That's what Flask needs, and by unifying the hooks flask_map_domain_msi()
can then also serve both flask_{,un}map_domain_irq().Signed-off-by: Jan Beulich <[email protected]> --- How come Arm doesn't use xsm_unmap_domain_irq()? --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -2214,7 +2214,7 @@ int map_domain_pirq( return 0; } - ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi); + ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi ? &msi->sbdf : NULL); if ( ret ) { dprintk(XENLOG_G_ERR, "dom%d: could not permit access to irq %d mapping to pirq %d\n", @@ -2442,7 +2442,7 @@ int unmap_domain_pirq(struct domain *d, */ if ( !d->is_dying ) ret = xsm_unmap_domain_irq(XSM_HOOK, d, irq, - msi_desc ? msi_desc->dev : NULL); + msi_desc ? &msi_desc->dev->sbdf : NULL); if ( ret ) goto done; --- a/xen/include/xsm/dummy.h +++ b/xen/include/xsm/dummy.h @@ -470,7 +470,7 @@ static XSM_INLINE int xsm_map_domain_pir #endif /* CONFIG_HAS_PIRQ */ static XSM_INLINE int xsm_map_domain_irq( - XSM_DEFAULT_ARG struct domain *d, int irq, const void *data) + XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); @@ -491,7 +491,7 @@ static XSM_INLINE int xsm_unbind_pt_irq( } static XSM_INLINE int xsm_unmap_domain_irq( - XSM_DEFAULT_ARG struct domain *d, int irq, const void *data) + XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf) { XSM_ASSERT_ACTION(XSM_HOOK); return xsm_default_action(action, current->domain, d); --- a/xen/include/xsm/hooks.h +++ b/xen/include/xsm/hooks.h @@ -71,8 +71,8 @@ XSM_HOOK(int, schedop_shutdown, struct d XSM_HOOK(int, map_domain_pirq, struct domain *, bool) #endif -XSM_HOOK(int, map_domain_irq, struct domain *, int, const void *) -XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const void *) +XSM_HOOK(int, map_domain_irq, struct domain *, int, const pci_sbdf_t *) +XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const pci_sbdf_t *) XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *) XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *) --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -1030,17 +1030,14 @@ static int cf_check flask_map_domain_pir #endif /* CONFIG_HAS_PIRQ */ static int flask_map_domain_msi ( - struct domain *d, int irq, const void *data, uint32_t *sid, + struct domain *d, int irq, pci_sbdf_t sbdf, uint32_t *sid, struct avc_audit_data *ad) { #ifdef CONFIG_HAS_PCI_MSI - const struct msi_info *msi = data; - uint32_t machine_bdf = msi->sbdf.sbdf; - AVC_AUDIT_DATA_INIT(ad, DEV); - ad->device = machine_bdf; + ad->device = sbdf.sbdf; - return security_device_sid(machine_bdf, sid); + return security_device_sid(sbdf.sbdf, sid); #else return -EINVAL; #endif @@ -1066,15 +1063,15 @@ static uint32_t flask_iommu_resource_use } static int cf_check flask_map_domain_irq( - struct domain *d, int irq, const void *data) + struct domain *d, int irq, const pci_sbdf_t *sbdf) { uint32_t sid, dsid; int rc = -EPERM; struct avc_audit_data ad; uint32_t dperm = flask_iommu_resource_use_perm(d); - if ( irq >= nr_static_irqs && data ) - rc = flask_map_domain_msi(d, irq, data, &sid, &ad); + if ( irq >= nr_static_irqs && sbdf ) + rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad); else rc = get_irq_sid(irq, &sid, &ad); @@ -1091,32 +1088,15 @@ static int cf_check flask_map_domain_irq return rc; } -static int flask_unmap_domain_msi ( - struct domain *d, int irq, const void *data, uint32_t *sid, - struct avc_audit_data *ad) -{ -#ifdef CONFIG_HAS_PCI_MSI - const struct pci_dev *pdev = data; - uint32_t machine_bdf = (pdev->seg << 16) | (pdev->bus << 8) | pdev->devfn; - - AVC_AUDIT_DATA_INIT(ad, DEV); - ad->device = machine_bdf; - - return security_device_sid(machine_bdf, sid); -#else - return -EINVAL; -#endif -} - static int cf_check flask_unmap_domain_irq( - struct domain *d, int irq, const void *data) + struct domain *d, int irq, const pci_sbdf_t *sbdf) { uint32_t sid; int rc = -EPERM; struct avc_audit_data ad; - if ( irq >= nr_static_irqs && data ) - rc = flask_unmap_domain_msi(d, irq, data, &sid, &ad); + if ( irq >= nr_static_irqs && sbdf ) + rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad); else rc = get_irq_sid(irq, &sid, &ad);
