On 24/09/2026 11.12, Philippe Mathieu-Daudé wrote:
On 24/9/26 11:05, Thomas Huth wrote:
XHCI is a complex controller, involving lots of descriptors that
are written and read via DMA transfers. As some recent bugs like
https://gitlab.com/qemu-project/qemu/-/work_items/3926 revealed,
this can sometimes be exploited from the guest side to crash or
stall QEMU.
The code currently does DMA writes with the MEMTXATTRS_UNSPECIFIED
attribute, i.e. the controller is allowed to write to other MMIO
regions, too. However, in normal operation, this should not be
necessary, all descriptors should reside in normal memory. So let's
decrease the attack surface a little bit and limit the DMA writes
to normal memory here.
Signed-off-by: Thomas Huth <[email protected]>
Message-ID: <[email protected]>
I had this tagged to review but low priority since RFC, anyhow LGTM.
Thanks for your plans! ... I already assumed there would be nobody looking
at this. Anyhow, I think we likely won't find out whether there is any valid
scenario where the USB controller could write to MMIO space if we don't try
to include this, thus I added it to this PR to include it rather early than
late in this development cycle, so it gets enough testing coverage. If it
breaks anything, we can simply revert it again.
Thomas
