xsm: Add xsm_map_domain_pirq hook

When checking permissions in map_domain_pirq, the msi_desc field of
the irq_desc is not yet populated with the PCI device being used. Pass
in the msi_info structure which contains the intended PCI device whose
label will be used in the security check.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Committed-by: Keir Fraser <keir@xen.org>

xen/arch/x86/irq.c

@@ -1828,7 +1828,7 @@ int map_domain_pirq(
         return 0;
     }
 
-    ret = xsm_irq_permission(d, irq, 1);
+    ret = xsm_map_domain_pirq(d, irq, data);
     if ( ret )
     {
         dprintk(XENLOG_G_ERR, "dom%d: could not permit access to irq %d mapping to pirq %d\n",

xen/include/xsm/xsm.h

@@ -115,6 +115,7 @@ struct xsm_operations {
     int (*schedop_shutdown) (struct domain *d1, struct domain *d2);
 
     char *(*show_irq_sid) (int irq);
+    int (*map_domain_pirq) (struct domain *d, int irq, void *data);
     int (*irq_permission) (struct domain *d, int pirq, uint8_t allow);
     int (*iomem_permission) (struct domain *d, uint64_t s, uint64_t e, uint8_t allow);
     int (*pci_config_permission) (struct domain *d, uint32_t machine_bdf, uint16_t start, uint16_t end, uint8_t access);
@@ -484,6 +485,11 @@ static inline char *xsm_show_irq_sid (int irq)
     return xsm_call(show_irq_sid(irq));
 }
 
+static inline int xsm_map_domain_pirq (struct domain *d, int irq, void *data)
+{
+    return xsm_call(map_domain_pirq(d, irq, data));
+}
+
 static inline int xsm_irq_permission (struct domain *d, int pirq, uint8_t allow)
 {
     return xsm_call(irq_permission(d, pirq, allow));

xen/xsm/dummy.c

@@ -375,6 +375,11 @@ static char *dummy_show_irq_sid (int irq)
     return NULL;
 }
 
+static int dummy_map_domain_pirq (struct domain *d, int irq, void *data)
+{
+    return 0;
+}
+
 static int dummy_irq_permission (struct domain *d, int pirq, uint8_t allow)
 {
     return 0;
@@ -660,6 +665,7 @@ void xsm_fixup_ops (struct xsm_operations *ops)
     set_to_dummy_if_null(ops, schedop_shutdown);
 
     set_to_dummy_if_null(ops, show_irq_sid);
+    set_to_dummy_if_null(ops, map_domain_pirq);
     set_to_dummy_if_null(ops, irq_permission);
     set_to_dummy_if_null(ops, iomem_permission);
     set_to_dummy_if_null(ops, pci_config_permission);

xen/xsm/flask/hooks.c

@@ -757,6 +757,42 @@ static char *flask_show_irq_sid (int irq)
     return ctx;
 }
 
+static int flask_map_domain_pirq (struct domain *d, int irq, void *data)
+{
+    u32 sid;
+    int rc = -EPERM;
+    struct msi_info *msi = data;
+
+    struct domain_security_struct *ssec, *tsec;
+    struct avc_audit_data ad;
+
+    rc = domain_has_perm(current->domain, d, SECCLASS_RESOURCE, RESOURCE__ADD);
+
+    if ( rc )
+        return rc;
+
+    if ( irq >= nr_irqs_gsi && msi ) {
+        u32 machine_bdf = (msi->seg << 16) | (msi->bus << 8) | msi->devfn;
+        AVC_AUDIT_DATA_INIT(&ad, DEV);
+        ad.device = machine_bdf;
+        rc = security_device_sid(machine_bdf, &sid);
+    } else {
+        rc = get_irq_sid(irq, &sid, &ad);
+    }
+    if ( rc )
+        return rc;
+
+    ssec = current->domain->ssid;
+    tsec = d->ssid;
+
+    rc = avc_has_perm(ssec->sid, sid, SECCLASS_RESOURCE, RESOURCE__ADD_IRQ, &ad);
+    if ( rc )
+        return rc;
+
+    rc = avc_has_perm(tsec->sid, sid, SECCLASS_RESOURCE, RESOURCE__USE, &ad);
+    return rc;
+}
+
 static int flask_irq_permission (struct domain *d, int irq, uint8_t access)
 {
     u32 perm;
@@ -1582,6 +1618,7 @@ static struct xsm_operations flask_ops = {
 
     .show_irq_sid = flask_show_irq_sid,
 
+    .map_domain_pirq = flask_map_domain_pirq,
     .irq_permission = flask_irq_permission,
     .iomem_permission = flask_iomem_permission,
     .pci_config_permission = flask_pci_config_permission,