Patchwork [for-1.7,0/5] fix address space size issues

login
register
mail settings
Submitter Marcel Apfelbaum
Date Nov. 6, 2013, 10:09 p.m.
Message ID <1383775790.2527.41.camel@localhost.localdomain>
Download mbox | patch
Permalink /patch/289036/
State New
Headers show

Comments

Marcel Apfelbaum - Nov. 6, 2013, 10:09 p.m.
On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote:
> On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote:
> > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote:
> > > A bug reported by Luiz Capitulino let us to find
> > > several bugs in memory address space setup.
> > > 
> > > One issue is that gdb stub can give us arbitrary addresses
> > > and we'll try to access them.
> > > Since our lookup ignored high bits in the address,
> > > we hit a wrong section and got a crash.
> > > In fact, PCI devices can access arbitrary addresses too,
> > > so we should just make lookup robust against this case.
> > > 
> > > Another issue has to do with size of regions.
> > > memory API uses UINT64_MAX so say "all 64 bit" but
> > > some devices mistakenly used INT64_MAX.
> > > 
> > > It should not affect most systems in practice as
> > > everything should be limited by address space size,
> > > but it's an API misuse that we should not keep around,
> > > and it will become a problem if a system with 64 bit
> > > target address hits this path.
> > > 
> > > Patch 1 fixes an actual bug.
> > > The rest of patches make code cleaner and more robust.
> > > 
> > > Michael S. Tsirkin (4):
> > >   exec: don't ignore high address bits on lookup
> > >   pci: fix address space size for bridge
> > >   exec: don't ignore high address bits on set
> > >   spapr_pci: s/INT64_MAX/UINT64_MAX/
> > > 
> > > Paolo Bonzini (1):
> > >   pc: s/INT64_MAX/UINT64_MAX/
> > > 
> > >  exec.c              | 9 +++++++++
> > >  hw/i386/pc_piix.c   | 2 +-
> > >  hw/i386/pc_q35.c    | 2 +-
> > >  hw/pci/pci_bridge.c | 2 +-
> > >  hw/ppc/spapr_pci.c  | 2 +-
> > >  5 files changed, 13 insertions(+), 4 deletions(-)
> > > 
> > 
> > Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com>
> > 
> 
> Please don't apply this.
> 
> I didn't post the patches - I only sent them to Marcel :)
> And the reason is that the assert in exec. detects more bugs with
> over-writing page-tables: just run make check.
> 
> I think we need to get a handle on them first before applying.
> 

Found the issues with make check, so that this series can be posted.
I'll send a proper patch tomorrow:



Thanks,
Marcel
Michael S. Tsirkin - Nov. 6, 2013, 10:20 p.m.
On Thu, Nov 07, 2013 at 12:09:50AM +0200, Marcel Apfelbaum wrote:
> On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote:
> > On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote:
> > > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote:
> > > > A bug reported by Luiz Capitulino let us to find
> > > > several bugs in memory address space setup.
> > > > 
> > > > One issue is that gdb stub can give us arbitrary addresses
> > > > and we'll try to access them.
> > > > Since our lookup ignored high bits in the address,
> > > > we hit a wrong section and got a crash.
> > > > In fact, PCI devices can access arbitrary addresses too,
> > > > so we should just make lookup robust against this case.
> > > > 
> > > > Another issue has to do with size of regions.
> > > > memory API uses UINT64_MAX so say "all 64 bit" but
> > > > some devices mistakenly used INT64_MAX.
> > > > 
> > > > It should not affect most systems in practice as
> > > > everything should be limited by address space size,
> > > > but it's an API misuse that we should not keep around,
> > > > and it will become a problem if a system with 64 bit
> > > > target address hits this path.
> > > > 
> > > > Patch 1 fixes an actual bug.
> > > > The rest of patches make code cleaner and more robust.
> > > > 
> > > > Michael S. Tsirkin (4):
> > > >   exec: don't ignore high address bits on lookup
> > > >   pci: fix address space size for bridge
> > > >   exec: don't ignore high address bits on set
> > > >   spapr_pci: s/INT64_MAX/UINT64_MAX/
> > > > 
> > > > Paolo Bonzini (1):
> > > >   pc: s/INT64_MAX/UINT64_MAX/
> > > > 
> > > >  exec.c              | 9 +++++++++
> > > >  hw/i386/pc_piix.c   | 2 +-
> > > >  hw/i386/pc_q35.c    | 2 +-
> > > >  hw/pci/pci_bridge.c | 2 +-
> > > >  hw/ppc/spapr_pci.c  | 2 +-
> > > >  5 files changed, 13 insertions(+), 4 deletions(-)
> > > > 
> > > 
> > > Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com>
> > > 
> > 
> > Please don't apply this.
> > 
> > I didn't post the patches - I only sent them to Marcel :)
> > And the reason is that the assert in exec. detects more bugs with
> > over-writing page-tables: just run make check.
> > 
> > I think we need to get a handle on them first before applying.
> > 
> 
> Found the issues with make check, so that this series can be posted.
> I'll send a proper patch tomorrow:

Cool. So pls make this patch 1 and the rest can go on top.
Also maybe add TARGET_PHYS_ADDR_SPACE_MAX to avoid
 TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
                            UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)
everywhere.

though that is not a must.

Does hw/ppc/spapr_vio.c need a patch too?
Could not figure out where does the "as" come from there ...
probably not an issue.

We also need some more tests done.

> 
> diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
> index 59e1bb8..c203935 100644
> --- a/hw/alpha/typhoon.c
> +++ b/hw/alpha/typhoon.c
> @@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
>  
>      /* Host memory as seen from the PCI side, via the IOMMU.  */
>      memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops,
> -                             "iommu-typhoon", UINT64_MAX);
> +                             "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
> +                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
>      address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci");
>      pci_setup_iommu(b, typhoon_pci_dma_iommu, s);
>  
> diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
> index ef45f4f..84b1309 100644
> --- a/hw/ppc/spapr_iommu.c
> +++ b/hw/ppc/spapr_iommu.c
> @@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev)
>      trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd);
>  
>      memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
> -                             "iommu-spapr", UINT64_MAX);
> +                             "iommu-spapr",
> +                             TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
> +                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
>  
>      QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
> 
> 
> Thanks,
> Marcel
> 
>
Marcel Apfelbaum - Nov. 6, 2013, 10:22 p.m.
On Thu, 2013-11-07 at 00:20 +0200, Michael S. Tsirkin wrote:
> On Thu, Nov 07, 2013 at 12:09:50AM +0200, Marcel Apfelbaum wrote:
> > On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote:
> > > On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote:
> > > > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote:
> > > > > A bug reported by Luiz Capitulino let us to find
> > > > > several bugs in memory address space setup.
> > > > > 
> > > > > One issue is that gdb stub can give us arbitrary addresses
> > > > > and we'll try to access them.
> > > > > Since our lookup ignored high bits in the address,
> > > > > we hit a wrong section and got a crash.
> > > > > In fact, PCI devices can access arbitrary addresses too,
> > > > > so we should just make lookup robust against this case.
> > > > > 
> > > > > Another issue has to do with size of regions.
> > > > > memory API uses UINT64_MAX so say "all 64 bit" but
> > > > > some devices mistakenly used INT64_MAX.
> > > > > 
> > > > > It should not affect most systems in practice as
> > > > > everything should be limited by address space size,
> > > > > but it's an API misuse that we should not keep around,
> > > > > and it will become a problem if a system with 64 bit
> > > > > target address hits this path.
> > > > > 
> > > > > Patch 1 fixes an actual bug.
> > > > > The rest of patches make code cleaner and more robust.
> > > > > 
> > > > > Michael S. Tsirkin (4):
> > > > >   exec: don't ignore high address bits on lookup
> > > > >   pci: fix address space size for bridge
> > > > >   exec: don't ignore high address bits on set
> > > > >   spapr_pci: s/INT64_MAX/UINT64_MAX/
> > > > > 
> > > > > Paolo Bonzini (1):
> > > > >   pc: s/INT64_MAX/UINT64_MAX/
> > > > > 
> > > > >  exec.c              | 9 +++++++++
> > > > >  hw/i386/pc_piix.c   | 2 +-
> > > > >  hw/i386/pc_q35.c    | 2 +-
> > > > >  hw/pci/pci_bridge.c | 2 +-
> > > > >  hw/ppc/spapr_pci.c  | 2 +-
> > > > >  5 files changed, 13 insertions(+), 4 deletions(-)
> > > > > 
> > > > 
> > > > Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com>
> > > > 
> > > 
> > > Please don't apply this.
> > > 
> > > I didn't post the patches - I only sent them to Marcel :)
> > > And the reason is that the assert in exec. detects more bugs with
> > > over-writing page-tables: just run make check.
> > > 
> > > I think we need to get a handle on them first before applying.
> > > 
> > 
> > Found the issues with make check, so that this series can be posted.
> > I'll send a proper patch tomorrow:
> 
> Cool. So pls make this patch 1 and the rest can go on top.
> Also maybe add TARGET_PHYS_ADDR_SPACE_MAX to avoid
>  TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
>                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)
> everywhere.
> 
Good idea, I'll use this.

> though that is not a must.
> 
> Does hw/ppc/spapr_vio.c need a patch too?
> Could not figure out where does the "as" come from there ...
> probably not an issue.
Wasn't needed for make check. That doesn't mean is not an issue.

> We also need some more tests done.
That's for sure, in the mean time I'll put the assert inside
an ifdef as you suggested.

Thanks,
Marcel

> 
> > 
> > diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
> > index 59e1bb8..c203935 100644
> > --- a/hw/alpha/typhoon.c
> > +++ b/hw/alpha/typhoon.c
> > @@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
> >  
> >      /* Host memory as seen from the PCI side, via the IOMMU.  */
> >      memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops,
> > -                             "iommu-typhoon", UINT64_MAX);
> > +                             "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
> > +                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
> >      address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci");
> >      pci_setup_iommu(b, typhoon_pci_dma_iommu, s);
> >  
> > diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
> > index ef45f4f..84b1309 100644
> > --- a/hw/ppc/spapr_iommu.c
> > +++ b/hw/ppc/spapr_iommu.c
> > @@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev)
> >      trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd);
> >  
> >      memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
> > -                             "iommu-spapr", UINT64_MAX);
> > +                             "iommu-spapr",
> > +                             TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
> > +                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
> >  
> >      QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
> > 
> > 
> > Thanks,
> > Marcel
> > 
> >
Michael S. Tsirkin - Nov. 6, 2013, 10:37 p.m.
On Thu, Nov 07, 2013 at 12:22:29AM +0200, Marcel Apfelbaum wrote:
> On Thu, 2013-11-07 at 00:20 +0200, Michael S. Tsirkin wrote:
> > On Thu, Nov 07, 2013 at 12:09:50AM +0200, Marcel Apfelbaum wrote:
> > > On Wed, 2013-11-06 at 22:13 +0200, Michael S. Tsirkin wrote:
> > > > On Wed, Nov 06, 2013 at 09:54:03PM +0200, Marcel Apfelbaum wrote:
> > > > > On Wed, 2013-11-06 at 20:47 +0200, Michael S. Tsirkin wrote:
> > > > > > A bug reported by Luiz Capitulino let us to find
> > > > > > several bugs in memory address space setup.
> > > > > > 
> > > > > > One issue is that gdb stub can give us arbitrary addresses
> > > > > > and we'll try to access them.
> > > > > > Since our lookup ignored high bits in the address,
> > > > > > we hit a wrong section and got a crash.
> > > > > > In fact, PCI devices can access arbitrary addresses too,
> > > > > > so we should just make lookup robust against this case.
> > > > > > 
> > > > > > Another issue has to do with size of regions.
> > > > > > memory API uses UINT64_MAX so say "all 64 bit" but
> > > > > > some devices mistakenly used INT64_MAX.
> > > > > > 
> > > > > > It should not affect most systems in practice as
> > > > > > everything should be limited by address space size,
> > > > > > but it's an API misuse that we should not keep around,
> > > > > > and it will become a problem if a system with 64 bit
> > > > > > target address hits this path.
> > > > > > 
> > > > > > Patch 1 fixes an actual bug.
> > > > > > The rest of patches make code cleaner and more robust.
> > > > > > 
> > > > > > Michael S. Tsirkin (4):
> > > > > >   exec: don't ignore high address bits on lookup
> > > > > >   pci: fix address space size for bridge
> > > > > >   exec: don't ignore high address bits on set
> > > > > >   spapr_pci: s/INT64_MAX/UINT64_MAX/
> > > > > > 
> > > > > > Paolo Bonzini (1):
> > > > > >   pc: s/INT64_MAX/UINT64_MAX/
> > > > > > 
> > > > > >  exec.c              | 9 +++++++++
> > > > > >  hw/i386/pc_piix.c   | 2 +-
> > > > > >  hw/i386/pc_q35.c    | 2 +-
> > > > > >  hw/pci/pci_bridge.c | 2 +-
> > > > > >  hw/ppc/spapr_pci.c  | 2 +-
> > > > > >  5 files changed, 13 insertions(+), 4 deletions(-)
> > > > > > 
> > > > > 
> > > > > Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com>
> > > > > 
> > > > 
> > > > Please don't apply this.
> > > > 
> > > > I didn't post the patches - I only sent them to Marcel :)
> > > > And the reason is that the assert in exec. detects more bugs with
> > > > over-writing page-tables: just run make check.
> > > > 
> > > > I think we need to get a handle on them first before applying.
> > > > 
> > > 
> > > Found the issues with make check, so that this series can be posted.
> > > I'll send a proper patch tomorrow:
> > 
> > Cool. So pls make this patch 1 and the rest can go on top.
> > Also maybe add TARGET_PHYS_ADDR_SPACE_MAX to avoid
> >  TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
> >                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS)
> > everywhere.
> > 
> Good idea, I'll use this.
> 
> > though that is not a must.
> > 
> > Does hw/ppc/spapr_vio.c need a patch too?
> > Could not figure out where does the "as" come from there ...
> > probably not an issue.
> Wasn't needed for make check. That doesn't mean is not an issue.
> 
> > We also need some more tests done.
> That's for sure, in the mean time I'll put the assert inside
> an ifdef as you suggested.
> 
> Thanks,
> Marcel


