* [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
@ 2020-12-20 16:35 Laurent Vivier
2021-01-07 8:02 ` Laurent Vivier
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Laurent Vivier @ 2020-12-20 16:35 UTC (permalink / raw)
To: qemu-devel; +Cc: Laurent Vivier, Gerd Hoffmann, Michael S. Tsirkin
In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
since
commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
get the address and the length of the region.
commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
As this is not implemented in QEMU, address and length are 0 and passed
as is to devm_request_mem_region() that triggers a crash:
[drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
According to the comments in the kernel, a non existent shared region
has a length of (u64)-1.
This is what we return now with this patch to disable the region.
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
hw/virtio/virtio-mmio.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index e1b5c3b81e37..610661d6a526 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
return 0;
}
return vdev->generation;
+ case VIRTIO_MMIO_SHM_LEN_LOW:
+ case VIRTIO_MMIO_SHM_LEN_HIGH:
+ /*
+ * VIRTIO_MMIO_SHM_SEL is unimplemented
+ * according to the linux driver, if region length is -1
+ * the shared memory doesn't exist
+ */
+ return -1;
case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
case VIRTIO_MMIO_DRIVER_FEATURES:
case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
--
2.29.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
2020-12-20 16:35 [PATCH] virtio-mmio: fix guest kernel crash with SHM regions Laurent Vivier
@ 2021-01-07 8:02 ` Laurent Vivier
2021-01-07 10:36 ` Gerd Hoffmann
2021-01-08 12:06 ` Stefano Garzarella
2021-01-23 14:58 ` Laurent Vivier
2 siblings, 1 reply; 5+ messages in thread
From: Laurent Vivier @ 2021-01-07 8:02 UTC (permalink / raw)
To: qemu-devel; +Cc: Gerd Hoffmann, Michael S. Tsirkin
Hi,
any comment?
Thanks,
Laurent
Le 20/12/2020 à 17:35, Laurent Vivier a écrit :
> In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
> since
> commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
> but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
> get the address and the length of the region.
>
> commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
>
> As this is not implemented in QEMU, address and length are 0 and passed
> as is to devm_request_mem_region() that triggers a crash:
>
> [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
> Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
>
> According to the comments in the kernel, a non existent shared region
> has a length of (u64)-1.
>
> This is what we return now with this patch to disable the region.
>
> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
> ---
> hw/virtio/virtio-mmio.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
> index e1b5c3b81e37..610661d6a526 100644
> --- a/hw/virtio/virtio-mmio.c
> +++ b/hw/virtio/virtio-mmio.c
> @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
> return 0;
> }
> return vdev->generation;
> + case VIRTIO_MMIO_SHM_LEN_LOW:
> + case VIRTIO_MMIO_SHM_LEN_HIGH:
> + /*
> + * VIRTIO_MMIO_SHM_SEL is unimplemented
> + * according to the linux driver, if region length is -1
> + * the shared memory doesn't exist
> + */
> + return -1;
> case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
> case VIRTIO_MMIO_DRIVER_FEATURES:
> case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
2021-01-07 8:02 ` Laurent Vivier
@ 2021-01-07 10:36 ` Gerd Hoffmann
0 siblings, 0 replies; 5+ messages in thread
From: Gerd Hoffmann @ 2021-01-07 10:36 UTC (permalink / raw)
To: Laurent Vivier; +Cc: qemu-devel, Michael S. Tsirkin
Hi,
> > According to the comments in the kernel, a non existent shared region
> > has a length of (u64)-1.
virtio spec says the same.
> > + case VIRTIO_MMIO_SHM_LEN_LOW:
> > + case VIRTIO_MMIO_SHM_LEN_HIGH:
> > + /*
> > + * VIRTIO_MMIO_SHM_SEL is unimplemented
> > + * according to the linux driver, if region length is -1
> > + * the shared memory doesn't exist
> > + */
> > + return -1;
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
take care,
Gerd
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
2020-12-20 16:35 [PATCH] virtio-mmio: fix guest kernel crash with SHM regions Laurent Vivier
2021-01-07 8:02 ` Laurent Vivier
@ 2021-01-08 12:06 ` Stefano Garzarella
2021-01-23 14:58 ` Laurent Vivier
2 siblings, 0 replies; 5+ messages in thread
From: Stefano Garzarella @ 2021-01-08 12:06 UTC (permalink / raw)
To: Laurent Vivier; +Cc: Michael S. Tsirkin, qemu-devel, Gerd Hoffmann
On Sun, Dec 20, 2020 at 05:35:39PM +0100, Laurent Vivier wrote:
>In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
>since
>commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
>but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
>get the address and the length of the region.
>
>commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
>
>As this is not implemented in QEMU, address and length are 0 and passed
>as is to devm_request_mem_region() that triggers a crash:
>
> [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
> Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
>
>According to the comments in the kernel, a non existent shared region
>has a length of (u64)-1.
>
>This is what we return now with this patch to disable the region.
>
>Signed-off-by: Laurent Vivier <laurent@vivier.eu>
>---
> hw/virtio/virtio-mmio.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
>diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
>index e1b5c3b81e37..610661d6a526 100644
>--- a/hw/virtio/virtio-mmio.c
>+++ b/hw/virtio/virtio-mmio.c
>@@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
> return 0;
> }
> return vdev->generation;
>+ case VIRTIO_MMIO_SHM_LEN_LOW:
>+ case VIRTIO_MMIO_SHM_LEN_HIGH:
>+ /*
>+ * VIRTIO_MMIO_SHM_SEL is unimplemented
>+ * according to the linux driver, if region length is -1
>+ * the shared memory doesn't exist
>+ */
>+ return -1;
> case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
> case VIRTIO_MMIO_DRIVER_FEATURES:
> case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
>--
>2.29.2
>
>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] virtio-mmio: fix guest kernel crash with SHM regions
2020-12-20 16:35 [PATCH] virtio-mmio: fix guest kernel crash with SHM regions Laurent Vivier
2021-01-07 8:02 ` Laurent Vivier
2021-01-08 12:06 ` Stefano Garzarella
@ 2021-01-23 14:58 ` Laurent Vivier
2 siblings, 0 replies; 5+ messages in thread
From: Laurent Vivier @ 2021-01-23 14:58 UTC (permalink / raw)
To: qemu-devel; +Cc: Gerd Hoffmann, Michael S. Tsirkin
Anyone to merge this?
Thanks,
Laurent
Le 20/12/2020 à 17:35, Laurent Vivier a écrit :
> In the kernel, virtio_gpu_init() uses virtio_get_shm_region()
> since
> commit 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
> but vm_get_shm_region() unconditionally uses VIRTIO_MMIO_SHM_SEL to
> get the address and the length of the region.
>
> commit 38e895487afc ("virtio: Implement get_shm_region for MMIO transport"
>
> As this is not implemented in QEMU, address and length are 0 and passed
> as is to devm_request_mem_region() that triggers a crash:
>
> [drm:virtio_gpu_init] *ERROR* Could not reserve host visible region
> Unable to handle kernel NULL pointer dereference at virtual address (ptrval)
>
> According to the comments in the kernel, a non existent shared region
> has a length of (u64)-1.
>
> This is what we return now with this patch to disable the region.
>
> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
> ---
> hw/virtio/virtio-mmio.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
> index e1b5c3b81e37..610661d6a526 100644
> --- a/hw/virtio/virtio-mmio.c
> +++ b/hw/virtio/virtio-mmio.c
> @@ -191,6 +191,14 @@ static uint64_t virtio_mmio_read(void *opaque, hwaddr offset, unsigned size)
> return 0;
> }
> return vdev->generation;
> + case VIRTIO_MMIO_SHM_LEN_LOW:
> + case VIRTIO_MMIO_SHM_LEN_HIGH:
> + /*
> + * VIRTIO_MMIO_SHM_SEL is unimplemented
> + * according to the linux driver, if region length is -1
> + * the shared memory doesn't exist
> + */
> + return -1;
> case VIRTIO_MMIO_DEVICE_FEATURES_SEL:
> case VIRTIO_MMIO_DRIVER_FEATURES:
> case VIRTIO_MMIO_DRIVER_FEATURES_SEL:
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-01-23 15:00 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-20 16:35 [PATCH] virtio-mmio: fix guest kernel crash with SHM regions Laurent Vivier
2021-01-07 8:02 ` Laurent Vivier
2021-01-07 10:36 ` Gerd Hoffmann
2021-01-08 12:06 ` Stefano Garzarella
2021-01-23 14:58 ` Laurent Vivier
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.