mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
a2e1753b80
qemu/include/exec
History
Alexander Bulekov a2e1753b80 memory: prevent dma-reentracy issues 
Add a flag to the DeviceState, when a device is engaged in PIO/MMIO/DMA.
This flag is set/checked prior to calling a device's MemoryRegion
handlers, and set when device code initiates DMA.  The purpose of this
flag is to prevent two types of DMA-based reentrancy issues:

1.) mmio -> dma -> mmio case
2.) bh -> dma write -> mmio case

These issues have led to problems such as stack-exhaustion and
use-after-frees.

Summary of the problem from Peter Maydell:
https://lore.kernel.org/qemu-devel/CAFEAcA_23vc7hE3iaM-JVA6W38LK4hJoWae5KcknhPRD5fPBZA@mail.gmail.com

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/62
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/540
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/541
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/556
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/557
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/827
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1282
Resolves: CVE-2023-0330

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230427211013.2994127-2-alxndr@bu.edu>
[thuth: Replace warn_report() with warn_report_once()]
Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-04-28 11:20:01 +02:00
..
user
address-spaces.h
confidential-guest-support.h
cpu_ldst.h tcg: Add guest load/store primitives for TCGv_i128 2023-02-04 06:19:42 -10:00
cpu-all.h include/exec: Provide the tswap() functions for target independent code, too 2023-04-20 11:25:32 +02:00
cpu-common.h cpu: Remove parameter of list_cpus() 2023-04-20 11:25:32 +02:00
cpu-defs.h include/exec: Remove guards around NB_MMU_MODES 2023-03-13 06:44:37 -07:00
cputlb.h
exec-all.h accel/tcg: Pass last not end to tb_invalidate_phys_range 2023-03-28 15:23:10 -07:00
gdbstub.h gdbstub: move syscall handling to new file 2023-03-07 20:44:08 +00:00
gen-icount.h include/exec/gen-icount: Drop tcg_temp_free in gen_tb_start 2023-03-05 13:44:08 -08:00
helper-gen.h tracing: excise the tcg related from tracetool 2022-02-09 12:08:42 +00:00
helper-head.h exec/helper-head: Include missing "fpu/softfloat-types.h" header 2023-02-28 10:32:31 -10:00
helper-proto.h tcg: Mark tcg helpers noinline to avoid an issue with LTO 2023-01-23 14:39:48 -10:00
helper-tcg.h tracing: remove the trace-tcg includes from the build 2022-02-09 12:08:42 +00:00
hwaddr.h bulk: Rename TARGET_FMT_plx -> HWADDR_FMT_plx 2023-01-18 11:14:34 +01:00
ioport.h
log.h include/exec/log: Do not reference QemuLogFile directly 2022-04-20 10:51:11 -07:00
memattrs.h softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR 2022-03-21 10:10:58 +01:00
memop.h Replace TARGET_WORDS_BIGENDIAN 2022-04-06 10:50:37 +02:00
memopidx.h Normalize header guard symbol definition 2022-05-11 16:50:26 +02:00
memory_ldst_cached.h.inc exec/memory_ldst_cached: Use correct type size 2021-05-26 08:35:51 -07:00
memory_ldst_phys.h.inc exec/memory_ldst_phys: Use correct type sizes 2021-05-26 08:35:51 -07:00
memory_ldst.h.inc exec/memory_ldst: Use correct type sizes 2021-05-26 08:35:51 -07:00
memory-internal.h exec/memory: Expose memory_region_access_valid() 2023-01-09 13:50:13 +01:00
memory.h memory: prevent dma-reentracy issues 2023-04-28 11:20:01 +02:00
page-vary.h include: move target page bits declaration to page-vary.h 2022-04-06 14:31:43 +02:00
plugin-gen.h include: Include headers where needed 2023-01-08 01:54:22 -05:00
poison.h mips: Always include nanomips disassembler 2023-01-13 16:22:53 +01:00
ram_addr.h migration: Use non-atomic ops for clear log bitmap 2022-11-21 11:58:10 +01:00
ramblock.h migration: Use non-atomic ops for clear log bitmap 2022-11-21 11:58:10 +01:00
ramlist.h qapi: introduce x-query-ramblock QMP command 2021-11-02 15:55:14 +00:00
replay-core.h replay: Extract core API to 'exec/replay-core.h' 2023-02-27 22:29:01 +01:00
target_long.h include: split target_long definition from cpu-defs 2023-03-07 20:44:09 +00:00
target_page.h
tb-flush.h includes: move tb_flush into its own header 2023-03-07 17:06:33 +00:00
translate-all.h accel/tcg: Move remainder of page locking to tb-maint.c 2022-12-20 17:11:12 -08:00
translator.h accel/tcg: Remove translator_loop_temp_check 2023-03-05 13:44:07 -08:00
tswap.h include/exec: Provide the tswap() functions for target independent code, too 2023-04-20 11:25:32 +02:00