arch/x86: add distinct XSM hooks for map/unmap

The xsm_iomem_permission and xsm_ioport_permission hooks are intended
to be called by the domain builder, while the calls in
arch/x86/domctl.c which control mapping are also performed by the
device model.  Because these operations require distinct access
control policies, they cannot use the same XSM hooks.

This also adds a missing XSM hook in the unbind IRQ domctl.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Acked-by: Jan Beulich <jbeulich@suse.com>
Committed-by: Keir Fraser <keir@xen.org>

2 files changed, 24 insertions, 22 deletions

diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index a2ce7332fd..b767cfe10c 100644
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -96,8 +96,10 @@ void xsm_fixup_ops (struct xsm_operations *ops)
 
     set_to_dummy_if_null(ops, show_irq_sid);
     set_to_dummy_if_null(ops, map_domain_pirq);
+    set_to_dummy_if_null(ops, unmap_domain_pirq);
     set_to_dummy_if_null(ops, irq_permission);
     set_to_dummy_if_null(ops, iomem_permission);
+    set_to_dummy_if_null(ops, iomem_mapping);
     set_to_dummy_if_null(ops, pci_config_permission);
 
     set_to_dummy_if_null(ops, get_device_group);
@@ -160,5 +162,6 @@ void xsm_fixup_ops (struct xsm_operations *ops)
     set_to_dummy_if_null(ops, ext_vcpucontext);
     set_to_dummy_if_null(ops, vcpuextstate);
     set_to_dummy_if_null(ops, ioport_permission);
+    set_to_dummy_if_null(ops, ioport_mapping);
 #endif
 }
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index ead5958770..e60c6f44d2 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -721,43 +721,41 @@ static int flask_map_domain_pirq (struct domain *d, int irq, void *data)
     return rc;
 }
 
-static int flask_irq_permission (struct domain *d, int irq, uint8_t access)
+static int flask_unmap_domain_pirq (struct domain *d, int irq)
 {
-    u32 perm;
-    u32 rsid;
+    u32 sid;
     int rc = -EPERM;
 
-    struct domain_security_struct *ssec, *tsec;
+    struct domain_security_struct *ssec;
     struct avc_audit_data ad;
 
-    rc = domain_has_perm(current->domain, d, SECCLASS_RESOURCE,
-                         resource_to_perm(access));
-
+    rc = domain_has_perm(current->domain, d, SECCLASS_RESOURCE, RESOURCE__REMOVE);
     if ( rc )
         return rc;
 
-    if ( access )
-        perm = RESOURCE__ADD_IRQ;
-    else
-        perm = RESOURCE__REMOVE_IRQ;
-
     ssec = current->domain->ssid;
-    tsec = d->ssid;
 
-    rc = get_irq_sid(irq, &rsid, &ad);
-    if ( rc )
-        return rc;
-
-    rc = avc_has_perm(ssec->sid, rsid, SECCLASS_RESOURCE, perm, &ad);
+    if ( irq < nr_static_irqs ) {
+        rc = get_irq_sid(irq, &sid, &ad);
+    } else {
+        /* It is currently not possible to check the specific MSI IRQ being
+         * removed, since we do not have the msi_info like map_domain_pirq */
+        return 0;
+    }
     if ( rc )
         return rc;
 
-    if ( access )
-        rc = avc_has_perm(tsec->sid, rsid, SECCLASS_RESOURCE, 
-                            RESOURCE__USE, &ad);
+    rc = avc_has_perm(ssec->sid, sid, SECCLASS_RESOURCE, RESOURCE__REMOVE_IRQ, &ad);
     return rc;
 }
 
+static int flask_irq_permission (struct domain *d, int pirq, uint8_t access)
+{
+    /* the PIRQ number is not useful; real IRQ is checked during mapping */
+    return domain_has_perm(current->domain, d, SECCLASS_RESOURCE,
+                           resource_to_perm(access));
+}
+
 struct iomem_has_perm_data {
     struct domain_security_struct *ssec, *tsec;
     u32 perm;
@@ -1413,7 +1411,7 @@ static int flask_bind_pt_irq (struct domain *d, struct xen_domctl_bind_pt_irq *b
     return avc_has_perm(tsec->sid, rsid, SECCLASS_RESOURCE, RESOURCE__USE, &ad);
 }
 
-static int flask_unbind_pt_irq (struct domain *d)
+static int flask_unbind_pt_irq (struct domain *d, struct xen_domctl_bind_pt_irq *bind)
 {
     return domain_has_perm(current->domain, d, SECCLASS_RESOURCE, RESOURCE__REMOVE);
 }
@@ -1533,6 +1531,7 @@ static struct xsm_operations flask_ops = {
     .show_irq_sid = flask_show_irq_sid,
 
     .map_domain_pirq = flask_map_domain_pirq,
+    .unmap_domain_pirq = flask_unmap_domain_pirq,
     .irq_permission = flask_irq_permission,
     .iomem_permission = flask_iomem_permission,
     .pci_config_permission = flask_pci_config_permission,