Re: [Xen-devel] [PATCH 15/16] xen/vtd: prevent from assign the device with shared rmrr

[Tamas K Lengyel <tamas.k.lengyel@xxxxxxxxx>]

So this change in 4.6 prevents me from passing through devices that have worked previously with VT-d:

(XEN) [VT-D] cannot assign 0000:00:1a.0 with shared RMRR at ae8a9000 for Dom30.
(XEN) [VT-D] cannot assign 0000:00:1d.0 with shared RMRR at ae8a9000 for Dom31.

The devices are the USB 2.0 devices on a DQ67SW motherboard:

00:1a.0 USB controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #2 (rev 04)
00:1d.0 USB controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #1 (rev 04)

Tamas

On Wed, Jul 22, 2015 at 9:44 AM, Ian Jackson <ian.jackson@xxxxxxxxxxxxx> wrote:

From: Tiejun Chen <tiejun.chen@xxxxxxxxx>

Currently we're intending to cover this kind of devices
with shared RMRR simply since the case of shared RMRR is
a rare case according to our previous experiences. But
late we can group these devices which shared rmrr, and
then allow all devices within a group to be assigned to
same domain.

CC: Yang Zhang <yang.z.zhang@xxxxxxxxx>
CC: Kevin Tian <kevin.tian@xxxxxxxxx>
Signed-off-by: Tiejun Chen <tiejun.chen@xxxxxxxxx>
Acked-by: Kevin Tian <kevin.tian@xxxxxxxxx>
---
Âxen/drivers/passthrough/vtd/iommu.c |Â Â30 +++++++++++++++++++++++++++---
Â1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c
index 8a8d763..ce5c295 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -2293,13 +2293,37 @@ static int intel_iommu_assign_device(
  Âif ( list_empty(&acpi_drhd_units) )
    Âreturn -ENODEV;

+Â Â seg = pdev->seg;
+Â Â bus = pdev->bus;
+Â Â /*
+Â Â Â* In rare cases one given rmrr is shared by multiple devices but
+Â Â Â* obviously this would put the security of a system at risk. So
+Â Â Â* we should prevent from this sort of device assignment.
+Â Â Â*
+Â Â Â* TODO: in the future we can introduce group device assignment
+Â Â Â* interface to make sure devices sharing RMRR are assigned to the
+Â Â Â* same domain together.
+Â Â Â*/
+Â Â for_each_rmrr_device( rmrr, bdf, i )
+Â Â {
+Â Â Â Â if ( rmrr->segment == seg &&
+Â Â Â Â Â Â ÂPCI_BUS(bdf) == bus &&
+Â Â Â Â Â Â ÂPCI_DEVFN2(bdf) == devfn &&
+Â Â Â Â Â Â Ârmrr->scope.devices_cnt > 1 )
+Â Â Â Â {
+Â Â Â Â Â Â printk(XENLOG_G_ERR VTDPREFIX
+Â Â Â Â Â Â Â Â Â Â" cannot assign %04x:%02x:%02x.%u"
+Â Â Â Â Â Â Â Â Â Â" with shared RMRR at %"PRIx64" for Dom%d.\n",
+Â Â Â Â Â Â Â Â Â Âseg, bus, PCI_SLOT(devfn), PCI_FUNC(devfn),
+Â Â Â Â Â Â Â Â Â Ârmrr->base_address, d->domain_id);
+Â Â Â Â Â Â return -EPERM;
+Â Â Â Â }
+Â Â }
+
  Âret = reassign_device_ownership(hardware_domain, d, devfn, pdev);
  Âif ( ret )
    Âreturn ret;

-Â Â seg = pdev->seg;
-Â Â bus = pdev->bus;
-
  Â/* Setup rmrr identity mapping */
  Âfor_each_rmrr_device( rmrr, bdf, i )
  Â{
--
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel