From patchwork Sun Apr 15 18:38:59 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Andreas_F=C3=A4rber?= X-Patchwork-Id: 152704 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 67F69B6FE3 for ; Mon, 16 Apr 2012 05:55:06 +1000 (EST) Received: from localhost ([::1]:46538 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SJUNL-0002SU-62 for incoming@patchwork.ozlabs.org; Sun, 15 Apr 2012 14:40:39 -0400 Received: from eggs.gnu.org ([208.118.235.92]:37628) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SJUMO-0000O4-Di for qemu-devel@nongnu.org; Sun, 15 Apr 2012 14:39:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SJUMM-0002y5-4i for qemu-devel@nongnu.org; Sun, 15 Apr 2012 14:39:39 -0400 Received: from cantor2.suse.de ([195.135.220.15]:35652 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SJUML-0002wS-Or; Sun, 15 Apr 2012 14:39:38 -0400 Received: from relay1.suse.de (unknown [195.135.220.254]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx2.suse.de (Postfix) with ESMTP id 5877E8FFEB; Sun, 15 Apr 2012 20:39:36 +0200 (CEST) From: =?UTF-8?q?Andreas=20F=C3=A4rber?= To: qemu-devel@nongnu.org Date: Sun, 15 Apr 2012 20:38:59 +0200 Message-Id: <1334515144-26485-16-git-send-email-afaerber@suse.de> X-Mailer: git-send-email 1.7.7 In-Reply-To: <1334515144-26485-1-git-send-email-afaerber@suse.de> References: <1334515144-26485-1-git-send-email-afaerber@suse.de> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4-2.6 X-Received-From: 195.135.220.15 Cc: Anthony Liguori , "Michael S. Tsirkin" , Alexey Kardashevskiy , agraf@suse.de, blauwirbel@gmail.com, qemu-ppc@nongnu.org, =?UTF-8?q?Andreas=20F=C3=A4rber?= , David Gibson Subject: [Qemu-devel] [PATCH 15/20] pseries: Fix RTAS based config access X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: David Gibson On the pseries platform, access to PCI config space is via RTAS calls( which go to the hypervisor) rather than MMIO. This means we don't use the same code path as nearly everyone else which goes through pci_host.c and we're missing some of the parameter checking along the way. We do have some parameter checking in the RTAS calls, but it's not enough. It checks for overruns, but does not check for unaligned accesses, oversized accesses (which means the guest could trigger an assertion failure from pci_host_config_{read,write}_common(). Worse it doesn't do the basic checking for the number of RTAS arguments and results before accessing them. This patch fixes these bugs. Cc: Michael S. Tsirkin Signed-off-by: David Gibson [AF: Fix typos spotted by mst] Signed-off-by: Andreas Färber --- hw/spapr_pci.c | 117 +++++++++++++++++++++++++++++++++++++------------------ 1 files changed, 79 insertions(+), 38 deletions(-) diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c index e7ef551..a564c00 100644 --- a/hw/spapr_pci.c +++ b/hw/spapr_pci.c @@ -57,26 +57,38 @@ static PCIDevice *find_dev(sPAPREnvironment *spapr, static uint32_t rtas_pci_cfgaddr(uint32_t arg) { + /* This handles the encoding of extended config space addresses */ return ((arg >> 20) & 0xf00) | (arg & 0xff); } -static uint32_t rtas_read_pci_config_do(PCIDevice *pci_dev, uint32_t addr, - uint32_t limit, uint32_t len) +static void finish_read_pci_config(sPAPREnvironment *spapr, uint64_t buid, + uint32_t addr, uint32_t size, + target_ulong rets) { - if ((addr + len) <= limit) { - return pci_host_config_read_common(pci_dev, addr, limit, len); - } else { - return ~0x0; + PCIDevice *pci_dev; + uint32_t val; + + if ((size != 1) && (size != 2) && (size != 4)) { + /* access must be 1, 2 or 4 bytes */ + rtas_st(rets, 0, -1); + return; } -} -static void rtas_write_pci_config_do(PCIDevice *pci_dev, uint32_t addr, - uint32_t limit, uint32_t val, - uint32_t len) -{ - if ((addr + len) <= limit) { - pci_host_config_write_common(pci_dev, addr, limit, val, len); + pci_dev = find_dev(spapr, buid, addr); + addr = rtas_pci_cfgaddr(addr); + + if (!pci_dev || (addr % size) || (addr >= pci_config_size(pci_dev))) { + /* Access must be to a valid device, within bounds and + * naturally aligned */ + rtas_st(rets, 0, -1); + return; } + + val = pci_host_config_read_common(pci_dev, addr, + pci_config_size(pci_dev), size); + + rtas_st(rets, 0, 0); + rtas_st(rets, 1, val); } static void rtas_ibm_read_pci_config(sPAPREnvironment *spapr, @@ -84,19 +96,19 @@ static void rtas_ibm_read_pci_config(sPAPREnvironment *spapr, target_ulong args, uint32_t nret, target_ulong rets) { - uint32_t val, size, addr; - uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2); - PCIDevice *dev = find_dev(spapr, buid, rtas_ld(args, 0)); + uint64_t buid; + uint32_t size, addr; - if (!dev) { + if ((nargs != 4) || (nret != 2)) { rtas_st(rets, 0, -1); return; } + + buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2); size = rtas_ld(args, 3); - addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - val = rtas_read_pci_config_do(dev, addr, pci_config_size(dev), size); - rtas_st(rets, 0, 0); - rtas_st(rets, 1, val); + addr = rtas_ld(args, 0); + + finish_read_pci_config(spapr, buid, addr, size, rets); } static void rtas_read_pci_config(sPAPREnvironment *spapr, @@ -104,18 +116,45 @@ static void rtas_read_pci_config(sPAPREnvironment *spapr, target_ulong args, uint32_t nret, target_ulong rets) { - uint32_t val, size, addr; - PCIDevice *dev = find_dev(spapr, 0, rtas_ld(args, 0)); + uint32_t size, addr; - if (!dev) { + if ((nargs != 2) || (nret != 2)) { rtas_st(rets, 0, -1); return; } + size = rtas_ld(args, 1); - addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - val = rtas_read_pci_config_do(dev, addr, pci_config_size(dev), size); + addr = rtas_ld(args, 0); + + finish_read_pci_config(spapr, 0, addr, size, rets); +} + +static void finish_write_pci_config(sPAPREnvironment *spapr, uint64_t buid, + uint32_t addr, uint32_t size, + uint32_t val, target_ulong rets) +{ + PCIDevice *pci_dev; + + if ((size != 1) && (size != 2) && (size != 4)) { + /* access must be 1, 2 or 4 bytes */ + rtas_st(rets, 0, -1); + return; + } + + pci_dev = find_dev(spapr, buid, addr); + addr = rtas_pci_cfgaddr(addr); + + if (!pci_dev || (addr % size) || (addr >= pci_config_size(pci_dev))) { + /* Access must be to a valid device, within bounds and + * naturally aligned */ + rtas_st(rets, 0, -1); + return; + } + + pci_host_config_write_common(pci_dev, addr, pci_config_size(pci_dev), + val, size); + rtas_st(rets, 0, 0); - rtas_st(rets, 1, val); } static void rtas_ibm_write_pci_config(sPAPREnvironment *spapr, @@ -123,19 +162,20 @@ static void rtas_ibm_write_pci_config(sPAPREnvironment *spapr, target_ulong args, uint32_t nret, target_ulong rets) { + uint64_t buid; uint32_t val, size, addr; - uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2); - PCIDevice *dev = find_dev(spapr, buid, rtas_ld(args, 0)); - if (!dev) { + if ((nargs != 5) || (nret != 1)) { rtas_st(rets, 0, -1); return; } + + buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2); val = rtas_ld(args, 4); size = rtas_ld(args, 3); - addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - rtas_write_pci_config_do(dev, addr, pci_config_size(dev), val, size); - rtas_st(rets, 0, 0); + addr = rtas_ld(args, 0); + + finish_write_pci_config(spapr, buid, addr, size, val, rets); } static void rtas_write_pci_config(sPAPREnvironment *spapr, @@ -144,17 +184,18 @@ static void rtas_write_pci_config(sPAPREnvironment *spapr, uint32_t nret, target_ulong rets) { uint32_t val, size, addr; - PCIDevice *dev = find_dev(spapr, 0, rtas_ld(args, 0)); - if (!dev) { + if ((nargs != 3) || (nret != 1)) { rtas_st(rets, 0, -1); return; } + + val = rtas_ld(args, 2); size = rtas_ld(args, 1); - addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - rtas_write_pci_config_do(dev, addr, pci_config_size(dev), val, size); - rtas_st(rets, 0, 0); + addr = rtas_ld(args, 0); + + finish_write_pci_config(spapr, 0, addr, size, val, rets); } static int pci_spapr_map_irq(PCIDevice *pci_dev, int irq_num)