul Durrant, xen-devel, linux-kernel, Stefano Stabellini, Juergen Gross
On Tue, 14 Feb 2017, Boris Ostrovsky wrote:
> On 02/13/2017 12:03 PM, Paul Durrant wrote:
> > Recently a new dm_op[1] hypercall was added to Xen to provide a mechanism
> > for restricting device emulators (such as QEMU) to a limited set of
> > hypervisor operations, and being able to audit those operations in the
> > kernel of the domain in which they run.
> >
> > This patch adds IOCTL_PRIVCMD_DM_OP as gateway for __HYPERVISOR_dm_op.
> >
> > NOTE: There is no requirement for user-space code to bounce data through
> > locked memory buffers (as with IOCTL_PRIVCMD_HYPERCALL) since
> > privcmd has enough information to lock the original buffers
> > directly.
> >
> > [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=524a98c2
> >
> > Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
>
>
> Stefano,
>
> Are you OK with ARM changes?
Yes:
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Thanks for CC'ing me, I missed the patch.
>
>
> > ---
> > Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> > Cc: Juergen Gross <jgross@suse.com>
> >
> > v3:
> > - Add module parameters for max number of dm_op buffers and max buffer
> > size
> > - Fix arm build
> > - Fix commit comment to reflect re-worked patch
> >
> > v2:
> > - Lock the user pages rather than bouncing through kernel memory
> > ---
> > arch/arm/xen/enlighten.c | 1 +
> > arch/arm/xen/hypercall.S | 1 +
> > arch/arm64/xen/hypercall.S | 1 +
> > arch/x86/include/asm/xen/hypercall.h | 7 ++
> > drivers/xen/privcmd.c | 139 +++++++++++++++++++++++++++++++++++
> > include/uapi/xen/privcmd.h | 13 ++++
> > include/xen/arm/hypercall.h | 1 +
> > include/xen/interface/hvm/dm_op.h | 32 ++++++++
> > include/xen/interface/xen.h | 1 +
> > 9 files changed, 196 insertions(+)
> > create mode 100644 include/xen/interface/hvm/dm_op.h
> >
> > diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
> > index 11d9f28..81e3217 100644
> > --- a/arch/arm/xen/enlighten.c
> > +++ b/arch/arm/xen/enlighten.c
> > @@ -457,4 +457,5 @@ EXPORT_SYMBOL_GPL(HYPERVISOR_tmem_op);
> > EXPORT_SYMBOL_GPL(HYPERVISOR_platform_op);
> > EXPORT_SYMBOL_GPL(HYPERVISOR_multicall);
> > EXPORT_SYMBOL_GPL(HYPERVISOR_vm_assist);
> > +EXPORT_SYMBOL_GPL(HYPERVISOR_dm_op);
> > EXPORT_SYMBOL_GPL(privcmd_call);
> > diff --git a/arch/arm/xen/hypercall.S b/arch/arm/xen/hypercall.S
> > index a648dfc..b0b80c0 100644
> > --- a/arch/arm/xen/hypercall.S
> > +++ b/arch/arm/xen/hypercall.S
> > @@ -92,6 +92,7 @@ HYPERCALL1(tmem_op);
> > HYPERCALL1(platform_op_raw);
> > HYPERCALL2(multicall);
> > HYPERCALL2(vm_assist);
> > +HYPERCALL3(dm_op);
> >
> > ENTRY(privcmd_call)
> > stmdb sp!, {r4}
> > diff --git a/arch/arm64/xen/hypercall.S b/arch/arm64/xen/hypercall.S
> > index 947830a..401ceb7 100644
> > --- a/arch/arm64/xen/hypercall.S
> > +++ b/arch/arm64/xen/hypercall.S
> > @@ -84,6 +84,7 @@ HYPERCALL1(tmem_op);
> > HYPERCALL1(platform_op_raw);
> > HYPERCALL2(multicall);
> > HYPERCALL2(vm_assist);
> > +HYPERCALL3(dm_op);
> >
> > ENTRY(privcmd_call)
> > mov x16, x0
> > diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
> > index a12a047..f6d20f6 100644
> > --- a/arch/x86/include/asm/xen/hypercall.h
> > +++ b/arch/x86/include/asm/xen/hypercall.h
