xsm: Add missing access checks

Actions requiring IS_PRIV should also require some XSM access control
in order for XSM to be useful in confining multiple privileged
domains. Add XSM hooks for new hypercalls and sub-commands that are
under IS_PRIV but not currently under any access checks.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>

1 files changed, 6 insertions, 0 deletions

diff --git a/xen/arch/x86/msi.c b/xen/arch/x86/msi.c
index 2d860069c8..782b84b0fd 100644
--- a/xen/arch/x86/msi.c
+++ b/xen/arch/x86/msi.c
@@ -29,6 +29,7 @@
 #include <io_ports.h>
 #include <public/physdev.h>
 #include <xen/iommu.h>
+#include <xsm/xsm.h>
 
 /* bitmap indicate which fixed map is free */
 DEFINE_SPINLOCK(msix_fixmap_lock);
@@ -992,6 +993,7 @@ int pci_restore_msi_state(struct pci_dev *pdev)
 {
     unsigned long flags;
     int irq;
+    int ret;
     struct msi_desc *entry, *tmp;
     struct irq_desc *desc;
 
@@ -1000,6 +1002,10 @@ int pci_restore_msi_state(struct pci_dev *pdev)
     if (!pdev)
         return -EINVAL;
 
+    ret = xsm_resource_setup_pci((pdev->seg << 16) | (pdev->bus << 8) | pdev->devfn);
+    if ( ret )
+        return ret;
+
     list_for_each_entry_safe( entry, tmp, &pdev->msi_list, list )
     {
         irq = entry->irq;