linux/virt/kvm
Alex Williamson 3d27e23b17 KVM: Device assignment permission checks
Only allow KVM device assignment to attach to devices which:

 - Are not bridges
 - Have BAR resources (assume others are special devices)
 - The user has permissions to use

Assigning a bridge is a configuration error, it's not supported, and
typically doesn't result in the behavior the user is expecting anyway.
Devices without BAR resources are typically chipset components that
also don't have host drivers.  We don't want users to hold such devices
captive or cause system problems by fencing them off into an iommu
domain.  We determine "permission to use" by testing whether the user
has access to the PCI sysfs resource files.  By default a normal user
will not have access to these files, so it provides a good indication
that an administration agent has granted the user access to the device.

[Yang Bai: add missing #include]
[avi: fix comment style]

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Yang Bai <hamo.by@gmail.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2011-12-25 19:03:54 +02:00
..
Kconfig KVM: Halt vcpu if page it tries to access is swapped out 2011-01-12 11:21:39 +02:00
assigned-dev.c KVM: Device assignment permission checks 2011-12-25 19:03:54 +02:00
async_pf.c KVM: fix the race while wakeup all pv guest 2011-01-12 11:29:03 +02:00
async_pf.h KVM: Halt vcpu if page it tries to access is swapped out 2011-01-12 11:21:39 +02:00
coalesced_mmio.c KVM: Intelligent device lookup on I/O bus 2011-09-25 19:17:59 +03:00
coalesced_mmio.h KVM: Make coalesced mmio use a device per zone 2011-09-25 19:17:57 +03:00
eventfd.c KVM: Intelligent device lookup on I/O bus 2011-09-25 19:17:59 +03:00
ioapic.c KVM: Intelligent device lookup on I/O bus 2011-09-25 19:17:59 +03:00
ioapic.h KVM: convert ioapic lock to spinlock 2010-05-13 01:23:55 -03:00
iodev.h KVM: remove in_range from io devices 2009-09-10 08:33:05 +03:00
iommu.c kvm: iommu.c file requires the full module.h present. 2011-10-31 19:32:13 -04:00
irq_comm.c KVM: fast-path msi injection with irqfd 2011-01-12 11:29:38 +02:00
kvm_main.c KVM: Intelligent device lookup on I/O bus 2011-09-25 19:17:59 +03:00