CVE-2015-2756
http://xenbits.xen.org/xsa/advisory-126.html
unmediated PCI command register access in qemu:
HVM guests are currently permitted to modify the memory and I/O decode bits in the PCI command register of devices passed through to them. Unless the device is an SR-IOV virtual function, after disabling one or both of these bits subsequent accesses to the MMIO or I/O port ranges would - on PCI Express devices - lead to Unsupported Request responses. The treatment of such errors is platform specific.
Furthermore (at least) devices under control of the Linux pciback driver in the host are handed to guests with the aforementioned bits turned off. This means that such accesses can similarly lead to Unsupported Request responses until these flags are set as needed by the guest.
guest VM可以修改PCI command register，如果disable掉某些bits可能造成之后产生UR (unsupported request) responses，造成host crash
privilege uncheck (PCI register modify)
http://xenbits.xen.org/xsa/xsa126-qemut.patch
http://xenbits.xen.org/xsa/xsa126-qemuu.patch
limit guest control of PCI command register
Otherwise the guest can abuse that control to cause e.g. PCIe Unsupported Request responses (by disabling memory and/or I/O decoding and subsequently causing [CPU side] accesses to the respective address ranges), which (depending on system configuration) may be fatal to the host.
In the event that the platform surfaces aforementioned UR responses as Non-Maskable Interrupts, and either the OS is configured to treat NMIs as fatal or (e.g. via ACPI’s APEI) the platform tells the OS to treat these errors as fatal, the host would crash, leading to a Denial of Service.
DoS: Conditional host crash