From patchwork Thu Mar 17 01:38:52 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Konrad Rzeszutek Wilk X-Patchwork-Id: 8606601 Return-Path: X-Original-To: patchwork-xen-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 443C59F6E1 for ; Thu, 17 Mar 2016 01:42:15 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 64E23202E6 for ; Thu, 17 Mar 2016 01:42:11 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 68B2620279 for ; Thu, 17 Mar 2016 01:42:09 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1agMuD-0007aP-Qt; Thu, 17 Mar 2016 01:39:17 +0000 Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1agMuC-0007aE-Ui for xen-devel@lists.xenproject.org; Thu, 17 Mar 2016 01:39:17 +0000 Received: from [193.109.254.147] by server-6.bemta-14.messagelabs.com id C0/CC-03497-4CA0AE65; Thu, 17 Mar 2016 01:39:16 +0000 X-Env-Sender: konrad@char.us.oracle.com X-Msg-Ref: server-13.tower-27.messagelabs.com!1458178753!31819324!1 X-Originating-IP: [156.151.31.81] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogMTU2LjE1MS4zMS44MSA9PiAyODgzMzk=\n X-StarScan-Received: X-StarScan-Version: 8.11; banners=-,-,- X-VirusChecked: Checked Received: (qmail 15712 invoked from network); 17 Mar 2016 01:39:15 -0000 Received: from userp1040.oracle.com (HELO userp1040.oracle.com) (156.151.31.81) by server-13.tower-27.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 17 Mar 2016 01:39:15 -0000 Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id u2H1cuSZ030567 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 17 Mar 2016 01:38:56 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.13.8/8.13.8) with ESMTP id u2H1ctjD000631 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Thu, 17 Mar 2016 01:38:56 GMT Received: from abhmp0004.oracle.com (abhmp0004.oracle.com [141.146.116.10]) by aserv0122.oracle.com (8.13.8/8.13.8) with ESMTP id u2H1csva003726; Thu, 17 Mar 2016 01:38:54 GMT Received: from char.us.oracle.com (/10.137.176.158) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 16 Mar 2016 18:38:54 -0700 Received: by char.us.oracle.com (Postfix, from userid 1000) id 98F106A00B6; Wed, 16 Mar 2016 21:38:52 -0400 (EDT) Date: Wed, 16 Mar 2016 21:38:52 -0400 From: Konrad Rzeszutek Wilk To: Konrad Rzeszutek Wilk Message-ID: <20160317013852.GA22460@char.us.oracle.com> References: <1458064616-23101-1-git-send-email-konrad.wilk@oracle.com> <1458064616-23101-5-git-send-email-konrad.wilk@oracle.com> <56E85478.5070408@citrix.com> <20160315201906.GA6211@localhost.localdomain> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20160315201906.GA6211@localhost.localdomain> User-Agent: Mutt/1.5.24 (2015-08-30) X-Source-IP: userv0021.oracle.com [156.151.31.71] Cc: Wei Liu , Stefano Stabellini , Andrew Cooper , Ian Jackson , mpohlack@amazon.de, ross.lagerwall@citrix.com, Julien Grall , Stefano Stabellini , Jan Beulich , xen-devel@lists.xenproject.org, sasha.levin@oracle.com, Daniel De Graaf , Keir Fraser Subject: Re: [Xen-devel] [PATCH v4 04/34] HYPERCALL_version_op. New hypercall mirroring XENVER_ but sane. X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP > > > + > > > + if ( !rc ) > > > + { > > > + ssize_t bytes; > > > + > > > + if ( sz > len ) > > > + bytes = len; > > > + else > > > + bytes = sz; > > > + > > > + if ( copy_to_guest(arg, ptr ? ptr : &u, bytes) ) > > > > Can be shortened to ptr ?: &u > > > > > + rc = -EFAULT; > > > + } > > > + if ( !rc ) > > ^^^^^^^^^ - here > > > + { > > > + /* > > > + * We return len (truncate) worth of data even if we fail. > > > + */ > > > + if ( sz > len ) > > > + rc = -ENOBUFS; > > > > This needs to be in the previous if() clause to avoid overriding -EFAULT > > with -ENOBUFS. > > That is exactly why it is in its own 'if ( !rc )' - so it won't > overwrite -EFAULT. See above for 'here' All changes incorporated. This is what the patch ends up looking: From 534f9277aebb9b89b937a79dd33c0a7016ce00a2 Mon Sep 17 00:00:00 2001 From: Konrad Rzeszutek Wilk Date: Wed, 16 Mar 2016 15:48:56 -0400 Subject: [PATCH v4 05/35] HYPERCALL_version_op. New hypercall mirroring XENVER_ but sane. This hypercall mirrors the XENVER_ in that it has similar functionality. However it is designed differently: - No compat layer. The data structures are the same size on 32 as on 64-bit. - The hypercall accepts three arguments - the command, pointer to an buffer, and the length of the buffer. - Each sub-ops can be "probed" for size by returning the size of buffer that will be needed - if the buffer is NULL. - Subops can complete even if the buffer is too slow - truncated data will be filled and hypercall will return -ENOBUFS. - VERSION_OP_commandline, VERSION_OP_changeset are privileged. - There are no XENVER_compile_info equivalent. - The hypercall can return -EPERM and toolstack/OSes are expected to deal with it. Suggested-by: Andrew Cooper Signed-off-by: Konrad Rzeszutek Wilk --- Cc: Daniel De Graaf Cc: Ian Jackson Cc: Stefano Stabellini Cc: Wei Liu Cc: Stefano Stabellini Cc: Julien Grall Cc: Keir Fraser Cc: Jan Beulich Cc: Andrew Cooper v2: Remove memset and use {}. Tweak copy_to_guest and capabilities_info, add ASSERT(sz) per Andrew's review. --- --- tools/flask/policy/policy/modules/xen/xen.te | 9 +- xen/arch/arm/traps.c | 1 + xen/arch/x86/hvm/hvm.c | 1 + xen/arch/x86/x86_64/compat/entry.S | 2 + xen/arch/x86/x86_64/entry.S | 2 + xen/common/compat/kernel.c | 3 + xen/common/kernel.c | 259 +++++++++++++++++++++++---- xen/include/public/arch-arm.h | 3 + xen/include/public/version.h | 72 +++++++- xen/include/public/xen.h | 1 + xen/include/xen/hypercall.h | 4 + xen/include/xsm/dummy.h | 19 ++ xen/include/xsm/xsm.h | 7 + xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 39 ++++ xen/xsm/flask/policy/access_vectors | 24 ++- 16 files changed, 404 insertions(+), 43 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index 7e7400d..bea40c1 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -74,12 +74,14 @@ allow dom0_t xen_t:xen2 { get_symbol }; -# Allow dom0 to use all XENVER_ subops +# Allow dom0 to use all XENVER_ subops and VERSION_OP subops # Note that dom0 is part of domain_type so this has duplicates. allow dom0_t xen_t:version { xen_version xen_extraversion xen_compile_info xen_capabilities xen_changeset xen_platform_parameters xen_get_features xen_pagesize xen_guest_handle xen_commandline + version extraversion capabilities changeset platform_parameters + get_features pagesize guest_handle commandline }; allow dom0_t xen_t:mmu memorymap; @@ -146,11 +148,14 @@ if (guest_writeconsole) { # pmu_ctrl is for) allow domain_type xen_t:xen2 pmu_use; -# For normal guests all except XENVER_commandline +# For normal guests all except XENVER_commandline, VERSION_OP_changeset, +# and VERSION_OP_commandline allow domain_type xen_t:version { xen_version xen_extraversion xen_compile_info xen_capabilities xen_changeset xen_platform_parameters xen_get_features xen_pagesize xen_guest_handle + version extraversion capabilities platform_parameters + get_features