lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Intel-IOMMU, intr-remap: source-id checking

Browse Source 
To support domain-isolation usages, the platform hardware must be
capable of uniquely identifying the requestor (source-id) for each
interrupt message. Without source-id checking for interrupt remapping
, a rouge guest/VM with assigned devices can launch interrupt attacks
to bring down anothe guest/VM or the VMM itself.

This patch adds source-id checking for interrupt remapping, and then
really isolates interrupts for guests/VMs with assigned devices.

Because PCI subsystem is not initialized yet when set up IOAPIC
entries, use read_pci_config_byte to access PCI config space directly.

Signed-off-by: Weidong Han <weidong.han@intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
This commit is contained in:
Weidong Han
2009-05-23 00:41:15 +08:00
committed by David Woodhouse
parent c4658b4e77
commit f007e99c8e
4 changed files with 136 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
arch/x86/kernel/apic/io_apic.c
View File

@ -1414,6 +1414,9 @@ int setup_ioapic_entry(int apic_id, int irq,
irte.vector = vector;
irte.dest_id = IRTE_DEST(destination);
/* Set source-id of interrupt request */
set_ioapic_sid(&irte, apic_id);
modify_irte(irq, &irte);
ir_entry->index2 = (index >> 15) & 0x1;
@ -3290,6 +3293,9 @@ static int msi_compose_msg(struct pci_dev *pdev, unsigned int irq, struct msi_ms
irte.vector = cfg->vector;
irte.dest_id = IRTE_DEST(dest);
/* Set source-id of interrupt request */
set_msi_sid(&irte, pdev);
modify_irte(irq, &irte);
msg->address_hi = MSI_ADDR_BASE_HI;