x86: remove IS_PRIV bypass on IRQ check

This prevents a process in dom0 from granting a domU access to an IRQ without
adding the IRQ to the domU's list of permitted IRQs. This operation currently
succeeds in dom0 but would fail if the device model were running in a stubdom,
so making the failure consistent should ease debugging of the device-model
stubdoms.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index 9580390594f86efbc2cb7feeced3b4916b485fe7..1f16ad2568f237fd6a6cc6070f8cf246990976e2 100644 (file)
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -565,9 +565,8 @@ long arch_do_domctl(
 
     case XEN_DOMCTL_bind_pt_irq:
     {
-        xen_domctl_bind_pt_irq_t * bind;
-
-        bind = &(domctl->u.bind_pt_irq);
+        xen_domctl_bind_pt_irq_t *bind = &domctl->u.bind_pt_irq;
+        int irq;
 
         ret = -EINVAL;
         if ( !is_hvm_domain(d) )
@@ -577,14 +576,10 @@ long arch_do_domctl(
         if ( ret )
             break;
 
+        irq = domain_pirq_to_irq(d, bind->machine_irq);
         ret = -EPERM;
-        if ( !IS_PRIV(current->domain) )
-        {
-            int irq = domain_pirq_to_irq(d, bind->machine_irq);
-
-            if ( irq <= 0 || !irq_access_permitted(current->domain, irq) )
-                break;
-        }
+        if ( irq <= 0 || !irq_access_permitted(current->domain, irq) )
+            break;
 
         ret = -ESRCH;
         if ( iommu_enabled )
@@ -601,18 +596,12 @@ long arch_do_domctl(
 
     case XEN_DOMCTL_unbind_pt_irq:
     {
-        xen_domctl_bind_pt_irq_t * bind;
-
-        bind = &(domctl->u.bind_pt_irq);
+        xen_domctl_bind_pt_irq_t *bind = &domctl->u.bind_pt_irq;
+        int irq = domain_pirq_to_irq(d, bind->machine_irq);
 
         ret = -EPERM;
-        if ( !IS_PRIV(current->domain) )
-        {
-            int irq = domain_pirq_to_irq(d, bind->machine_irq);
-
-            if ( irq <= 0 || !irq_access_permitted(current->domain, irq) )
-                break;
-        }
+        if ( irq <= 0 || !irq_access_permitted(current->domain, irq) )
+            break;
 
         ret = xsm_unbind_pt_irq(XSM_HOOK, d, bind);
         if ( ret )