|
|
432cb7 |
From fe4e22b9ccf2eb55d61eccf5050fb7aeafb5fe20 Mon Sep 17 00:00:00 2001
|
|
|
432cb7 |
From: Jon Maloy <jmaloy@redhat.com>
|
|
|
432cb7 |
Date: Wed, 13 Apr 2022 14:51:06 -0400
|
|
|
432cb7 |
Subject: [PATCH 3/3] softmmu/physmem: Introduce MemTxAttrs::memory field and
|
|
|
432cb7 |
MEMTX_ACCESS_ERROR
|
|
|
432cb7 |
MIME-Version: 1.0
|
|
|
432cb7 |
Content-Type: text/plain; charset=UTF-8
|
|
|
432cb7 |
Content-Transfer-Encoding: 8bit
|
|
|
432cb7 |
|
|
|
432cb7 |
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
|
432cb7 |
RH-MergeRequest: 151: hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR
|
|
|
432cb7 |
RH-Commit: [3/3] b1ebc1e99f21ba0b9eccb284e260b56c7a8e64d8 (jmaloy/qemu-kvm)
|
|
|
432cb7 |
RH-Bugzilla: 1999236
|
|
|
432cb7 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
432cb7 |
RH-Acked-by: Peter Xu <peterx@redhat.com>
|
|
|
432cb7 |
|
|
|
432cb7 |
Bugzilla: https:
|
|
|
432cb7 |
Upstream: Merged
|
|
|
432cb7 |
CVE: CVE-2021-3750
|
|
|
432cb7 |
Conflicts: memalign.h has not been introduced in this version. Instead,
|
|
|
432cb7 |
we include osdep.h where the function prototypes are to be
|
|
|
432cb7 |
found.
|
|
|
432cb7 |
|
|
|
432cb7 |
commit 3ab6fdc91b72e156da22848f0003ff4225690ced
|
|
|
432cb7 |
Author: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
432cb7 |
Date: Wed Dec 15 19:24:21 2021 +0100
|
|
|
432cb7 |
|
|
|
432cb7 |
softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR
|
|
|
432cb7 |
|
|
|
432cb7 |
Add the 'memory' bit to the memory attributes to restrict bus
|
|
|
432cb7 |
controller accesses to memories.
|
|
|
432cb7 |
|
|
|
432cb7 |
Introduce flatview_access_allowed() to check bus permission
|
|
|
432cb7 |
before running any bus transaction.
|
|
|
432cb7 |
|
|
|
432cb7 |
Have read/write accessors return MEMTX_ACCESS_ERROR if an access is
|
|
|
432cb7 |
restricted.
|
|
|
432cb7 |
|
|
|
432cb7 |
There is no change for the default case where 'memory' is not set.
|
|
|
432cb7 |
|
|
|
432cb7 |
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
432cb7 |
Message-Id: <20211215182421.418374-4-philmd@redhat.com>
|
|
|
432cb7 |
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
|
|
|
432cb7 |
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
432cb7 |
[thuth: Replaced MEMTX_BUS_ERROR with MEMTX_ACCESS_ERROR, remove "inline"]
|
|
|
432cb7 |
Signed-off-by: Thomas Huth <thuth@redhat.com>
|
|
|
432cb7 |
|
|
|
432cb7 |
(cherry picked from commit 3ab6fdc91b72e156da22848f0003ff4225690ced)
|
|
|
432cb7 |
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
|
432cb7 |
|
|
|
432cb7 |
include/exec/memattrs.h | 9 +++++++++
|
|
|
432cb7 |
softmmu/physmem.c | 45 +++++++++++++++++++++++++++++++++++++++
|
|
|
432cb7 |
2 files changed, 52 insertions(+), 2 deletions(-)
|
|
|
432cb7 |
|
|
|
432cb7 |
diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
|
|
|
432cb7 |
index 95f2d20d55..9fb98bc1ef 100644
|
|
|
432cb7 |
|
|
|
432cb7 |
+++ b/include/exec/memattrs.h
|
|
|
432cb7 |
@@ -35,6 +35,14 @@ typedef struct MemTxAttrs {
|
|
|
432cb7 |
unsigned int secure:1;
|
|
|
432cb7 |
|
|
|
432cb7 |
unsigned int user:1;
|
|
|
432cb7 |
+ /*
|
|
|
432cb7 |
+ * Bus interconnect and peripherals can access anything (memories,
|
|
|
432cb7 |
+ * devices) by default. By setting the 'memory' bit, bus transaction
|
|
|
432cb7 |
+ * are restricted to "normal" memories (per the AMBA documentation)
|
|
|
432cb7 |
+ * versus devices. Access to devices will be logged and rejected
|
|
|
432cb7 |
+ * (see MEMTX_ACCESS_ERROR).
|
|
|
432cb7 |
+ */
|
|
|
432cb7 |
+ unsigned int memory:1;
|
|
|
432cb7 |
/* Requester ID (for MSI for example) */
|
|
|
432cb7 |
unsigned int requester_id:16;
|
|
|
432cb7 |
/* Invert endianness for this page */
|
|
|
432cb7 |
@@ -66,6 +74,7 @@ typedef struct MemTxAttrs {
|
|
|
432cb7 |
#define MEMTX_OK 0
|
|
|
432cb7 |
#define MEMTX_ERROR (1U << 0)
|
|
|
432cb7 |
#define MEMTX_DECODE_ERROR (1U << 1)
|
|
|
432cb7 |
+#define MEMTX_ACCESS_ERROR (1U << 2)
|
|
|
432cb7 |
typedef uint32_t MemTxResult;
|
|
|
432cb7 |
|
|
|
432cb7 |
#endif
|
|
|
432cb7 |
diff
|
|
|
432cb7 |
index 483a31be81..4d0ef5f92f 100644
|
|
|
432cb7 |
|
|
|
432cb7 |
|
|
|
432cb7 |
@@ -41,6 +41,8 @@
|
|
|
432cb7 |
#include "qemu/config-file.h"
|
|
|
432cb7 |
#include "qemu/error-report.h"
|
|
|
432cb7 |
#include "qemu/qemu-print.h"
|
|
|
432cb7 |
+#include "qemu/log.h"
|
|
|
432cb7 |
+#include "qemu/osdep.h"
|
|
|
432cb7 |
#include "exec/memory.h"
|
|
|
432cb7 |
#include "exec/ioport.h"
|
|
|
432cb7 |
#include "sysemu/dma.h"
|
|
|
432cb7 |
@@ -2759,6 +2761,33 @@ static bool prepare_mmio_access(MemoryRegion *mr)
|
|
|
432cb7 |
return release_lock;
|
|
|
432cb7 |
}
|
|
|
432cb7 |
|
|
|
432cb7 |
+/**
|
|
|
432cb7 |
+ * flatview_access_allowed
|
|
|
432cb7 |
+ * @mr:
|
|
|
432cb7 |
+ * @attrs: memory transaction attributes
|
|
|
432cb7 |
+ * @addr: address within that memory region
|
|
|
432cb7 |
+ * @len: the number of bytes to access
|
|
|
432cb7 |
+ *
|
|
|
432cb7 |
+ * Check if a memory transaction is allowed.
|
|
|
432cb7 |
+ *
|
|
|
432cb7 |
+ * Returns: true if transaction is allowed, false if denied.
