xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-23 19:49:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

hw/usb/hcd-xhci: Check whether DMA accesses fail

Browse Source 
If a guest sets up bad descriptors, it could force QEMU to access
non-existing memory regions. Thus we should check the return value
of dma_memory_read/write() to make sure that these errors don't go
unnoticed.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220817160016.49752-1-thuth@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Thomas Huth 2022-08-17 18:00:16 +02:00 committed by Gerd Hoffmann
parent 17b55372b5
commit 0b33bb394d
1 changed files with 48 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
hw/usb/hcd-xhci.c
View File

@ -463,6 +463,12 @@ static void xhci_mfwrap_timer(void *opaque)
xhci_mfwrap_update(xhci);
}
static void xhci_die(XHCIState *xhci)
{
xhci->usbsts |= USBSTS_HCE;
DPRINTF("xhci: asserted controller error\n");
}
static inline dma_addr_t xhci_addr64(uint32_t low, uint32_t high)
{
if (sizeof(dma_addr_t) == 4) {
@ -488,7 +494,14 @@ static inline void xhci_dma_read_u32s(XHCIState *xhci, dma_addr_t addr,
assert((len % sizeof(uint32_t)) == 0);
dma_memory_read(xhci->as, addr, buf, len, MEMTXATTRS_UNSPECIFIED);
if (dma_memory_read(xhci->as, addr, buf, len,
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
__func__);
memset(buf, 0xff, len);
xhci_die(xhci);
return;
}
for (i = 0; i < (len / sizeof(uint32_t)); i++) {
buf[i] = le32_to_cpu(buf[i]);
@ -496,7 +509,7 @@ static inline void xhci_dma_read_u32s(XHCIState *xhci, dma_addr_t addr,
}
static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr,
uint32_t *buf, size_t len)
const uint32_t *buf, size_t len)
{
int i;
uint32_t tmp[5];
@ -508,7 +521,13 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr,
for (i = 0; i < n; i++) {
tmp[i] = cpu_to_le32(buf[i]);
}
dma_memory_write(xhci->as, addr, tmp, len, MEMTXATTRS_UNSPECIFIED);
if (dma_memory_write(xhci->as, addr, tmp, len,
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
__func__);
xhci_die(xhci);
return;
}
}
static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
@ -593,12 +612,6 @@ static inline int xhci_running(XHCIState *xhci)
return !(xhci->usbsts & USBSTS_HCH);
}
static void xhci_die(XHCIState *xhci)
{
xhci->usbsts |= USBSTS_HCE;
DPRINTF("xhci: asserted controller error\n");
}
static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
{
XHCIInterrupter *intr = &xhci->intr[v];
@ -619,7 +632,12 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v)
ev_trb.status, ev_trb.control);
addr = intr->er_start + TRB_SIZE*intr->er_ep_idx;
dma_memory_write(xhci->as, addr, &ev_trb, TRB_SIZE, MEMTXATTRS_UNSPECIFIED);
if (dma_memory_write(xhci->as, addr, &ev_trb, TRB_SIZE,
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
__func__);
xhci_die(xhci);
}
intr->er_ep_idx++;
if (intr->er_ep_idx >= intr->er_size) {
@ -680,8 +698,12 @@ static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
while (1) {
TRBType type;
dma_memory_read(xhci->as, ring->dequeue, trb, TRB_SIZE,
MEMTXATTRS_UNSPECIFIED);
if (dma_memory_read(xhci->as, ring->dequeue, trb, TRB_SIZE,
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
__func__);
return 0;
}
trb->addr = ring->dequeue;
trb->ccs = ring->ccs;
le64_to_cpus(&trb->parameter);
@ -798,8 +820,14 @@ static void xhci_er_reset(XHCIState *xhci, int v)
xhci_die(xhci);
return;
}
dma_memory_read(xhci->as, erstba, &seg, sizeof(seg),
MEMTXATTRS_UNSPECIFIED);
if (dma_memory_read(xhci->as, erstba, &seg, sizeof(seg),
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n",
__func__);
xhci_die(xhci);
return;
}
le32_to_cpus(&seg.addr_low);
le32_to_cpus(&seg.addr_high);
le32_to_cpus(&seg.size);
@ -2415,8 +2443,12 @@ static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
/* TODO: actually implement real values here */
bw_ctx[0] = 0;
memset(&bw_ctx[1], 80, xhci->numports); /* 80% */
dma_memory_write(xhci->as, ctx, bw_ctx, sizeof(bw_ctx),
MEMTXATTRS_UNSPECIFIED);
if (dma_memory_write(xhci->as, ctx, bw_ctx, sizeof(bw_ctx),
MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory write failed!\n",
__func__);
return CC_TRB_ERROR;
}
return CC_SUCCESS;
}