pci_map_rom/pci_get_rom_size() performs memory access in the ROM. In case the Memory Space accesses were disabled, readw() is likely to crash the host with a synchronous external abort (aarch64).
In case memory accesses were disabled, re-enable them before the call and disable them back again just after. Signed-off-by: Eric Auger <[email protected]> --- v1 -> v2: - also re-enable in case of error --- drivers/vfio/pci/vfio_pci.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index ff60bd1ea587..721aa55424a4 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -706,8 +706,10 @@ static long vfio_pci_ioctl(void *device_data, break; case VFIO_PCI_ROM_REGION_INDEX: { + bool mem_access_disabled; void __iomem *io; size_t size; + u16 cmd; info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); info.flags = 0; @@ -723,15 +725,28 @@ static long vfio_pci_ioctl(void *device_data, break; } + pci_read_config_word(pdev, PCI_COMMAND, &cmd); + mem_access_disabled = !(cmd & PCI_COMMAND_MEMORY); + if (mem_access_disabled) { + cmd |= PCI_COMMAND_MEMORY; + pci_write_config_word(pdev, PCI_COMMAND, cmd); + } + /* Is it really there? */ io = pci_map_rom(pdev, &size); if (!io || !size) { info.size = 0; - break; + goto rom_info_out; } pci_unmap_rom(pdev, io); info.flags = VFIO_REGION_INFO_FLAG_READ; +rom_info_out: + if (mem_access_disabled) { + cmd &= ~PCI_COMMAND_MEMORY; + pci_write_config_word(pdev, PCI_COMMAND, cmd); + } + break; } case VFIO_PCI_VGA_REGION_INDEX: -- 2.20.1
