From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dario Faggioli Subject: Re: [PATCH RFC] flask: move policy header sources into hypervisor Date: Wed, 10 Oct 2012 15:39:48 +0100 Message-ID: <1349879988.3610.194.camel@Abyss> References: <1349801565.21847.228.camel@zakaz.uk.xensource.com> <1349807513-10923-1-git-send-email-dgdegra@tycho.nsa.gov> <1349858695.3610.158.camel@Abyss> <50758038.6050009@tycho.nsa.gov> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6714192692552890345==" Return-path: In-Reply-To: <50758038.6050009@tycho.nsa.gov> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Daniel De Graaf Cc: Marcus Granado , "andre.przywara@amd.com" , Ian Campbell , "anil@recoil.org" , George Dunlap , Andrew Cooper , "juergen.gross@ts.fujitsu.com" , Ian Jackson , "xen-devel@lists.xen.org" , "JBeulich@suse.com" , "msw@amazon.com" , "Keir (Xen.org)" List-Id: xen-devel@lists.xenproject.org --===============6714192692552890345== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-RZPLawl4HIKX8ofqAOV5" --=-RZPLawl4HIKX8ofqAOV5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2012-10-10 at 15:03 +0100, Daniel De Graaf wrote:=20 > Ah, in my distraction with fixing the autogeneration I neglected to=20 > finish looking at the original patch. > :-) > The XSM changes look good except > for a missing implementation of the dummy_nodeaffinity() function in > xen/xsm/dummy.c. However, since the implementation of xsm_nodeaffinity > and xsm_vcpuaffinity are identical, it may be simpler to just merge them > into a common xsm_affinity_domctl hook (as is implemented in > xsm/flask/hooks.c) - in that case, just renaming the existing dummy hook > will suffice. >=20 Ok, thanks. I will do that. > A more general note on the topic of what XSM permissions to use:=20 > normally, each domctl has its own permission, and so adding new domctls > would be done by adding a new permission to the access_vectors file > (which is the source of av_perm_to_string.h). However, for this case, it > seems rather unlikely that one would want to allow access to vcpu > affinity and deny node affinity, so using the same permission for both= =20 > accesses is the best solution. >=20 Yes, exactly. Moreover, looking at xen/xsm/flask/include/av_permissions.h where DOMAIN__{GET,SET}VCPUAFFINITY are, I got thee impression that there is no more space left for DOMAIN__* permissions, as they already go from 0x00000001UL to 0x80000000UL... Is that so? > When renaming a permission (such as getvcpuaffinity =3D> getaffinity), th= e > FLASK policy also needs to be changed - you can normally just grep for > the permission being changed. >=20 Ok and thanks again. I will do that too... > The dummy hook would be caught in a compilation with XSM enabled, but I > notice that current xen-unstable will not build due to a patch being > applied out of order (xsm/flask: add domain relabel support requires > rcu_lock_domain_by_any_id which was added in the prior patch). Adding > Keir to CC since he applied the patch. >=20 ... As well as I will try to check for this for next round (hoping that by that time the issue you're describing here would be fixed :-)). Thanks a lot and Regards, Dario --=20 <> (Raistlin Majere) ----------------------------------------------------------------- Dario Faggioli, Ph.D, http://retis.sssup.it/people/faggioli Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK) --=-RZPLawl4HIKX8ofqAOV5 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEABECAAYFAlB1iLQACgkQk4XaBE3IOsRI6gCePQEYE6oUPGBJWzUwCUyYv2uF NBkAn3tq1BWef5CbWn4tOTEbueOh0/65 =oPcO -----END PGP SIGNATURE----- --=-RZPLawl4HIKX8ofqAOV5-- --===============6714192692552890345== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============6714192692552890345==--