Re: [Xen-devel] PATCH: Allow domains to share instruction pages with each other

[Keir Fraser <keir.fraser@xxxxxxxxxxxxx>]

On 10/01/2009 01:08, "Michael Abd-El-Malek" <mabdelm@xxxxxxxxxxx> wrote:

> Allow domains to share instruction pages with each other.
> 
> Xen changeset 4ec25db9326a (Nov 3, 2008) set the NX page bit on pages
> shared between domains.  That broke my ability to execute a binary
> whose pages are mapped from another domain.
> 
> My fix: I removed the NX page flag.  I don't see a security problem
> with this: if domain A maps a page from domain B, it somehow trusts
> it, and can do any additional checks after the page is mapped.  But
> absolutely disallowing execution of instructions from a mapped page
> seems a little too strict.

I think NX as default is pretty sensible. If you want to be able to make
executable shared mappings via grants, how about we add a flag
GNTMAP_executable to gnttab_map_grant_ref? You can use that in
create_grant_host_mapping() to zap _PAGE_NX.

If that works for you, feel free to make a patch.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel