mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Konrad Rzeszutek Wilk
722b6d259f
This reverts commit 2716d87537.
As it was decided that the existing XENVER hypercall - while having
grown organically over the years can still be expanded.
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Requested-and-acked-by: Jan Beulich <jbeulich@suse.com>
527 lines
16 KiB
Plaintext
527 lines
16 KiB
Plaintext
#
|
|
# Define the access vectors.
|
|
#
|
|
# class class_name { permission_name ... }
|
|
|
|
# Class xen and xen2 consists of dom0-only operations dealing with the
|
|
# hypervisor itself. Unless otherwise specified, the source is the domain
|
|
# executing the hypercall, and the target is the xen initial sid (type xen_t).
|
|
class xen
|
|
{
|
|
# XENPF_settime32
|
|
# XENPF_settime64
|
|
settime
|
|
# XEN_SYSCTL_tbuf_op
|
|
tbufcontrol
|
|
# CONSOLEIO_read, XEN_SYSCTL_readconsole
|
|
readconsole
|
|
# XEN_SYSCTL_readconsole with clear=1
|
|
clearconsole
|
|
# XEN_SYSCTL_perfc_op
|
|
perfcontrol
|
|
# XENPF_add_memtype
|
|
mtrr_add
|
|
# XENPF_del_memtype
|
|
mtrr_del
|
|
# XENPF_read_memtype
|
|
mtrr_read
|
|
# XENPF_microcode_update
|
|
microcode
|
|
# XEN_SYSCTL_physinfo, XEN_SYSCTL_cputopoinfo, XEN_SYSCTL_numainfo
|
|
# XEN_SYSCTL_pcitopoinfo
|
|
physinfo
|
|
# XENPF_platform_quirk
|
|
quirk
|
|
# CONSOLEIO_write
|
|
writeconsole
|
|
# PHYSDEVOP_apic_read, PHYSDEVOP_alloc_irq_vector
|
|
readapic
|
|
# PHYSDEVOP_apic_write
|
|
writeapic
|
|
# Most XENOPROF_*
|
|
privprofile
|
|
# XENOPROF_{init,enable_virq,disable_virq,get_buffer}
|
|
nonprivprofile
|
|
# kexec hypercall
|
|
kexec
|
|
# XENPF_firmware_info, XENPF_efi_runtime_call
|
|
firmware
|
|
# XENPF_enter_acpi_sleep
|
|
sleep
|
|
# XENPF_change_freq
|
|
frequency
|
|
# XENPF_getidletime
|
|
getidle
|
|
# XEN_SYSCTL_debug_keys
|
|
debug
|
|
# XEN_SYSCTL_getcpuinfo, XENPF_get_cpu_version, XENPF_get_cpuinfo
|
|
getcpuinfo
|
|
# XEN_SYSCTL_availheap
|
|
heap
|
|
# XEN_SYSCTL_get_pmstat, XEN_SYSCTL_pm_op, XENPF_set_processor_pminfo,
|
|
# XENPF_core_parking
|
|
pm_op
|
|
# mca hypercall
|
|
mca_op
|
|
# XEN_SYSCTL_lockprof_op
|
|
lockprof
|
|
# XEN_SYSCTL_cpupool_op
|
|
cpupool_op
|
|
# tmem hypercall (any access)
|
|
tmem_op
|
|
# XEN_SYSCTL_tmem_op command of tmem (part of sysctl)
|
|
tmem_control
|
|
# XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_getinfo, XEN_SYSCTL_sched_id
|
|
getscheduler
|
|
# XEN_SYSCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_putinfo
|
|
setscheduler
|
|
}
|
|
|
|
# This is a continuation of class xen, since only 32 permissions can be
|
|
# defined per class
|
|
class xen2
|
|
{
|
|
# XENPF_resource_op
|
|
resource_op
|
|
# XEN_SYSCTL_psr_cmt_op
|
|
psr_cmt_op
|
|
# XEN_SYSCTL_psr_cat_op
|
|
psr_cat_op
|
|
# XENPF_get_symbol
|
|
get_symbol
|
|
# PMU control
|
|
pmu_ctrl
|
|
# PMU use (domains, including unprivileged ones, will be using this operation)
|
|
pmu_use
|
|
# XEN_SYSCTL_get_cpu_levelling_caps
|
|
get_cpu_levelling_caps
|
|
# XEN_SYSCTL_get_cpu_featureset
|
|
get_cpu_featureset
|
|
}
|
|
|
|
# Classes domain and domain2 consist of operations that a domain performs on
|
|
# another domain or on itself. Unless otherwise specified, the source is the
|
|
# domain executing the hypercall, and the target is the domain being operated on
|
|
# (which may result in a _self or _target type).
|
|
#
|
|
# transitions in class domain are used to produce the _self and _target types;
|
|
# see docs/misc/xsm-flask.txt and the example XSM policy for details.
|
|
class domain
|
|
{
|
|
# XEN_DOMCTL_setvcpucontext
|
|
setvcpucontext
|
|
# XEN_DOMCTL_pausedomain
|
|
pause
|
|
# XEN_DOMCTL_unpausedomain
|
|
unpause
|
|
# XEN_DOMCTL_resumedomain
|
|
resume
|
|
# XEN_DOMCTL_arm_createdomain
|
|
create
|
|
# checked in FLASK_RELABEL_DOMAIN for any relabel operation:
|
|
# source = the old label of the domain
|
|
# target = the new label of the domain
|
|
# see also the domain2 relabel{from,to,self} permissions
|
|
transition
|
|
# XEN_DOMCTL_max_vcpus
|
|
max_vcpus
|
|
# XEN_DOMCTL_destroydomain
|
|
destroy
|
|
# XEN_DOMCTL_setvcpuaffinity
|
|
# XEN_DOMCTL_setnodeaffinity
|
|
setaffinity
|
|
# XEN_DOMCTL_getvcpuaffinity
|
|
# XEN_DOMCTL_getnodeaffinity
|
|
getaffinity
|
|
# XEN_DOMCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_getinfo
|
|
getscheduler
|
|
# XEN_DOMCTL_getdomaininfo, XEN_SYSCTL_getdomaininfolist
|
|
getdomaininfo
|
|
# XEN_DOMCTL_getvcpuinfo
|
|
getvcpuinfo
|
|
# XEN_DOMCTL_getvcpucontext
|
|
getvcpucontext
|
|
# XEN_DOMCTL_max_mem
|
|
setdomainmaxmem
|
|
# XEN_DOMCTL_setdomainhandle
|
|
setdomainhandle
|
|
# XEN_DOMCTL_setdebugging
|
|
setdebugging
|
|
# XEN_DOMCTL_hypercall_init
|
|
hypercall
|
|
# XEN_DOMCTL_settimeoffset
|
|
settime
|
|
# checked in XEN_DOMCTL_set_target:
|
|
# source = the new device model domain
|
|
# target = the new target domain
|
|
# see also the domain2 make_priv_for and set_as_target checks
|
|
set_target
|
|
# SCHEDOP_remote_shutdown
|
|
shutdown
|
|
# XEN_DOMCTL_set{,_machine}_address_size
|
|
setaddrsize
|
|
# XEN_DOMCTL_get{,_machine}_address_size
|
|
getaddrsize
|
|
# XEN_DOMCTL_sendtrigger
|
|
trigger
|
|
# XEN_DOMCTL_get_ext_vcpucontext
|
|
# XEN_DOMCTL_set_vcpu_msrs
|
|
getextvcpucontext
|
|
# XEN_DOMCTL_set_ext_vcpucontext
|
|
# XEN_DOMCTL_get_vcpu_msrs
|
|
setextvcpucontext
|
|
# XEN_DOMCTL_getvcpuextstate
|
|
getvcpuextstate
|
|
# XEN_DOMCTL_setvcpuextstate
|
|
setvcpuextstate
|
|
# XENMEM_get_pod_target
|
|
getpodtarget
|
|
# XENMEM_set_pod_target
|
|
setpodtarget
|
|
# XEN_DOMCTL_subscribe, XEN_DOMCTL_disable_migrate,
|
|
# XEN_DOMCTL_suppress_spurious_page_faults
|
|
set_misc_info
|
|
# XEN_DOMCTL_set_virq_handler
|
|
set_virq_handler
|
|
}
|
|
|
|
# This is a continuation of class domain, since only 32 permissions can be
|
|
# defined per class
|
|
class domain2
|
|
{
|
|
# checked in FLASK_RELABEL_DOMAIN with non-DOMID_SELF:
|
|
# source = the domain making the hypercall
|
|
# target = the old label of the domain being relabeled
|
|
relabelfrom
|
|
# checked in FLASK_RELABEL_DOMAIN with non-DOMID_SELF:
|
|
# source = the domain making the hypercall
|
|
# target = the new label of the domain being relabeled
|
|
relabelto
|
|
# checked in FLASK_RELABEL_DOMAIN, only with DOMID_SELF:
|
|
# source = the old label of the domain
|
|
# target = the new label of the domain
|
|
# see also domain__transition
|
|
relabelself
|
|
# checked in XEN_DOMCTL_set_target:
|
|
# source = the domain making the hypercall
|
|
# target = the new device model domain
|
|
make_priv_for
|
|
# checked in XEN_DOMCTL_set_target:
|
|
# source = the domain making the hypercall
|
|
# target = the new target domain
|
|
set_as_target
|
|
# XEN_DOMCTL_set_cpuid
|
|
set_cpuid
|
|
# XEN_DOMCTL_gettscinfo
|
|
gettsc
|
|
# XEN_DOMCTL_settscinfo
|
|
settsc
|
|
# XEN_DOMCTL_scheduler_op with XEN_DOMCTL_SCHEDOP_putinfo
|
|
setscheduler
|
|
# XENMEM_claim_pages
|
|
setclaim
|
|
# XEN_DOMCTL_set_max_evtchn
|
|
set_max_evtchn
|
|
# XEN_DOMCTL_cacheflush
|
|
cacheflush
|
|
# Creation of the hardware domain when it is not dom0
|
|
create_hardware_domain
|
|
# XEN_DOMCTL_setvnumainfo
|
|
set_vnumainfo
|
|
# XENMEM_getvnumainfo
|
|
get_vnumainfo
|
|
# XEN_DOMCTL_psr_cmt_op
|
|
psr_cmt_op
|
|
# XEN_DOMCTL_set_access_required
|
|
# XEN_DOMCTL_monitor_op
|
|
# XEN_DOMCTL_vm_event_op
|
|
vm_event
|
|
# XEN_DOMCTL_soft_reset
|
|
soft_reset
|
|
# XENMEM_access_op
|
|
mem_access
|
|
# XENMEM_paging_op
|
|
mem_paging
|
|
# XENMEM_sharing_op
|
|
mem_sharing
|
|
# XEN_DOMCTL_psr_cat_op
|
|
psr_cat_op
|
|
}
|
|
|
|
# Similar to class domain, but primarily contains domctls related to HVM domains
|
|
class hvm
|
|
{
|
|
# XEN_DOMCTL_sethvmcontext
|
|
sethvmc
|
|
# XEN_DOMCTL_gethvmcontext, XEN_DOMCTL_gethvmcontext_partial
|
|
gethvmc
|
|
# HVMOP_set_param
|
|
setparam
|
|
# HVMOP_get_param
|
|
getparam
|
|
# HVMOP_set_pci_intx_level (also needs hvmctl)
|
|
pcilevel
|
|
# HVMOP_set_isa_irq_level
|
|
irqlevel
|
|
# HVMOP_set_pci_link_route
|
|
pciroute
|
|
bind_irq
|
|
# XEN_DOMCTL_pin_mem_cacheattr
|
|
cacheattr
|
|
# HVMOP_track_dirty_vram
|
|
trackdirtyvram
|
|
# HVMOP_modified_memory, HVMOP_get_mem_type, HVMOP_set_mem_type,
|
|
# HVMOP_set_mem_access, HVMOP_get_mem_access, HVMOP_pagetable_dying,
|
|
# HVMOP_inject_trap
|
|
hvmctl
|
|
# XEN_DOMCTL_mem_sharing_op and XENMEM_sharing_op_{share,add_physmap} with:
|
|
# source = the domain making the hypercall
|
|
# target = domain whose memory is being shared
|
|
mem_sharing
|
|
# XEN_DOMCTL_audit_p2m
|
|
audit_p2m
|
|
# HVMOP_inject_msi
|
|
send_irq
|
|
# checked in XENMEM_sharing_op_{share,add_physmap} with:
|
|
# source = domain whose memory is being shared
|
|
# target = client domain
|
|
share_mem
|
|
# HVMOP_set_param setting HVM_PARAM_NESTEDHVM
|
|
nested
|
|
# HVMOP_set_param setting HVM_PARAM_ALTP2MHVM
|
|
altp2mhvm
|
|
