Re: [PATCH 22/24] XSM: pass just SBDF to xsm_{,un}map_domain_irq()

On 7/28/26 9:25 AM, Jan Beulich wrote:
> That's what Flask needs, and by unifying the hooks flask_map_domain_msi()
> can then also serve both flask_{,un}map_domain_irq().
> 
> Signed-off-by: Jan Beulich <[email protected]>
> ---
> How come Arm doesn't use xsm_unmap_domain_irq()?
> 

I do not know, perhaps a gap in completeness. I would have to go study 
it to see if there was something more to it.

> --- a/xen/arch/x86/irq.c
> +++ b/xen/arch/x86/irq.c
> @@ -2214,7 +2214,7 @@ int map_domain_pirq(
>           return 0;
>       }
>   
> -    ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi);
> +    ret = xsm_map_domain_irq(XSM_HOOK, d, irq, msi ? &msi->sbdf : NULL);
>       if ( ret )
>       {
>           dprintk(XENLOG_G_ERR, "dom%d: could not permit access to irq %d mapping to pirq %d\n",
> @@ -2442,7 +2442,7 @@ int unmap_domain_pirq(struct domain *d,
>        */
>       if ( !d->is_dying )
>           ret = xsm_unmap_domain_irq(XSM_HOOK, d, irq,
> -                                   msi_desc ? msi_desc->dev : NULL);
> +                                   msi_desc ? &msi_desc->dev->sbdf : NULL);
>   
>       if ( ret )
>           goto done;
> --- a/xen/include/xsm/dummy.h
> +++ b/xen/include/xsm/dummy.h
> @@ -470,7 +470,7 @@ static XSM_INLINE int xsm_map_domain_pir
>   #endif /* CONFIG_HAS_PIRQ */
>   
>   static XSM_INLINE int xsm_map_domain_irq(
> -    XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
> +    XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf)
>   {
>       XSM_ASSERT_ACTION(XSM_HOOK);
>       return xsm_default_action(action, current->domain, d);
> @@ -491,7 +491,7 @@ static XSM_INLINE int xsm_unbind_pt_irq(
>   }
>   
>   static XSM_INLINE int xsm_unmap_domain_irq(
> -    XSM_DEFAULT_ARG struct domain *d, int irq, const void *data)
> +    XSM_DEFAULT_ARG struct domain *d, int irq, const pci_sbdf_t *sbdf)
>   {
>       XSM_ASSERT_ACTION(XSM_HOOK);
>       return xsm_default_action(action, current->domain, d);
> --- a/xen/include/xsm/hooks.h
> +++ b/xen/include/xsm/hooks.h
> @@ -71,8 +71,8 @@ XSM_HOOK(int, schedop_shutdown, struct d
>   XSM_HOOK(int, map_domain_pirq, struct domain *, bool)
>   #endif
>   
> -XSM_HOOK(int, map_domain_irq, struct domain *, int, const void *)
> -XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const void *)
> +XSM_HOOK(int, map_domain_irq, struct domain *, int, const pci_sbdf_t *)
> +XSM_HOOK(int, unmap_domain_irq, struct domain *, int, const pci_sbdf_t *)
>   XSM_HOOK(int, bind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
>   XSM_HOOK(int, unbind_pt_irq, struct domain *, struct xen_domctl_bind_pt_irq *)
>   
> --- a/xen/xsm/flask/hooks.c
> +++ b/xen/xsm/flask/hooks.c
> @@ -1030,17 +1030,14 @@ static int cf_check flask_map_domain_pir
>   #endif /* CONFIG_HAS_PIRQ */
>   
>   static int flask_map_domain_msi (
> -    struct domain *d, int irq, const void *data, uint32_t *sid,
> +    struct domain *d, int irq, pci_sbdf_t sbdf, uint32_t *sid,
>       struct avc_audit_data *ad)
>   {
>   #ifdef CONFIG_HAS_PCI_MSI
> -    const struct msi_info *msi = data;
> -    uint32_t machine_bdf = msi->sbdf.sbdf;
> -
>       AVC_AUDIT_DATA_INIT(ad, DEV);
> -    ad->device = machine_bdf;
> +    ad->device = sbdf.sbdf;
>   
> -    return security_device_sid(machine_bdf, sid);
> +    return security_device_sid(sbdf.sbdf, sid);
>   #else
>       return -EINVAL;
>   #endif
> @@ -1066,15 +1063,15 @@ static uint32_t flask_iommu_resource_use
>   }
>   
>   static int cf_check flask_map_domain_irq(
> -    struct domain *d, int irq, const void *data)
> +    struct domain *d, int irq, const pci_sbdf_t *sbdf)
>   {
>       uint32_t sid, dsid;
>       int rc = -EPERM;
>       struct avc_audit_data ad;
>       uint32_t dperm = flask_iommu_resource_use_perm(d);
>   
> -    if ( irq >= nr_static_irqs && data )
> -        rc = flask_map_domain_msi(d, irq, data, &sid, &ad);
> +    if ( irq >= nr_static_irqs && sbdf )
> +        rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad);
>       else
>           rc = get_irq_sid(irq, &sid, &ad);
>   
> @@ -1091,32 +1088,15 @@ static int cf_check flask_map_domain_irq
>       return rc;
>   }
>   
> -static int flask_unmap_domain_msi (
> -    struct domain *d, int irq, const void *data, uint32_t *sid,
> -    struct avc_audit_data *ad)
> -{
> -#ifdef CONFIG_HAS_PCI_MSI
> -    const struct pci_dev *pdev = data;
> -    uint32_t machine_bdf = (pdev->seg << 16) | (pdev->bus << 8) | pdev->devfn;
> -
> -    AVC_AUDIT_DATA_INIT(ad, DEV);
> -    ad->device = machine_bdf;
> -
> -    return security_device_sid(machine_bdf, sid);
> -#else
> -    return -EINVAL;
> -#endif
> -}
> -
>   static int cf_check flask_unmap_domain_irq(
> -    struct domain *d, int irq, const void *data)
> +    struct domain *d, int irq, const pci_sbdf_t *sbdf)
>   {
>       uint32_t sid;
>       int rc = -EPERM;
>       struct avc_audit_data ad;
>   
> -    if ( irq >= nr_static_irqs && data )
> -        rc = flask_unmap_domain_msi(d, irq, data, &sid, &ad);
> +    if ( irq >= nr_static_irqs && sbdf )
> +        rc = flask_map_domain_msi(d, irq, *sbdf, &sid, &ad);
>       else
>           rc = get_irq_sid(irq, &sid, &ad);
>   
> 

Acked-by: Daniel P. Smith <[email protected]>