@@ -46,6 +46,7 @@ allow dom0_t dom0_t:resource { add remove };
# Allow dom0 to communicate with a nested Xen hypervisor
allow dom0_t nestedxen_t:version { xen_version xen_get_features };
allow dom0_t nestedxen_t:mmu physmap;
+allow dom0_t nestedxen_t:hvm { setparam getparam };
# These permissions allow using the FLASK security server to compute access
# checks locally, which could be used by a domain or service (such as xenstore)
@@ -62,6 +62,7 @@ DECLARE_HYPERCALL(argo_op)
DECLARE_HYPERCALL(xenpmu_op)
DECLARE_HYPERCALL(nested_xen_version)
DECLARE_HYPERCALL(nested_memory_op)
+DECLARE_HYPERCALL(nested_hvm_op)
DECLARE_HYPERCALL(arch_0)
DECLARE_HYPERCALL(arch_1)
@@ -22,6 +22,7 @@
#include <xen/lib.h>
#include <xen/sched.h>
+#include <public/hvm/hvm_op.h>
#include <public/memory.h>
#include <public/version.h>
#include <public/xen.h>
@@ -160,3 +161,44 @@ int compat_nested_memory_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
return nested_add_to_physmap(*nat);
}
#endif
+
+long do_nested_hvm_op(int cmd, XEN_GUEST_HANDLE_PARAM(void) arg)
+{
+ struct xen_hvm_param a;
+ long ret;
+
+ if ( !xen_nested )
+ return -ENOSYS;
+
+ ret = xsm_nested_hvm_op(XSM_PRIV, current->domain, cmd);
+ if ( ret )
+ return ret;
+
+ switch ( cmd )
+ {
+ case HVMOP_set_param:
+ {
+ if ( copy_from_guest(&a, arg, 1) )
+ return -EFAULT;
+
+ return xen_hypercall_hvm_op(cmd, &a);
+ }
+
+ case HVMOP_get_param:
+ {
+ if ( copy_from_guest(&a, arg, 1) )
+ return -EFAULT;
+
+ ret = xen_hypercall_hvm_op(cmd, &a);
+
+ if ( !ret && __copy_to_guest(arg, &a, 1) )
+ return -EFAULT;
+
+ return ret;
+ }
+
+ default:
+ gprintk(XENLOG_ERR, "Nested hvm op %d not implemented.\n", cmd);
+ return -EOPNOTSUPP;
+ }
+}
@@ -76,6 +76,7 @@ const hypercall_args_t hypercall_args_table[NR_hypercalls] =
#ifdef CONFIG_XEN_NESTED
ARGS(nested_xen_version, 2),
COMP(nested_memory_op, 2, 2),
+ ARGS(nested_hvm_op, 2),
#endif
ARGS(mca, 1),
ARGS(arch_1, 1),
@@ -87,6 +87,7 @@ const hypercall_table_t pv_hypercall_table[] = {
#ifdef CONFIG_XEN_NESTED
HYPERCALL(nested_xen_version),
COMPAT_CALL(nested_memory_op),
+ HYPERCALL(nested_hvm_op),
#endif
HYPERCALL(mca),
HYPERCALL(arch_1),
@@ -123,6 +123,7 @@ DEFINE_XEN_GUEST_HANDLE(xen_ulong_t);
#define __HYPERVISOR_dm_op 41
#define __HYPERVISOR_nested_xen_version 42
#define __HYPERVISOR_nested_memory_op 43
+#define __HYPERVISOR_nested_hvm_op 44
/* Architecture-specific hypercall definitions. */
#define __HYPERVISOR_arch_0 48
@@ -158,6 +158,10 @@ extern long do_nested_xen_version(
extern long do_nested_memory_op(
int cmd,
XEN_GUEST_HANDLE_PARAM(void) arg);
+
+extern long do_nested_hvm_op(
+ int cmd,
+ XEN_GUEST_HANDLE_PARAM(void) arg);
#endif
#ifdef CONFIG_COMPAT
@@ -754,6 +754,13 @@ static XSM_INLINE int xsm_nested_add_to_physmap(XSM_DEFAULT_ARG
XSM_ASSERT_ACTION(XSM_PRIV);
return xsm_default_action(action, d, NULL);
}
+
+static XSM_INLINE int xsm_nested_hvm_op(XSM_DEFAULT_ARG const struct domain *d,
+ unsigned int cmd)
+{
+ XSM_ASSERT_ACTION(XSM_PRIV);
+ return xsm_default_action(action, d, NULL);
+}
#endif
#include <public/version.h>
@@ -190,6 +190,7 @@ struct xsm_operations {
#ifdef CONFIG_XEN_NESTED
int (*nested_xen_version) (const struct domain *d, unsigned int cmd);
int (*nested_add_to_physmap) (const struct domain *d);
+ int (*nested_hvm_op) (const struct domain *d, unsigned int cmd);
#endif
};
@@ -741,6 +742,12 @@ static inline int xsm_nested_add_to_physmap(xsm_default_t def,
return xsm_ops->nested_add_to_physmap(d);
}
+static inline int xsm_nested_hvm_op(xsm_default_t def, const struct domain *d,
+ unsigned int cmd)
+{
+ return xsm_ops->nested_hvm_op(d, cmd);
+}
+
#endif /* CONFIG_XEN_NESTED */
#endif /* XSM_NO_WRAPPERS */
@@ -160,5 +160,6 @@ void __init xsm_fixup_ops (struct xsm_operations *ops)
#ifdef CONFIG_XEN_NESTED
set_to_dummy_if_null(ops, nested_xen_version);
set_to_dummy_if_null(ops, nested_add_to_physmap);
+ set_to_dummy_if_null(ops, nested_hvm_op);
#endif
}
@@ -1768,6 +1768,27 @@ static int flask_nested_xen_version(const struct domain *d, unsigned int op)
return domain_has_xen_version(d, SECINITSID_NESTEDXEN, op);
}
+static int flask_nested_hvm_op(const struct domain *d, unsigned int op)
+{
+ u32 perm;
+
+ switch ( op )
+ {
+ case HVMOP_set_param:
+ perm = HVM__SETPARAM;
+ break;
+
+ case HVMOP_get_param:
+ perm = HVM__GETPARAM;
+ break;
+
+ default:
+ perm = HVM__HVMCTL;
+ }
+
+ return domain_has_nested_perm(d, SECCLASS_HVM, perm);
+}
+
#endif
long do_flask_op(XEN_GUEST_HANDLE_PARAM(xsm_op_t) u_flask_op);
@@ -1912,6 +1933,7 @@ static struct xsm_operations flask_ops = {
#ifdef CONFIG_XEN_NESTED
.nested_xen_version = flask_nested_xen_version,
.nested_add_to_physmap = flask_nested_add_to_physmap,
+ .nested_hvm_op = flask_nested_hvm_op,
#endif
};
Provides proxying to the host hypervisor for HVMOP_get_param and HVMOP_set_param ops. Signed-off-by: Christopher Clark <christopher.clark@starlab.io> --- tools/flask/policy/modules/dom0.te | 1 + xen/arch/x86/guest/hypercall_page.S | 1 + xen/arch/x86/guest/xen-nested.c | 42 +++++++++++++++++++++++++++++ xen/arch/x86/hypercall.c | 1 + xen/arch/x86/pv/hypercall.c | 1 + xen/include/public/xen.h | 1 + xen/include/xen/hypercall.h | 4 +++ xen/include/xsm/dummy.h | 7 +++++ xen/include/xsm/xsm.h | 7 +++++ xen/xsm/dummy.c | 1 + xen/xsm/flask/hooks.c | 22 +++++++++++++++ 11 files changed, 88 insertions(+)