[PATCH 0/4] stricter ioreq server permissions checks

[PATCH 0/4] stricter ioreq server permissions checks

[Paul Durrant]

This series tightens up permissions checking on ioreq server control plane
operations.

Paul Durrant (4):
  x86/hvm: stop passing explicit domid to hvm_create_ioreq_server()
  x86/hvm: take a reference on ioreq server emulating domain
  x86/hvm: re-structure some of the ioreq server look-up loops
  x86/hvm: add stricter permissions checks to ioreq server control plane

 xen/arch/x86/hvm/dm.c            |   5 +-
 xen/arch/x86/hvm/hvm.c           |   4 +-
 xen/arch/x86/hvm/ioreq.c         | 231 +++++++++++++++++++++++++--------------
 xen/include/asm-x86/hvm/domain.h |   4 +-
 xen/include/asm-x86/hvm/ioreq.h  |   5 +-
 5 files changed, 155 insertions(+), 94 deletions(-)

-- 
2.11.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[PATCH 1/4] x86/hvm: stop passing explicit domid to hvm_create_ioreq_server()

[Paul Durrant]

There are only two call-sites for this function:

- The 'default' call site, which sets the is_default argument to true
  and passes the value of HVM_PARAM_DM_DOMAIN as domid.
- The 'dm op' call site, which sets the is_default argument to false
  and passes current->domain->domain_id as domid.

Clearly the correct value of domid can be discerned from the is_default
argument so this patch modifies hvm_create_ioreq_server() to do that
internally, negating the need for the domid argument.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
---
 xen/arch/x86/hvm/dm.c           |  5 ++---
 xen/arch/x86/hvm/hvm.c          |  4 +---
 xen/arch/x86/hvm/ioreq.c        | 17 +++++++++--------
 xen/include/asm-x86/hvm/ioreq.h |  5 ++---
 4 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/xen/arch/x86/hvm/dm.c b/xen/arch/x86/hvm/dm.c
index 7788577a73..96b0d13f2f 100644
--- a/xen/arch/x86/hvm/dm.c
+++ b/xen/arch/x86/hvm/dm.c
@@ -402,7 +402,6 @@ static int dm_op(const struct dmop_args *op_args)
     {
     case XEN_DMOP_create_ioreq_server:
     {
-        struct domain *curr_d = current->domain;
         struct xen_dm_op_create_ioreq_server *data =
             &op.u.create_ioreq_server;
 
@@ -412,8 +411,8 @@ static int dm_op(const struct dmop_args *op_args)
         if ( data->pad[0] || data->pad[1] || data->pad[2] )
             break;
 
-        rc = hvm_create_ioreq_server(d, curr_d->domain_id, false,
-                                     data->handle_bufioreq, &data->id);
+        rc = hvm_create_ioreq_server(d, false, data->handle_bufioreq,
+                                     &data->id);
         break;
     }
 
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 91bc3e8b27..42a294a6cc 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -4443,9 +4443,7 @@ static int hvmop_get_param(
          */
         if ( !d->creation_finished )
         {
-            domid_t domid = d->arch.hvm_domain.params[HVM_PARAM_DM_DOMAIN];
-
-            rc = hvm_create_ioreq_server(d, domid, true,
+            rc = hvm_create_ioreq_server(d, true,
                                          HVM_IOREQSRV_BUFIOREQ_LEGACY, NULL);
             if ( rc != 0 && rc != -EEXIST )
                 goto out;
diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c
index 7e66965bcd..ee5f47de65 100644
--- a/xen/arch/x86/hvm/ioreq.c
+++ b/xen/arch/x86/hvm/ioreq.c
@@ -599,16 +599,18 @@ static void hvm_ioreq_server_disable(struct hvm_ioreq_server *s,
 }
 
 static int hvm_ioreq_server_init(struct hvm_ioreq_server *s,
-                                 struct domain *d, domid_t domid,
-                                 bool is_default, int bufioreq_handling,
-                                 ioservid_t id)
+                                 struct domain *d, bool is_default,
+                                 int bufioreq_handling, ioservid_t id)
 {
     struct vcpu *v;
     int rc;
 
     s->id = id;
     s->domain = d;
-    s->domid = domid;
+
+    s->domid = is_default ?
+        d->arch.hvm_domain.params[HVM_PARAM_DM_DOMAIN] :
+        current->domain->domain_id;
 
     spin_lock_init(&s->lock);
     INIT_LIST_HEAD(&s->ioreq_vcpu_list);
@@ -680,9 +682,8 @@ static ioservid_t next_ioservid(struct domain *d)
     return id;
 }
 
