[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH 03/22] arch/x86: add distinct XSM hooks for map/unmap



The xsm_iomem_permission and xsm_ioport_permission hooks are intended to
be called by the domain builder, while the calls in arch/x86/domctl.c
which control mapping are also performed by the device model.  Because
these operations require distinct access control policies, they cannot
use the same XSM hooks.

This also adds a missing XSM hook in the unbind IRQ domctl.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
Cc: Keir Fraser <keir@xxxxxxx>
---
 xen/arch/x86/domctl.c   |  8 ++++++--
 xen/arch/x86/physdev.c  |  2 +-
 xen/include/xsm/dummy.h | 17 ++++++++++++++++-
 xen/include/xsm/xsm.h   | 25 ++++++++++++++++++++++---
 xen/xsm/dummy.c         |  3 +++
 xen/xsm/flask/hooks.c   | 43 +++++++++++++++++++++----------------------
 6 files changed, 69 insertions(+), 29 deletions(-)

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index e89a20a..0e81010 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -656,6 +656,10 @@ long arch_do_domctl(
              !irq_access_permitted(current->domain, bind->machine_irq) )
             break;
 
+        ret = xsm_unbind_pt_irq(d, bind);
+        if ( ret )
+            break;
+
         if ( iommu_enabled )
         {
             spin_lock(&pcidevs_lock);
@@ -687,7 +691,7 @@ long arch_do_domctl(
              !iomem_access_permitted(current->domain, mfn, mfn + nr_mfns - 1) )
             break;
 
-        ret = xsm_iomem_permission(d, mfn, mfn + nr_mfns - 1, add);
+        ret = xsm_iomem_mapping(d, mfn, mfn + nr_mfns - 1, add);
         if ( ret )
             break;
 
@@ -765,7 +769,7 @@ long arch_do_domctl(
              !ioports_access_permitted(current->domain, fmp, fmp + np - 1) )
             break;
 
-        ret = xsm_ioport_permission(d, fmp, fmp + np - 1, add);
+        ret = xsm_ioport_mapping(d, fmp, fmp + np - 1, add);
         if ( ret )
             break;
 
diff --git a/xen/arch/x86/physdev.c b/xen/arch/x86/physdev.c
index a041783..7800473 100644
--- a/xen/arch/x86/physdev.c
+++ b/xen/arch/x86/physdev.c
@@ -242,7 +242,7 @@ int physdev_unmap_pirq(domid_t domid, int pirq)
     if ( !IS_PRIV_FOR(current->domain, d) )
         goto free_domain;
 
-    ret = xsm_irq_permission(d, domain_pirq_to_irq(d, pirq), 0);
+    ret = xsm_unmap_domain_pirq(d, domain_pirq_to_irq(d, pirq));
     if ( ret )
         goto free_domain;
 
diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
index 075572f..4384552 100644
--- a/xen/include/xsm/dummy.h
+++ b/xen/include/xsm/dummy.h
@@ -394,6 +394,11 @@ static XSM_INLINE int xsm_map_domain_pirq(struct domain 
*d, int irq, void *data)
     return 0;
 }
 
+static XSM_INLINE int xsm_unmap_domain_pirq(struct domain *d, int irq)
+{
+    return 0;
+}
+
 static XSM_INLINE int xsm_irq_permission(struct domain *d, int pirq, uint8_t 
allow)
 {
     return 0;
@@ -404,6 +409,11 @@ static XSM_INLINE int xsm_iomem_permission(struct domain 
*d, uint64_t s, uint64_
     return 0;
 }
 
+static XSM_INLINE int xsm_iomem_mapping(struct domain *d, uint64_t s, uint64_t 
e, uint8_t allow)
+{
+    return 0;
+}
+
 static XSM_INLINE int xsm_pci_config_permission(struct domain *d, uint32_t 
machine_bdf,
                                         uint16_t start, uint16_t end,
                                         uint8_t access)
@@ -585,7 +595,7 @@ static XSM_INLINE int xsm_bind_pt_irq(struct domain *d, 
struct xen_domctl_bind_p
     return 0;
 }
 
-static XSM_INLINE int xsm_unbind_pt_irq(struct domain *d)
+static XSM_INLINE int xsm_unbind_pt_irq(struct domain *d, struct 
xen_domctl_bind_pt_irq *bind)
 {
     return 0;
 }
@@ -610,4 +620,9 @@ static XSM_INLINE int xsm_ioport_permission(struct domain 
*d, uint32_t s, uint32
     return 0;
 }
 
+static XSM_INLINE int xsm_ioport_mapping(struct domain *d, uint32_t s, 
uint32_t e, uint8_t allow)
+{
+    return 0;
+}
+
 #endif
diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h
index 73169fe..662f233 100644
--- a/xen/include/xsm/xsm.h
+++ b/xen/include/xsm/xsm.h
@@ -111,8 +111,10 @@ struct xsm_operations {
 
     char *(*show_irq_sid) (int irq);
     int (*map_domain_pirq) (struct domain *d, int irq, void *data);
+    int (*unmap_domain_pirq) (struct domain *d, int irq);
     int (*irq_permission) (struct domain *d, int pirq, uint8_t allow);
     int (*iomem_permission) (struct domain *d, uint64_t s, uint64_t e, uint8_t 
allow);
+    int (*iomem_mapping) (struct domain *d, uint64_t s, uint64_t e, uint8_t 
allow);
     int (*pci_config_permission) (struct domain *d, uint32_t machine_bdf, 
uint16_t start, uint16_t end, uint8_t access);
 
     int (*get_device_group) (uint32_t machine_bdf);
@@ -170,11 +172,12 @@ struct xsm_operations {
     int (*add_to_physmap) (struct domain *d1, struct domain *d2);
     int (*sendtrigger) (struct domain *d);
     int (*bind_pt_irq) (struct domain *d, struct xen_domctl_bind_pt_irq *bind);
-    int (*unbind_pt_irq) (struct domain *d);
+    int (*unbind_pt_irq) (struct domain *d, struct xen_domctl_bind_pt_irq 
*bind);
     int (*pin_mem_cacheattr) (struct domain *d);
     int (*ext_vcpucontext) (struct domain *d, uint32_t cmd);
     int (*vcpuextstate) (struct domain *d, uint32_t cmd);
     int (*ioport_permission) (struct domain *d, uint32_t s, uint32_t e, 
uint8_t allow);
+    int (*ioport_mapping) (struct domain *d, uint32_t s, uint32_t e, uint8_t 
allow);
 #endif
 };
 
@@ -489,6 +492,11 @@ static inline int xsm_map_domain_pirq (struct domain *d, 
int irq, void *data)
     return xsm_ops->map_domain_pirq(d, irq, data);
 }
 
+static inline int xsm_unmap_domain_pirq (struct domain *d, int irq)
+{
+    return xsm_ops->unmap_domain_pirq(d, irq);
+}
+
 static inline int xsm_irq_permission (struct domain *d, int pirq, uint8_t 
allow)
 {
     return xsm_ops->irq_permission(d, pirq, allow);
@@ -499,6 +507,11 @@ static inline int xsm_iomem_permission (struct domain *d, 
uint64_t s, uint64_t e
     return xsm_ops->iomem_permission(d, s, e, allow);
 }
 
+static inline int xsm_iomem_mapping (struct domain *d, uint64_t s, uint64_t e, 
uint8_t allow)
+{
+    return xsm_ops->iomem_mapping(d, s, e, allow);
+}
+
 static inline int xsm_pci_config_permission (struct domain *d, uint32_t 
machine_bdf, uint16_t start, uint16_t end, uint8_t access)
 {
     return xsm_ops->pci_config_permission(d, machine_bdf, start, end, access);
@@ -754,9 +767,10 @@ static inline int xsm_bind_pt_irq(struct domain *d,
     return xsm_ops->bind_pt_irq(d, bind);
 }
 
-static inline int xsm_unbind_pt_irq(struct domain *d)
+static inline int xsm_unbind_pt_irq(struct domain *d,
+                                                struct xen_domctl_bind_pt_irq 
*bind)
 {
-    return xsm_ops->unbind_pt_irq(d);
+    return xsm_ops->unbind_pt_irq(d, bind);
 }
 
 static inline int xsm_pin_mem_cacheattr(struct domain *d)
@@ -777,6 +791,11 @@ static inline int xsm_ioport_permission (struct domain *d, 
uint32_t s, uint32_t
 {
     return xsm_ops->ioport_permission(d, s, e, allow);
 }
+
+static inline int xsm_ioport_mapping (struct domain *d, uint32_t s, uint32_t 
e, uint8_t allow)
+{
+    return xsm_ops->ioport_mapping(d, s, e, allow);
+}
 #endif /* CONFIG_X86 */
 #endif /* XSM_NO_WRAPPERS */
 
diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index a2ce733..b767cfe 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -96,8 +96,10 @@ void xsm_fixup_ops (struct xsm_operations *ops)
 
     set_to_dummy_if_null(ops, show_irq_sid);
     set_to_dummy_if_null(ops, map_domain_pirq);
+    set_to_dummy_if_null(ops, unmap_domain_pirq);
     set_to_dummy_if_null(ops, irq_permission);
     set_to_dummy_if_null(ops, iomem_permission);
+    set_to_dummy_if_null(ops, iomem_mapping);
     set_to_dummy_if_null(ops, pci_config_permission);
 
     set_to_dummy_if_null(ops, get_device_group);
@@ -160,5 +162,6 @@ void xsm_fixup_ops (struct xsm_operations *ops)
     set_to_dummy_if_null(ops, ext_vcpucontext);
     set_to_dummy_if_null(ops, vcpuextstate);
     set_to_dummy_if_null(ops, ioport_permission);
+    set_to_dummy_if_null(ops, ioport_mapping);
 #endif
 }
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index ead5958..e60c6f4 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -721,43 +721,41 @@ static int flask_map_domain_pirq (struct domain *d, int 
irq, void *data)
     return rc;
 }
 
-static int flask_irq_permission (struct domain *d, int irq, uint8_t access)
+static int flask_unmap_domain_pirq (struct domain *d, int irq)
 {
-    u32 perm;
-    u32 rsid;
+    u32 sid;
     int rc = -EPERM;
 
-    struct domain_security_struct *ssec, *tsec;
+    struct domain_security_struct *ssec;
     struct avc_audit_data ad;
 
-    rc = domain_has_perm(current->domain, d, SECCLASS_RESOURCE,
-                         resource_to_perm(access));
-
+    rc = domain_has_perm(current->domain, d, SECCLASS_RESOURCE, 
RESOURCE__REMOVE);
     if ( rc )
         return rc;
 
-    if ( access )
-        perm = RESOURCE__ADD_IRQ;
-    else
-        perm = RESOURCE__REMOVE_IRQ;
-
     ssec = current->domain->ssid;
-    tsec = d->ssid;
 
-    rc = get_irq_sid(irq, &rsid, &ad);
-    if ( rc )
-        return rc;
-
-    rc = avc_has_perm(ssec->sid, rsid, SECCLASS_RESOURCE, perm, &ad);
+    if ( irq < nr_static_irqs ) {
+        rc = get_irq_sid(irq, &sid, &ad);
+    } else {
+        /* It is currently not possible to check the specific MSI IRQ being
+         * removed, since we do not have the msi_info like map_domain_pirq */
+        return 0;
+    }
     if ( rc )
         return rc;
 
-    if ( access )
-        rc = avc_has_perm(tsec->sid, rsid, SECCLASS_RESOURCE, 
-                            RESOURCE__USE, &ad);
+    rc = avc_has_perm(ssec->sid, sid, SECCLASS_RESOURCE, RESOURCE__REMOVE_IRQ, 
&ad);
     return rc;
 }
 
+static int flask_irq_permission (struct domain *d, int pirq, uint8_t access)
+{
+    /* the PIRQ number is not useful; real IRQ is checked during mapping */
+    return domain_has_perm(current->domain, d, SECCLASS_RESOURCE,
+                           resource_to_perm(access));
+}
+
 struct iomem_has_perm_data {
     struct domain_security_struct *ssec, *tsec;
     u32 perm;
@@ -1413,7 +1411,7 @@ static int flask_bind_pt_irq (struct domain *d, struct 
xen_domctl_bind_pt_irq *b
     return avc_has_perm(tsec->sid, rsid, SECCLASS_RESOURCE, RESOURCE__USE, 
&ad);
 }
 
-static int flask_unbind_pt_irq (struct domain *d)
+static int flask_unbind_pt_irq (struct domain *d, struct 
xen_domctl_bind_pt_irq *bind)
 {
     return domain_has_perm(current->domain, d, SECCLASS_RESOURCE, 
RESOURCE__REMOVE);
 }
@@ -1533,6 +1531,7 @@ static struct xsm_operations flask_ops = {
     .show_irq_sid = flask_show_irq_sid,
 
     .map_domain_pirq = flask_map_domain_pirq,
+    .unmap_domain_pirq = flask_unmap_domain_pirq,
     .irq_permission = flask_irq_permission,
     .iomem_permission = flask_iomem_permission,
     .pci_config_permission = flask_pci_config_permission,
-- 
1.7.11.7


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.