tree 2cdc7a586a9c5435c05a14d63e6e707b490e539e
parent c1e9db472bbc60120fd41ea2f81fcff12bc7ff3c
author Alex Williamson <alex.williamson@redhat.com> 1324443549 -0700
committer Marcelo Tosatti <mtosatti@redhat.com> 1324638171 -0200

kvm: Device assignment permission checks

Only allow KVM device assignment to attach to devices which:

 - Are not bridges
 - Have BAR resources (assume others are special devices)
 - The user has permissions to use

Assigning a bridge is a configuration error, it's not supported, and
typically doesn't result in the behavior the user is expecting anyway.
Devices without BAR resources are typically chipset components that
also don't have host drivers.  We don't want users to hold such devices
captive or cause system problems by fencing them off into an iommu
domain.  We determine "permission to use" by testing whether the user
has access to the PCI sysfs resource files.  By default a normal user
will not have access to these files, so it provides a good indication
that an administration agent has granted the user access to the device.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>