From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ben Guthro Subject: Re: Ping: [PATCH] VT-d: protect against bogus information coming from BIOS Date: Mon, 5 Aug 2013 09:10:21 -0400 Message-ID: References: <51DD52EF02000078000E3CDE@nat28.tlf.novell.com> <51FFBF8B02000078000E94AC@nat28.tlf.novell.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9085685292917113283==" Return-path: In-Reply-To: <51FFBF8B02000078000E94AC@nat28.tlf.novell.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Jan Beulich Cc: xiantao.zhang@intel.com, xen-devel List-Id: xen-devel@lists.xenproject.org --===============9085685292917113283== Content-Type: multipart/alternative; boundary=001a11c1e980daaf0204e333079d --001a11c1e980daaf0204e333079d Content-Type: text/plain; charset=ISO-8859-1 On Mon, Aug 5, 2013 at 9:06 AM, Jan Beulich wrote: > Ping? > > >>> On 10.07.13 at 12:26, "Jan Beulich" wrote: > > Add checks similar to those done by Linux: The DRHD address must not > > be all zeros or all ones (Linux only checks for zero), and capabilities > > as well as extended capabilities must not be all ones. > > > > Signed-off-by: Jan Beulich > > > Looks OK to me, FWIW You can add Reviewed-by: Ben Guthro > > --- a/xen/drivers/passthrough/vtd/dmar.c > > +++ b/xen/drivers/passthrough/vtd/dmar.c > > @@ -447,6 +447,9 @@ acpi_parse_one_drhd(struct acpi_dmar_hea > > if ( (ret = acpi_dmar_check_length(header, sizeof(*drhd))) != 0 ) > > return ret; > > > > + if ( !drhd->address || !(drhd->address + 1) ) > > + return -ENODEV; > > + > > dmaru = xzalloc(struct acpi_drhd_unit); > > if ( !dmaru ) > > return -ENOMEM; > > --- a/xen/drivers/passthrough/vtd/iommu.c > > +++ b/xen/drivers/passthrough/vtd/iommu.c > > @@ -1159,6 +1159,9 @@ int __init iommu_alloc(struct acpi_drhd_ > > dprintk(VTDPREFIX, > > "cap = %"PRIx64" ecap = %"PRIx64"\n", iommu->cap, > iommu->ecap); > > } > > + if ( !(iommu->cap + 1) || !(iommu->ecap + 1) ) > > + return -ENODEV; > > + > > if ( cap_fault_reg_offset(iommu->cap) + > > cap_num_fault_regs(iommu->cap) * PRIMARY_FAULT_REG_LEN >= > PAGE_SIZE > > || > > ecap_iotlb_offset(iommu->ecap) >= PAGE_SIZE ) > > > > --001a11c1e980daaf0204e333079d Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Mon, Aug 5, 2013 at 9:06 AM, Jan Beulich = <JBeulich@suse.com> wrote:
Ping?

>>> On 10.07.13 at 12:26, "Jan Beulich" <JBeulich@suse.com> wrote:
> Add checks similar to those done by Linux: The DRHD address must not > be all zeros or all ones (Linux only checks for zero), and capabilitie= s
> as well as extended capabilities must not be all ones.
>
> Signed-off-by: Jan Beulich <jb= eulich@suse.com>
>

Looks OK to me, FWIW
You can add
Reviewed-by: Ben Guthro <benjamin.guthro@citrix.com>

=A0
> --- a/xen/drivers/passthrough/vtd/dmar.c
> +++ b/xen/drivers/passthrough/vtd/dmar.c
> @@ -447,6 +447,9 @@ acpi_parse_one_drhd(struct acpi_dmar_hea
> =A0 =A0 =A0if ( (ret =3D acpi_dmar_check_length(header, sizeof(*drhd))= ) !=3D 0 )
> =A0 =A0 =A0 =A0 =A0return ret;
>
> + =A0 =A0if ( !drhd->address || !(drhd->address + 1) )
> + =A0 =A0 =A0 =A0return -ENODEV;
> +
> =A0 =A0 =A0dmaru =3D xzalloc(struct acpi_drhd_unit);
> =A0 =A0 =A0if ( !dmaru )
> =A0 =A0 =A0 =A0 =A0return -ENOMEM;
> --- a/xen/drivers/passthrough/vtd/iommu.c
> +++ b/xen/drivers/passthrough/vtd/iommu.c
> @@ -1159,6 +1159,9 @@ int __init iommu_alloc(struct acpi_drhd_
> =A0 =A0 =A0 =A0 =A0dprintk(VTDPREFIX,
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0"cap =3D %"PRIx64" e= cap =3D %"PRIx64"\n", iommu->cap, iommu->ecap);
> =A0 =A0 =A0}
> + =A0 =A0if ( !(iommu->cap + 1) || !(iommu->ecap + 1) )
> + =A0 =A0 =A0 =A0return -ENODEV;
> +
> =A0 =A0 =A0if ( cap_fault_reg_offset(iommu->cap) +
> =A0 =A0 =A0 =A0 =A0 cap_num_fault_regs(iommu->cap) * PRIMARY_FAULT_= REG_LEN >=3D PAGE_SIZE
> ||
> =A0 =A0 =A0 =A0 =A0 ecap_iotlb_offset(iommu->ecap) >=3D PAGE_SIZ= E )




--001a11c1e980daaf0204e333079d-- --===============9085685292917113283== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============9085685292917113283==--