vfio: Filter out bogus mappings
PATCH 1/1 vfio: Filter out bogus mappings
Since 57271d63 we now see spurious mappings with the upper bits set if 64bit PCI BARs are sized while enabled. The guest writes a mask of 0xffffffff to the lower BAR to size it, then restores it, then writes the same mask to the upper BAR resulting in a spurious BAR mapping into the last 4G of the 64bit address space. Most architectures do not support or make use of the full 64bits address space for PCI BARs, so we filter out mappings with the high bit set. Long term, we probably need to think about vfio telling us the address width limitations of the IOMMU.
--- hw/misc/vfio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
hw/misc/vfio.c +3 -1
@@ -2156,7 +2156,9 @@ static int vfio_dma_map(VFIOContainer *container, hwaddr iova,static bool vfio_listener_skipped_section (MemoryRegionSection *section) { -return !memory_region_is_ram (section->mr); +return !memory_region_is_ram (section->mr) || + section->offset_within_address_space > + ~section->offset_within_address_space; } static void vfio_listener_region_add(MemoryListener *listener,
Quoted 20 lines · Alex Williamson
Since
57271d63we now see spurious mappings with the upper bits set if 64bit PCI BARs are sized while enabled. The guest writes a mask of0xffffffffto the lower BAR to size it, then restores it, then writes the same mask to the upper BAR resulting in a spurious BAR mapping into the last 4G of the 64bit address space. Most architectures do not support or make use of the full 64bits address space for PCI BARs, so we filter out mappings with the high bit set. Long term, we probably need to think about vfio telling us the address width limitations of the IOMMU.Signed-off-by Alex Williamson <[email protected]>--- hw/misc/vfio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)hw/misc/vfio.c +0
-0
hw/misc/vfio.c static int vfio_dma_map(VFIOContainer *container, hwaddr iova, · line 2161
Quoted 7 lines
hw/misc/vfio.c +3
-1@@ -2156,7 +2156,9 @@ static int vfio_dma_map(VFIOContainer *container, hwaddr iova,static bool vfio_listener_skipped_section (MemoryRegionSection *section) { -return !memory_region_is_ram (section->mr); +return !memory_region_is_ram (section->mr) || + section->offset_within_address_space > + ~section->offset_within_address_space;
I personally find this a very un-intuitive way to test it.
section->offset_within_address_space >= 0x1ULL << 63
would be more readable I think.
A comment in code explaining what this hack does won't hurt too.
Quoted 3 lines
hw/misc/vfio.c +0
-0} static void vfio_listener_region_add(MemoryListener *listener,