From patchwork Tue Jan 3 14:04:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boris Ostrovsky X-Patchwork-Id: 9494891 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 19FEC606B4 for ; Tue, 3 Jan 2017 14:06:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2C77026CF9 for ; Tue, 3 Jan 2017 14:06:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 216DE2711E; Tue, 3 Jan 2017 14:06:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.2 required=2.0 tests=BAYES_00,LONGWORDS, RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 522FC27031 for ; Tue, 3 Jan 2017 14:06:43 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cOPhP-0005U0-UK; Tue, 03 Jan 2017 14:04:23 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cOPhO-0005Rw-B7 for xen-devel@lists.xen.org; Tue, 03 Jan 2017 14:04:22 +0000 Received: from [85.158.139.211] by server-10.bemta-5.messagelabs.com id E6/AE-04988-56FAB685; Tue, 03 Jan 2017 14:04:21 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprAIsWRWlGSWpSXmKPExsUyZ7p8oG7K+uw IgxfPLC2WfFzM4sDocXT3b6YAxijWzLyk/IoE1ow991YxFuw3r/j0Yh5bA+NynS5GLg4hgQlM Eh1zn7BCOL8YJd4vnM4G4WxglJjS+QbKmcAosXTnSuYuRk4ONgEjibNHpzOC2CIC0hLXPl9mB CliFnjKKPF7/30WkISwgI3Eoekgozg5WARUJT4c2wLWwCvgKbH+dQcTiC0hICdx81wn2FBOAS +JtTtugtULAdX8nfGUBaLGUOL0w22MExj5FjAyrGLUKE4tKkst0jUy1EsqykzPKMlNzMzRNTQ w1ctNLS5OTE/NSUwq1kvOz93ECAyXegYGxh2Mdyf7HWKU5GBSEuWNZsiOEOJLyk+pzEgszogv Ks1JLT7EKMPBoSTB67EOKCdYlJqeWpGWmQMMXJi0BAePkgjvsbVAad7igsTc4sx0iNQpRmOOa c8WP2XiWHJj3VMmIZa8/LxUKXFeSZBJAiClGaV5cINgEXWJUVZKmJeRgYFBiKcgtSg3swRV/h WjOAejkjCvPMgUnsy8Erh9r4BOYQI6ZXsA2CkliQgpqQbG8i1BfX3x4WlPX6id2Gw14aGKGM+ fb29+vOp6yqPNuzt93kYxkbJIkTT3Owcrziu9mivofcM5Zsf8q3MLl9bPY1A2a9cPZXu1Pdn0 oyej6wMjvlP/t+xy3TvbNUhhQvRJs88M3/87S85UFfGpm6klcEzzyFWryfPuvytQD16YFnfbS v+o48mzSizFGYmGWsxFxYkASZ0nsaMCAAA= X-Env-Sender: boris.ostrovsky@oracle.com X-Msg-Ref: server-15.tower-206.messagelabs.com!1483452259!64149131!1 X-Originating-IP: [156.151.31.81] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogMTU2LjE1MS4zMS44MSA9PiAyODgzMzk=\n X-StarScan-Received: X-StarScan-Version: 9.1.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 30642 invoked from network); 3 Jan 2017 14:04:20 -0000 Received: from userp1040.oracle.com (HELO userp1040.oracle.com) (156.151.31.81) by server-15.tower-206.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 3 Jan 2017 14:04:20 -0000 Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v03E4CEQ005398 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 3 Jan 2017 14:04:12 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v03E4Bfi006495 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 3 Jan 2017 14:04:11 GMT Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v03E4AVn032530; Tue, 3 Jan 2017 14:04:10 GMT Received: from ostr-laptop.us.oracle.com (/10.152.23.90) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 03 Jan 2017 06:04:10 -0800 From: Boris Ostrovsky To: xen-devel@lists.xen.org Date: Tue, 3 Jan 2017 09:04:05 -0500 Message-Id: <1483452256-2879-2-git-send-email-boris.ostrovsky@oracle.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1483452256-2879-1-git-send-email-boris.ostrovsky@oracle.com> References: <1483452256-2879-1-git-send-email-boris.ostrovsky@oracle.com> X-Source-IP: userv0021.oracle.com [156.151.31.71] Cc: wei.liu2@citrix.com, andrew.cooper3@citrix.com, ian.jackson@eu.citrix.com, jbeulich@suse.com, Boris Ostrovsky , Daniel De Graaf , roger.pau@citrix.com Subject: [Xen-devel] [PATCH v6 01/12] domctl: Add XEN_DOMCTL_acpi_access X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP This domctl will allow toolstack to read and write some ACPI registers. It will be available to both x86 and ARM but will be implemented first only for x86 Signed-off-by: Boris Ostrovsky Acked-by: Daniel De Graaf --- CC: Daniel De Graaf --- Changes in v6: * Fold xen_acpi_access into xen_domctl_acpi_access * Some new error return values tools/flask/policy/modules/dom0.te | 2 +- tools/flask/policy/modules/xen.if | 4 ++-- xen/arch/x86/domctl.c | 7 +++++++ xen/arch/x86/hvm/Makefile | 1 + xen/arch/x86/hvm/acpi.c | 24 ++++++++++++++++++++++++ xen/include/asm-x86/hvm/domain.h | 3 +++ xen/include/public/domctl.h | 17 +++++++++++++++++ xen/xsm/flask/hooks.c | 3 +++ xen/xsm/flask/policy/access_vectors | 2 ++ 9 files changed, 60 insertions(+), 3 deletions(-) create mode 100644 xen/arch/x86/hvm/acpi.c diff --git a/tools/flask/policy/modules/dom0.te b/tools/flask/policy/modules/dom0.te index d0a4d91..475d446 100644 --- a/tools/flask/policy/modules/dom0.te +++ b/tools/flask/policy/modules/dom0.te @@ -39,7 +39,7 @@ allow dom0_t dom0_t:domain { }; allow dom0_t dom0_t:domain2 { set_cpuid gettsc settsc setscheduler set_max_evtchn set_vnumainfo - get_vnumainfo psr_cmt_op psr_cat_op + get_vnumainfo psr_cmt_op psr_cat_op acpi_access }; allow dom0_t dom0_t:resource { add remove }; diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index 1aca75d..42a8cc2 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -52,7 +52,7 @@ define(`create_domain_common', ` settime setdomainhandle getvcpucontext set_misc_info }; allow $1 $2:domain2 { set_cpuid settsc setscheduler setclaim set_max_evtchn set_vnumainfo get_vnumainfo cacheflush - psr_cmt_op psr_cat_op soft_reset }; + psr_cmt_op psr_cat_op soft_reset acpi_access }; allow $1 $2:security check_context; allow $1 $2:shadow enable; allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp }; @@ -85,7 +85,7 @@ define(`manage_domain', ` getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume setpodtarget getpodtarget }; - allow $1 $2:domain2 set_vnumainfo; + allow $1 $2:domain2 { set_vnumainfo acpi_access }; ') # migrate_domain_out(priv, target) diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index ab9ad39..2904e49 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -1425,6 +1425,13 @@ long arch_do_domctl( } break; + case XEN_DOMCTL_acpi_access: + if ( !is_hvm_domain(d) ) + ret = -ENODEV; + else + ret = hvm_acpi_domctl_access(d, &domctl->u.acpi_access); + break; + default: ret = iommu_do_domctl(domctl, d, u_domctl); break; diff --git a/xen/arch/x86/hvm/Makefile b/xen/arch/x86/hvm/Makefile index f750d13..bae3244 100644 --- a/xen/arch/x86/hvm/Makefile +++ b/xen/arch/x86/hvm/Makefile @@ -1,6 +1,7 @@ subdir-y += svm subdir-y += vmx +obj-y += acpi.o obj-y += asid.o obj-y += emulate.o obj-y += hpet.o diff --git a/xen/arch/x86/hvm/acpi.c b/xen/arch/x86/hvm/acpi.c