-int hvm_create_ioreq_server(struct domain *d, domid_t domid,
-                            bool is_default, int bufioreq_handling,
-                            ioservid_t *id)
+int hvm_create_ioreq_server(struct domain *d, bool is_default,
+                            int bufioreq_handling, ioservid_t *id)
 {
     struct hvm_ioreq_server *s;
     int rc;
@@ -702,7 +703,7 @@ int hvm_create_ioreq_server(struct domain *d, domid_t domid,
     if ( is_default && d->arch.hvm_domain.default_ioreq_server != NULL )
         goto fail2;
 
-    rc = hvm_ioreq_server_init(s, d, domid, is_default, bufioreq_handling,
+    rc = hvm_ioreq_server_init(s, d, is_default, bufioreq_handling,
                                next_ioservid(d));
     if ( rc )
         goto fail3;
diff --git a/xen/include/asm-x86/hvm/ioreq.h b/xen/include/asm-x86/hvm/ioreq.h
index 1829fcf43e..0048a7c41c 100644
--- a/xen/include/asm-x86/hvm/ioreq.h
+++ b/xen/include/asm-x86/hvm/ioreq.h
@@ -23,9 +23,8 @@ bool hvm_io_pending(struct vcpu *v);
 bool handle_hvm_io_completion(struct vcpu *v);
 bool is_ioreq_server_page(struct domain *d, const struct page_info *page);
 
-int hvm_create_ioreq_server(struct domain *d, domid_t domid,
-                            bool is_default, int bufioreq_handling,
-                            ioservid_t *id);
+int hvm_create_ioreq_server(struct domain *d, bool is_default,
+                            int bufioreq_handling, ioservid_t *id);
 int hvm_destroy_ioreq_server(struct domain *d, ioservid_t id);
 int hvm_get_ioreq_server_info(struct domain *d, ioservid_t id,
                               unsigned long *ioreq_gfn,
-- 
2.11.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[PATCH 2/4] x86/hvm: take a reference on ioreq server emulating domain

[Paul Durrant]

When an ioreq server is created the code currently stores the id
of the emulating domain, but does not take a reference on that domain.

This patch modifies the code to hold a reference for the lifetime of the
ioreq server.

NOTE: For the default server only it is theoritically possible for the
      emulating domain to change during the lifetime of the ioreq server
      (if a tools domain modifies HVM_PARAM_DM_DOMAIN) so this domain
      references are swizzled in this case.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
---
 xen/arch/x86/hvm/ioreq.c         | 102 +++++++++++++++++++++++++++------------
 xen/include/asm-x86/hvm/domain.h |   4 +-
 2 files changed, 73 insertions(+), 33 deletions(-)

diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c
index ee5f47de65..8d1ff46146 100644
--- a/xen/arch/x86/hvm/ioreq.c
+++ b/xen/arch/x86/hvm/ioreq.c
@@ -218,7 +218,7 @@ static void hvm_unmap_ioreq_page(struct hvm_ioreq_server *s, bool buf)
 static int hvm_map_ioreq_page(
     struct hvm_ioreq_server *s, bool buf, unsigned long gfn)
 {
-    struct domain *d = s->domain;
+    struct domain *d = s->target;
     struct hvm_ioreq_page *iorp = buf ? &s->bufioreq : &s->ioreq;
     struct page_info *page;
     void *va;
@@ -305,6 +305,7 @@ static int hvm_ioreq_server_add_vcpu(struct hvm_ioreq_server *s,
                                      bool is_default, struct vcpu *v)
 {
     struct hvm_ioreq_vcpu *sv;
+    domid_t domid;
     int rc;
 
     sv = xzalloc(struct hvm_ioreq_vcpu);
@@ -315,7 +316,9 @@ static int hvm_ioreq_server_add_vcpu(struct hvm_ioreq_server *s,
 
     spin_lock(&s->lock);
 
-    rc = alloc_unbound_xen_event_channel(v->domain, v->vcpu_id, s->domid,
+    domid = s->emulator->domain_id;
+
+    rc = alloc_unbound_xen_event_channel(v->domain, v->vcpu_id, domid,
                                          NULL);
     if ( rc < 0 )
         goto fail2;
@@ -324,9 +327,9 @@ static int hvm_ioreq_server_add_vcpu(struct hvm_ioreq_server *s,
 
     if ( v->vcpu_id == 0 && s->bufioreq.va != NULL )
     {
-        struct domain *d = s->domain;
+        struct domain *d = s->target;
 
-        rc = alloc_unbound_xen_event_channel(v->domain, 0, s->domid, NULL);
+        rc = alloc_unbound_xen_event_channel(v->domain, 0, domid, NULL);
         if ( rc < 0 )
             goto fail3;
 
@@ -434,7 +437,7 @@ static int hvm_ioreq_server_setup_pages(struct hvm_ioreq_server *s,
                                         bool is_default,
                                         bool handle_bufioreq)
 {
-    struct domain *d = s->domain;
+    struct domain *d = s->target;
     unsigned long ioreq_gfn = gfn_x(INVALID_GFN);
     unsigned long bufioreq_gfn = gfn_x(INVALID_GFN);
     int rc;
@@ -471,7 +474,7 @@ static int hvm_ioreq_server_setup_pages(struct hvm_ioreq_server *s,
 static void hvm_ioreq_server_unmap_pages(struct hvm_ioreq_server *s,
                                          bool is_default)
 {
-    struct domain *d = s->domain;
+    struct domain *d = s->target;
     bool handle_bufioreq = !!s->bufioreq.va;
 
     if ( handle_bufioreq )
@@ -521,7 +524,7 @@ static int hvm_ioreq_server_alloc_rangesets(struct hvm_ioreq_server *s,
         if ( rc )
             goto fail;
 
-        s->range[i] = rangeset_new(s->domain, name,
+        s->range[i] = rangeset_new(s->target, name,
                                    RANGESETF_prettyprint_hex);
 
         xfree(name);
@@ -545,7 +548,7 @@ static int hvm_ioreq_server_alloc_rangesets(struct hvm_ioreq_server *s,
 static void hvm_ioreq_server_enable(struct hvm_ioreq_server *s,
                                     bool is_default)
 {
-    struct domain *d = s->domain;
+    struct domain *d = s->target;
     struct hvm_ioreq_vcpu *sv;
     bool handle_bufioreq = !!s->bufioreq.va;
 
@@ -576,7 +579,7 @@ static void hvm_ioreq_server_enable(struct hvm_ioreq_server *s,
 static void hvm_ioreq_server_disable(struct hvm_ioreq_server *s,
                                      bool is_default)
 {
-    struct domain *d = s->domain;
+    struct domain *d = s->target;
     bool handle_bufioreq = !!s->bufioreq.va;
 
     spin_lock(&s->lock);
@@ -598,6 +601,20 @@ static void hvm_ioreq_server_disable(struct hvm_ioreq_server *s,
     spin_unlock(&s->lock);
 }
 
+static int get_default_emulator(domid_t domid, struct domain **emulator)
+{
+        bool ref;
+
+        *emulator = rcu_lock_domain_by_id(domid);
+        if ( !*emulator )
+            return -ESRCH;
+
+        ref = !!get_domain(*emulator); /* fails if domain is dying */
+        rcu_unlock_domain(*emulator);
+
+        return ref ? 0 : -EACCES;
+}
+
 static int hvm_ioreq_server_init(struct hvm_ioreq_server *s,
                                  struct domain *d, bool is_default,
                                  int bufioreq_handling, ioservid_t id)
@@ -606,11 +623,23 @@ static int hvm_ioreq_server_init(struct hvm_ioreq_server *s,
     int rc;
 
     s->id = id;
-    s->domain = d;
+    s->target = d;
 
