[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen master] flask/label-pci: Allow specifying optional irq label
commit de819c96c863467b6e625cd7197d17682f6c6122 Author: Jason Andryuk <jandryuk@xxxxxxxxx> AuthorDate: Tue Mar 14 10:46:00 2023 +0100 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Tue Mar 14 10:46:00 2023 +0100 flask/label-pci: Allow specifying optional irq label IRQs can be shared between devices, so using the same label as the PCI device can create conflicts where the IRQ is labeled with one of the device labels preventing assignment of the second device to the second domain. Add the ability to specify an irq label distinct from the PCI device, so a shared irq label can be specified. The policy would then be written such that the two domains can each use the shared IRQ type in addition to their labeled PCI device. That way we can still label most of the PCI device resources and assign devices in the face of shared IRQs. Signed-off-by: Jason Andryuk <jandryuk@xxxxxxxxx> Reviewed-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx> --- docs/misc/xsm-flask.txt | 16 ++++++++++++++++ tools/flask/utils/label-pci.c | 13 ++++++++++--- 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/docs/misc/xsm-flask.txt b/docs/misc/xsm-flask.txt index 2419c5cf29..ba89ebbfd8 100644 --- a/docs/misc/xsm-flask.txt +++ b/docs/misc/xsm-flask.txt @@ -205,6 +205,22 @@ parameter, which can also be changed using xl setenforce). When using the default types for domains (domU_t), the example policy shipped with Xen should allow the same operations on or between domains as when not using FLASK. +By default, flask-label-pci labels the device, I/O ports, memory and IRQ with +the provided label. These are all unique per-device, except for IRQs which +can be shared between devices. This leads to assignment problems since vmA_t +can't access the IRQ devB_t. To work around this issue, flask-label-pci +takes an optional 3rd argument to label the IRQ: + + flask-label-pci 0000:03:02.0 system_u:object_r:nic_dev_t \ + system_u:object_r:shared_irq_t + +The IRQ labeling only applies to the PIRQ - MSI/MSI-X interrupts are labeled +with the main device label. + +The policy needs to define the shared_irq_t with: + type shared_irq_t, resource_type; + +And the policy needs to be updated to allow domains appropriate access. MLS/MCS policy -------------- diff --git a/tools/flask/utils/label-pci.c b/tools/flask/utils/label-pci.c index 9ddb713cf4..897b772804 100644 --- a/tools/flask/utils/label-pci.c +++ b/tools/flask/utils/label-pci.c @@ -28,7 +28,7 @@ static void usage (int argCnt, char *argv[]) { - fprintf(stderr, "Usage: %s SBDF label\n", argv[0]); + fprintf(stderr, "Usage: %s SBDF label <irq_label>\n", argv[0]); exit(1); } @@ -39,12 +39,19 @@ int main (int argCnt, char *argv[]) int seg, bus, dev, fn; uint32_t sbdf; uint64_t start, end, flags; + char *pirq_label; char buf[1024]; FILE *f; - if (argCnt != 3) + if (argCnt < 3 || argCnt > 4) usage(argCnt, argv); + if (argCnt == 4) { + pirq_label = argv[3]; + } else { + pirq_label = argv[2]; + } + xch = xc_interface_open(0,0,0); if ( !xch ) { @@ -107,7 +114,7 @@ int main (int argCnt, char *argv[]) if (fscanf(f, "%" SCNu64, &start) != 1) start = 0; if (start) { - ret = xc_flask_add_pirq(xch, start, argv[2]); + ret = xc_flask_add_pirq(xch, start, pirq_label); if (ret) { fprintf(stderr, "xc_flask_add_pirq %"PRIu64" failed: %d\n", start, ret); -- generated by git-patchbot for /home/xen/git/xen.git#master
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |