| Message ID | 20110726203722.39565.29092.stgit@dddsys0.bos.redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, 2011-07-26 at 18:08 -0400, Donald Dutile wrote: > The bcm5761 provides a PCIe Cap structure (capid=0x10) > that is invalid, providing one that is 8 bytes shorter > than the v2 PCIe spec defines. > This leads to a memory corruption when mapped for device-assigment. > > Add a check in assigned_device_pci_cap_init() to correct > this hw error for this device, and try to catch other ones > and print warnings if they exists. > > Signed-off-by: Donald Dutile <ddutile@redhat.com> > cc: Alex Williamson <alex.williamson@redhat.com> > cc: Michael S. Tsirking <mst@redhat.com> > --- Acked-by: Alex Williamson <alex.williamson@redhat.com> > hw/device-assignment.c | 29 ++++++++++++++++++++++++----- > 1 files changed, 24 insertions(+), 5 deletions(-) > > diff --git a/hw/device-assignment.c b/hw/device-assignment.c > index 36ad6b0..e073840 100644 > --- a/hw/device-assignment.c > +++ b/hw/device-assignment.c > @@ -1419,18 +1419,37 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev) > } > > if ((pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0))) { > - uint8_t version; > + uint8_t version, size; > uint16_t type, devctl, lnkcap, lnksta; > uint32_t devcap; > - int size = 0x3c; /* version 2 size */ > > version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS); > version &= PCI_EXP_FLAGS_VERS; > if (version == 1) { > size = 0x14; > - } else if (version > 2) { > - fprintf(stderr, "Unsupported PCI express capability version %d\n", > - version); > + } else if (version == 2) { > + /* > + * Check for non-std size, accept reduced size to 0x34, > + * which is what bcm5761 implemented, violating the > + * PCIe v3.0 spec that regs should exist and be read as 0, > + * not optionally provided and shorten the struct size. > + */ > + size = MIN(0x3c, PCI_CONFIG_SPACE_SIZE - pos); > + if (size < 0x34) { > + fprintf(stderr, > + "%s: Invalid size PCIe cap-id 0x%x \n", > + __func__, PCI_CAP_ID_EXP); > + return -EINVAL; > + } else if (size != 0x3c) { > + fprintf(stderr, > + "WARNING, %s: PCIe cap-id 0x%x has " > + "non-standard size 0x%x; std size should be 0x3c \n", > + __func__, PCI_CAP_ID_EXP, size); > + } > + } else { > + fprintf(stderr, > + "%s: Unsupported PCI express capability version %d\n", > + __func__, version); > return -EINVAL; > } > > -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, Jul 26, 2011 at 06:08:09PM -0400, Donald Dutile wrote: > The bcm5761 provides a PCIe Cap structure (capid=0x10) > that is invalid, providing one that is 8 bytes shorter > than the v2 PCIe spec defines. > This leads to a memory corruption when mapped for device-assigment. > > Add a check in assigned_device_pci_cap_init() to correct > this hw error for this device, and try to catch other ones > and print warnings if they exists. > > Signed-off-by: Donald Dutile <ddutile@redhat.com> > cc: Alex Williamson <alex.williamson@redhat.com> > cc: Michael S. Tsirking <mst@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> > --- > > hw/device-assignment.c | 29 ++++++++++++++++++++++++----- > 1 files changed, 24 insertions(+), 5 deletions(-) > > diff --git a/hw/device-assignment.c b/hw/device-assignment.c > index 36ad6b0..e073840 100644 > --- a/hw/device-assignment.c > +++ b/hw/device-assignment.c > @@ -1419,18 +1419,37 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev) > } > > if ((pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0))) { > - uint8_t version; > + uint8_t version, size; > uint16_t type, devctl, lnkcap, lnksta; > uint32_t devcap; > - int size = 0x3c; /* version 2 size */ > > version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS); > version &= PCI_EXP_FLAGS_VERS; > if (version == 1) { > size = 0x14; > - } else if (version > 2) { > - fprintf(stderr, "Unsupported PCI express capability version %d\n", > - version); > + } else if (version == 2) { > + /* > + * Check for non-std size, accept reduced size to 0x34, > + * which is what bcm5761 implemented, violating the > + * PCIe v3.0 spec that regs should exist and be read as 0, > + * not optionally provided and shorten the struct size. > + */ > + size = MIN(0x3c, PCI_CONFIG_SPACE_SIZE - pos); > + if (size < 0x34) { > + fprintf(stderr, > + "%s: Invalid size PCIe cap-id 0x%x \n", > + __func__, PCI_CAP_ID_EXP); > + return -EINVAL; > + } else if (size != 0x3c) { > + fprintf(stderr, > + "WARNING, %s: PCIe cap-id 0x%x has " > + "non-standard size 0x%x; std size should be 0x3c \n", > + __func__, PCI_CAP_ID_EXP, size); > + } > + } else { > + fprintf(stderr, > + "%s: Unsupported PCI express capability version %d\n", > + __func__, version); > return -EINVAL; > } > -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 07/27/2011 01:08 AM, Donald Dutile wrote: > The bcm5761 provides a PCIe Cap structure (capid=0x10) > that is invalid, providing one that is 8 bytes shorter > than the v2 PCIe spec defines. > This leads to a memory corruption when mapped for device-assigment. > > Add a check in assigned_device_pci_cap_init() to correct > this hw error for this device, and try to catch other ones > and print warnings if they exists. Applied, thanks.
On Tue, Jul 26, 2011 at 06:08:09PM -0400, Donald Dutile wrote: > The bcm5761 provides a PCIe Cap structure (capid=0x10) > that is invalid, providing one that is 8 bytes shorter > than the v2 PCIe spec defines. > This leads to a memory corruption when mapped for device-assigment. > > Add a check in assigned_device_pci_cap_init() to correct > this hw error for this device, and try to catch other ones > and print warnings if they exists. > > Signed-off-by: Donald Dutile <ddutile@redhat.com> > cc: Alex Williamson <alex.williamson@redhat.com> > cc: Michael S. Tsirking <mst@redhat.com> Patch does not apply cleanly, complaints about trailing whitespaces. Please regenerate against current git tree, thanks. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 08/01/2011 06:50 PM, Marcelo Tosatti wrote: > On Tue, Jul 26, 2011 at 06:08:09PM -0400, Donald Dutile wrote: > > The bcm5761 provides a PCIe Cap structure (capid=0x10) > > that is invalid, providing one that is 8 bytes shorter > > than the v2 PCIe spec defines. > > This leads to a memory corruption when mapped for device-assigment. > > > > Add a check in assigned_device_pci_cap_init() to correct > > this hw error for this device, and try to catch other ones > > and print warnings if they exists. > > > > Signed-off-by: Donald Dutile<ddutile@redhat.com> > > cc: Alex Williamson<alex.williamson@redhat.com> > > cc: Michael S. Tsirking<mst@redhat.com> > > Patch does not apply cleanly, complaints about trailing whitespaces. > > Please regenerate against current git tree, thanks. > I thought I applied it already, I even remember the trailing whitespace complaints (which git fixed for me). I hope we didn't lose other patches this way.
On Mon, Aug 01, 2011 at 06:53:49PM +0300, Avi Kivity wrote: > On 08/01/2011 06:50 PM, Marcelo Tosatti wrote: > >On Tue, Jul 26, 2011 at 06:08:09PM -0400, Donald Dutile wrote: > >> The bcm5761 provides a PCIe Cap structure (capid=0x10) > >> that is invalid, providing one that is 8 bytes shorter > >> than the v2 PCIe spec defines. > >> This leads to a memory corruption when mapped for device-assigment. > >> > >> Add a check in assigned_device_pci_cap_init() to correct > >> this hw error for this device, and try to catch other ones > >> and print warnings if they exists. > >> > >> Signed-off-by: Donald Dutile<ddutile@redhat.com> > >> cc: Alex Williamson<alex.williamson@redhat.com> > >> cc: Michael S. Tsirking<mst@redhat.com> > > > >Patch does not apply cleanly, complaints about trailing whitespaces. > > > >Please regenerate against current git tree, thanks. > > > > I thought I applied it already, I even remember the trailing > whitespace complaints (which git fixed for me). > > I hope we didn't lose other patches this way. OK. Its not lost: commit f9c29774d2174df6ffc20becec20928948198914 Author: Donald Dutile <ddutile@redhat.com> Date: Tue Jul 26 18:08:09 2011 -0400 device-assignment: handle device with incorrect PCIe Cap structure size -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 08/01/2011 06:56 PM, Marcelo Tosatti wrote: > OK. Its not lost: > > commit f9c29774d2174df6ffc20becec20928948198914 > Author: Donald Dutile<ddutile@redhat.com> > Date: Tue Jul 26 18:08:09 2011 -0400 > > device-assignment: handle device with incorrect PCIe Cap structure size > Ah, I looked for it in the kernel tree instead of qemu. I look silly either way, but at least the patch is in.
diff --git a/hw/device-assignment.c b/hw/device-assignment.c index 36ad6b0..e073840 100644 --- a/hw/device-assignment.c +++ b/hw/device-assignment.c @@ -1419,18 +1419,37 @@ static int assigned_device_pci_cap_init(PCIDevice *pci_dev) } if ((pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0))) { - uint8_t version; + uint8_t version, size; uint16_t type, devctl, lnkcap, lnksta; uint32_t devcap; - int size = 0x3c; /* version 2 size */ version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS); version &= PCI_EXP_FLAGS_VERS; if (version == 1) { size = 0x14; - } else if (version > 2) { - fprintf(stderr, "Unsupported PCI express capability version %d\n", - version); + } else if (version == 2) { + /* + * Check for non-std size, accept reduced size to 0x34, + * which is what bcm5761 implemented, violating the + * PCIe v3.0 spec that regs should exist and be read as 0, + * not optionally provided and shorten the struct size. + */ + size = MIN(0x3c, PCI_CONFIG_SPACE_SIZE - pos); + if (size < 0x34) { + fprintf(stderr, + "%s: Invalid size PCIe cap-id 0x%x \n", + __func__, PCI_CAP_ID_EXP); + return -EINVAL; + } else if (size != 0x3c) { + fprintf(stderr, + "WARNING, %s: PCIe cap-id 0x%x has " + "non-standard size 0x%x; std size should be 0x3c \n", + __func__, PCI_CAP_ID_EXP, size); + } + } else { + fprintf(stderr, + "%s: Unsupported PCI express capability version %d\n", + __func__, version); return -EINVAL; }
The bcm5761 provides a PCIe Cap structure (capid=0x10) that is invalid, providing one that is 8 bytes shorter than the v2 PCIe spec defines. This leads to a memory corruption when mapped for device-assigment. Add a check in assigned_device_pci_cap_init() to correct this hw error for this device, and try to catch other ones and print warnings if they exists. Signed-off-by: Donald Dutile <ddutile@redhat.com> cc: Alex Williamson <alex.williamson@redhat.com> cc: Michael S. Tsirking <mst@redhat.com> --- hw/device-assignment.c | 29 ++++++++++++++++++++++++----- 1 files changed, 24 insertions(+), 5 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html