From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ed White Subject: [PATCH v5 13/15] x86/altp2m: XSM hooks for altp2m HVM ops Date: Mon, 13 Jul 2015 17:15:01 -0700 Message-ID: <1436832903-12639-14-git-send-email-edmund.h.white@intel.com> References: <1436832903-12639-1-git-send-email-edmund.h.white@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1436832903-12639-1-git-send-email-edmund.h.white@intel.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: Ravi Sahita , Wei Liu , George Dunlap , Ian Jackson , Tim Deegan , Jan Beulich , Andrew Cooper , tlengyel@novetta.com, Daniel De Graaf List-Id: xen-devel@lists.xenproject.org From: Ravi Sahita Signed-off-by: Ravi Sahita Acked-by: Daniel De Graaf --- tools/flask/policy/policy/modules/xen/xen.if | 4 ++-- xen/arch/x86/hvm/hvm.c | 6 ++++++ xen/include/xsm/dummy.h | 12 ++++++++++++ xen/include/xsm/xsm.h | 12 ++++++++++++ xen/xsm/dummy.c | 2 ++ xen/xsm/flask/hooks.c | 12 ++++++++++++ xen/xsm/flask/policy/access_vectors | 7 +++++++ 7 files changed, 53 insertions(+), 2 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index f4cde11..6177fe9 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -8,7 +8,7 @@ define(`declare_domain_common', ` allow $1 $2:grant { query setup }; allow $1 $2:mmu { adjust physmap map_read map_write stat pinpage updatemp mmuext_op }; - allow $1 $2:hvm { getparam setparam }; + allow $1 $2:hvm { getparam setparam altp2mhvm_op }; allow $1 $2:domain2 get_vnumainfo; ') @@ -58,7 +58,7 @@ define(`create_domain_common', ` allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; allow $1 $2:grant setup; allow $1 $2:hvm { cacheattr getparam hvmctl irqlevel pciroute sethvmc - setparam pcilevel trackdirtyvram nested }; + setparam pcilevel trackdirtyvram nested altp2mhvm altp2mhvm_op }; ') # create_domain(priv, target) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index df69c1d..ea1c784 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -5887,6 +5887,9 @@ static int hvmop_set_param( nestedhvm_vcpu_destroy(v); break; case HVM_PARAM_ALTP2M: + rc = xsm_hvm_param_altp2mhvm(XSM_PRIV, d); + if ( rc ) + break; if ( a.value > 1 ) rc = -EINVAL; if ( a.value && @@ -6491,6 +6494,9 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg) } if ( !rc ) + rc = xsm_hvm_altp2mhvm_op(XSM_TARGET, d ? d : current->domain); + + if ( !rc ) { switch ( a.cmd ) { diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index f044c0f..e0b561d 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -548,6 +548,18 @@ static XSM_INLINE int xsm_hvm_param_nested(XSM_DEFAULT_ARG struct domain *d) return xsm_default_action(action, current->domain, d); } +static XSM_INLINE int xsm_hvm_param_altp2mhvm(XSM_DEFAULT_ARG struct domain *d) +{ + XSM_ASSERT_ACTION(XSM_PRIV); + return xsm_default_action(action, current->domain, d); +} + +static XSM_INLINE int xsm_hvm_altp2mhvm_op(XSM_DEFAULT_ARG struct domain *d) +{ + XSM_ASSERT_ACTION(XSM_TARGET); + return xsm_default_action(action, current->domain, d); +} + static XSM_INLINE int xsm_vm_event_control(XSM_DEFAULT_ARG struct domain *d, int mode, int op) { XSM_ASSERT_ACTION(XSM_PRIV); diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index c872d44..dc48d23 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -147,6 +147,8 @@ struct xsm_operations { int (*hvm_param) (struct domain *d, unsigned long op); int (*hvm_control) (struct domain *d, unsigned long op); int (*hvm_param_nested) (struct domain *d); + int (*hvm_param_altp2mhvm) (struct domain *d); + int (*hvm_altp2mhvm_op) (struct domain *d); int (*get_vnumainfo) (struct domain *d); int (*vm_event_control) (struct domain *d, int mode, int op); @@ -586,6 +588,16 @@ static inline int xsm_hvm_param_nested (xsm_default_t def, struct domain *d) return xsm_ops->hvm_param_nested(d); } +static inline int xsm_hvm_param_altp2mhvm (xsm_default_t def, struct domain *d) +{ + return xsm_ops->hvm_param_altp2mhvm(d); +} + +static inline int xsm_hvm_altp2mhvm_op (xsm_default_t def, struct domain *d) +{ + return xsm_ops->hvm_altp2mhvm_op(d); +} + static inline int xsm_get_vnumainfo (xsm_default_t def, struct domain *d) { return xsm_ops->get_vnumainfo(d); diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index e84b0e4..3461d4f 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -116,6 +116,8 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, hvm_param); set_to_dummy_if_null(ops, hvm_control); set_to_dummy_if_null(ops, hvm_param_nested); + set_to_dummy_if_null(ops, hvm_param_altp2mhvm); + set_to_dummy_if_null(ops, hvm_altp2mhvm_op); set_to_dummy_if_null(ops, do_xsm_op); #ifdef CONFIG_COMPAT diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 6e37d29..2b998c9 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1170,6 +1170,16 @@ static int flask_hvm_param_nested(struct domain *d) return current_has_perm(d, SECCLASS_HVM, HVM__NESTED); } +static int flask_hvm_param_altp2mhvm(struct domain *d) +{ + return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM); +} + +static int flask_hvm_altp2mhvm_op(struct domain *d) +{ + return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM_OP); +} + static int flask_vm_event_control(struct domain *d, int mode, int op) { return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__VM_EVENT); @@ -1654,6 +1664,8 @@ static struct xsm_operations flask_ops = { .hvm_param = flask_hvm_param, .hvm_control = flask_hvm_param, .hvm_param_nested = flask_hvm_param_nested, + .hvm_param_altp2mhvm = flask_hvm_param_altp2mhvm, + .hvm_altp2mhvm_op = flask_hvm_altp2mhvm_op, .do_xsm_op = do_flask_op, .get_vnumainfo = flask_get_vnumainfo, diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 68284d5..d168de2 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -272,6 +272,13 @@ class hvm share_mem # HVMOP_set_param setting HVM_PARAM_NESTEDHVM nested +# HVMOP_set_param setting HVM_PARAM_ALTP2MHVM + altp2mhvm +# HVMOP_altp2m_set_domain_state HVMOP_altp2m_get_domain_state +# HVMOP_altp2m_vcpu_enable_notify HVMOP_altp2m_create_p2m +# HVMOP_altp2m_destroy_p2m HVMOP_altp2m_switch_p2m +# HVMOP_altp2m_set_mem_access HVMOP_altp2m_change_gfn + altp2mhvm_op } # Class event describes event channels. Interdomain event channels have their -- 1.9.1