From patchwork Thu Feb 9 14:17:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Durrant X-Patchwork-Id: 9564665 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5929360236 for ; Thu, 9 Feb 2017 14:20:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 18A27284B4 for ; Thu, 9 Feb 2017 14:20:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 0B96E284FA; Thu, 9 Feb 2017 14:20:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 7548B284B4 for ; Thu, 9 Feb 2017 14:20:03 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cbpXm-0006hU-ER; Thu, 09 Feb 2017 14:17:54 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cbpXl-0006gv-6u for xen-devel@lists.xenproject.org; Thu, 09 Feb 2017 14:17:53 +0000 Received: from [193.109.254.147] by server-1.bemta-6.messagelabs.com id EE/B0-27678-01A7C985; Thu, 09 Feb 2017 14:17:52 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnkeJIrShJLcpLzFFi42JxWrrBXlegak6 EwfoJjBbft0xmcmD0OPzhCksAYxRrZl5SfkUCa8b+bU3MBfusKx78L2tgPGbYxcjJISHgL3Hu zEkWEJtNQEdi6tNLrCC2iICLRP+2M2wgNrNAlcTpaZMZQWxhAUuJXRvvsIPYLAIqEveuLQKL8 wq4SSx4fYQJYqacxPnjP5lBbE4Bd4nvD26BzRQCqtn19QQ7hK0isX7qLDaIXkGJkzOfsEDskp A4+OIF8wRG3llIUrOQpBYwMq1iVC9OLSpLLdI10ksqykzPKMlNzMzRNTQw08tNLS5OTE/NSUw q1kvOz93ECAwcBiDYwbjsr9MhRkkOJiVRXtmCORFCfEn5KZUZicUZ8UWlOanFhxhlODiUJHiP VgDlBItS01Mr0jJzgCEMk5bg4FES4Y0BSfMWFyTmFmemQ6ROMepynLpx+iWTEEtefl6qlDjvI ZAiAZCijNI8uBGweLrEKCslzMsIdJQQT0FqUW5mCar8K0ZxDkYlYd51IFN4MvNK4Da9AjqCCe iI66dngRxRkoiQkmpglAyOWPttvvo7nSSGfHWvtyuYZi8wnxmqNs1UOnaxo9r+Lu/OnsnfPV8 2NW8o+Bqq/jh4/3Wp+XIrWLkWvXTYcXlpSMInAbki3yXzNOTyZ/wNKPFfbnaeYentkpRdNpMO XNrFWRV4/U/ru8fFvyf6WXHEruRJvDOZk8/4+b9UxTT27YGvG18yK7EUZyQaajEXFScCAJNFD gWiAgAA X-Env-Sender: prvs=206c1e2c2=Paul.Durrant@citrix.com X-Msg-Ref: server-14.tower-27.messagelabs.com!1486649869!73813703!2 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.1.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 50381 invoked from network); 9 Feb 2017 14:17:51 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-14.tower-27.messagelabs.com with RC4-SHA encrypted SMTP; 9 Feb 2017 14:17:51 -0000 X-IronPort-AV: E=Sophos;i="5.35,349,1484006400"; d="scan'208";a="414641201" From: Paul Durrant To: , Date: Thu, 9 Feb 2017 14:17:45 +0000 Message-ID: <1486649866-4869-3-git-send-email-paul.durrant@citrix.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1486649866-4869-1-git-send-email-paul.durrant@citrix.com> References: <1486649866-4869-1-git-send-email-paul.durrant@citrix.com> MIME-Version: 1.0 Cc: Juergen Gross , Boris Ostrovsky , Paul Durrant Subject: [Xen-devel] [PATCH 2/3] xen/privcmd: Add IOCTL_PRIVCMD_DM_OP X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Recently a new dm_op[1] hypercall was added to Xen to provide a mechanism for restricting device emulators (such as QEMU) to a limited set of hypervisor operations, and being able to audit those operations in the kernel of the domain in which they run. This patch adds IOCTL_PRIVCMD_DM_OP as gateway for __HYPERVISOR_dm_op, bouncing the callers buffers through kernel memory to allow the address ranges to be audited (and negating the need to bounce through locked memory in user-space). [1] http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=524a98c2 Signed-off-by: Paul Durrant --- Cc: Boris Ostrovsky Cc: Juergen Gross --- arch/x86/include/asm/xen/hypercall.h | 7 ++ drivers/xen/privcmd.c | 122 +++++++++++++++++++++++++++++++++++ include/uapi/xen/privcmd.h | 13 ++++ include/xen/interface/hvm/dm_op.h | 32 +++++++++ include/xen/interface/xen.h | 1 + 5 files changed, 175 insertions(+) create mode 100644 include/xen/interface/hvm/dm_op.h diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h index a12a047..f6d20f6 100644 --- a/arch/x86/include/asm/xen/hypercall.h +++ b/arch/x86/include/asm/xen/hypercall.h @@ -472,6 +472,13 @@ HYPERVISOR_xenpmu_op(unsigned int op, void *arg) return _hypercall2(int, xenpmu_op, op, arg); } +static inline int +HYPERVISOR_dm_op( + domid_t dom, unsigned int nr_bufs, void *bufs) +{ + return _hypercall3(int, dm_op, dom, nr_bufs, bufs); +} + static inline void MULTI_fpu_taskswitch(struct multicall_entry *mcl, int set) { diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index b4e5e27..31c43f4 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include #include @@ -548,6 +549,123 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version) goto out; } +static int bounce_in(struct privcmd_dm_op_buf kbufs[], void *kptr[], + unsigned int num) +{ + unsigned int i; + int rc = 0; + + for (i = 0; i < num; i++) { + kptr[i] = kzalloc(kbufs[i].size, GFP_KERNEL); + if (!kptr[i]) { + rc = -ENOMEM; + break; + } + + if (copy_from_user(kptr[i], kbufs[i].uptr, kbufs[i].size)) { + rc = -EFAULT; + break; + } + } + + return rc; +} + +static int bounce_out(struct privcmd_dm_op_buf kbufs[], void *kptr[], + unsigned int num) +{ + unsigned int i; + int rc = 0; + + for (i = 0; i < num; i++) + if (copy_to_user(kbufs[i].uptr, kptr[i], kbufs[i].size)) + rc = -EFAULT; + + return rc; +} + +static void free_kptr(void *kptr[], unsigned int num) +{ + unsigned int i; + + if (!kptr) + return; + + for (i = 0; i < num; i++) + kfree(kptr[i]); + + kfree(kptr); +} + +static long privcmd_ioctl_dm_op(void __user *udata) +{ + struct privcmd_dm_op kdata; + struct privcmd_dm_op_buf *kbufs; + void **kptr = NULL; + struct xen_dm_op_buf *xbufs = NULL; + unsigned int i; + long rc; + + if (copy_from_user(&kdata, udata, sizeof(kdata))) + return -EFAULT; + + if (kdata.num == 0) + return 0; + + /* + * Set a tolerable upper limit on the number of buffers + * without being overly restrictive, since we can't easily + * predict what future dm_ops may require. + */ + if (kdata.num * sizeof(*kbufs) > PAGE_SIZE) + return -EINVAL; + + kbufs = kcalloc(kdata.num, sizeof(*kbufs), GFP_KERNEL); + if (!kbufs) + return -ENOMEM; + + if (copy_from_user(kbufs, kdata.ubufs, + sizeof(*kbufs) * kdata.num)) { + rc = -EFAULT; + goto out; + } + + kptr = kcalloc(kdata.num, sizeof(*kptr), GFP_KERNEL); + if (!kptr) { + rc = -ENOMEM; + goto out; + } + + rc = bounce_in(kbufs, kptr, kdata.num); + if (rc) + goto out; + + xbufs = kcalloc(kdata.num, sizeof(*xbufs), GFP_KERNEL); + if (!xbufs) { + rc = -ENOMEM; + goto out; + } + + for (i = 0; i < kdata.num; i++) { + set_xen_guest_handle(xbufs[i].h, kptr[i]); + xbufs[i].size = kbufs[i].size; + } + + xen_preemptible_hcall_begin(); + rc = HYPERVISOR_dm_op(kdata.dom, kdata.num, xbufs); + xen_preemptible_hcall_end(); + + if (!rc) + rc = bounce_out(kbufs, kptr, kdata.num); + +out: + kfree(xbufs); + free_kptr(kptr, kdata.num); + kfree(kbufs); + + return rc; +} + static long privcmd_ioctl(struct file *file, unsigned int cmd, unsigned long data) { @@ -571,6 +689,10 @@ static long privcmd_ioctl(struct file *file, ret = privcmd_ioctl_mmap_batch(udata, 2); break; + case IOCTL_PRIVCMD_DM_OP: + ret = privcmd_ioctl_dm_op(udata); + break; + default: break; } diff --git a/include/uapi/xen/privcmd.h b/include/uapi/xen/privcmd.h index 7ddeeda..f8c5d75 100644 --- a/include/uapi/xen/privcmd.h +++ b/include/uapi/xen/privcmd.h @@ -77,6 +77,17 @@ struct privcmd_mmapbatch_v2 { int __user *err; /* array of error codes */ }; +struct privcmd_dm_op_buf { + void __user *uptr; + size_t size; +}; + +struct privcmd_dm_op { + domid_t dom; + __u16 num; + const struct privcmd_dm_op_buf __user *ubufs; +}; + /* * @cmd: IOCTL_PRIVCMD_HYPERCALL * @arg: &privcmd_hypercall_t @@ -98,5 +109,7 @@ struct privcmd_mmapbatch_v2 { _IOC(_IOC_NONE, 'P', 3, sizeof(struct privcmd_mmapbatch)) #define IOCTL_PRIVCMD_MMAPBATCH_V2 \ _IOC(_IOC_NONE, 'P', 4, sizeof(struct privcmd_mmapbatch_v2)) +#define IOCTL_PRIVCMD_DM_OP \ + _IOC(_IOC_NONE, 'P', 5, sizeof(struct privcmd_dm_op)) #endif /* __LINUX_PUBLIC_PRIVCMD_H__ */ diff --git a/include/xen/interface/hvm/dm_op.h b/include/xen/interface/hvm/dm_op.h new file mode 100644 index 0000000..ee9e480 --- /dev/null +++ b/include/xen/interface/hvm/dm_op.h @@ -0,0 +1,32 @@ +/* + * Copyright (c) 2016, Citrix Systems Inc + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to + * deal in the Software without restriction, including without limitation the + * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or + * sell copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + * DEALINGS IN THE SOFTWARE. + */ + +#ifndef __XEN_PUBLIC_HVM_DM_OP_H__ +#define __XEN_PUBLIC_HVM_DM_OP_H__ + +struct xen_dm_op_buf { + GUEST_HANDLE(void) h; + xen_ulong_t size; +}; +DEFINE_GUEST_HANDLE_STRUCT(xen_dm_op_buf); + +#endif /* __XEN_PUBLIC_HVM_DM_OP_H__ */ diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h index 1b0d189..4f4830e 100644 --- a/include/xen/interface/xen.h +++ b/include/xen/interface/xen.h @@ -81,6 +81,7 @@ #define __HYPERVISOR_tmem_op 38 #define __HYPERVISOR_xc_reserved_op 39 /* reserved for XenClient */ #define __HYPERVISOR_xenpmu_op 40 +#define __HYPERVISOR_dm_op 41 /* Architecture-specific hypercall definitions. */ #define __HYPERVISOR_arch_0 48