x86/hvm: convert access check for nested HVM to XSM

This adds an XSM hook for enabling nested HVM support, replacing an
IS_PRIV check.  This hook is a partial duplicate with the xsm_hvm_param
hook, but using the existing hook would require adding the index to the
hook and would require the use of a custom hook for the xsm-disabled
case (using XSM_OTHER, which is less immediately readable) - whereas
adding a new hook retains the clarity of the existing code.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)

1 files changed, 2 insertions, 4 deletions

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 38e87ce3af..8522963cb0 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -3909,11 +3909,9 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg)
                     rc = -EINVAL;
                 break;
             case HVM_PARAM_NESTEDHVM:
-                if ( !IS_PRIV(current->domain) )
-                {
-                    rc = -EPERM;
+                rc = xsm_hvm_param_nested(XSM_PRIV, d);
+                if ( rc )
                     break;
-                }
                 if ( a.value > 1 )
                     rc = -EINVAL;
                 /* Remove the check below once we have