From patchwork Thu Mar 24 21:30:09 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Konrad Rzeszutek Wilk X-Patchwork-Id: 8664971 Return-Path: X-Original-To: patchwork-xen-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 694D59F36E for ; Thu, 24 Mar 2016 21:33:18 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 77F5920379 for ; Thu, 24 Mar 2016 21:33:16 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8225420373 for ; Thu, 24 Mar 2016 21:33:14 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ajCpf-00040F-Mj; Thu, 24 Mar 2016 21:30:19 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ajCpe-000407-KU for xen-devel@lists.xenproject.org; Thu, 24 Mar 2016 21:30:18 +0000 Received: from [85.158.137.68] by server-10.bemta-3.messagelabs.com id 12/28-03003-96C54F65; Thu, 24 Mar 2016 21:30:17 +0000 X-Env-Sender: ketuzsezr@gmail.com X-Msg-Ref: server-3.tower-31.messagelabs.com!1458855015!31292171!1 X-Originating-IP: [209.85.220.195] X-SpamReason: No, hits=0.5 required=7.0 tests=BODY_RANDOM_LONG X-StarScan-Received: X-StarScan-Version: 8.11; banners=-,-,- X-VirusChecked: Checked Received: (qmail 20491 invoked from network); 24 Mar 2016 21:30:16 -0000 Received: from mail-qk0-f195.google.com (HELO mail-qk0-f195.google.com) (209.85.220.195) by server-3.tower-31.messagelabs.com with AES128-GCM-SHA256 encrypted SMTP; 24 Mar 2016 21:30:16 -0000 Received: by mail-qk0-f195.google.com with SMTP id q184so2569546qkb.0 for ; Thu, 24 Mar 2016 14:30:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=Yei1Bh4xf5Zig9xnR5Blrst2tlzSWDGnB6LqrOYMyhc=; b=zlJ7pSWPpXMUFMQUAVTHGm5p/igcCDGV1eVcUx/2CVo0UirMcKy6BRGA7i8RnW6p4W hvphRGKno74nsbJQTvtX4BK1QwMGwzFJ4BfUq9y8IcOCx/HtW4gj1/nili07Tza2Y+hV xPnZbE/nKXjQwM4m50YXt7MYBDu9c0UsCLwS2dtqVc+eoqFgohe1uUPf8kM1TzMDHmV0 ppJFHJahk7vK/oWVxfPqkFghHdHK5XfTsLYpxbRj1OT/y6C8Hv1om05oUdmRoiaCfI8s nETFYdAFA21QmvPPo1JdRwFkNxu0EDENCC8RRIpaJmwRQno6hoJDKNkYo0fK+psObLgS lB5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-disposition:in-reply-to:user-agent; bh=Yei1Bh4xf5Zig9xnR5Blrst2tlzSWDGnB6LqrOYMyhc=; b=fEqGFjP84EdoGWYz1WMVkHufnW9hcoJ7Urbg6yNLPrurE/0SHnWkMkOmxWmvmq8kY0 5bNCt6Ty6tJ5p0RZSmci6MFgoyBiGHnAzfA6X4o3+tNYrP4AAsNH6oBlgqE03Zv/t9s9 bnYCQOGIT7DMaineO+Zm+Wm+AEcuYrQdQSbjjPzBpyjNtiXtDcd03QS2XA0m2wjEhOfC qEX+0OSpx0EmE/GKp76rILSv6gKLADlh9J4DfrbRoH/PPBfTu00ERTE3rsx+HylR8Ey9 thtSmokrmSnLPJwNW8N1WGYRbO45VpVnBW+khlX+6elIAhzG30/MnUGDYJL8h9EAiQhU dpfg== X-Gm-Message-State: AD7BkJLpRAuephidv4SAH1Ur0iXs2Mh2RPSuG8v+0ryHJxROdPv2IZiLB0+myczRs/NpvA== X-Received: by 10.55.212.132 with SMTP id s4mr3451597qks.78.1458855015100; Thu, 24 Mar 2016 14:30:15 -0700 (PDT) Received: from localhost.localdomain (209-6-196-81.c3-0.smr-ubr2.sbo-smr.ma.cable.rcn.com. [209.6.196.81]) by smtp.gmail.com with ESMTPSA id d188sm4074058qkb.9.2016.03.24.14.30.13 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 24 Mar 2016 14:30:14 -0700 (PDT) Date: Thu, 24 Mar 2016 17:30:09 -0400 From: Konrad Rzeszutek Wilk To: Konrad Rzeszutek Wilk Message-ID: <20160324212905.GA9589@localhost.localdomain> References: <1458849640-22588-1-git-send-email-konrad.wilk@oracle.com> <1458849640-22588-2-git-send-email-konrad.wilk@oracle.com> <56F44C85.8010003@citrix.com> <6313AFDA-2BCB-421B-BD57-07B7CFA7BE3C@oracle.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <6313AFDA-2BCB-421B-BD57-07B7CFA7BE3C@oracle.com> User-Agent: Mutt/1.5.24 (2015-08-30) Cc: Wei Liu , Stefano Stabellini , Andrew Cooper , Ian Jackson , mpohlack@amazon.de, ross.lagerwall@citrix.com, Julien Grall , Stefano Stabellini , Jan Beulich , xen-devel@lists.xenproject.org, sasha.levin@oracle.com, Daniel De Graaf , Keir Fraser Subject: Re: [Xen-devel] [PATCH v5 01/28] HYPERCALL_version_op. New hypercall mirroring XENVER_ but sane. X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP > Thanks! > > And Argh! > > I neglected to change the name of kernel_cache_init as Jan requested. Jan, here is an updated patch. I changed the name to capabilities_cache_init. Sorry about that! From e766ddb37acda16c3adbd65179d532b9381bda8e Mon Sep 17 00:00:00 2001 From: Konrad Rzeszutek Wilk Date: Tue, 22 Mar 2016 16:53:19 -0400 Subject: [PATCH] HYPERCALL_version_op. New hypercall mirroring XENVER_ but sane. This hypercall mirrors the XENVER_ in that it has similar functionality. However it is designed differently: - No compat layer. The data structures are the same size on 32 as on 64-bit. - The hypercall accepts three arguments - the command, pointer to an buffer, and the length of the buffer. - Each sub-ops can be "probed" for size by returning the size of buffer that will be needed - if the buffer is NULL. - Subops can complete even if the buffer is too small - truncated data will be filled and hypercall will return -ENOBUFS. - VERSION_commandline, VERSION_changeset are privileged. - There is no XENVER_compile_info equivalent. - The hypercall can return -EPERM and toolstack/OSes are expected to deal with. However there are three subops: XEN_VERSION_version, XEN_VERSION_platform_parameters and XEN_VERSION_get_features that will always return an value as guests cannot survive without them. While we combine some of the common code between XENVER_ and VERSION_ take the liberty of moving pae_extended_cr3 in x86 area. Suggested-by: Andrew Cooper Signed-off-by: Konrad Rzeszutek Wilk Acked-by: Daniel De Graaf [XSM bits] Reviewed-by: Andrew Cooper --- Cc: Daniel De Graaf Cc: Ian Jackson Cc: Stefano Stabellini Cc: Wei Liu Cc: Stefano Stabellini Cc: Julien Grall Cc: Keir Fraser Cc: Jan Beulich Cc: Andrew Cooper v1-v3: Was not part of the series. v4: New posting. v5: Remove memset and use {}. Tweak copy_to_guest and capabilities_info, add ASSERT(sz) per Andrew's review. Add cached=1 back in. Per Jan, s/VERSION_OP/VERSION/, squash size check with do_version_op, update the comments. Dropped Andrew's Review-by. Ate newlines. Added initcall to guard against garbage being set in cached data. Folded code populating cache in __init. s/char/char[]/ in public.h --- --- tools/flask/policy/policy/modules/xen/xen.te | 7 +- xen/arch/arm/traps.c | 1 + xen/arch/x86/hvm/hvm.c | 1 + xen/arch/x86/x86_64/compat/entry.S | 2 + xen/arch/x86/x86_64/entry.S | 2 + xen/common/compat/kernel.c | 2 + xen/common/kernel.c | 213 ++++++++++++++++++++++----- xen/include/public/arch-arm.h | 2 + xen/include/public/version.h | 70 ++++++++- xen/include/public/xen.h | 1 + xen/include/xen/hypercall.h | 4 + xen/include/xsm/dummy.h | 21 +++ xen/include/xsm/xsm.h | 6 + xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 35 +++++ xen/xsm/flask/policy/access_vectors | 21 ++- 16 files changed, 346 insertions(+), 43 deletions(-) diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te index e174e48..7e69ce9 100644 --- a/tools/flask/policy/policy/modules/xen/xen.te +++ b/tools/flask/policy/policy/modules/xen/xen.te @@ -74,11 +74,12 @@ allow dom0_t xen_t:xen2 { get_symbol }; -# Allow dom0 to use all XENVER_ subops that have checks. +# Allow dom0 to use all XENVER_ subops and VERSION subops that have checks. # Note that dom0 is part of domain_type so this has duplicates. allow dom0_t xen_t:version { xen_extraversion xen_compile_info xen_capabilities xen_changeset xen_pagesize xen_guest_handle xen_commandline + extraversion capabilities changeset pagesize guest_handle commandline }; allow dom0_t xen_t:mmu memorymap; @@ -145,10 +146,12 @@ if (guest_writeconsole) { # pmu_ctrl is for) allow domain_type xen_t:xen2 pmu_use; -# For normal guests all possible except XENVER_commandline. +# For normal guests all possible except XENVER_commandline, VERSION_changeset, +# and VERSION_commandline allow domain_type xen_t:version { xen_extraversion xen_compile_info xen_capabilities xen_changeset xen_pagesize xen_guest_handle + extraversion capabilities pagesize guest_handle }; ############################################################################### diff --git a/xen/arch/arm/traps.c b/xen/arch/arm/traps.c index 83744e8..31d2115 100644 --- a/xen/arch/arm/traps.c +++ b/xen/arch/arm/traps.c @@ -1235,6 +1235,7 @@ static arm_hypercall_t arm_hypercall_table[] = { HYPERCALL(multicall, 2), HYPERCALL(platform_op, 1), HYPERCALL_ARM(vcpu_op, 3), + HYPERCALL(version_op, 3), }; #ifndef NDEBUG diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 80d59ff..f16b590 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -5322,6 +5322,7 @@ static const struct { COMPAT_CALL(platform_op), COMPAT_CALL(mmuext_op), HYPERCALL(xenpmu_op), + HYPERCALL(version_op), HYPERCALL(arch_1) }; diff --git a/xen/arch/x86/x86_64/compat/entry.S b/xen/arch/x86/x86_64/compat/entry.S index 33e2c12..fd25e84 100644 --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -394,6 +394,7 @@ ENTRY(compat_hypercall_table) .quad do_tmem_op .quad do_ni_hypercall /* reserved for XenClient */ .quad do_xenpmu_op /* 40 */ + .quad do_version_op .rept __HYPERVISOR_arch_0-((.-compat_hypercall_table)/8) .quad compat_ni_hypercall .endr @@ -445,6 +446,7 @@ ENTRY(compat_hypercall_args_table) .byte 1 /* do_tmem_op */ .byte 0 /* reserved for XenClient */ .byte 2 /* do_xenpmu_op */ /* 40 */ + .byte 3 /* do_version_op */ .rept __HYPERVISOR_arch_0-(.-compat_hypercall_args_table) .byte 0 /* compat_ni_hypercall */ .endr diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index 07ef096..b0e7257 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -730,6 +730,7 @@ ENTRY(hypercall_table) .quad do_tmem_op .quad do_ni_hypercall /* reserved for XenClient */ .quad do_xenpmu_op /* 40 */ + .quad do_version_op .rept __HYPERVISOR_arch_0-((.-hypercall_table)/8) .quad do_ni_hypercall .endr @@ -781,6 +782,7 @@ ENTRY(hypercall_args_table) .byte 1 /* do_tmem_op */ .byte 0 /* reserved for XenClient */ .byte 2 /* do_xenpmu_op */ /* 40 */ + .byte 3 /* do_version_op */ .rept __HYPERVISOR_arch_0-(.-hypercall_args_table) .byte 0 /* do_ni_hypercall */ .endr diff --git a/xen/common/compat/kernel.c b/xen/common/compat/kernel.c index df93fdd..7a7ca53 100644 --- a/xen/common/compat/kernel.c +++ b/xen/common/compat/kernel.c @@ -39,6 +39,8 @@ CHECK_TYPE(capabilities_info); CHECK_TYPE(domain_handle); +CHECK_TYPE(version_op_val); + #define xennmi_callback compat_nmi_callback #define xennmi_callback_t compat_nmi_callback_t diff --git a/xen/common/kernel.c b/xen/common/kernel.c index a4a3c36..f6d2676 100644 --- a/xen/common/kernel.c +++ b/xen/common/kernel.c @@ -221,6 +221,47 @@ void __init do_initcalls(void) #endif +static int get_features(struct domain *d, xen_feature_info_t *fi) +{ + switch ( fi->submap_idx ) + { + case 0: + fi->submap = (1U << XENFEAT_memory_op_vnode_supported); + if ( paging_mode_translate(d) ) + fi->submap |= + (1U << XENFEAT_writable_page_tables) | + (1U << XENFEAT_auto_translated_physmap); + if ( is_hardware_domain(d) ) + fi->submap |= 1U << XENFEAT_dom0; +#ifdef CONFIG_X86 + if ( VM_ASSIST(d, pae_extended_cr3) ) + fi->submap |= (1U << XENFEAT_pae_pgdir_above_4gb); + switch ( d->guest_type ) + { + case guest_type_pv: + fi->submap |= (1U << XENFEAT_mmu_pt_update_preserve_ad) | + (1U << XENFEAT_highmem_assist) | + (1U << XENFEAT_gnttab_map_avail_bits); + break; + case guest_type_pvh: + fi->submap |= (1U << XENFEAT_hvm_safe_pvclock) | + (1U << XENFEAT_supervisor_mode_kernel) | + (1U << XENFEAT_hvm_callback_vector); + break; + case guest_type_hvm: + fi->submap |= (1U << XENFEAT_hvm_safe_pvclock) | + (1U << XENFEAT_hvm_callback_vector) | + (1U << XENFEAT_hvm_pirqs); + break; + } +#endif + break; + default: + return -EINVAL; + } + return 0; +} + /* * Simple hypercalls. */ @@ -298,47 +339,14 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) case XENVER_get_features: { xen_feature_info_t fi; - struct domain *d = current->domain; + int rc; if ( copy_from_guest(&fi, arg, 1) ) return -EFAULT; - switch ( fi.submap_idx ) - { - case 0: - fi.submap = (1U << XENFEAT_memory_op_vnode_supported); - if ( VM_ASSIST(d, pae_extended_cr3) ) - fi.submap |= (1U << XENFEAT_pae_pgdir_above_4gb); - if ( paging_mode_translate(d) ) - fi.submap |= - (1U << XENFEAT_writable_page_tables) | - (1U << XENFEAT_auto_translated_physmap); - if ( is_hardware_domain(d) ) - fi.submap |= 1U << XENFEAT_dom0; -#ifdef CONFIG_X86 - switch ( d->guest_type ) - { - case guest_type_pv: - fi.submap |= (1U << XENFEAT_mmu_pt_update_preserve_ad) | - (1U << XENFEAT_highmem_assist) | - (1U << XENFEAT_gnttab_map_avail_bits); - break; - case guest_type_pvh: - fi.submap |= (1U << XENFEAT_hvm_safe_pvclock) | - (1U << XENFEAT_supervisor_mode_kernel) | - (1U << XENFEAT_hvm_callback_vector); - break; - case guest_type_hvm: - fi.submap |= (1U << XENFEAT_hvm_safe_pvclock) | - (1U << XENFEAT_hvm_callback_vector) | - (1U << XENFEAT_hvm_pirqs); - break; - } -#endif - break; - default: - return -EINVAL; - } + rc = get_features(current->domain, &fi); + if ( rc ) + return rc; if ( __copy_to_guest(arg, &fi, 1) ) return -EFAULT; @@ -381,6 +389,123 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) return -ENOSYS; } +/* Computed by capabilities_cache_init. */ +static xen_capabilities_info_t __read_mostly cached_cap; +static unsigned int __read_mostly cached_cap_len; + +/* + * Similar to HYPERVISOR_xen_version but with a sane interface + * (has a length, one can probe for the length) and with one less sub-ops: + * missing XENVER_compile_info. + */ +DO(version_op)(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg, + unsigned int len) +{ + union { + xen_version_op_val_t val; + xen_feature_info_t fi; + } u = {}; + unsigned int sz = 0; + const void *ptr = NULL; + int rc = xsm_version_op(XSM_OTHER, cmd); + + /* We can safely return -EPERM! */ + if ( rc ) + return rc; + + /* + * The HYPERVISOR_xen_version differs in that some return the value, + * and some copy it on back on argument. We follow the same rule for all + * sub-ops: return the number of bytes written, or negative errno on + * failure, and always copy the result in arg. Yeey sanity! + */ + switch ( cmd ) + { + case XEN_VERSION_version: + sz = sizeof(xen_version_op_val_t); + u.val = (xen_major_version() << 16) | xen_minor_version(); + break; + + case XEN_VERSION_extraversion: + sz = strlen(xen_extra_version()) + 1; + ptr = xen_extra_version(); + break; + + case XEN_VERSION_capabilities: + sz = cached_cap_len; + ptr = cached_cap; + break; + + case XEN_VERSION_changeset: + sz = strlen(xen_changeset()) + 1; + ptr = xen_changeset(); + break; + + case XEN_VERSION_platform_parameters: + sz = sizeof(xen_version_op_val_t); + u.val = HYPERVISOR_VIRT_START; + break; + + case XEN_VERSION_get_features: + sz = sizeof(xen_feature_info_t); + + if ( guest_handle_is_null(arg) ) + break; + + if ( copy_from_guest(&u.fi, arg, 1) ) + { + rc = -EFAULT; + break; + } + rc = get_features(current->domain, &u.fi); + break; + + case XEN_VERSION_pagesize: + sz = sizeof(xen_version_op_val_t); + u.val = PAGE_SIZE; + break; + + case XEN_VERSION_guest_handle: + sz = ARRAY_SIZE(current->domain->handle); + ptr = current->domain->handle; + break; + + case XEN_VERSION_commandline: + sz = strlen(saved_cmdline) + 1; + ptr = saved_cmdline; + break; + + default: + rc = -ENOSYS; + } + + if ( rc ) + return rc; + + /* + * This hypercall also allows the client to probe. If it provides + * a NULL arg we will return the size of the space it has to + * allocate for the specific sub-op. + */ + ASSERT(sz); + if ( guest_handle_is_null(arg) ) + return sz; + + if ( !rc ) + { + unsigned int bytes = min(sz, len); + + if ( copy_to_guest(arg, ptr ? : &u, bytes) ) + rc = -EFAULT; + + /* We return len (truncate) worth of data even if we fail. */ + if ( !rc && sz > len ) + rc = -ENOBUFS; + } + + return rc == 0 ? sz : rc; +} + DO(nmi_op)(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) arg) { struct xennmi_callback cb; @@ -418,6 +543,20 @@ DO(ni_hypercall)(void) return -ENOSYS; } +static int __init capabilities_cache_init(void) +{ + /* + * Pre-allocate the cache so we do not have to worry about + * simultaneous invocations on safe_strcat by guests and the cache + * data becoming garbage. + */ + arch_get_xen_caps(&cached_cap); + cached_cap_len = strlen(cached_cap) + 1; + + return 0; +} +__initcall(capabilities_cache_init); + /* * Local variables: * mode: C diff --git a/xen/include/public/arch-arm.h b/xen/include/public/arch-arm.h index 870bc3b..5f90718 100644 --- a/xen/include/public/arch-arm.h +++ b/xen/include/public/arch-arm.h @@ -128,6 +128,8 @@ * * VCPUOP_register_vcpu_info * * VCPUOP_register_runstate_memory_area * + * HYPERVISOR_version_op + * All generic sub-operations * * Other notes on the ARM ABI: * diff --git a/xen/include/public/version.h b/xen/include/public/version.h index 24a582f..d71ec5b 100644 --- a/xen/include/public/version.h +++ b/xen/include/public/version.h @@ -30,7 +30,14 @@ #include "xen.h" -/* NB. All ops return zero on success, except XENVER_{version,pagesize} */ +/* + * There are two hypercalls mentioned in here. The XENVER_ are for + * HYPERCALL_xen_version (17), while VERSION_ are for the + * HYPERCALL_version_op (41). + * + * The subops are very similar except that the later hypercall has a + * sane interface. + */ /* arg == NULL; returns major:minor (16:16). */ #define XENVER_version 0 @@ -87,6 +94,67 @@ typedef struct xen_feature_info xen_feature_info_t; #define XENVER_commandline 9 typedef char xen_commandline_t[1024]; +/* + * The HYPERCALL_version_op has a set of sub-ops which mirror the + * sub-ops of HYPERCALL_xen_version. However this hypercall differs + * radically from the former: + * - It returns the amount of bytes returned. + * - It will return -XEN_EPERM if the guest is not permitted + * (Albeit XEN_VERSION_version, XEN_VERSION_platform_parameters, and + * XEN_VERSION_get_features will always return an value as guest cannot + * survive without this information). + * - It will return the requested data in arg. + * - It requires an third argument (len) for the length of the + * arg. Naturally the