diff options
author | David Hildenbrand <david@redhat.com> | 2023-09-06 14:04:53 +0200 |
---|---|---|
committer | David Hildenbrand <david@redhat.com> | 2023-09-19 10:23:21 +0200 |
commit | 3a1258399bdf4d4412cbfde36d0d94965eec87b6 (patch) | |
tree | 651d96d9bdeb511144c73e85cc54cf6839313d29 /include | |
parent | 13d6b1608160de40ec65ae4c32419e56714bbadf (diff) | |
download | qemu-3a1258399bdf4d4412cbfde36d0d94965eec87b6.zip qemu-3a1258399bdf4d4412cbfde36d0d94965eec87b6.tar.gz qemu-3a1258399bdf4d4412cbfde36d0d94965eec87b6.tar.bz2 |
nvdimm: Reject writing label data to ROM instead of crashing QEMU
Currently, when using a true R/O NVDIMM (ROM memory backend) with a label
area, the VM can easily crash QEMU by trying to write to the label area,
because the ROM memory is mmap'ed without PROT_WRITE.
[root@vm-0 ~]# ndctl disable-region region0
disabled 1 region
[root@vm-0 ~]# ndctl zero-labels nmem0
-> QEMU segfaults
Let's remember whether we have a ROM memory backend and properly
reject the write request:
[root@vm-0 ~]# ndctl disable-region region0
disabled 1 region
[root@vm-0 ~]# ndctl zero-labels nmem0
zeroed 0 nmem
In comparison, on a system with a R/W NVDIMM:
[root@vm-0 ~]# ndctl disable-region region0
disabled 1 region
[root@vm-0 ~]# ndctl zero-labels nmem0
zeroed 1 nmem
For ACPI, just return "unsupported", like if no label exists. For spapr,
return "H_P2", similar to when no label area exists.
Could we rely on the "unarmed" property? Maybe, but it looks cleaner to
only disallow what certainly cannot work.
After all "unarmed=on" primarily means: cannot accept persistent writes. In
theory, there might be setups where devices with "unarmed=on" set could
be used to host non-persistent data (temporary files, system RAM, ...); for
example, in Linux, admins can overwrite the "readonly" setting and still
write to the device -- which will work as long as we're not using ROM.
Allowing writing label data in such configurations can make sense.
Message-ID: <20230906120503.359863-2-david@redhat.com>
Fixes: dbd730e85987 ("nvdimm: check -object memory-backend-file, readonly=on option")
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Diffstat (limited to 'include')
-rw-r--r-- | include/hw/mem/nvdimm.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/include/hw/mem/nvdimm.h b/include/hw/mem/nvdimm.h index acf887c..d3b7634 100644 --- a/include/hw/mem/nvdimm.h +++ b/include/hw/mem/nvdimm.h @@ -78,6 +78,12 @@ struct NVDIMMDevice { bool unarmed; /* + * Whether our DIMM is backed by ROM, and even label data cannot be + * written. If set, implies that "unarmed" is also set. + */ + bool readonly; + + /* * The PPC64 - spapr requires each nvdimm device have a uuid. */ QemuUUID uuid; |