Xen project Mailing List

[Xen-devel] [PATCH v7 13/15] x86/altp2m: XSM hooks for altp2m HVM ops

From: Ravi Sahita <ravi.sahita@xxxxxxxxx> Signed-off-by: Ravi Sahita <ravi.sahita@xxxxxxxxx> Acked-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx> --- Changes since v6: no changes tools/flask/policy/policy/modules/xen/xen.if | 4 ++-- xen/arch/x86/hvm/hvm.c | 6 ++++++ xen/include/xsm/dummy.h | 12 ++++++++++++ xen/include/xsm/xsm.h | 12 ++++++++++++ xen/xsm/dummy.c | 2 ++ xen/xsm/flask/hooks.c | 12 ++++++++++++ xen/xsm/flask/policy/access_vectors | 7 +++++++ 7 files changed, 53 insertions(+), 2 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index da4c95b..a2f25e1 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -8,7 +8,7 @@ define(`declare_domain_common', ` allow $1 $2:grant { query setup }; allow $1 $2:mmu { adjust physmap map_read map_write stat pinpage updatemp mmuext_op }; - allow $1 $2:hvm { getparam setparam }; + allow $1 $2:hvm { getparam setparam altp2mhvm_op }; allow $1 $2:domain2 get_vnumainfo; ') @@ -58,7 +58,7 @@ define(`create_domain_common', ` allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; allow $1 $2:grant setup; allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc - setparam pcilevel trackdirtyvram nested }; + setparam pcilevel trackdirtyvram nested altp2mhvm altp2mhvm_op }; ') # create_domain(priv, target) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 55e70f0..cd5d8d5 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -6005,6 +6005,9 @@ static int hvmop_set_param( nestedhvm_vcpu_destroy(v); break; case HVM_PARAM_ALTP2M: + rc = xsm_hvm_param_altp2mhvm(XSM_PRIV, d); + if ( rc ) + break; if ( a.value > 1 ) rc = -EINVAL; if ( a.value && @@ -6189,6 +6192,9 @@ static int do_altp2m_op( goto out; } + if ( (rc = xsm_hvm_altp2mhvm_op(XSM_TARGET, d ? d : current->domain)) ) + goto out; + switch ( a.cmd ) { case HVMOP_altp2m_get_domain_state: diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index adb02bc..bbbfce7 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -548,6 +548,18 @@ static XSM_INLINE int xsm_hvm_param_nested(XSM_DEFAULT_ARG struct domain *d) return xsm_default_action(action, current->domain, d); } +static XSM_INLINE int xsm_hvm_param_altp2mhvm(XSM_DEFAULT_ARG struct domain *d) +{ + XSM_ASSERT_ACTION(XSM_PRIV); + return xsm_default_action(action, current->domain, d); +} + +static XSM_INLINE int xsm_hvm_altp2mhvm_op(XSM_DEFAULT_ARG struct domain *d) +{ + XSM_ASSERT_ACTION(XSM_TARGET); + return xsm_default_action(action, current->domain, d); +} + static XSM_INLINE int xsm_vm_event_control(XSM_DEFAULT_ARG struct domain *d, int mode, int op) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 7886574..3678a93 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -147,6 +147,8 @@ struct xsm_operations { int (*hvm_param) (struct domain *d, unsigned long op); int (*hvm_control) (struct domain *d, unsigned long op); int (*hvm_param_nested) (struct domain *d); + int (*hvm_param_altp2mhvm) (struct domain *d); + int (*hvm_altp2mhvm_op) (struct domain *d); int (*get_vnumainfo) (struct domain *d); int (*vm_event_control) (struct domain *d, int mode, int op); @@ -587,6 +589,16 @@ static inline int xsm_hvm_param_nested (xsm_default_t def, struct domain *d) return xsm_ops->hvm_param_nested(d); } +static inline int xsm_hvm_param_altp2mhvm (xsm_default_t def, struct domain *d) +{ + return xsm_ops->hvm_param_altp2mhvm(d); +} + +static inline int xsm_hvm_altp2mhvm_op (xsm_default_t def, struct domain *d) +{ + return xsm_ops->hvm_altp2mhvm_op(d); +} + static inline int xsm_get_vnumainfo (xsm_default_t def, struct domain *d) { return xsm_ops->get_vnumainfo(d); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 06ac911..21b1bf8 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -116,6 +116,8 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, hvm_param); set_to_dummy_if_null(ops, hvm_control); set_to_dummy_if_null(ops, hvm_param_nested); + set_to_dummy_if_null(ops, hvm_param_altp2mhvm); + set_to_dummy_if_null(ops, hvm_altp2mhvm_op); set_to_dummy_if_null(ops, do_xsm_op); #ifdef CONFIG_COMPAT diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 882681f..7a4522e 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1176,6 +1176,16 @@ static int flask_hvm_param_nested(struct domain *d) return current_has_perm(d, SECCLASS_HVM, HVM__NESTED); } +static int flask_hvm_param_altp2mhvm(struct domain *d) +{ + return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM); +} + +static int flask_hvm_altp2mhvm_op(struct domain *d) +{ + return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM_OP); +} + static int flask_vm_event_control(struct domain *d, int mode, int op) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__VM_EVENT); @@ -1687,6 +1697,8 @@ static struct xsm_operations flask_ops = { .hvm_param = flask_hvm_param, .hvm_control = flask_hvm_param, .hvm_param_nested = flask_hvm_param_nested, + .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, + .hvm_altp2mhvm_op = flask_hvm_altp2mhvm_op, .do_xsm_op = do_flask_op, .get_vnumainfo = flask_get_vnumainfo, diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index b2a20c3..71495fd 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -282,6 +282,13 @@ class hvm share_mem # HVMOP_set_param setting HVM_PARAM_NESTEDHVM nested +# HVMOP_set_param setting HVM_PARAM_ALTP2MHVM + altp2mhvm +# HVMOP_altp2m_set_domain_state HVMOP_altp2m_get_domain_state +# HVMOP_altp2m_vcpu_enable_notify HVMOP_altp2m_create_p2m +# HVMOP_altp2m_destroy_p2m HVMOP_altp2m_switch_p2m +# HVMOP_altp2m_set_mem_access HVMOP_altp2m_change_gfn + altp2mhvm_op } # Class event describes event channels. Interdomain event channels have their -- 1.9.1 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel

©2013 Xen Project, A Linux Foundation Collaborative Project. All Rights Reserved.
Linux Foundation is a registered trademark of The Linux Foundation.
Xen Project is a trademark of The Linux Foundation.