[PATCH 0/2] VT-d: extend XSA-59 workaround

[PATCH 0/2] VT-d: extend XSA-59 workaround

[Jan Beulich]

The endless story continues.

1: make XSA-59 workaround fully cover XeonE5/E7 v2
2: extend XSA-59 workaround to XeonE5 v3 (Haswell)

Signed-off-by: Jan Beulich <jbeulich@suse.com>

[PATCH 1/2] VT-d: make XSA-59 workaround fully cover XeonE5/E7 v2

[Jan Beulich]

[-- Attachment #1: Type: text/plain, Size: 641 bytes --]

So far only the VT-d UR masking was being done for them.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/drivers/passthrough/vtd/quirks.c
+++ b/xen/drivers/passthrough/vtd/quirks.c
@@ -440,6 +440,9 @@ void pci_vtd_quirk(const struct pci_dev 
                seg, bus, dev, func);
         break;
 
+    /* Xeon E5/E7 v2 */
+    case 0x0e00: /* host bridge */
+    case 0x0e01: case 0x0e04 ... 0x0e0b: /* root ports */
     /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */
     case 0x3400 ... 0x3407: /* host bridges */
     case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */




[-- Attachment #2: xsa59-XeonEx-v2.patch --]
[-- Type: text/plain, Size: 692 bytes --]

VT-d: make XSA-59 workaround fully cover XeonE5/E7 v2

So far only the VT-d UR masking was being done for them.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/drivers/passthrough/vtd/quirks.c
+++ b/xen/drivers/passthrough/vtd/quirks.c
@@ -440,6 +440,9 @@ void pci_vtd_quirk(const struct pci_dev 
                seg, bus, dev, func);
         break;
 
+    /* Xeon E5/E7 v2 */
+    case 0x0e00: /* host bridge */
+    case 0x0e01: case 0x0e04 ... 0x0e0b: /* root ports */
     /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */
     case 0x3400 ... 0x3407: /* host bridges */
     case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

[PATCH 2/2] VT-d: extend XSA-59 workaround to XeonE5 v3 (Haswell)

[Jan Beulich]

[-- Attachment #1: Type: text/plain, Size: 1183 bytes --]

Note that the datasheet lacks PCI IDs for Dev 1 Fn 0-1, so their IDs
are being added based on what https://pci-ids.ucw.cz/read/PC/8086 says.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/drivers/passthrough/vtd/quirks.c
+++ b/xen/drivers/passthrough/vtd/quirks.c
@@ -431,6 +431,7 @@ void pci_vtd_quirk(const struct pci_dev 
      *   - Potential security issue if malicious guest trigger VT-d faults.
      */
     case 0x0e28: /* Xeon-E5v2 (IvyBridge) */
+    case 0x2f28: /* Xeon-E5v3 (Haswell) */
     case 0x342e: /* Tylersburg chipset (Nehalem / Westmere systems) */
     case 0x3728: /* Xeon C5500/C3500 (JasperForest) */
     case 0x3c28: /* Sandybridge */
@@ -443,6 +444,9 @@ void pci_vtd_quirk(const struct pci_dev 
     /* Xeon E5/E7 v2 */
     case 0x0e00: /* host bridge */
     case 0x0e01: case 0x0e04 ... 0x0e0b: /* root ports */
+    /* Xeon E5 v3 */
+    case 0x2f00: /* host bridge */
+    case 0x2f01 ... 0x2f0b: /* root ports */
     /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */
     case 0x3400 ... 0x3407: /* host bridges */
     case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */




[-- Attachment #2: xsa59-XeonE5-v3.patch --]
[-- Type: text/plain, Size: 1234 bytes --]

VT-d: extend XSA-59 workaround to XeonE5 v3 (Haswell)

