[Xen-changelog] [xen-unstable] xsm/flask: Use PCI device label for PCI-MSI IRQs

[Xen patchbot-unstable <patchbot@xxxxxxx>]

# HG changeset patch
# User Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
# Date 1328195866 0
# Node ID 108fa9cf28b36d8d34a847a4cf00f6f4df79a40b
# Parent  d82a1e3d3c65ff9dd8b318bbe402273b96c4938b
xsm/flask: Use PCI device label for PCI-MSI IRQs

Because the PCI-MSI IRQ numbers are allocated dynamically, labeling
them by number is not useful. Instead, for all IRQs beyond
nr_irqs_gsi, use the associated msi_desc to find the PCI device and
use the label of the PCI device for the IRQ.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
Committed-by: Keir Fraser <keir@xxxxxxx>
---


diff -r d82a1e3d3c65 -r 108fa9cf28b3 xen/xsm/flask/hooks.c
--- a/xen/xsm/flask/hooks.c     Thu Feb 02 15:17:11 2012 +0000
+++ b/xen/xsm/flask/hooks.c     Thu Feb 02 15:17:46 2012 +0000
@@ -19,6 +19,7 @@
 #include <xen/errno.h>
 #include <xen/guest_access.h>
 #include <xen/xenoprof.h>
+#include <asm/msi.h>
 #include <public/xen.h>
 #include <public/physdev.h>
 #include <public/platform.h>
@@ -62,6 +63,36 @@
     return avc_has_perm(dsec->sid, SECINITSID_XEN, SECCLASS_XEN, perms, NULL);
 }
 
+static int get_irq_sid(int irq, u32 *sid, struct avc_audit_data *ad)
+{
+    struct irq_desc *desc = irq_to_desc(irq);
+    if ( irq >= nr_irqs || irq < 0 )
+        return -EINVAL;
+    if ( irq < nr_irqs_gsi ) {
+        if (ad) {
+            AVC_AUDIT_DATA_INIT(ad, IRQ);
+            ad->irq = irq;
+        }
+        return security_irq_sid(irq, sid);
+    }
+    if ( desc->msi_desc ) {
+        struct pci_dev *dev = desc->msi_desc->dev;
+        u32 sbdf = (dev->seg << 16) | (dev->bus << 8) | dev->devfn;
+        if (ad) {
+            AVC_AUDIT_DATA_INIT(ad, DEV);
+            ad->device = sbdf;
+        }
+        return security_device_sid(sbdf, sid);
+    }
+    if (ad) {
+        AVC_AUDIT_DATA_INIT(ad, IRQ);
+        ad->irq = irq;
+    }
+    /* HPET or IOMMU IRQ, should not be seen by domains */
+    *sid = SECINITSID_UNLABELED;
+    return 0;
+}
+
 static int flask_domain_alloc_security(struct domain *d)
 {
     struct domain_security_struct *dsec;
@@ -292,8 +323,8 @@
         break;
     case ECS_PIRQ:
         irq = domain_pirq_to_irq(d, chn->u.pirq.irq);
-        if (irq)
-            security_irq_sid(irq, &sid);
+        if (irq && get_irq_sid(irq, &sid, NULL))
+            return NULL;
         break;
     }
     if ( !sid )
@@ -716,7 +747,7 @@
 {
     u32 sid, ctx_len;
     char *ctx;
-    int rc = security_irq_sid(irq, &sid);
+    int rc = get_irq_sid(irq, &sid, NULL);
     if ( rc )
         return NULL;
 
@@ -726,7 +757,7 @@
     return ctx;
 }
 
-static int flask_irq_permission (struct domain *d, int pirq, uint8_t access)
+static int flask_irq_permission (struct domain *d, int irq, uint8_t access)
 {
     u32 perm;
     u32 rsid;
@@ -749,13 +780,10 @@
     ssec = current->domain->ssid;
     tsec = d->ssid;
 
-    rc = security_irq_sid(pirq, &rsid);
+    rc = get_irq_sid(irq, &rsid, &ad);
     if ( rc )
         return rc;
 
-    AVC_AUDIT_DATA_INIT(&ad, IRQ);
-    ad.irq = pirq;
-
     rc = avc_has_perm(ssec->sid, rsid, SECCLASS_RESOURCE, perm, &ad);
     if ( rc )
         return rc;
@@ -915,12 +943,10 @@
     struct avc_audit_data ad;
     struct domain_security_struct *ssec;
 
-    rc = security_irq_sid(gsi, &rsid);
+    rc = get_irq_sid(gsi, &rsid, &ad);
     if ( rc )
         return rc;
 
-    AVC_AUDIT_DATA_INIT(&ad, IRQ);
-    ad.irq = gsi;
     ssec = current->domain->ssid;
     return avc_has_perm(ssec->sid, rsid, SECCLASS_RESOURCE, RESOURCE__SETUP, 
&ad);
 }
@@ -1424,13 +1450,10 @@
 
     irq = domain_pirq_to_irq(d, bind->machine_irq);
 
-    rc = security_irq_sid(irq, &rsid);
+    rc = get_irq_sid(irq, &rsid, &ad);
     if ( rc )
         return rc;
 
-    AVC_AUDIT_DATA_INIT(&ad, IRQ);
-    ad.irq = irq;
-
     ssec = current->domain->ssid;
     rc = avc_has_perm(ssec->sid, rsid, SECCLASS_HVM, HVM__BIND_IRQ, &ad);
     if ( rc )

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog