4a5ee0f11d
5537a4d8-libxl-use-DEBUG-log-level-instead-of-INFO.patch - Upstream patches from Jan 55dc78e9-x86-amd_ucode-skip-updates-for-final-levels.patch 55dc7937-x86-IO-APIC-don-t-create-pIRQ-mapping-from-masked-RTE.patch 55df2f76-IOMMU-skip-domains-without-page-tables-when-dumping.patch 55e43fd8-x86-NUMA-fix-setup_node.patch 55e43ff8-x86-NUMA-don-t-account-hotplug-regions.patch 55e593f1-x86-NUMA-make-init_node_heap-respect-Xen-heap-limit.patch 54c2553c-grant-table-use-uint16_t-consistently-for-offset-and-length.patch 54ca33bc-grant-table-refactor-grant-copy-to-reduce-duplicate-code.patch 54ca340e-grant-table-defer-releasing-pages-acquired-in-a-grant-copy.patch - bsc#944463 - VUL-0: CVE-2015-5239: qemu-kvm: Integer overflow in vnc_client_read() and protocol_client_msg() CVE-2015-5239-qemuu-limit-client_cut_text-msg-payload-size.patch CVE-2015-5239-qemut-limit-client_cut_text-msg-payload-size.patch - bsc#944697 - VUL-1: CVE-2015-6815: qemu: net: e1000: infinite loop issue CVE-2015-6815-qemuu-e1000-fix-infinite-loop.patch CVE-2015-6815-qemut-e1000-fix-infinite-loop.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=375
85 lines
3.0 KiB
Diff
85 lines
3.0 KiB
Diff
# Commit 669d4b85c433674ab3b52ef707af0d3a551c941f
|
|
# Date 2015-08-25 16:18:31 +0200
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86/IO-APIC: don't create pIRQ mapping from masked RTE
|
|
|
|
While moving our XenoLinux patches to 4.2-rc I noticed bogus "already
|
|
mapped" messages resulting from Linux (legitimately) writing RTEs with
|
|
only the mask bit set. Clearly we shouldn't even attempt to create a
|
|
pIRQ <-> IRQ mapping from such RTEs.
|
|
|
|
In the course of this I also found that the respective message isn't
|
|
really useful without also printing the pre-existing mapping. And I
|
|
noticed that map_domain_pirq() allowed IRQ0 to get through, despite us
|
|
never allowing a domain to control that interrupt.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
|
|
--- a/xen/arch/x86/io_apic.c
|
|
+++ b/xen/arch/x86/io_apic.c
|
|
@@ -2371,9 +2371,14 @@ int ioapic_guest_write(unsigned long phy
|
|
* pirq and irq mapping. Where the GSI is greater than 256, we assume
|
|
* that dom0 pirq == irq.
|
|
*/
|
|
- pirq = (irq >= 256) ? irq : rte.vector;
|
|
- if ( (pirq < 0) || (pirq >= hardware_domain->nr_pirqs) )
|
|
- return -EINVAL;
|
|
+ if ( !rte.mask )
|
|
+ {
|
|
+ pirq = (irq >= 256) ? irq : rte.vector;
|
|
+ if ( pirq >= hardware_domain->nr_pirqs )
|
|
+ return -EINVAL;
|
|
+ }
|
|
+ else
|
|
+ pirq = -1;
|
|
|
|
if ( desc->action )
|
|
{
|
|
@@ -2408,12 +2413,15 @@ int ioapic_guest_write(unsigned long phy
|
|
|
|
printk(XENLOG_INFO "allocated vector %02x for irq %d\n", ret, irq);
|
|
}
|
|
- spin_lock(&hardware_domain->event_lock);
|
|
- ret = map_domain_pirq(hardware_domain, pirq, irq,
|
|
- MAP_PIRQ_TYPE_GSI, NULL);
|
|
- spin_unlock(&hardware_domain->event_lock);
|
|
- if ( ret < 0 )
|
|
- return ret;
|
|
+ if ( pirq >= 0 )
|
|
+ {
|
|
+ spin_lock(&hardware_domain->event_lock);
|
|
+ ret = map_domain_pirq(hardware_domain, pirq, irq,
|
|
+ MAP_PIRQ_TYPE_GSI, NULL);
|
|
+ spin_unlock(&hardware_domain->event_lock);
|
|
+ if ( ret < 0 )
|
|
+ return ret;
|
|
+ }
|
|
|
|
spin_lock_irqsave(&ioapic_lock, flags);
|
|
/* Set the correct irq-handling type. */
|
|
--- a/xen/arch/x86/irq.c
|
|
+++ b/xen/arch/x86/irq.c
|
|
@@ -1906,7 +1906,7 @@ int map_domain_pirq(
|
|
if ( !irq_access_permitted(current->domain, irq))
|
|
return -EPERM;
|
|
|
|
- if ( pirq < 0 || pirq >= d->nr_pirqs || irq < 0 || irq >= nr_irqs )
|
|
+ if ( pirq < 0 || pirq >= d->nr_pirqs || irq <= 0 || irq >= nr_irqs )
|
|
{
|
|
dprintk(XENLOG_G_ERR, "dom%d: invalid pirq %d or irq %d\n",
|
|
d->domain_id, pirq, irq);
|
|
@@ -1919,8 +1919,9 @@ int map_domain_pirq(
|
|
if ( (old_irq > 0 && (old_irq != irq) ) ||
|
|
(old_pirq && (old_pirq != pirq)) )
|
|
{
|
|
- dprintk(XENLOG_G_WARNING, "dom%d: pirq %d or irq %d already mapped\n",
|
|
- d->domain_id, pirq, irq);
|
|
+ dprintk(XENLOG_G_WARNING,
|
|
+ "dom%d: pirq %d or irq %d already mapped (%d,%d)\n",
|
|
+ d->domain_id, pirq, irq, old_pirq, old_irq);
|
|
return 0;
|
|
}
|
|
|