> > @@ -472,6 +472,13 @@ HYPERVISOR_xenpmu_op(unsigned int op, void *arg)
> > return _hypercall2(int, xenpmu_op, op, arg);
> > }
> >
> > +static inline int
> > +HYPERVISOR_dm_op(
> > + domid_t dom, unsigned int nr_bufs, void *bufs)
> > +{
> > + return _hypercall3(int, dm_op, dom, nr_bufs, bufs);
> > +}
> > +
> > static inline void
> > MULTI_fpu_taskswitch(struct multicall_entry *mcl, int set)
> > {
> > diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
> > index 5e5c7ae..a33f17e 100644
> > --- a/drivers/xen/privcmd.c
> > +++ b/drivers/xen/privcmd.c
> > @@ -22,6 +22,7 @@
> > #include <linux/pagemap.h>
> > #include <linux/seq_file.h>
> > #include <linux/miscdevice.h>
> > +#include <linux/moduleparam.h>
> >
> > #include <asm/pgalloc.h>
> > #include <asm/pgtable.h>
> > @@ -32,6 +33,7 @@
> > #include <xen/xen.h>
> > #include <xen/privcmd.h>
> > #include <xen/interface/xen.h>
> > +#include <xen/interface/hvm/dm_op.h>
> > #include <xen/features.h>
> > #include <xen/page.h>
> > #include <xen/xen-ops.h>
> > @@ -43,6 +45,17 @@ MODULE_LICENSE("GPL");
> >
> > #define PRIV_VMA_LOCKED ((void *)1)
> >
> > +unsigned int privcmd_dm_op_max_num = 16;
> > +module_param_named(dm_op_max_nr_bufs, privcmd_dm_op_max_num, uint, 0644);
> > +MODULE_PARM_DESC(dm_op_max_nr_bufs,
> > + "Maximum number of buffers per dm_op hypercall");
> > +
> > +unsigned int privcmd_dm_op_buf_max_size = XEN_PAGE_SIZE;
> > +module_param_named(dm_op_buf_max_size, privcmd_dm_op_buf_max_size, uint,
> > + 0644);
> > +MODULE_PARM_DESC(dm_op_buf_max_size,
> > + "Maximum size of a dm_op hypercall buffer");
> > +
> > static int privcmd_vma_range_is_mapped(
> > struct vm_area_struct *vma,
> > unsigned long addr,
> > @@ -548,6 +561,128 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
> > goto out;
> > }
> >
> > +static int lock_pages(
> > + struct privcmd_dm_op_buf kbufs[], unsigned int num,
> > + struct page *pages[], unsigned int nr_pages)
> > +{
> > + unsigned int i;
> > +
> > + for (i = 0; i < num; i++) {
> > + unsigned int requested;
> > + int pinned;
> > +
> > + requested = DIV_ROUND_UP(
> > + offset_in_page(kbufs[i].uptr) + kbufs[i].size,
> > + PAGE_SIZE);
> > + if (requested > nr_pages)
> > + return -ENOSPC;
> > +
> > + pinned = get_user_pages_fast(
> > + (unsigned long) kbufs[i].uptr,
> > + requested, FOLL_WRITE, pages);
> > + if (pinned < 0)
> > + return pinned;
> > +
> > + nr_pages -= pinned;
> > + pages += pinned;
> > + }
> > +
> > + return 0;
> > +}
> > +
> > +static void unlock_pages(struct page *pages[], unsigned int nr_pages)
> > +{
> > + unsigned int i;
> > +
> > + if (!pages)
> > + return;
> > +
> > + for (i = 0; i < nr_pages; i++) {
> > + if (pages[i])
> > + put_page(pages[i]);
> > + }
> > +}
> > +
> > +static long privcmd_ioctl_dm_op(void __user *udata)
> > +{
> > + struct privcmd_dm_op kdata;
> > + struct privcmd_dm_op_buf *kbufs;
> > + unsigned int nr_pages = 0;
> > + struct page **pages = NULL;
> > + struct xen_dm_op_buf *xbufs = NULL;
> > + unsigned int i;
> > + long rc;
> > +
> > + if (copy_from_user(&kdata, udata, sizeof(kdata)))
> > + return -EFAULT;
> > +
> > + if (kdata.num == 0)
> > + return 0;
> > +
> > + if (kdata.num > privcmd_dm_op_max_num)
> > + return -E2BIG;
> > +
> > + kbufs = kcalloc(kdata.num, sizeof(*kbufs), GFP_KERNEL);
> > + if (!kbufs)
> > + return -ENOMEM;
> > +
> > + if (copy_from_user(kbufs, kdata.ubufs,
> > + sizeof(*kbufs) * kdata.num)) {
> > + rc = -EFAULT;
> > + goto out;
> > + }
> > +
> > + for (i = 0; i < kdata.num; i++) {
> > + if (kbufs[i].size > privcmd_dm_op_buf_max_size) {
> > + rc = -E2BIG;
> > + goto out;
> > + }
> > +
> > + if (!access_ok(VERIFY_WRITE, kbufs[i].uptr,
> > + kbufs[i].size)) {
> > + rc = -EFAULT;
> > + goto out;
> > + }
> > +
> > + nr_pages += DIV_ROUND_UP(
> > + offset_in_page(kbufs[i].uptr) + kbufs[i].size,
> > + PAGE_SIZE);
> > + }
> > +
> > + pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
> > + if (!pages) {
> > + rc = -ENOMEM;
> > + goto out;
> > + }
> > +
> > + xbufs = kcalloc(kdata.num, sizeof(*xbufs), GFP_KERNEL);
> > + if (!xbufs) {
> > + rc = -ENOMEM;
> > + goto out;
> > + }
> > +
> > + rc = lock_pages(kbufs, kdata.num, pages, nr_pages);
> > + if (rc)
> > + goto out;
> > +
> > + for (i = 0; i < kdata.num; i++) {
> > + set_xen_guest_handle(xbufs[i].h, kbufs[i].uptr);
> > + xbufs[i].size = kbufs[i].size;
> > + }
> > +
> > + xen_preemptible_hcall_begin();
> > + rc = HYPERVISOR_dm_op(kdata.dom, kdata.num, xbufs);
> > + xen_preemptible_hcall_end();
> > +
> > +out:
> > + unlock_pages(pages, nr_pages);
> > + kfree(xbufs);
> > + kfree(pages);
> > + kfree(kbufs);
> > +
> > + return rc;
> > +}
> > +
> > static long privcmd_ioctl(struct file *file,
> > unsigned int cmd, unsigned long data)
> > {
> > @@ -571,6 +706,10 @@ static long privcmd_ioctl(struct file *file,
> > ret = privcmd_ioctl_mmap_batch(udata, 2);
> > break;
> >
> > + case IOCTL_PRIVCMD_DM_OP:
> > + ret = privcmd_ioctl_dm_op(udata);
> > + break;
> > +
> > default:
> > break;
> > }
> > diff --git a/include/uapi/xen/privcmd.h b/include/uapi/xen/privcmd.h
> > index 7ddeeda..f8c5d75 100644
> > --- a/include/uapi/xen/privcmd.h
> > +++ b/include/uapi/xen/privcmd.h
> > @@ -77,6 +77,17 @@ struct privcmd_mmapbatch_v2 {
> > int __user *err; /* array of error codes */
> > };
> >
> > +struct privcmd_dm_op_buf {
> > + void __user *uptr;
> > + size_t size;
> > +};
> > +
> > +struct privcmd_dm_op {
> > + domid_t dom;
> > + __u16 num;
> > + const struct privcmd_dm_op_buf __user *ubufs;
> > +};
> > +
> > /*
> > * @cmd: IOCTL_PRIVCMD_HYPERCALL
> > * @arg: &privcmd_hypercall_t
> > @@ -98,5 +109,7 @@ struct privcmd_mmapbatch_v2 {
> > _IOC(_IOC_NONE, 'P', 3, sizeof(struct privcmd_mmapbatch))
> > #define IOCTL_PRIVCMD_MMAPBATCH_V2 \
> > _IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2))
> > +#define IOCTL_PRIVCMD_DM_OP \
> > + _IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_dm_op))
> >
> > #endif /* __LINUX_PUBLIC_PRIVCMD_H__ */
> > diff --git a/include/xen/arm/hypercall.h b/include/xen/arm/hypercall.h
> > index 9d874db..73db4b2 100644
> > --- a/include/xen/arm/hypercall.h
> > +++ b/include/xen/arm/hypercall.h
> > @@ -53,6 +53,7 @@ int HYPERVISOR_physdev_op(int cmd, void *arg);
> > int HYPERVISOR_vcpu_op(int cmd, int vcpuid, void *extra_args);
> > int HYPERVISOR_tmem_op(void *arg);
> > int HYPERVISOR_vm_assist(unsigned int cmd, unsigned int type);
> > +int HYPERVISOR_dm_op(domid_t domid, unsigned int nr_bufs, void *bufs);
> > int HYPERVISOR_platform_op_raw(void *arg);
> > static inline int HYPERVISOR_platform_op(struct xen_platform_op *op)
> > {
> > diff --git a/include/xen/interface/hvm/dm_op.h b/include/xen/interface/hvm/dm_op.h
> > new file mode 100644
> > index 0000000..ee9e480
> > --- /dev/null
> > +++ b/include/xen/interface/hvm/dm_op.h
> > @@ -0,0 +1,32 @@
> > +/*
> > + * Copyright (c) 2016, Citrix Systems Inc
> > + *
> > + * Permission is hereby granted, free of charge, to any person obtaining a copy
> > + * of this software and associated documentation files (the "Software"), to
> > + * deal in the Software without restriction, including without limitation the
> > + * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
> > + * sell copies of the Software, and to permit persons to whom the Software is
> > + * furnished to do so, subject to the following conditions:
> > + *
> > + * The above copyright notice and this permission notice shall be included in
> > + * all copies or substantial portions of the Software.
> > + *
> > + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> > + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> > + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
> > + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> > + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
> > + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
> > + * DEALINGS IN THE SOFTWARE.
> > + */
> > +
> > +#ifndef __XEN_PUBLIC_HVM_DM_OP_H__
> > +#define __XEN_PUBLIC_HVM_DM_OP_H__
> > +
> > +struct xen_dm_op_buf {
> > + GUEST_HANDLE(void) h;
> > + xen_ulong_t size;
> > +};
> > +DEFINE_GUEST_HANDLE_STRUCT(xen_dm_op_buf);
> > +
> > +#endif /* __XEN_PUBLIC_HVM_DM_OP_H__ */
> > diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h
> > index 1b0d189..4f4830e 100644
> > --- a/include/xen/interface/xen.h
> > +++ b/include/xen/interface/xen.h
> > @@ -81,6 +81,7 @@
> > #define __HYPERVISOR_tmem_op 38
> > #define __HYPERVISOR_xc_reserved_op 39 /* reserved for XenClient */
> > #define __HYPERVISOR_xenpmu_op 40
> > +#define __HYPERVISOR_dm_op 41
> >
> > /* Architecture-specific hypercall definitions. */
> > #define __HYPERVISOR_arch_0 48
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* RE: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-14 18:38 ` Stefano Stabellini
@ 2017-02-15 9:14 ` Paul Durrant
0 siblings, 0 replies; 14+ messages in thread
From: Paul Durrant @ 2017-02-15 9:14 UTC (permalink / raw)
To: 'Stefano Stabellini', Boris Ostrovsky
Cc: xen-devel, linux-kernel, Juergen Gross
> -----Original Message-----
> From: Stefano Stabellini [mailto:sstabellini@kernel.org]
> Sent: 14 February 2017 18:39
> To: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Paul Durrant <Paul.Durrant@citrix.com>; xen-devel@lists.xenproject.org;
> linux-kernel@vger.kernel.org; Stefano Stabellini <sstabellini@kernel.org>;
> Juergen Gross <jgross@suse.com>
> Subject: Re: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
>
> On Tue, 14 Feb 2017, Boris Ostrovsky wrote:
> > On 02/13/2017 12:03 PM, Paul Durrant wrote:
> > > Recently a new dm_op[1] hypercall was added to Xen to provide a
> mechanism
> > > for restricting device emulators (such as QEMU) to a limited set of
> > > hypervisor operations, and being able to audit those operations in the
> > > kernel of the domain in which they run.
