763b78040d
config handling stack overflow CVE-2015-3259-xsa137.patch - Upstream patches from Jan 558bfaa0-x86-traps-avoid-using-current-too-early.patch 5592a116-nested-EPT-fix-the-handling-of-nested-EPT.patch 559b9dd6-x86-p2m-ept-don-t-unmap-in-use-EPT-pagetable.patch 559bdde5-pull-in-latest-linux-earlycpio.patch - Upstream patches from Jan pending review 552d0fd2-x86-hvm-don-t-include-asm-spinlock-h.patch 552d0fe8-x86-mtrr-include-asm-atomic.h.patch 552d293b-x86-vMSI-X-honor-all-mask-requests.patch 552d2966-x86-vMSI-X-add-valid-bits-for-read-acceleration.patch 554c7aee-x86-provide-arch_fetch_and_add.patch 554c7b00-arm-provide-arch_fetch_and_add.patch 55534b0a-x86-provide-add_sized.patch 55534b25-arm-provide-add_sized.patch 5555a4f8-use-ticket-locks-for-spin-locks.patch 5555a5b9-x86-arm-remove-asm-spinlock-h.patch 5555a8ec-introduce-non-contiguous-allocation.patch 55795a52-x86-vMSI-X-support-qword-MMIO-access.patch 557eb55f-gnttab-per-active-entry-locking.patch 557eb5b6-gnttab-introduce-maptrack-lock.patch 557eb620-gnttab-make-the-grant-table-lock-a-read-write-lock.patch 557ffab8-evtchn-factor-out-freeing-an-event-channel.patch 5582bf43-evtchn-simplify-port_is_valid.patch 5582bf81-evtchn-remove-the-locking-when-unmasking-an-event-channel.patch 5583d9c5-x86-MSI-X-cleanup.patch 5583da09-x86-MSI-track-host-and-guest-masking-separately.patch 5583da64-gnttab-use-per-VCPU-maptrack-free-lists.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=369
115 lines
4.0 KiB
Diff
115 lines
4.0 KiB
Diff
x86/PCI: add config space abstract write intercept logic
|
|
|
|
This is to be used by MSI code, and later to also be hooked up to
|
|
MMCFG accesses by Dom0.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
|
|
--- sle12sp1.orig/xen/arch/x86/msi.c 2015-07-08 11:45:59.000000000 +0200
|
|
+++ sle12sp1/xen/arch/x86/msi.c 2015-06-22 09:06:30.000000000 +0200
|
|
@@ -1108,6 +1108,12 @@ void pci_cleanup_msi(struct pci_dev *pde
|
|
msi_free_irqs(pdev);
|
|
}
|
|
|
|
+int pci_msi_conf_write_intercept(struct pci_dev *pdev, unsigned int reg,
|
|
+ unsigned int size, uint32_t *data)
|
|
+{
|
|
+ return 0;
|
|
+}
|
|
+
|
|
int pci_restore_msi_state(struct pci_dev *pdev)
|
|
{
|
|
unsigned long flags;
|
|
--- sle12sp1.orig/xen/arch/x86/pci.c 2015-07-08 11:45:59.000000000 +0200
|
|
+++ sle12sp1/xen/arch/x86/pci.c 2015-06-19 16:08:11.000000000 +0200
|
|
@@ -67,3 +67,28 @@ void pci_conf_write(uint32_t cf8, uint8_
|
|
|
|
spin_unlock_irqrestore(&pci_config_lock, flags);
|
|
}
|
|
+
|
|
+int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
|
|
+ unsigned int reg, unsigned int size,
|
|
+ uint32_t *data)
|
|
+{
|
|
+ struct pci_dev *pdev;
|
|
+ int rc = 0;
|
|
+
|
|
+ /*
|
|
+ * Avoid expensive operations when no hook is going to do anything
|
|
+ * for the access anyway.
