[XEN] Restrict access to grant-mapping operations.

TLB flushing is not done strictly before notifying
the mappee -- this creates scope for multi-processor
mapping guests to attempt to abuse a stale mapping
on another VCPU.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 3b6ad115485be01eac6a972071d9fe721395967b..552db91089e99553968a9ceb52a0e1d933da48a4 100644 (file)
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -24,6 +24,8 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#include <xen/config.h>
+#include <xen/iocap.h>
 #include <xen/lib.h>
 #include <xen/sched.h>
 #include <xen/shadow.h>
@@ -991,6 +993,9 @@ do_grant_table_op(
             guest_handle_cast(uop, gnttab_map_grant_ref_t);
         if ( unlikely(!guest_handle_okay(map, count)) )
             goto out;
+        rc = -EPERM;
+        if ( unlikely(!grant_flip_permitted(d)) )
+            goto out;
         rc = gnttab_map_grant_ref(map, count);
         break;
     }
@@ -1000,6 +1005,9 @@ do_grant_table_op(
             guest_handle_cast(uop, gnttab_unmap_grant_ref_t);
         if ( unlikely(!guest_handle_okay(unmap, count)) )
             goto out;
+        rc = -EPERM;
+        if ( unlikely(!grant_flip_permitted(d)) )
+            goto out;
         rc = gnttab_unmap_grant_ref(unmap, count);
         break;
     }
@@ -1015,6 +1023,9 @@ do_grant_table_op(
             guest_handle_cast(uop, gnttab_transfer_t);
         if ( unlikely(!guest_handle_okay(transfer, count)) )
             goto out;
+        rc = -EPERM;
+        if ( unlikely(!grant_flip_permitted(d)) )
+            goto out;
         rc = gnttab_transfer(transfer, count);
         break;
     }

diff --git a/xen/include/xen/iocap.h b/xen/include/xen/iocap.h
index db461b9dcb0fa97eb4c1478c83bd5472dbfbf45b..b3a5daec4541d4c721405960e5e37e26044c4dce 100644 (file)
--- a/xen/include/xen/iocap.h
+++ b/xen/include/xen/iocap.h
@@ -31,4 +31,12 @@
 #define multipage_allocation_permitted(d)               \
     (!rangeset_is_empty((d)->iomem_caps))
 
+/*
+ * Until TLB flushing issues are sorted out we consider it unsafe for
+ * domains with no hardware-access privileges to perform grant map/transfer
+ * operations.
+ */
+#define grant_operations_permitted(d)                   \
+    (!rangeset_is_empty((d)->iomem_caps))
+
 #endif /* __XEN_IOCAP_H__ */