| Message ID | 20210414084356.3792113-1-imammedo@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [for-6.0,v2] x86: acpi: use offset instead of pointer when using build_header() | expand |
On Wed, 14 Apr 2021 04:43:56 -0400 Igor Mammedov <imammedo@redhat.com> wrote: > Do the same as in commit > (4d027afeb3a97 Virt: ACPI: fix qemu assert due to re-assigned table data address) > for remaining tables that happen to use saved at > the beginning pointer to build header to avoid assert > when table_data is relocated due to implicit re-size. > > In this case user is trying to start Windows 10 and getting assert at > hw/acpi/bios-linker-loader.c:239: > bios_linker_loader_add_checksum: Assertion `start_offset < file->blob->len' failed. > > Fixes: https://bugs.launchpad.net/bugs/1923497 > Signed-off-by: Igor Mammedov <imammedo@redhat.com> forgot to CC stable, doing it now > --- > v2: > - amend commit message (Michael) > PS: > I have build_header() refactoring patch that requires offset > instead of pointer, to make it harder to misuse but it's > a bit intrusive for last minute fixes. So here goes simplified > variant, and I'll post refactoring patch for 6.1. later. > > hw/acpi/aml-build.c | 15 +++++++++------ > hw/i386/acpi-build.c | 8 ++++++-- > 2 files changed, 15 insertions(+), 8 deletions(-) > > diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c > index d33ce8954a..f0035d2b4a 100644 > --- a/hw/acpi/aml-build.c > +++ b/hw/acpi/aml-build.c > @@ -1830,6 +1830,7 @@ build_rsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, > int i; > unsigned rsdt_entries_offset; > AcpiRsdtDescriptorRev1 *rsdt; > + int rsdt_start = table_data->len; > const unsigned table_data_len = (sizeof(uint32_t) * table_offsets->len); > const unsigned rsdt_entry_size = sizeof(rsdt->table_offset_entry[0]); > const size_t rsdt_len = sizeof(*rsdt) + table_data_len; > @@ -1846,7 +1847,8 @@ build_rsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, > ACPI_BUILD_TABLE_FILE, ref_tbl_offset); > } > build_header(linker, table_data, > - (void *)rsdt, "RSDT", rsdt_len, 1, oem_id, oem_table_id); > + (void *)(table_data->data + rsdt_start), > + "RSDT", rsdt_len, 1, oem_id, oem_table_id); > } > > /* Build xsdt table */ > @@ -1857,6 +1859,7 @@ build_xsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, > int i; > unsigned xsdt_entries_offset; > AcpiXsdtDescriptorRev2 *xsdt; > + int xsdt_start = table_data->len; > const unsigned table_data_len = (sizeof(uint64_t) * table_offsets->len); > const unsigned xsdt_entry_size = sizeof(xsdt->table_offset_entry[0]); > const size_t xsdt_len = sizeof(*xsdt) + table_data_len; > @@ -1873,7 +1876,8 @@ build_xsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, > ACPI_BUILD_TABLE_FILE, ref_tbl_offset); > } > build_header(linker, table_data, > - (void *)xsdt, "XSDT", xsdt_len, 1, oem_id, oem_table_id); > + (void *)(table_data->data + xsdt_start), > + "XSDT", xsdt_len, 1, oem_id, oem_table_id); > } > > void build_srat_memory(AcpiSratMemoryAffinity *numamem, uint64_t base, > @@ -2053,10 +2057,9 @@ void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, > uint64_t control_area_start_address; > TPMIf *tpmif = tpm_find(); > uint32_t start_method; > - void *tpm2_ptr; > > tpm2_start = table_data->len; > - tpm2_ptr = acpi_data_push(table_data, sizeof(AcpiTableHeader)); > + acpi_data_push(table_data, sizeof(AcpiTableHeader)); > > /* Platform Class */ > build_append_int_noprefix(table_data, TPM2_ACPI_CLASS_CLIENT, 2); > @@ -2095,8 +2098,8 @@ void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, > log_addr_offset, 8, > ACPI_BUILD_TPMLOG_FILE, 0); > build_header(linker, table_data, > - tpm2_ptr, "TPM2", table_data->len - tpm2_start, 4, oem_id, > - oem_table_id); > + (void *)(table_data->data + tpm2_start), > + "TPM2", table_data->len - tpm2_start, 4, oem_id, oem_table_id); > } > > Aml *build_crs(PCIHostState *host, CrsRangeSet *range_set, uint32_t io_offset, > diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c > index de98750aef..daaf8f473e 100644 > --- a/hw/i386/acpi-build.c > +++ b/hw/i386/acpi-build.c > @@ -1816,6 +1816,7 @@ build_hpet(GArray *table_data, BIOSLinker *linker, const char *oem_id, > const char *oem_table_id) > { > Acpi20Hpet *hpet; > + int hpet_start = table_data->len; > > hpet = acpi_data_push(table_data, sizeof(*hpet)); > /* Note timer_block_id value must be kept in sync with value advertised by > @@ -1824,13 +1825,15 @@ build_hpet(GArray *table_data, BIOSLinker *linker, const char *oem_id, > hpet->timer_block_id = cpu_to_le32(0x8086a201); > hpet->addr.address = cpu_to_le64(HPET_BASE); > build_header(linker, table_data, > - (void *)hpet, "HPET", sizeof(*hpet), 1, oem_id, oem_table_id); > + (void *)(table_data->data + hpet_start), > + "HPET", sizeof(*hpet), 1, oem_id, oem_table_id); > } > > static void > build_tpm_tcpa(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, > const char *oem_id, const char *oem_table_id) > { > + int tcpa_start = table_data->len; > Acpi20Tcpa *tcpa = acpi_data_push(table_data, sizeof *tcpa); > unsigned log_addr_size = sizeof(tcpa->log_area_start_address); > unsigned log_addr_offset = > @@ -1849,7 +1852,8 @@ build_tpm_tcpa(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, > ACPI_BUILD_TPMLOG_FILE, 0); > > build_header(linker, table_data, > - (void *)tcpa, "TCPA", sizeof(*tcpa), 2, oem_id, oem_table_id); > + (void *)(table_data->data + tcpa_start), > + "TCPA", sizeof(*tcpa), 2, oem_id, oem_table_id); > } > > #define HOLE_640K_START (640 * KiB)
diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c index d33ce8954a..f0035d2b4a 100644 --- a/hw/acpi/aml-build.c +++ b/hw/acpi/aml-build.c @@ -1830,6 +1830,7 @@ build_rsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, int i; unsigned rsdt_entries_offset; AcpiRsdtDescriptorRev1 *rsdt; + int rsdt_start = table_data->len; const unsigned table_data_len = (sizeof(uint32_t) * table_offsets->len); const unsigned rsdt_entry_size = sizeof(rsdt->table_offset_entry[0]); const size_t rsdt_len = sizeof(*rsdt) + table_data_len; @@ -1846,7 +1847,8 @@ build_rsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, ACPI_BUILD_TABLE_FILE, ref_tbl_offset); } build_header(linker, table_data, - (void *)rsdt, "RSDT", rsdt_len, 1, oem_id, oem_table_id); + (void *)(table_data->data + rsdt_start), + "RSDT", rsdt_len, 1, oem_id, oem_table_id); } /* Build xsdt table */ @@ -1857,6 +1859,7 @@ build_xsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, int i; unsigned xsdt_entries_offset; AcpiXsdtDescriptorRev2 *xsdt; + int xsdt_start = table_data->len; const unsigned table_data_len = (sizeof(uint64_t) * table_offsets->len); const unsigned xsdt_entry_size = sizeof(xsdt->table_offset_entry[0]); const size_t xsdt_len = sizeof(*xsdt) + table_data_len; @@ -1873,7 +1876,8 @@ build_xsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets, ACPI_BUILD_TABLE_FILE, ref_tbl_offset); } build_header(linker, table_data, - (void *)xsdt, "XSDT", xsdt_len, 1, oem_id, oem_table_id); + (void *)(table_data->data + xsdt_start), + "XSDT", xsdt_len, 1, oem_id, oem_table_id); } void build_srat_memory(AcpiSratMemoryAffinity *numamem, uint64_t base, @@ -2053,10 +2057,9 @@ void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, uint64_t control_area_start_address; TPMIf *tpmif = tpm_find(); uint32_t start_method; - void *tpm2_ptr; tpm2_start = table_data->len; - tpm2_ptr = acpi_data_push(table_data, sizeof(AcpiTableHeader)); + acpi_data_push(table_data, sizeof(AcpiTableHeader)); /* Platform Class */ build_append_int_noprefix(table_data, TPM2_ACPI_CLASS_CLIENT, 2); @@ -2095,8 +2098,8 @@ void build_tpm2(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, log_addr_offset, 8, ACPI_BUILD_TPMLOG_FILE, 0); build_header(linker, table_data, - tpm2_ptr, "TPM2", table_data->len - tpm2_start, 4, oem_id, - oem_table_id); + (void *)(table_data->data + tpm2_start), + "TPM2", table_data->len - tpm2_start, 4, oem_id, oem_table_id); } Aml *build_crs(PCIHostState *host, CrsRangeSet *range_set, uint32_t io_offset, diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c index de98750aef..daaf8f473e 100644 --- a/hw/i386/acpi-build.c +++ b/hw/i386/acpi-build.c @@ -1816,6 +1816,7 @@ build_hpet(GArray *table_data, BIOSLinker *linker, const char *oem_id, const char *oem_table_id) { Acpi20Hpet *hpet; + int hpet_start = table_data->len; hpet = acpi_data_push(table_data, sizeof(*hpet)); /* Note timer_block_id value must be kept in sync with value advertised by @@ -1824,13 +1825,15 @@ build_hpet(GArray *table_data, BIOSLinker *linker, const char *oem_id, hpet->timer_block_id = cpu_to_le32(0x8086a201); hpet->addr.address = cpu_to_le64(HPET_BASE); build_header(linker, table_data, - (void *)hpet, "HPET", sizeof(*hpet), 1, oem_id, oem_table_id); + (void *)(table_data->data + hpet_start), + "HPET", sizeof(*hpet), 1, oem_id, oem_table_id); } static void build_tpm_tcpa(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, const char *oem_id, const char *oem_table_id) { + int tcpa_start = table_data->len; Acpi20Tcpa *tcpa = acpi_data_push(table_data, sizeof *tcpa); unsigned log_addr_size = sizeof(tcpa->log_area_start_address); unsigned log_addr_offset = @@ -1849,7 +1852,8 @@ build_tpm_tcpa(GArray *table_data, BIOSLinker *linker, GArray *tcpalog, ACPI_BUILD_TPMLOG_FILE, 0); build_header(linker, table_data, - (void *)tcpa, "TCPA", sizeof(*tcpa), 2, oem_id, oem_table_id); + (void *)(table_data->data + tcpa_start), + "TCPA", sizeof(*tcpa), 2, oem_id, oem_table_id); } #define HOLE_640K_START (640 * KiB)
Do the same as in commit (4d027afeb3a97 Virt: ACPI: fix qemu assert due to re-assigned table data address) for remaining tables that happen to use saved at the beginning pointer to build header to avoid assert when table_data is relocated due to implicit re-size. In this case user is trying to start Windows 10 and getting assert at hw/acpi/bios-linker-loader.c:239: bios_linker_loader_add_checksum: Assertion `start_offset < file->blob->len' failed. Fixes: https://bugs.launchpad.net/bugs/1923497 Signed-off-by: Igor Mammedov <imammedo@redhat.com> --- v2: - amend commit message (Michael) PS: I have build_header() refactoring patch that requires offset instead of pointer, to make it harder to misuse but it's a bit intrusive for last minute fixes. So here goes simplified variant, and I'll post refactoring patch for 6.1. later. hw/acpi/aml-build.c | 15 +++++++++------ hw/i386/acpi-build.c | 8 ++++++-- 2 files changed, 15 insertions(+), 8 deletions(-)