XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. However this is not a strictly required step. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment. Hosts where these methods are used will still leave the system in a vulnerable state after the device comes back from a guest.

Upstream Reference:

http://xenbits.xen.org/xsa/advisory-306.html