[Xen-changelog] [xen stable-4.6] vtd/iommu: permit group devices to passthrough in relaxed mode

[patchbot@xxxxxxx]

commit 11d942df114045860a27563418cf5dbd5bcd0402
Author:     Tiejun Chen <tiejun.chen@xxxxxxxxx>
AuthorDate: Mon Sep 14 13:42:34 2015 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Sep 14 13:42:34 2015 +0200

    vtd/iommu: permit group devices to passthrough in relaxed mode
    
    Currently we don't allow passing through any group devices which are
    sharing same RMRR entry since it would break security among VMs. And
    indeed, we expect we can figure out a better way to handle this kind
    of case completely.
    
    But before the group assignment gets implemented, we might make this
    permission dependent on our RMRR policy. So, now it would be allowed
    in the relaxed mode.
    
    Signed-off-by: Tiejun Chen <tiejun.chen@xxxxxxxxx>
    Acked-by: Kevin Tian <kevin.tian@xxxxxxxxx>
    Release-acked-by: Wei Liu <wei.liu2@xxxxxxxxxx>
    master commit: 3848058e7dd66dc35b232a029fcbde55f3eb872f
    master date: 2015-09-14 13:38:02 +0200
---
 xen/drivers/passthrough/vtd/iommu.c |   14 ++++++++++----
 1 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/xen/drivers/passthrough/vtd/iommu.c 
b/xen/drivers/passthrough/vtd/iommu.c
index 836aed5..7b45bff 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -2297,7 +2297,9 @@ static int intel_iommu_assign_device(
     /*
      * In rare cases one given rmrr is shared by multiple devices but
      * obviously this would put the security of a system at risk. So
-     * we should prevent from this sort of device assignment.
+     * we would prevent from this sort of device assignment. But this
+     * can be permitted if user set
+     *      "pci = [ 'sbdf, rdm_policy=relaxed' ]"
      *
      * TODO: in the future we can introduce group device assignment
      * interface to make sure devices sharing RMRR are assigned to the
@@ -2310,12 +2312,16 @@ static int intel_iommu_assign_device(
              PCI_DEVFN2(bdf) == devfn &&
              rmrr->scope.devices_cnt > 1 )
         {
-            printk(XENLOG_G_ERR VTDPREFIX
-                   " cannot assign %04x:%02x:%02x.%u"
+            bool_t relaxed = !!(flag & XEN_DOMCTL_DEV_RDM_RELAXED);
+
+            printk(XENLOG_G_WARNING VTDPREFIX
+                   " It's %s to assign %04x:%02x:%02x.%u"
                    " with shared RMRR at %"PRIx64" for Dom%d.\n",
+                   relaxed ? "risky" : "disallowed",
                    seg, bus, PCI_SLOT(devfn), PCI_FUNC(devfn),
                    rmrr->base_address, d->domain_id);
-            return -EPERM;
+            if ( !relaxed )
+                return -EPERM;
         }
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog