[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] [v3][PATCH 16/16] xen/vtd: prevent from assign the device with shared rmrr
> From: Chen, Tiejun > Sent: Thursday, June 11, 2015 9:15 AM > > Currently we're intending to cover this kind of devices we're -> we're not? > with shared RMRR simply since the case of shared RMRR is > a rare case according to our previous experiences. But > late we can group these devices which shared rmrr, and > then allow all devices within a group to be assigned to > same domain. > > Signed-off-by: Tiejun Chen <tiejun.chen@xxxxxxxxx> Acked-by: Kevin Tian <kevin.tian@xxxxxxxxx> except one text comment. > --- > xen/drivers/passthrough/vtd/iommu.c | 30 > +++++++++++++++++++++++++++--- > 1 file changed, 27 insertions(+), 3 deletions(-) > > diff --git a/xen/drivers/passthrough/vtd/iommu.c > b/xen/drivers/passthrough/vtd/iommu.c > index d3233b8..f220081 100644 > --- a/xen/drivers/passthrough/vtd/iommu.c > +++ b/xen/drivers/passthrough/vtd/iommu.c > @@ -2277,13 +2277,37 @@ static int intel_iommu_assign_device( > if ( list_empty(&acpi_drhd_units) ) > return -ENODEV; > > + seg = pdev->seg; > + bus = pdev->bus; > + /* > + * In rare cases one given rmrr is shared by multiple devices but > + * obviously this would put the security of a system at risk. So > + * we should prevent from this sort of device assignment. > + * > + * TODO: actually we can group these devices which shared rmrr, and > + * then allow all devices within a group to be assigned to same domain. TODO: in the future we can introduce group device assignment interface to make sure devices sharing RMRR are assigned to the same domain together. > + */ > + for_each_rmrr_device( rmrr, bdf, i ) > + { > + if ( rmrr->segment == seg && > + PCI_BUS(bdf) == bus && > + PCI_DEVFN2(bdf) == devfn ) > + { > + if ( rmrr->scope.devices_cnt > 1 ) > + { > + ret = -EPERM; > + printk(XENLOG_G_ERR VTDPREFIX > + " cannot assign this device with shared RMRR for > Dom%d (%d)\n", > + d->domain_id, ret); > + return ret; > + } > + } > + } > + > ret = reassign_device_ownership(hardware_domain, d, devfn, pdev); > if ( ret ) > return ret; > > - seg = pdev->seg; > - bus = pdev->bus; > - > /* Setup rmrr identity mapping */ > for_each_rmrr_device( rmrr, bdf, i ) > { > -- > 1.9.1 _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |