edu: fix DMA range upper bound check
The edu_check_range function checks that start <= end1 < end2, where end1 is the upper bound (exclusive) of the guest-supplied DMA range and end2 is the upper bound (exclusive) of the device's allowed DMA range. When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1 will be equal to end2, so the check fails and QEMU aborts with this puzzling error message (newlines added for formatting): qemu: hardware error: EDU: DMA range 0x0000000000040000-0x0000000000040fff out of bounds (0x0000000000040000-0x0000000000040fff)! By checking end1 <= end2 instead, guests will be allowed to transfer exactly 4096 bytes. It is not necessary to explicitly check for start <= end1 because the previous two checks (within(addr, start, end2) and end1 > addr) imply start < end1. Fixes:b30934cb52
("hw: misc, add educational driver", 2015-01-21) Signed-off-by: Max Erenberg <merenber@uwaterloo.ca> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit2c5107e1b4
) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
parent
6e3cfd598c
commit
0bf355e6ca
@ -115,7 +115,7 @@ static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start,
|
||||
uint64_t end2 = start + size2;
|
||||
|
||||
if (within(addr, start, end2) &&
|
||||
end1 > addr && within(end1, start, end2)) {
|
||||
end1 > addr && end1 <= end2) {
|
||||
return;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user