From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <Ian.Campbell@eu.citrix.com>
Subject: Re: [PATCH v12 11/14] flask/policy: allow domU to use
 previously-mapped I/O-memory
Date: Wed, 3 Sep 2014 12:21:36 +0100
Message-ID: <1409743296.22712.10.camel@eu.citrix.com>
References: <1409416189-16564-1-git-send-email-avanzini.arianna@gmail.com>
	<1409416189-16564-12-git-send-email-avanzini.arianna@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <1409416189-16564-12-git-send-email-avanzini.arianna@gmail.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Arianna Avanzini <avanzini.arianna@gmail.com>, Daniel De Graaf <dgdegra@tycho.nsa.gov>
Cc: paolo.valente@unimore.it, keir@xen.org, stefano.stabellini@eu.citrix.com, Ian.Jackson@eu.citrix.com, dario.faggioli@citrix.com, tim@xen.org, xen-devel@lists.xen.org, julien.grall@citrix.com, etrudeau@broadcom.com, JBeulich@suse.com, andrew.cooper3@citrix.com, viktor.kleinik@globallogic.com, andrii.tseglytskyi@globallogic.com
List-Id: xen-devel@lists.xenproject.org

On Sat, 2014-08-30 at 18:29 +0200, Arianna Avanzini wrote:
> From: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
> 
> This commit allows the domU to access previously-mapped I/O-memory
> even if XSM is enabled and FLASK is enforced.

CCing Daniel (XSM maintainer).

I think this is probably OK, but I'm no XSM expert.

(If I were writing the ocmmit message I would have said something like
"Update the example XSM policy to allow...")

> 
> Signed-off-by: Andrii Tseglytskyi <andrii.tseglytskyi@globallogic.com>
> Signed-off-by: Arianna Avanzini <avanzini.arianna@gmail.com>
> Cc: Dario Faggioli <dario.faggioli@citrix.com>
> Cc: Paolo Valente <paolo.valente@unimore.it>
> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
> Cc: Julien Grall <julien.grall@citrix.com>
> Cc: Ian Campbell <Ian.Campbell@eu.citrix.com>
> Cc: Jan Beulich <JBeulich@suse.com>
> Cc: Keir Fraser <keir@xen.org>
> Cc: Tim Deegan <tim@xen.org>
> Cc: Ian Jackson <Ian.Jackson@eu.citrix.com>
> Cc: Andrew Cooper <andrew.cooper3@citrix.com>
> Cc: Eric Trudeau <etrudeau@broadcom.com>
> Cc: Viktor Kleinik <viktor.kleinik@globallogic.com>
> ---
>  tools/flask/policy/policy/modules/xen/xen.te | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/tools/flask/policy/policy/modules/xen/xen.te b/tools/flask/policy/policy/modules/xen/xen.te
> index bb59fe8..34b5bfa 100644
> --- a/tools/flask/policy/policy/modules/xen/xen.te
> +++ b/tools/flask/policy/policy/modules/xen/xen.te
> @@ -107,6 +107,7 @@ admin_device(dom0_t, device_t)
>  admin_device(dom0_t, irq_t)
>  admin_device(dom0_t, ioport_t)
>  admin_device(dom0_t, iomem_t)
> +admin_device(domU_t, iomem_t)
>  
>  domain_comms(dom0_t, dom0_t)
>