|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] [PATCH v4 1/4] xen/arm: observe itargets setting in vgic_enable_irqs and vgic_disable_irqs
vgic_enable_irqs should enable irq delivery to the vcpu specified by
GICD_ITARGETSR, rather than the vcpu that wrote to GICD_ISENABLER.
Similarly vgic_disable_irqs should use the target vcpu specified by
itarget to disable irqs.
itargets can be set to a mask but vgic_get_target_vcpu always returns
the lower vcpu in the mask.
Correctly initialize itargets for SPIs.
Validate writes to GICD_ITARGETSR.
Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
---
Changes in v4:
- remove assert that could allow a guest to crash Xen;
- add itargets validation to vgic_distr_mmio_write;
- export vgic_get_target_vcpu.
Changes in v3:
- add assert in get_target_vcpu;
- rename get_target_vcpu to vgic_get_target_vcpu.
Changes in v2:
- refactor the common code in get_target_vcpu;
- unify PPI and SPI paths;
- correctly initialize itargets for SPI;
- use byte_read.
---
xen/arch/arm/vgic.c | 60 +++++++++++++++++++++++++++++++++++++++------
xen/include/asm-arm/gic.h | 2 ++
2 files changed, 54 insertions(+), 8 deletions(-)
diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c
index cb8df3a..e527892 100644
--- a/xen/arch/arm/vgic.c
+++ b/xen/arch/arm/vgic.c
@@ -106,7 +106,15 @@ int domain_vgic_init(struct domain *d)
INIT_LIST_HEAD(&d->arch.vgic.pending_irqs[i].lr_queue);
}
for (i=0; i<DOMAIN_NR_RANKS(d); i++)
+ {
+ int j;
+
spin_lock_init(&d->arch.vgic.shared_irqs[i].lock);
+ /* Only delivery to CPU0 */
+ for ( j = 0 ; j < 8 ; j++ )
+ d->arch.vgic.shared_irqs[i].itargets[j] =
+ (1<<0) | (1<<8) | (1<<16) | (1<<24);
+ }
return 0;
}
@@ -369,6 +377,22 @@ read_as_zero:
return 1;
}
+struct vcpu *vgic_get_target_vcpu(struct vcpu *v, unsigned int irq)
+{
+ int target;
+ struct vgic_irq_rank *rank;
+ struct vcpu *v_target;
+
+ rank = vgic_irq_rank(v, 1, irq/32);
+ vgic_lock_rank(v, rank);
+ target = byte_read(rank->itargets[(irq%32)/4], 0, irq % 4);
+ /* just return the first vcpu in the mask */
+ target = find_next_bit((const unsigned long *) &target, 8, 0);
+ v_target = v->domain->vcpu[target];
+ vgic_unlock_rank(v, rank);
+ return v_target;
+}
+
static void vgic_disable_irqs(struct vcpu *v, uint32_t r, int n)
{
const unsigned long mask = r;
@@ -376,12 +400,14 @@ static void vgic_disable_irqs(struct vcpu *v, uint32_t r,
int n)
unsigned int irq;
unsigned long flags;
int i = 0;
+ struct vcpu *v_target;
while ( (i = find_next_bit(&mask, 32, i)) < 32 ) {
irq = i + (32 * n);
- p = irq_to_pending(v, irq);
+ v_target = vgic_get_target_vcpu(v, irq);
+ p = irq_to_pending(v_target, irq);
clear_bit(GIC_IRQ_GUEST_ENABLED, &p->status);
- gic_remove_from_queues(v, irq);
+ gic_remove_from_queues(v_target, irq);
if ( p->desc != NULL )
{
spin_lock_irqsave(&p->desc->lock, flags);
@@ -399,24 +425,26 @@ static void vgic_enable_irqs(struct vcpu *v, uint32_t r,
int n)
unsigned int irq;
unsigned long flags;
int i = 0;
+ struct vcpu *v_target;
while ( (i = find_next_bit(&mask, 32, i)) < 32 ) {
irq = i + (32 * n);
- p = irq_to_pending(v, irq);
+ v_target = vgic_get_target_vcpu(v, irq);
+ p = irq_to_pending(v_target, irq);
set_bit(GIC_IRQ_GUEST_ENABLED, &p->status);
/* We need to force the first injection of evtchn_irq because
* evtchn_upcall_pending is already set by common code on vcpu
* creation. */
- if ( irq == v->domain->arch.evtchn_irq &&
+ if ( irq == v_target->domain->arch.evtchn_irq &&
vcpu_info(current, evtchn_upcall_pending) &&
list_empty(&p->inflight) )
- vgic_vcpu_inject_irq(v, irq);
+ vgic_vcpu_inject_irq(v_target, irq);
else {
unsigned long flags;
- spin_lock_irqsave(&v->arch.vgic.lock, flags);
+ spin_lock_irqsave(&v_target->arch.vgic.lock, flags);
if ( !list_empty(&p->inflight) && !test_bit(GIC_IRQ_GUEST_VISIBLE,
&p->status) )
- gic_raise_guest_irq(v, irq, p->priority);
- spin_unlock_irqrestore(&v->arch.vgic.lock, flags);
+ gic_raise_guest_irq(v_target, irq, p->priority);
+ spin_unlock_irqrestore(&v_target->arch.vgic.lock, flags);
}
if ( p->desc != NULL )
{
@@ -502,6 +530,7 @@ static int vgic_distr_mmio_write(struct vcpu *v,
mmio_info_t *info)
int offset = (int)(info->gpa - v->domain->arch.vgic.dbase);
int gicd_reg = REG(offset);
uint32_t tr;
+ int i;
switch ( gicd_reg )
{
@@ -585,6 +614,21 @@ static int vgic_distr_mmio_write(struct vcpu *v,
mmio_info_t *info)
rank = vgic_irq_rank(v, 8, gicd_reg - GICD_ITARGETSR);
if ( rank == NULL) goto write_ignore;
vgic_lock_rank(v, rank);
+ tr = *r & ~(rank->itargets[REG_RANK_INDEX(8, gicd_reg -
GICD_ITARGETSR)]);
+ i = 0;
+ /* validate writes */
+ while ( (i = find_next_bit((const unsigned long *) &tr, 32, i)) < 32 )
+ {
+ unsigned int target = i % 8;
+ if ( target > v->domain->max_vcpus )
+ {
+ gdprintk(XENLOG_WARNING, "vGICD: GICD_ITARGETSR write invalid
target vcpu %u\n",
+ target);
+ vgic_unlock_rank(v, rank);
+ return 1;
+ }
+ i++;
+ }
if ( dabt.size == 2 )
rank->itargets[REG_RANK_INDEX(8, gicd_reg - GICD_ITARGETSR)] = *r;
else
diff --git a/xen/include/asm-arm/gic.h b/xen/include/asm-arm/gic.h
index bf6fb1e..bd40628 100644
--- a/xen/include/asm-arm/gic.h
+++ b/xen/include/asm-arm/gic.h
@@ -227,6 +227,8 @@ int gic_irq_xlate(const u32 *intspec, unsigned int intsize,
unsigned int *out_hwirq, unsigned int *out_type);
void gic_clear_lrs(struct vcpu *v);
+struct vcpu *vgic_get_target_vcpu(struct vcpu *v, unsigned int irq);
+
#endif /* __ASSEMBLY__ */
#endif
--
1.7.10.4
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |