[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] [PATCH v03 02/10] domctl: introduce access_remote_pagetable call
>>> On 02.09.14 at 17:46, <andrii.tseglytskyi@xxxxxxxxxxxxxxx> wrote: > --- a/xen/include/public/domctl.h > +++ b/xen/include/public/domctl.h > @@ -1067,6 +1067,7 @@ struct xen_domctl { > #define XEN_DOMCTL_configure_domain 74 > #define XEN_DOMCTL_dtdev_op 75 > #define XEN_DOMCTL_assign_dt_device 76 > +#define XEN_DOMCTL_access_remote_pagetable 77 What's the point of introducing but not handling this? > --- a/xen/xsm/flask/hooks.c > +++ b/xen/xsm/flask/hooks.c > @@ -718,6 +718,9 @@ static int flask_domctl(struct domain *d, int cmd) > case XEN_DOMCTL_configure_domain: > return current_has_perm(d, SECCLASS_DOMAIN2, > DOMAIN2__CONFIGURE_DOMAIN); > > + case XEN_DOMCTL_access_remote_pagetable: > + return current_has_perm(d, SECCLASS_DOMAIN2, > DOMAIN2__ACCESS_REMOTE_PAGETABLE); This would seem too weak a check, as it's an all or nothing one. I could easily see an entity to be permitted access to one GPU, but not to others or IPUs. Also you should Cc the XSM maintainer on XSM changes. Jan _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |