EVTCHNOP_alloc_unbound can allocate a port in an arbitrary

domain (only if the caller is sufficiently privileged).

Signed-off-by: Keir Fraser <keir@xensource.com>

diff --git a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
index 78222c92f5aa8309e2a6c2949b67c1b7cf1ddcc3..00caac5d95fe8f46f4b08eab4aff0bcb34a8f5a6 100644 (file)
--- a/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
+++ b/linux-2.6-xen-sparse/drivers/xen/blkfront/blkfront.c
@@ -485,7 +485,7 @@ static void watch_for_status(struct xenbus_watch *watch, const char *node)
 static int setup_blkring(struct xenbus_device *dev, struct blkfront_info *info)
 {
        blkif_sring_t *sring;
-       evtchn_op_t op = { .cmd = EVTCHNOP_alloc_unbound };
+       evtchn_op_t op;
        int err;
 
        info->ring_ref = GRANT_INVALID_REF;
@@ -508,7 +508,9 @@ static int setup_blkring(struct xenbus_device *dev, struct blkfront_info *info)
        }
        info->ring_ref = err;
 
-       op.u.alloc_unbound.dom = info->backend_id;
+       op.cmd = EVTCHNOP_alloc_unbound;
+       op.u.alloc_unbound.dom = DOMID_SELF;
+       op.u.alloc_unbound.remote_dom = info->backend_id;
        err = HYPERVISOR_event_channel_op(&op);
        if (err) {
                gnttab_end_foreign_access(info->ring_ref, 0);
@@ -518,7 +520,9 @@ static int setup_blkring(struct xenbus_device *dev, struct blkfront_info *info)
                xenbus_dev_error(dev, err, "allocating event channel");
                return err;
        }
+
        blkif_connect(info, op.u.alloc_unbound.port);
+
        return 0;
 }
 

diff --git a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
index 5a5dac453fcdb48fe56188737b855a1261491eca..7bd156625b4478c29f676f56923e8bf3f76b5a6b 100644 (file)
--- a/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
+++ b/linux-2.6-xen-sparse/drivers/xen/netfront/netfront.c
@@ -972,7 +972,7 @@ static void watch_for_status(struct xenbus_watch *watch, const char *node)
 
 static int setup_device(struct xenbus_device *dev, struct netfront_info *info)
 {
-       evtchn_op_t op = { .cmd = EVTCHNOP_alloc_unbound };
+       evtchn_op_t op;
        int err;
 
        info->tx_ring_ref = GRANT_INVALID_REF;
@@ -1010,13 +1010,17 @@ static int setup_device(struct xenbus_device *dev, struct netfront_info *info)
        }
        info->rx_ring_ref = err;
 
-       op.u.alloc_unbound.dom = info->backend_id;
+       op.cmd = EVTCHNOP_alloc_unbound;
+       op.u.alloc_unbound.dom = DOMID_SELF;
+       op.u.alloc_unbound.remote_dom = info->backend_id;
        err = HYPERVISOR_event_channel_op(&op);
        if (err) {
                xenbus_dev_error(dev, err, "allocating event channel");
                goto out;
        }
+
        connect_device(info, op.u.alloc_unbound.port);
+
        return 0;
 
  out:

diff --git a/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c b/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c
index 8fc6a4b5016f1e42500adbb73eb4433425325036..55c44f95aafb89ca8ee9d296471a4fe7aa7c018b 100644 (file)
--- a/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c
+++ b/linux-2.6-xen-sparse/drivers/xen/tpmfront/tpmfront.c
@@ -244,8 +244,7 @@ static int setup_tpmring(struct xenbus_device *dev,
 {
        tpmif_tx_interface_t *sring;
        struct tpm_private *tp = &my_private;
-
-       evtchn_op_t op = { .cmd = EVTCHNOP_alloc_unbound };
+       evtchn_op_t op;
        int err;
 
        sring = (void *)__get_free_page(GFP_KERNEL);
@@ -269,7 +268,9 @@ static int setup_tpmring(struct xenbus_device *dev,
        }
        info->ring_ref = err;
 
-       op.u.alloc_unbound.dom = backend_id;
+       op.cmd = EVTCHNOP_alloc_unbound;
+       op.u.alloc_unbound.dom = DOMID_SELF;
+       op.u.alloc_unbound.remote_dom = backend_id;
        err = HYPERVISOR_event_channel_op(&op);
        if (err) {
                gnttab_end_foreign_access(info->ring_ref, 0);
@@ -278,7 +279,9 @@ static int setup_tpmring(struct xenbus_device *dev,
                xenbus_dev_error(dev, err, "allocating event channel");
                return err;
        }
+
        tpmif_connect(op.u.alloc_unbound.port, backend_id);
+
        return 0;
 }
 

diff --git a/tools/libxc/xc_evtchn.c b/tools/libxc/xc_evtchn.c
index f7698d354187acc93dcc1a6e663fc55104d9f1a8..3bdacf36a34c59d33a3b9ca4d7829591b4955118 100644 (file)
--- a/tools/libxc/xc_evtchn.c
+++ b/tools/libxc/xc_evtchn.c
@@ -33,6 +33,7 @@ static int do_evtchn_op(int xc_handle, evtchn_op_t *op)
 
 
 int xc_evtchn_alloc_unbound(int xc_handle,
+                            u32 remote_dom,
                             u32 dom,
                             int *port)
 {
@@ -40,6 +41,7 @@ int xc_evtchn_alloc_unbound(int xc_handle,
     int         rc;
 
     op.cmd = EVTCHNOP_alloc_unbound;
+    op.u.alloc_unbound.remote_dom = (domid_t)remote_dom;
     op.u.alloc_unbound.dom  = (domid_t)dom;
     op.u.alloc_unbound.port = (port != NULL) ? *port : 0;
 

diff --git a/tools/libxc/xenctrl.h b/tools/libxc/xenctrl.h
index 2fe9bee750b3385f10d0871e9657cf19149f98c0..3e74c62fa0c5ab65c6246e5d1d49f0b6dede1505 100644 (file)
--- a/tools/libxc/xenctrl.h
+++ b/tools/libxc/xenctrl.h
@@ -306,13 +306,15 @@ typedef evtchn_status_t xc_evtchn_status_t;
  * well-known port within a domain to receive events on.
  *
  * @parm xc_handle a handle to an open hypervisor interface
- * @parm dom the ID of the domain.  This maybe DOMID_SELF
+ * @parm remote_dom the ID of the domain who will later bind
+ * @parm dom the ID of the local domain (the 'allocatee')
  * @parm port a pointer to a port.  This is an in/out parameter.  If *port is
  *            0, then a new port will be assigned, if port is > 0 then that
  *            port is allocated if the port is unallocated.
  * @return 0 on success, -1 on failure
  */
 int xc_evtchn_alloc_unbound(int xc_handle,
+                            u32 remote_dom,
                             u32 dom,
                             int *port);
 

diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
index d096b7bb96e88c3824fba6a47d916acfa867fc94..7ff5b40ca903409829f65d79216c05d6d289dd94 100644 (file)
--- a/tools/python/xen/lowlevel/xc/xc.c
+++ b/tools/python/xen/lowlevel/xc/xc.c
@@ -432,16 +432,16 @@ static PyObject *pyxc_evtchn_alloc_unbound(PyObject *self,
 {
     XcObject *xc = (XcObject *)self;
 
-    u32 dom;
+    u32 dom = DOMID_SELF, remote_dom;
     int port = 0;
 
-    static char *kwd_list[] = { "dom", "port", NULL };
+    static char *kwd_list[] = { "remote_dom", "dom", "port", NULL };
 
-    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "i|i", kwd_list,
-                                      &dom, &port) )
+    if ( !PyArg_ParseTupleAndKeywords(args, kwds, "i|ii", kwd_list,
+                                      &remote_dom, &dom, &port) )
         return NULL;
 
-    if ( xc_evtchn_alloc_unbound(xc->xc_handle, dom, &port) != 0 )
+    if ( xc_evtchn_alloc_unbound(xc->xc_handle, remote_dom, dom, &port) != 0 )
         return PyErr_SetFromErrno(xc_error);
 
     return PyInt_FromLong(port);

diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
index 8c413097ba16ac4ee51c11ae98f4cd9220b97f08..eea5ee16330777d48d6603e3073c14420cb462ec 100644 (file)
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -63,10 +63,19 @@ static int get_free_port(struct domain *d)
 static long evtchn_alloc_unbound(evtchn_alloc_unbound_t *alloc)
 {
     struct evtchn *chn;
-    struct domain *d = current->domain;
+    struct domain *d;
     int            port = alloc->port;
+    domid_t        dom = alloc->dom;
     long           rc = 0;
 
+    if ( dom == DOMID_SELF )
+        dom = current->domain->domain_id;
+    else if ( !IS_PRIV(current->domain) )
+        return -EPERM;
+
+    if ( (d = find_domain_by_id(dom)) == NULL )
+        return -ESRCH;
+
     spin_lock(&d->evtchn_lock);
 
     /* Obtain, or ensure that we already have, a valid <port>. */
@@ -84,11 +93,11 @@ static long evtchn_alloc_unbound(evtchn_alloc_unbound_t *alloc)
     {
     case ECS_FREE:
         chn->state = ECS_UNBOUND;
-        chn->u.unbound.remote_domid = alloc->dom;
+        chn->u.unbound.remote_domid = alloc->remote_dom;
         break;
 
     case ECS_UNBOUND:
-        if ( chn->u.unbound.remote_domid != alloc->dom )
+        if ( chn->u.unbound.remote_domid != alloc->remote_dom )
             ERROR_EXIT(-EINVAL);
         break;
 
@@ -99,7 +108,10 @@ static long evtchn_alloc_unbound(evtchn_alloc_unbound_t *alloc)
  out:
     spin_unlock(&d->evtchn_lock);
 
+    put_domain(d);
+
     alloc->port = port;
+
     return rc;
 }
 

diff --git a/xen/include/public/event_channel.h b/xen/include/public/event_channel.h
index 443be607f84efc7ea65c6a487ff3c142a0872d51..37efd85af37b55eba4dfa81e4cff466d7fc1d32d 100644 (file)
--- a/xen/include/public/event_channel.h
+++ b/xen/include/public/event_channel.h
@@ -10,14 +10,16 @@
 #define __XEN_PUBLIC_EVENT_CHANNEL_H__
 
 /*
- * EVTCHNOP_alloc_unbound: Prepare a local port for binding to <dom>.
- * <port> may be wildcarded by setting to zero, in which case a fresh port
- * will be allocated, and the field filled in on return.
+ * EVTCHNOP_alloc_unbound: Allocate a port in <dom> for later binding to
+ * <remote_dom>. <port> may be wildcarded by setting to zero, in which case a
+ * fresh port will be allocated, and the field filled in on return.
+ * NOTES:
+ *  1. If the caller is unprivileged then <dom> must be DOMID_SELF.
  */
 #define EVTCHNOP_alloc_unbound    6
 typedef struct evtchn_alloc_unbound {
     /* IN parameters */
-    domid_t dom;
+    domid_t dom, remote_dom;
     /* IN/OUT parameters */
     u32     port;
 } evtchn_alloc_unbound_t;