bitkeeper revision 1.1757 (42be9ad5TTWQjsCBju5noyzBrTMyjA)

Attached is the patch that changes the default ssid from 0xffffffff to 0
as discussed in previous emails.

Signed-off-by: Reiner Sailer <sailer@us.ibm.com>
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>

diff --git a/tools/policy/policy_tool.c b/tools/policy/policy_tool.c
index 9c2f7a5a5b2371e7f4044b28d259124360dde34b..99dd104c4fc9e4de45c13ca616596e6bda14c2b8 100644 (file)
--- a/tools/policy/policy_tool.c
+++ b/tools/policy/policy_tool.c
@@ -234,14 +234,14 @@ void acm_dump_policy_buffer(void *buf, int buflen) {
 /*************************** set policy ****************************/
 
 int acm_domain_set_chwallpolicy(void *bufstart, int buflen) {
-#define CWALL_MAX_SSIDREFS             5
+#define CWALL_MAX_SSIDREFS             6
 #define CWALL_MAX_TYPES                10
 #define CWALL_MAX_CONFLICTSETS         2
 
      struct acm_chwall_policy_buffer *chwall_bin_pol = (struct acm_chwall_policy_buffer *)bufstart;
      domaintype_t *ssidrefs, *conflicts;
      int ret = 0;
-     int i,j;
+     int j;
 
      chwall_bin_pol->chwall_max_types = htons(CWALL_MAX_TYPES);
      chwall_bin_pol->chwall_max_ssidrefs = htons(CWALL_MAX_SSIDREFS);
@@ -261,13 +261,13 @@ int acm_domain_set_chwallpolicy(void *bufstart, int buflen) {
                           return -1; /* not enough space */
 
      ssidrefs = (domaintype_t *)(bufstart+ntohs(chwall_bin_pol->chwall_ssid_offset));
-     for(i=0; i< CWALL_MAX_SSIDREFS; i++) {
-            for (j=0; j< CWALL_MAX_TYPES; j++)
-                    ssidrefs[i*CWALL_MAX_TYPES + j] = htons(0);
-            /* here, set type i for ssidref i; generally, a ssidref can have multiple chwall types */
-            if (i < CWALL_MAX_SSIDREFS)
-                    ssidrefs[i*CWALL_MAX_TYPES + i] = htons(1);
-     }
+     memset(ssidrefs, 0, CWALL_MAX_TYPES*CWALL_MAX_SSIDREFS*sizeof(domaintype_t));
+
+     /* now set type j-1 for ssidref i+1 */
+     for(j=0; j<= CWALL_MAX_SSIDREFS; j++)
+         if ((0 < j) &&( j <= CWALL_MAX_TYPES))
+             ssidrefs[j*CWALL_MAX_TYPES + j - 1] = htons(1);
+
      ret += CWALL_MAX_TYPES*CWALL_MAX_SSIDREFS*sizeof(domaintype_t);
      if ((buflen - ret) < (CWALL_MAX_CONFLICTSETS*CWALL_MAX_TYPES*sizeof(domaintype_t)))
                           return -1; /* not enough space */
@@ -276,10 +276,10 @@ int acm_domain_set_chwallpolicy(void *bufstart, int buflen) {
      conflicts = (domaintype_t *)(bufstart + 
                                  ntohs(chwall_bin_pol->chwall_conflict_sets_offset));
      memset((void *)conflicts, 0, CWALL_MAX_CONFLICTSETS*CWALL_MAX_TYPES*sizeof(domaintype_t));
-     /* just 1 conflict set [0]={2,3}, [1]={0,5,6} */
+     /* just 1 conflict set [0]={2,3}, [1]={1,5,6} */
      if (CWALL_MAX_TYPES > 3) {
             conflicts[2] = htons(1); conflicts[3] = htons(1); /* {2,3} */
-            conflicts[CWALL_MAX_TYPES] = htons(1); conflicts[CWALL_MAX_TYPES+5] = htons(1); 
+            conflicts[CWALL_MAX_TYPES+1] = htons(1); conflicts[CWALL_MAX_TYPES+5] = htons(1); 
             conflicts[CWALL_MAX_TYPES+6] = htons(1);/* {0,5,6} */
      }
      ret += sizeof(domaintype_t)*CWALL_MAX_CONFLICTSETS*CWALL_MAX_TYPES;
@@ -287,12 +287,12 @@ int acm_domain_set_chwallpolicy(void *bufstart, int buflen) {
 }
 
 int acm_domain_set_stepolicy(void *bufstart, int buflen) {
-#define STE_MAX_SSIDREFS       5
-#define STE_MAX_TYPES                  5
+#define STE_MAX_SSIDREFS        6
+#define STE_MAX_TYPES                  5
        
     struct acm_ste_policy_buffer *ste_bin_pol = (struct acm_ste_policy_buffer *)bufstart;
     domaintype_t *ssidrefs;
-    int i,j, ret = 0;
+    int j, ret = 0;
 
     ste_bin_pol->ste_max_types = htons(STE_MAX_TYPES);
     ste_bin_pol->ste_max_ssidrefs = htons(STE_MAX_SSIDREFS);
@@ -304,14 +304,14 @@ int acm_domain_set_stepolicy(void *bufstart, int buflen) {
            return -1; /* not enough space */
 
      ssidrefs = (domaintype_t *)(bufstart+ntohs(ste_bin_pol->ste_ssid_offset));
-     for(i=0; i< STE_MAX_SSIDREFS; i++) {
-            for (j=0; j< STE_MAX_TYPES; j++)
-                    ssidrefs[i*STE_MAX_TYPES + j] = htons(0);
-            /* set type i in ssidref 0 and ssidref i */
-            ssidrefs[i] = htons(1); /* ssidref 0 has all types set */
-            if (i < STE_MAX_SSIDREFS)
-                    ssidrefs[i*STE_MAX_TYPES + i] = htons(1);
-     }
+     memset(ssidrefs, 0, STE_MAX_TYPES*STE_MAX_SSIDREFS*sizeof(domaintype_t));
+     /* all types 1 for ssidref 1 */
+     for(j=0; j< STE_MAX_TYPES; j++)
+        ssidrefs[1*STE_MAX_TYPES +j] = htons(1);
+     /* now set type j-1 for ssidref j */
+     for(j=0; j< STE_MAX_SSIDREFS; j++)
+            if ((0 < j) &&( j <= STE_MAX_TYPES))
+                    ssidrefs[j*STE_MAX_TYPES + j - 1] = htons(1);
      ret += STE_MAX_TYPES*STE_MAX_SSIDREFS*sizeof(domaintype_t);
      return ret;
 }

diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
index a7f08333f1767e39796e02c822ddb08cd9bb339a..89035c12be306f9599a35121eb50de880929aa88 100644 (file)
--- a/tools/python/xen/lowlevel/xc/xc.c
+++ b/tools/python/xen/lowlevel/xc/xc.c
@@ -78,7 +78,7 @@ static PyObject *pyxc_domain_create(PyObject *self,
 
     u32          dom = 0;
     int          ret;
-    u32          ssidref = 0xFFFFFFFF;
+    u32          ssidref = 0x0;
 
     static char *kwd_list[] = { "dom", "ssidref", NULL };
 

diff --git a/tools/python/xen/xm/main.py b/tools/python/xen/xm/main.py
index bcc3ded27441c15e3854750049518d79a824454b..f7bb884e5dd452a22575e3624e48d4486da2b358 100644 (file)
--- a/tools/python/xen/xm/main.py
+++ b/tools/python/xen/xm/main.py
@@ -399,9 +399,9 @@ class ProgList(Prog):
                 d['port'] = sxp.child_value(console, 'console_port')
             else:
                 d['port'] = ''
-            if ((int(sxp.child_value(info, 'ssidref', '-1'))) != -1):
-                d['ssidref1'] =  int(sxp.child_value(info, 'ssidref', '-1')) & 0xffff
-                d['ssidref2'] = (int(sxp.child_value(info, 'ssidref', '-1')) >> 16) & 0xffff
+            if ((int(sxp.child_value(info, 'ssidref', '0'))) != 0):
+                d['ssidref1'] =  int(sxp.child_value(info, 'ssidref', '0')) & 0xffff
+                d['ssidref2'] = (int(sxp.child_value(info, 'ssidref', '0')) >> 16) & 0xffff
                 print ("%(name)-16s %(dom)3d  %(mem)7d  %(cpu)3d  %(vcpus)5d   %(state)5s  %(cpu_time)7.1f     %(port)4s    s:%(ssidref2)02x/p:%(ssidref1)02x" % d)
             else:
                 print ("%(name)-16s %(dom)3d  %(mem)7d  %(cpu)3d  %(vcpus)5d   %(state)5s  %(cpu_time)7.1f     %(port)4s" % d)

diff --git a/xen/acm/acm_chinesewall_hooks.c b/xen/acm/acm_chinesewall_hooks.c
index 938716d3f9fe929632134624767fd08296d1ae09..f939078119bc12412f68c51755c92436acc39998 100644 (file)
--- a/xen/acm/acm_chinesewall_hooks.c
+++ b/xen/acm/acm_chinesewall_hooks.c
@@ -50,7 +50,7 @@ int acm_init_chwall_policy(void)
 {
        /* minimal startup policy; policy write-locked already */
        chwall_bin_pol.max_types = 1;
-       chwall_bin_pol.max_ssidrefs = 1;
+       chwall_bin_pol.max_ssidrefs = 2;
        chwall_bin_pol.max_conflictsets = 1;
        chwall_bin_pol.ssidrefs = (domaintype_t *)xmalloc_array(domaintype_t, chwall_bin_pol.max_ssidrefs*chwall_bin_pol.max_types);
        chwall_bin_pol.conflict_sets = (domaintype_t *)xmalloc_array(domaintype_t, chwall_bin_pol.max_conflictsets*chwall_bin_pol.max_types);
@@ -81,9 +81,10 @@ chwall_init_domain_ssid(void **chwall_ssid, ssidref_t ssidref)
         * part of the global ssidref (same way we'll get the partial ssid pointer)
         */
        chwall_ssidp->chwall_ssidref = GET_SSIDREF(ACM_CHINESE_WALL_POLICY, ssidref);
-       if (chwall_ssidp->chwall_ssidref >= chwall_bin_pol.max_ssidrefs) {
-               printkd("%s: ERROR chwall_ssidref(%x) > max(%x).\n",
-                       __func__, chwall_ssidp->chwall_ssidref, chwall_bin_pol.max_ssidrefs-1);
+       if ((chwall_ssidp->chwall_ssidref >= chwall_bin_pol.max_ssidrefs) ||
+           (chwall_ssidp->chwall_ssidref == ACM_DEFAULT_LOCAL_SSID)) {
+               printkd("%s: ERROR chwall_ssidref(%x) undefined (>max) or unset (0).\n",
+                       __func__, chwall_ssidp->chwall_ssidref);
                xfree(chwall_ssidp);
                return ACM_INIT_SSID_ERROR;
        }

diff --git a/xen/acm/acm_simple_type_enforcement_hooks.c b/xen/acm/acm_simple_type_enforcement_hooks.c
index 6606c53a73348371dd4cc58d88978f73d93d53d2..1bc12eaba8630fbd25310cfb5808e123e9b3b1c2 100644 (file)
--- a/xen/acm/acm_simple_type_enforcement_hooks.c
+++ b/xen/acm/acm_simple_type_enforcement_hooks.c
@@ -73,14 +73,15 @@ int acm_init_ste_policy(void)
 {
        /* minimal startup policy; policy write-locked already */
        ste_bin_pol.max_types = 1;
-       ste_bin_pol.max_ssidrefs = 1;
-       ste_bin_pol.ssidrefs = (domaintype_t *)xmalloc_array(domaintype_t, 1);
-       
+       ste_bin_pol.max_ssidrefs = 2;
+       ste_bin_pol.ssidrefs = (domaintype_t *)xmalloc_array(domaintype_t, 2);
+       memset(ste_bin_pol.ssidrefs, 0, 2);
+
        if (ste_bin_pol.ssidrefs == NULL)
                return ACM_INIT_SSID_ERROR;
 
