[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [for 2.9] balloon: Don't balloon roms
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [for 2.9] balloon: Don't balloon roms |
Date: |
Fri, 16 Dec 2016 13:25:56 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 |
On 16/12/2016 12:41, Dr. David Alan Gilbert (git) wrote:
> From: "Dr. David Alan Gilbert" <address@hidden>
>
> A broken guest can specify physical addresses that correspond
> to any memory region, but it shouldn't be able to change ROM.
>
> Signed-off-by: Dr. David Alan Gilbert <address@hidden>
> ---
> hw/virtio/trace-events | 2 ++
> hw/virtio/virtio-balloon.c | 7 ++++++-
> 2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
> index 7b6f55e..6926eed 100644
> --- a/hw/virtio/trace-events
> +++ b/hw/virtio/trace-events
> @@ -15,6 +15,8 @@ virtio_rng_pushed(void *rng, size_t len) "rng %p: %zd bytes
> pushed"
> virtio_rng_request(void *rng, size_t size, unsigned quota) "rng %p: %zd
> bytes requested, %u bytes quota left"
>
> # hw/virtio/virtio-balloon.c
> +#
> +virtio_balloon_bad_addr(uint64_t gpa) "%"PRIx64
> virtio_balloon_handle_output(const char *name, uint64_t gpa) "section name:
> %s gpa: %"PRIx64
> virtio_balloon_get_config(uint32_t num_pages, uint32_t actual) "num_pages:
> %d actual: %d"
> virtio_balloon_set_config(uint32_t actual, uint32_t oldactual) "actual: %d
> oldactual: %d"
> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> index 884570a..a705e0e 100644
> --- a/hw/virtio/virtio-balloon.c
> +++ b/hw/virtio/virtio-balloon.c
> @@ -228,8 +228,13 @@ static void virtio_balloon_handle_output(VirtIODevice
> *vdev, VirtQueue *vq)
>
> /* FIXME: remove get_system_memory(), but how? */
> section = memory_region_find(get_system_memory(), pa, 1);
> - if (!int128_nz(section.size) ||
> !memory_region_is_ram(section.mr))
> + if (!int128_nz(section.size) ||
> + !memory_region_is_ram(section.mr) ||
> + memory_region_is_rom(section.mr) ||
> + memory_region_is_romd(section.mr)) {
> + trace_virtio_balloon_bad_addr(pa);
> continue;
> + }
>
>
> trace_virtio_balloon_handle_output(memory_region_name(section.mr),
> pa);
>
Acked-by: Paolo Bonzini <address@hidden>
Cc: address@hidden