[Xen-changelog] [xen stable-4.3] libxl: suppress device assignment to HVM guest when there is no IOMMU

[patchbot@xxxxxxx]

commit 826eb17271d3c647516d9944c47b0779afedea25
Author:     Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
AuthorDate: Mon Jul 1 15:20:28 2013 +0100
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Mon Jul 1 15:20:28 2013 +0100

    libxl: suppress device assignment to HVM guest when there is no IOMMU
    
    This in effect copies similar logic from xend: While there's no way to
    check whether a device is assigned to a particular guest,
    XEN_DOMCTL_test_assign_device at least allows checking whether an
    IOMMU is there and whether a device has been assign to _some_
    guest.
    
    For the time being, this should be enough to cover for the missing
    error checking/recovery in other parts of libxl's device assignment
    paths.
    
    There remains a (functionality-, but not security-related) race in
    that the iommu should be set up earlier, but this is too risky a
    change for this stage of the 4.3 release.
    
    This is a security issue, XSA-61.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Tested-by: George Dunlap <george.dunlap@xxxxxxxxxxxxx>
    Acked-by: George Dunlap <george.dunlap@xxxxxxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
---
 tools/libxl/libxl_pci.c |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/tools/libxl/libxl_pci.c b/tools/libxl/libxl_pci.c
index 2f9f010..88bf91e 100644
--- a/tools/libxl/libxl_pci.c
+++ b/tools/libxl/libxl_pci.c
@@ -1036,6 +1036,18 @@ int libxl__device_pci_add(libxl__gc *gc, uint32_t domid, 
libxl_device_pci *pcide
     int num_assigned, i, rc;
     int stubdomid = 0;
 
+    if (libxl__domain_type(gc, domid) == LIBXL_DOMAIN_TYPE_HVM) {
+        rc = xc_test_assign_device(ctx->xch, domid, pcidev_encode_bdf(pcidev));
+        if (rc) {
+            LIBXL__LOG(ctx, LIBXL__LOG_ERROR,
+                       "PCI device %04x:%02x:%02x.%u %s?",
+                       pcidev->domain, pcidev->bus, pcidev->dev, pcidev->func,
+                       errno == ENOSYS ? "cannot be assigned - no IOMMU"
+                                       : "already assigned to a different 
guest");
+            goto out;
+        }
+    }
+
     rc = libxl__device_pci_setdefault(gc, pcidev);
     if (rc) goto out;
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog