[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 06/56] usb:xhci: no DMA on HC reset
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 06/56] usb:xhci: no DMA on HC reset |
Date: |
Mon, 8 Aug 2016 16:03:37 -0500 |
From: Roman Kagan <address@hidden>
This patch is a rough fix to a memory corruption we are observing when
running VMs with xhci USB controller and OVMF firmware.
Specifically, on the following call chain
xhci_reset
xhci_disable_slot
xhci_disable_ep
xhci_set_ep_state
QEMU overwrites guest memory using stale guest addresses.
This doesn't happen when the guest (firmware) driver sets up xhci for
the first time as there are no slots configured yet. However when the
firmware hands over the control to the OS some slots and endpoints are
already set up with their context in the guest RAM. Now the OS' driver
resets the controller again and xhci_set_ep_state then reads and writes
that memory which is now owned by the OS.
As a quick fix, skip calling xhci_set_ep_state in xhci_disable_ep if the
device context base address array pointer is zero (indicating we're in
the HC reset and no DMA is possible).
Cc: address@hidden
Signed-off-by: Roman Kagan <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 491d68d9382dbb588f2ff5132ee3d87ce2f1b230)
Signed-off-by: Michael Roth <address@hidden>
---
hw/usb/hcd-xhci.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index bcde8a2..43ba615 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -1531,7 +1531,10 @@ static TRBCCode xhci_disable_ep(XHCIState *xhci,
unsigned int slotid,
usb_packet_cleanup(&epctx->transfers[i].packet);
}
- xhci_set_ep_state(xhci, epctx, NULL, EP_DISABLED);
+ /* only touch guest RAM if we're not resetting the HC */
+ if (xhci->dcbaap_low || xhci->dcbaap_high) {
+ xhci_set_ep_state(xhci, epctx, NULL, EP_DISABLED);
+ }
timer_free(epctx->kick_timer);
g_free(epctx);
--
1.9.1
- [Qemu-devel] [PATCH 50/56] nbd: More debug typo fixes, use correct formats, (continued)
- [Qemu-devel] [PATCH 50/56] nbd: More debug typo fixes, use correct formats, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 47/56] util: Fix MIN_NON_ZERO, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 48/56] block/iscsi: fix rounding in iscsi_allocationmap_set, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 04/56] tools: kvm_stat: Powerpc related fixes, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 49/56] Fix some typos found by codespell, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 53/56] pcie: fix link active status bit migration, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 52/56] nbd: Limit nbdflags to 16 bits, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 51/56] nbd: Don't use *_to_cpup() functions, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 54/56] target-i386: fix typo in xsetbv implementation, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 55/56] virtio: error out if guest exceeds virtqueue size, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 06/56] usb:xhci: no DMA on HC reset,
Michael Roth <=
- [Qemu-devel] [PATCH 56/56] ide: fix halted IO segfault at reset, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 07/56] target-mips: fix call to memset in soft reset code, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 08/56] target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 05/56] exec.c: Ensure right alignment also for file backed ram, Michael Roth, 2016/08/08
- Re: [Qemu-devel] [Qemu-stable] [PATCH 00/56] Patch Round-up for stable 2.6.1, freeze on 2016-08-12, Cole Robinson, 2016/08/08
- Re: [Qemu-devel] [Qemu-stable] [PATCH 00/56] Patch Round-up for stable 2.6.1, freeze on 2016-08-12, Michael Roth, 2016/08/09
- Re: [Qemu-devel] [PATCH 00/56] Patch Round-up for stable 2.6.1, freeze on 2016-08-12, Bruce Rogers, 2016/08/09