# HVMOP_altp2m_set_domain_state HVMOP_altp2m_get_domain_state
|
|
# HVMOP_altp2m_vcpu_enable_notify HVMOP_altp2m_create_p2m
|
|
# HVMOP_altp2m_destroy_p2m HVMOP_altp2m_switch_p2m
|
|
# HVMOP_altp2m_set_mem_access HVMOP_altp2m_change_gfn
|
|
altp2mhvm_op
|
|
}
|
|
|
|
# Class event describes event channels. Interdomain event channels have their
|
|
# own security label which is computed using a type transition between the
|
|
# source and target domains. Each endpoint has its own label, and the
|
|
# permission checks must pass on both endpoints for an event channel to be
|
|
# established.
|
|
class event
|
|
{
|
|
# when creating an interdomain event channel endpoint:
|
|
# source = event channel label
|
|
# target = remote domain the event channel binds to. This may be a _self or
|
|
# _target label if the endpoints are related as such.
|
|
# This permission is checked when creating an unbound event channel and when the
|
|
# interdomain event channel is established.
|
|
bind
|
|
# EVTCHNOP_send:
|
|
# source = domain sending the event
|
|
# target = event channel label
|
|
send
|
|
# EVTCHNOP_status; same as _send
|
|
status
|
|
# when creating an interdomain event channel endpoint:
|
|
# source = the domain creating the channel (which might not be an endpoint)
|
|
# target = event channel label
|
|
create
|
|
# EVTCHNOP_reset:
|
|
# source = domain making the hypercall
|
|
# target = domain whose event channels are being reset
|
|
reset
|
|
}
|
|
|
|
# Class grant describes pages shared by grant mappings. Pages use the security
|
|
# label of their owning domain.
|
|
class grant
|
|
{
|
|
# GNTTABOP_map_grant_ref with any access
|
|
map_read
|
|
# GNTTABOP_map_grant_ref with write access
|
|
map_write
|
|
# GNTTABOP_unmap_grant_ref
|
|
unmap
|
|
# GNTTABOP_transfer
|
|
transfer
|
|
# GNTTABOP_setup_table, GNTTABOP_get_status_frames (target is commonly _self)
|
|
setup
|
|
# GNTTABOP_copy
|
|
copy
|
|
# GNTTABOP_query_size, GNTTABOP_get_version
|
|
query
|
|
}
|
|
|
|
# Class mmu describes pages of memory not accessed using grants. Permissions
|
|
# are checked using the domain ID used to access the page - the most common case
|
|
# is a domain's own ID (the _self label). Using DOMID_IO in the map command to
|
|
# restrict the mapping to IO memory will result in the target being domio_t, and
|
|
# migration uses read-only mappings with a target of DOMID_XEN (domxen_t).
|
|
class mmu
|
|
{
|
|
# checked when using mmu_update to map a page readably
|
|
# source = domain making the hypercall (which might not own the page table)
|
|
# target = domain whose pages are being mapped
|
|
map_read
|
|
# checked when using mmu_update to map a page writably
|
|
# source = domain making the hypercall
|
|
# target = domain whose pages are being mapped
|
|
map_write
|
|
# XEN_DOMCTL_getpageframeinfo3
|
|
pageinfo
|
|
# XEN_DOMCTL_getmemlist
|
|
pagelist
|
|
# XENMEM_{increase,decrease}_reservation, XENMEM_populate_physmap
|
|
adjust
|
|
# XENMEM_{current,maximum}_reservation, XENMEM_maximum_gpfn
|
|
stat
|
|
# mmu_update MMU_MACHPHYS_UPDATE
|
|
updatemp
|
|
# XENMEM_add_to_physmap, XENMEM_remove_from_physmap
|
|
physmap
|
|
# MMUEXT_PIN_L*_TABLE
|
|
pinpage
|
|
# XENMEM_machine_memory_map (with target xen_t)
|
|
# XENMEM_set_memory_map (with domain target)
|
|
memorymap
|
|
# checked when using mmu_update to update the page tables of another domain
|
|
# source = domain making the hypercall
|
|
# target = domain whose page tables are being modified
|
|
remote_remap
|
|
# the mmuext_op hypercall acting on the target domain
|
|
mmuext_op
|
|
# XENMEM_exchange:
|
|
# source = domain making the hypercall
|
|
# target = domain whose pages are being exchanged
|
|
exchange
|
|
# Allow a privileged domain to install a map of a page it does not own. Used
|
|
# for stub domain device models with the PV framebuffer.
|
|
target_hack
|
|
}
|
|
|
|
# control of the paging_domctl split by subop
|
|
class shadow
|
|
{
|
|
# XEN_DOMCTL_SHADOW_OP_OFF
|
|
disable
|
|
# enable, get/set allocation
|
|
enable
|
|
# enable, read, and clean log
|
|
logdirty
|
|
}
|
|
|
|
# Class resource is used to describe the resources used in hardware device
|
|
# passthrough. Resources include: hardware IRQs, MMIO regions, x86 I/O ports,
|
|
# and PCI devices; see docs/misc/xsm-flask.txt for how to label them.
|
|
#
|
|
# Access to the legacy PCI configuration space on x86 via port 0xCF8/CFC
|
|
# requires IS_PRIV, even with FLASK. Writes to the BARs are checked as "setup",
|
|
# while other reads/writes are "use"; the target is the PCI device whose
|
|
# configuration space is being modified. Accesses to the MMIO-based PCI express
|
|
# configuration space described by the ACPI MCFG table are controlled as MMIO
|
|
# accesses, and cannot special-case BAR writes.
|
|
#
|
|
# The {add,remove}_{irq,ioport,iomem,device} permissions use:
|
|
# source = domain making the hypercall
|
|
# target = resource's security label
|
|
class resource
|
|
{
|
|
# checked when adding a resource to a domain:
|
|
# source = domain making the hypercall
|
|
# target = domain which will have access to the resource
|
|
add
|
|
# checked when removing a resource from a domain:
|
|
# source = domain making the hypercall
|
|
# target = domain which will no longer have access to the resource
|
|
remove
|
|
# checked when adding a resource to a domain:
|
|
# source = domain which will have access to the resource
|
|
# target = resource's security label
|
|
# also checked when using some core Xen devices (target xen_t)
|
|
use
|
|
# PHYSDEVOP_map_pirq and ioapic writes for dom0, when acting on real IRQs
|
|
# For GSI interrupts, the IRQ's label is indexed by the IRQ number
|
|
# For MSI interrupts, the label of the PCI device is used
|
|
add_irq
|
|
# PHYSDEVOP_unmap_pirq (same as map, and only for real IRQs)
|
|
remove_irq
|
|
# XEN_DOMCTL_ioport_permission, XEN_DOMCTL_ioport_mapping
|
