[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 19/23] hw/pcie: better hotplug/hotunplug support
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 19/23] hw/pcie: better hotplug/hotunplug support |
Date: |
Mon, 23 Jun 2014 18:54:11 +0300 |
From: Marcel Apfelbaum <address@hidden>
The current code is broken: it does surprise removal which crashes guests.
Reimplemented the steps:
- Hotplug triggers both 'present detect change' and
'attention button pressed'.
- Hotunplug starts by triggering 'attention button pressed',
then waits for the OS to power off the device and only
then detaches it.
Fixes CVE-2014-3471.
Signed-off-by: Marcel Apfelbaum <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/pci/pcie.c | 29 ++++++++++++++++++++++++-----
1 file changed, 24 insertions(+), 5 deletions(-)
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index d6d9eb8..da32589 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -258,7 +258,8 @@ void pcie_cap_slot_hotplug_cb(HotplugHandler *hotplug_dev,
DeviceState *dev,
pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
PCI_EXP_SLTSTA_PDS);
- pcie_cap_slot_event(PCI_DEVICE(hotplug_dev), PCI_EXP_HP_EV_PDC);
+ pcie_cap_slot_event(PCI_DEVICE(hotplug_dev),
+ PCI_EXP_HP_EV_PDC | PCI_EXP_HP_EV_ABP);
}
void pcie_cap_slot_hot_unplug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
@@ -268,10 +269,7 @@ void pcie_cap_slot_hot_unplug_cb(HotplugHandler
*hotplug_dev, DeviceState *dev,
pcie_cap_slot_hotplug_common(PCI_DEVICE(hotplug_dev), dev, &exp_cap, errp);
- object_unparent(OBJECT(dev));
- pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
- PCI_EXP_SLTSTA_PDS);
- pcie_cap_slot_event(PCI_DEVICE(hotplug_dev), PCI_EXP_HP_EV_PDC);
+ pcie_cap_slot_push_attention_button(PCI_DEVICE(hotplug_dev));
}
/* pci express slot for pci express root/downstream port
@@ -383,6 +381,11 @@ void pcie_cap_slot_reset(PCIDevice *dev)
hotplug_event_update_event_status(dev);
}
+static void pcie_unplug_device(PCIBus *bus, PCIDevice *dev, void *opaque)
+{
+ object_unparent(OBJECT(dev));
+}
+
void pcie_cap_slot_write_config(PCIDevice *dev,
uint32_t addr, uint32_t val, int len)
{
@@ -407,6 +410,22 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
sltsta);
}
+ /*
+ * If the slot is polulated, power indicator is off and power
+ * controller is off, it is safe to detach the devices.
+ */
+ if ((sltsta & PCI_EXP_SLTSTA_PDS) && (val & PCI_EXP_SLTCTL_PCC) &&
+ ((val & PCI_EXP_SLTCTL_PIC_OFF) == PCI_EXP_SLTCTL_PIC_OFF)) {
+ PCIBus *sec_bus = pci_bridge_get_sec_bus(PCI_BRIDGE(dev));
+ pci_for_each_device(sec_bus, pci_bus_num(sec_bus),
+ pcie_unplug_device, NULL);
+
+ pci_word_test_and_clear_mask(exp_cap + PCI_EXP_SLTSTA,
+ PCI_EXP_SLTSTA_PDS);
+ pci_word_test_and_set_mask(exp_cap + PCI_EXP_SLTSTA,
+ PCI_EXP_SLTSTA_PDC);
+ }
+
hotplug_event_notify(dev);
/*
--
MST
- [Qemu-devel] [PULL 09/23] e1000: signal guest on successful link auto-negotiation, (continued)
- [Qemu-devel] [PULL 09/23] e1000: signal guest on successful link auto-negotiation, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 10/23] e1000: move e1000_autoneg_timer() to after set_ics(), Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 11/23] e1000: factor out checking for auto-negotiation availability, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 13/23] qemu-char: fix qemu_chr_fe_get_msgfd(), Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 12/23] qapi/string-output-visitor: fix human output, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 14/23] qemu-char: avoid leaking unused fds in tcp_get_msgfds(), Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 15/23] virtio-pci: Report an error when msix vectors init fails, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 16/23] q35: Use PC_Q35_COMPAT_1_4 on pc-q35-1.4 compat_props, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 17/23] hw/pcie: correct debug message, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 18/23] hw/pcie: implement power controller functionality, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 19/23] hw/pcie: better hotplug/hotunplug support,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 20/23] pcie: coding style tweak, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 22/23] pc & q35: Add new machine opt max-ram-below-4g, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 21/23] xen-hvm: Fix xen_hvm_init() to adjust pc memory layout, Michael S. Tsirkin, 2014/06/23
- [Qemu-devel] [PULL 23/23] xen-hvm: Handle machine opt max-ram-below-4g, Michael S. Tsirkin, 2014/06/23
- Re: [Qemu-devel] [PULL 00/23] pc,pci,vhost,net fixes, enhancements, Peter Maydell, 2014/06/24