search for: get_free_pirq

Issues noticed during recent fixing of security problems. 1: x86: drop "index" parameter from get_free_pirq() 2: x86: fix RCU locking in PHYSDEVOP_get_free_pirq Signed-off-by: Jan Beulich <jbeulich@suse.com>

Currently the vector is not freed for MSI interrupt, the three patches fix the issue. The first patch(pirq.patch) move the get_free_pirq/map(unmap)_domain_pirq from arch/x86/physdev.c to arch/x86/irq.c, since that should be part of irq managment, no logic changes. The second patch(msi_vector_clean.patch) free the vector when the pirq is unmapped or when domain destroy. One thing need notice for this patch is, current code will not...

...<Christoph.Egger@amd.com> Acked-by: Tim Deegan <tim@xen.org> Committed-by: Tim Deegan <tim@xen.org> changeset: 23808:4a4882df5649 user: Stefano Stabellini <stefano.stabellini@eu.citrix.com> date: Wed Aug 31 15:23:49 2011 +0100 xen: get_free_pirq: make sure that the returned pirq is allocated Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> changeset: 23807:2297b90a6a7b user: Stefano Stabellini <stefano.stabellini@eu.citrix.com> date: Wed Aug 31 15:23:34 2011 +0100...

.../arch/x86/physdev.c Wed Sep 24 10:23:51 2008 +0100 +++ b/xen/arch/x86/physdev.c Wed Sep 24 12:36:55 2008 +0100 @@ -26,17 +26,11 @@ ioapic_guest_write( ioapic_guest_write( unsigned long physbase, unsigned int reg, u32 pval); - -extern struct hw_interrupt_type pci_msi_type; - static int get_free_pirq(struct domain *d, int type, int index) { int i; - if ( d == NULL ) - return -EINVAL; - - ASSERT(spin_is_locked(&d->arch.irq_lock)); + ASSERT(spin_is_locked(&d->evtchn_lock)); if ( type == MAP_PIRQ_TYPE_GSI ) { @@ -64,11 +58,10 @@ static int map_domain...

There is a BUG_ON() at xen/arch/x86/physdev.c:169 which appears to be dependent upon guest behavior (should close event channel before un-mapping pirq), rather than on internal hypervisor state. In 2.6.18, this likely goes unnoticed because pci_device_shutdown() only calls all the driver shutdown routines. In newer kernels, however, it also calls pci_msi_shutdown() and pci_msix_shutdown(), which