Page MenuHomeFreeBSD
Files F177418105

D59780.1794330490.diff
No OneTemporary
Actions

Authored By
Unknown
Size
1 KB
Referenced Files
None
Subscribers
None

D59780.1794330490.diff
View Options

diff --git a/usr.sbin/bhyve/pci_xhci.c b/usr.sbin/bhyve/pci_xhci.c
--- a/usr.sbin/bhyve/pci_xhci.c
+++ b/usr.sbin/bhyve/pci_xhci.c
@@ -85,7 +85,13 @@
#define XHCI_PORTREGS_START 0x400
#define XHCI_DOORBELL_MAX 256
-#define XHCI_STREAMS_MAX 1 /* 4-15 in XHCI spec */
+/*
+ * Maximum number of primary stream array entries we support. The HCCPARAMS1
+ * MaxPSASize field is a 4-bit encoding where the supported count is
+ * 2^(MaxPSASize+1); XHCI_MAXPSASIZE is that encoding (15 => 2^16 streams).
+ */
+#define XHCI_STREAMS_MAX 65536
+#define XHCI_MAXPSASIZE 15
/* caplength and hci-version registers */
#define XHCI_SET_CAPLEN(x) ((x) & 0xFF)
@@ -670,6 +676,16 @@
devep = &dev->eps[epid];
pstreams = XHCI_EPCTX_0_MAXP_STREAMS_GET(ep_ctx->dwEpCtx0);
if (pstreams > 0) {
+ /*
+ * MaxPStreams is guest-controlled; reject out-of-range values
+ * instead of asserting (which would let the guest abort bhyve).
+ */
+ if (pstreams > XHCI_MAXPSASIZE) {
+ WPRINTF(("pci_xhci: invalid MaxPStreams %u, clamping",
+ pstreams));
+ pstreams = XHCI_MAXPSASIZE;
+ }
+ pstreams = 1 << (pstreams + 1);
DPRINTF(("init_ep %d with pstreams %u", epid, pstreams));
assert(devep->ep_sctx_trbs == NULL);
@@ -3004,7 +3020,7 @@
sc->hccparams1 = XHCI_SET_HCCP1_AC64(1) | /* 64-bit addrs */
XHCI_SET_HCCP1_NSS(1) | /* no 2nd-streams */
XHCI_SET_HCCP1_SPC(1) | /* short packet */
- XHCI_SET_HCCP1_MAXPSA(XHCI_STREAMS_MAX);
+ XHCI_SET_HCCP1_MAXPSA(XHCI_MAXPSASIZE);
sc->hccparams2 = XHCI_SET_HCCP2_LEC(1) |
XHCI_SET_HCCP2_U3C(1);
sc->dboff = XHCI_SET_DOORBELL(XHCI_CAPLEN + XHCI_PORTREGS_START +

File Metadata

Mime Type
text/plain
Expires
Tue, Nov 10, 5:08 PM (1 h, 26 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
39189020
Default Alt Text
D59780.1794330490.diff (1 KB)

Event Timeline