From 4bc22a50ebc1fb1695d59f69105797e208021edb Mon Sep 17 00:00:00 2001 From: Daniel De Graaf Date: Tue, 23 Apr 2013 11:54:01 +0200 Subject: x86/hvm: convert access check for nested HVM to XSM This adds an XSM hook for enabling nested HVM support, replacing an IS_PRIV check. This hook is a partial duplicate with the xsm_hvm_param hook, but using the existing hook would require adding the index to the hook and would require the use of a custom hook for the xsm-disabled case (using XSM_OTHER, which is less immediately readable) - whereas adding a new hook retains the clarity of the existing code. Signed-off-by: Daniel De Graaf Acked-by: George Dunlap (release perspective) --- xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 6 ++++++ xen/xsm/flask/policy/access_vectors | 2 ++ 3 files changed, 9 insertions(+) (limited to 'xen/xsm') diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 6f1e0b4860..21aef2add9 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -101,6 +101,7 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, tmem_op); set_to_dummy_if_null(ops, tmem_control); set_to_dummy_if_null(ops, hvm_param); + set_to_dummy_if_null(ops, hvm_param_nested); set_to_dummy_if_null(ops, do_xsm_op); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 247c8a393b..23c523386b 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1092,6 +1092,11 @@ static int flask_hvm_param(struct domain *d, unsigned long op) return current_has_perm(d, SECCLASS_HVM, perm); } +static int flask_hvm_param_nested(struct domain *d) +{ + return current_has_perm(d, SECCLASS_HVM, HVM__NESTED); +} + #ifdef CONFIG_X86 static int flask_shadow_control(struct domain *d, uint32_t op) { @@ -1506,6 +1511,7 @@ static struct xsm_operations flask_ops = { .tmem_op = flask_tmem_op, .tmem_control = flask_tmem_control, .hvm_param = flask_hvm_param, + .hvm_param_nested = flask_hvm_param_nested, .do_xsm_op = do_flask_op, diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index fdfc50245a..36b8b2c271 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -234,6 +234,8 @@ class hvm # source = domain whose memory is being shared # target = client domain share_mem +# HVMOP_set_param setting HVM_PARAM_NESTEDHVM + nested } # Class event describes event channels. Interdomain event channels have their -- cgit v1.2.3