maybe 

if (index > XXX) {
#ifdef DEBUG
	fprintf(stderr, "scary warnings");
#endif
	return
}

so we don't corrupt pagetable ..

> > 
> > > 
> > > diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
> > > index 59e1bb8..c203935 100644
> > > --- a/hw/alpha/typhoon.c
> > > +++ b/hw/alpha/typhoon.c
> > > @@ -888,7 +888,8 @@ PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
> > >  
> > >      /* Host memory as seen from the PCI side, via the IOMMU.  */
> > >      memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops,
> > > -                             "iommu-typhoon", UINT64_MAX);
> > > +                             "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
> > > +                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
> > >      address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci");
> > >      pci_setup_iommu(b, typhoon_pci_dma_iommu, s);
> > >  
> > > diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
> > > index ef45f4f..84b1309 100644
> > > --- a/hw/ppc/spapr_iommu.c
> > > +++ b/hw/ppc/spapr_iommu.c
> > > @@ -136,7 +136,9 @@ static int spapr_tce_table_realize(DeviceState *dev)
> > >      trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd);
> > >  
> > >      memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
> > > -                             "iommu-spapr", UINT64_MAX);
> > > +                             "iommu-spapr",
> > > +                             TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
> > > +                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
> > >  
> > >      QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);
> > > 
> > > 
> > > Thanks,
> > > Marcel
> > > 
> > > 
> 
>

Patch

diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c
index 59e1bb8..c203935 100644
--- a/hw/alpha/typhoon.c
+++ b/hw/alpha/typhoon.c
@@ -888,7 +888,8 @@  PCIBus *typhoon_init(ram_addr_t ram_size, ISABus **isa_bus,
 
     /* Host memory as seen from the PCI side, via the IOMMU.  */
     memory_region_init_iommu(&s->pchip.iommu, OBJECT(s), &typhoon_iommu_ops,
-                             "iommu-typhoon", UINT64_MAX);
+                             "iommu-typhoon", TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
+                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
     address_space_init(&s->pchip.iommu_as, &s->pchip.iommu, "pchip0-pci");
     pci_setup_iommu(b, typhoon_pci_dma_iommu, s);
 
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index ef45f4f..84b1309 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -136,7 +136,9 @@  static int spapr_tce_table_realize(DeviceState *dev)
     trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd);
 
     memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,
-                             "iommu-spapr", UINT64_MAX);
+                             "iommu-spapr",
+                             TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
+                             UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
 
     QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);