Module Name: src
Committed By: macallan
Date: Fri Apr 13 22:13:09 UTC 2018
Modified Files:
src/sys/arch/macppc/pci: u3.c
Log Message:
track bus-range for every bus and restrict config space accesses to that
range. Now pcictl pci* list no longer crashes the kernel.
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 src/sys/arch/macppc/pci/u3.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/macppc/pci/u3.c
diff -u src/sys/arch/macppc/pci/u3.c:1.8 src/sys/arch/macppc/pci/u3.c:1.9
--- src/sys/arch/macppc/pci/u3.c:1.8 Fri Oct 2 05:22:51 2015
+++ src/sys/arch/macppc/pci/u3.c Fri Apr 13 22:13:09 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: u3.c,v 1.8 2015/10/02 05:22:51 msaitoh Exp $ */
+/* $NetBSD: u3.c,v 1.9 2018/04/13 22:13:09 macallan Exp $ */
/*
* Copyright 2006 Kyma Systems LLC.
@@ -54,8 +54,12 @@ struct ibmcpc_softc
struct genppc_pci_chipset sc_pc[8];
struct powerpc_bus_space sc_iot;
struct powerpc_bus_space sc_memt;
+ int sc_ranges[8];
};
+/* kinda ugly but there can be only one */
+static struct ibmcpc_softc *cpc0 = NULL;
+
static void ibmcpc_attach(device_t, device_t, void *);
static int ibmcpc_match(device_t, cfdata_t, void *);
@@ -108,6 +112,8 @@ ibmcpc_attach(device_t parent, device_t
reg[1], reg[2]);
pc_data = mapiodev(reg[1], reg[2], false);
+ cpc0 = sc;
+
for (child = OF_child(OF_finddevice("/ht")), i = 1; child;
child = OF_peer(child), i++) {
@@ -141,6 +147,7 @@ ibmcpc_attach(device_t parent, device_t
macppc_pci_get_chipset_tag(pc);
pc->pc_node = child;
pc->pc_bus = busrange[0];
+ sc->sc_ranges[pc->pc_bus] = busrange[1];
pc->pc_addr = 0x0;
pc->pc_data = pc_data;
pc->pc_conf_read = ibmcpc_conf_read;
@@ -167,6 +174,7 @@ static pcireg_t
ibmcpc_conf_read(void *cookie, pcitag_t tag, int reg)
{
pci_chipset_tag_t pc = cookie;
+ struct ibmcpc_softc *sc = cpc0;
u_int32_t daddr = (u_int32_t) pc->pc_data;
pcireg_t data;
u_int32_t bus, dev, func, x, devfn;
@@ -176,6 +184,11 @@ ibmcpc_conf_read(void *cookie, pcitag_t
pci_decompose_tag(pc, tag, &bus, &dev, &func);
+ if ((bus < pc->pc_bus) || (bus > sc->sc_ranges[pc->pc_bus])) {
+ data = 0xffffffff;
+ goto done;
+ }
+
devfn = PCI_DEVFN(dev, func);
if (bus == 0) {
@@ -200,6 +213,7 @@ static void
ibmcpc_conf_write(void *cookie, pcitag_t tag, int reg, pcireg_t data)
{
pci_chipset_tag_t pc = cookie;
+ struct ibmcpc_softc *sc = cpc0;
int32_t *daddr = pc->pc_data;
u_int32_t bus, dev, func;
u_int32_t x, devfn;
@@ -209,6 +223,9 @@ ibmcpc_conf_write(void *cookie, pcitag_t
pci_decompose_tag(pc, tag, &bus, &dev, &func);
+ if ((bus < pc->pc_bus) || (bus > sc->sc_ranges[pc->pc_bus]))
+ return;
+
devfn = PCI_DEVFN(dev, func);
if (bus == 0) {