Note that the datasheet lacks PCI IDs for Dev 1 Fn 0-1, so their IDs
are being added based on what https://pci-ids.ucw.cz/read/PC/8086 says.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/drivers/passthrough/vtd/quirks.c
+++ b/xen/drivers/passthrough/vtd/quirks.c
@@ -431,6 +431,7 @@ void pci_vtd_quirk(const struct pci_dev 
      *   - Potential security issue if malicious guest trigger VT-d faults.
      */
     case 0x0e28: /* Xeon-E5v2 (IvyBridge) */
+    case 0x2f28: /* Xeon-E5v3 (Haswell) */
     case 0x342e: /* Tylersburg chipset (Nehalem / Westmere systems) */
     case 0x3728: /* Xeon C5500/C3500 (JasperForest) */
     case 0x3c28: /* Sandybridge */
@@ -443,6 +444,9 @@ void pci_vtd_quirk(const struct pci_dev 
     /* Xeon E5/E7 v2 */
     case 0x0e00: /* host bridge */
     case 0x0e01: case 0x0e04 ... 0x0e0b: /* root ports */
+    /* Xeon E5 v3 */
+    case 0x2f00: /* host bridge */
+    case 0x2f01 ... 0x2f0b: /* root ports */
     /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */
     case 0x3400 ... 0x3407: /* host bridges */
     case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH 0/2] VT-d: extend XSA-59 workaround

[Konrad Rzeszutek Wilk]

On Fri, Dec 19, 2014 at 08:31:51AM +0000, Jan Beulich wrote:
> The endless story continues.

Intel maintainers, are you folks OK with these patches?

>From my perspective: Release-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> 
> 1: make XSA-59 workaround fully cover XeonE5/E7 v2
> 2: extend XSA-59 workaround to XeonE5 v3 (Haswell)
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel

Re: [PATCH 0/2] VT-d: extend XSA-59 workaround

[Dugger, Donald D]

Working to resolve this issue, I hope to have a definitive answer by the end of this week.

--
Don Dugger
"Censeo Toto nos in Kansa esse decisse." - D. Gale
Ph: 303/443-3786

-----Original Message-----
From: Konrad Rzeszutek Wilk [mailto:konrad.wilk@oracle.com] 
Sent: Monday, January 5, 2015 9:27 AM
To: Jan Beulich
Cc: xen-devel; Zhang, Yang Z; Tian, Kevin; Dugger, Donald D
Subject: Re: [Xen-devel] [PATCH 0/2] VT-d: extend XSA-59 workaround

On Fri, Dec 19, 2014 at 08:31:51AM +0000, Jan Beulich wrote:
> The endless story continues.

Intel maintainers, are you folks OK with these patches?

>From my perspective: Release-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> 
> 1: make XSA-59 workaround fully cover XeonE5/E7 v2
> 2: extend XSA-59 workaround to XeonE5 v3 (Haswell)
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel

Re: [PATCH 0/2] VT-d: extend XSA-59 workaround

[Konrad Rzeszutek Wilk]

On Mon, Jan 05, 2015 at 04:28:02PM +0000, Dugger, Donald D wrote:
> Working to resolve this issue, I hope to have a definitive answer by the end of this week.

OK, so past Xen 4.5 release. thanks!
> 
> --
> Don Dugger
> "Censeo Toto nos in Kansa esse decisse." - D. Gale
> Ph: 303/443-3786
> 
> -----Original Message-----
> From: Konrad Rzeszutek Wilk [mailto:konrad.wilk@oracle.com] 
> Sent: Monday, January 5, 2015 9:27 AM
> To: Jan Beulich
> Cc: xen-devel; Zhang, Yang Z; Tian, Kevin; Dugger, Donald D
> Subject: Re: [Xen-devel] [PATCH 0/2] VT-d: extend XSA-59 workaround
> 
> On Fri, Dec 19, 2014 at 08:31:51AM +0000, Jan Beulich wrote:
> > The endless story continues.
> 
> Intel maintainers, are you folks OK with these patches?
> 
> >From my perspective: Release-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> > 
> > 1: make XSA-59 workaround fully cover XeonE5/E7 v2
> > 2: extend XSA-59 workaround to XeonE5 v3 (Haswell)
> > 
> > Signed-off-by: Jan Beulich <jbeulich@suse.com>
> > 
> > 
> > _______________________________________________
> > Xen-devel mailing list
> > Xen-devel@lists.xen.org
> > http://lists.xen.org/xen-devel

Re: [PATCH 0/2] VT-d: extend XSA-59 workaround

[Jan Beulich]

>>> "Dugger, Donald D" <donald.d.dugger@intel.com> 01/05/15 5:28 PM >>>
>Working to resolve this issue, I hope to have a definitive answer by the end of this week.

I.e. too late for 4.5, unless it gets slipped further...

Jan

Re: [PATCH 1/2] VT-d: make XSA-59 workaround fully cover XeonE5/E7 v2

[Dugger, Donald D]

Note that the following Nehalem/Westmere chipsets should be included in this list:

Nehalem - 0x40, 0x2c01, 0x2c41, 0x313x
Westmere - 0x2c70, 0x2d81, 0xd15x

--
Don Dugger
"Censeo Toto nos in Kansa esse decisse." - D. Gale
Ph: 303/443-3786

-----Original Message-----
From: Jan Beulich [mailto:JBeulich@suse.com] 
Sent: Friday, December 19, 2014 1:41 AM
To: xen-devel
Cc: Dugger, Donald D; Tian, Kevin; Zhang, Yang Z
Subject: [PATCH 1/2] VT-d: make XSA-59 workaround fully cover XeonE5/E7 v2

So far only the VT-d UR masking was being done for them.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/drivers/passthrough/vtd/quirks.c
+++ b/xen/drivers/passthrough/vtd/quirks.c
@@ -440,6 +440,9 @@ void pci_vtd_quirk(const struct pci_dev 
                seg, bus, dev, func);
         break;
 
+    /* Xeon E5/E7 v2 */
+    case 0x0e00: /* host bridge */
+    case 0x0e01: case 0x0e04 ... 0x0e0b: /* root ports */
     /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */
     case 0x3400 ... 0x3407: /* host bridges */
     case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */

Re: [PATCH 2/2] VT-d: extend XSA-59 workaround to XeonE5 v3 (Haswell)

[Dugger, Donald D]

Note that the following Haswell chipsets should also be included in this list:

Haswell - 0xc0f, 0xd00, 0xd04, 0xd08, 0xd0f, 0xa00, 0xa08, 0xa0f

--
Don Dugger
"Censeo Toto nos in Kansa esse decisse." - D. Gale
Ph: 303/443-3786

-----Original Message-----
From: Jan Beulich [mailto:JBeulich@suse.com] 
Sent: Friday, December 19, 2014 1:42 AM
To: xen-devel
Cc: Dugger, Donald D; Tian, Kevin; Zhang, Yang Z
Subject: [PATCH 2/2] VT-d: extend XSA-59 workaround to XeonE5 v3 (Haswell)

Note that the datasheet lacks PCI IDs for Dev 1 Fn 0-1, so their IDs are being added based on what https://pci-ids.ucw.cz/read/PC/8086 says.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/drivers/passthrough/vtd/quirks.c
+++ b/xen/drivers/passthrough/vtd/quirks.c
@@ -431,6 +431,7 @@ void pci_vtd_quirk(const struct pci_dev 
      *   - Potential security issue if malicious guest trigger VT-d faults.
      */
     case 0x0e28: /* Xeon-E5v2 (IvyBridge) */
+    case 0x2f28: /* Xeon-E5v3 (Haswell) */
     case 0x342e: /* Tylersburg chipset (Nehalem / Westmere systems) */
     case 0x3728: /* Xeon C5500/C3500 (JasperForest) */
     case 0x3c28: /* Sandybridge */
@@ -443,6 +444,9 @@ void pci_vtd_quirk(const struct pci_dev 
     /* Xeon E5/E7 v2 */
     case 0x0e00: /* host bridge */
     case 0x0e01: case 0x0e04 ... 0x0e0b: /* root ports */
+    /* Xeon E5 v3 */
+    case 0x2f00: /* host bridge */
+    case 0x2f01 ... 0x2f0b: /* root ports */
     /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */
     case 0x3400 ... 0x3407: /* host bridges */
     case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */

Re: [PATCH 2/2] VT-d: extend XSA-59 workaround to XeonE5 v3 (Haswell)

[Jan Beulich]

>>> On 17.03.15 at 18:41, <donald.d.dugger@intel.com> wrote:
> Note that the following Haswell chipsets should also be included in this 
> list:
> 
> Haswell - 0xc0f, 0xd00, 0xd04, 0xd08, 0xd0f, 0xa00, 0xa08, 0xa0f

But these are desktop ones afaict, i.e. they'd belong in a separate
patch (which I'll create in a minute).

Jan

> -----Original Message-----
> From: Jan Beulich [mailto:JBeulich@suse.com] 
> Sent: Friday, December 19, 2014 1:42 AM
> To: xen-devel
> Cc: Dugger, Donald D; Tian, Kevin; Zhang, Yang Z
> Subject: [PATCH 2/2] VT-d: extend XSA-59 workaround to XeonE5 v3 (Haswell)
> 
> Note that the datasheet lacks PCI IDs for Dev 1 Fn 0-1, so their IDs are 
> being added based on what https://pci-ids.ucw.cz/read/PC/8086 says.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> --- a/xen/drivers/passthrough/vtd/quirks.c
> +++ b/xen/drivers/passthrough/vtd/quirks.c
> @@ -431,6 +431,7 @@ void pci_vtd_quirk(const struct pci_dev 
>       *   - Potential security issue if malicious guest trigger VT-d faults.
>       */
>      case 0x0e28: /* Xeon-E5v2 (IvyBridge) */
> +    case 0x2f28: /* Xeon-E5v3 (Haswell) */
>      case 0x342e: /* Tylersburg chipset (Nehalem / Westmere systems) */
>      case 0x3728: /* Xeon C5500/C3500 (JasperForest) */
>      case 0x3c28: /* Sandybridge */
> @@ -443,6 +444,9 @@ void pci_vtd_quirk(const struct pci_dev 
>      /* Xeon E5/E7 v2 */
>      case 0x0e00: /* host bridge */
>      case 0x0e01: case 0x0e04 ... 0x0e0b: /* root ports */
> +    /* Xeon E5 v3 */
> +    case 0x2f00: /* host bridge */
> +    case 0x2f01 ... 0x2f0b: /* root ports */
>      /* Tylersburg (EP)/Boxboro (MP) chipsets (NHM-EP/EX, WSM-EP/EX) */
>      case 0x3400 ... 0x3407: /* host bridges */
>      case 0x3408 ... 0x3411: case 0x3420 ... 0x3421: /* root ports */

Re: [PATCH 1/2] VT-d: make XSA-59 workaround fully cover XeonE5/E7 v2

[Jan Beulich]

>>> On 17.03.15 at 18:39, <donald.d.dugger@intel.com> wrote:
> Note that the following Nehalem/Westmere chipsets should be included in this 
> list:
> 
> Nehalem - 0x40, 0x2c01, 0x2c41, 0x313x
> Westmere - 0x2c70, 0x2d81, 0xd15x

0x0040 is already there (as a desktop one). The others being server
ones again would belong into a separate patch, as v2 (see the title)
refers to Ivybridge afaict.

Furthermore simply listing the IDs isn't necessarily enough. I'll see
whether I can hunt down the data sheets for the above, but
considering that we have three different workarounds, of which
I can reasonably exclude only the desktop variant, I wouldn't know
where to put those without having the spec or you telling me.

Jan