From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Jackson Subject: [PATCH 15/16] xen/vtd: prevent from assign the device with shared rmrr Date: Wed, 22 Jul 2015 16:44:18 +0100 Message-ID: <1437579859-24485-16-git-send-email-ian.jackson@eu.citrix.com> References: <1437579859-24485-1-git-send-email-ian.jackson@eu.citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1437579859-24485-1-git-send-email-ian.jackson@eu.citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xensource.com Cc: Kevin Tian , Wei Liu , Ian Campbell , George Dunlap , Jan Beulich , Yang Zhang , Tiejun Chen List-Id: xen-devel@lists.xenproject.org From: Tiejun Chen Currently we're intending to cover this kind of devices with shared RMRR simply since the case of shared RMRR is a rare case according to our previous experiences. But late we can group these devices which shared rmrr, and then allow all devices within a group to be assigned to same domain. CC: Yang Zhang CC: Kevin Tian Signed-off-by: Tiejun Chen Acked-by: Kevin Tian --- xen/drivers/passthrough/vtd/iommu.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index 8a8d763..ce5c295 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -2293,13 +2293,37 @@ static int intel_iommu_assign_device( if ( list_empty(&acpi_drhd_units) ) return -ENODEV; + seg = pdev->seg; + bus = pdev->bus; + /* + * In rare cases one given rmrr is shared by multiple devices but + * obviously this would put the security of a system at risk. So + * we should prevent from this sort of device assignment. + * + * TODO: in the future we can introduce group device assignment + * interface to make sure devices sharing RMRR are assigned to the + * same domain together. + */ + for_each_rmrr_device( rmrr, bdf, i ) + { + if ( rmrr->segment == seg && + PCI_BUS(bdf) == bus && + PCI_DEVFN2(bdf) == devfn && + rmrr->scope.devices_cnt > 1 ) + { + printk(XENLOG_G_ERR VTDPREFIX + " cannot assign %04x:%02x:%02x.%u" + " with shared RMRR at %"PRIx64" for Dom%d.\n", + seg, bus, PCI_SLOT(devfn), PCI_FUNC(devfn), + rmrr->base_address, d->domain_id); + return -EPERM; + } + } + ret = reassign_device_ownership(hardware_domain, d, devfn, pdev); if ( ret ) return ret; - seg = pdev->seg; - bus = pdev->bus; - /* Setup rmrr identity mapping */ for_each_rmrr_device( rmrr, bdf, i ) { -- 1.7.10.4