[xen staging] VT-d: don't needlessly engage the untrusted-MSI workaround

[patchbot@xxxxxxx]

commit d5c39d5f8da6a39d98fa4b5e5d7b7528dcf34e7c
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Nov 24 11:04:32 2021 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Nov 24 11:04:32 2021 +0100

    VT-d: don't needlessly engage the untrusted-MSI workaround
    
    The quarantine domain doesn't count as a DomU, as it won't itself
    trigger any bad behavior. The workaround only needs enabling when an
    actual DomU is about to gain control of a device. This then also means
    enabling of the workaround can be deferred until immediately ahead of
    the call to domain_context_mapping(). While there also stop open-coding
    is_hardware_domain().
    
    Fixes: 319f9a0ba94c ("passthrough: quarantine PCI devices")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>
---
 xen/drivers/passthrough/vtd/iommu.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/xen/drivers/passthrough/vtd/iommu.c 
b/xen/drivers/passthrough/vtd/iommu.c
index f9ce402f22..5de9a73f56 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -2403,14 +2403,6 @@ static int reassign_device_ownership(
 {
     int ret;
 
-    /*
-     * Devices assigned to untrusted domains (here assumed to be any domU)
-     * can attempt to send arbitrary LAPIC/MSI messages. We are unprotected
-     * by the root complex unless interrupt remapping is enabled.
-     */
-    if ( (target != hardware_domain) && !iommu_intremap )
-        untrusted_msi = true;
-
     /*
      * If the device belongs to the hardware domain, and it has RMRR, don't
      * remove it from the hardware domain, because BIOS may use RMRR at
@@ -2455,6 +2447,15 @@ static int reassign_device_ownership(
     if ( !has_arch_pdevs(target) )
         vmx_pi_hooks_assign(target);
 
+    /*
+     * Devices assigned to untrusted domains (here assumed to be any domU)
+     * can attempt to send arbitrary LAPIC/MSI messages. We are unprotected
+     * by the root complex unless interrupt remapping is enabled.
+     */
+    if ( !iommu_intremap && !is_hardware_domain(target) &&
+         !is_system_domain(target) )
+        untrusted_msi = true;
+
     ret = domain_context_mapping(target, devfn, pdev);
     if ( ret )
     {
--
generated by git-patchbot for /home/xen/git/xen.git#staging