domctl: restrict DOMCTL_set_target to HVM domains Both the XSA-217 fix and lists.xenproject.org/archives/html/xen-devel/2017-04/msg02945.html make this assumption, so let's enforce it. Signed-off-by: Jan Beulich --- a/xen/common/domctl.c +++ b/xen/common/domctl.c @@ -1071,7 +1071,9 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xe break; } - ret = xsm_set_target(XSM_HOOK, d, e); + ret = -EOPNOTSUPP; + if ( is_hvm_domain(e) ) + ret = xsm_set_target(XSM_HOOK, d, e); if ( ret ) { put_domain(e); break;