From patchwork Wed May 4 17:53:55 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roman Kagan X-Patchwork-Id: 618570 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3r0Qff72yrz9t6j for ; Thu, 5 May 2016 03:54:50 +1000 (AEST) Received: from localhost ([::1]:49484 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ay10X-0003vO-Jl for incoming@patchwork.ozlabs.org; Wed, 04 May 2016 13:54:45 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33296) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ay10E-0003Mi-Tr for qemu-devel@nongnu.org; Wed, 04 May 2016 13:54:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ay103-0001eq-9d for qemu-devel@nongnu.org; Wed, 04 May 2016 13:54:21 -0400 Received: from mailhub.sw.ru ([195.214.232.25]:28524 helo=relay.sw.ru) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ay102-0001cS-T8 for qemu-devel@nongnu.org; Wed, 04 May 2016 13:54:15 -0400 Received: from rkaganb.sw.ru ([10.30.3.95]) by relay.sw.ru (8.13.4/8.13.4) with ESMTP id u44Hs0ib028180; Wed, 4 May 2016 20:54:01 +0300 (MSK) From: Roman Kagan To: Gerd Hoffmann , qemu-devel@nongnu.org Date: Wed, 4 May 2016 20:53:55 +0300 Message-Id: <1462384435-1034-1-git-send-email-rkagan@virtuozzo.com> X-Mailer: git-send-email 2.5.5 X-detected-operating-system: by eggs.gnu.org: OpenBSD 3.x X-Received-From: 195.214.232.25 Subject: [Qemu-devel] [PATCH] usb:xhci: no DMA on HC reset X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Denis V. Lunev" , Roman Kagan Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" This patch is a rough fix to a memory corruption we are observing when running VMs with xhci USB controller and OVMF firmware. Specifically, on the following call chain xhci_reset xhci_disable_slot xhci_disable_ep xhci_set_ep_state QEMU overwrites guest memory using stale guest addresses. This doesn't happen when the guest (firmware) driver sets up xhci for the first time as there are no slots configured yet. However when the firmware hands over the control to the OS some slots and endpoints are already set up with their context in the guest RAM. Now the OS' driver resets the controller again and xhci_set_ep_state then reads and writes that memory which is now owned by the OS. As a quick fix, skip calling xhci_set_ep_state in xhci_disable_ep if the device context base address array pointer is zero (indicating we're in the HC reset and no DMA is possible). Signed-off-by: Roman Kagan Cc: Gerd Hoffmann --- hw/usb/hcd-xhci.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index bcde8a2..43ba615 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -1531,7 +1531,10 @@ static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid, usb_packet_cleanup(&epctx->transfers[i].packet); } - xhci_set_ep_state(xhci, epctx, NULL, EP_DISABLED); + /* only touch guest RAM if we're not resetting the HC */ + if (xhci->dcbaap_low || xhci->dcbaap_high) { + xhci_set_ep_state(xhci, epctx, NULL, EP_DISABLED); + } timer_free(epctx->kick_timer); g_free(epctx);