Re: [Xen-devel] [v3][PATCH 16/16] xen/vtd: prevent from assign the device with shared rmrr

["Chen, Tiejun" <tiejun.chen@xxxxxxxxx>]

On 2015/6/11 18:25, Tian, Kevin wrote:
> > From: Chen, Tiejun
> > Sent: Thursday, June 11, 2015 9:15 AM
> >
> > Currently we're intending to cover this kind of devices
> we're -> we're not?
I mean currently we want to handle this shared case *simply* so I think 
its still "we're", right?
> > with shared RMRR simply since the case of shared RMRR is
> > a rare case according to our previous experiences. But
> > late we can group these devices which shared rmrr, and
> > then allow all devices within a group to be assigned to
> > same domain.
> >
> > Signed-off-by: Tiejun Chen <tiejun.chen@xxxxxxxxx>
> Acked-by: Kevin Tian <kevin.tian@xxxxxxxxx> except one text
> comment.
>
> > ---
> >   xen/drivers/passthrough/vtd/iommu.c | 30
> > +++++++++++++++++++++++++++---
> >   1 file changed, 27 insertions(+), 3 deletions(-)
> >
> > diff --git a/xen/drivers/passthrough/vtd/iommu.c
> > b/xen/drivers/passthrough/vtd/iommu.c
> > index d3233b8..f220081 100644
> > --- a/xen/drivers/passthrough/vtd/iommu.c
> > +++ b/xen/drivers/passthrough/vtd/iommu.c
> > @@ -2277,13 +2277,37 @@ static int intel_iommu_assign_device(
> >       if ( list_empty(&acpi_drhd_units) )
> >           return -ENODEV;
> >
> > +    seg = pdev->seg;
> > +    bus = pdev->bus;
> > +    /*
> > +     * In rare cases one given rmrr is shared by multiple devices but
> > +     * obviously this would put the security of a system at risk. So
> > +     * we should prevent from this sort of device assignment.
> > +     *
> > +     * TODO: actually we can group these devices which shared rmrr, and
> > +     * then allow all devices within a group to be assigned to same domain.
> TODO: in the future we can introduce group device assignment
> interface to make sure devices sharing RMRR are assigned to the
> same domain together.
Thank you to rephrase this.

Tiejun

> > +     */
> > +    for_each_rmrr_device( rmrr, bdf, i )
> > +    {
> > +        if ( rmrr->segment == seg &&
> > +             PCI_BUS(bdf) == bus &&
> > +             PCI_DEVFN2(bdf) == devfn )
> > +        {
> > +            if ( rmrr->scope.devices_cnt > 1 )
> > +            {
> > +                ret = -EPERM;
> > +                printk(XENLOG_G_ERR VTDPREFIX
> > +                       " cannot assign this device with shared RMRR for Dom%d 
> > (%d)\n",
> > +                       d->domain_id, ret);
> > +                return ret;
> > +            }
> > +        }
> > +    }
> > +
> >       ret = reassign_device_ownership(hardware_domain, d, devfn, pdev);
> >       if ( ret )
> >           return ret;
> >
> > -    seg = pdev->seg;
> > -    bus = pdev->bus;
> > -
> >       /* Setup rmrr identity mapping */
> >       for_each_rmrr_device( rmrr, bdf, i )
> >       {
> > --
> > 1.9.1
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel