ia64/xen-unstable

changeset 18781:40668908260c

vtd: fix interrupt remapping to handle SMI RTE's with uninitialized
reserved fields

Some BIOS does not zero out reserve fields in IOAPIC RTE's.
clear_IO_APIC() zeroes out all RTE's except for RTE with MSI delivery
type. This is a problem when the host OS converts SMI delivery type
to some other type but leaving the reserved field uninitialized. This
can cause interrupt remapping table out of bound error if "format"
field is 1 and the uninitialized "index" field has a value that that
is larger than the maximum index of interrupt remapping table.

Signed-off-by: Allen Kay <allen.m.kay@intel.com>=
author Keir Fraser <keir.fraser@citrix.com>
date Mon Nov 10 10:41:41 2008 +0000 (2008-11-10)
parents 832efb028a1d
children beade55d67fc
files xen/drivers/passthrough/vtd/dmar.c xen/drivers/passthrough/vtd/intremap.c
line diff
     1.1 --- a/xen/drivers/passthrough/vtd/dmar.c	Fri Nov 07 17:06:21 2008 +0000
     1.2 +++ b/xen/drivers/passthrough/vtd/dmar.c	Mon Nov 10 10:41:41 2008 +0000
     1.3 @@ -351,7 +351,9 @@ acpi_parse_one_rmrr(struct acpi_dmar_ent
     1.4  
     1.5      if ( rmrr->base_address >= rmrr->end_address )
     1.6      {
     1.7 -        dprintk(XENLOG_ERR VTDPREFIX, "RMRR is incorrect.\n");
     1.8 +        dprintk(XENLOG_ERR VTDPREFIX,
     1.9 +                "RMRR error: base_addr %"PRIx64" end_address %"PRIx64"\n",
    1.10 +                rmrr->base_address, rmrr->end_address);
    1.11          return -EFAULT;
    1.12      }
    1.13  
     2.1 --- a/xen/drivers/passthrough/vtd/intremap.c	Fri Nov 07 17:06:21 2008 +0000
     2.2 +++ b/xen/drivers/passthrough/vtd/intremap.c	Mon Nov 10 10:41:41 2008 +0000
     2.3 @@ -207,7 +207,7 @@ unsigned int io_apic_read_remap_rte(
     2.4  
     2.5      remap_rte = (struct IO_APIC_route_remap_entry *) &old_rte;
     2.6  
     2.7 -    if ( remap_rte->format == 0 )
     2.8 +    if ( (remap_rte->format == 0) || (old_rte.delivery_mode == dest_SMI) )
     2.9      {
    2.10          *IO_APIC_BASE(apic) = rte_upper ? (reg + 1) : reg;
    2.11          return *(IO_APIC_BASE(apic)+4);
    2.12 @@ -253,6 +253,31 @@ void io_apic_write_remap_rte(
    2.13  
    2.14      remap_rte = (struct IO_APIC_route_remap_entry *) &old_rte;
    2.15  
    2.16 +    if ( old_rte.delivery_mode == dest_SMI )
    2.17 +    {
    2.18 +        /* Some BIOS does not zero out reserve fields in IOAPIC
    2.19 +         * RTE's.  clear_IO_APIC() zeroes out all RTE's except for RTE
    2.20 +         * with MSI delivery type.  This is a problem when the host
    2.21 +         * OS converts SMI delivery type to some other type but leaving
    2.22 +         * the reserved field uninitialized.  This can cause interrupt
    2.23 +         * remapping table out of bound error if "format" field is 1
    2.24 +         * and the "index" field has a value that that is larger than 
    2.25 +         * the maximum index of interrupt remapping table.
    2.26 +         */
    2.27 +        if ( remap_rte->format == 1 )
    2.28 +        {
    2.29 +            remap_rte->format = 0;
    2.30 +            *IO_APIC_BASE(apic) = reg;
    2.31 +            *(IO_APIC_BASE(apic)+4) = *(((u32 *)&old_rte)+0);
    2.32 +            *IO_APIC_BASE(apic) = reg + 1;
    2.33 +            *(IO_APIC_BASE(apic)+4) = *(((u32 *)&old_rte)+1);
    2.34 +        }
    2.35 +
    2.36 +        *IO_APIC_BASE(apic) = rte_upper ? (reg + 1) : reg;
    2.37 +        *(IO_APIC_BASE(apic)+4) = value;
    2.38 +        return;
    2.39 +    }
    2.40 +
    2.41      /* mask the interrupt while we change the intremap table */
    2.42      saved_mask = remap_rte->mask;
    2.43      remap_rte->mask = 1;