From: Elena Ufimtseva Date: Fri, 5 Sep 2014 09:01:45 +0000 (+0200) Subject: xsm bits for vNUMA hypercalls X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~4469 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks://%22/%22http:/www.example.com/cgi/%22https:/%22bookmarks:/%22?a=commitdiff_plain;h=40c7af684fc0bf89c7b643a5492b4abd920fba86;p=xen.git xsm bits for vNUMA hypercalls Define xsm_get_vnumainfo hypercall used for domain which wish to receive vnuma topology. Add xsm hook for XEN_DOMCTL_setvnumainfo. Also adds basic policies. Signed-off-by: Elena Ufimtseva Acked-by: Daniel De Graaf --- diff --git a/tools/flask/policy/policy/modules/xen/xen.if b/tools/flask/policy/policy/modules/xen/xen.if index dedc0351ab..32b51b60b7 100644 --- a/tools/flask/policy/policy/modules/xen/xen.if +++ b/tools/flask/policy/policy/modules/xen/xen.if @@ -49,7 +49,7 @@ define(`create_domain_common', ` getdomaininfo hypercall setvcpucontext setextvcpucontext getscheduler getvcpuinfo getvcpuextstate getaddrsize getaffinity setaffinity }; - allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn }; + allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op }; @@ -81,6 +81,7 @@ define(`manage_domain', ` allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler }; + allow $1 $2:domain2 set_vnumainfo; ') # migrate_domain_out(priv, target) diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index bb59fe89df..193788362f 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -76,7 +76,7 @@ allow dom0_t dom0_t:domain { getpodtarget setpodtarget set_misc_info set_virq_handler }; allow dom0_t dom0_t:domain2 { - set_cpuid gettsc settsc setscheduler set_max_evtchn + set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo get_vnumainfo }; allow dom0_t dom0_t:resource { add remove }; diff --git a/xen/common/memory.c b/xen/common/memory.c index 81be69e066..031672a81b 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -989,6 +989,13 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE_PARAM(void) arg) if ( (d = rcu_lock_domain_by_any_id(topology.domid)) == NULL ) return -ESRCH; + rc = xsm_get_vnumainfo(XSM_TARGET, d); + if ( rc ) + { + rcu_unlock_domain(d); + return rc; + } + read_lock(&d->vnuma_rwlock); if ( d->vnuma == NULL ) diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index c5aa3167db..df55e7041a 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -317,6 +317,12 @@ static XSM_INLINE int xsm_set_pod_target(XSM_DEFAULT_ARG struct domain *d) return xsm_default_action(action, current->domain, d); } +static XSM_INLINE int xsm_get_vnumainfo(XSM_DEFAULT_ARG struct domain *d) +{ + XSM_ASSERT_ACTION(XSM_TARGET); + return xsm_default_action(action, current->domain, d); +} + #if defined(HAS_PASSTHROUGH) && defined(HAS_PCI) static XSM_INLINE int xsm_get_device_group(XSM_DEFAULT_ARG uint32_t machine_bdf) { diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index a85045db97..6c1c079cb1 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -139,6 +139,7 @@ struct xsm_operations { int (*hvm_param) (struct domain *d, unsigned long op); int (*hvm_control) (struct domain *d, unsigned long op); int (*hvm_param_nested) (struct domain *d); + int (*get_vnumainfo) (struct domain *d); #ifdef CONFIG_X86 int (*do_mca) (void); @@ -534,6 +535,11 @@ static inline int xsm_hvm_param_nested (xsm_default_t def, struct domain *d) return xsm_ops->hvm_param_nested(d); } +static inline int xsm_get_vnumainfo (xsm_default_t def, struct domain *d) +{ + return xsm_ops->get_vnumainfo(d); +} + #ifdef CONFIG_X86 static inline int xsm_do_mca(xsm_default_t def) { @@ -653,6 +659,7 @@ static inline int xsm_ioport_mapping (xsm_default_t def, struct domain *d, uint3 { return xsm_ops->ioport_mapping(d, s, e, allow); } + #endif /* CONFIG_X86 */ #endif /* XSM_NO_WRAPPERS */ diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index c95c803180..0826a8b12b 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -85,6 +85,7 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, iomem_permission); set_to_dummy_if_null(ops, iomem_mapping); set_to_dummy_if_null(ops, pci_config_permission); + set_to_dummy_if_null(ops, get_vnumainfo); #if defined(HAS_PASSTHROUGH) && defined(HAS_PCI) set_to_dummy_if_null(ops, get_device_group); diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index f2f59ea59d..00efba1a6a 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -404,6 +404,11 @@ static int flask_claim_pages(struct domain *d) return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SETCLAIM); } +static int flask_get_vnumainfo(struct domain *d) +{ + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__GET_VNUMAINFO); +} + static int flask_console_io(struct domain *d, int cmd) { u32 perm; @@ -715,6 +720,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_cacheflush: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__CACHEFLUSH); + case XEN_DOMCTL_setvnumainfo: + return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN2__SET_VNUMAINFO); + default: printk("flask_domctl: Unknown op %d\n", cmd); return -EPERM; @@ -1552,6 +1560,8 @@ static struct xsm_operations flask_ops = { .hvm_param_nested = flask_hvm_param_nested, .do_xsm_op = do_flask_op, + .get_vnumainfo = flask_get_vnumainfo, + #ifdef CONFIG_COMPAT .do_compat_op = compat_flask_op, #endif diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 32371a9371..d27984155c 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -200,6 +200,10 @@ class domain2 cacheflush # Creation of the hardware domain when it is not dom0 create_hardware_domain +# XEN_DOMCTL_setvnumainfo + set_vnumainfo +# XENMEM_getvnumainfo + get_vnumainfo } # Similar to class domain, but primarily contains domctls related to HVM domains