new file mode 100644 index 0000000..04901c1 --- /dev/null +++ b/xen/arch/x86/hvm/acpi.c @@ -0,0 +1,24 @@ +/* acpi.c: ACPI access handling + * + * Copyright (c) 2016 Oracle and/or its affiliates. All rights reserved. + */ +#include +#include +#include + + +int hvm_acpi_domctl_access(struct domain *d, + const struct xen_domctl_acpi_access *access) +{ + return -ENOSYS; +} + +/* + * Local variables: + * mode: C + * c-file-style: "BSD" + * c-basic-offset: 4 + * tab-width: 4 + * indent-tabs-mode: nil + * End: + */ diff --git a/xen/include/asm-x86/hvm/domain.h b/xen/include/asm-x86/hvm/domain.h index d55d180..52f934a 100644 --- a/xen/include/asm-x86/hvm/domain.h +++ b/xen/include/asm-x86/hvm/domain.h @@ -166,6 +166,9 @@ struct hvm_domain { #define hap_enabled(d) ((d)->arch.hvm_domain.hap_enabled) +int hvm_acpi_domctl_access(struct domain *d, + const struct xen_domctl_acpi_access *access); + #endif /* __ASM_X86_HVM_DOMAIN_H__ */ /* diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h index 85cbb7c..5978664 100644 --- a/xen/include/public/domctl.h +++ b/xen/include/public/domctl.h @@ -1145,6 +1145,21 @@ struct xen_domctl_psr_cat_op { typedef struct xen_domctl_psr_cat_op xen_domctl_psr_cat_op_t; DEFINE_XEN_GUEST_HANDLE(xen_domctl_psr_cat_op_t); +struct xen_domctl_acpi_access { +#define XEN_DOMCTL_ACPI_READ 0 +#define XEN_DOMCTL_ACPI_WRITE 1 + uint8_t rw; /* IN: Read or write */ +#define XEN_ACPI_SYSTEM_MEMORY 0 +#define XEN_ACPI_SYSTEM_IO 1 + uint8_t space_id; /* IN: Address space */ + uint8_t width; /* IN: Access size (bytes) */ + uint8_t pad[5]; + uint64_aligned_t address; /* IN: 64-bit address of register */ + XEN_GUEST_HANDLE_64(void) val; /* IN/OUT: data */ +}; +typedef struct xen_domctl_acpi_access xen_domctl_acpi_access_t; +DEFINE_XEN_GUEST_HANDLE(xen_domctl_acpi_access_t); + struct xen_domctl { uint32_t cmd; #define XEN_DOMCTL_createdomain 1 @@ -1222,6 +1237,7 @@ struct xen_domctl { #define XEN_DOMCTL_monitor_op 77 #define XEN_DOMCTL_psr_cat_op 78 #define XEN_DOMCTL_soft_reset 79 +#define XEN_DOMCTL_acpi_access 80 #define XEN_DOMCTL_gdbsx_guestmemio 1000 #define XEN_DOMCTL_gdbsx_pausevcpu 1001 #define XEN_DOMCTL_gdbsx_unpausevcpu 1002 @@ -1284,6 +1300,7 @@ struct xen_domctl { struct xen_domctl_psr_cmt_op psr_cmt_op; struct xen_domctl_monitor_op monitor_op; struct xen_domctl_psr_cat_op psr_cat_op; + struct xen_domctl_acpi_access acpi_access; uint8_t pad[128]; } u; }; diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 040a251..c1ba42e 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -748,6 +748,9 @@ static int flask_domctl(struct domain *d, int cmd) case XEN_DOMCTL_soft_reset: return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__SOFT_RESET); + case XEN_DOMCTL_acpi_access: + return current_has_perm(d, SECCLASS_DOMAIN2, DOMAIN2__ACPI_ACCESS); + default: return avc_unknown_permission("domctl", cmd); } diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 92e6da9..e40258e 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -246,6 +246,8 @@ class domain2 mem_sharing # XEN_DOMCTL_psr_cat_op psr_cat_op +# XEN_DOMCTL_acpi_access + acpi_access } # Similar to class domain, but primarily contains domctls related to HVM domains