arg has to fit the requested data otherwise + * -XEN_ENOBUFS is returned. + * + * It also offers an mechanism to probe for the amount of bytes an + * sub-op will require. Having the arg have an NULL handle will + * return the number of bytes requested for the operation. Or an + * negative value if an error is encountered. + */ + +typedef uint64_t xen_version_op_val_t; +DEFINE_XEN_GUEST_HANDLE(xen_version_op_val_t); + +/* + * arg == xen_version_op_val_t. Encoded as major:minor (31..16:15..0), while + * 63..32 are zero. + */ +#define XEN_VERSION_version 0 + +/* arg == char[]. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_extraversion 1 + +/* arg == char[]. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_capabilities 3 + +/* arg == char[]. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_changeset 4 + +/* arg == xen_version_op_val_t. */ +#define XEN_VERSION_platform_parameters 5 + +/* + * arg = xen_feature_info_t - shares the same structure + * as the XENVER_get_features. + */ +#define XEN_VERSION_get_features 6 + +/* arg == xen_version_op_val_t. */ +#define XEN_VERSION_pagesize 7 + +/* + * arg == void. + * + * The toolstack fills it out for guest consumption. It is intended to hold + * the UUID of the guest. + */ +#define XEN_VERSION_guest_handle 8 + +/* arg = char[]. Contains NUL terminated utf-8 string. */ +#define XEN_VERSION_commandline 9 + #endif /* __XEN_PUBLIC_VERSION_H__ */ /* diff --git a/xen/include/public/xen.h b/xen/include/public/xen.h index 64ba7ab..1a99929 100644 --- a/xen/include/public/xen.h +++ b/xen/include/public/xen.h @@ -115,6 +115,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_ulong_t); #define __HYPERVISOR_tmem_op 38 #define __HYPERVISOR_xc_reserved_op 39 /* reserved for XenClient */ #define __HYPERVISOR_xenpmu_op 40 +#define __HYPERVISOR_version_op 41 /* supersedes xen_version (17) */ /* Architecture-specific hypercall definitions. */ #define __HYPERVISOR_arch_0 48 diff --git a/xen/include/xen/hypercall.h b/xen/include/xen/hypercall.h index 0c8ae0e..e8d2b81 100644 --- a/xen/include/xen/hypercall.h +++ b/xen/include/xen/hypercall.h @@ -147,6 +147,10 @@ do_xenoprof_op(int op, XEN_GUEST_HANDLE_PARAM(void) arg); extern long do_xenpmu_op(unsigned int op, XEN_GUEST_HANDLE_PARAM(xen_pmu_params_t) arg); +extern long +do_version_op(unsigned int cmd, + XEN_GUEST_HANDLE_PARAM(void) arg, unsigned int len); + #ifdef CONFIG_COMPAT extern int diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h index abbe282..e5dad35 100644 --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -751,3 +751,24 @@ static XSM_INLINE int xsm_xen_version (XSM_DEFAULT_ARG uint32_t op) return xsm_default_action(XSM_PRIV, current->domain, NULL); } } + +static XSM_INLINE int xsm_version_op (XSM_DEFAULT_ARG uint32_t op) +{ + XSM_ASSERT_ACTION(XSM_OTHER); + switch ( op ) + { + case XEN_VERSION_version: + case XEN_VERSION_platform_parameters: + case XEN_VERSION_get_features: + /* These MUST always be accessible to any guest by default. */ + return 0; + case XEN_VERSION_extraversion: + case XEN_VERSION_capabilities: + case XEN_VERSION_pagesize: + case XEN_VERSION_guest_handle: + /* These can be accessible to a guest. */ + return xsm_default_action(XSM_HOOK, current->domain, NULL); + default: + return xsm_default_action(XSM_PRIV, current->domain, NULL); + } +} diff --git a/xen/include/xsm/xsm.h b/xen/include/xsm/xsm.h index 5ecbee0..ac80472 100644 --- a/xen/include/xsm/xsm.h +++ b/xen/include/xsm/xsm.h @@ -194,6 +194,7 @@ struct xsm_operations { int (*pmu_op) (struct domain *d, unsigned int