xsm: XSM foreigndom usage bug

- This patch corrects an unsafe/incorrect usage of FOREIGNDOM.  The
value of FOREIGNDOM is now passed through the XSM interface.
Corresponding updates to the Flask module are included in this patch.

- This patch also includes a minor header update to allow the Flask
  module to compile after recent updates to Xen.

Signed-off-by: George Coker <gscoker@alpha.ncsc.mil>

diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c
index c5d38b3852881b758c98f7b4b23cbadf43c9faa9..b198355f0f0d418463f7000a67d23503099f3d87 100644 (file)
--- a/xen/arch/x86/mm.c
+++ b/xen/arch/x86/mm.c
@@ -2804,7 +2804,7 @@ int do_mmu_update(
              */
         case MMU_NORMAL_PT_UPDATE:
         case MMU_PT_UPDATE_PRESERVE_AD:
-            rc = xsm_mmu_normal_update(d, req.val);
+            rc = xsm_mmu_normal_update(d, FOREIGNDOM, req.val);
             if ( rc )
                 break;
 
@@ -3321,7 +3321,7 @@ int do_update_va_mapping(unsigned long va, u64 val64,
     if ( unlikely(!access_ok(va, 1) && !paging_mode_external(d)) )
         return -EINVAL;
 
-    rc = xsm_update_va_mapping(d, val);
+    rc = xsm_update_va_mapping(d, FOREIGNDOM, val);
     if ( rc )
         return rc;
 

diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index fdeb2138e50b61ae01f03a4b420226e16e2c025d..2f54b22626547dff2cf87c009f89223fdbbfdcce 100644 (file)
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -137,9 +137,11 @@ struct xsm_operations {
     int (*getidletime) (void);
     int (*machine_memory_map) (void);
     int (*domain_memory_map) (struct domain *d);
-    int (*mmu_normal_update) (struct domain *d, intpte_t fpte);
+    int (*mmu_normal_update) (struct domain *d, struct domain *f, 
+                                                                intpte_t fpte);
     int (*mmu_machphys_update) (struct domain *d, unsigned long mfn);
-    int (*update_va_mapping) (struct domain *d, l1_pgentry_t pte);
+    int (*update_va_mapping) (struct domain *d, struct domain *f, 
+                                                            l1_pgentry_t pte);
     int (*add_to_physmap) (struct domain *d1, struct domain *d2);
     int (*remove_from_physmap) (struct domain *d1, struct domain *d2);
     int (*sendtrigger) (struct domain *d);
@@ -560,9 +562,10 @@ static inline int xsm_domain_memory_map(struct domain *d)
     return xsm_call(domain_memory_map(d));
 }
 
-static inline int xsm_mmu_normal_update (struct domain *d, intpte_t fpte)
+static inline int xsm_mmu_normal_update (struct domain *d, struct domain *f, 
+                                                                intpte_t fpte)
 {
-    return xsm_call(mmu_normal_update(d, fpte));
+    return xsm_call(mmu_normal_update(d, f, fpte));
 }
 
 static inline int xsm_mmu_machphys_update (struct domain *d, unsigned long mfn)
@@ -570,9 +573,10 @@ static inline int xsm_mmu_machphys_update (struct domain *d, unsigned long mfn)
     return xsm_call(mmu_machphys_update(d, mfn));
 }
 
-static inline int xsm_update_va_mapping(struct domain *d, l1_pgentry_t pte)
+static inline int xsm_update_va_mapping(struct domain *d, struct domain *f, 
+                                                            l1_pgentry_t pte)
 {
-    return xsm_call(update_va_mapping(d, pte));
+    return xsm_call(update_va_mapping(d, f, pte));
 }
 
 static inline int xsm_add_to_physmap(struct domain *d1, struct domain *d2)

diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 96ba83f6d31c9410a4e6030ef74cac3d10865f4f..d14172e41aedae604aab9ef9b0bb7a11c315da30 100644 (file)
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -400,7 +400,8 @@ static int dummy_domain_memory_map (struct domain *d)
     return 0;
 }
 
-static int dummy_mmu_normal_update (struct domain *d, intpte_t fpte)
+static int dummy_mmu_normal_update (struct domain *d, struct domain *f, 
+                                                                intpte_t fpte)
 {
     return 0;
 }
@@ -410,7 +411,8 @@ static int dummy_mmu_machphys_update (struct domain *d, unsigned long mfn)
     return 0;
 }
 
-static int dummy_update_va_mapping (struct domain *d, l1_pgentry_t pte)
+static int dummy_update_va_mapping (struct domain *d, struct domain *f, 
+                                                            l1_pgentry_t pte)
 {
     return 0;
 }

diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index ddbe9719a2c57100546f67795f309418ed25eaa3..0771e3f1a8e5d63951e5405a5e397500cfab3fa3 100644 (file)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -11,6 +11,7 @@
 #include <xen/init.h>
 #include <xen/lib.h>
 #include <xen/sched.h>
+#include <xen/paging.h>
 #include <xen/xmalloc.h>
 #include <xsm/xsm.h>
 #include <xen/spinlock.h>
@@ -354,7 +355,7 @@ static int get_mfn_sid(unsigned long mfn, u32 *sid)
     if ( mfn_valid(mfn) )
     {
         /*mfn is valid if this is a page that Xen is tracking!*/
-        page = mfn_to_page(mfn);        
+        page = mfn_to_page(mfn);
         rc = get_page_sid(page, sid);
     }
     else
@@ -404,23 +405,6 @@ static int flask_memory_pin_page(struct domain *d, struct page_info *page)
     return avc_has_perm(dsec->sid, sid, SECCLASS_MMU, MMU__PINPAGE, NULL);
 }
 
-/* Used to defer flushing of memory structures. */
-struct percpu_mm_info {
-#define DOP_FLUSH_TLB      (1<<0) /* Flush the local TLB.                    */
-#define DOP_FLUSH_ALL_TLBS (1<<1) /* Flush TLBs of all VCPUs of current dom. */
-#define DOP_RELOAD_LDT     (1<<2) /* Reload the LDT shadow mapping.          */
-    unsigned int   deferred_ops;
-    /* If non-NULL, specifies a foreign subject domain for some operations. */
-    struct domain *foreign;
-};
-static DEFINE_PER_CPU(struct percpu_mm_info, percpu_mm_info);
-
-/*
- * Returns the current foreign domain; defaults to the currently-executing
- * domain if a foreign override hasn't been specified.
- */
-#define FOREIGNDOM (this_cpu(percpu_mm_info).foreign ?: current->domain)
-
 static int flask_console_io(struct domain *d, int cmd)
 {
     u32 perm;
@@ -1023,7 +1007,8 @@ static int flask_domain_memory_map(struct domain *d)
     return domain_has_perm(current->domain, d, SECCLASS_MMU, MMU__MEMORYMAP);
 }
 
-static int flask_mmu_normal_update(struct domain *d, intpte_t fpte)
+static int flask_mmu_normal_update(struct domain *d, struct domain *f, 
+                                                                intpte_t fpte)
 {
     int rc = 0;
     u32 map_perms = MMU__MAP_READ;
@@ -1036,7 +1021,7 @@ static int flask_mmu_normal_update(struct domain *d, intpte_t fpte)
     if ( l1e_get_flags(l1e_from_intpte(fpte)) & _PAGE_RW )
         map_perms |= MMU__MAP_WRITE;
 
-    fmfn = gmfn_to_mfn(FOREIGNDOM, l1e_get_pfn(l1e_from_intpte(fpte)));
+    fmfn = gmfn_to_mfn(f, l1e_get_pfn(l1e_from_intpte(fpte)));
 
     rc = get_mfn_sid(fmfn, &fsid);
     if ( rc )
@@ -1059,7 +1044,8 @@ static int flask_mmu_machphys_update(struct domain *d, unsigned long mfn)
     return avc_has_perm(dsec->sid, psid, SECCLASS_MMU, MMU__UPDATEMP, NULL);
 }
 
-static int flask_update_va_mapping(struct domain *d, l1_pgentry_t pte)
+static int flask_update_va_mapping(struct domain *d, struct domain *f, 
+                                                            l1_pgentry_t pte)
 {
     int rc = 0;
     u32 psid;
@@ -1069,7 +1055,7 @@ static int flask_update_va_mapping(struct domain *d, l1_pgentry_t pte)
 
     dsec = d->ssid;
 
-    mfn = gmfn_to_mfn(FOREIGNDOM, l1e_get_pfn(pte));        
+    mfn = gmfn_to_mfn(f, l1e_get_pfn(pte));        
     rc = get_mfn_sid(mfn, &psid);
     if ( rc )
         return rc;