x86/hvm: convert access check for nested HVM to XSM

This adds an XSM hook for enabling nested HVM support, replacing an
IS_PRIV check.  This hook is a partial duplicate with the xsm_hvm_param
hook, but using the existing hook would require adding the index to the
hook and would require the use of a custom hook for the xsm-disabled
case (using XSM_OTHER, which is less immediately readable) - whereas
adding a new hook retains the clarity of the existing code.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)

1 files changed, 2 insertions, 0 deletions

diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
index fdfc50245a..36b8b2c271 100644
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -234,6 +234,8 @@ class hvm
 #  source = domain whose memory is being shared
 #  target = client domain
     share_mem
+# HVMOP_set_param setting HVM_PARAM_NESTEDHVM
+    nested
 }
 
 # Class event describes event channels.  Interdomain event channels have their