1Xen Statements 2============== 3 4Policy version 30 introduced the [`devicetreecon`](cil_xen_statements.md#devicetreecon) statement and also expanded the existing I/O memory range to 64 bits in order to support hardware with more than 44 bits of physical address space (32-bit count of 4K pages). 5 6See the ["XSM/FLASK Configuration"](http://xenbits.xen.org/docs/4.2-testing/misc/xsm-flask.txt) document for further information ([](http://xenbits.xen.org/docs/4.2-testing/misc/xsm-flask.txt)) 7 8iomemcon 9-------- 10 11Label i/o memory. This may be a single memory location or a range. 12 13**Statement definition:** 14 15```secil 16 (iomemcon mem_addr|(mem_low mem_high) context_id) 17``` 18 19**Where:** 20 21<table> 22<colgroup> 23<col width="25%" /> 24<col width="75%" /> 25</colgroup> 26<tbody> 27<tr class="odd"> 28<td align="left"><p><code>iomemcon</code></p></td> 29<td align="left"><p>The <code>iomemcon</code> keyword.</p></td> 30</tr> 31<tr class="even"> 32<td align="left"><p><code>mem_addr |</code></p> 33<p><code>(mem_low mem_high)</code></p></td> 34<td align="left"><p>A single memory address to apply the context, or a range of addresses.</p> 35<p>The entries must consist of numerics <code>[0-9]</code>.</p></td> 36</tr> 37<tr class="odd"> 38<td align="left"><p><code>context_id</code></p></td> 39<td align="left"><p>A previously declared <code>context</code> identifier or an anonymous security context (<code>user role type levelrange</code>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</p></td> 40</tr> 41</tbody> 42</table> 43 44**Example:** 45 46An anonymous context for a memory address range of `0xfebe0-0xfebff`: 47 48```secil 49 (iomemcon (1043424 1043455) (unconfined.user object_r unconfined.object low_low)) 50``` 51 52ioportcon 53--------- 54 55Label i/o ports. This may be a single port or a range. 56 57**Statement definition:** 58 59```secil 60 (ioportcon port|(port_low port_high) context_id) 61``` 62 63**Where:** 64 65<table> 66<colgroup> 67<col width="27%" /> 68<col width="72%" /> 69</colgroup> 70<tbody> 71<tr class="odd"> 72<td align="left"><p><code>ioportcon</code></p></td> 73<td align="left"><p>The <code>ioportcon</code> keyword.</p></td> 74</tr> 75<tr class="even"> 76<td align="left"><p><code>port |</code></p> 77<p><code>(port_low port_high)</code></p></td> 78<td align="left"><p>A single port to apply the context, or a range of ports.</p> 79<p>The entries must consist of numerics <code>[0-9]</code>.</p></td> 80</tr> 81<tr class="odd"> 82<td align="left"><p><code>context_id</code></p></td> 83<td align="left"><p>A previously declared <code>context</code> identifier or an anonymous security context (<code>user role type levelrange</code>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</p></td> 84</tr> 85</tbody> 86</table> 87 88**Example:** 89 90An anonymous context for a single port of :`0xecc0`: 91 92```secil 93 (ioportcon 60608 (unconfined.user object_r unconfined.object low_low)) 94``` 95 96pcidevicecon 97------------ 98 99Label a PCI device. 100 101**Statement definition:** 102 103```secil 104 (pcidevicecon device context_id) 105``` 106 107**Where:** 108 109<table> 110<colgroup> 111<col width="25%" /> 112<col width="75%" /> 113</colgroup> 114<tbody> 115<tr class="odd"> 116<td align="left"><p><code>pcidevicecon</code></p></td> 117<td align="left"><p>The <code>pcidevicecon</code> keyword.</p></td> 118</tr> 119<tr class="even"> 120<td align="left"><p><code>device</code></p></td> 121<td align="left"><p>The device number.The entries must consist of numerics <code>[0-9]</code>.</p></td> 122</tr> 123<tr class="odd"> 124<td align="left"><p><code>context_id</code></p></td> 125<td align="left"><p>A previously declared <code>context</code> identifier or an anonymous security context (<code>user role type levelrange</code>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</p></td> 126</tr> 127</tbody> 128</table> 129 130**Example:** 131 132An anonymous context for a pci device address of `0xc800`: 133 134```secil 135 (pcidevicecon 51200 (unconfined.user object_r unconfined.object low_low)) 136``` 137 138pirqcon 139------- 140 141Label an interrupt level. 142 143**Statement definition:** 144 145```secil 146 (pirqcon irq_level context_id) 147``` 148 149**Where:** 150 151<table> 152<colgroup> 153<col width="25%" /> 154<col width="75%" /> 155</colgroup> 156<tbody> 157<tr class="odd"> 158<td align="left"><p><code>pirqcon</code></p></td> 159<td align="left"><p>The <code>pirqcon</code> keyword.</p></td> 160</tr> 161<tr class="even"> 162<td align="left"><p><code>irq_level</code></p></td> 163<td align="left"><p>The interrupt request number. The entries must consist of numerics <code>[0-9]</code>.</p></td> 164</tr> 165<tr class="odd"> 166<td align="left"><p><code>context_id</code></p></td> 167<td align="left"><p>A previously declared <code>context</code> identifier or an anonymous security context (<code>user role type levelrange</code>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</p></td> 168</tr> 169</tbody> 170</table> 171 172**Example:** 173 174An anonymous context for IRQ 33: 175 176```secil 177 (pirqcon 33 (unconfined.user object_r unconfined.object low_low)) 178``` 179 180devicetreecon 181------------- 182 183Label device tree nodes. 184 185**Statement definition:** 186 187```secil 188 (devicetreecon path context_id) 189``` 190 191**Where:** 192 193<table> 194<colgroup> 195<col width="25%" /> 196<col width="75%" /> 197</colgroup> 198<tbody> 199<tr class="odd"> 200<td align="left"><p><code>devicetreecon</code></p></td> 201<td align="left"><p>The <code>devicetreecon</code> keyword.</p></td> 202</tr> 203<tr class="even"> 204<td align="left"><p><code>path</code></p></td> 205<td align="left"><p>The device tree path. If this contains spaces enclose within <code>""</code>.</p></td> 206</tr> 207<tr class="odd"> 208<td align="left"><p><code>context_id</code></p></td> 209<td align="left"><p>A previously declared <code>context</code> identifier or an anonymous security context (<code>user role type levelrange</code>), the range MUST be defined whether the policy is MLS/MCS enabled or not.</p></td> 210</tr> 211</tbody> 212</table> 213 214**Example:** 215 216An anonymous context for the specified path: 217 218```secil 219 (devicetreecon "/this is/a/path" (unconfined.user object_r unconfined.object low_low)) 220``` 221