| Message ID | 1383775790.2527.41.camel@localhost.localdomain |
|---|---|
| State | New |
| Headers | show |
On Thu, Nov 07, 2013 at 12:09:50AM +0200, Marcel Apfelbaum wrote: > On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote: > > On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote: > > > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote: > > > > A bug reported by Luiz Capitulino let us to find > > > > several bugs in memory address space setup. > > > > > > > > One issue is that gdb stub can give us arbitrary addresses > > > > and we'll try to access them. > > > > Since our lookup ignored high bits in the address, > > > > we hit a wrong section and got a crash. > > > > In fact, PCI devices can access arbitrary addresses too, > > > > so we should just make lookup robust against this case. > > > > > > > > Another issue has to do with size of regions. > > > > memory API uses UINT64_MAX so say "all 64 bit" but > > > > some devices mistakenly used INT64_MAX. > > > > > > > > It should not affect most systems in practice as > > > > everything should be limited by address space size, > > > > but it's an API misuse that we should not keep around, > > > > and it will become a problem if a system with 64 bit > > > > target address hits this path. > > > > > > > > Patch 1 fixes an actual bug. > > > > The rest of patches make code cleaner and more robust. > > > > > > > > Michael S. Tsirkin (4): > > > > exec: don't ignore high address bits on lookup > > > > pci: fix address space size for bridge > > > > exec: don't ignore high address bits on set > > > > spapr_pci: s/INT64_MAX/UINT64_MAX/ > > > > > > > > Paolo Bonzini (1): > > > > pc: s/INT64_MAX/UINT64_MAX/ > > > > > > > > exec.c | 9 +++++++++ > > > > hw/i386/pc_piix.c | 2 +- > > > > hw/i386/pc_q35.c | 2 +- > > > > hw/pci/pci_bridge.c | 2 +- > > > > hw/ppc/spapr_pci.c | 2 +- > > > > 5 files changed, 13 insertions(+), 4 deletions(-) > > > > > > > > > > Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> > > > > > > > Please don't apply this. > > > > I didn't post the patches - I only sent them to Marcel :) > > And the reason is that the assert in exec. detects more bugs with > > over-writing page-tables: just run make check. > > > > I think we need to get a handle on them first before applying. > > > > Found the issues with make check, so that this series can be posted. > I'll send a proper patch tomorrow: Cool. So pls make this patch 1 and the rest can go on top. Also maybe add TARGET_PHYS_ADDR_SPACE_MAX to avoid TARGET_PHYS_ADDR_SPACE_BITS == 64 ? UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS) everywhere. though that is not a must. Does hw/ppc/spapr_vio.c need a patch too? Could not figure out where does the "as" come from there ... probably not an issue. We also need some more tests done. > > diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c > index 59e1bb8..c203935 100644 > --- a/hw/alpha/typhoon.c > +++ b/hw/alpha/typhoon.c > @@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus, > > /* Host memory as seen from the PCI side, via the IOMMU. */ > memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops, > - "iommu-typhoon", UINT64_MAX); > + "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); > address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci"); > pci_setup_iommu(b, typhoon_pci_dma_iommu, s); > > diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c > index ef45f4f..84b1309 100644 > --- a/hw/ppc/spapr_iommu.c > +++ b/hw/ppc/spapr_iommu.c > @@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev) > trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd); > > memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops, > - "iommu-spapr", UINT64_MAX); > + "iommu-spapr", > + TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); > > QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list); > > > Thanks, > Marcel > >
On Thu, 2013-11-07 at 00:20 +0200, Michael S. Tsirkin wrote: > On Thu, Nov 07, 2013 at 12:09:50AM +0200, Marcel Apfelbaum wrote: > > On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote: > > > On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote: > > > > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote: > > > > > A bug reported by Luiz Capitulino let us to find > > > > > several bugs in memory address space setup. > > > > > > > > > > One issue is that gdb stub can give us arbitrary addresses > > > > > and we'll try to access them. > > > > > Since our lookup ignored high bits in the address, > > > > > we hit a wrong section and got a crash. > > > > > In fact, PCI devices can access arbitrary addresses too, > > > > > so we should just make lookup robust against this case. > > > > > > > > > > Another issue has to do with size of regions. > > > > > memory API uses UINT64_MAX so say "all 64 bit" but > > > > > some devices mistakenly used INT64_MAX. > > > > > > > > > > It should not affect most systems in practice as > > > > > everything should be limited by address space size, > > > > > but it's an API misuse that we should not keep around, > > > > > and it will become a problem if a system with 64 bit > > > > > target address hits this path. > > > > > > > > > > Patch 1 fixes an actual bug. > > > > > The rest of patches make code cleaner and more robust. > > > > > > > > > > Michael S. Tsirkin (4): > > > > > exec: don't ignore high address bits on lookup > > > > > pci: fix address space size for bridge > > > > > exec: don't ignore high address bits on set > > > > > spapr_pci: s/INT64_MAX/UINT64_MAX/ > > > > > > > > > > Paolo Bonzini (1): > > > > > pc: s/INT64_MAX/UINT64_MAX/ > > > > > > > > > > exec.c | 9 +++++++++ > > > > > hw/i386/pc_piix.c | 2 +- > > > > > hw/i386/pc_q35.c | 2 +- > > > > > hw/pci/pci_bridge.c | 2 +- > > > > > hw/ppc/spapr_pci.c | 2 +- > > > > > 5 files changed, 13 insertions(+), 4 deletions(-) > > > > > > > > > > > > > Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> > > > > > > > > > > Please don't apply this. > > > > > > I didn't post the patches - I only sent them to Marcel :) > > > And the reason is that the assert in exec. detects more bugs with > > > over-writing page-tables: just run make check. > > > > > > I think we need to get a handle on them first before applying. > > > > > > > Found the issues with make check, so that this series can be posted. > > I'll send a proper patch tomorrow: > > Cool. So pls make this patch 1 and the rest can go on top. > Also maybe add TARGET_PHYS_ADDR_SPACE_MAX to avoid > TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS) > everywhere. > Good idea, I'll use this. > though that is not a must. > > Does hw/ppc/spapr_vio.c need a patch too? > Could not figure out where does the "as" come from there ... > probably not an issue. Wasn't needed for make check. That doesn't mean is not an issue. > We also need some more tests done. That's for sure, in the mean time I'll put the assert inside an ifdef as you suggested. Thanks, Marcel > > > > > diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c > > index 59e1bb8..c203935 100644 > > --- a/hw/alpha/typhoon.c > > +++ b/hw/alpha/typhoon.c > > @@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus, > > > > /* Host memory as seen from the PCI side, via the IOMMU. */ > > memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops, > > - "iommu-typhoon", UINT64_MAX); > > + "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > > + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); > > address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci"); > > pci_setup_iommu(b, typhoon_pci_dma_iommu, s); > > > > diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c > > index ef45f4f..84b1309 100644 > > --- a/hw/ppc/spapr_iommu.c > > +++ b/hw/ppc/spapr_iommu.c > > @@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev) > > trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd); > > > > memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops, > > - "iommu-spapr", UINT64_MAX); > > + "iommu-spapr", > > + TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > > + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); > > > > QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list); > > > > > > Thanks, > > Marcel > > > >
On Thu, Nov 07, 2013 at 12:22:29AM +0200, Marcel Apfelbaum wrote: > On Thu, 2013-11-07 at 00:20 +0200, Michael S. Tsirkin wrote: > > On Thu, Nov 07, 2013 at 12:09:50AM +0200, Marcel Apfelbaum wrote: > > > On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote: > > > > On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote: > > > > > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote: > > > > > > A bug reported by Luiz Capitulino let us to find > > > > > > several bugs in memory address space setup. > > > > > > > > > > > > One issue is that gdb stub can give us arbitrary addresses > > > > > > and we'll try to access them. > > > > > > Since our lookup ignored high bits in the address, > > > > > > we hit a wrong section and got a crash. > > > > > > In fact, PCI devices can access arbitrary addresses too, > > > > > > so we should just make lookup robust against this case. > > > > > > > > > > > > Another issue has to do with size of regions. > > > > > > memory API uses UINT64_MAX so say "all 64 bit" but > > > > > > some devices mistakenly used INT64_MAX. > > > > > > > > > > > > It should not affect most systems in practice as > > > > > > everything should be limited by address space size, > > > > > > but it's an API misuse that we should not keep around, > > > > > > and it will become a problem if a system with 64 bit > > > > > > target address hits this path. > > > > > > > > > > > > Patch 1 fixes an actual bug. > > > > > > The rest of patches make code cleaner and more robust. > > > > > > > > > > > > Michael S. Tsirkin (4): > > > > > > exec: don't ignore high address bits on lookup > > > > > > pci: fix address space size for bridge > > > > > > exec: don't ignore high address bits on set > > > > > > spapr_pci: s/INT64_MAX/UINT64_MAX/ > > > > > > > > > > > > Paolo Bonzini (1): > > > > > > pc: s/INT64_MAX/UINT64_MAX/ > > > > > > > > > > > > exec.c | 9 +++++++++ > > > > > > hw/i386/pc_piix.c | 2 +- > > > > > > hw/i386/pc_q35.c | 2 +- > > > > > > hw/pci/pci_bridge.c | 2 +- > > > > > > hw/ppc/spapr_pci.c | 2 +- > > > > > > 5 files changed, 13 insertions(+), 4 deletions(-) > > > > > > > > > > > > > > > > Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> > > > > > > > > > > > > > Please don't apply this. > > > > > > > > I didn't post the patches - I only sent them to Marcel :) > > > > And the reason is that the assert in exec. detects more bugs with > > > > over-writing page-tables: just run make check. > > > > > > > > I think we need to get a handle on them first before applying. > > > > > > > > > > Found the issues with make check, so that this series can be posted. > > > I'll send a proper patch tomorrow: > > > > Cool. So pls make this patch 1 and the rest can go on top. > > Also maybe add TARGET_PHYS_ADDR_SPACE_MAX to avoid > > TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > > UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS) > > everywhere. > > > Good idea, I'll use this. > > > though that is not a must. > > > > Does hw/ppc/spapr_vio.c need a patch too? > > Could not figure out where does the "as" come from there ... > > probably not an issue. > Wasn't needed for make check. That doesn't mean is not an issue. > > > We also need some more tests done. > That's for sure, in the mean time I'll put the assert inside > an ifdef as you suggested. > > Thanks, > Marcel maybe if (index > XXX) { #ifdef DEBUG fprintf(stderr, "scary warnings"); #endif return } so we don't corrupt pagetable .. > > > > > > > > diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c > > > index 59e1bb8..c203935 100644 > > > --- a/hw/alpha/typhoon.c > > > +++ b/hw/alpha/typhoon.c > > > @@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus, > > > > > > /* Host memory as seen from the PCI side, via the IOMMU. */ > > > memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops, > > > - "iommu-typhoon", UINT64_MAX); > > > + "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > > > + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); > > > address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci"); > > > pci_setup_iommu(b, typhoon_pci_dma_iommu, s); > > > > > > diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c > > > index ef45f4f..84b1309 100644 > > > --- a/hw/ppc/spapr_iommu.c > > > +++ b/hw/ppc/spapr_iommu.c > > > @@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev) > > > trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd); > > > > > > memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops, > > > - "iommu-spapr", UINT64_MAX); > > > + "iommu-spapr", > > > + TARGET_PHYS_ADDR_SPACE_BITS == 64 ? > > > + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); > > > > > > QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list); > > > > > > > > > Thanks, > > > Marcel > > > > > > > >
diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c index 59e1bb8..c203935 100644 --- a/hw/alpha/typhoon.c +++ b/hw/alpha/typhoon.c @@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus, /* Host memory as seen from the PCI side, via the IOMMU. */ memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops, - "iommu-typhoon", UINT64_MAX); + "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ? + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci"); pci_setup_iommu(b, typhoon_pci_dma_iommu, s); diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c index ef45f4f..84b1309 100644 --- a/hw/ppc/spapr_iommu.c +++ b/hw/ppc/spapr_iommu.c @@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev) trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd); memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops, - "iommu-spapr", UINT64_MAX); + "iommu-spapr", + TARGET_PHYS_ADDR_SPACE_BITS == 64 ? + UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)); QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);