From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: [PATCH for-4.5] xsm/flask: add two missing domctls Date: Tue, 25 Nov 2014 18:19:05 +0000 Message-ID: <5474C819.5080303@citrix.com> References: <1416934664-17630-1-git-send-email-dgdegra@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1416934664-17630-1-git-send-email-dgdegra@tycho.nsa.gov> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Daniel De Graaf , xen-devel@lists.xen.org Cc: m.a.young@durham.ac.uk List-Id: xen-devel@lists.xenproject.org On 25/11/14 16:57, Daniel De Graaf wrote: > Reported-by: Michael Young > Signed-off-by: Daniel De Graaf Reviewed-by: Andrew Cooper CC'd Konrad, as this should be accepted into Xen-4.5. Without it, migration/suspend fails with -EPERM in the default case when XSM is compiled into Xen. Daniel: there are 4 hypercalls for getting/setting bits of PV VCPU state: XEN_DOMCTL_{get,set}vcpucontext XEN_DOMCTL_{get,set}_ext_vcpucontext XEN_DOMCTL_{get,set}vcpuextstate XEN_DOMCTL_{get,set}_vcpu_msrs I see no reason for these to have separate access vectors; you typically either need to use all of them, or none, but I presume it is too late to coalesce the vectors in a backwards compatible way? ~Andrew > --- > xen/xsm/flask/hooks.c | 2 ++ > xen/xsm/flask/policy/access_vectors | 2 ++ > 2 files changed, 4 insertions(+) > > diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c > index 0ba2ce9..d48463f 100644 > --- a/xen/xsm/flask/hooks.c > +++ b/xen/xsm/flask/hooks.c > @@ -672,9 +672,11 @@ static int flask_domctl(struct domain *d, int cmd) > return current_has_perm(d, SECCLASS_HVM, HVM__CACHEATTR); > > case XEN_DOMCTL_set_ext_vcpucontext: > + case XEN_DOMCTL_set_vcpu_msrs: > return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__SETEXTVCPUCONTEXT); > > case XEN_DOMCTL_get_ext_vcpucontext: > + case XEN_DOMCTL_get_vcpu_msrs: > return current_has_perm(d, SECCLASS_DOMAIN, DOMAIN__GETEXTVCPUCONTEXT); > > case XEN_DOMCTL_setvcpuextstate: > diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors > index 1cd451e..1da9f63 100644 > --- a/xen/xsm/flask/policy/access_vectors > +++ b/xen/xsm/flask/policy/access_vectors > @@ -151,8 +151,10 @@ class domain > # XEN_DOMCTL_sendtrigger > trigger > # XEN_DOMCTL_get_ext_vcpucontext > +# XEN_DOMCTL_set_vcpu_msrs > getextvcpucontext > # XEN_DOMCTL_set_ext_vcpucontext > +# XEN_DOMCTL_get_vcpu_msrs > setextvcpucontext > # XEN_DOMCTL_getvcpuextstate > getvcpuextstate