On Thu, 2011-07-21 at 12:39 -0400, Donald Dutile wrote:
> v2: do local boundary check with respect to legacy PCI header length,
> and don't depend on it in pci_add_capability().
> : fix compilation, and change else>2 to simple else for all other cases.
>
> Doing device assignement using a PCIe device with it's
> PCI Cap structure at offset 0xcc showed a problem in
> the default size mapped for this cap-id.
>
> The failure caused a corruption which might have gone unnoticed
> otherwise.
>
> Fix assigned_device_pci_cap_init() to set the default
> size of PCIe Cap structure (cap-id 0x10) to 0x34 instead of 0x3c.
> 0x34 is default, min, for endpoint device with a cap version of 2.
>
> Add check in assigned_devic_pci_cap_init() to ensure
> size of Cap structure doesn't exceed legacy PCI header space,
> which is where it must fit.
>
> Signed-off-by: Donald Dutile <ddutile@xxxxxxxxxx>
> cc: Alex Williamson <alex.williamson@xxxxxxxxxx>
> cc: Michael S. Tsirkin <mst@xxxxxxxxxx>
> ---
>
> hw/device-assignment.c | 19 ++++++++++++++++---
> 1 files changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/hw/device-assignment.c b/hw/device-assignment.c
> index 36ad6b0..6bb8af7 100644
> --- a/hw/device-assignment.c
> +++ b/hw/device-assignment.c
> @@ -1419,21 +1419,34 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
> }
>
> if ((pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0))) {
> - uint8_t version;
> + uint8_t version, size;
> uint16_t type, devctl, lnkcap, lnksta;
> uint32_t devcap;
> - int size = 0x3c; /* version 2 size */
>
> version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS);
> version &= PCI_EXP_FLAGS_VERS;
> if (version == 1) {
> size = 0x14;
> - } else if (version > 2) {
> + } else if (version == 2) {
> + /* don't include slot cap/stat/ctrl 2 regs; only support endpoints */
> + size = 0x34;
> + } else {
> fprintf(stderr, "Unsupported PCI express capability version %d\n",
> version);
> return -EINVAL;
> }
>
> + /* make sure cap struct resides in legacy hdr space */
> + if (size > PCI_CONFIG_SPACE_SIZE - pos) {
> + fprintf(stderr, "ERROR: %04x:%02x:%02x.%x "
> + "Attempt to add PCI Cap Structure 0x%x at offset 0x%x,"
> + "size 0x%x, which exceeds legacy PCI config space 0x%x\n",
> + pci_find_domain(pci_dev->bus), pci_bus_num(pci_dev->bus),
> + PCI_SLOT(pci_dev->devfn), PCI_FUNC(pci_dev->devfn),
> + PCI_CAP_ID_EXP, pos, size, PCI_CONFIG_SPACE_SIZE);
> + return -EINVAL;
> + }
> +
This is crazy, why would we only test this for PCI_CAP_ID_EXP? If the
test is going to go in device-assignment, we need to wrap
pci_add_capability and do it for all callers. However, maybe we can get
MST to take it in pci_add_capability() if we make the test more
complete... something like:
if ((pos < 256 && size > 256 - pos) ||
(pci_config_size() > 256 && pos > 256 &&
size > pci_config_size() - pos)) {
... badness
Thanks,
Alex
> if ((ret = pci_add_capability(pci_dev, PCI_CAP_ID_EXP,
> pos, size)) < 0) {
> return ret;
>
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
