From: "Michael S. Tsirkin" <mst@redhat.com> To: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, cdall@kernel.org, marc.zyngier@arm.com, punit.agrawal@arm.com, will.deacon@arm.com, catalin.marinas@arm.com, pbonzini@redhat.com, rkrcmar@redhat.com, ard.biesheuvel@linaro.org, peter.maydell@linaro.org, kristina.martsenko@arm.com, mark.rutland@arm.com, Jason Wang <jasowang@redhat.com>, Jean-Philippe Brucker <jean-philippe.brucker@arm.com> Subject: Re: [PATCH v2 01/17] virtio: mmio-v1: Validate queue PFN Date: Tue, 27 Mar 2018 17:07:27 +0300 [thread overview] Message-ID: <20180327170119-mutt-send-email-mst@kernel.org> (raw) In-Reply-To: <1522156531-28348-2-git-send-email-suzuki.poulose@arm.com> On Tue, Mar 27, 2018 at 02:15:11PM +0100, Suzuki K Poulose wrote: > virtio-mmio with virtio-v1 uses a 32bit PFN for the queue. > If the queue pfn is too large to fit in 32bits, which > we could hit on arm64 systems with 52bit physical addresses > (even with 64K page size), we simply miss out a proper link > to the other side of the queue. > > Add a check to validate the PFN, rather than silently breaking > the devices. > > Cc: "Michael S. Tsirkin" <mst@redhat.com> > Cc: Jason Wang <jasowang@redhat.com> > Cc: Marc Zyngier <marc.zyngier@arm.com> > Cc: Christoffer Dall <cdall@kernel.org> > Cc: Peter Maydel <peter.maydell@linaro.org> > Cc: Jean-Philippe Brucker <jean-philippe.brucker@arm.com> > Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> OK - seems harmless so I will queue this. But I really think effort should be spent on adding v1.0 support in QEMU. > --- > drivers/virtio/virtio_mmio.c | 18 ++++++++++++++++-- > 1 file changed, 16 insertions(+), 2 deletions(-) > > diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c > index 67763d3..b2f9b5c 100644 > --- a/drivers/virtio/virtio_mmio.c > +++ b/drivers/virtio/virtio_mmio.c > @@ -397,9 +397,21 @@ static struct virtqueue *vm_setup_vq(struct virtio_device *vdev, unsigned index, > /* Activate the queue */ > writel(virtqueue_get_vring_size(vq), vm_dev->base + VIRTIO_MMIO_QUEUE_NUM); > if (vm_dev->version == 1) { > + u64 q_pfn = virtqueue_get_desc_addr(vq) >> PAGE_SHIFT; > + > + /* > + * virtio-mmio v1 uses a 32bit QUEUE PFN. If we have something > + * that doesn't fit in 32bit, fail the setup rather than > + * pretending to be successful. > + */ > + if (q_pfn >> 32) { > + dev_err(&vdev->dev, "virtio-mmio: queue address too large\n"); > + err = -ENOMEM; > + goto error_bad_pfn; > + } > + > writel(PAGE_SIZE, vm_dev->base + VIRTIO_MMIO_QUEUE_ALIGN); > - writel(virtqueue_get_desc_addr(vq) >> PAGE_SHIFT, > - vm_dev->base + VIRTIO_MMIO_QUEUE_PFN); > + writel(q_pfn, vm_dev->base + VIRTIO_MMIO_QUEUE_PFN); > } else { > u64 addr; > > @@ -430,6 +442,8 @@ static struct virtqueue *vm_setup_vq(struct virtio_device *vdev, unsigned index, > > return vq; > > +error_bad_pfn: > + vring_del_virtqueue(vq); > error_new_virtqueue: > if (vm_dev->version == 1) { > writel(0, vm_dev->base + VIRTIO_MMIO_QUEUE_PFN); > -- > 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: mst@redhat.com (Michael S. Tsirkin) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v2 01/17] virtio: mmio-v1: Validate queue PFN Date: Tue, 27 Mar 2018 17:07:27 +0300 [thread overview] Message-ID: <20180327170119-mutt-send-email-mst@kernel.org> (raw) In-Reply-To: <1522156531-28348-2-git-send-email-suzuki.poulose@arm.com> On Tue, Mar 27, 2018 at 02:15:11PM +0100, Suzuki K Poulose wrote: > virtio-mmio with virtio-v1 uses a 32bit PFN for the queue. > If the queue pfn is too large to fit in 32bits, which > we could hit on arm64 systems with 52bit physical addresses > (even with 64K page size), we simply miss out a proper link > to the other side of the queue. > > Add a check to validate the PFN, rather than silently breaking > the devices. > > Cc: "Michael S. Tsirkin" <mst@redhat.com> > Cc: Jason Wang <jasowang@redhat.com> > Cc: Marc Zyngier <marc.zyngier@arm.com> > Cc: Christoffer Dall <cdall@kernel.org> > Cc: Peter Maydel <peter.maydell@linaro.org> > Cc: Jean-Philippe Brucker <jean-philippe.brucker@arm.com> > Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> OK - seems harmless so I will queue this. But I really think effort should be spent on adding v1.0 support in QEMU. > --- > drivers/virtio/virtio_mmio.c | 18 ++++++++++++++++-- > 1 file changed, 16 insertions(+), 2 deletions(-) > > diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c > index 67763d3..b2f9b5c 100644 > --- a/drivers/virtio/virtio_mmio.c > +++ b/drivers/virtio/virtio_mmio.c > @@ -397,9 +397,21 @@ static struct virtqueue *vm_setup_vq(struct virtio_device *vdev, unsigned index, > /* Activate the queue */ > writel(virtqueue_get_vring_size(vq), vm_dev->base + VIRTIO_MMIO_QUEUE_NUM); > if (vm_dev->version == 1) { > + u64 q_pfn = virtqueue_get_desc_addr(vq) >> PAGE_SHIFT; > + > + /* > + * virtio-mmio v1 uses a 32bit QUEUE PFN. If we have something > + * that doesn't fit in 32bit, fail the setup rather than > + * pretending to be successful. > + */ > + if (q_pfn >> 32) { > + dev_err(&vdev->dev, "virtio-mmio: queue address too large\n"); > + err = -ENOMEM; > + goto error_bad_pfn; > + } > + > writel(PAGE_SIZE, vm_dev->base + VIRTIO_MMIO_QUEUE_ALIGN); > - writel(virtqueue_get_desc_addr(vq) >> PAGE_SHIFT, > - vm_dev->base + VIRTIO_MMIO_QUEUE_PFN); > + writel(q_pfn, vm_dev->base + VIRTIO_MMIO_QUEUE_PFN); > } else { > u64 addr; > > @@ -430,6 +442,8 @@ static struct virtqueue *vm_setup_vq(struct virtio_device *vdev, unsigned index, > > return vq; > > +error_bad_pfn: > + vring_del_virtqueue(vq); > error_new_virtqueue: > if (vm_dev->version == 1) { > writel(0, vm_dev->base + VIRTIO_MMIO_QUEUE_PFN); > -- > 2.7.4
next prev parent reply other threads:[~2018-03-27 14:07 UTC|newest] Thread overview: 113+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-03-27 13:15 [PATCH v2 00/17] kvm: arm64: Dynamic & 52bit IPA support Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 01/17] virtio: mmio-v1: Validate queue PFN Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 14:07 ` Michael S. Tsirkin [this message] 2018-03-27 14:07 ` Michael S. Tsirkin 2018-03-27 13:15 ` [PATCH v2 02/17] virtio: pci-legacy: Validate queue pfn Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 14:11 ` Michael S. Tsirkin 2018-03-27 14:11 ` Michael S. Tsirkin 2018-07-13 0:36 ` Michael S. Tsirkin 2018-07-13 0:36 ` Michael S. Tsirkin 2018-07-13 8:54 ` Suzuki K Poulose 2018-07-13 8:54 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 03/17] arm64: Make page table helpers reusable Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-26 10:54 ` Julien Grall 2018-04-26 10:54 ` Julien Grall 2018-03-27 13:15 ` [PATCH v2 04/17] arm64: Refactor pud_huge for reusability Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-26 10:55 ` Julien Grall 2018-04-26 10:55 ` Julien Grall 2018-03-27 13:15 ` [PATCH v2 05/17] arm64: Helper for parange to PASize Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-26 10:58 ` Julien Grall 2018-04-26 10:58 ` Julien Grall 2018-04-27 15:18 ` Suzuki K Poulose 2018-04-27 15:18 ` Suzuki K Poulose 2018-04-27 15:18 ` Julien Grall 2018-04-27 15:18 ` Julien Grall 2018-05-03 14:39 ` James Morse 2018-05-03 14:39 ` James Morse 2018-05-08 13:47 ` Suzuki K Poulose 2018-05-08 13:47 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 06/17] kvm: arm/arm64: Fix stage2_flush_memslot for 4 level page table Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 07/17] kvm: arm/arm64: Remove spurious WARN_ON Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 08/17] kvm: arm/arm64: Prepare for VM specific stage2 translations Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-26 