|
|
+ */
|
|
+ if ( reg < 64 || reg >= 256 )
|
|
+ return 0;
|
|
+
|
|
+ spin_lock(&pcidevs_lock);
|
|
+
|
|
+ pdev = pci_get_pdev(seg, PCI_BUS(bdf), PCI_DEVFN2(bdf));
|
|
+ if ( pdev )
|
|
+ rc = pci_msi_conf_write_intercept(pdev, reg, size, data);
|
|
+
|
|
+ spin_unlock(&pcidevs_lock);
|
|
+
|
|
+ return rc;
|
|
+}
|
|
--- sle12sp1.orig/xen/arch/x86/traps.c 2015-07-08 11:45:59.000000000 +0200
|
|
+++ sle12sp1/xen/arch/x86/traps.c 2015-06-19 15:52:47.000000000 +0200
|
|
@@ -1708,8 +1708,8 @@ static int admin_io_okay(
|
|
return ioports_access_permitted(v->domain, port, port + bytes - 1);
|
|
}
|
|
|
|
-static bool_t pci_cfg_ok(struct domain *currd, bool_t write,
|
|
- unsigned int start, unsigned int size)
|
|
+static bool_t pci_cfg_ok(struct domain *currd, unsigned int start,
|
|
+ unsigned int size, uint32_t *write)
|
|
{
|
|
uint32_t machine_bdf;
|
|
|
|
@@ -1741,8 +1741,12 @@ static bool_t pci_cfg_ok(struct domain *
|
|
start |= CF8_ADDR_HI(currd->arch.pci_cf8);
|
|
}
|
|
|
|
- return !xsm_pci_config_permission(XSM_HOOK, currd, machine_bdf,
|
|
- start, start + size - 1, write);
|
|
+ if ( xsm_pci_config_permission(XSM_HOOK, currd, machine_bdf,
|
|
+ start, start + size - 1, !!write) != 0 )
|
|
+ return 0;
|
|
+
|
|
+ return !write ||
|
|
+ pci_conf_write_intercept(0, machine_bdf, start, size, write) >= 0;
|
|
}
|
|
|
|
uint32_t guest_io_read(
|
|
@@ -1796,7 +1800,7 @@ uint32_t guest_io_read(
|
|
size = min(bytes, 4 - (port & 3));
|
|
if ( size == 3 )
|
|
size = 2;
|
|
- if ( pci_cfg_ok(v->domain, 0, port & 3, size) )
|
|
+ if ( pci_cfg_ok(v->domain, port & 3, size, NULL) )
|
|
sub_data = pci_conf_read(v->domain->arch.pci_cf8, port & 3, size);
|
|
}
|
|
|
|
@@ -1869,7 +1873,7 @@ void guest_io_write(
|
|
size = min(bytes, 4 - (port & 3));
|
|
if ( size == 3 )
|
|
size = 2;
|
|
- if ( pci_cfg_ok(v->domain, 1, port & 3, size) )
|
|
+ if ( pci_cfg_ok(v->domain, port & 3, size, &data) )
|
|
pci_conf_write(v->domain->arch.pci_cf8, port & 3, size, data);
|
|
}
|
|
|
|
--- sle12sp1.orig/xen/include/asm-x86/pci.h 2015-07-08 11:45:59.000000000 +0200
|
|
+++ sle12sp1/xen/include/asm-x86/pci.h 2015-06-19 15:52:03.000000000 +0200
|
|
@@ -15,4 +15,11 @@ struct arch_pci_dev {
|
|
vmask_t used_vectors;
|
|
};
|
|
|
|
+struct pci_dev;
|
|
+int pci_conf_write_intercept(unsigned int seg, unsigned int bdf,
|
|
+ unsigned int reg, unsigned int size,
|
|
+ uint32_t *data);
|
|
+int pci_msi_conf_write_intercept(struct pci_dev *, unsigned int reg,
|
|
+ unsigned int size, uint32_t *data);
|
|
+
|
|
#endif /* __X86_PCI_H__ */
|