aboutsummaryrefslogtreecommitdiffstats
path: root/xen/include/xsm
Commit message (Collapse)AuthorAgeFilesLines
* xsm: clean up unneeded current referencesDaniel De Graaf2013-10-041-2/+2
| | | | | | | | | | | | Some XSM hooks in dummy.h used current->domain when this was also passed as a parameter; use the parameter in these cases. There are two hooks where this does not apply and which are not immediately obvious: xsm_set_target's parameters are the device model and HVM domains, and xsm_mem_sharing_op's first parameter is the source of the shared page, not the domain making the hypercall. Reported-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* xsm: forbid PV guest console readsDaniel De Graaf2013-10-041-3/+3
| | | | | | | | The CONSOLEIO_read operation was incorrectly allowed to PV guests if the hypervisor was compiled in debug mode (with VERBOSE defined). Reported-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* fix DOMID_IO mapping permission checks (try 2)Daniel De Graaf2013-09-261-2/+3
| | | | | | | | | | | | | | When the permission checks for memory mapping were moved from get_pg_owner to xsm_mmu_update in aaba7a677, the exception for DOMID_IO was not taken into account. This will cause IO memory mappings by PV domains (mini-os in particular) to fail when XSM/FLASK is not being used. This patch reintroduces the exception for DOMID_IO; the actual restrictions on IO memory mappings have always been checked separately using iomem_access_permitted, so this change should not break existing access control. Reported-by: Eduardo Peixoto Macedo <epm@cin.ufpe.br> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* Revert "fix DOMID_IO mapping permission checks"Jan Beulich2013-09-251-2/+0
| | | | This reverts commit 145ae98bfab8280744ad5e800cc036e1c84c0486.
* fix DOMID_IO mapping permission checksDaniel De Graaf2013-09-251-0/+2
| | | | | | | | | | | | | | When the permission checks for memory mapping were moved from get_pg_owner to xsm_mmu_update in aaba7a677, the exception for DOMID_IO was not taken into account. This will cause IO memory mappings by PV domains (mini-os in particular) to fail when XSM/FLASK is not being used. This patch reintroduces the exception for DOMID_IO; the actual restrictions on IO memory mappings have always been checked separately using iomem_access_permitted, so this change should not break existing access control. Reported-by: Eduardo Peixoto Macedo <epm@cin.ufpe.br> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* hypervisor/xen/tools: Remove the XENMEM_get_oustanding_pages and provide the ↵Konrad Rzeszutek Wilk2013-05-142-12/+0
| | | | | | | | | | | | | | | | | | | | | | | | data via xc_phys_info During the review of the patches it was noticed that there exists a race wherein the 'free_memory' value consists of information from two hypercalls. That is the XEN_SYSCTL_physinfo and XENMEM_get_outstanding_pages. The free memory the host has available for guest is the difference between the 'free_pages' (from XEN_SYSCTL_physinfo) and 'outstanding_pages'. As they are two hypercalls many things can happen in between the execution of them. This patch resolves this by eliminating the XENMEM_get_outstanding_pages hypercall and providing the free_pages and outstanding_pages information via the xc_phys_info structure. It also removes the XSM hooks and adds locking as needed. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Reviewed-by: Tim Deegan <tim@xen.org> Acked-by: Keir Fraser <keir.xen@gmail.com>
* rename IS_PRIV to is_hardware_domainDaniel De Graaf2013-05-071-12/+20
| | | | | | | | | | | Since the remaining uses of IS_PRIV are actually concerned with the domain having control of the hardware (i.e. being the initial domain), clarify this by renaming IS_PRIV to is_hardware_domain. This also removes IS_PRIV_FOR since the only remaining user was xsm/dummy.h. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release) Acked-by: Keir Fraser <keir@xen.org>
* arm: remove rcu_lock_target_domain_by_id usersDaniel De Graaf2013-05-072-0/+19
| | | | | | | | | | This function has been replaced with rcu_lock_domain_by_any_id and an XSM check. Two callers already had an XSM check; add a check to the third. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release) Acked-by: Ian Campbell <ian.campbell@citrix.com> (for thae ARM bits)
* xsm: add hooks for claimDaniel De Graaf2013-05-072-0/+24
| | | | | | | | | | | Adds XSM hooks for the recently introduced XENMEM_claim_pages and XENMEM_get_outstanding_pages operations, and adds FLASK access vectors for them. This makes the access control decisions for these operations match those in the rest of the hypervisor. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release) Acked-by: Keir Fraser <keir@xen.org>
* x86: remove IS_PRIV_FOR referencesDaniel De Graaf2013-04-232-0/+12
| | | | | | | | | | | | The check in guest_physmap_mark_populate_on_demand is redundant, since its only caller is populate_physmap whose only caller checks the xsm_memory_adjust_reservation hook prior to calling. Add a new XSM hook for the other two checks since they allow privileged domains to arbitrarily map a guest's memory. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)
* x86/hvm: convert access check for nested HVM to XSMDaniel De Graaf2013-04-232-0/+12
| | | | | | | | | | | | This adds an XSM hook for enabling nested HVM support, replacing an IS_PRIV check. This hook is a partial duplicate with the xsm_hvm_param hook, but using the existing hook would require adding the index to the hook and would require the use of a custom hook for the xsm-disabled case (using XSM_OTHER, which is less immediately readable) - whereas adding a new hook retains the clarity of the existing code. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)
* xen/arch/arm: add XSM hook to HVMOP_{get,set}_paramDaniel De Graaf2013-01-302-11/+12
| | | | | | | | This hook is not x86-specific; move it out of CONFIG_X86. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* xen/arch/x86: complete XSM hooks on irq/pirq mappingsDaniel De Graaf2013-01-232-8/+32
| | | | | | | | | | | | | | | | | Manipulation of a domain's pirq namespace was not fully protected by XSM hooks because the XSM hooks for IRQs needed a physical IRQ. Since this may not apply to HVM domains, a complete solution needs to split the XSM hook for this operation, using one hook for the PIRQ manipulation and one for controlling access to the hardware IRQ. This reworking has the advantage of providing the same MSI data to remove_irq that is provided to add_irq, allowing the PCI device to be determined in both functions. It also eliminates the last callers of rcu_lock_target_domain_by_id in x86 and common code in preparation for this function's removal. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen arm: add XSM hooks to arch_memory_opIan Campbell2013-01-212-18/+18
| | | | | | | | | | Treat XENMEM_add_to_physmap_range the same as XENMEM_add_to_physmap. Reported-by: Lars Rasmusson <Lars.Rasmusson@sics.se> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xsm: Dummy hook functions must be always_inline to ensure constantKeir Fraser2013-01-111-3/+3
| | | | | | | propagation and dead-code elimination makes LINKER_BUG_ON() operate properly. Signed-off-by: Keir Fraser <keir@xen.org>
* xen/xsm: distinguish scheduler get/set operationsDaniel De Graaf2013-01-112-0/+24
| | | | | | | | Add getscheduler and setscheduler permissions to replace the monolithic scheduler permission in the scheduler_op domctl and sysctl. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* tmem: add XSM hooksDaniel De Graaf2013-01-112-0/+24
| | | | | | | | | | | This adds a pair of XSM hooks for tmem operations: xsm_tmem_op which controls any use of tmem, and xsm_tmem_control which allows use of the TMEM_CONTROL operations. By default, all domains can use tmem while only IS_PRIV domains can use control operations. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> Committed-by: Keir Fraser <keir@xen.org>
* xen/xsm: Add xsm_default parameter to XSM hooksDaniel De Graaf2013-01-112-290/+356
| | | | | | | | | | | | | | Include the default XSM hook action as the first argument of the hook to facilitate quick understanding of how the call site is expected to be used (dom0-only, arbitrary guest, or device model). This argument does not solely define how a given hook is interpreted, since any changes to the hook's default action need to be made identically to all callers of a hook (if there are multiple callers; most hooks only have one), and may also require changing the arguments of the hook. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* xen: platform_hypercall XSM hook removalDaniel De Graaf2013-01-112-128/+0
| | | | | | | | | A number of the platform_hypercall XSM hooks have no parameters or only pass the operation ID, making them redundant with the xsm_platform_op hook. Remove these redundant hooks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: sysctl XSM hook removalDaniel De Graaf2013-01-112-111/+1
| | | | | | | | | A number of the sysctl XSM hooks have no parameters or only pass the operation ID, making them redundant with the xsm_sysctl hook. Remove these redundant hooks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: domctl XSM hook removalDaniel De Graaf2013-01-112-296/+0
| | | | | | | | | | | | | | A number of the domctl XSM hooks do nothing except pass the domain and operation ID, making them redundant with the xsm_domctl hook. Remove these redundant hooks. The remaining domctls all use individual hooks because they pass extra details of the call to the XSM module in order to allow a more fine-grained access decision to be made - for example, considering the exact device or memory range being set up for guest access. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: add XSM hook for XENMEM_exchangeDaniel De Graaf2013-01-112-0/+13
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: use XSM hooks for get_pg_owner access checksDaniel De Graaf2013-01-112-15/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three callers of get_pg_owner: * do_mmuext_op, which does not have XSM hooks on all subfunctions * do_mmu_update, which has hooks that are inefficient * do_update_va_mapping_otherdomain, which has a simple XSM hook In order to preserve return values for the do_mmuext_op hypercall, an additional XSM hook is required to check the operation even for those subfunctions that do not use the pg_owner field. This also covers the MMUEXT_UNPIN_TABLE operation which did previously have an XSM hook. The XSM hooks in do_mmu_update were capable of replacing the checks in get_pg_owner; however, the hooks are buried in the inner loop of the function - not very good for performance when XSM is enabled and these turn in to indirect function calls. This patch removes the PTE from the hooks and replaces it with a bitfield describing what accesses are being requested. The XSM hook can then be called only when additional bits are set instead of once per iteration of the loop. This patch results in a change in the FLASK permissions used for mapping an MMIO page: the target for the permisison check on the memory mapping is no longer resolved to the device-specific type, and is instead either the domain's own type or domio_t (depending on if the domain uses DOMID_SELF or DOMID_IO in the map command). Device-specific access is still controlled via the "resource use" permisison checked at domain creation (or device hotplug). Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: Add missing mem_sharing XSM hooksDaniel De Graaf2013-01-112-4/+43
| | | | | | | | | | | | This patch adds splits up the mem_sharing and mem_event XSM hooks to better cover what the code is doing. It also changes the utility function get_mem_event_op_target to rcu_lock_live_remote_domain_by_id because there is no mm-specific logic in there. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Tim Deegan <tim@xen.org> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: convert platform_hypercall to use XSMDaniel De Graaf2013-01-112-0/+13
| | | | | | | | | The newly introduced xsm_platform_op hook addresses new sub-ops, while most ops already have their own XSM hooks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* xen: convert do_sysctl to use XSMDaniel De Graaf2013-01-112-0/+13
| | | | | | | | The xsm_sysctl hook now covers every sysctl, in addition to the more fine-grained XSM hooks in most sub-functions. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: convert do_domctl to use XSMDaniel De Graaf2013-01-111-2/+14
| | | | | | | | | The xsm_domctl hook now covers every domctl, in addition to the more fine-grained XSM hooks in most sub-functions. This also removes the need to special-case XEN_DOMCTL_getdomaininfo. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: avoid calling rcu_lock_*target_domain when an XSM hook existsDaniel De Graaf2013-01-111-0/+34
| | | | | | | | | | | | | | | | | | | The rcu_lock_{,remote_}target_domain_by_id functions are wrappers around an IS_PRIV_FOR check for the current domain. This is now redundant with XSM hooks, so replace these calls with rcu_lock_domain_by_any_id or rcu_lock_remote_domain_by_id to remove the duplicate permission checks. When XSM_ENABLE is not defined or when the dummy XSM module is used, this patch should not change any functionality. Because the locations of privilege checks have sometimes moved below argument validation, error returns of some functions may change from EPERM to EINVAL when called with invalid arguments and from a domain without permission to perform the operation. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* xen: use XSM instead of IS_PRIV where duplicatedDaniel De Graaf2013-01-111-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Xen hypervisor has two basic access control function calls: IS_PRIV and the xsm_* functions. Most privileged operations currently require that both checks succeed, and many times the checks are at different locations in the code. This patch eliminates the explicit and implicit IS_PRIV checks that are duplicated in XSM hooks. When XSM_ENABLE is not defined or when the dummy XSM module is used, this patch should not change any functionality. Because the locations of privilege checks have sometimes moved below argument validation, error returns of some functions may change from EPERM to EINVAL or ESRCH if called with invalid arguments and from a domain without permission to perform the operation. Some checks are removed due to non-obvious duplicates in their callers: * acpi_enter_sleep is checked in XENPF_enter_acpi_sleep * map_domain_pirq has IS_PRIV_FOR checked in its callers: * physdev_map_pirq checks when acquiring the RCU lock * ioapic_guest_write is checked in PHYSDEVOP_apic_write * PHYSDEVOP_{manage_pci_add,manage_pci_add_ext,pci_device_add} are checked by xsm_resource_plug_pci in pci_add_device * PHYSDEVOP_manage_pci_remove is checked by xsm_resource_unplug_pci in pci_remove_device * PHYSDEVOP_{restore_msi,restore_msi_ext} are checked by xsm_resource_setup_pci in pci_restore_msi_state * do_console_io has changed to IS_PRIV from an explicit domid==0 Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: add distinct XSM hooks for map/unmapDaniel De Graaf2013-01-102-4/+38
| | | | | | | | | | | | | | The xsm_iomem_permission and xsm_ioport_permission hooks are intended to be called by the domain builder, while the calls in arch/x86/domctl.c which control mapping are also performed by the device model. Because these operations require distinct access control policies, they cannot use the same XSM hooks. This also adds a missing XSM hook in the unbind IRQ domctl. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Use the dummy XSM module if XSM is disabledDaniel De Graaf2013-01-102-148/+756
| | | | | | | | | | | | This patch moves the implementation of the dummy XSM module to a header file that provides inline functions when XSM_ENABLE is not defined. This reduces duplication between the dummy module and callers when the implementation of the dummy return is not just "return 0", and also provides better compile-time checking for completeness of the XSM implementations in the dummy module. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriateStefano Stabellini2012-10-171-2/+2
| | | | | | | | | | | | Note: these changes don't make any difference on x86. Replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when it is used as an hypercall argument. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xsm/flask: remove page-to-domain lookups from XSM hooksDaniel De Graaf2012-08-221-11/+12
| | | | | | | | | | | | | | | | | Doing a reverse lookup from MFN to its owning domain is redundant with the internal checks Xen does on pages. Change the checks to operate directly on the domain owning the pages for normal memory; MMIO areas are still checked with security_iomem_sid. This fixes a hypervisor crash when a domU attempts to map an MFN that is free in Xen's heap: the XSM hook is called before the validity check, and page_get_owner returns garbage when called on these pages. While explicitly checking for such pages using page_get_owner_and_reference is a possible solution, this ends up duplicating parts of get_page_from_l1e. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: define __section() and friends and use them for section annotations.Tim Deegan2012-04-111-1/+1
| | | | | | | | | By itself this is just code-tidying, but it's also useful for the following patch, which will adjust __section() for clang compiles. Signed-off-by: Tim Deegan <tim@xen.org> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Tim Deegan <tim@xen.org>
* ia64: fix build (next instance)Jan Beulich2012-02-061-6/+6
| | | | | | | A number of build problems crept in once again. Fix them. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* xsm: Add xsm_map_domain_pirq hookDaniel De Graaf2012-02-021-0/+6
| | | | | | | | | | When checking permissions in map_domain_pirq, the msi_desc field of the irq_desc is not yet populated with the PCI device being used. Pass in the msi_info structure which contains the intended PCI device whose label will be used in the security check. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Add security label to IRQ debug outputDaniel De Graaf2012-02-021-0/+7
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Add security labels to event-channel dumpDaniel De Graaf2012-02-021-0/+6
| | | | | | | | | | | | | | In FLASK, event channel labels are distinct from the labels of the domain using them. When debugging policy issues, it is useful to be able to view the current label of event channels; add this label to the event channel dump. This patch also adds the IRQ associated with a PIRQ for event channels bound to a PIRQ, and moves the xen_consumer flag to the front to create more consistent alignment in the output. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: allow global VIRQ handlers to be delegated to other domainsDaniel De Graaf2012-01-281-0/+6
| | | | | | | | | | | | | | | | | This patch sends global VIRQs to a domain designated as the VIRQ handler instead of sending all global VIRQ events to dom0. This is required in order to run xenstored in a stubdom, because VIRQ_DOM_EXC must be sent to xenstored for domain destruction to work properly. This patch was inspired by the xenstored stubdomain patch series sent to xen-devel by Alex Zeffertt in 2009. Signed-off-by: Diego Ongaro <diego.ongaro@citrix.com> Signed-off-by: Alex Zeffertt <alex.zeffertt@eu.citrix.com> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* xen: reinstate previously unused XENMEM_remove_from_physmap hypercallDaniel De Graaf2012-01-281-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reinstates the XENMEM_remove_from_physmap hypercall which was removed in 19041:ee62aaafff46 because it was not used. However, is now needed in order to support xenstored stub domains. The xenstored stub domain is not priviliged like dom0 and so cannot unilaterally map the xenbus page of other guests into it's address space. Therefore, before creating a domU the domain builder needs to seed its grant table with a grant ref allowing the xenstored stub domain to access the new domU's xenbus page. At present domU's do not start with their grant table mapped. Instead it gets mapped when the guest requests a grant table from the hypervisor. In order to seed the grant table, the domain builder first needs to map it into dom0 address space. But the hypercall to do this requires a gpfn (guest pfn), which is an mfn for PV guest, but a pfn for HVM guests. Therfore, in order to seed the grant table of an HVM guest, dom0 needs to *temporarily* map it into the guest's "physical" address space. Hence the need to reinstate the XENMEM_remove_from_physmap hypercall. Signed-off-by: Alex Zeffertt <alex.zeffertt@eu.citrix.com> Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* xsm: add checks on PCI configuration accessDaniel De Graaf2011-12-181-0/+6
| | | | | | | | PCI configuration access is allowed to any privileged domain regardless of I/O port access restrictions; add XSM hooks for these accesses. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* xsm: Add missing access checksDaniel De Graaf2011-12-181-0/+122
| | | | | | | | | Actions requiring IS_PRIV should also require some XSM access control in order for XSM to be useful in confining multiple privileged domains. Add XSM hooks for new hypercalls and sub-commands that are under IS_PRIV but not currently under any access checks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* xsm: add remote_remap permissionDaniel De Graaf2011-12-181-5/+5
| | | | | | | | The mmu_update hypercall can be used to manipulate the page tables of a remote domain. Add a check for this in the XSM hook in addition to the existing check on mapping pages of a remote domain. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* remove the use of -Wno-unused-valueJan Beulich2011-12-131-4/+4
| | | | | | | | It has been hiding actual mistakes, and there are not too many changes necessary to make things build without suppressing this warning. Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* xsm: Expand I/O resource hooksDaniel De Graaf2011-12-021-9/+13
| | | | | | | | | | | | | | | | | | The XSM hooks inside rangeset are not useful in capturing the PIRQ mappings in HVM domains. They can also be called from softirq context where current->domain is invalid, causing spurious AVC denials from unrelated domains on such calls. Within FLASK code, the rangeset hooks were already divided between IRQs, I/O memory, and x86 IO ports; propagate this division back through the XSM hooks and call the XSM functions directly when needed. This removes XSM checks for the initial rangeset population for dom0 and the removal checks on domain destruction; denying either of these actions does not make sense. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Revert "Fix xsm_mmu_* and xsm_update_va_mapping hooks"Daniel De Graaf2011-12-021-15/+13
| | | | | | | | | This reverts 23220:56a3b9c7367f, which removes all validation of the target pages in the mapping. This crash was solved by properly marking pages without known SIDs in 22207:20f139010445. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: remove unused xsm_assign_vector checkDaniel De Graaf2011-12-021-6/+0
| | | | | | | | The PHYSDEVOP_alloc_irq_vector hypercall is a noop, so its XSM check is not useful. Remove it and the "event vector" FLASK permission. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* x86/microcode: enable boot time (pre-Dom0) loadingJan Beulich2011-12-011-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Largely as a result of the continuing resistance of Linux maintainers to accept a microcode loading patch for pv-ops Xen kernels, this follows the suggested route and provides a means to load microcode updates without the assistance of Dom0, thus also addressing eventual problems in the hardware much earlier. This leverages the fact that via the multiboot protocol another blob of data can be easily added in the form of just an extra module. Since microcode data cannot reliably be recognized by looking at the provided data, this requires (in the non-EFI case) the use of a command line parameter ("ucode=<number>") to identify which of the modules is to be parsed for an eventual microcode update (in the EFI case the module is being identified in the config file, and hence the command line argument, if given, will be ignored). This required to adjust the XSM module determination logic accordingly. The format of the data to be provided is the raw binary blob already used for AMD CPUs, and the output of the intel-microcode2ucode utility for the Intel case (either the per-(family,model,stepping) file or - to make things easier for distro-s integration-wise - simply the concatenation of all of them). In order to not convert the spin_lock() in microcode_update_cpu() (and then obviously also all other uses on microcode_mutex) to spin_lock_irqsave() (which would be undesirable for the hypercall context in which the function also runs), the boot time handling gets done using a tasklet (instead of using on_selected_cpus()). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* ia64: fix the buildJan Beulich2011-11-151-18/+19
| | | | | | | This addresses all remaining build problems introduced over the last several months. Signed-off-by: Jan Beulich <jbeulich@suse.com>
* xen/xsm: Compile error due to naming clash between XSM and EFI runtimeJames Carter2011-09-171-3/+3
| | | | | | | | | | | | | | The problem is that efi_runtime_call is the name of both a function in xen/arch/x86/efi/runtime.c and a member of the xsm_operations struct in xen/include/xsm/xsm.h. This causes the macro "#define efi_runtime_call(x) efi_compat_runtime_call(x)" on line 15 of xen/arch/x86/x86_64/platform_hypercall.c to cause the above compile error. Renaming the XSM struct member fixes the problem. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 02:25:13 +0000