[Xen-devel] [PATCH 4/5] x86/PV: remove the emulated PIT

[Roger Pau Monne <roger.pau@xxxxxxxxxx>]

The HVMlite series removed the initialization of the emulated PIT for PV
guests, but the handler was still reachable, which means a PV guests can
crash Xen if it pokes at IO ports 0x42, 0x43 or 0x61. Completely remove the
PV PIT handler and move the PIT initialization to HVM guests only.

Signed-off-by: Roger Pau Monnà <roger.pau@xxxxxxxxxx>
---
Cc: Jan Beulich <jbeulich@xxxxxxxx>
Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/arch/x86/domain.c         |  3 ---
 xen/arch/x86/hvm/hvm.c        |  2 ++
 xen/arch/x86/hvm/i8254.c      | 27 ---------------------------
 xen/arch/x86/traps.c          | 12 ++----------
 xen/include/asm-x86/hvm/vpt.h |  1 -
 5 files changed, 4 insertions(+), 41 deletions(-)

diff --git a/xen/arch/x86/domain.c b/xen/arch/x86/domain.c
index 159d960..868ef49 100644
--- a/xen/arch/x86/domain.c
+++ b/xen/arch/x86/domain.c
@@ -647,9 +647,6 @@ int arch_domain_create(struct domain *d, unsigned int 
domcr_flags,
     tsc_set_info(d, TSC_MODE_DEFAULT, 0UL, 0, 0);
     spin_lock_init(&d->arch.vtsc_lock);
 
-    /* PV/PVH guests get an emulated PIT too for video BIOSes to use. */
-    pit_init(d, cpu_khz);
-
     return 0;
 
  fail:
diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 05c3ca1..28c6cd9 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -1622,6 +1622,8 @@ int hvm_domain_initialise(struct domain *d)
 
     msixtbl_init(d);
 
+    pit_init(d, cpu_khz);
+
     register_portio_handler(d, 0xe9, 1, hvm_print_line);
     register_portio_handler(d, 0xcf8, 4, hvm_access_cf8);
 
diff --git a/xen/arch/x86/hvm/i8254.c b/xen/arch/x86/hvm/i8254.c
index b517cd6..83eae33 100644
--- a/xen/arch/x86/hvm/i8254.c
+++ b/xen/arch/x86/hvm/i8254.c
@@ -558,33 +558,6 @@ static int handle_speaker_io(
     return X86EMUL_OKAY;
 }
 
-int pv_pit_handler(int port, int data, int write)
-{
-    ioreq_t ioreq = {
-        .size = 1,
-        .type = IOREQ_TYPE_PIO,
-        .addr = port,
-        .dir  = write ? IOREQ_WRITE : IOREQ_READ,
-        .data = data
-    };
-
-    if ( is_hardware_domain(current->domain) && hwdom_pit_access(&ioreq) )
-    {
-        /* nothing to do */;
-    }
-    else
-    {
-        uint32_t val = data;
-        if ( port == 0x61 )
-            handle_speaker_io(ioreq.dir, port, 1, &val);
-        else
-            handle_pit_io(ioreq.dir, port, 1, &val);
-        ioreq.data = val;
-    }
-
-    return !write ? ioreq.data : 0;
-}
-
 /*
  * Local variables:
  * mode: C
diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c
index e105b95..a9d7e83 100644
--- a/xen/arch/x86/traps.c
+++ b/xen/arch/x86/traps.c
@@ -1839,11 +1839,7 @@ uint32_t guest_io_read(unsigned int port, unsigned int 
bytes,
         unsigned int size = 1;
         uint32_t sub_data = ~0;
 
-        if ( (port == 0x42) || (port == 0x43) || (port == 0x61) )
-        {
-            sub_data = pv_pit_handler(port, 0, 0);
-        }
-        else if ( (port == RTC_PORT(0)) )
+        if ( (port == RTC_PORT(0)) )
         {
             sub_data = currd->arch.cmos_idx;
         }
@@ -1908,11 +1904,7 @@ void guest_io_write(unsigned int port, unsigned int 
bytes, uint32_t data,
     {
         unsigned int size = 1;
 
-        if ( (port == 0x42) || (port == 0x43) || (port == 0x61) )
-        {
-            pv_pit_handler(port, (uint8_t)data, 1);
-        }
-        else if ( (port == RTC_PORT(0)) )
+        if ( (port == RTC_PORT(0)) )
         {
             currd->arch.cmos_idx = data;
         }
diff --git a/xen/include/asm-x86/hvm/vpt.h b/xen/include/asm-x86/hvm/vpt.h
index 495d669..557bb4a 100644
--- a/xen/include/asm-x86/hvm/vpt.h
+++ b/xen/include/asm-x86/hvm/vpt.h
@@ -172,7 +172,6 @@ void create_periodic_time(
     uint64_t period, uint8_t irq, time_cb *cb, void *data);
 void destroy_periodic_time(struct periodic_time *pt);
 
-int pv_pit_handler(int port, int data, int write);
 void pit_reset(struct domain *d);
 
 void pit_init(struct domain *d, unsigned long cpu_khz);
-- 
1.9.5 (Apple Git-50.3)


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel