debuggers.hg

changeset 20892:7d65247d5f06

VT-d: improve RMRR validity checking

In order to make Xen more defensive to VT-d related BIOS issue, this
patch ignores a DRHD if all devices under its scope are not pci
discoverable, and regards a DRHD as invalid and then disable whole
VT-d if some devices under its scope are not pci discoverable. But if
iommu=force is set, it will enable all DRHDs reported by BIOS, to
avoid any security vulnerability with malicious s/s re-enabling
"supposed disabled" devices. Pls note that we don't know the devices
under the "Include_all" DRHD are existent or not, because the scope of
"Include_all" DRHD won't enumerate common pci device, it only
enumerates I/OxAPIC and HPET devices.

Signed-off-by: Noboru Iwamatsu <n_iwamatsu@jp.fujitsu.com>
Signed-off-by: Weidong Han <weidong.han@intel.com>
author Keir Fraser <keir.fraser@citrix.com>
date Sat Jan 23 08:23:24 2010 +0000 (2010-01-23)
parents 4978b4a4bbb6
children 15efdfc46593
files xen/drivers/passthrough/vtd/dmar.c
line diff
     1.1 --- a/xen/drivers/passthrough/vtd/dmar.c	Fri Jan 22 13:32:26 2010 +0000
     1.2 +++ b/xen/drivers/passthrough/vtd/dmar.c	Sat Jan 23 08:23:24 2010 +0000
     1.3 @@ -396,8 +396,49 @@ acpi_parse_one_drhd(struct acpi_dmar_ent
     1.4  
     1.5      if ( ret )
     1.6          xfree(dmaru);
     1.7 +    else if ( force_iommu || dmaru->include_all )
     1.8 +        acpi_register_drhd_unit(dmaru);
     1.9      else
    1.10 -        acpi_register_drhd_unit(dmaru);
    1.11 +    {
    1.12 +        u8 b, d, f;
    1.13 +        int i, invalid_cnt = 0;
    1.14 +
    1.15 +        for ( i = 0; i < dmaru->scope.devices_cnt; i++ )
    1.16 +        {
    1.17 +            b = PCI_BUS(dmaru->scope.devices[i]);
    1.18 +            d = PCI_SLOT(dmaru->scope.devices[i]);
    1.19 +            f = PCI_FUNC(dmaru->scope.devices[i]);
    1.20 +
    1.21 +            if ( pci_device_detect(b, d, f) == 0 )
    1.22 +            {
    1.23 +                dprintk(XENLOG_WARNING VTDPREFIX,
    1.24 +                    "  Non-existent device (%x:%x.%x) is reported "
    1.25 +                    "in this DRHD's scope!\n", b, d, f);
    1.26 +                invalid_cnt++;
    1.27 +            }
    1.28 +        }
    1.29 +
    1.30 +        if ( invalid_cnt )
    1.31 +        {
    1.32 +            xfree(dmaru);
    1.33 +            if ( invalid_cnt == dmaru->scope.devices_cnt )
    1.34 +            {
    1.35 +                dprintk(XENLOG_WARNING VTDPREFIX,
    1.36 +                    "  Ignore the DRHD due to all devices under "
    1.37 +                    "its scope are not PCI discoverable!\n");
    1.38 +            }
    1.39 +            else
    1.40 +            {
    1.41 +                dprintk(XENLOG_WARNING VTDPREFIX,
    1.42 +                    "  The DRHD is invalid due to some devices under "
    1.43 +                    "its scope are not PCI discoverable!\n");
    1.44 +                ret = -EINVAL;
    1.45 +            }
    1.46 +        }
    1.47 +        else
    1.48 +            acpi_register_drhd_unit(dmaru);
    1.49 +    }
    1.50 +
    1.51      return ret;
    1.52  }
    1.53