> > >
> > > This patch adds IOCTL_PRIVCMD_DM_OP as gateway for
> __HYPERVISOR_dm_op.
> > >
> > > NOTE: There is no requirement for user-space code to bounce data
> through
> > > locked memory buffers (as with IOCTL_PRIVCMD_HYPERCALL) since
> > > privcmd has enough information to lock the original buffers
> > > directly.
> > >
> > > [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=524a98c2
> > >
> > > Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
> >
> >
> > Stefano,
> >
> > Are you OK with ARM changes?
>
> Yes:
>
> Acked-by: Stefano Stabellini <sstabellini@kernel.org>
>
> Thanks for CC'ing me, I missed the patch.
>
Sorry. My fault for nor re-running get-maintaner.pl after fixing up the ARM build.
Paul
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP
2017-02-13 17:03 ` [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP Paul Durrant
2017-02-13 19:11 ` Boris Ostrovsky
2017-02-14 17:25 ` Boris Ostrovsky
@ 2017-02-15 14:47 ` Boris Ostrovsky
2 siblings, 0 replies; 14+ messages in thread
From: Boris Ostrovsky @ 2017-02-15 14:47 UTC (permalink / raw)
To: Paul Durrant, xen-devel, linux-kernel; +Cc: Juergen Gross, Stefano Stabellini
On 02/13/2017 12:03 PM, Paul Durrant wrote:
> Recently a new dm_op[1] hypercall was added to Xen to provide a mechanism
> for restricting device emulators (such as QEMU) to a limited set of
> hypervisor operations, and being able to audit those operations in the
> kernel of the domain in which they run.
>
> This patch adds IOCTL_PRIVCMD_DM_OP as gateway for __HYPERVISOR_dm_op.
>
> NOTE: There is no requirement for user-space code to bounce data through
> locked memory buffers (as with IOCTL_PRIVCMD_HYPERCALL) since
> privcmd has enough information to lock the original buffers
> directly.
>
> [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=524a98c2
>
> Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Applied to for-linus-4.11 (with agreed upon adjustments)
-boris
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT
2017-02-13 17:03 ` [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT Paul Durrant
2017-02-13 19:20 ` Boris Ostrovsky
@ 2017-02-15 14:49 ` Boris Ostrovsky
1 sibling, 0 replies; 14+ messages in thread
From: Boris Ostrovsky @ 2017-02-15 14:49 UTC (permalink / raw)
To: Paul Durrant, xen-devel, linux-kernel; +Cc: Juergen Gross
On 02/13/2017 12:03 PM, Paul Durrant wrote:
> The purpose if this ioctl is to allow a user of privcmd to restrict its
> operation such that it will no longer service arbitrary hypercalls via
> IOCTL_PRIVCMD_HYPERCALL, and will check for a matching domid when
> servicing IOCTL_PRIVCMD_DM_OP. The aim of this is to limit the attack
> surface for a compromised device model.
>
> Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
Applied to for-linus-4.11 (with commit message adjustment)
-boris
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2017-02-15 14:48 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-13 17:03 [PATCH v3 0/3] xen/privcmd: support for dm_op and restriction Paul Durrant
2017-02-13 17:03 ` [PATCH v3 1/3] xen/privcmd: return -ENOTTY for unimplemented IOCTLs Paul Durrant
2017-02-13 18:52 ` Boris Ostrovsky
2017-02-13 17:03 ` [PATCH v3 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP Paul Durrant
2017-02-13 19:11 ` Boris Ostrovsky
2017-02-14 9:20 ` Paul Durrant
2017-02-14 14:11 ` Boris Ostrovsky
2017-02-14 17:25 ` Boris Ostrovsky
2017-02-14 18:38 ` Stefano Stabellini
2017-02-15 9:14 ` Paul Durrant
2017-02-15 14:47 ` Boris Ostrovsky
2017-02-13 17:03 ` [PATCH v3 3/3] xen/privcmd: add IOCTL_PRIVCMD_RESTRICT Paul Durrant
2017-02-13 19:20 ` Boris Ostrovsky
2017-02-15 14:49 ` Boris Ostrovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).