|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v4 2/7] xen: xsm: flask: introduce XENMAPSPACE_gmfn_share for memory sharing
The existing XENMAPSPACE_gmfn_foreign subop of XENMEM_add_to_physmap forbids a Dom0 to map memory pages from one DomU to another, which restricts some useful yet not dangerous use cases -- such as sharing pages among DomU's so that they can do shm-based communication. This patch introduces XENMAPSPACE_gmfn_share to address this inconvenience, which is mostly the same as XENMAPSPACE_gmfn_foreign but has its own xsm check. Specifically, the patch: * Introduces a new av permission MMU__SHARE_MEM to denote if two domains can share memory by using the new subop; * Introduces xsm_map_gmfn_share() to check if (current) has proper permission over (t) AND MMU__SHARE_MEM is allowed between (d) and (t); * Modify the default xen.te to allow MMU__SHARE_MEM for normal domains that allow grant mapping/event channels. The new subop is marked unsupported for x86 because calling p2m_add_foregin on two DomU's is currently not supported on x86. This is for the proposal "Allow setting up shared memory areas between VMs from xl config file" (see [1]). [1] https://lists.xen.org/archives/html/xen-devel/2017-08/msg03242.html Signed-off-by: Zhongze Liu <blackskygg@xxxxxxxxx> Cc: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx> Cc: Ian Jackson <ian.jackson@xxxxxxxxxxxxx> Cc: Wei Liu <wei.liu2@xxxxxxxxxx> Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx> Cc: Julien Grall <julien.grall@xxxxxxx> Cc: xen-devel@xxxxxxxxxxxxx --- V3: * Change several if statements to the GCC '... = a ?: b' extention. * Lookup the current domain in the hooks instead of passing it as an arg. V4: * Eliminate the duplicated (c) over (d) check. * Added a new subop instead of modifying the old subop. --- tools/flask/policy/modules/xen.if | 2 ++ xen/arch/arm/mm.c | 8 +++++++- xen/arch/x86/mm.c | 4 ++++ xen/include/public/memory.h | 4 ++++ xen/include/xsm/dummy.h | 6 ++++++ xen/include/xsm/xsm.h | 6 ++++++ xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 7 +++++++ xen/xsm/flask/policy/access_vectors | 5 +++++ 9 files changed, 42 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index 459880bb01..f02d49114f 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -127,6 +127,8 @@ define(`domain_comms', ` domain_event_comms($1, $2) allow $1 $2:grant { map_read map_write copy unmap }; allow $2 $1:grant { map_read map_write copy unmap }; + allow $1 $2:mmu share_mem; + allow $2 $1:mmu share_mem; ') # domain_self_comms(domain) diff --git a/xen/arch/arm/mm.c b/xen/arch/arm/mm.c index 3c328e2df5..8e385d62a8 100644 --- a/xen/arch/arm/mm.c +++ b/xen/arch/arm/mm.c @@ -1251,6 +1251,7 @@ int xenmem_add_to_physmap_one( break; case XENMAPSPACE_gmfn_foreign: + case XENMAPSPACE_gmfn_share: { struct domain *od; p2m_type_t p2mt; @@ -1265,7 +1266,12 @@ int xenmem_add_to_physmap_one( return -EINVAL; } - rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); + if ( space == XENMAPSPACE_gmfn_foreign ) { + rc = xsm_map_gmfn_foreign(XSM_TARGET, d, od); + } else { + rc = xsm_map_gmfn_share(XSM_TARGET, d, od); + } + if ( rc ) { rcu_unlock_domain(od); diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index c732734ac1..684403f737 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -4126,6 +4126,10 @@ int xenmem_add_to_physmap_one( } case XENMAPSPACE_gmfn_foreign: return p2m_add_foreign(d, idx, gfn_x(gpfn), extra.foreign_domid); + case XENMAPSPACE_gmfn_share: + gdprintk(XENLOG_WARNING, + "XENMAPSPACE_gmfn_share is currently not supported on x86\n"); + break; default: break; } diff --git a/xen/include/public/memory.h b/xen/include/public/memory.h index 29386df98b..ce70788660 100644 --- a/xen/include/public/memory.h +++ b/xen/include/public/memory.h @@ -227,6 +227,10 @@ DEFINE_XEN_GUEST_HANDLE(xen_machphys_mapping_t); Stage-2 using the Normal Memory Inner/Outer Write-Back Cacheable memory attribute. */ +#define XENMAPSPACE_gmfn_share 6 /* Same as *_gmfn_foreign, but this is + for a privileged dom to share pages + between two doms. */ + /* ` } */ /* diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index d6ddadcafd..cda87dea12 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -521,6 +521,12 @@ static XSM_INLINE int xsm_map_gmfn_foreign(XSM_DEFAULT_ARG struct domain *d, str return xsm_default_action(action, d, t); } +static XSM_INLINE int xsm_map_gmfn_share(XSM_DEFAULT_ARG struct domain *d, struct domain *t) +{ + XSM_ASSERT_ACTION(XSM_TARGET); + return xsm_default_action(action, current->domain, t); +} + static XSM_INLINE int xsm_hvm_param(XSM_DEFAULT_ARG struct domain *d, unsigned long op) { XSM_ASSERT_ACTION(XSM_TARGET); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index e3912bcc9d..1305b16973 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -86,6 +86,7 @@ struct xsm_operations { int (*add_to_physmap) (struct domain *d1, struct domain *d2); int (*remove_from_physmap) (struct domain *d1, struct domain *d2); int (*map_gmfn_foreign) (struct domain *d, struct domain *t); + int (*map_gmfn_share) (struct domain *d, struct domain *t); int (*claim_pages) (struct domain *d); int (*console_io) (struct domain *d, int cmd); @@ -375,6 +376,11 @@ static inline int xsm_map_gmfn_foreign (xsm_default_t def, struct domain *d, str return xsm_ops->map_gmfn_foreign(d, t); } +static inline int xsm_map_gmfn_share (xsm_default_t def, struct domain *d, struct domain *t) +{ + return xsm_ops->map_gmfn_share(d, t); +} + static inline int xsm_claim_pages(xsm_default_t def, struct domain *d) { return xsm_ops->claim_pages(d); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 479b103614..3017dfc9a6 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -124,6 +124,7 @@ void __init xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, add_to_physmap); set_to_dummy_if_null(ops, remove_from_physmap); set_to_dummy_if_null(ops, map_gmfn_foreign); + set_to_dummy_if_null(ops, map_gmfn_share); set_to_dummy_if_null(ops, vm_event_control); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 1802d8dfe6..d4a8153301 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1196,6 +1196,12 @@ static int flask_map_gmfn_foreign(struct domain *d, struct domain *t) return domain_has_perm(d, t, SECCLASS_MMU, MMU__MAP_READ | MMU__MAP_WRITE); } +static int flask_map_gmfn_share(struct domain *d, struct domain *t) +{ + return current_has_perm(t, SECCLASS_MMU, MMU__MAP_READ | MMU__MAP_WRITE) ?: + domain_has_perm(d, t, SECCLASS_MMU, MMU__SHARE_MEM); +} + static int flask_hvm_param(struct domain *d, unsigned long op) { u32 perm; @@ -1815,6 +1821,7 @@ static struct xsm_operations flask_ops = { .add_to_physmap = flask_add_to_physmap, .remove_from_physmap = flask_remove_from_physmap, .map_gmfn_foreign = flask_map_gmfn_foreign, + .map_gmfn_share = flask_map_gmfn_share, #if defined(CONFIG_HAS_PASSTHROUGH) && defined(CONFIG_HAS_PCI) .get_device_group = flask_get_device_group, diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 89b99966bb..e249a68728 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -383,6 +383,11 @@ class mmu # Allow a privileged domain to install a map of a page it does not own. Used # for stub domain device models with the PV framebuffer. target_hack +# Checked when using XENMEM_add_to_physmap with XENMAPSPACE_gmfn_share +# to share memory between two domains: +# source = domain whose memory is being shared +# target = client domain + share_mem } # control of the paging_domctl split by subop -- 2.16.1 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxxxxxxxxx https://lists.xenproject.org/mailman/listinfo/xen-devel
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |