From: Daniel De Graaf <dgdegra@tycho.nsa.gov>
To: Jan Beulich <JBeulich@suse.com>
Cc: marmarek@invisiblethingslab.com, xen-devel <xen-devel@lists.xen.org>
Subject: Re: PCI passthrough for HVM with stubdomain broken by "tools/libxl: handle the iomem parameter with the memory_mapping hcall"
Date: Thu, 23 Jun 2016 10:33:39 -0400 [thread overview]
Message-ID: <b8a9777f-b019-3e27-2255-74277478013d@tycho.nsa.gov> (raw)
In-Reply-To: <576BBC4C02000078000F7F1F@prv-mh.provo.novell.com>
On 06/23/2016 04:39 AM, Jan Beulich wrote:
>>>> On 23.06.16 at 10:32, <JBeulich@suse.com> wrote:
>>>>> On 22.06.16 at 20:24, <dgdegra@tycho.nsa.gov> wrote:
>>> Either method works, and I agree allowing DM to invoke this domctl is both
>>> useful and not going to introduce problems. The getdomaininfo permission
>>> will also need to be added to the device_model macro in xen.if.
>>
>> What exactly this last sentence means I need to add I'm not sure
>> about.
>
> Perhaps this?
>
> --- unstable.orig/tools/flask/policy/policy/modules/xen/xen.if
> +++ unstable/tools/flask/policy/policy/modules/xen/xen.if
> @@ -148,7 +148,7 @@ define(`device_model', `
> create_channel($2, $1, $2_channel)
> allow $1 $2_channel:event create;
>
> - allow $1 $2_target:domain shutdown;
> + allow $1 $2_target:domain { getdomaininfo shutdown };
> allow $1 $2_target:mmu { map_read map_write adjust physmap target_hack };
> allow $1 $2_target:hvm { getparam setparam trackdirtyvram hvmctl irqlevel pciroute pcilevel cacheattr send_irq };
> ')
>
> Jan
Yes, that is what I meant.
--
Daniel De Graaf
National Security Agency
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
next prev parent reply other threads:[~2016-06-23 14:33 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-22 13:03 PCI passthrough for HVM with stubdomain broken by "tools/libxl: handle the iomem parameter with the memory_mapping hcall" Marek Marczykowski-Górecki
2016-06-22 13:50 ` Jan Beulich
2016-06-22 14:13 ` Marek Marczykowski-Górecki
2016-06-22 15:23 ` Jan Beulich
2016-06-22 18:24 ` Daniel De Graaf
2016-06-23 8:32 ` Jan Beulich
2016-06-23 8:39 ` Jan Beulich
2016-06-23 14:33 ` Daniel De Graaf [this message]
2016-06-23 8:57 ` Marek Marczykowski-Górecki
2016-06-23 9:12 ` Jan Beulich
2016-06-23 9:18 ` Marek Marczykowski-Górecki
2016-06-23 9:23 ` Marek Marczykowski-Górecki
2016-06-23 9:46 ` Jan Beulich
2016-06-23 13:25 ` Marek Marczykowski-Górecki
2016-06-23 14:12 ` Andrew Cooper
2016-06-23 14:59 ` Marek Marczykowski-Górecki
2016-06-23 15:01 ` Andrew Cooper
2016-06-23 14:45 ` Jan Beulich
2016-06-23 15:00 ` Daniel De Graaf
2016-06-23 15:22 ` Marek Marczykowski-Górecki
2016-06-23 15:30 ` Daniel De Graaf
2016-06-23 15:37 ` Jan Beulich
2016-06-23 15:45 ` Marek Marczykowski-Górecki
2016-06-23 15:49 ` Marek Marczykowski-Górecki
2016-06-23 16:02 ` Jan Beulich
2016-06-23 9:45 ` Jan Beulich
2016-06-23 9:44 ` Andrew Cooper
2016-06-23 9:50 ` Jan Beulich
2016-06-23 14:15 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b8a9777f-b019-3e27-2255-74277478013d@tycho.nsa.gov \
--to=dgdegra@tycho.nsa.gov \
--cc=JBeulich@suse.com \
--cc=marmarek@invisiblethingslab.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).