pagesize guest_handle }; ############################################################################### # diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 83744e8..31d2115 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -1235,6 +1235,7 @@ static arm_hypercall_t arm_hypercall_table[] = { HYPERCALL(multicall, 2), HYPERCALL(platform_op, 1), HYPERCALL_ARM(vcpu_op, 3), + HYPERCALL(version_op, 3), }; #ifndef NDEBUG diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 255a1d6..56b9f6b 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -5332,6 +5332,7 @@ static const struct { COMPAT_CALL(platform_op), COMPAT_CALL(mmuext_op), HYPERCALL(xenpmu_op), + HYPERCALL(version_op), HYPERCALL(arch_1) }; diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 5218f8a..cc49f4a 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -395,6 +395,7 @@ ENTRY(compat_hypercall_table) .quad do_tmem_op .quad do_ni_hypercall /* reserved for XenClient */ .quad do_xenpmu_op /* 40 */ + .quad do_version_op .rept __HYPERVISOR_arch_0-((.-compat_hypercall_table)/8) .quad compat_ni_hypercall .endr @@ -446,6 +447,7 @@ ENTRY(compat_hypercall_args_table) .byte 1 /* do_tmem_op */ .byte 0 /* reserved for XenClient */ .byte 2 /* do_xenpmu_op */ /* 40 */ + .byte 3 /* do_version_op */ .rept __HYPERVISOR_arch_0-(.-compat_hypercall_args_table) .byte 0 /* compat_ni_hypercall */ .endr diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index cab9763..3a350e0 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -731,6 +731,7 @@ ENTRY(hypercall_table) .quad do_tmem_op .quad do_ni_hypercall /* reserved for XenClient */ .quad do_xenpmu_op /* 40 */ + .quad do_version_op .rept __HYPERVISOR_arch_0-((.-hypercall_table)/8) .quad do_ni_hypercall .endr @@ -782,6 +783,7 @@ ENTRY(hypercall_args_table) .byte 1 /* do_tmem_op */ .byte 0 /* reserved for XenClient */ .byte 2 /* do_xenpmu_op */ /* 40 */ + .byte 3 /* do_version_op */ .rept __HYPERVISOR_arch_0-(.-hypercall_args_table) .byte 0 /* do_ni_hypercall */ .endr diff --git a/xen/common/compat/kernel.c b/xen/common/compat/kernel.c index dc898ae..b763318 100644 --- a/xen/common/compat/kernel.c +++ b/xen/common/compat/kernel.c @@ -34,6 +34,9 @@ CHECK_TYPE(capabilities_info); CHECK_TYPE(domain_handle); +CHECK_TYPE(version_op_buf); +CHECK_TYPE(version_op_val); + #ifdef COMPAT_VM_ASSIST_VALID #undef VM_ASSIST_VALID #define VM_ASSIST_VALID COMPAT_VM_ASSIST_VALID diff --git a/xen/common/kernel.c b/xen/common/kernel.c index 2699ac0..4ab4640 100644 --- a/xen/common/kernel.c +++ b/xen/common/kernel.c @@ -221,6 +221,47 @@ void __init do_initcalls(void) #endif +static int get_features(struct domain *d, xen_feature_info_t *fi) +{ + switch ( fi->submap_idx ) + { + case 0: + fi->submap = (1U << XENFEAT_memory_op_vnode_supported); + if ( VM_ASSIST(d, pae_extended_cr3) ) + fi->submap |= (1U << XENFEAT_pae_pgdir_above_4gb); + if ( paging_mode_translate(d) ) + fi->submap |= + (1U << XENFEAT_writable_page_tables) | + (1U << XENFEAT_auto_translated_physmap); + if ( is_hardware_domain(d) ) + fi->submap |= 1U << XENFEAT_dom0; +#ifdef CONFIG_X86 + switch ( d->guest_type ) + { + case guest_type_pv: + fi->submap |= (1U << XENFEAT_mmu_pt_update_preserve_ad) | + (1U << XENFEAT_highmem_assist) | + (1U << XENFEAT_gnttab_map_avail_bits); + break; + case guest_type_pvh: + fi->submap |= (1U << XENFEAT_hvm_safe_pvclock) | + (1U << XENFEAT_supervisor_mode_kernel) | + (1U << XENFEAT_hvm_callback_vector); + break; + case guest_type_hvm: + fi->submap |= (1U << XENFEAT_hvm_safe_pvclock) | + (1U << XENFEAT_hvm_callback_vector) | + (1U << XENFEAT_hvm_pirqs); + break; + } +#endif + break; + default: + return -EINVAL; + } + return 0; +} + /* * Simple hypercalls. */ @@ -302,50 +343,16 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) case XENVER_get_features: { xen_feature_info_t fi; - struct domain *d = current->domain; if ( copy_from_guest(&fi, arg, 1) ) return -EFAULT; - switch ( fi.submap_idx ) + if ( !deny ) { - case 0: - if ( deny ) - break; - fi.submap = (1U << XENFEAT_memory_op_vnode_supported); - if ( VM_ASSIST(d, pae_extended_cr3) ) - fi.submap |= (1U << XENFEAT_pae_pgdir_above_4gb); - if ( paging_mode_translate(d) ) - fi.submap |= - (1U << XENFEAT_writable_page_tables) | - (1U << XENFEAT_auto_translated_physmap); - if ( is_hardware_domain(d) ) - fi.submap |= 1U << XENFEAT_dom0; -#ifdef CONFIG_X86 - switch ( d->guest_type ) - { - case guest_type_pv: - fi.submap |= (1U << XENFEAT_mmu_pt_update_preserve_ad) | - (1U << XENFEAT_highmem_assist) | - (1U << XENFEAT_gnttab_map_avail_bits); - break; - case guest_type_pvh: - fi.submap |= (1U << XENFEAT_hvm_safe_pvclock) | - (1U << XENFEAT_supervisor_mode_kernel) | - (1U << XENFEAT_hvm_callback_vector); - break; - case guest_type_hvm: - fi.submap |= (1U << XENFEAT_hvm_safe_pvclock) | - (1U << XENFEAT_hvm_callback_vector) | - (1U << XENFEAT_hvm_pirqs); - break; - } -#endif - break; - default: - return -EINVAL; + int rc = get_features(current->domain, &fi); + if ( rc ) + return rc; } - if ( __copy_to_guest(arg, &fi, 1) ) return -EFAULT; return 0; @@ -388,6 +395,182 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) return -ENOSYS; } +static const char *capabilities_info(ssize_t *len) +{ + static xen_capabilities_info_t cached_cap; + static unsigned int cached_cap_len; + static bool_t cached; + + if ( unlikely(!cached) ) + { + arch_get_xen_caps(&cached_cap); + cached_cap_len = strlen(cached_cap) + 1; + } + + *len = cached_cap_len; + return cached_cap; +} + +static int size_of_subops_data(unsigned int cmd, ssize_t *sz) +{ + int rc = 0; + /* Compute size. */ + switch ( cmd ) + { + case XEN_VERSION_OP_version: + *sz = sizeof(xen_version_op_val_t); + break; + + case XEN_VERSION_OP_extraversion: + *sz = strlen(xen_extra_version()) + 1; + break; + + case XEN_VERSION_OP_capabilities: + capabilities_info(sz); + break; + + case XEN_VERSION_OP_platform_parameters: + *sz = sizeof(xen_version_op_val_t); + break; + + case XEN_VERSION_OP_changeset: + *sz = strlen(xen_changeset()) + 1; + break; + + case XEN_VERSION_OP_get_features: + *sz = sizeof(xen_feature_info_t); + break; + + case XEN_VERSION_OP_pagesize: + *sz = sizeof(xen_version_op_val_t); + break; + + case XEN_VERSION_OP_guest_handle: + *sz = ARRAY_SIZE(current->domain->handle); + break; + + case XEN_VERSION_OP_commandline: + *sz = ARRAY_SIZE(saved_cmdline); + break; + + default: + rc = -ENOSYS; + } + + return rc; +} + +/* + * Similar to HYPERVISOR_xen_version but with a sane interface + * (has a length, one can probe for the length) and with one less sub-ops: + * missing XENVER_compile_info. + */ +DO(version_op)(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg, + unsigned int len) +{ + union { + xen_version_op_val_t n; + xen_feature_info_t fi; + } u = {}; + ssize_t sz = 0; + const void *ptr = NULL; + int rc = xsm_version_op(XSM_OTHER, cmd); + + /* We can safely return -EPERM! */ + if ( rc ) + return rc; + + rc = size_of_subops_data(cmd, &sz); + if ( rc ) + return rc; + + ASSERT(sz); + /* + * This hypercall also allows the client to probe. If it provides + * a NULL arg we will return the size of the space it has to + * allocate for the specific sub-op. + */ + if ( guest_handle_is_null(arg) ) + return sz; + + /* + * The HYPERVISOR_xen_version differs in that some return the value, + * and some copy it on back on argument. We follow the same rule for all + * sub-ops: return 0 on success, positive value of bytes returned, and + * always copy the result in arg. Yeey sanity! + */ + + switch ( cmd ) + { + case XEN_VERSION_OP_version: + u.n = (xen_major_version() << 16) | xen_minor_version(); + break; + + case XEN_VERSION_OP_extraversion: + ptr = xen_extra_version(); + break; + + case XEN_VERSION_OP_capabilities: + ptr = capabilities_info(&sz); + break; + + case XEN_VERSION_OP_platform_parameters: + u.n = HYPERVISOR_VIRT_START; + break; + + case XEN_VERSION_OP_changeset: + ptr = xen_changeset(); + break; + + case XEN_VERSION_OP_get_features: + if ( copy_from_guest(&u.fi, arg, 1) ) + { + rc = -EFAULT; + break; + } + rc = get_features(current->domain, &u.fi); + break; + + case XEN_VERSION_OP_pagesize: + u.n = PAGE_SIZE; + break; + + case XEN_VERSION_OP_guest_handle: + ptr = current->domain->handle; + break; + + case XEN_VERSION_OP_commandline: + ptr = saved_cmdline; + break; + + default: + rc = -ENOSYS; + } + + if ( !rc ) + { + ssize_t bytes; + + if ( sz > len ) + bytes = len; + else + bytes = sz; + + if ( copy_to_guest(arg, ptr ? : &u, bytes) ) + rc = -EFAULT; + } + if ( !rc ) + { + /* + * We return len (truncate) worth of data even if we fail. + */ + if ( sz > len ) + rc = -ENOBUFS; + } + + return rc == 0 ? sz : rc; +} + DO(nmi_op)(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { struct xennmi_callback cb; diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h index 870bc3b..c9ae315 100644 --- a/xen/include/public/arch-arm.h +++ b/xen/include/public/arch-arm.h @@ -128,6 +128,9 @@ * * VCPUOP_register_vcpu_info * * VCPUOP_register_runstate_memory_area * + * HYPERVISOR_version_op + * All generic sub-operations + * * * Other notes on the ARM ABI: * diff --git a/xen/include/public/version.h b/xen/include/public/version.h index 24a582f..a025489 100644 --- a/xen/include/public/version.h +++ b/xen/include/public/version.h @@ -30,7 +30,15 @@ #include "xen.h" -/* NB. All ops return zero on success, except XENVER_{version,pagesize} */ +/* + * There are two hypercalls mentioned in here. The XENVER_ are for + * HYPERCALL_xen_version (17), while VERSION_OP_ are for the + * HYPERCALL_version_op (41). + * + * The subops are very similar except that the later hypercall has a + * sane interface. + */ + /* arg == NULL; returns major:minor (16:16). */ #define XENVER_version 0 @@ -87,6 +95,68 @@ typedef struct xen_feature_info xen_feature_info_t; #define XENVER_commandline 9 typedef char xen_commandline_t[1024]; + + +/* + * The HYPERCALL_version_op has a set of sub-ops which mirror the + * sub-ops of HYPERCALL_xen_version. However this hypercall differs + * radically from the former: + * - It returns the amount of bytes returned. + * - It will return -XEN_EPERM if the guest is not permitted. + * - It will return the requested data in arg. + * - It requires an third argument (len) for the length of the + * arg. Naturally the arg has to fit the requested data otherwise + * -XEN_ENOBUFS is returned. + * + * It also offers an mechanism to probe for the amount of bytes an + * sub-op will require. Having the arg have an NULL pointer will + * return the number of bytes requested for the operation. Or an + * negative value if an error is encountered. + */ + +typedef uint64_t xen_version_op_val_t; +DEFINE_XEN_GUEST_HANDLE(xen_version_op_val_t); + +typedef void xen_version_op_buf_t; +DEFINE_XEN_GUEST_HANDLE(xen_version_op_buf_t); + +/* arg == version_op_val_t. Encoded as major:minor (31..16:15..0) */ +#define XEN_VERSION_OP_version 0 + +/* arg == version_op_buf. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_OP_extraversion 1 + +/* arg == version_op_buf. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_OP_capabilities 3 + +/* arg == version_op_buf. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_OP_changeset 4 + +/* + * arg == xen_version_op_val_t. Contains the virtual address + * of the hypervisor encoded as [63..0]. + */ +#define XEN_VERSION_OP_platform_parameters 5 + +/* + * arg = xen_feature_info_t - shares the same structure + * as the XENVER_get_features. + */ +#define XEN_VERSION_OP_get_features 6 + +/* arg == xen_version_op_val_t. */ +#define XEN_VERSION_OP_pagesize 7 + +/* arg == version_op_buf. + * + * The toolstack fills it out for guest consumption. It is intended to hold + * the UUID of the guest. + */ +#define XEN_VERSION_OP_guest_handle 8 + +/* arg = version_op_buf. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_OP_commandline 9 + #endif /* __XEN_PUBLIC_VERSION_H__ */ /* diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h index 64ba7ab..1a99929 100644 --- a/xen/include/public/xen.h +++ b/xen/include/public/xen.h @@ -115,6 +115,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_ulong_t); #define __HYPERVISOR_tmem_op 38 #define __HYPERVISOR_xc_reserved_op 39 /* reserved for XenClient */ #define __HYPERVISOR_xenpmu_op 40 +#define __HYPERVISOR_version_op 41 /* supersedes xen_version (17) */ /* Architecture-specific hypercall definitions. */ #define __HYPERVISOR_arch_0 48 diff --git a/xen/include/xen/hypercall.h b/xen/include/xen/hypercall.h index 0c8ae0e..e8d2b81 100644 --- a/xen/include/xen/hypercall.h +++ b/xen/include/xen/hypercall.h @@ -147,6 +147,10 @@ do_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg); extern long do_xenpmu_op(unsigned int op, XEN_GUEST_HANDLE_PARAM(xen_pmu_params_t) arg); +extern long +do_version_op(unsigned int cmd, + XEN_GUEST_HANDLE_PARAM(void) arg, unsigned int len); + #ifdef CONFIG_COMPAT extern int diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index 94b8855..8c6ae90 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -749,3 +749,22 @@ static XSM_INLINE int xsm_xen_version (XSM_DEFAULT_ARG uint32_t op) return xsm_default_action(XSM_PRIV, current->domain, NULL); } } + +static XSM_INLINE int xsm_version_op (XSM_DEFAULT_ARG uint32_t op) +{ + XSM_ASSERT_ACTION(XSM_OTHER); + switch ( op ) + { + case XEN_VERSION_OP_version: + case XEN_VERSION_OP_extraversion: + case XEN_VERSION_OP_capabilities: + case XEN_VERSION_OP_platform_parameters: + case XEN_VERSION_OP_get_features: + case XEN_VERSION_OP_pagesize: + case XEN_VERSION_OP_guest_handle: + /* These MUST always be accessible to any guest by default. */ + return xsm_default_action(XSM_HOOK, current->domain, NULL); + default: + return xsm_default_action(XSM_PRIV, current->domain, NULL); + } +} diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index db440f6..ac80472 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -194,6 +194,7 @@ struct xsm_operations { int (*pmu_op) (struct domain *d, unsigned int op); #endif int (*xen_version) (uint32_t cmd); + int (*version_op) (uint32_t cmd); }; #ifdef CONFIG_XSM @@ -736,6 +737,12 @@ static inline int xsm_xen_version (xsm_default_t def, uint32_t op) { return xsm_ops->xen_version(op); } + +static inline int xsm_version_op (xsm_default_t def, uint32_t op) +{ + return xsm_ops->version_op(op); +} + #endif /* XSM_NO_WRAPPERS */ #ifdef CONFIG_MULTIBOOT diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 9791ad4..776dd09 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -163,4 +163,5 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, pmu_op); #endif set_to_dummy_if_null(ops, xen_version); + set_to_dummy_if_null(ops, version_op); } diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index d1bef43..2510229 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1662,6 +1662,44 @@ static int flask_xen_version (uint32_t op) } } +static int flask_version_op (uint32_t op) +{ + u32 dsid = domain_sid(current->domain); + + switch ( op ) + { + case XEN_VERSION_OP_version: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__VERSION, NULL); + case XEN_VERSION_OP_extraversion: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__EXTRAVERSION, NULL); + case XEN_VERSION_OP_capabilities: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__CAPABILITIES, NULL); + case XEN_VERSION_OP_changeset: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__CHANGESET, NULL); + case XEN_VERSION_OP_platform_parameters: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__PLATFORM_PARAMETERS, NULL); + case XEN_VERSION_OP_get_features: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__GET_FEATURES, NULL); + case XEN_VERSION_OP_pagesize: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__PAGESIZE, NULL); + case XEN_VERSION_OP_guest_handle: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__GUEST_HANDLE, NULL); + case XEN_VERSION_OP_commandline: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__COMMANDLINE, NULL); + default: + return -EPERM; + } +} + long do_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op); int compat_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op); @@ -1801,6 +1839,7 @@ static struct xsm_operations flask_ops = { .pmu_op = flask_pmu_op, #endif .xen_version = flask_xen_version, + .version_op = flask_version_op, }; static __init void flask_init(void) diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index 628dd5c..59c9f69 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -496,9 +496,10 @@ class security del_ocontext } -# Class version is used to describe the XENVER_ hypercall. +# Class version is used to describe the XENVER_ and VERSION_OP hypercall. # Each sub-ops is described here - in the default case all of them should -# be allowed except the XENVER_commandline. +# be allowed except the XENVER_commandline, VERSION_OP_commandline, and +# VERSION_OP_changeset. # class version { @@ -522,4 +523,23 @@ class version xen_guest_handle # Xen command line. xen_commandline + +# Often called by PV kernels to force an callback. + version +# Extra informations (-unstable). + extraversion +# Such as "xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64". + capabilities +# Such as the virtual address of where the hypervisor resides. + platform_parameters +# Source code changeset. + changeset +# The features the hypervisor supports. + get_features +# Page size the hypervisor uses. + pagesize +# An value that the control stack can choose. + guest_handle +# Xen command line. + commandline }