ia64/xen-unstable

view xen/common/domctl.c @ 16508:d2bef6551c12

xsm: Consolidate xsm processing within domain control hypercall.

Consolidate all the 15 xsm calls from within do_domctl a single
routine that is only called in one place, xsm_domctl:

int xsm_domctl (struct xen_domctl *domctl);

The parameter to domctl is a pointer to the xen_domctl structure that
contains a union of all sub operational parameters.

The benefits of this patch include:

(1) Easier to maintain because there is one place in the entire
hypercall to check with the xsm, instead of 15 or more.

(2) New sub-operations don't also need to add a corresponding xsm
function.

(3) Removes 178 lines of code.

(4) Enhanced security because of 1-4.

Signed-off-by: Mike D. Day <ncmike@us.ibm.com>
author Keir Fraser <keir.fraser@citrix.com>
date Tue Dec 04 10:25:35 2007 +0000 (2007-12-04)
parents bd59dd48e208
children 62451388f630
line source
1 /******************************************************************************
2 * domctl.c
3 *
4 * Domain management operations. For use by node control stack.
5 *
6 * Copyright (c) 2002-2006, K A Fraser
7 */
9 #include <xen/config.h>
10 #include <xen/types.h>
11 #include <xen/lib.h>
12 #include <xen/mm.h>
13 #include <xen/sched.h>
14 #include <xen/domain.h>
15 #include <xen/event.h>
16 #include <xen/domain_page.h>
17 #include <xen/trace.h>
18 #include <xen/console.h>
19 #include <xen/iocap.h>
20 #include <xen/rcupdate.h>
21 #include <xen/guest_access.h>
22 #include <xen/bitmap.h>
23 #include <xen/paging.h>
24 #include <asm/current.h>
25 #include <public/domctl.h>
26 #include <xsm/xsm.h>
28 extern long arch_do_domctl(
29 struct xen_domctl *op, XEN_GUEST_HANDLE(xen_domctl_t) u_domctl);
31 void cpumask_to_xenctl_cpumap(
32 struct xenctl_cpumap *xenctl_cpumap, cpumask_t *cpumask)
33 {
34 unsigned int guest_bytes, copy_bytes, i;
35 uint8_t zero = 0;
36 uint8_t bytemap[(NR_CPUS + 7) / 8];
38 if ( guest_handle_is_null(xenctl_cpumap->bitmap) )
39 return;
41 guest_bytes = (xenctl_cpumap->nr_cpus + 7) / 8;
42 copy_bytes = min_t(unsigned int, guest_bytes, sizeof(bytemap));
44 bitmap_long_to_byte(bytemap, cpus_addr(*cpumask), NR_CPUS);
46 copy_to_guest(xenctl_cpumap->bitmap, bytemap, copy_bytes);
48 for ( i = copy_bytes; i < guest_bytes; i++ )
49 copy_to_guest_offset(xenctl_cpumap->bitmap, i, &zero, 1);
50 }
52 void xenctl_cpumap_to_cpumask(
53 cpumask_t *cpumask, struct xenctl_cpumap *xenctl_cpumap)
54 {
55 unsigned int guest_bytes, copy_bytes;
56 uint8_t bytemap[(NR_CPUS + 7) / 8];
58 guest_bytes = (xenctl_cpumap->nr_cpus + 7) / 8;
59 copy_bytes = min_t(unsigned int, guest_bytes, sizeof(bytemap));
61 cpus_clear(*cpumask);
63 if ( guest_handle_is_null(xenctl_cpumap->bitmap) )
64 return;
66 copy_from_guest(bytemap, xenctl_cpumap->bitmap, copy_bytes);
68 bitmap_byte_to_long(cpus_addr(*cpumask), bytemap, NR_CPUS);
69 }
71 static inline int is_free_domid(domid_t dom)
72 {
73 struct domain *d;
75 if ( dom >= DOMID_FIRST_RESERVED )
76 return 0;
78 if ( (d = rcu_lock_domain_by_id(dom)) == NULL )
79 return 1;
81 rcu_unlock_domain(d);
82 return 0;
83 }
85 void getdomaininfo(struct domain *d, struct xen_domctl_getdomaininfo *info)
86 {
87 struct vcpu *v;
88 u64 cpu_time = 0;
89 int flags = XEN_DOMINF_blocked;
90 struct vcpu_runstate_info runstate;
92 info->domain = d->domain_id;
93 info->nr_online_vcpus = 0;
95 /*
96 * - domain is marked as blocked only if all its vcpus are blocked
97 * - domain is marked as running if any of its vcpus is running
98 */
99 for_each_vcpu ( d, v )
100 {
101 vcpu_runstate_get(v, &runstate);
102 cpu_time += runstate.time[RUNSTATE_running];
103 info->max_vcpu_id = v->vcpu_id;
104 if ( !test_bit(_VPF_down, &v->pause_flags) )
105 {
106 if ( !(v->pause_flags & VPF_blocked) )
107 flags &= ~XEN_DOMINF_blocked;
108 if ( v->is_running )
109 flags |= XEN_DOMINF_running;
110 info->nr_online_vcpus++;
111 }
112 }
114 info->cpu_time = cpu_time;
116 info->flags = flags |
117 ((d->is_dying == DOMDYING_dead) ? XEN_DOMINF_dying : 0) |
118 (d->is_shut_down ? XEN_DOMINF_shutdown : 0) |
119 (d->is_paused_by_controller ? XEN_DOMINF_paused : 0) |
120 (d->debugger_attached ? XEN_DOMINF_debugged : 0) |
121 d->shutdown_code << XEN_DOMINF_shutdownshift;
123 if ( is_hvm_domain(d) )
124 info->flags |= XEN_DOMINF_hvm_guest;
126 xsm_security_domaininfo(d, info);
128 info->tot_pages = d->tot_pages;
129 info->max_pages = d->max_pages;
130 info->shared_info_frame = mfn_to_gmfn(d, __pa(d->shared_info)>>PAGE_SHIFT);
132 memcpy(info->handle, d->handle, sizeof(xen_domain_handle_t));
133 }
135 static unsigned int default_vcpu0_location(void)
136 {
137 struct domain *d;
138 struct vcpu *v;
139 unsigned int i, cpu, cnt[NR_CPUS] = { 0 };
140 cpumask_t cpu_exclude_map;
142 /* Do an initial CPU placement. Pick the least-populated CPU. */
143 rcu_read_lock(&domlist_read_lock);
144 for_each_domain ( d )
145 for_each_vcpu ( d, v )
146 if ( !test_bit(_VPF_down, &v->pause_flags) )
147 cnt[v->processor]++;
148 rcu_read_unlock(&domlist_read_lock);
150 /*
151 * If we're on a HT system, we only auto-allocate to a non-primary HT. We
152 * favour high numbered CPUs in the event of a tie.
153 */
154 cpu = first_cpu(cpu_sibling_map[0]);
155 if ( cpus_weight(cpu_sibling_map[0]) > 1 )
156 cpu = next_cpu(cpu, cpu_sibling_map[0]);
157 cpu_exclude_map = cpu_sibling_map[0];
158 for_each_online_cpu ( i )
159 {
160 if ( cpu_isset(i, cpu_exclude_map) )
161 continue;
162 if ( (i == first_cpu(cpu_sibling_map[i])) &&
163 (cpus_weight(cpu_sibling_map[i]) > 1) )
164 continue;
165 cpus_or(cpu_exclude_map, cpu_exclude_map, cpu_sibling_map[i]);
166 if ( cnt[i] <= cnt[cpu] )
167 cpu = i;
168 }
170 return cpu;
171 }
173 long do_domctl(XEN_GUEST_HANDLE(xen_domctl_t) u_domctl)
174 {
175 long ret = 0;
176 struct xen_domctl curop, *op = &curop;
177 static DEFINE_SPINLOCK(domctl_lock);
179 if ( !IS_PRIV(current->domain) )
180 return -EPERM;
182 if ( copy_from_guest(op, u_domctl, 1) )
183 return -EFAULT;
185 if ( op->interface_version != XEN_DOMCTL_INTERFACE_VERSION )
186 return -EACCES;
188 spin_lock(&domctl_lock);
190 if ( xsm_domctl(op) )
191 goto domctl_out;
193 switch ( op->cmd )
194 {
196 case XEN_DOMCTL_setvcpucontext:
197 {
198 struct domain *d = rcu_lock_domain_by_id(op->domain);
199 vcpu_guest_context_u c = { .nat = NULL };
200 unsigned int vcpu = op->u.vcpucontext.vcpu;
201 struct vcpu *v;
203 ret = -ESRCH;
204 if ( d == NULL )
205 break;
207 ret = -EINVAL;
208 if ( (vcpu >= MAX_VIRT_CPUS) || ((v = d->vcpu[vcpu]) == NULL) )
209 goto svc_out;
211 if ( guest_handle_is_null(op->u.vcpucontext.ctxt) )
212 {
213 ret = vcpu_reset(v);
214 goto svc_out;
215 }
217 #ifdef CONFIG_COMPAT
218 BUILD_BUG_ON(sizeof(struct vcpu_guest_context)
219 < sizeof(struct compat_vcpu_guest_context));
220 #endif
221 ret = -ENOMEM;
222 if ( (c.nat = xmalloc(struct vcpu_guest_context)) == NULL )
223 goto svc_out;
225 if ( !IS_COMPAT(v->domain) )
226 ret = copy_from_guest(c.nat, op->u.vcpucontext.ctxt, 1);
227 #ifdef CONFIG_COMPAT
228 else
229 ret = copy_from_guest(c.cmp,
230 guest_handle_cast(op->u.vcpucontext.ctxt,
231 void), 1);
232 #endif
233 ret = ret ? -EFAULT : 0;
235 if ( ret == 0 )
236 {
237 domain_pause(d);
238 ret = arch_set_info_guest(v, c);
239 domain_unpause(d);
240 }
242 svc_out:
243 xfree(c.nat);
244 rcu_unlock_domain(d);
245 }
246 break;
248 case XEN_DOMCTL_pausedomain:
249 {
250 struct domain *d = rcu_lock_domain_by_id(op->domain);
251 ret = -ESRCH;
252 if ( d != NULL )
253 {
254 ret = -EINVAL;
255 if ( d != current->domain )
256 {
257 domain_pause_by_systemcontroller(d);
258 ret = 0;
259 }
260 rcu_unlock_domain(d);
261 }
262 }
263 break;
265 case XEN_DOMCTL_unpausedomain:
266 {
267 struct domain *d = rcu_lock_domain_by_id(op->domain);
269 ret = -ESRCH;
270 if ( d == NULL )
271 break;
272 domain_unpause_by_systemcontroller(d);
273 rcu_unlock_domain(d);
274 ret = 0;
275 }
276 break;
278 case XEN_DOMCTL_resumedomain:
279 {
280 struct domain *d = rcu_lock_domain_by_id(op->domain);
282 ret = -ESRCH;
283 if ( d == NULL )
284 break;
286 domain_resume(d);
287 rcu_unlock_domain(d);
288 ret = 0;
289 }
290 break;
292 case XEN_DOMCTL_createdomain:
293 {
294 struct domain *d;
295 domid_t dom;
296 static domid_t rover = 0;
297 unsigned int domcr_flags;
299 ret = -EINVAL;
300 if ( supervisor_mode_kernel ||
301 (op->u.createdomain.flags & ~XEN_DOMCTL_CDF_hvm_guest) )
302 break;
304 dom = op->domain;
305 if ( (dom > 0) && (dom < DOMID_FIRST_RESERVED) )
306 {
307 ret = -EINVAL;
308 if ( !is_free_domid(dom) )
309 break;
310 }
311 else
312 {
313 for ( dom = rover + 1; dom != rover; dom++ )
314 {
315 if ( dom == DOMID_FIRST_RESERVED )
316 dom = 0;
317 if ( is_free_domid(dom) )
318 break;
319 }
321 ret = -ENOMEM;
322 if ( dom == rover )
323 break;
325 rover = dom;
326 }
328 domcr_flags = 0;
329 if ( op->u.createdomain.flags & XEN_DOMCTL_CDF_hvm_guest )
330 domcr_flags |= DOMCRF_hvm;
332 ret = -ENOMEM;
333 d = domain_create(dom, domcr_flags, op->u.createdomain.ssidref);
334 if ( d == NULL )
335 break;
337 ret = 0;
339 memcpy(d->handle, op->u.createdomain.handle,
340 sizeof(xen_domain_handle_t));
342 op->domain = d->domain_id;
343 if ( copy_to_guest(u_domctl, op, 1) )
344 ret = -EFAULT;
345 }
346 break;
348 case XEN_DOMCTL_max_vcpus:
349 {
350 struct domain *d;
351 unsigned int i, max = op->u.max_vcpus.max, cpu;
353 ret = -EINVAL;
354 if ( max > MAX_VIRT_CPUS )
355 break;
357 ret = -ESRCH;
358 if ( (d = rcu_lock_domain_by_id(op->domain)) == NULL )
359 break;
361 /* Needed, for example, to ensure writable p.t. state is synced. */
362 domain_pause(d);
364 /* We cannot reduce maximum VCPUs. */
365 ret = -EINVAL;
366 if ( (max != MAX_VIRT_CPUS) && (d->vcpu[max] != NULL) )
367 goto maxvcpu_out;
369 ret = -ENOMEM;
370 for ( i = 0; i < max; i++ )
371 {
372 if ( d->vcpu[i] != NULL )
373 continue;
375 cpu = (i == 0) ?
376 default_vcpu0_location() :
377 (d->vcpu[i-1]->processor + 1) % num_online_cpus();
379 if ( alloc_vcpu(d, i, cpu) == NULL )
380 goto maxvcpu_out;
381 }
383 ret = 0;
385 maxvcpu_out:
386 domain_unpause(d);
387 rcu_unlock_domain(d);
388 }
389 break;
391 case XEN_DOMCTL_destroydomain:
392 {
393 struct domain *d = rcu_lock_domain_by_id(op->domain);
394 ret = -ESRCH;
395 if ( d != NULL )
396 {
397 domain_kill(d);
398 rcu_unlock_domain(d);
399 }
400 }
401 break;
403 case XEN_DOMCTL_setvcpuaffinity:
404 case XEN_DOMCTL_getvcpuaffinity:
405 {
406 domid_t dom = op->domain;
407 struct domain *d = rcu_lock_domain_by_id(dom);
408 struct vcpu *v;
409 cpumask_t new_affinity;
411 ret = -ESRCH;
412 if ( d == NULL )
413 break;
415 ret = -EINVAL;
416 if ( op->u.vcpuaffinity.vcpu >= MAX_VIRT_CPUS )
417 goto vcpuaffinity_out;
419 ret = -ESRCH;
420 if ( (v = d->vcpu[op->u.vcpuaffinity.vcpu]) == NULL )
421 goto vcpuaffinity_out;
423 if ( op->cmd == XEN_DOMCTL_setvcpuaffinity )
424 {
425 xenctl_cpumap_to_cpumask(
426 &new_affinity, &op->u.vcpuaffinity.cpumap);
427 ret = vcpu_set_affinity(v, &new_affinity);
428 }
429 else
430 {
431 cpumask_to_xenctl_cpumap(
432 &op->u.vcpuaffinity.cpumap, &v->cpu_affinity);
433 ret = 0;
434 }
436 vcpuaffinity_out:
437 rcu_unlock_domain(d);
438 }
439 break;
441 case XEN_DOMCTL_scheduler_op:
442 {
443 struct domain *d;
445 ret = -ESRCH;
446 if ( (d = rcu_lock_domain_by_id(op->domain)) == NULL )
447 break;
449 ret = sched_adjust(d, &op->u.scheduler_op);
450 if ( copy_to_guest(u_domctl, op, 1) )
451 ret = -EFAULT;
453 rcu_unlock_domain(d);
454 }
455 break;
457 case XEN_DOMCTL_getdomaininfo:
458 {
459 struct domain *d;
460 domid_t dom = op->domain;
462 rcu_read_lock(&domlist_read_lock);
464 for_each_domain ( d )
465 if ( d->domain_id >= dom )
466 break;
468 if ( d == NULL )
469 {
470 rcu_read_unlock(&domlist_read_lock);
471 ret = -ESRCH;
472 break;
473 }
475 getdomaininfo(d, &op->u.getdomaininfo);
477 op->domain = op->u.getdomaininfo.domain;
478 if ( copy_to_guest(u_domctl, op, 1) )
479 ret = -EFAULT;
481 rcu_read_unlock(&domlist_read_lock);
482 }
483 break;
485 case XEN_DOMCTL_getvcpucontext:
486 {
487 vcpu_guest_context_u c = { .nat = NULL };
488 struct domain *d;
489 struct vcpu *v;
491 ret = -ESRCH;
492 if ( (d = rcu_lock_domain_by_id(op->domain)) == NULL )
493 break;
495 ret = -EINVAL;
496 if ( op->u.vcpucontext.vcpu >= MAX_VIRT_CPUS )
497 goto getvcpucontext_out;
499 ret = -ESRCH;
500 if ( (v = d->vcpu[op->u.vcpucontext.vcpu]) == NULL )
501 goto getvcpucontext_out;
503 ret = -ENODATA;
504 if ( !v->is_initialised )
505 goto getvcpucontext_out;
507 #ifdef CONFIG_COMPAT
508 BUILD_BUG_ON(sizeof(struct vcpu_guest_context)
509 < sizeof(struct compat_vcpu_guest_context));
510 #endif
511 ret = -ENOMEM;
512 if ( (c.nat = xmalloc(struct vcpu_guest_context)) == NULL )
513 goto getvcpucontext_out;
515 if ( v != current )
516 vcpu_pause(v);
518 arch_get_info_guest(v, c);
519 ret = 0;
521 if ( v != current )
522 vcpu_unpause(v);
524 if ( !IS_COMPAT(v->domain) )
525 ret = copy_to_guest(op->u.vcpucontext.ctxt, c.nat, 1);
526 #ifdef CONFIG_COMPAT
527 else
528 ret = copy_to_guest(guest_handle_cast(op->u.vcpucontext.ctxt,
529 void), c.cmp, 1);
530 #endif
532 if ( copy_to_guest(u_domctl, op, 1) || ret )
533 ret = -EFAULT;
535 getvcpucontext_out:
536 xfree(c.nat);
537 rcu_unlock_domain(d);
538 }
539 break;
541 case XEN_DOMCTL_getvcpuinfo:
542 {
543 struct domain *d;
544 struct vcpu *v;
545 struct vcpu_runstate_info runstate;
547 ret = -ESRCH;
548 if ( (d = rcu_lock_domain_by_id(op->domain)) == NULL )
549 break;
551 ret = -EINVAL;
552 if ( op->u.getvcpuinfo.vcpu >= MAX_VIRT_CPUS )
553 goto getvcpuinfo_out;
555 ret = -ESRCH;
556 if ( (v = d->vcpu[op->u.getvcpuinfo.vcpu]) == NULL )
557 goto getvcpuinfo_out;
559 vcpu_runstate_get(v, &runstate);
561 op->u.getvcpuinfo.online = !test_bit(_VPF_down, &v->pause_flags);
562 op->u.getvcpuinfo.blocked = test_bit(_VPF_blocked, &v->pause_flags);
563 op->u.getvcpuinfo.running = v->is_running;
564 op->u.getvcpuinfo.cpu_time = runstate.time[RUNSTATE_running];
565 op->u.getvcpuinfo.cpu = v->processor;
566 ret = 0;
568 if ( copy_to_guest(u_domctl, op, 1) )
569 ret = -EFAULT;
571 getvcpuinfo_out:
572 rcu_unlock_domain(d);
573 }
574 break;
576 case XEN_DOMCTL_max_mem:
577 {
578 struct domain *d;
579 unsigned long new_max;
581 ret = -ESRCH;
582 d = rcu_lock_domain_by_id(op->domain);
583 if ( d == NULL )
584 break;
586 ret = -EINVAL;
587 new_max = op->u.max_mem.max_memkb >> (PAGE_SHIFT-10);
589 spin_lock(&d->page_alloc_lock);
590 if ( new_max >= d->tot_pages )
591 {
592 ret = guest_physmap_max_mem_pages(d, new_max);
593 if ( ret != 0 )
594 break;
595 d->max_pages = new_max;
596 ret = 0;
597 }
598 spin_unlock(&d->page_alloc_lock);
600 rcu_unlock_domain(d);
601 }
602 break;
604 case XEN_DOMCTL_setdomainhandle:
605 {
606 struct domain *d;
608 ret = -ESRCH;
609 d = rcu_lock_domain_by_id(op->domain);
610 if ( d == NULL )
611 break;
613 memcpy(d->handle, op->u.setdomainhandle.handle,
614 sizeof(xen_domain_handle_t));
615 rcu_unlock_domain(d);
616 ret = 0;
617 }
618 break;
620 case XEN_DOMCTL_setdebugging:
621 {
622 struct domain *d;
624 ret = -ESRCH;
625 d = rcu_lock_domain_by_id(op->domain);
626 if ( d == NULL )
627 break;
629 domain_pause(d);
630 d->debugger_attached = !!op->u.setdebugging.enable;
631 domain_unpause(d); /* causes guest to latch new status */
632 rcu_unlock_domain(d);
633 ret = 0;
634 }
635 break;
637 case XEN_DOMCTL_irq_permission:
638 {
639 struct domain *d;
640 unsigned int pirq = op->u.irq_permission.pirq;
642 ret = -EINVAL;
643 if ( pirq >= NR_IRQS )
644 break;
646 ret = -ESRCH;
647 d = rcu_lock_domain_by_id(op->domain);
648 if ( d == NULL )
649 break;
651 if ( op->u.irq_permission.allow_access )
652 ret = irq_permit_access(d, pirq);
653 else
654 ret = irq_deny_access(d, pirq);
656 rcu_unlock_domain(d);
657 }
658 break;
660 case XEN_DOMCTL_iomem_permission:
661 {
662 struct domain *d;
663 unsigned long mfn = op->u.iomem_permission.first_mfn;
664 unsigned long nr_mfns = op->u.iomem_permission.nr_mfns;
666 ret = -EINVAL;
667 if ( (mfn + nr_mfns - 1) < mfn ) /* wrap? */
668 break;
670 ret = -ESRCH;
671 d = rcu_lock_domain_by_id(op->domain);
672 if ( d == NULL )
673 break;
675 if ( op->u.iomem_permission.allow_access )
676 ret = iomem_permit_access(d, mfn, mfn + nr_mfns - 1);
677 else
678 ret = iomem_deny_access(d, mfn, mfn + nr_mfns - 1);
680 rcu_unlock_domain(d);
681 }
682 break;
684 case XEN_DOMCTL_settimeoffset:
685 {
686 struct domain *d;
688 ret = -ESRCH;
689 d = rcu_lock_domain_by_id(op->domain);
690 if ( d != NULL )
691 {
692 d->time_offset_seconds = op->u.settimeoffset.time_offset_seconds;
693 rcu_unlock_domain(d);
694 ret = 0;
695 }
696 }
697 break;
699 default:
700 ret = arch_do_domctl(op, u_domctl);
701 break;
702 }
704 domctl_out:
705 spin_unlock(&domctl_lock);
707 return ret;
708 }
710 /*
711 * Local variables:
712 * mode: C
713 * c-set-style: "BSD"
714 * c-basic-offset: 4
715 * tab-width: 4
716 * indent-tabs-mode: nil
717 * End:
718 */