1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
libxl: suppress device assignment to HVM guest when there is no IOMMU
This in effect copies similar logic from xend: While there's no way to
check whether a device is assigned to a particular guest,
XEN_DOMCTL_test_assign_device at least allows checking whether an
IOMMU is there and whether a device has been assign to _some_
guest.
For the time being, this should be enough to cover for the missing
error checking/recovery in other parts of libxl's device assignment
paths.
There remains a (functionality-, but not security-related) race in
that the iommu should be set up earlier, but this is too risky a
change for this stage of the 4.3 release.
This is a security issue, XSA-61.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Tested-by: George Dunlap <george.dunlap@eu.citrix.com>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
--- a/tools/libxl/libxl_pci.c
+++ b/tools/libxl/libxl_pci.c
@@ -1036,6 +1036,18 @@ int libxl__device_pci_add(libxl__gc *gc, uint32_t domid, libxl_device_pci *pcide
int num_assigned, i, rc;
int stubdomid = 0;
+ if (libxl__domain_type(gc, domid) == LIBXL_DOMAIN_TYPE_HVM) {
+ rc = xc_test_assign_device(ctx->xch, domid, pcidev_encode_bdf(pcidev));
+ if (rc) {
+ LIBXL__LOG(ctx, LIBXL__LOG_ERROR,
+ "PCI device %04x:%02x:%02x.%u %s?",
+ pcidev->domain, pcidev->bus, pcidev->dev, pcidev->func,
+ errno == ENOSYS ? "cannot be assigned - no IOMMU"
+ : "already assigned to a different guest");
+ goto out;
+ }
+ }
+
rc = libxl__device_pci_setdefault(gc, pcidev);
if (rc) goto out;
|
