From nobody Sat May 18 04:29:54 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1666971373; cv=none; d=zohomail.com; s=zohoarc; b=RtPsyb3N/kvh7cjhzQ3P+dwjY0OWScogPFerxE1VyBSIWidWZsrFUCEfMHVotsbVGFP9jLGsqUTRe8a8BEmDc7AOQ54O0F4pVdS5Dpe87ReSeD5EvxhF9g8qIHgJodKUwPr53f9oxYmcB662336RRZz1yVMP3CS8dwfAj9A9ckE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1666971373; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=Qj8bRKaZuDAtvv39+zS/1lG63F4LiPgPvyQIhmOrGl0=; b=n+Y7kaJewZn1fK3bcnw43U67xa1Knnt5k0wJxs+ejGBvTAe8msJ9OK6fM0hA0yUpXJsK9tM6C61mrGGVXtxR4OX4n2Pj2X2KfFf8eHKZI3PgCY7W80ypZ1/lT6H4rfh5l80Y+R1+PvgrwWMyGTpsTKCiWidlzK4o0JDp1VZLpX8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1666971373061109.595594209468; Fri, 28 Oct 2022 08:36:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ooRON-0007ql-Iv; Fri, 28 Oct 2022 11:35:31 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ooROJ-0007nt-Fj for qemu-devel@nongnu.org; Fri, 28 Oct 2022 11:35:29 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ooROH-000192-N4 for qemu-devel@nongnu.org; Fri, 28 Oct 2022 11:35:27 -0400 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-574-78U549wvNA2tQX4KZKbc1g-1; Fri, 28 Oct 2022 11:35:21 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B2BBA185A794; Fri, 28 Oct 2022 15:35:20 +0000 (UTC) Received: from f36-work.redhat.com (unknown [10.39.192.98]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 96B7E2024CB7; Fri, 28 Oct 2022 15:35:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1666971324; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Qj8bRKaZuDAtvv39+zS/1lG63F4LiPgPvyQIhmOrGl0=; b=GnTCxynM+D9NX+KorgBZ4IpCOGTo5qOiDuUG3jJTFycHagxjI07Ec5Sna5pVLXtDVgx0B8 wb97qe4gm8zRskYEvwZateMKSCW3xz2heF/6C1NwPqykL0Fcp23f5QGKPVQyxRSBO3zth1 Fizw6N1MdNnjlnR2Lft6td75B9BsGLo= X-MC-Unique: 78U549wvNA2tQX4KZKbc1g-1 From: Mauro Matteo Cascella To: qemu-devel@nongnu.org Cc: mcascell@redhat.com, coc.cyqh@gmail.com, philmd@linaro.org, bin.meng@windriver.com Subject: [PATCH] hw/sd/sdhci: further prohibit DMA accesses to devices Date: Fri, 28 Oct 2022 17:35:11 +0200 Message-Id: <20221028153511.932642-1-mcascell@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.1 on 10.11.54.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=mcascell@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -25 X-Spam_score: -2.6 X-Spam_bar: -- X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.516, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Qemu-devel" Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1666971374144100003 Content-Type: text/plain; charset="utf-8" Commit 799f7f01 left some DMA calls unprotected. Let's patch them. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1282 Reported-by: Siqi Chen Signed-off-by: Mauro Matteo Cascella --- hw/sd/sdhci.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 0e5e988927..c6ee24cde1 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -585,6 +585,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState= *s) const uint16_t block_size =3D s->blksize & BLOCK_SIZE_MASK; uint32_t boundary_chk =3D 1 << (((s->blksize & ~BLOCK_SIZE_MASK) >> 12= ) + 12); uint32_t boundary_count =3D boundary_chk - (s->sdmasysad % boundary_ch= k); + const MemTxAttrs attrs =3D { .memory =3D true }; =20 if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) { qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n"); @@ -617,7 +618,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState= *s) } } dma_memory_write(s->dma_as, s->sdmasysad, &s->fifo_buffer[begi= n], - s->data_count - begin, MEMTXATTRS_UNSPECIFIED= ); + s->data_count - begin, attrs); s->sdmasysad +=3D s->data_count - begin; if (s->data_count =3D=3D block_size) { s->data_count =3D 0; @@ -638,7 +639,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState= *s) boundary_count -=3D block_size - begin; } dma_memory_read(s->dma_as, s->sdmasysad, &s->fifo_buffer[begin= ], - s->data_count - begin, MEMTXATTRS_UNSPECIFIED); + s->data_count - begin, attrs); s->sdmasysad +=3D s->data_count - begin; if (s->data_count =3D=3D block_size) { sdbus_write_data(&s->sdbus, s->fifo_buffer, block_size); @@ -667,14 +668,15 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCISta= te *s) static void sdhci_sdma_transfer_single_block(SDHCIState *s) { uint32_t datacnt =3D s->blksize & BLOCK_SIZE_MASK; + const MemTxAttrs attrs =3D { .memory =3D true }; =20 if (s->trnmod & SDHC_TRNS_READ) { sdbus_read_data(&s->sdbus, s->fifo_buffer, datacnt); dma_memory_write(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt, - MEMTXATTRS_UNSPECIFIED); + attrs); } else { dma_memory_read(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt, - MEMTXATTRS_UNSPECIFIED); + attrs); sdbus_write_data(&s->sdbus, s->fifo_buffer, datacnt); } s->blkcnt--; @@ -693,11 +695,13 @@ static void get_adma_description(SDHCIState *s, ADMAD= escr *dscr) { uint32_t adma1 =3D 0; uint64_t adma2 =3D 0; + const MemTxAttrs attrs =3D { .memory =3D true }; hwaddr entry_addr =3D (hwaddr)s->admasysaddr; + switch (SDHC_DMA_TYPE(s->hostctl1)) { case SDHC_CTRL_ADMA2_32: dma_memory_read(s->dma_as, entry_addr, &adma2, sizeof(adma2), - MEMTXATTRS_UNSPECIFIED); + attrs); adma2 =3D le64_to_cpu(adma2); /* The spec does not specify endianness of descriptor table. * We currently assume that it is LE. @@ -709,7 +713,7 @@ static void get_adma_description(SDHCIState *s, ADMADes= cr *dscr) break; case SDHC_CTRL_ADMA1_32: dma_memory_read(s->dma_as, entry_addr, &adma1, sizeof(adma1), - MEMTXATTRS_UNSPECIFIED); + attrs); adma1 =3D le32_to_cpu(adma1); dscr->addr =3D (hwaddr)(adma1 & 0xFFFFF000); dscr->attr =3D (uint8_t)extract32(adma1, 0, 7); @@ -722,12 +726,12 @@ static void get_adma_description(SDHCIState *s, ADMAD= escr *dscr) break; case SDHC_CTRL_ADMA2_64: dma_memory_read(s->dma_as, entry_addr, &dscr->attr, 1, - MEMTXATTRS_UNSPECIFIED); + attrs); dma_memory_read(s->dma_as, entry_addr + 2, &dscr->length, 2, - MEMTXATTRS_UNSPECIFIED); + attrs); dscr->length =3D le16_to_cpu(dscr->length); dma_memory_read(s->dma_as, entry_addr + 4, &dscr->addr, 8, - MEMTXATTRS_UNSPECIFIED); + attrs); dscr->addr =3D le64_to_cpu(dscr->addr); dscr->attr &=3D (uint8_t) ~0xC0; dscr->incr =3D 12; --=20 2.37.3