|
add_ioport
|
|
remove_ioport
|
|
# XEN_DOMCTL_iomem_permission, XEN_DOMCTL_memory_mapping
|
|
add_iomem
|
|
remove_iomem
|
|
# XEN_DOMCTL_get_device_group, XEN_DOMCTL_test_assign_device:
|
|
# source = domain making the hypercall
|
|
# target = device being queried
|
|
stat_device
|
|
# XEN_DOMCTL_assign_device
|
|
add_device
|
|
# XEN_DOMCTL_deassign_device
|
|
remove_device
|
|
# checked for PCI hot and cold-plug hypercalls, with target as the PCI device
|
|
# checked for CPU and memory hotplug with xen_t as the target
|
|
plug
|
|
# checked for PCI hot-unplug hypercalls, with target as the PCI device
|
|
# checked for CPU offlining with xen_t as the target
|
|
unplug
|
|
# checked for PHYSDEVOP_restore_msi* (target PCI device)
|
|
# checked for PHYSDEVOP_setup_gsi (target IRQ)
|
|
# checked for PHYSDEVOP_pci_mmcfg_reserved (target xen_t)
|
|
setup
|
|
}
|
|
|
|
# Class security describes the FLASK security server itself; these operations
|
|
# are accessed using the xsm_op hypercall. The source is the domain invoking
|
|
# the hypercall, and the target is security_t.
|
|
#
|
|
# Any domain with access to load_policy or setenforce must be trusted, since it
|
|
# can bypass the rest of the security policy.
|
|
class security
|
|
{
|
|
# use the security server to compute an access check
|
|
compute_av
|
|
# use the security server to compute a type transition
|
|
compute_create
|
|
# use the security server to compute member selection
|
|
compute_member
|
|
# sid <-> context string conversions
|
|
check_context
|
|
# allow loading a new XSM/FLASK policy
|
|
load_policy
|
|
# use the security server to compute an object relabel
|
|
compute_relabel
|
|
# use the security server to list the SIDs reachable by a given user
|
|
compute_user
|
|
# allow switching between enforcing and permissive mode
|
|
setenforce
|
|
# allow changing policy booleans
|
|
setbool
|
|
# allow changing security server configuration parmeters
|
|
setsecparam
|
|
# add ocontext label definitions for resources
|
|
add_ocontext
|
|
# remove ocontext label definitions for resources
|
|
del_ocontext
|
|
}
|
|
|
|
# Class version is used to describe the XENVER_ hypercall.
|
|
# Almost all sub-ops are described here - in the default case all of them should
|
|
# be allowed except the XENVER_commandline.
|
|
#
|
|
# The ones that are omitted are XENVER_version, XENVER_platform_parameters,
|
|
# and XENVER_get_features - as they MUST always be returned to a guest.
|
|
#
|
|
class version
|
|
{
|
|
# Extra informations (-unstable).
|
|
xen_extraversion
|
|
# Compile information of the hypervisor.
|
|
xen_compile_info
|
|
# Such as "xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64".
|
|
xen_capabilities
|
|
# Source code changeset.
|
|
xen_changeset
|
|
# Page size the hypervisor uses.
|
|
xen_pagesize
|
|
# An value that the control stack can choose.
|
|
xen_guest_handle
|
|
# Xen command line.
|
|
xen_commandline
|
|
}
|