v2: do local boundary check with respect to legacy PCI header length,
and don't depend on it in pci_add_capability().
: fix compilation, and change else>2 to simple else for all other cases.
Doing device assignement using a PCIe device with it's
PCI Cap structure at offset 0xcc showed a problem in
the default size mapped for this cap-id.
The failure caused a corruption which might have gone unnoticed
otherwise.
Fix assigned_device_pci_cap_init() to set the default
size of PCIe Cap structure (cap-id 0x10) to 0x34 instead of 0x3c.
0x34 is default, min, for endpoint device with a cap version of 2.
Add check in assigned_devic_pci_cap_init() to ensure
size of Cap structure doesn't exceed legacy PCI header space,
which is where it must fit.
Signed-off-by: Donald Dutile <ddutile@xxxxxxxxxx>
cc: Alex Williamson <alex.williamson@xxxxxxxxxx>
cc: Michael S. Tsirkin <mst@xxxxxxxxxx>
---
hw/device-assignment.c | 19 ++++++++++++++++---
1 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/hw/device-assignment.c b/hw/device-assignment.c
index 36ad6b0..6bb8af7 100644
--- a/hw/device-assignment.c
+++ b/hw/device-assignment.c
@@ -1419,21 +1419,34 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
}
if ((pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0))) {
- uint8_t version;
+ uint8_t version, size;
uint16_t type, devctl, lnkcap, lnksta;
uint32_t devcap;
- int size = 0x3c; /* version 2 size */
version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS);
version &= PCI_EXP_FLAGS_VERS;
if (version == 1) {
size = 0x14;
- } else if (version > 2) {
+ } else if (version == 2) {
+ /* don't include slot cap/stat/ctrl 2 regs; only support endpoints */
+ size = 0x34;
+ } else {
fprintf(stderr, "Unsupported PCI express capability version %d\n",
version);
return -EINVAL;
}
+ /* make sure cap struct resides in legacy hdr space */
+ if (size > PCI_CONFIG_SPACE_SIZE - pos) {
+ fprintf(stderr, "ERROR: %04x:%02x:%02x.%x "
+ "Attempt to add PCI Cap Structure 0x%x at offset 0x%x,"
+ "size 0x%x, which exceeds legacy PCI config space 0x%x\n",
+ pci_find_domain(pci_dev->bus), pci_bus_num(pci_dev->bus),
+ PCI_SLOT(pci_dev->devfn), PCI_FUNC(pci_dev->devfn),
+ PCI_CAP_ID_EXP, pos, size, PCI_CONFIG_SPACE_SIZE);
+ return -EINVAL;
+ }
+
if ((ret = pci_add_capability(pci_dev, PCI_CAP_ID_EXP,
pos, size)) < 0) {
return ret;
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