op); #endif int (*xen_version) (uint32_t cmd); + int (*version_op) (uint32_t cmd); }; #ifdef CONFIG_XSM @@ -737,6 +738,11 @@ static inline int xsm_xen_version (xsm_default_t def, uint32_t op) return xsm_ops->xen_version(op); } +static inline int xsm_version_op (xsm_default_t def, uint32_t op) +{ + return xsm_ops->version_op(op); +} + #endif /* XSM_NO_WRAPPERS */ #ifdef CONFIG_MULTIBOOT diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c index 9791ad4..776dd09 100644 --- a/xen/xsm/dummy.c +++ b/xen/xsm/dummy.c @@ -163,4 +163,5 @@ void xsm_fixup_ops (struct xsm_operations *ops) set_to_dummy_if_null(ops, pmu_op); #endif set_to_dummy_if_null(ops, xen_version); + set_to_dummy_if_null(ops, version_op); } diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index 2069cb3..1eaec58 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1658,6 +1658,40 @@ static int flask_xen_version (uint32_t op) } } +static int flask_version_op (uint32_t op) +{ + u32 dsid = domain_sid(current->domain); + + switch ( op ) + { + case XEN_VERSION_version: + case XEN_VERSION_platform_parameters: + case XEN_VERSION_get_features: + /* These MUST always be accessible to any guest by default. */ + return 0; + case XEN_VERSION_extraversion: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__EXTRAVERSION, NULL); + case XEN_VERSION_capabilities: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__CAPABILITIES, NULL); + case XEN_VERSION_changeset: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__CHANGESET, NULL); + case XEN_VERSION_pagesize: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__PAGESIZE, NULL); + case XEN_VERSION_guest_handle: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__GUEST_HANDLE, NULL); + case XEN_VERSION_commandline: + return avc_has_perm(dsid, SECINITSID_XEN, SECCLASS_VERSION, + VERSION__COMMANDLINE, NULL); + default: + return -EPERM; + } +} + long do_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op); int compat_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op); @@ -1797,6 +1831,7 @@ static struct xsm_operations flask_ops = { .pmu_op = flask_pmu_op, #endif .xen_version = flask_xen_version, + .version_op = flask_version_op, }; static __init void flask_init(void) diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors index badcf1c..56600bb 100644 --- a/xen/xsm/flask/policy/access_vectors +++ b/xen/xsm/flask/policy/access_vectors @@ -496,12 +496,14 @@ class security del_ocontext } -# Class version is used to describe the XENVER_ hypercall. +# Class version is used to describe the XENVER_ and VERSION hypercall. # Almost all sub-ops are described here - in the default case all of them should -# be allowed except the XENVER_commandline. +# be allowed except the XENVER_commandline, VERSION_commandline, and +# VERSION_changeset. # # The ones that are omitted are XENVER_version, XENVER_platform_parameters, -# and XENVER_get_features - as they MUST always be returned to a guest. +# XENVER_get_features, XEN_VERSION_version, XEN_VERSION_platform_parameters, +# and XEN_VERSION_get_features - as they MUST always be returned to a guest. # class version { @@ -519,4 +521,17 @@ class version xen_guest_handle # Xen command line. xen_commandline +# --- VERSION hypercall --- +# Extra informations (-unstable). + extraversion +# Such as "xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64". + capabilities +# Source code changeset. + changeset +# Page size the hypervisor uses. + pagesize +# An value that the control stack can choose. + guest_handle +# Xen command line. + commandline }