|
|
|
432cb7 |
+ */
|
|
|
432cb7 |
+static bool flatview_access_allowed(MemoryRegion *mr, MemTxAttrs attrs,
|
|
|
432cb7 |
+ hwaddr addr, hwaddr len)
|
|
|
432cb7 |
+{
|
|
|
432cb7 |
+ if (likely(!attrs.memory)) {
|
|
|
432cb7 |
+ return true;
|
|
|
432cb7 |
+ }
|
|
|
432cb7 |
+ if (memory_region_is_ram(mr)) {
|
|
|
432cb7 |
+ return true;
|
|
|
432cb7 |
+ }
|
|
|
432cb7 |
+ qemu_log_mask(LOG_GUEST_ERROR,
|
|
|
432cb7 |
+ "Invalid access to non-RAM device at "
|
|
|
432cb7 |
+ "addr 0x%" HWADDR_PRIX ", size %" HWADDR_PRIu ", "
|
|
|
432cb7 |
+ "region '%s'\n", addr, len, memory_region_name(mr));
|
|
|
432cb7 |
+ return false;
|
|
|
432cb7 |
+}
|
|
|
432cb7 |
+
|
|
|
432cb7 |
|
|
|
432cb7 |
static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
|
|
|
432cb7 |
MemTxAttrs attrs,
|
|
|
432cb7 |
@@ -2773,7 +2802,10 @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
|
|
|
432cb7 |
const uint8_t *buf = ptr;
|
|
|
432cb7 |
|
|
|
432cb7 |
for (;;) {
|
|
|
432cb7 |
- if (!memory_access_is_direct(mr, true)) {
|
|
|
432cb7 |
+ if (!flatview_access_allowed(mr, attrs, addr1, l)) {
|
|
|
432cb7 |
+ result |= MEMTX_ACCESS_ERROR;
|
|
|
432cb7 |
+
|
|
|
432cb7 |
+ } else if (!memory_access_is_direct(mr, true)) {
|
|
|
432cb7 |
release_lock |= prepare_mmio_access(mr);
|
|
|
432cb7 |
l = memory_access_size(mr, l, addr1);
|
|
|
432cb7 |
/* XXX: could force current_cpu to NULL to avoid
|
|
|
432cb7 |
@@ -2818,6 +2850,9 @@ static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
|
|
|
432cb7 |
|
|
|
432cb7 |
l = len;
|
|
|
432cb7 |
mr = flatview_translate(fv, addr, &addr1, &l, true, attrs);
|
|
|
432cb7 |
+ if (!flatview_access_allowed(mr, attrs, addr, len)) {
|
|
|
432cb7 |
+ return MEMTX_ACCESS_ERROR;
|
|
|
432cb7 |
+ }
|
|
|
432cb7 |
return flatview_write_continue(fv, addr, attrs, buf, len,
|
|
|
432cb7 |
addr1, l, mr);
|
|
|
432cb7 |
}
|
|
|
432cb7 |
@@ -2836,7 +2871,10 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
|
|
|
432cb7 |
|
|
|
432cb7 |
fuzz_dma_read_cb(addr, len, mr);
|
|
|
432cb7 |
for (;;) {
|
|
|
432cb7 |
- if (!memory_access_is_direct(mr, false)) {
|
|
|
432cb7 |
+ if (!flatview_access_allowed(mr, attrs, addr1, l)) {
|
|
|
432cb7 |
+ result |= MEMTX_ACCESS_ERROR;
|
|
|
432cb7 |
+
|
|
|
432cb7 |
+ } else if (!memory_access_is_direct(mr, false)) {
|
|
|
432cb7 |
/* I/O case */
|
|
|
432cb7 |
release_lock |= prepare_mmio_access(mr);
|
|
|
432cb7 |
l = memory_access_size(mr, l, addr1);
|
|
|
432cb7 |
@@ -2879,6 +2917,9 @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
|
|
|
432cb7 |
|
|
|
432cb7 |
l = len;
|
|
|
432cb7 |
mr = flatview_translate(fv, addr, &addr1, &l, false, attrs);
|
|
|
432cb7 |
+ if (!flatview_access_allowed(mr, attrs, addr, len)) {
|
|
|
432cb7 |
+ return MEMTX_ACCESS_ERROR;
|
|
|
432cb7 |
+ }
|
|
|
432cb7 |
return flatview_read_continue(fv, addr, attrs, buf, len,
|
|
|
432cb7 |
addr1, l, mr);
|
|
|
432cb7 |
}
|
|
|
432cb7 |
--
|
|
|
432cb7 |
2.27.0
|
|
|
432cb7 |
|