From cce9aba653e4be7dce83e0887e9a547a7440d0a5 Mon Sep 17 00:00:00 2001 From: Keir Fraser Date: Thu, 12 May 2011 16:42:00 +0100 Subject: [PATCH] vt-d: [CVE-2011-1898] Ensure that "iommu=required" enables interrupt remapping. Ensure that when Xen boots with "iommu=required" it will also insist that interrupt remapping is supported and enabled. It arranges that booting with that option on vulnerable hardware will fail, rather than appearing to succeed but actually being vulnerable to guests. From: Allen Kay Signed-off-by: Keir Fraser --- xen/drivers/passthrough/vtd/iommu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index aa3b34aa0a..cbeec5ce0b 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1971,6 +1971,8 @@ static int init_vtd_hw(void) "ioapic_to_iommu: ioapic 0x%x (id: 0x%x) is NULL! " "Will not try to enable Interrupt Remapping.\n", apic, IO_APIC_ID(apic)); + if ( force_iommu ) + panic("intremap remapping failed to enable with iommu=required/force in grub\n"); break; } } @@ -1984,6 +1986,9 @@ static int init_vtd_hw(void) { dprintk(XENLOG_WARNING VTDPREFIX, "Interrupt Remapping not enabled\n"); + + if ( force_iommu && platform_supports_intremap() ) + panic("intremap remapping failed to enable with iommu=required/force in grub\n"); break; } } -- 2.30.2