Re: [Xen-devel] [PATCH v3 20/24] xen/passthrough: Extend XEN_DOMCTL_assign_device to support DT device

[Julien Grall <julien.grall@xxxxxxxxxx>]

Hi Daniel,

On 10/03/2015 22:45, Daniel De Graaf wrote:
> > BTW, do you have any pointer on how to write a policy for device/IRQ
> > passthrough?
> There is a bit of documentation in xsm-flask.txt about device labeling,
> which is the hard part of making passthrough work.  Labels can be set
> either statically in the security policy (as documented in the section
> "Device Labeling") or dynamically using a tool like flask-label-pci
> as documented in "Resource Policy".  Once that is done, then rules to
> allow the passthrough operation can be added, similar to the example
> resource nic_dev_t in xen.te.
I tried to follow xsm-flask.txt and uncomment one of the pirqcon line in 
the xsm policy.
But I got the following error:

policy/modules/xen/xen.te:199:ERROR 'syntax error' at token 'pirqcon' on 
line 1986:
pirqcon 33 system_u:object_r:nic_dev_t

Did I miss anything?

> In order to do static labeling for device passthrough, the nodes in a
> device tree need a 32-bit numeric identifier.  IO memory uses the MFN,
> PCI devices use SBDF, and IRQs and x86 legacy IOs just use the number.
Why it's restricted to an integer? Would it be possible to use a string 
as it's done for the sid?
Regards,


--
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel