From patchwork Tue Apr 4 15:24:35 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tamas Lengyel X-Patchwork-Id: 9661873 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 68EBC6032D for ; Tue, 4 Apr 2017 15:27:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5AFD025EA6 for ; Tue, 4 Apr 2017 15:27:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4F97A26419; Tue, 4 Apr 2017 15:27:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.6 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,RCVD_IN_SORBS_SPAM,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4088025EA6 for ; Tue, 4 Apr 2017 15:27:19 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cvQK7-00016w-3h; Tue, 04 Apr 2017 15:24:47 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cvQK5-00016o-LV for xen-devel@lists.xenproject.org; Tue, 04 Apr 2017 15:24:45 +0000 Received: from [193.109.254.147] by server-11.bemta-6.messagelabs.com id 32/C7-03642-CBAB3E85; Tue, 04 Apr 2017 15:24:44 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprKIsWRWlGSWpSXmKPExsXiVRvkqLtn1+M Ig5MLmSy+b5nM5MDocfjDFZYAxijWzLyk/IoE1oyrhwQK5jQzVvyY8oy1gfFZahcjF4eQwHRG iWddl5lBHBaBNywS0/7MZAdxJATesUh8vbaCpYuRE8iJkTh0+ikbhF0m8fHgPjBbSEBT4uCGM 8wQoyYxSey/M48ZJMEmYCRx9WoPWJGIgJLEvVWTmUBsZoH/jBL71waA2MICnhKLptwCW8AioC oxv38LI4jNK2AnceTVbnaIZfISu9ousk5g5FvAyLCKUaM4tagstUjXyEQvqSgzPaMkNzEzR9f QwEwvN7W4ODE9NScxqVgvOT93EyMwWBiAYAfjvo+RhxglOZiURHm91zyOEOJLyk+pzEgszogv Ks1JLT7EKMPBoSTBy7wTKCdYlJqeWpGWmQMMW5i0BAePkggvMzB0hXiLCxJzizPTIVKnGC055 sze/YaJo+fjASD5of/wGyYhlrz8vFQpcd5ekHkCIA0ZpXlw42CxdYlRVkqYlxHoQCGegtSi3M wSVPlXjOIcjErCvCIgU3gy80rgtr4COogJ6KAndx6CHFSSiJCSamBc4HmgerHE8eVqm78G9t0 wXvfQ92BINNekxpCUjOWXWCK82Qo8P87WfafdtfqL3wqOZa8kJS7EfVjuevjostbYWbmPDojd P2rwvm5T1k/pTc+/fnlqqj7/y9dlPqzS7AUezj03lO93Hs3QvyP96rWhtUzpNRP5jrotX0yDe 99aT+0/bdCj1LxViaU4I9FQi7moOBEA7mMxh6gCAAA= X-Env-Sender: tamas.lengyel@zentific.com X-Msg-Ref: server-2.tower-27.messagelabs.com!1491319483!43094978!1 X-Originating-IP: [74.125.82.65] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG X-StarScan-Received: X-StarScan-Version: 9.2.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 1997 invoked from network); 4 Apr 2017 15:24:44 -0000 Received: from mail-wm0-f65.google.com (HELO mail-wm0-f65.google.com) (74.125.82.65) by server-2.tower-27.messagelabs.com with AES128-GCM-SHA256 encrypted SMTP; 4 Apr 2017 15:24:44 -0000 Received: by mail-wm0-f65.google.com with SMTP id o81so6512818wmb.0 for ; Tue, 04 Apr 2017 08:24:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zentific-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=l+9rHtGGgSIf3IRJ/xtQIjXBACOU/NauH9B3n2Q+z9o=; b=Ebyp5IUpmEcnfXKqZ4OkG6XCXmGr+lE+jTyP9nKqKX4thSGvqHqNZy+iOxLZ2BQM0K dDVdGbOcpBj4865voKY1MlBYl4Ge30I42hWWFcSFqIKzzdEoaxEk6ZT+A0ayfICkw8lg GaznD+4QhkI20eUywDXLwO6naDcIZORa1BbVIDDzRA+5cVBKnj57zWnXDrVBAAGCyrGU NlJZ1wovurxtqrLoUZQTnuyfcsXaybZMXMdbyrB7s70iuT9McWp6Eg7ijZvfAnNbNWge 4WOYEChzZmAPcSP6sIaKCqKeFQW3gYD/Nt8IRfn5Zg9Ixo3moCCKtBWTXDv4lfrcQBrC iCSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=l+9rHtGGgSIf3IRJ/xtQIjXBACOU/NauH9B3n2Q+z9o=; b=AhLNWOzvQCkFfzRXAmtCQsyPoYbOJUjOFWbRh5OY4x+fLi64OSGJsU0ypCUfEz/00b oaAWF2ky9DpcluejwqPq1uMOLt2ZMTg1Q7/AkSLefLNNSiP41ilKEORwKa7dJZoP8vnz UzAWj8J3qlZ7hVexoxAdGt/VT0biw1tLT15Bs86kGRVv72h7TU11o+G2O9h7e/1Ly+v5 IYlXSq+HHwXNTBzwy/OfPd6zhHrPRrrZyiK81cTd/5mBC2jF++tKQLLt4s/9UiBZjGBo UdVw4q+eR4ia5Yiy/28tLWYkcEZrNsIymYvwpQ00ehzX42zXHK+VCFLx3eRhSucJBmyG Uamw== X-Gm-Message-State: AFeK/H1K62NxvedkOZupLSvrJD/1fLOV6soq6+XA1g9j/djcqdv+Yx4GdZyjhPVHSTqeJg== X-Received: by 10.28.9.15 with SMTP id 15mr16019934wmj.83.1491319483449; Tue, 04 Apr 2017 08:24:43 -0700 (PDT) Received: from l1.lan (c-24-9-60-130.hsd1.co.comcast.net. [24.9.60.130]) by smtp.gmail.com with ESMTPSA id 190sm18864229wmk.17.2017.04.04.08.24.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 04 Apr 2017 08:24:42 -0700 (PDT) From: Tamas K Lengyel To: xen-devel@lists.xenproject.org Date: Tue, 4 Apr 2017 09:24:35 -0600 Message-Id: <20170404152435.4915-1-tamas.lengyel@zentific.com> X-Mailer: git-send-email 2.11.0 Cc: Tamas K Lengyel , Ian Jackson , Sergej Proskurin , Jan Beulich , Andrew Cooper , Daniel De Graaf Subject: [Xen-devel] [PATCH v6] altp2m: Introduce external-only and limited use-cases X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Currently setting altp2mhvm=1 in the domain configuration allows access to the altp2m interface for both in-guest and external privileged tools. This poses a problem for use-cases where only external access should be allowed, requiring the user to compile Xen with XSM enabled to be able to appropriately restrict access. In this patch we deprecate the altp2mhvm domain configuration option and introduce the altp2m option, which allows specifying if by default the altp2m interface should be external-only or limited. The information is stored in HVM_PARAM_ALTP2M which we now define with specific XEN_ALTP2M_* modes. If external mode is selected, the XSM check is shifted to use XSM_DM_PRIV type check, thus restricting access to the interface by the guest itself. Note that we keep the default XSM policy untouched. Users of XSM who wish to enforce external mode for altp2m can do so by adjusting their XSM policy directly, as this domain config option does not override an active XSM policy. Also, as part of this patch we adjust the hvmop handler to require HVM_PARAM_ALTP2M to be of a type other then disabled for all ops. This has been previously only required for get/set altp2m domain state, all other options were gated on altp2m_enabled. Since altp2m_enabled only gets set during set altp2m domain state, this change introduces no new requirements to the other ops but makes it more clear that it is required for all ops. Signed-off-by: Tamas K Lengyel Signed-off-by: Sergej Proskurin Acked-by: Wei Liu Acked-by: Daniel De Graaf Acked-by: Jan Beulich --- Cc: Ian Jackson Cc: Andrew Cooper Cc: Jan Beulich Cc: Daniel De Graaf v5: Add "limited" mode where the guest only has access to enable/disable VMFUNC and #VE features. v6: Check mode when XSM is enabled so that both the mode and the XSM policy has to allow the altp2m operation to succeed. Makes limited mode available even when XSM is enabled. --- docs/man/xl.cfg.pod.5.in | 41 ++++++++++++++++++++++++++++++++++++++++- tools/libxl/libxl_create.c | 6 ++++-- tools/libxl/libxl_dom.c | 18 ++++++++++++++++-- tools/libxl/libxl_types.idl | 14 ++++++++++++++ tools/xl/xl_parse.c | 20 +++++++++++++++++++- xen/arch/x86/hvm/hvm.c | 22 ++++++++++++---------- xen/include/public/hvm/params.h | 12 +++++++++++- xen/include/xsm/dummy.h | 23 ++++++++++++++++++++--- xen/include/xsm/xsm.h | 6 +++--- xen/xsm/flask/hooks.c | 21 ++++++++++++++++++++- 10 files changed, 159 insertions(+), 24 deletions(-) diff --git a/docs/man/xl.cfg.pod.5.in b/docs/man/xl.cfg.pod.5.in index 206d33eb3f..616dc093b0 100644 --- a/docs/man/xl.cfg.pod.5.in +++ b/docs/man/xl.cfg.pod.5.in @@ -1319,6 +1319,41 @@ enabled by default and you should usually omit it. It may be necessary to disable the HPET in order to improve compatibility with guest Operating Systems (X86 only) +=item B + +Specifies access mode to the alternate-p2m capability. Alternate-p2m allows a +guest to manage multiple p2m guest physical "memory views" (as opposed to a +single p2m). This option is disabled by default and is available to x86 hvm +domains. You may want this option if you want to access-control/isolate +access to specific guest physical memory pages accessed by the guest, e.g. for +domain memory introspection or for isolation/access-control of memory between +components within a single guest domain. + +The valid values are as follows: + +=over 4 + +=item B<"disabled"> + +Altp2m is disabled for the domain (default). + +=item B<"mixed"> + +The mixed mode allows access to the altp2m interface for both in-guest +and external tools as well. + +=item B<"external"> + +Enables access to the alternate-p2m capability for hvm guests only +by external privileged tools. + +=item B<"limited"> + +Enables limited access to the alternate-p2m capability for hvm guests only, +ie. giving the guest access only to enable/disable the VMFUNC and #VE features. + +=back + =item B Enables or disables hvm guest access to alternate-p2m capability. @@ -1329,7 +1364,11 @@ You may want this option if you want to access-control/isolate access to specific guest physical memory pages accessed by the guest, e.g. for HVM domain memory introspection or for isolation/access-control of memory between components within -a single guest hvm domain. +a single guest hvm domain. This option is deprecated, use the option +"altp2m" instead. + +Note: While the option "altp2mhvm" is deprecated, legacy applications for +x86 systems will continue to work using it. =item B diff --git a/tools/libxl/libxl_create.c b/tools/libxl/libxl_create.c index 399b91426b..bffbc456c1 100644 --- a/tools/libxl/libxl_create.c +++ b/tools/libxl/libxl_create.c @@ -902,14 +902,16 @@ static void initiate_domain_create(libxl__egc *egc, if (d_config->c_info.type == LIBXL_DOMAIN_TYPE_HVM && (libxl_defbool_val(d_config->b_info.u.hvm.nested_hvm) && - libxl_defbool_val(d_config->b_info.u.hvm.altp2m))) { + (libxl_defbool_val(d_config->b_info.u.hvm.altp2m) || + (d_config->b_info.altp2m != LIBXL_ALTP2M_MODE_DISABLED)))) { ret = ERROR_INVAL; LOGD(ERROR, domid, "nestedhvm and altp2mhvm cannot be used together"); goto error_out; } if (d_config->c_info.type == LIBXL_DOMAIN_TYPE_HVM && - libxl_defbool_val(d_config->b_info.u.hvm.altp2m) && + (libxl_defbool_val(d_config->b_info.u.hvm.altp2m) || + (d_config->b_info.altp2m != LIBXL_ALTP2M_MODE_DISABLED)) && pod_enabled) { ret = ERROR_INVAL; LOGD(ERROR, domid, "Cannot enable PoD and ALTP2M at the same time"); diff --git a/tools/libxl/libxl_dom.c b/tools/libxl/libxl_dom.c index cf03ded67d..5d914a59ee 100644 --- a/tools/libxl/libxl_dom.c +++ b/tools/libxl/libxl_dom.c @@ -295,8 +295,6 @@ static void hvm_set_conf_params(xc_interface *handle, uint32_t domid, libxl_defbool_val(info->u.hvm.vpt_align)); xc_hvm_param_set(handle, domid, HVM_PARAM_NESTEDHVM, libxl_defbool_val(info->u.hvm.nested_hvm)); - xc_hvm_param_set(handle, domid, HVM_PARAM_ALTP2M, - libxl_defbool_val(info->u.hvm.altp2m)); } int libxl__build_pre(libxl__gc *gc, uint32_t domid, @@ -445,6 +443,22 @@ int libxl__build_pre(libxl__gc *gc, uint32_t domid, #endif } + /* Alternate p2m support on x86 is available only for HVM guests. */ + if (info->type == LIBXL_DOMAIN_TYPE_HVM) { + /* The config parameter "altp2m" replaces the parameter "altp2mhvm". For + * legacy reasons, both parameters are accepted on x86 HVM guests. + * + * If the legacy field info->u.hvm.altp2m is set, activate altp2m. + * Otherwise set altp2m based on the field info->altp2m. */ + if (info->altp2m == LIBXL_ALTP2M_MODE_DISABLED && + libxl_defbool_val(info->u.hvm.altp2m)) + xc_hvm_param_set(ctx->xch, domid, HVM_PARAM_ALTP2M, + libxl_defbool_val(info->u.hvm.altp2m)); + else + xc_hvm_param_set(ctx->xch, domid, HVM_PARAM_ALTP2M, + info->altp2m); + } + rc = libxl__arch_domain_create(gc, d_config, domid); return rc; diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl index d970284ffa..bac226cf7d 100644 --- a/tools/libxl/libxl_types.idl +++ b/tools/libxl/libxl_types.idl @@ -441,6 +441,14 @@ libxl_rdm_reserve = Struct("rdm_reserve", [ ("policy", libxl_rdm_reserve_policy), ]) +# Consistent with the values defined for HVM_PARAM_ALTP2M +libxl_altp2m_mode = Enumeration("altp2m_mode", [ + (0, "disabled"), + (1, "mixed"), + (2, "external"), + (3, "limited"), + ], init_val = "LIBXL_ALTP2M_MODE_DISABLED") + libxl_domain_build_info = Struct("domain_build_info",[ ("max_vcpus", integer), ("avail_vcpus", libxl_bitmap), @@ -519,6 +527,9 @@ libxl_domain_build_info = Struct("domain_build_info",[ ("mmio_hole_memkb", MemKB), ("timer_mode", libxl_timer_mode), ("nested_hvm", libxl_defbool), + # The u.hvm.altp2m field is used solely + # for x86 HVM guests and is maintained + # for legacy purposes. ("altp2m", libxl_defbool), ("system_firmware", string), ("smbios_firmware", string), @@ -569,6 +580,9 @@ libxl_domain_build_info = Struct("domain_build_info",[ ("arch_arm", Struct(None, [("gic_version", libxl_gic_version), ])), + # Alternate p2m is not bound to any architecture or guest type, as it is + # supported by x86 HVM and ARM support is planned. + ("altp2m", libxl_altp2m_mode), ], dir=DIR_IN ) diff --git a/tools/xl/xl_parse.c b/tools/xl/xl_parse.c index 66327dcc01..856a304b30 100644 --- a/tools/xl/xl_parse.c +++ b/tools/xl/xl_parse.c @@ -1156,7 +1156,9 @@ void parse_config_data(const char *config_source, xlu_cfg_get_defbool(config, "nestedhvm", &b_info->u.hvm.nested_hvm, 0); - xlu_cfg_get_defbool(config, "altp2mhvm", &b_info->u.hvm.altp2m, 0); + if (!xlu_cfg_get_defbool(config, "altp2mhvm", &b_info->u.hvm.altp2m, 0)) + fprintf(stderr, "WARNING: Specifying \"altp2mhvm\" is deprecated. " + "Please use \"altp2m\" instead.\n"); xlu_cfg_replace_string(config, "smbios_firmware", &b_info->u.hvm.smbios_firmware, 0); @@ -1216,6 +1218,22 @@ void parse_config_data(const char *config_source, abort(); } + if (!xlu_cfg_get_long(config, "altp2m", &l, 1)) { + if (l < LIBXL_ALTP2M_MODE_DISABLED || + l > LIBXL_ALTP2M_MODE_LIMITED) { + fprintf(stderr, "ERROR: invalid value %ld for \"altp2m\"\n", l); + exit (1); + } + + b_info->altp2m = l; + } else if (!xlu_cfg_get_string(config, "altp2m", &buf, 0)) { + if (libxl_altp2m_mode_from_string(buf, &b_info->altp2m)) { + fprintf(stderr, "ERROR: invalid value \"%s\" for \"altp2m\"\n", + buf); + exit (1); + } + } + if (!xlu_cfg_get_list(config, "ioports", &ioports, &num_ioports, 0)) { b_info->num_ioports = num_ioports; b_info->ioports = calloc(num_ioports, sizeof(*b_info->ioports)); diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 0282986738..fd77e3e7b8 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -4110,7 +4110,7 @@ static int hvmop_set_param( rc = xsm_hvm_param_altp2mhvm(XSM_PRIV, d); if ( rc ) break; - if ( a.value > 1 ) + if ( a.value > XEN_ALTP2M_limited ) rc = -EINVAL; if ( a.value && d->arch.hvm_domain.params[HVM_PARAM_NESTEDHVM] ) @@ -4324,6 +4324,7 @@ static int do_altp2m_op( struct xen_hvm_altp2m_op a; struct domain *d = NULL; int rc = 0; + uint64_t mode; if ( !hvm_altp2m_supported() ) return -EOPNOTSUPP; @@ -4370,18 +4371,20 @@ static int do_altp2m_op( goto out; } - if ( (rc = xsm_hvm_altp2mhvm_op(XSM_TARGET, d)) ) + mode = d->arch.hvm_domain.params[HVM_PARAM_ALTP2M]; + + if ( XEN_ALTP2M_disabled == mode ) + { + rc = -EINVAL; + goto out; + } + + if ( (rc = xsm_hvm_altp2mhvm_op(XSM_OTHER, d, mode, a.cmd)) ) goto out; switch ( a.cmd ) { case HVMOP_altp2m_get_domain_state: - if ( !d->arch.hvm_domain.params[HVM_PARAM_ALTP2M] ) - { - rc = -EINVAL; - break; - } - a.u.domain_state.state = altp2m_active(d); rc = __copy_to_guest(arg, &a, 1) ? -EFAULT : 0; break; @@ -4391,8 +4394,7 @@ static int do_altp2m_op( struct vcpu *v; bool_t ostate; - if ( !d->arch.hvm_domain.params[HVM_PARAM_ALTP2M] || - nestedhvm_enabled(d) ) + if ( nestedhvm_enabled(d) ) { rc = -EINVAL; break; diff --git a/xen/include/public/hvm/params.h b/xen/include/public/hvm/params.h index 19c9eb8886..1f3ed0906d 100644 --- a/xen/include/public/hvm/params.h +++ b/xen/include/public/hvm/params.h @@ -233,8 +233,18 @@ /* Location of the VM Generation ID in guest physical address space. */ #define HVM_PARAM_VM_GENERATION_ID_ADDR 34 -/* Boolean: Enable altp2m */ +/* + * Set mode for altp2m: + * disabled: don't activate altp2m (default) + * mixed: allow access to all altp2m ops for both in-guest and external tools + * external: allow access to external privileged tools only + * limited: guest only has limited access (ie. control VMFUNC and #VE) + */ #define HVM_PARAM_ALTP2M 35 +#define XEN_ALTP2M_disabled 0 +#define XEN_ALTP2M_mixed 1 +#define XEN_ALTP2M_external 2 +#define XEN_ALTP2M_limited 3 /* * Size of the x87 FPU FIP/FDP registers that the hypervisor needs to diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index ff730391d5..56a8814d82 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -555,10 +555,27 @@ static XSM_INLINE int xsm_hvm_param_altp2mhvm(XSM_DEFAULT_ARG struct domain *d) return xsm_default_action(action, current->domain, d); } -static XSM_INLINE int xsm_hvm_altp2mhvm_op(XSM_DEFAULT_ARG struct domain *d) +static XSM_INLINE int xsm_hvm_altp2mhvm_op(XSM_DEFAULT_ARG struct domain *d, uint64_t mode, uint32_t op) { - XSM_ASSERT_ACTION(XSM_TARGET); - return xsm_default_action(action, current->domain, d); + xsm_default_t a; + XSM_ASSERT_ACTION(XSM_OTHER); + + switch ( mode ) + { + case XEN_ALTP2M_mixed: + a = XSM_TARGET; + break; + case XEN_ALTP2M_external: + a = XSM_DM_PRIV; + break; + case XEN_ALTP2M_limited: + a = (HVMOP_altp2m_vcpu_enable_notify == op) ? XSM_TARGET : XSM_DM_PRIV; + break; + default: + return -EPERM; + }; + + return xsm_default_action(a, current->domain, d); } static XSM_INLINE int xsm_vm_event_control(XSM_DEFAULT_ARG struct domain *d, int mode, int op) diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 2cf7ac10db..60c0fd6a62 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -140,7 +140,7 @@ struct xsm_operations { int (*hvm_control) (struct domain *d, unsigned long op); int (*hvm_param_nested) (struct domain *d); int (*hvm_param_altp2mhvm) (struct domain *d); - int (*hvm_altp2mhvm_op) (struct domain *d); + int (*hvm_altp2mhvm_op) (struct domain *d, uint64_t mode, uint32_t op); int (*get_vnumainfo) (struct domain *d); int (*vm_event_control) (struct domain *d, int mode, int op); @@ -579,9 +579,9 @@ static inline int xsm_hvm_param_altp2mhvm (xsm_default_t def, struct domain *d) return xsm_ops->hvm_param_altp2mhvm(d); } -static inline int xsm_hvm_altp2mhvm_op (xsm_default_t def, struct domain *d) +static inline int xsm_hvm_altp2mhvm_op (xsm_default_t def, struct domain *d, uint64_t mode, uint32_t op) { - return xsm_ops->hvm_altp2mhvm_op(d); + return xsm_ops->hvm_altp2mhvm_op(d, mode, op); } static inline int xsm_get_vnumainfo (xsm_default_t def, struct domain *d) diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 4baed39890..fd84ac0f09 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1197,8 +1197,27 @@ static int flask_hvm_param_altp2mhvm(struct domain *d) return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM); } -static int flask_hvm_altp2mhvm_op(struct domain *d) +static int flask_hvm_altp2mhvm_op(struct domain *d, uint64_t mode, uint32_t op) { + /* + * Require both mode and XSM to allow the operation. Assume XSM rules + * are written with the XSM_TARGET policy in mind, so add restrictions + * on the domain acting on itself when forbidden by the mode. + */ + switch ( mode ) + { + case XEN_ALTP2M_mixed: + break; + case XEN_ALTP2M_limited: + if ( HVMOP_altp2m_vcpu_enable_notify == op ) + break; + /* fall-through */ + case XEN_ALTP2M_external: + if ( d == current->domain ) + return -EPERM; + break; + }; + return current_has_perm(d, SECCLASS_HVM, HVM__ALTP2MHVM_OP); }