From mboxrd@z Thu Jan 1 00:00:00 1970 From: Don Dutile Subject: Re: [PATCH V2] device-assignment pci: correct pci config size default for cap version 2 endpoints Date: Thu, 21 Jul 2011 13:52:42 -0400 Message-ID: <4E28676A.5050401@redhat.com> References: <20110721163733.661.22067.stgit@dddsys0.bos.redhat.com> <1311267773.26867.7.camel@ul30vt> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: kvm@vger.kernel.org, mst@redhat.com To: Alex Williamson Return-path: Received: from mx1.redhat.com ([209.132.183.28]:43030 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751419Ab1GURwo (ORCPT ); Thu, 21 Jul 2011 13:52:44 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p6LHqiIh021311 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 21 Jul 2011 13:52:44 -0400 In-Reply-To: <1311267773.26867.7.camel@ul30vt> Sender: kvm-owner@vger.kernel.org List-ID: On 07/21/2011 01:02 PM, Alex Williamson wrote: > On Thu, 2011-07-21 at 12:39 -0400, Donald Dutile wrote: >> v2: do local boundary check with respect to legacy PCI header length, >> and don't depend on it in pci_add_capability(). >> : fix compilation, and change else>2 to simple else for all other cases. >> >> Doing device assignement using a PCIe device with it's >> PCI Cap structure at offset 0xcc showed a problem in >> the default size mapped for this cap-id. >> >> The failure caused a corruption which might have gone unnoticed >> otherwise. >> >> Fix assigned_device_pci_cap_init() to set the default >> size of PCIe Cap structure (cap-id 0x10) to 0x34 instead of 0x3c. >> 0x34 is default, min, for endpoint device with a cap version of 2. >> >> Add check in assigned_devic_pci_cap_init() to ensure >> size of Cap structure doesn't exceed legacy PCI header space, >> which is where it must fit. >> >> Signed-off-by: Donald Dutile >> cc: Alex Williamson >> cc: Michael S. Tsirkin >> --- >> >> hw/device-assignment.c | 19 ++++++++++++++++--- >> 1 files changed, 16 insertions(+), 3 deletions(-) >> >> diff --git a/hw/device-assignment.c b/hw/device-assignment.c >> index 36ad6b0..6bb8af7 100644 >> --- a/hw/device-assignment.c >> +++ b/hw/device-assignment.c >> @@ -1419,21 +1419,34 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev) >> } >> >> if ((pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0))) { >> - uint8_t version; >> + uint8_t version, size; >> uint16_t type, devctl, lnkcap, lnksta; >> uint32_t devcap; >> - int size = 0x3c; /* version 2 size */ >> >> version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS); >> version&= PCI_EXP_FLAGS_VERS; >> if (version == 1) { >> size = 0x14; >> - } else if (version> 2) { >> + } else if (version == 2) { >> + /* don't include slot cap/stat/ctrl 2 regs; only support endpoints */ >> + size = 0x34; >> + } else { >> fprintf(stderr, "Unsupported PCI express capability version %d\n", >> version); >> return -EINVAL; >> } >> >> + /* make sure cap struct resides in legacy hdr space */ >> + if (size> PCI_CONFIG_SPACE_SIZE - pos) { >> + fprintf(stderr, "ERROR: %04x:%02x:%02x.%x " >> + "Attempt to add PCI Cap Structure 0x%x at offset 0x%x," >> + "size 0x%x, which exceeds legacy PCI config space 0x%x\n", >> + pci_find_domain(pci_dev->bus), pci_bus_num(pci_dev->bus), >> + PCI_SLOT(pci_dev->devfn), PCI_FUNC(pci_dev->devfn), >> + PCI_CAP_ID_EXP, pos, size, PCI_CONFIG_SPACE_SIZE); >> + return -EINVAL; >> + } >> + > > This is crazy, why would we only test this for PCI_CAP_ID_EXP? If the > test is going to go in device-assignment, we need to wrap > pci_add_capability and do it for all callers. However, maybe we can get > MST to take it in pci_add_capability() if we make the test more > complete... something like: > > if ((pos< 256&& size> 256 - pos) || > (pci_config_size()> 256&& pos> 256&& > size> pci_config_size() - pos)) { > ... badness > > Thanks, > > Alex > +1 >> if ((ret = pci_add_capability(pci_dev, PCI_CAP_ID_EXP, >> pos, size))< 0) { >> return ret; >> > > >