-       /* initialize state */
-       ste_bin_pol.ssidrefs[0] = 1;
+       /* initialize state so that dom0 can start up and communicate with itself */
+       ste_bin_pol.ssidrefs[1] = 1;
 
        /* init stats */
        atomic_set(&(ste_bin_pol.ec_eval_count), 0);
@@ -106,9 +107,10 @@ ste_init_domain_ssid(void **ste_ssid, ssidref_t ssidref)
 
        /* get policy-local ssid reference */
        ste_ssidp->ste_ssidref = GET_SSIDREF(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, ssidref);
-       if (ste_ssidp->ste_ssidref >= ste_bin_pol.max_ssidrefs) {
-               printkd("%s: ERROR ste_ssidref (%x) > max(%x).\n",
-                       __func__, ste_ssidp->ste_ssidref, ste_bin_pol.max_ssidrefs-1);
+       if ((ste_ssidp->ste_ssidref >= ste_bin_pol.max_ssidrefs) ||
+           (ste_ssidp->ste_ssidref == ACM_DEFAULT_LOCAL_SSID)) {
+               printkd("%s: ERROR ste_ssidref (%x) undefined or unset (0).\n",
+                       __func__, ste_ssidp->ste_ssidref);
                xfree(ste_ssidp);
                return ACM_INIT_SSID_ERROR;
        }

diff --git a/xen/include/acm/acm_hooks.h b/xen/include/acm/acm_hooks.h
index 6109b5ee0c861073048e6d09f50d8755bf80f39a..2e0f9edb25402dd87210fe0962ac195558e6ee0b 100644 (file)
--- a/xen/include/acm/acm_hooks.h
+++ b/xen/include/acm/acm_hooks.h
@@ -328,7 +328,7 @@ static inline int acm_pre_grant_setup(domid_t id)
 }
 
 /* predefined ssidref for DOM0 used by xen when creating DOM0 */
-#define ACM_DOM0_SSIDREF        0
+#define ACM_DOM0_SSIDREF       0x00010001 
 
 static inline void acm_post_domain0_create(domid_t domid)
 {

diff --git a/xen/include/public/acm.h b/xen/include/public/acm.h
index 9b6d97ffb330f9805b1e88f88a48f3d1ce32d5f8..fb70c43d21247b989d9a47e6a4536cb5c65c173f 100644 (file)
--- a/xen/include/public/acm.h
+++ b/xen/include/public/acm.h
@@ -41,8 +41,8 @@
 #endif
 
 /* default ssid reference value if not supplied */
-#define ACM_DEFAULT_SSID       0xffffffff
-#define ACM_DEFAULT_LOCAL_SSID  0xffff
+#define ACM_DEFAULT_SSID       0x0
+#define ACM_DEFAULT_LOCAL_SSID  0x0
 
 /* Internal ACM ERROR types */
 #define ACM_OK                          0

diff --git a/xen/include/public/dom0_ops.h b/xen/include/public/dom0_ops.h
index e03f49dc7df56465254fca26e6ad8c71366d9dc4..601368eb02d953b9776ad81a1d34ebd6147a0fef 100644 (file)
--- a/xen/include/public/dom0_ops.h
+++ b/xen/include/public/dom0_ops.h
@@ -19,7 +19,7 @@
  * This makes sure that old versions of dom0 tools will stop working in a
  * well-defined way (rather than crashing the machine, for instance).
  */
-#define DOM0_INTERFACE_VERSION   0xAAAA1007
+#define DOM0_INTERFACE_VERSION   0xAAAA1008
 
 /************************************************************************/
 

diff --git a/xen/include/public/policy_ops.h b/xen/include/public/policy_ops.h
index 6b55f764b179abad0e1f8a37a250a7899fe74093..7814d308c76171f630e263bcaa9c30225eb787bd 100644 (file)
--- a/xen/include/public/policy_ops.h
+++ b/xen/include/public/policy_ops.h
@@ -28,7 +28,7 @@
  * This makes sure that old versions of policy tools will stop working in a
  * well-defined way (rather than crashing the machine, for instance).
  */
-#define POLICY_INTERFACE_VERSION   0xAAAA0001
+#define POLICY_INTERFACE_VERSION   0xAAAA0002
 
 /************************************************************************/