From e57bb9c8458578eb75efc630c53c6dfa31c97783 Mon Sep 17 00:00:00 2001 From: "kaf24@firebug.cl.cam.ac.uk" Date: Wed, 31 Aug 2005 12:56:42 +0000 Subject: [PATCH] Disallow domain 0 access to certain I/O port ranges (Master/Slave PICs, PIT, Speaker Control). Modifying these can seriously harm Xen's health. Signed-off-by: Keir Fraser --- xen/arch/x86/domain_build.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/xen/arch/x86/domain_build.c b/xen/arch/x86/domain_build.c index 8b64b0ee45..474ad1b18b 100644 --- a/xen/arch/x86/domain_build.c +++ b/xen/arch/x86/domain_build.c @@ -20,6 +20,7 @@ #include #include #include +#include #include static long dom0_nrpages; @@ -707,6 +708,18 @@ int construct_dom0(struct domain *d, printk("dom0: shadow setup done\n"); } + /* + * Modify I/O port access permissions. + */ + /* Master Interrupt Controller (PIC). */ + physdev_modify_ioport_access_range(dom0, 0, 0x20, 2); + /* Slave Interrupt Controller (PIC). */ + physdev_modify_ioport_access_range(dom0, 0, 0xA0, 2); + /* Interval Timer (PIT). */ + physdev_modify_ioport_access_range(dom0, 0, 0x40, 4); + /* PIT Channel 2 / PC Speaker Control. */ + physdev_modify_ioport_access_range(dom0, 0, 0x61, 1); + return 0; } -- 2.30.2