From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julien Grall Subject: Re: [PATCH] domctl: fix IRQ permission granting/revocation Date: Wed, 10 Dec 2014 10:19:53 +0000 Message-ID: <54881E49.7090009@linaro.org> References: <54880D6B020000780004E6AA@mail.emea.novell.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1XyeNC-0006H0-Vj for xen-devel@lists.xenproject.org; Wed, 10 Dec 2014 10:19:59 +0000 Received: by mail-wi0-f181.google.com with SMTP id r20so4594892wiv.8 for ; Wed, 10 Dec 2014 02:19:56 -0800 (PST) In-Reply-To: <54880D6B020000780004E6AA@mail.emea.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Jan Beulich , xen-devel Cc: Ian Campbell , Tim Deegan , Keir Fraser , Ian Jackson List-Id: xen-devel@lists.xenproject.org Hi Jan, On 10/12/2014 08:07, Jan Beulich wrote: > Commit 545607eb3c ("x86: fix various issues with handling guest IRQs") > wasn't really consistent in one respect: The granting of access to an > IRQ shouldn't assume the pIRQ->IRQ translation to be the same in both > domains. In fact it is wrong to assume that a translation is already/ > still in place at the time access is being granted/revoked. With the change to the interface, some part of libxl may misuse xc_domain_irq_permission. For instance in tools/libxl/libxl_create.c: 1178 ret = irq >= 0 ? xc_physdev_map_pirq(CTX->xch, domid, irq, &irq) We get the PIRQ of domain domid in irq. 1179 : -EOVERFLOW; 1180 if (!ret) 1181 ret = xc_domain_irq_permission(CTX->xch, domid, irq, 1) Here, the PIRQ of the current domain should be passed. Fortunately, for this specific case, the PIRQs are the same. But this is confusing. > > Signed-off-by: Jan Beulich > > --- a/xen/common/domctl.c > +++ b/xen/common/domctl.c > @@ -981,18 +981,18 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe > > case XEN_DOMCTL_irq_permission: > { > - unsigned int pirq = op->u.irq_permission.pirq; > + unsigned int pirq = op->u.irq_permission.pirq, irq; > int allow = op->u.irq_permission.allow_access; > > if ( pirq >= d->nr_pirqs ) > ret = -EINVAL; > - else if ( !pirq_access_permitted(current->domain, pirq) || > + else if ( !(irq = pirq_access_permitted(current->domain, pirq)) || > xsm_irq_permission(XSM_HOOK, d, pirq, allow) ) As the pirq may not be the same in domain d, the XSM permission is wrong here. In anycase, it looks weird to use pirq here because the guy who defines the policy may not know the PIRQ value. Regards, -- Julien Grall