From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021094.outbound.protection.outlook.com [52.101.65.94]) by lore.virtuozzo.com (Postfix) with ESMTPS id B9B648017D for ; Mon, 26 Oct 2026 11:46:56 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=UVCycTiIvoWDSpg7yn48WDP/P3/DI0JObU3MJ0D/udaTu/ycSxvB/DlhXlgEQ6+ZDIQDJpD36vOto+AtaAhZBlpK5EA/znucei3XU18gHEr6dn3Iw4W7mbXm1MxLsW3x7gNNgv65xhXtJc1KnEmy2wQCY239WImqhIwaLJj6u7qS8jSEOlUEbrb6zxb7UMX9PhTH3iINcoNCtSq+13A4Gf5HVcdv639DsYqmR+Ir1uwqzbn5p2AHAtcyFn2rRzY5wV8/9b2QPFHfafxjxlRiJKZfY1CAuh/r1fR4ehyLcKjnj4EefrbhRvp2/D8I0lCZ4C5Gw07up76aqRVDC+oWFQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+5BTib1ct1/6aN2x4IYpEP//4SvskiwcHzKcQzcp6xY=; b=PBeYt70q+fNx1FUC55eBi8IBy8NZUz7j2IY+peKIrV/IIm6MnxbT3BwhvTu0DTN1YRRHO4HUQSZHz41zoQi3IYjl+SkWCB3nP3i3jGmZU78Gj6PQaoa1as/+/Kl4mgqMuMY78TyyTmee4vjrEhdniT1PclwWe1aVRKZTkBnXtIBJ+PMoDukya/gP03oEpki7KTi6qzrbMHE4ptwukb3Q2WOkmdEXMn38tOtWnmsH01JccKzQ/BQyKPkBrN4pNVKOn7w/JbVfimIkvgY4cOVMk4eeE9PmUEuvg0bSHHw9B45SefmaLYwnYCoTujSbgYsWfeDxH8FSavdKxjF6Jt+M0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::32b) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+5BTib1ct1/6aN2x4IYpEP//4SvskiwcHzKcQzcp6xY=; b=g+uakTB1Eci6W0gfyJPlCDw2k+VssRb0xb0nCRCapXNoH+qkN7xdjK0azzD2jrUa2FhQ+1Hi0XK5uuT/SKXL4grSNEQAZYevrFAGR0ESdDcxd3Q542ffWNFJSTPqzU8HRIs/3hGFuwsEtZB4v/v7Soq3gBIpOXs68T5JatXcES4= Received: from PAZP264CA0066.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1fd::23) by AS8PR08MB9693.eurprd08.prod.outlook.com (2603:10a6:20b:617::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 11:46:52 +0000 Received: from ZR1PEPF0000E6B4.eurprd05.prod.outlook.com (2603:10a6:102:1fd:cafe::9e) by PAZP264CA0066.outlook.office365.com (2603:10a6:102:1fd::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 11:46:52 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 2a00:1450:4864:20::32b) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::32b as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::32b; helo=mail-wm1-x32b.google.com; pr=C Received: from mail-wm1-x32b.google.com (2a00:1450:4864:20::32b) by ZR1PEPF0000E6B4.mail.protection.outlook.com (2603:10a6:918::15b) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 11:46:51 +0000 Received: by mail-wm1-x32b.google.com with SMTP id 5b1f17b1804b1-4a208d93758so33468295e9.3 for ; Mon, 26 Oct 2026 04:46:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793015211; x=1793620011; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+5BTib1ct1/6aN2x4IYpEP//4SvskiwcHzKcQzcp6xY=; b=lYO4B55/4g1hkEpBvSkF8IN86a+LO7dKNeAWA78x8p68vf3nbkSe0z4MFG+Ff4d4F8 HV3T+K5UFOKRQzfcMKBOE//gCrhBThMO0sscnfTWR/fqp5G+0GAoxLT4yWkMDa9wlDVN 7yyCwPMt/ocz1fK0Zczn0G/GOl/xyJcmIDzEzKj86shI3NJTt990O9jbPmPZSnQbHP67 8i+jc+BtzHJinW8osYicaX0zGcnVCs+vr67ceejEZNlWQVrMnWNZzUbGxr/w7Ab83Tt9 hIFKlCypNLYgFa9zgUZGpSRsxVcBZlec+lETuLpwFCr9awR1TppIaiUuK4aNeRSvOmOU 1+Vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793015211; x=1793620011; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=+5BTib1ct1/6aN2x4IYpEP//4SvskiwcHzKcQzcp6xY=; b=X3ybpBqdbEEAQN+Fcf6rO5PifBboqac2wxwzihvbY0thN3nNVpkRPu0P+Pla4DcXfQ Nw5ScR5xWMP6hGK2XVXB+7qo4dmB1hLxGQfoEvUyXI67RDy0DgZd6mBW8TE2DG+Gh2RI 09VCwFEzLi/7rcZdEjO/V7kObuXesNn5mcvk3vslcFHjo49RV4mKMsYQpNITVvRckrlB m+NqNIx6QZbdjS42ygafoQqUBtREc9umm5dz6zFTlyQcdiIqgQgJ4DRFZ0n8zsVz171V iou5zokZtF7ZRJHSrZLvR42YteFyPRG97xZ1Rw4hU+60k7Kh/13TNfx5kpHCr6bhkGPS gGnA== X-Gm-Message-State: AFq9FYI/J9P0/sgAiwU0Nkc7shltGOxRxpNm0hrp6g9+sMwnDjBFc/Bu lAAE4pYUH8R6VfPxVdWudICKouejj0R8a7ls/5uuUuow/6oJ7Oi5lpkZsrQDJqxNqm6fwYAk4NZ E/kzaQlA= X-Gm-Gg: AYBFou1jJvsXHGN3fVjKWBPTb7GkaclDbTdi2jcvPth5mqsjdyvO8e+czeddlXk9hYb Y4KRlzZkAx5Xu4yuFTiiIu+vuX8Wf8z2l8+RkPd5+Jqu2+CdOwhobj1LLluqhkTujNHbHsgSxBH VxY3e5zhPKaTFfBBRuF9hdHrb+R5tXmBhC752HP38sY3Yr938pFpllmYEZFJwF8UaYOr7/fEzo9 t8dIgEcbxSgrEjtjPAlljLamZfAcIiWi09KlB68hbp7xaM0sPrFowzDgOk84SfhDcvZML8y9LyG KTOln4i6z14Cn3eis1ahRKxb+jaCW5JzNGzvH2++mduq7+O41WUgcx8W7cyxHbiX3t+pCg91jgx OOUD8PJ56+guZKLUa8U57Aad8SLNBbi+DGJpjWKS7HSttZ5N3jYznRHwDB14uWCDOYmLw7aYm1a UCWPRnWoNwc/yIlBRQcU2MUGZwp7PbBJs+8xCCR1ioiLXkp8WR/hskTTbi7bp6+bskzZR1xAao8 +uQ8tgxi5Kn8cCP1Eie8ZvJtd1yyl+N5WAE+9rXofwdT7UyYZA= X-Received: by 2002:a05:600c:c110:b0:4a1:e00b:a10b with SMTP id 5b1f17b1804b1-4a35ac91142mr108136655e9.7.1793015211273; Mon, 26 Oct 2026 04:46:51 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a35a04ad39sm504302105e9.1.2026.10.26.04.46.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 04:46:50 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 2/3] hw/usb/hcd-xhci: Limit DMA transfers to plain memory #VSTOR-151666 Date: Mon, 26 Oct 2026 12:46:44 +0100 Message-ID: <20261026114645.187003-3-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261026114645.187003-1-den@openvz.org> References: <20261026114645.187003-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: ZR1PEPF0000E6B4:EE_|AS8PR08MB9693:EE_ X-MS-Office365-Filtering-Correlation-Id: e953f838-3ce7-42a7-8f7b-08df3356d394 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704161411799003|61400799027|48200799018|6059299003|376014|82310400026|9140799003|43022699015|10067099003|13003099007|3023799007|261021121427099003|261021123027099003|261009223027099003|261022105027099003|56012099006|5063699009|22082099003|18002099003|16102099003|55112099003; X-Microsoft-Antispam-Message-Info: pFNbveMD2dy7d7EAXe9aSJB7/05gOp50XCC8FYOJ6Ifb/uMJ2GRCxKbzGc5A4gmH+icofiL4zsJC3X+mgi72fZlp+dOCqVIrStd8rUmCecK/oV8d5LnBAzTj+dfmsnRiKCHn2xGVtNbHvI/vsZ+z2O9V83wau5y0bhVLEXFgax1iAnIVofhdKgBNYkM0X61R9N4flHn1PsXDlOnjHUD9Gf8t2/gyS7JcyGcneAQzmb1YlUwQVmr5OM4I8lsEoXMgo80Z1yv9wTWyYOKzYOpdyJs2EbquL7eBmdOh79pQ7EImgg4UHRlIzeyzyLJSUaFxg6S+ZMXProhx1sF5pU8jS5wnYs8ho6j7I2LTVfQu0oAStsK9ni5bxOq+ja/rxZeWG42kYL5kQD68kkNJIhCDMhAQm2kWmrIYaJq7R2NsroJPWth5WWv6PSBDYLVV1yz0k4733wACDzgh9cPopypXk59zGUdZT9ZXAVXtFyUZjk/WuTDeKIsm2plJLEjWH3SQP1eka6Ec7qV3EC1nVJlUEp+q2yhY18NoVp/jfgf3qSASzcQPnvf0N0CemxG4OtTYgeuG+Sm7AqxbkIz0rxn1yyrl2upYQPKrEJZOZ7+gwOIpDE+WfaS0dNRjzQl+TMFirtm8GsG90rPbkndyASQAJuwPyq89hdKyi23yiTTpmS40lQkgi9EHuwcCygw+01TaptbeB0eVL7q+Rod9B1jKph4WdBeACN3hKTLdl0RSnFKO6gRQS/BdjK/jkE2kqTBCoMa/OC9wBfhqqYqEECYB6YF7ufcxO36F+JMPYVZuqD0+hJewmn1/iSVKDrSEX242G8fFAcybSHoObJsrSQOJdMchHvqOdwQ8U1Kyp7ip2gzsw1vxgeZcZao5xsJexDddpQuJLwUKqp1jq6tpP9zzVC7Px62ONo0+81VOiYCWZfR1WolJrZk8j3Zok61IFqRj X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::32b;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x32b.google.com;PTR:mail-wm1-x32b.google.com;CAT:NONE;SFS:(13230040)(704161411799003)(61400799027)(48200799018)(6059299003)(376014)(82310400026)(9140799003)(43022699015)(10067099003)(13003099007)(3023799007)(261021121427099003)(261021123027099003)(261009223027099003)(261022105027099003)(56012099006)(5063699009)(22082099003)(18002099003)(16102099003)(55112099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: YMJ7Z6okAmO2+olRk2d7YYHiBxeE2RWaXFJzPeiO99oGa7tR/Z975NBNPeIxWkWu8GNGpA0BixshxhdsOkW2sSMSebUUPY7vOgrXLkNoI6EmB46E/awm0VVD27CbqkcYvwWtEjdjgoOlN8DKWbeorOatR89oMpMCE8IgubBTszit0kIOnokbMjOqaf28Au6Kh786/yXJKJo4wMbeAGu7xKWjOWgHa+gHx2W5fASGOFPPyB4idQKn+JIOqWrfFsrxbMtiClJQwRWkPz6o6bT+wGC4igAk7ZofOMTHZNN+AB/SWXOAGgrwqxeXyeEgFn7qbWfvGWntsS+MC9eKtw4R78aToHGQTM32Rb55UVoNpdUzCOWE/iq+sMrNQt/YbfPyuVGh3R0bt32ZdgYOQ5mKsNwu+2rBKU4ZBxcn9VzfNDPgIBsW031Qg/SYH4TJd7rn X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 11:46:51.8833 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e953f838-3ce7-42a7-8f7b-08df3356d394 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: ZR1PEPF0000E6B4.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB9693 List-Id: From: Thomas Huth XHCI is a complex controller, involving lots of descriptors that are written and read via DMA transfers. As some recent bugs like https://gitlab.com/qemu-project/qemu/-/work_items/3926 revealed, this can sometimes be exploited from the guest side to crash or stall QEMU. The code currently does DMA writes with the MEMTXATTRS_UNSPECIFIED attribute, i.e. the controller is allowed to write to other MMIO regions, too. However, in normal operation, this should not be necessary, all descriptors should reside in normal memory. So let's decrease the attack surface a little bit and limit the DMA writes to normal memory here. Signed-off-by: Thomas Huth Message-ID: <20260915123242.549150-1-thuth@redhat.com> (cherry picked from commit 89e653b77369ad2d3e579139b1fa2567daa86a79) --- hw/usb/hcd-xhci.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 1d7c0363e95..80d2687fb19 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -520,6 +520,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr, int i; uint32_t tmp[5]; uint32_t n = len / sizeof(uint32_t); + const MemTxAttrs memtx_attrs = { .memory = true }; assert((len % sizeof(uint32_t)) == 0); assert(n <= ARRAY_SIZE(tmp)); @@ -527,8 +528,7 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr, for (i = 0; i < n; i++) { tmp[i] = cpu_to_le32(buf[i]); } - if (dma_memory_write(xhci->as, addr, tmp, len, - MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) { + if (dma_memory_write(xhci->as, addr, tmp, len, memtx_attrs) != MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n", __func__); xhci_die(xhci); @@ -615,6 +615,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v) XHCIInterrupter *intr = &xhci->intr[v]; XHCITRB ev_trb; dma_addr_t addr; + const MemTxAttrs memtx_attrs = { .memory = true }; ev_trb.parameter = cpu_to_le64(event->ptr); ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24)); @@ -631,7 +632,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event, int v) addr = intr->er_start + TRB_SIZE*intr->er_ep_idx; if (dma_memory_write(xhci->as, addr, &ev_trb, TRB_SIZE, - MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) { + memtx_attrs) != MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory access failed!\n", __func__); xhci_die(xhci); @@ -2445,6 +2446,7 @@ static void xhci_detach_slot(XHCIState *xhci, USBPort *uport) static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx) { dma_addr_t ctx; + const MemTxAttrs memtx_attrs = { .memory = true }; DPRINTF("xhci_get_port_bandwidth()\n"); @@ -2453,9 +2455,9 @@ static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx) DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx); /* TODO: actually implement real values here. This is 80% for all ports. */ - if (stb_dma(xhci->as, ctx, 0, MEMTXATTRS_UNSPECIFIED) != MEMTX_OK || + if (stb_dma(xhci->as, ctx, 0, memtx_attrs) != MEMTX_OK || dma_memory_set(xhci->as, ctx + 1, 80, xhci->numports, - MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) { + memtx_attrs) != MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA memory write failed!\n", __func__); return CC_TRB_ERROR; -- 2.53.0