-    s->domid = is_default ?
-        d->arch.hvm_domain.params[HVM_PARAM_DM_DOMAIN] :
-        current->domain->domain_id;
+    if ( is_default )
+    {
+        domid_t domid = d->arch.hvm_domain.params[HVM_PARAM_DM_DOMAIN];
+
+        rc = get_default_emulator(domid, &s->emulator);
+        if ( rc )
+            return rc;
+    } else {
+        struct domain *currd = current->domain;
+
+        if ( !get_domain(currd) )
+            return -EACCES;
+
+        s->emulator = currd;
+    }
 
     spin_lock_init(&s->lock);
     INIT_LIST_HEAD(&s->ioreq_vcpu_list);
@@ -654,6 +683,8 @@ static void hvm_ioreq_server_deinit(struct hvm_ioreq_server *s,
     hvm_ioreq_server_remove_all_vcpus(s);
     hvm_ioreq_server_unmap_pages(s, is_default);
     hvm_ioreq_server_free_rangesets(s, is_default);
+
+    put_domain(s->emulator);
 }
 
 static ioservid_t next_ioservid(struct domain *d)
@@ -1125,35 +1156,46 @@ int hvm_set_dm_domain(struct domain *d, domid_t domid)
     domain_pause(d);
     spin_lock(&s->lock);
 
-    if ( s->domid != domid )
+    if ( domid != s->emulator->domain_id )
     {
-        struct hvm_ioreq_vcpu *sv;
+        struct domain *emulator;
 
-        list_for_each_entry ( sv,
-                              &s->ioreq_vcpu_list,
-                              list_entry )
+        rc = get_default_emulator(domid, &emulator);
+        if ( !rc )
         {
-            struct vcpu *v = sv->vcpu;
+            struct hvm_ioreq_vcpu *sv;
 
-            if ( v->vcpu_id == 0 )
+            list_for_each_entry ( sv,
+                                  &s->ioreq_vcpu_list,
+                                  list_entry )
             {
+                struct vcpu *v = sv->vcpu;
+
+                if ( v->vcpu_id == 0 )
+                {
+                    rc = hvm_replace_event_channel(v, domid,
+                                                   &s->bufioreq_evtchn);
+                    if ( rc )
+                        break;
+
+                    d->arch.hvm_domain.params[HVM_PARAM_BUFIOREQ_EVTCHN] =
+                        s->bufioreq_evtchn;
+                }
+
                 rc = hvm_replace_event_channel(v, domid,
-                                               &s->bufioreq_evtchn);
+                                               &sv->ioreq_evtchn);
                 if ( rc )
                     break;
 
-                d->arch.hvm_domain.params[HVM_PARAM_BUFIOREQ_EVTCHN] =
-                    s->bufioreq_evtchn;
+                hvm_update_ioreq_evtchn(s, sv);
             }
 
-            rc = hvm_replace_event_channel(v, domid, &sv->ioreq_evtchn);
-            if ( rc )
-                break;
-
-            hvm_update_ioreq_evtchn(s, sv);
+            if ( !rc )
+            {
+                put_domain(s->emulator);
+                s->emulator = emulator;
+            }
         }
-
-        s->domid = domid;
     }
 
     spin_unlock(&s->lock);
diff --git a/xen/include/asm-x86/hvm/domain.h b/xen/include/asm-x86/hvm/domain.h
index 7f128c05ff..6e03d024c8 100644
--- a/xen/include/asm-x86/hvm/domain.h
+++ b/xen/include/asm-x86/hvm/domain.h
@@ -53,13 +53,11 @@ struct hvm_ioreq_vcpu {
 
 struct hvm_ioreq_server {
     struct list_head       list_entry;
-    struct domain          *domain;
+    struct domain          *target, *emulator;
 
     /* Lock to serialize toolstack modifications */
     spinlock_t             lock;
 
-    /* Domain id of emulating domain */
-    domid_t                domid;
     ioservid_t             id;
     struct hvm_ioreq_page  ioreq;
     struct list_head       ioreq_vcpu_list;
-- 
2.11.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[PATCH 3/4] x86/hvm: re-structure some of the ioreq server look-up loops

[Paul Durrant]

This patch is a cosmetic re-structuring of some of the loops with look up
an ioreq server based on target domain and server id.

The restructuring is done separately here to ease review of a subsquent
patch.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
---
 xen/arch/x86/hvm/ioreq.c | 100 +++++++++++++++++++++++------------------------
 1 file changed, 50 insertions(+), 50 deletions(-)

diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c
index 8d1ff46146..712c75ff35 100644
--- a/xen/arch/x86/hvm/ioreq.c
+++ b/xen/arch/x86/hvm/ioreq.c
@@ -862,37 +862,37 @@ int hvm_map_io_range_to_ioreq_server(struct domain *d, ioservid_t id,
                           &d->arch.hvm_domain.ioreq_server.list,
                           list_entry )
     {
+        struct rangeset *r;
+
         if ( s == d->arch.hvm_domain.default_ioreq_server )
             continue;
 
-        if ( s->id == id )
-        {
-            struct rangeset *r;
-
-            switch ( type )
-            {
-            case XEN_DMOP_IO_RANGE_PORT:
-            case XEN_DMOP_IO_RANGE_MEMORY:
-            case XEN_DMOP_IO_RANGE_PCI:
-                r = s->range[type];
-                break;
+        if ( s->id != id )
+            continue;
 
-            default:
-                r = NULL;
-                break;
-            }
+        switch ( type )
+        {
+        case XEN_DMOP_IO_RANGE_PORT:
+        case XEN_DMOP_IO_RANGE_MEMORY:
+        case XEN_DMOP_IO_RANGE_PCI:
+            r = s->range[type];
+            break;
 
-            rc = -EINVAL;
-            if ( !r )
-                break;
+        default:
+            r = NULL;
+            break;
+        }
 
-            rc = -EEXIST;
-            if ( rangeset_overlaps_range(r, start, end) )
+        rc = -EINVAL;
+        if ( !r )
                 break;
 
-            rc = rangeset_add_range(r, start, end);
+        rc = -EEXIST;
+        if ( rangeset_overlaps_range(r, start, end) )
             break;
-        }
+
+        rc = rangeset_add_range(r, start, end);
+        break;
     }
 
     spin_unlock_recursive(&d->arch.hvm_domain.ioreq_server.lock);
@@ -917,37 +917,37 @@ int hvm_unmap_io_range_from_ioreq_server(struct domain *d, ioservid_t id,
                           &d->arch.hvm_domain.ioreq_server.list,
                           list_entry )
     {
+        struct rangeset *r;
+
         if ( s == d->arch.hvm_domain.default_ioreq_server )
             continue;
 
-        if ( s->id == id )
-        {
-            struct rangeset *r;
-
-            switch ( type )
-            {
-            case XEN_DMOP_IO_RANGE_PORT:
-            case XEN_DMOP_IO_RANGE_MEMORY:
-            case XEN_DMOP_IO_RANGE_PCI:
-                r = s->range[type];
-                break;
+        if ( s->id != id )
+            continue;
 
-            default:
-                r = NULL;
-                break;
-            }
+        switch ( type )
+        {
+        case XEN_DMOP_IO_RANGE_PORT:
+        case XEN_DMOP_IO_RANGE_MEMORY:
+        case XEN_DMOP_IO_RANGE_PCI:
+            r = s->range[type];
+            break;
 
-            rc = -EINVAL;
-            if ( !r )
-                break;
+        default:
+            r = NULL;
+            break;
+        }
 
-            rc = -ENOENT;
-            if ( !rangeset_contains_range(r, start, end) )
-                break;
+        rc = -EINVAL;
+        if ( !r )
+            break;
 
-            rc = rangeset_remove_range(r, start, end);
+        rc = -ENOENT;
+        if ( !rangeset_contains_range(r, start, end) )
             break;
-        }
+
+        rc = rangeset_remove_range(r, start, end);
+        break;
     }
 
     spin_unlock_recursive(&d->arch.hvm_domain.ioreq_server.lock);
@@ -985,11 +985,11 @@ int hvm_map_mem_type_to_ioreq_server(struct domain *d, ioservid_t id,
         if ( s == d->arch.hvm_domain.default_ioreq_server )
             continue;
 
-        if ( s->id == id )
-        {
-            rc = p2m_set_ioreq_server(d, flags, s);
-            break;
-        }
+        if ( s->id != id )
+            continue;
+
+        rc = p2m_set_ioreq_server(d, flags, s);
+        break;
     }
 
     spin_unlock_recursive(&d->arch.hvm_domain.ioreq_server.lock);
-- 
2.11.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

[PATCH 4/4] x86/hvm: add stricter permissions checks to ioreq server control plane

[Paul Durrant]

There has always been an intention in the ioreq server API that only the
domain that creates an ioreq server should be able to manipulate it.
However, so far, nothing has enforced this. This means that two domains
with DM_PRIV over a target domain can currently manipulate each others
ioreq servers.

A previous patch added code to take a reference and store a pointer to the
domain that creates an ioreq server. This patch now adds checks to the
functions that manipulate the ioreq server to make sure they are being
called by the same domain.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
---
 xen/arch/x86/hvm/ioreq.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/xen/arch/x86/hvm/ioreq.c b/xen/arch/x86/hvm/ioreq.c
index 712c75ff35..094a4fcdf5 100644
--- a/xen/arch/x86/hvm/ioreq.c
+++ b/xen/arch/x86/hvm/ioreq.c
@@ -784,6 +784,10 @@ int hvm_destroy_ioreq_server(struct domain *d, ioservid_t id)
         if ( s->id != id )
             continue;
 
+        rc = -EPERM;
+        if ( s->emulator != current->domain )
+            break;
+
         domain_pause(d);
 
         p2m_set_ioreq_server(d, 0, s);
@@ -828,6 +832,10 @@ int hvm_get_ioreq_server_info(struct domain *d, ioservid_t id,
         if ( s->id != id )
             continue;
 
+        rc = -EPERM;
+        if ( s->emulator != current->domain )
+            break;
+
         *ioreq_gfn = s->ioreq.gfn;
 
         if ( s->bufioreq.va != NULL )
@@ -870,6 +878,10 @@ int hvm_map_io_range_to_ioreq_server(struct domain *d, ioservid_t id,
         if ( s->id != id )
             continue;
 
+        rc = -EPERM;
+        if ( s->emulator != current->domain )
+            break;
+
         switch ( type )
         {
         case XEN_DMOP_IO_RANGE_PORT:
@@ -925,6 +937,10 @@ int hvm_unmap_io_range_from_ioreq_server(struct domain *d, ioservid_t id,
         if ( s->id != id )
             continue;
 
+        rc = -EPERM;
+        if ( s->emulator != current->domain )
+            break;
+
         switch ( type )
         {
         case XEN_DMOP_IO_RANGE_PORT:
@@ -988,6 +1004,10 @@ int hvm_map_mem_type_to_ioreq_server(struct domain *d, ioservid_t id,
         if ( s->id != id )
             continue;
 
+        rc = -EPERM;
+        if ( s->emulator != current->domain )
+            break;
+
         rc = p2m_set_ioreq_server(d, flags, s);
         break;
     }
@@ -1027,6 +1047,10 @@ int hvm_set_ioreq_server_state(struct domain *d, ioservid_t id,
         if ( s->id != id )
             continue;
 
+        rc = -EPERM;
+        if ( s->emulator != current->domain )
+            break;
+
         domain_pause(d);
 
         if ( enabled )
-- 
2.11.0


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel