aboutsummaryrefslogtreecommitdiffstats
path: root/xen/xsm
Commit message (Collapse)AuthorAgeFilesLines
* Add DOMCTL to limit the number of event channels a domain may useDavid Vrabel2013-10-142-0/+5
| | | | | | | | | | | | | | | Add XEN_DOMCTL_set_max_evtchn which may be used during domain creation to set the maximum event channel port a domain may use. This may be used to limit the amount of Xen resources (global mapping space and xenheap) that a domain may use for event channels. A domain that does not have a limit set may use all the event channels supported by the event channel ABI in use. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Keir Fraser <keir@xen.org>
* use SMP barrier in common code dealing with shared memory protocolsIan Campbell2013-07-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Xen currently makes no strong distinction between the SMP barriers (smp_mb etc) and the regular barrier (mb etc). In Linux, where we inherited these names from having imported Linux code which uses them, the SMP barriers are intended to be sufficient for implementing shared-memory protocols between processors in an SMP system while the standard barriers are useful for MMIO etc. On x86 with the stronger ordering model there is not much practical difference here but ARM has weaker barriers available which are suitable for use as SMP barriers. Therefore ensure that common code uses the SMP barriers when that is all which is required. On both ARM and x86 both types of barrier are currently identical so there is no actual change. A future patch will change smp_mb to a weaker barrier on ARM. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org>
* hypervisor/xen/tools: Remove the XENMEM_get_oustanding_pages and provide the ↵Konrad Rzeszutek Wilk2013-05-143-9/+1
| | | | | | | | | | | | | | | | | | | | | | | | data via xc_phys_info During the review of the patches it was noticed that there exists a race wherein the 'free_memory' value consists of information from two hypercalls. That is the XEN_SYSCTL_physinfo and XENMEM_get_outstanding_pages. The free memory the host has available for guest is the difference between the 'free_pages' (from XEN_SYSCTL_physinfo) and 'outstanding_pages'. As they are two hypercalls many things can happen in between the execution of them. This patch resolves this by eliminating the XENMEM_get_outstanding_pages hypercall and providing the free_pages and outstanding_pages information via the xc_phys_info structure. It also removes the XSM hooks and adds locking as needed. Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Reviewed-by: Tim Deegan <tim@xen.org> Acked-by: Keir Fraser <keir.xen@gmail.com>
* xen: move for_each_set_bit to xen/bitops.hStefano Stabellini2013-05-081-1/+1
| | | | | | | | Move for_each_set_bit from asm-x86/bitops.h to xen/bitops.h. Replace #include <asm/bitops.h> with #include <xen/bitops.h> everywhere. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Keir Fraser <keir@xen.org>
* arm: remove rcu_lock_target_domain_by_id usersDaniel De Graaf2013-05-072-0/+13
| | | | | | | | | | This function has been replaced with rcu_lock_domain_by_any_id and an XSM check. Two callers already had an XSM check; add a check to the third. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release) Acked-by: Ian Campbell <ian.campbell@citrix.com> (for thae ARM bits)
* xsm: add hooks for claimDaniel De Graaf2013-05-073-1/+18
| | | | | | | | | | | Adds XSM hooks for the recently introduced XENMEM_claim_pages and XENMEM_get_outstanding_pages operations, and adds FLASK access vectors for them. This makes the access control decisions for these operations match those in the rest of the hypervisor. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (for 4.3 release) Acked-by: Keir Fraser <keir@xen.org>
* xsm: fix printf format string for strlen resultIan Campbell2013-04-301-1/+1
| | | | | | | | | | | | | | strlen returns size_t: policydb.c: In function ‘policydb_read’: policydb.c:1779: error: format ‘%lu’ expects type ‘long unsigned int’, but argument 3 has type ‘size_t’ This is probably benign on 64-bit x86 but was found by Dharshini on 32-bit Xen 4.2.x. I expect it affects ARM too. Reported-by: Dharshini Tharmaraj <dharshinitharmaraj@gmail.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* x86: remove IS_PRIV_FOR referencesDaniel De Graaf2013-04-233-0/+10
| | | | | | | | | | | | The check in guest_physmap_mark_populate_on_demand is redundant, since its only caller is populate_physmap whose only caller checks the xsm_memory_adjust_reservation hook prior to calling. Add a new XSM hook for the other two checks since they allow privileged domains to arbitrarily map a guest's memory. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)
* x86/hvm: convert access check for nested HVM to XSMDaniel De Graaf2013-04-233-0/+9
| | | | | | | | | | | | This adds an XSM hook for enabling nested HVM support, replacing an IS_PRIV check. This hook is a partial duplicate with the xsm_hvm_param hook, but using the existing hook would require adding the index to the hook and would require the use of a custom hook for the xsm-disabled case (using XSM_OTHER, which is less immediately readable) - whereas adding a new hook retains the clarity of the existing code. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> (release perspective)
* xen: allow for explicitly specifying node-affinityDario Faggioli2013-04-172-4/+8
| | | | | | | | | | | | | | | Make it possible to pass the node-affinity of a domain to the hypervisor from the upper layers, instead of always being computed automatically. Note that this also required generalizing the Flask hooks for setting and getting the affinity, so that they now deal with both vcpu and node affinity. Signed-off-by: Dario Faggioli <dario.faggioli@citrix.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: George Dunlap <george.dunlap@eu.citrix.com> Acked-by: Juergen Gross <juergen.gross@ts.fujitsu.com> Acked-by: Keir Fraser <keir@xen.org>
* xen/flask: fix crash on debugkey "i"Daniel De Graaf2013-02-131-1/+1
| | | | | | | | | The IRQs beyond nr_static_irqs do not all have an associated PCI device, so only query the device SID if pci is not NULL. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* xen/arch/arm: add XSM hook to HVMOP_{get,set}_paramDaniel De Graaf2013-01-302-24/+24
| | | | | | | | This hook is not x86-specific; move it out of CONFIG_X86. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Keir Fraser <keir@xen.org>
* xen/arch/x86: complete XSM hooks on irq/pirq mappingsDaniel De Graaf2013-01-233-19/+25
| | | | | | | | | | | | | | | | | Manipulation of a domain's pirq namespace was not fully protected by XSM hooks because the XSM hooks for IRQs needed a physical IRQ. Since this may not apply to HVM domains, a complete solution needs to split the XSM hook for this operation, using one hook for the PIRQ manipulation and one for controlling access to the hardware IRQ. This reworking has the advantage of providing the same MSI data to remove_irq that is provided to add_irq, allowing the PCI device to be determined in both functions. It also eliminates the last callers of rcu_lock_target_domain_by_id in x86 and common code in preparation for this function's removal. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen arm: add XSM hooks to arch_memory_opIan Campbell2013-01-212-14/+16
| | | | | | | | | | Treat XENMEM_add_to_physmap_range the same as XENMEM_add_to_physmap. Reported-by: Lars Rasmusson <Lars.Rasmusson@sics.se> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* miscellaneous cleanupJan Beulich2013-01-171-2/+3
| | | | | | | | | | | | | | | | | ... noticed while putting together the 16Tb support patches for x86. Briefly, this (in order of the changes below) - fixes an inefficiency in x86's context switch code (translations to/ from struct page are more involved than to/from MFNs) - drop unnecessary MFM-to-page conversions - drop a redundant call to destroy_xen_mappings() (an indentical call is being made a few lines up) - simplify a VA-to-MFN translation - drop dead code (several occurrences) - add a missing __init annotation Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove unused permissionsDaniel De Graaf2013-01-111-6/+0
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: document the access vectorsDaniel De Graaf2013-01-111-104/+355
| | | | | | | | | | This adds comments to the FLASK access_vectors file describing what operations each access vector controls and the meanings of the source and target fields in the permission check. This also makes the indentation of the file consistent; no functionality changes are made. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen/xsm: distinguish scheduler get/set operationsDaniel De Graaf2013-01-113-10/+43
| | | | | | | | Add getscheduler and setscheduler permissions to replace the monolithic scheduler permission in the scheduler_op domctl and sysctl. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* tmem: add XSM hooksDaniel De Graaf2013-01-113-0/+16
| | | | | | | | | | | This adds a pair of XSM hooks for tmem operations: xsm_tmem_op which controls any use of tmem, and xsm_tmem_control which allows use of the TMEM_CONTROL operations. By default, all domains can use tmem while only IS_PRIV domains can use control operations. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Dan Magenheimer <dan.magenheimer@oracle.com> Committed-by: Keir Fraser <keir@xen.org>
* xen: platform_hypercall XSM hook removalDaniel De Graaf2013-01-112-89/+30
| | | | | | | | | A number of the platform_hypercall XSM hooks have no parameters or only pass the operation ID, making them redundant with the xsm_platform_op hook. Remove these redundant hooks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: sysctl XSM hook removalDaniel De Graaf2013-01-112-97/+38
| | | | | | | | | A number of the sysctl XSM hooks have no parameters or only pass the operation ID, making them redundant with the xsm_sysctl hook. Remove these redundant hooks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: domctl XSM hook removalDaniel De Graaf2013-01-112-313/+92
| | | | | | | | | | | | | | A number of the domctl XSM hooks do nothing except pass the domain and operation ID, making them redundant with the xsm_domctl hook. Remove these redundant hooks. The remaining domctls all use individual hooks because they pass extra details of the call to the XSM module in order to allow a more fine-grained access decision to be made - for example, considering the exact device or memory range being set up for guest access. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: add XSM hook for XENMEM_exchangeDaniel De Graaf2013-01-113-0/+8
| | | | | Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: use XSM hooks for get_pg_owner access checksDaniel De Graaf2013-01-113-48/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are three callers of get_pg_owner: * do_mmuext_op, which does not have XSM hooks on all subfunctions * do_mmu_update, which has hooks that are inefficient * do_update_va_mapping_otherdomain, which has a simple XSM hook In order to preserve return values for the do_mmuext_op hypercall, an additional XSM hook is required to check the operation even for those subfunctions that do not use the pg_owner field. This also covers the MMUEXT_UNPIN_TABLE operation which did previously have an XSM hook. The XSM hooks in do_mmu_update were capable of replacing the checks in get_pg_owner; however, the hooks are buried in the inner loop of the function - not very good for performance when XSM is enabled and these turn in to indirect function calls. This patch removes the PTE from the hooks and replaces it with a bitfield describing what accesses are being requested. The XSM hook can then be called only when additional bits are set instead of once per iteration of the loop. This patch results in a change in the FLASK permissions used for mapping an MMIO page: the target for the permisison check on the memory mapping is no longer resolved to the device-specific type, and is instead either the domain's own type or domio_t (depending on if the domain uses DOMID_SELF or DOMID_IO in the map command). Device-specific access is still controlled via the "resource use" permisison checked at domain creation (or device hotplug). Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: Add missing mem_sharing XSM hooksDaniel De Graaf2013-01-113-3/+28
| | | | | | | | | | | | This patch adds splits up the mem_sharing and mem_event XSM hooks to better cover what the code is doing. It also changes the utility function get_mem_event_op_target to rcu_lock_live_remote_domain_by_id because there is no mm-specific logic in there. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Tim Deegan <tim@xen.org> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: add distinct SIDs for self/target accessDaniel De Graaf2013-01-113-223/+210
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because the FLASK XSM module no longer checks IS_PRIV for remote domain accesses covered by XSM permissions, domains now have the ability to perform memory management and other functions on all domains that have the same type. While it is possible to prevent this by only creating one domain per type, this solution significantly limits the flexibility of the type system. This patch introduces a domain type transition to represent a domain that is operating on itself. In the example policy, this is demonstrated by creating a type with _self appended when declaring a domain type which will be used for reflexive operations. AVCs for a domain of type domU_t will look like the following: scontext=system_u:system_r:domU_t tcontext=system_u:system_r:domU_t_self This change also allows policy to distinguish between event channels a domain creates to itself and event channels created between domains of the same type. The IS_PRIV_FOR check used for device model domains is also no longer checked by FLASK; a similar transition is performed when the target is set and used when the device model accesses its target domain. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: add missing hooksDaniel De Graaf2013-01-112-11/+60
| | | | | | | | The FLASK module was missing implementations of some hooks and did not have access vectors defined for 10 domctls; define these now. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: Add checks on the domain performing the set_target operationDaniel De Graaf2013-01-112-0/+9
| | | | | | | | | The existing domain__set_target check only verifies that the source and target domains can be associated. We also need to check that the privileged domain making this association is allowed to do so. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Move flask policy files into hypervisor (missed from earlier commit).Keir Fraser2013-01-115-0/+448
| | | | | | | | | | | Signed-off-by: Keir Fraser <keir@xen.org> --HG-- rename : tools/flask/policy/policy/flask/access_vectors => xen/xsm/flask/policy/access_vectors rename : tools/flask/policy/policy/flask/initial_sids => xen/xsm/flask/policy/initial_sids rename : tools/flask/policy/policy/flask/mkaccess_vector.sh => xen/xsm/flask/policy/mkaccess_vector.sh rename : tools/flask/policy/policy/flask/mkflask.sh => xen/xsm/flask/policy/mkflask.sh rename : tools/flask/policy/policy/flask/security_classes => xen/xsm/flask/policy/security_classes
* arch/x86: convert platform_hypercall to use XSMDaniel De Graaf2013-01-112-0/+34
| | | | | | | | | The newly introduced xsm_platform_op hook addresses new sub-ops, while most ops already have their own XSM hooks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* xen: convert do_sysctl to use XSMDaniel De Graaf2013-01-112-0/+34
| | | | | | | | The xsm_sysctl hook now covers every sysctl, in addition to the more fine-grained XSM hooks in most sub-functions. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: convert do_domctl to use XSMDaniel De Graaf2013-01-111-1/+84
| | | | | | | | | The xsm_domctl hook now covers every domctl, in addition to the more fine-grained XSM hooks in most sub-functions. This also removes the need to special-case XEN_DOMCTL_getdomaininfo. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: use XSM instead of IS_PRIV where duplicatedDaniel De Graaf2013-01-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Xen hypervisor has two basic access control function calls: IS_PRIV and the xsm_* functions. Most privileged operations currently require that both checks succeed, and many times the checks are at different locations in the code. This patch eliminates the explicit and implicit IS_PRIV checks that are duplicated in XSM hooks. When XSM_ENABLE is not defined or when the dummy XSM module is used, this patch should not change any functionality. Because the locations of privilege checks have sometimes moved below argument validation, error returns of some functions may change from EPERM to EINVAL or ESRCH if called with invalid arguments and from a domain without permission to perform the operation. Some checks are removed due to non-obvious duplicates in their callers: * acpi_enter_sleep is checked in XENPF_enter_acpi_sleep * map_domain_pirq has IS_PRIV_FOR checked in its callers: * physdev_map_pirq checks when acquiring the RCU lock * ioapic_guest_write is checked in PHYSDEVOP_apic_write * PHYSDEVOP_{manage_pci_add,manage_pci_add_ext,pci_device_add} are checked by xsm_resource_plug_pci in pci_add_device * PHYSDEVOP_manage_pci_remove is checked by xsm_resource_unplug_pci in pci_remove_device * PHYSDEVOP_{restore_msi,restore_msi_ext} are checked by xsm_resource_setup_pci in pci_restore_msi_state * do_console_io has changed to IS_PRIV from an explicit domid==0 Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* arch/x86: add distinct XSM hooks for map/unmapDaniel De Graaf2013-01-102-22/+24
| | | | | | | | | | | | | | The xsm_iomem_permission and xsm_ioport_permission hooks are intended to be called by the domain builder, while the calls in arch/x86/domctl.c which control mapping are also performed by the device model. Because these operations require distinct access control policies, they cannot use the same XSM hooks. This also adds a missing XSM hook in the unbind IRQ domctl. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Keir Fraser <keir@xen.org>
* flask: move policy headers into hypervisorDaniel De Graaf2013-01-106-346/+25
| | | | | | | | | | Rather than keeping around headers that are autogenerated in order to avoid adding build dependencies from xen/ to files in tools/, move the relevant parts of the FLASK policy into the hypervisor tree and generate the headers as part of the hypervisor's build. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Use the dummy XSM module if XSM is disabledDaniel De Graaf2013-01-103-604/+7
| | | | | | | | | | | | This patch moves the implementation of the dummy XSM module to a header file that provides inline functions when XSM_ENABLE is not defined. This reduces duplication between the dummy module and callers when the implementation of the dummy return is not just "return 0", and also provides better compile-time checking for completeness of the XSM implementations in the dummy module. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xen: remove nr_irqs_gsi from generic codeIan Campbell2012-12-191-2/+2
| | | | | | | | | | | | | | | | The concept is X86 specific. AFAICT the generic concept here is the number of static physical IRQs which the current hardware has, so call this nr_static_irqs. Also using "defined NR_IRQS" as a standin for x86 might have made sense at one point but its just cleaner to push the necessary definitions into asm/irq.h. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Acked-by: Jan Beulich <jbeulich@suse.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xen: replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when appropriateStefano Stabellini2012-10-174-5/+5
| | | | | | | | | | | | Note: these changes don't make any difference on x86. Replace XEN_GUEST_HANDLE with XEN_GUEST_HANDLE_PARAM when it is used as an hypercall argument. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* xsm/flask: add domain relabel supportDaniel De Graaf2012-09-175-7/+65
| | | | | | | | | | | | | | | | This adds the ability to change a domain's XSM label after creation. The new label will be used for all future access checks; however, existing event channels and memory mappings will remain valid even if their creation would be denied by the new label. With appropriate security policy and hooks in the domain builder, this can be used to create domains that the domain builder does not have access to after building. It can also be used to allow a domain to drop privileges - for example, prior to launching a user-supplied kernel loaded by a pv-grub stubdom. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove unneeded create_sid fieldDaniel De Graaf2012-09-172-14/+10
| | | | | | | | | This field was only used to populate the ssid of dom0, which can be handled explicitly in the domain creation hook. This also removes the unnecessary permission check on the creation of dom0. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove inherited class attributesDaniel De Graaf2012-09-176-143/+6
| | | | | | | | | | | The ability to declare common permission blocks shared across multiple classes is not currently used in Xen. Currently, support for this feature is broken in the header generation scripts, and it is not expected that this feature will be used in the future, so remove the dead code. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: remove page-to-domain lookups from XSM hooksDaniel De Graaf2012-08-222-144/+51
| | | | | | | | | | | | | | | | | Doing a reverse lookup from MFN to its owning domain is redundant with the internal checks Xen does on pages. Change the checks to operate directly on the domain owning the pages for normal memory; MMIO areas are still checked with security_iomem_sid. This fixes a hypervisor crash when a domU attempts to map an MFN that is free in Xen's heap: the XSM hook is called before the validity check, and page_get_owner returns garbage when called on these pages. While explicitly checking for such pages using page_get_owner_and_reference is a possible solution, this ends up duplicating parts of get_page_from_l1e. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: Add missing dummy hooksDaniel De Graaf2012-08-222-0/+36
| | | | | | | | | | A few XSM hooks have been defined without implementation in dummy.c; these will cause a null function pointer deference if called. Also implement the efi_call hook, which was incorrectly added without any implementations. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: avoid struct page lookup in mmu_normal_updateDaniel De Graaf2012-07-091-7/+6
| | | | | | | | | | Since the mmu_normal_update hook is called even when mapping MFNs without an associated struct page, attempting to use the struct page to map between GFN and MFN will cause crashes. Use get_gfn_query instead. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: fix memory AVC formattingDaniel De Graaf2012-07-091-1/+1
| | | | | | | A space was missing in the format string. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* common: Use get_page_from_gfn() instead of get_gfn()/put_gfn.Tim Deegan2012-05-171-6/+11
| | | | | Signed-off-by: Tim Deegan <tim@xen.org> Signed-off-by: Andres Lagar-Cavilla <andres@lagarcavilla.org>
* xsm/flask: clean up auditing outputDaniel De Graaf2012-04-173-9/+18
| | | | | | | | | | | The audit data for normal MMU updates was incorrectly using the RANGE type which presented the data badly in audit messages; add a MEMORY type for this showing the correct names for the fields. This patch also shows the target domain in event channel mapping checks to make debugging those denials easier. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm: expose context of event channel peersDaniel De Graaf2012-02-291-0/+36
| | | | | | | | | | This hypercall allows a domain to identify the security context of a domain that it is communicating with using the interdomain event channel that it is using for the communication. This can be used to augment Xen's security permissions with intra-domain security checks. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: buffer AVC messages for outputDaniel De Graaf2012-02-291-25/+82
| | | | | | | | | | | When multiple CPUs hit an AVC audit message, the resulting output in the ring buffer and serial console is garbled due to the audit process using many separate printk invocations for each message. Change the AVC audit process to use a temporary buffer and output the contents once the entire audit message is complete. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* xsm/flask: clean interdomain event channel hookDaniel De Graaf2012-02-291-22/+8
| | | | | | | | | | | | Don't attempt to relabel the already-bound half of the event channel pair created by an interdomain event channel. This relabeling also performed an incorrect check that the destination domain is permitted to create the reverse event channel, which may not be true if the unbound channel was created by the domain builder (like the xenstore channel). Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 14:37:39 +0000