Commit "kvm tools: virtio: remove hardcoded assumptions
about guest page size" has introduced a bug that prevented
guests with more than 4gb of ram from booting.
The issue is that 'pfn' is a 32bit integer, so when multiplying
it by page size to get the actual page will cause an overflow if
the pfn referred to a memory area above 4gb.
Signed-off-by: Sasha Levin <sasha.levin@xxxxxxxxxx>
---
tools/kvm/include/kvm/virtio.h | 6 ++++++
tools/kvm/virtio/9p.c | 2 +-
tools/kvm/virtio/balloon.c | 2 +-
tools/kvm/virtio/blk.c | 2 +-
tools/kvm/virtio/console.c | 2 +-
tools/kvm/virtio/net.c | 2 +-
tools/kvm/virtio/rng.c | 2 +-
tools/kvm/virtio/scsi.c | 2 +-
8 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/tools/kvm/include/kvm/virtio.h b/tools/kvm/include/kvm/virtio.h
index 269ea4a..820b94a 100644
--- a/tools/kvm/include/kvm/virtio.h
+++ b/tools/kvm/include/kvm/virtio.h
@@ -90,4 +90,10 @@ int virtio_init(struct kvm *kvm, void *dev, struct virtio_device *vdev,
struct virtio_ops *ops, enum virtio_trans trans,
int device_id, int subsys_id, int class);
int virtio_compat_add_message(const char *device, const char *config);
+
+static inline void *virtio_get_vq(struct kvm *kvm, u32 pfn, u32 page_size)
+{
+ return guest_flat_to_host(kvm, (u64)pfn * page_size);
+}
+
#endif /* KVM__VIRTIO_H */
diff --git a/tools/kvm/virtio/9p.c b/tools/kvm/virtio/9p.c
index b7a5723..127b13a 100644
--- a/tools/kvm/virtio/9p.c
+++ b/tools/kvm/virtio/9p.c
@@ -1267,7 +1267,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align,
queue = &p9dev->vqs[vq];
queue->pfn = pfn;
- p = guest_flat_to_host(kvm, queue->pfn * page_size);
+ p = virtio_get_vq(kvm, queue->pfn, page_size);
job = &p9dev->jobs[vq];
vring_init(&queue->vring, VIRTQUEUE_NUM, p, align);
diff --git a/tools/kvm/virtio/balloon.c b/tools/kvm/virtio/balloon.c
index d1b64fa..4863535 100644
--- a/tools/kvm/virtio/balloon.c
+++ b/tools/kvm/virtio/balloon.c
@@ -204,7 +204,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align,
queue = &bdev->vqs[vq];
queue->pfn = pfn;
- p = guest_flat_to_host(kvm, queue->pfn * page_size);
+ p = virtio_get_vq(kvm, queue->pfn, page_size);
thread_pool__init_job(&bdev->jobs[vq], kvm, virtio_bln_do_io, queue);
vring_init(&queue->vring, VIRTIO_BLN_QUEUE_SIZE, p, align);
diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c
index 44ac44b..ab18716 100644
--- a/tools/kvm/virtio/blk.c
+++ b/tools/kvm/virtio/blk.c
@@ -167,7 +167,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align,
queue = &bdev->vqs[vq];
queue->pfn = pfn;
- p = guest_flat_to_host(kvm, queue->pfn * page_size);
+ p = virtio_get_vq(kvm, queue->pfn, page_size);
vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, align);
diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c
index 1f88a4b..83c58bf 100644
--- a/tools/kvm/virtio/console.c
+++ b/tools/kvm/virtio/console.c
@@ -137,7 +137,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align,
queue = &cdev.vqs[vq];
queue->pfn = pfn;
- p = guest_flat_to_host(kvm, queue->pfn * page_size);
+ p = virtio_get_vq(kvm, queue->pfn, page_size);
vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, align);
diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c
index 7855cfc..298903c 100644
--- a/tools/kvm/virtio/net.c
+++ b/tools/kvm/virtio/net.c
@@ -410,7 +410,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align,
queue = &ndev->vqs[vq];
queue->pfn = pfn;
- p = guest_flat_to_host(kvm, queue->pfn * page_size);
+ p = virtio_get_vq(kvm, queue->pfn, page_size);
vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, align);
diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c
index 2ce8afd..394de71 100644
--- a/tools/kvm/virtio/rng.c
+++ b/tools/kvm/virtio/rng.c
@@ -98,7 +98,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align,
queue = &rdev->vqs[vq];
queue->pfn = pfn;
- p = guest_flat_to_host(kvm, queue->pfn * page_size);
+ p = virtio_get_vq(kvm, queue->pfn, page_size);
job = &rdev->jobs[vq];
diff --git a/tools/kvm/virtio/scsi.c b/tools/kvm/virtio/scsi.c
index 05b2dc6..8da2420 100644
--- a/tools/kvm/virtio/scsi.c
+++ b/tools/kvm/virtio/scsi.c
@@ -63,7 +63,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align,
queue = &sdev->vqs[vq];
queue->pfn = pfn;
- p = guest_flat_to_host(kvm, queue->pfn * page_size);
+ p = virtio_get_vq(kvm, queue->pfn, page_size);
vring_init(&queue->vring, VIRTIO_SCSI_QUEUE_SIZE, p, align);
--
1.8.1.2
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
