[Xen-changelog] [xen stable-4.3] AMD/IOMMU: fix infinite loop due to ivrs_bdf_entries larger than 16-bit value

[patchbot@xxxxxxx]

commit 409a2073540b0dfc47a4d0f6de41db160c28e488
Author:     Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
AuthorDate: Fri Jan 10 11:12:25 2014 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Jan 10 11:12:25 2014 +0100

    AMD/IOMMU: fix infinite loop due to ivrs_bdf_entries larger than 16-bit 
value
    
    Certain AMD systems could have upto 0x10000 ivrs_bdf_entries.
    However, the loop variable (bdf) is declared as u16 which causes
    inifinite loop when parsing IOMMU event log with IO_PAGE_FAULT event.
    This patch changes the variable to u32 instead.
    
    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 81b1c7de2339d2788352b162057e70130803f3cf
    master date: 2014-01-07 15:09:42 +0100
---
 xen/drivers/passthrough/amd/iommu_acpi.c |   13 +++++++------
 xen/drivers/passthrough/amd/iommu_init.c |   12 +++++++-----
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/xen/drivers/passthrough/amd/iommu_acpi.c 
b/xen/drivers/passthrough/amd/iommu_acpi.c
index 330e74f..a88d223 100644
--- a/xen/drivers/passthrough/amd/iommu_acpi.c
+++ b/xen/drivers/passthrough/amd/iommu_acpi.c
@@ -156,7 +156,7 @@ static int __init register_exclusion_range_for_all_devices(
     int seg = 0; /* XXX */
     unsigned long range_top, iommu_top, length;
     struct amd_iommu *iommu;
-    u16 bdf;
+    unsigned int bdf;
 
     /* is part of exclusion range inside of IOMMU virtual address space? */
     /* note: 'limit' parameter is assumed to be page-aligned */
@@ -234,7 +234,8 @@ static int __init 
register_exclusion_range_for_iommu_devices(
     unsigned long base, unsigned long limit, u8 iw, u8 ir)
 {
     unsigned long range_top, iommu_top, length;
-    u16 bdf, req;
+    unsigned int bdf;
+    u16 req;
 
     /* is part of exclusion range inside of IOMMU virtual address space? */
     /* note: 'limit' parameter is assumed to be page-aligned */
@@ -289,7 +290,7 @@ static int __init parse_ivmd_device_range(
     const struct acpi_ivrs_memory *ivmd_block,
     unsigned long base, unsigned long limit, u8 iw, u8 ir)
 {
-    u16 first_bdf, last_bdf, bdf;
+    unsigned int first_bdf, last_bdf, bdf;
     int error;
 
     first_bdf = ivmd_block->header.device_id;
@@ -427,7 +428,7 @@ static u16 __init parse_ivhd_device_range(
     const struct acpi_ivhd_device_range *range,
     u16 header_length, u16 block_length, struct amd_iommu *iommu)
 {
-    u16 dev_length, first_bdf, last_bdf, bdf;
+    unsigned int dev_length, first_bdf, last_bdf, bdf;
 
     dev_length = sizeof(*range);
     if ( header_length < (block_length + dev_length) )
@@ -508,7 +509,7 @@ static u16 __init parse_ivhd_device_alias_range(
     u16 header_length, u16 block_length, struct amd_iommu *iommu)
 {
 
-    u16 dev_length, first_bdf, last_bdf, alias_id, bdf;
+    unsigned int dev_length, first_bdf, last_bdf, alias_id, bdf;
 
     dev_length = sizeof(*range);
     if ( header_length < (block_length + dev_length) )
@@ -587,7 +588,7 @@ static u16 __init parse_ivhd_device_extended_range(
     const struct acpi_ivhd_device_extended_range *range,
     u16 header_length, u16 block_length, struct amd_iommu *iommu)
 {
-    u16 dev_length, first_bdf, last_bdf, bdf;
+    unsigned int dev_length, first_bdf, last_bdf, bdf;
 
     dev_length = sizeof(*range);
     if ( header_length < (block_length + dev_length) )
diff --git a/xen/drivers/passthrough/amd/iommu_init.c 
b/xen/drivers/passthrough/amd/iommu_init.c
index ba86e1b..2af0923 100644
--- a/xen/drivers/passthrough/amd/iommu_init.c
+++ b/xen/drivers/passthrough/amd/iommu_init.c
@@ -533,7 +533,8 @@ static hw_irq_controller iommu_maskable_msi_type = {
 
 static void parse_event_log_entry(struct amd_iommu *iommu, u32 entry[])
 {
-    u16 domain_id, device_id, bdf, flags;
+    u16 domain_id, device_id, flags;
+    unsigned int bdf;
     u32 code;
     u64 *addr;
     int count = 0;
@@ -1112,7 +1113,7 @@ int iterate_ivrs_entries(int (*handler)(u16 seg, struct 
ivrs_mappings *))
 
     do {
         struct ivrs_mappings *map;
-        int bdf;
+        unsigned int bdf;
 
         if ( !radix_tree_gang_lookup(&ivrs_maps, (void **)&map, seg, 1) )
             break;
@@ -1127,7 +1128,7 @@ int iterate_ivrs_entries(int (*handler)(u16 seg, struct 
ivrs_mappings *))
 static int __init alloc_ivrs_mappings(u16 seg)
 {
     struct ivrs_mappings *ivrs_mappings;
-    int bdf;
+    unsigned int bdf;
 
     BUG_ON( !ivrs_bdf_entries );
 
@@ -1165,7 +1166,7 @@ static int __init alloc_ivrs_mappings(u16 seg)
 static int __init amd_iommu_setup_device_table(
     u16 seg, struct ivrs_mappings *ivrs_mappings)
 {
-    int bdf;
+    unsigned int bdf;
     void *intr_tb, *dte;
 
     BUG_ON( (ivrs_bdf_entries == 0) );
@@ -1315,7 +1316,8 @@ static void invalidate_all_domain_pages(void)
 static int _invalidate_all_devices(
     u16 seg, struct ivrs_mappings *ivrs_mappings)
 {
-    int bdf, req_id;
+    unsigned int bdf; 
+    u16 req_id;
     unsigned long flags;
     struct amd_iommu *iommu;
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog