Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'stable/for-linus-4.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen bug fixes from David Vrabel:
- fix a PV regression in 3.19.
- fix a dom0 crash on hosts with large numbers of PIRQs.
- prevent pcifront from disabling memory or I/O port access, which may
trigger host crashes.
* tag 'stable/for-linus-4.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen-pciback: limit guest control of command register
xen/events: avoid NULL pointer dereference in dom0 on large machines
xen: Remove trailing semicolon from xenbus_register_frontend() definition
x86/xen: correct bug in p2m list initialization
+65
-22
+1
-1
arch/x86/xen/p2m.c
+1
-1
arch/x86/xen/p2m.c
+12
-6
drivers/xen/events/events_base.c
+12
-6
drivers/xen/events/events_base.c
···
526
526
pirq_query_unmask(irq);
527
527
528
528
rc = set_evtchn_to_irq(evtchn, irq);
529
-
if (rc != 0) {
530
-
pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
531
-
irq, rc);
532
-
xen_evtchn_close(evtchn);
533
-
return 0;
534
-
}
529
+
if (rc)
530
+
goto err;
531
+
535
532
bind_evtchn_to_cpu(evtchn, 0);
536
533
info->evtchn = evtchn;
534
+
535
+
rc = xen_evtchn_port_setup(info);
536
+
if (rc)
537
+
goto err;
537
538
538
539
out:
539
540
unmask_evtchn(evtchn);
540
541
eoi_pirq(irq_get_irq_data(irq));
541
542
543
+
return 0;
544
+
545
+
err:
546
+
pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
547
+
xen_evtchn_close(evtchn);
542
548
return 0;
543
549
}
544
550
+1
-1
drivers/xen/xen-pciback/conf_space.c
+1
-1
drivers/xen/xen-pciback/conf_space.c
+2
drivers/xen/xen-pciback/conf_space.h
+2
drivers/xen/xen-pciback/conf_space.h
+47
-12
drivers/xen/xen-pciback/conf_space_header.c
+47
-12
drivers/xen/xen-pciback/conf_space_header.c
···
11
11
#include "pciback.h"
12
12
#include "conf_space.h"
13
13
14
+
struct pci_cmd_info {
15
+
u16 val;
16
+
};
17
+
14
18
struct pci_bar_info {
15
19
u32 val;
16
20
u32 len_val;
···
24
20
#define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
25
21
#define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
26
22
23
+
/* Bits guests are allowed to control in permissive mode. */
24
+
#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
25
+
PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
26
+
PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
27
+
28
+
static void *command_init(struct pci_dev *dev, int offset)
29
+
{
30
+
struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
31
+
int err;
32
+
33
+
if (!cmd)
34
+
return ERR_PTR(-ENOMEM);
35
+
36
+
err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
37
+
if (err) {
38
+
kfree(cmd);
39
+
return ERR_PTR(err);
40
+
}
41
+
42
+
return cmd;
43
+
}
44
+
27
45
static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
28
46
{
29
-
int i;
30
-
int ret;
47
+
int ret = pci_read_config_word(dev, offset, value);
48
+
const struct pci_cmd_info *cmd = data;
31
49
32
-
ret = xen_pcibk_read_config_word(dev, offset, value, data);
33
-
if (!pci_is_enabled(dev))
34
-
return ret;
35
-
36
-
for (i = 0; i < PCI_ROM_RESOURCE; i++) {
37
-
if (dev->resource[i].flags & IORESOURCE_IO)
38
-
*value |= PCI_COMMAND_IO;
39
-
if (dev->resource[i].flags & IORESOURCE_MEM)
40
-
*value |= PCI_COMMAND_MEMORY;
41
-
}
50
+
*value &= PCI_COMMAND_GUEST;
51
+
*value |= cmd->val & ~PCI_COMMAND_GUEST;
42
52
43
53
return ret;
44
54
}
···
61
43
{
62
44
struct xen_pcibk_dev_data *dev_data;
63
45
int err;
46
+
u16 val;
47
+
struct pci_cmd_info *cmd = data;
64
48
65
49
dev_data = pci_get_drvdata(dev);
66
50
if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
···
102
82
value &= ~PCI_COMMAND_INVALIDATE;
103
83
}
104
84
}
85
+
86
+
cmd->val = value;
87
+
88
+
if (!permissive && (!dev_data || !dev_data->permissive))
89
+
return 0;
90
+
91
+
/* Only allow the guest to control certain bits. */
92
+
err = pci_read_config_word(dev, offset, &val);
93
+
if (err || val == value)
94
+
return err;
95
+
96
+
value &= PCI_COMMAND_GUEST;
97
+
value |= val & ~PCI_COMMAND_GUEST;
105
98
106
99
return pci_write_config_word(dev, offset, value);
107
100
}
···
315
282
{
316
283
.offset = PCI_COMMAND,
317
284
.size = 2,
285
+
.init = command_init,
286
+
.release = bar_release,
318
287
.u.w.read = command_read,
319
288
.u.w.write = command_write,
320
289
},
+2
-2
include/xen/xenbus.h
+2
-2
include/xen/xenbus.h
···
114
114
const char *mod_name);
115
115
116
116
#define xenbus_register_frontend(drv) \
117
-
__xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME);
117
+
__xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME)
118
118
#define xenbus_register_backend(drv) \
119
-
__xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME);
119
+
__xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME)
120
120
121
121
void xenbus_unregister_driver(struct xenbus_driver *drv);
122
122