13:35 ` Julien Grall 2018-04-26 13:35 ` Julien Grall 2018-04-27 15:22 ` Suzuki K Poulose 2018-04-27 15:22 ` Suzuki K Poulose 2018-04-27 15:58 ` Suzuki K Poulose 2018-04-27 15:58 ` Suzuki K Poulose 2018-04-27 16:04 ` Julien Grall 2018-04-27 16:04 ` Julien Grall 2018-03-27 13:15 ` [PATCH v2 09/17] kvm: arm64: Make stage2 page table layout dynamic Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-25 16:35 ` Julien Grall 2018-04-25 16:35 ` Julien Grall 2018-04-25 16:37 ` Suzuki K Poulose 2018-04-25 16:37 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 10/17] kvm: arm64: Dynamic configuration of VTCR and VTTBR mask Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-30 11:14 ` Julien Grall 2018-04-30 11:14 ` Julien Grall 2018-03-27 13:15 ` [PATCH v2 11/17] kvm: arm64: Configure VTCR per VM Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-03 14:58 ` James Morse 2018-04-03 14:58 ` James Morse 2018-04-03 15:44 ` Suzuki K Poulose 2018-04-03 15:44 ` Suzuki K Poulose 2018-05-03 14:39 ` James Morse 2018-05-03 14:39 ` James Morse 2018-05-08 11:16 ` Suzuki K Poulose 2018-05-08 11:16 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 12/17] kvm: arm/arm64: Expose supported physical address limit for VM Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-13 13:21 ` Peter Maydell 2018-04-13 13:21 ` Peter Maydell 2018-04-16 10:23 ` Suzuki K Poulose 2018-04-16 10:23 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 13/17] kvm: arm/arm64: Allow tuning the physical address size " Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-25 16:10 ` Julien Grall 2018-04-25 16:10 ` Julien Grall 2018-04-25 16:22 ` Suzuki K Poulose 2018-04-25 16:22 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 14/17] kvm: arm64: Switch to per VM IPA limit Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-13 16:27 ` Punit Agrawal 2018-04-13 16:27 ` Punit Agrawal 2018-04-16 10:25 ` Suzuki K Poulose 2018-04-16 10:25 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 15/17] vgic: Add support for 52bit guest physical address Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 16/17] kvm: arm64: Add support for handling 52bit IPA Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [PATCH v2 17/17] kvm: arm64: Allow IPA size supported by the system Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [kvmtool PATCH 18/17] kvmtool: Allow backends to run checks on the KVM device fd Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [kvmtool PATCH 19/17] kvmtool: arm64: Add support for guest physical address size Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-03-27 13:15 ` [kvmtool PATCH 20/17] kvmtool: arm64: Switch memory layout Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-03 12:34 ` Jean-Philippe Brucker 2018-04-03 12:34 ` Jean-Philippe Brucker 2018-03-27 13:15 ` [kvmtool PATCH 21/17] kvmtool: arm: Add support for creating VM with PA size Suzuki K Poulose 2018-03-27 13:15 ` Suzuki K Poulose 2018-04-26 14:08 ` Julien Grall 2018-04-26 14:08 ` Julien Grall 2018-04-30 14:17 ` Julien Grall 2018-04-30 14:17 ` Julien Grall 2018-04-30 14:18 ` Suzuki K Poulose 2018-04-30 14:18 ` Suzuki K Poulose
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180327170119-mutt-send-email-mst@kernel.org \ --to=mst@redhat.com \ --cc=ard.biesheuvel@linaro.org \ --cc=catalin.marinas@arm.com \ --cc=cdall@kernel.org \ --cc=jasowang@redhat.com \ --cc=jean-philippe.brucker@arm.com \ --cc=kristina.martsenko@arm.com \ --cc=kvm@vger.kernel.org \ --cc=kvmarm@lists.cs.columbia.edu \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=marc.zyngier@arm.com \ --cc=mark.rutland@arm.com \ --cc=pbonzini@redhat.com \ --cc=peter.maydell@linaro.org \ --cc=punit.agrawal@arm.com \ --cc=rkrcmar@redhat.com \ --cc=suzuki.poulose@arm.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.