commit d489ae4ac57ebe14bde8384556cbac237ead988d
author Alexander Duyck <alexander.h.duyck@linux.intel.com> Thu Apr 09 20:41:50 2020 -0700
committer Paolo Bonzini <pbonzini@redhat.com> Mon Apr 13 02:56:18 2020 -0400
tree 13decef18302ed6153b05ba5974918cd61dbc48b
parent 1148e4f4dc22f8efe3419fda4ca4f0a7369ef94a

memory: Do not allow direct write access to rom_device regions

According to the documentation in memory.h a ROM memory region will be
backed by RAM for reads, but is supposed to go through a callback for
writes. Currently we were not checking for the existence of the rom_device
flag when determining if we could perform a direct write or not.

To correct that add a check to memory_region_is_direct so that if the
memory region has the rom_device flag set we will return false for all
checks where is_write is set.

Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Message-Id: <20200410034150.24738.98143.stgit@localhost.localdomain>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

include/exec/memory.h

diff --git a/include/exec/memory.h b/include/exec/memory.h
index 1614d9a..e000bd2 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -2351,8 +2351,8 @@
 static inline bool memory_access_is_direct(MemoryRegion *mr, bool is_write)
 {
     if (is_write) {
-        return memory_region_is_ram(mr) &&
-               !mr->readonly && !memory_region_is_ram_device(mr);
+        return memory_region_is_ram(mr) && !mr->readonly &&
+               !mr->rom_device && !memory_region_is_ram_device(mr);
     } else {
         return (memory_region_is_ram(mr) && !memory_region_is_ram_device(mr)) ||
                memory_region_is_romd(mr);