From fe4e22b9ccf2eb55d61eccf5050fb7aeafb5fe20 Mon Sep 17 00:00:00 2001

From: Jon Maloy <jmaloy@redhat.com>

Date: Wed, 13 Apr 2022 14:51:06 -0400

Subject: [PATCH 3/3] softmmu/physmem: Introduce MemTxAttrs::memory field and

 MEMTX_ACCESS_ERROR

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

RH-Author: Jon Maloy <jmaloy@redhat.com>

RH-MergeRequest: 151: hw/intc/arm_gicv3: Check for !MEMTX_OK instead of MEMTX_ERROR

RH-Commit: [3/3] b1ebc1e99f21ba0b9eccb284e260b56c7a8e64d8 (jmaloy/qemu-kvm)

RH-Bugzilla: 1999236

RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>

RH-Acked-by: Peter Xu <peterx@redhat.com>

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236

Upstream: Merged

CVE: CVE-2021-3750

Conflicts: memalign.h has not been introduced in this version. Instead,

           we include osdep.h where the function prototypes are to be

           found.

commit 3ab6fdc91b72e156da22848f0003ff4225690ced

Author: Philippe Mathieu-Daudé <philmd@redhat.com>

Date:   Wed Dec 15 19:24:21 2021 +0100

    softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR

    Add the 'memory' bit to the memory attributes to restrict bus

    controller accesses to memories.

    Introduce flatview_access_allowed() to check bus permission

    before running any bus transaction.

    Have read/write accessors return MEMTX_ACCESS_ERROR if an access is

    restricted.

    There is no change for the default case where 'memory' is not set.

    Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

    Message-Id: <20211215182421.418374-4-philmd@redhat.com>

    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

    [thuth: Replaced MEMTX_BUS_ERROR with MEMTX_ACCESS_ERROR, remove "inline"]

    Signed-off-by: Thomas Huth <thuth@redhat.com>

(cherry picked from commit 3ab6fdc91b72e156da22848f0003ff4225690ced)

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

---

 include/exec/memattrs.h |  9 +++++++++

 softmmu/physmem.c       | 45 +++++++++++++++++++++++++++++++++++++++--

 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h

index 95f2d20d55..9fb98bc1ef 100644

--- a/include/exec/memattrs.h

+++ b/include/exec/memattrs.h

@@ -35,6 +35,14 @@ typedef struct MemTxAttrs {

     unsigned int secure:1;

     /* Memory access is usermode (unprivileged) */

     unsigned int user:1;

+    /*

+     * Bus interconnect and peripherals can access anything (memories,

+     * devices) by default. By setting the 'memory' bit, bus transaction

+     * are restricted to "normal" memories (per the AMBA documentation)

+     * versus devices. Access to devices will be logged and rejected

+     * (see MEMTX_ACCESS_ERROR).

+     */

+    unsigned int memory:1;

     /* Requester ID (for MSI for example) */

     unsigned int requester_id:16;

     /* Invert endianness for this page */

@@ -66,6 +74,7 @@ typedef struct MemTxAttrs {

 #define MEMTX_OK 0

 #define MEMTX_ERROR             (1U << 0) /* device returned an error */

 #define MEMTX_DECODE_ERROR      (1U << 1) /* nothing at that address */

+#define MEMTX_ACCESS_ERROR      (1U << 2) /* access denied */

 typedef uint32_t MemTxResult;

 #endif

diff --git a/softmmu/physmem.c b/softmmu/physmem.c

index 483a31be81..4d0ef5f92f 100644

--- a/softmmu/physmem.c

+++ b/softmmu/physmem.c

@@ -41,6 +41,8 @@

 #include "qemu/config-file.h"

 #include "qemu/error-report.h"

 #include "qemu/qemu-print.h"

+#include "qemu/log.h"

+#include "qemu/osdep.h"

 #include "exec/memory.h"

 #include "exec/ioport.h"

 #include "sysemu/dma.h"

@@ -2759,6 +2761,33 @@ static bool prepare_mmio_access(MemoryRegion *mr)

     return release_lock;

 }

+/**

+ * flatview_access_allowed

+ * @mr: #MemoryRegion to be accessed

+ * @attrs: memory transaction attributes

+ * @addr: address within that memory region

+ * @len: the number of bytes to access

+ *

+ * Check if a memory transaction is allowed.

+ *

+ * Returns: true if transaction is allowed, false if denied.

+ */

+static bool flatview_access_allowed(MemoryRegion *mr, MemTxAttrs attrs,

+                                    hwaddr addr, hwaddr len)

+{

+    if (likely(!attrs.memory)) {

+        return true;

+    }

+    if (memory_region_is_ram(mr)) {

+        return true;

+    }

+    qemu_log_mask(LOG_GUEST_ERROR,

+                  "Invalid access to non-RAM device at "

+                  "addr 0x%" HWADDR_PRIX ", size %" HWADDR_PRIu ", "

+                  "region '%s'\n", addr, len, memory_region_name(mr));

+    return false;

+}

+

 /* Called within RCU critical section.  */

 static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,

                                            MemTxAttrs attrs,

@@ -2773,7 +2802,10 @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,

     const uint8_t *buf = ptr;

     for (;;) {

-        if (!memory_access_is_direct(mr, true)) {

+        if (!flatview_access_allowed(mr, attrs, addr1, l)) {

+            result |= MEMTX_ACCESS_ERROR;

+            /* Keep going. */

+        } else if (!memory_access_is_direct(mr, true)) {

             release_lock |= prepare_mmio_access(mr);

             l = memory_access_size(mr, l, addr1);

             /* XXX: could force current_cpu to NULL to avoid

@@ -2818,6 +2850,9 @@ static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,

     l = len;

     mr = flatview_translate(fv, addr, &addr1, &l, true, attrs);

+    if (!flatview_access_allowed(mr, attrs, addr, len)) {

+        return MEMTX_ACCESS_ERROR;

+    }

     return flatview_write_continue(fv, addr, attrs, buf, len,

                                    addr1, l, mr);

 }

@@ -2836,7 +2871,10 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,

     fuzz_dma_read_cb(addr, len, mr);

     for (;;) {

-        if (!memory_access_is_direct(mr, false)) {

+        if (!flatview_access_allowed(mr, attrs, addr1, l)) {

+            result |= MEMTX_ACCESS_ERROR;

+            /* Keep going. */

+        } else if (!memory_access_is_direct(mr, false)) {

             /* I/O case */

             release_lock |= prepare_mmio_access(mr);

             l = memory_access_size(mr, l, addr1);

@@ -2879,6 +2917,9 @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr,

     l = len;

     mr = flatview_translate(fv, addr, &addr1, &l, false, attrs);

+    if (!flatview_access_allowed(mr, attrs, addr, len)) {

+        return MEMTX_ACCESS_ERROR;

+    }

     return flatview_read_continue(fv, addr, attrs, buf, len,

                                   addr1, l, mr);

 }

-- 

2.27.0