Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
---
 hw/i386/xen/xen-hvm.c |  8 --------
 hw/xen/xen-common.c   | 10 ++++++++++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c
index d9ccd5d..7b60ec6 100644
--- a/hw/i386/xen/xen-hvm.c
+++ b/hw/i386/xen/xen-hvm.c
@@ -1254,14 +1254,6 @@ void xen_hvm_init(PCMachineState *pcms, MemoryRegion **ram_memory)
         goto err;
     }
 
-    if (xen_domid_restrict) {
-        rc = xen_restrict(xen_domid);
-        if (rc < 0) {
-            error_report("failed to restrict: error %d", errno);
-            goto err;
-        }
-    }
-
     xen_create_ioreq_server(xen_domid, &state->ioservid);
 
     state->exit.notify = xen_exit_notifier;
diff --git a/hw/xen/xen-common.c b/hw/xen/xen-common.c
index 632a938..dfee53e 100644
--- a/hw/xen/xen-common.c
+++ b/hw/xen/xen-common.c
@@ -111,9 +111,19 @@ static void xenstore_record_dm_state(struct xs_handle *xs, const char *state)
 static void xen_change_state_handler(void *opaque, int running,
                                      RunState state)
 {
+    int rc;
+
     if (running) {
         /* record state running */
         xenstore_record_dm_state(xenstore, "running");
+
+        if (xen_domid_restrict) {
+            rc = xen_restrict(xen_domid);
+            if (rc < 0) {
+                perror("xen: failed to restrict");
+                exit(1);
+            }
+        }
     }
 }
 
-- 
2.1.4

On Fri, Sep 15, 2017 at 07:09:55PM +0100, Ian Jackson wrote:
> Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>

Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>

-- 
Anthony PERARD