esp: check dma length before reading scsi command(CVE-2016-4441)
[qemu/ar7.git] / hw / s390x / s390-skeys.c
blobd772cfc7eab0912779447e5fa44e1f7523309140
1 /*
2 * s390 storage key device
4 * Copyright 2015 IBM Corp.
5 * Author(s): Jason J. Herne <jjherne@linux.vnet.ibm.com>
7 * This work is licensed under the terms of the GNU GPL, version 2 or (at
8 * your option) any later version. See the COPYING file in the top-level
9 * directory.
12 #include "qemu/osdep.h"
13 #include "hw/boards.h"
14 #include "qmp-commands.h"
15 #include "migration/qemu-file.h"
16 #include "hw/s390x/storage-keys.h"
17 #include "qemu/error-report.h"
18 #include "sysemu/kvm.h"
20 #define S390_SKEYS_BUFFER_SIZE 131072 /* Room for 128k storage keys */
21 #define S390_SKEYS_SAVE_FLAG_EOS 0x01
22 #define S390_SKEYS_SAVE_FLAG_SKEYS 0x02
23 #define S390_SKEYS_SAVE_FLAG_ERROR 0x04
25 S390SKeysState *s390_get_skeys_device(void)
27 S390SKeysState *ss;
29 ss = S390_SKEYS(object_resolve_path_type("", TYPE_S390_SKEYS, NULL));
30 assert(ss);
31 return ss;
34 void s390_skeys_init(void)
36 Object *obj;
38 if (kvm_enabled()) {
39 obj = object_new(TYPE_KVM_S390_SKEYS);
40 } else {
41 obj = object_new(TYPE_QEMU_S390_SKEYS);
43 object_property_add_child(qdev_get_machine(), TYPE_S390_SKEYS,
44 obj, NULL);
45 object_unref(obj);
47 qdev_init_nofail(DEVICE(obj));
50 static void write_keys(QEMUFile *f, uint8_t *keys, uint64_t startgfn,
51 uint64_t count, Error **errp)
53 uint64_t curpage = startgfn;
54 uint64_t maxpage = curpage + count - 1;
55 const char *fmt = "page=%03" PRIx64 ": key(%d) => ACC=%X, FP=%d, REF=%d,"
56 " ch=%d, reserved=%d\n";
57 char buf[128];
58 int len;
60 for (; curpage <= maxpage; curpage++) {
61 uint8_t acc = (*keys & 0xF0) >> 4;
62 int fp = (*keys & 0x08);
63 int ref = (*keys & 0x04);
64 int ch = (*keys & 0x02);
65 int res = (*keys & 0x01);
67 len = snprintf(buf, sizeof(buf), fmt, curpage,
68 *keys, acc, fp, ref, ch, res);
69 assert(len < sizeof(buf));
70 qemu_put_buffer(f, (uint8_t *)buf, len);
71 keys++;
75 void hmp_info_skeys(Monitor *mon, const QDict *qdict)
77 S390SKeysState *ss = s390_get_skeys_device();
78 S390SKeysClass *skeyclass = S390_SKEYS_GET_CLASS(ss);
79 uint64_t addr = qdict_get_int(qdict, "addr");
80 uint8_t key;
81 int r;
83 /* Quick check to see if guest is using storage keys*/
84 if (!skeyclass->skeys_enabled(ss)) {
85 monitor_printf(mon, "Error: This guest is not using storage keys\n");
86 return;
89 r = skeyclass->get_skeys(ss, addr / TARGET_PAGE_SIZE, 1, &key);
90 if (r < 0) {
91 monitor_printf(mon, "Error: %s\n", strerror(-r));
92 return;
95 monitor_printf(mon, " key: 0x%X\n", key);
98 void hmp_dump_skeys(Monitor *mon, const QDict *qdict)
100 const char *filename = qdict_get_str(qdict, "filename");
101 Error *err = NULL;
103 qmp_dump_skeys(filename, &err);
104 if (err) {
105 error_report_err(err);
109 void qmp_dump_skeys(const char *filename, Error **errp)
111 S390SKeysState *ss = s390_get_skeys_device();
112 S390SKeysClass *skeyclass = S390_SKEYS_GET_CLASS(ss);
113 const uint64_t total_count = ram_size / TARGET_PAGE_SIZE;
114 uint64_t handled_count = 0, cur_count;
115 Error *lerr = NULL;
116 vaddr cur_gfn = 0;
117 uint8_t *buf;
118 int ret;
119 QEMUFile *f;
121 /* Quick check to see if guest is using storage keys*/
122 if (!skeyclass->skeys_enabled(ss)) {
123 error_setg(errp, "This guest is not using storage keys - "
124 "nothing to dump");
125 return;
128 f = qemu_fopen(filename, "wb");
129 if (!f) {
130 error_setg_file_open(errp, errno, filename);
131 return;
134 buf = g_try_malloc(S390_SKEYS_BUFFER_SIZE);
135 if (!buf) {
136 error_setg(errp, "Could not allocate memory");
137 goto out;
140 /* we'll only dump initial memory for now */
141 while (handled_count < total_count) {
142 /* Calculate how many keys to ask for & handle overflow case */
143 cur_count = MIN(total_count - handled_count, S390_SKEYS_BUFFER_SIZE);
145 ret = skeyclass->get_skeys(ss, cur_gfn, cur_count, buf);
146 if (ret < 0) {
147 error_setg(errp, "get_keys error %d", ret);
148 goto out_free;
151 /* write keys to stream */
152 write_keys(f, buf, cur_gfn, cur_count, &lerr);
153 if (lerr) {
154 goto out_free;
157 cur_gfn += cur_count;
158 handled_count += cur_count;
161 out_free:
162 error_propagate(errp, lerr);
163 g_free(buf);
164 out:
165 qemu_fclose(f);
168 static void qemu_s390_skeys_init(Object *obj)
170 QEMUS390SKeysState *skeys = QEMU_S390_SKEYS(obj);
171 MachineState *machine = MACHINE(qdev_get_machine());
173 skeys->key_count = machine->maxram_size / TARGET_PAGE_SIZE;
174 skeys->keydata = g_malloc0(skeys->key_count);
177 static int qemu_s390_skeys_enabled(S390SKeysState *ss)
179 return 1;
183 * TODO: for memory hotplug support qemu_s390_skeys_set and qemu_s390_skeys_get
184 * will have to make sure that the given gfn belongs to a memory region and not
185 * a memory hole.
187 static int qemu_s390_skeys_set(S390SKeysState *ss, uint64_t start_gfn,
188 uint64_t count, uint8_t *keys)
190 QEMUS390SKeysState *skeydev = QEMU_S390_SKEYS(ss);
191 int i;
193 /* Check for uint64 overflow and access beyond end of key data */
194 if (start_gfn + count > skeydev->key_count || start_gfn + count < count) {
195 error_report("Error: Setting storage keys for page beyond the end "
196 "of memory: gfn=%" PRIx64 " count=%" PRId64,
197 start_gfn, count);
198 return -EINVAL;
201 for (i = 0; i < count; i++) {
202 skeydev->keydata[start_gfn + i] = keys[i];
204 return 0;
207 static int qemu_s390_skeys_get(S390SKeysState *ss, uint64_t start_gfn,
208 uint64_t count, uint8_t *keys)
210 QEMUS390SKeysState *skeydev = QEMU_S390_SKEYS(ss);
211 int i;
213 /* Check for uint64 overflow and access beyond end of key data */
214 if (start_gfn + count > skeydev->key_count || start_gfn + count < count) {
215 error_report("Error: Getting storage keys for page beyond the end "
216 "of memory: gfn=%" PRIx64 " count=%" PRId64,
217 start_gfn, count);
218 return -EINVAL;
221 for (i = 0; i < count; i++) {
222 keys[i] = skeydev->keydata[start_gfn + i];
224 return 0;
227 static void qemu_s390_skeys_class_init(ObjectClass *oc, void *data)
229 S390SKeysClass *skeyclass = S390_SKEYS_CLASS(oc);
231 skeyclass->skeys_enabled = qemu_s390_skeys_enabled;
232 skeyclass->get_skeys = qemu_s390_skeys_get;
233 skeyclass->set_skeys = qemu_s390_skeys_set;
236 static const TypeInfo qemu_s390_skeys_info = {
237 .name = TYPE_QEMU_S390_SKEYS,
238 .parent = TYPE_S390_SKEYS,
239 .instance_init = qemu_s390_skeys_init,
240 .instance_size = sizeof(QEMUS390SKeysState),
241 .class_init = qemu_s390_skeys_class_init,
242 .class_size = sizeof(S390SKeysClass),
245 static void s390_storage_keys_save(QEMUFile *f, void *opaque)
247 S390SKeysState *ss = S390_SKEYS(opaque);
248 S390SKeysClass *skeyclass = S390_SKEYS_GET_CLASS(ss);
249 uint64_t pages_left = ram_size / TARGET_PAGE_SIZE;
250 uint64_t read_count, eos = S390_SKEYS_SAVE_FLAG_EOS;
251 vaddr cur_gfn = 0;
252 int error = 0;
253 uint8_t *buf;
255 if (!skeyclass->skeys_enabled(ss)) {
256 goto end_stream;
259 buf = g_try_malloc(S390_SKEYS_BUFFER_SIZE);
260 if (!buf) {
261 error_report("storage key save could not allocate memory");
262 goto end_stream;
265 /* We only support initial memory. Standby memory is not handled yet. */
266 qemu_put_be64(f, (cur_gfn * TARGET_PAGE_SIZE) | S390_SKEYS_SAVE_FLAG_SKEYS);
267 qemu_put_be64(f, pages_left);
269 while (pages_left) {
270 read_count = MIN(pages_left, S390_SKEYS_BUFFER_SIZE);
272 if (!error) {
273 error = skeyclass->get_skeys(ss, cur_gfn, read_count, buf);
274 if (error) {
276 * If error: we want to fill the stream with valid data instead
277 * of stopping early so we pad the stream with 0x00 values and
278 * use S390_SKEYS_SAVE_FLAG_ERROR to indicate failure to the
279 * reading side.
281 error_report("S390_GET_KEYS error %d", error);
282 memset(buf, 0, S390_SKEYS_BUFFER_SIZE);
283 eos = S390_SKEYS_SAVE_FLAG_ERROR;
287 qemu_put_buffer(f, buf, read_count);
288 cur_gfn += read_count;
289 pages_left -= read_count;
292 g_free(buf);
293 end_stream:
294 qemu_put_be64(f, eos);
297 static int s390_storage_keys_load(QEMUFile *f, void *opaque, int version_id)
299 S390SKeysState *ss = S390_SKEYS(opaque);
300 S390SKeysClass *skeyclass = S390_SKEYS_GET_CLASS(ss);
301 int ret = 0;
303 while (!ret) {
304 ram_addr_t addr;
305 int flags;
307 addr = qemu_get_be64(f);
308 flags = addr & ~TARGET_PAGE_MASK;
309 addr &= TARGET_PAGE_MASK;
311 switch (flags) {
312 case S390_SKEYS_SAVE_FLAG_SKEYS: {
313 const uint64_t total_count = qemu_get_be64(f);
314 uint64_t handled_count = 0, cur_count;
315 uint64_t cur_gfn = addr / TARGET_PAGE_SIZE;
316 uint8_t *buf = g_try_malloc(S390_SKEYS_BUFFER_SIZE);
318 if (!buf) {
319 error_report("storage key load could not allocate memory");
320 ret = -ENOMEM;
321 break;
324 while (handled_count < total_count) {
325 cur_count = MIN(total_count - handled_count,
326 S390_SKEYS_BUFFER_SIZE);
327 qemu_get_buffer(f, buf, cur_count);
329 ret = skeyclass->set_skeys(ss, cur_gfn, cur_count, buf);
330 if (ret < 0) {
331 error_report("S390_SET_KEYS error %d", ret);
332 break;
334 handled_count += cur_count;
335 cur_gfn += cur_count;
337 g_free(buf);
338 break;
340 case S390_SKEYS_SAVE_FLAG_ERROR: {
341 error_report("Storage key data is incomplete");
342 ret = -EINVAL;
343 break;
345 case S390_SKEYS_SAVE_FLAG_EOS:
346 /* normal exit */
347 return 0;
348 default:
349 error_report("Unexpected storage key flag data: %#x", flags);
350 ret = -EINVAL;
354 return ret;
357 static inline bool s390_skeys_get_migration_enabled(Object *obj, Error **errp)
359 S390SKeysState *ss = S390_SKEYS(obj);
361 return ss->migration_enabled;
364 static inline void s390_skeys_set_migration_enabled(Object *obj, bool value,
365 Error **errp)
367 S390SKeysState *ss = S390_SKEYS(obj);
369 /* Prevent double registration of savevm handler */
370 if (ss->migration_enabled == value) {
371 return;
374 ss->migration_enabled = value;
376 if (ss->migration_enabled) {
377 register_savevm(NULL, TYPE_S390_SKEYS, 0, 1, s390_storage_keys_save,
378 s390_storage_keys_load, ss);
379 } else {
380 unregister_savevm(DEVICE(ss), TYPE_S390_SKEYS, ss);
384 static void s390_skeys_instance_init(Object *obj)
386 object_property_add_bool(obj, "migration-enabled",
387 s390_skeys_get_migration_enabled,
388 s390_skeys_set_migration_enabled, NULL);
389 object_property_set_bool(obj, true, "migration-enabled", NULL);
392 static void s390_skeys_class_init(ObjectClass *oc, void *data)
394 DeviceClass *dc = DEVICE_CLASS(oc);
396 dc->hotpluggable = false;
397 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
400 static const TypeInfo s390_skeys_info = {
401 .name = TYPE_S390_SKEYS,
402 .parent = TYPE_DEVICE,
403 .instance_init = s390_skeys_instance_init,
404 .instance_size = sizeof(S390SKeysState),
405 .class_init = s390_skeys_class_init,
406 .class_size = sizeof(S390SKeysClass),
407 .abstract = true,
410 static void qemu_s390_skeys_register_types(void)
412 type_register_static(&s390_skeys_info);
413 type_register_static(&qemu_s390_skeys_info);
416 type_init(qemu_s390_skeys_register_types)