[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] i386: amd_iommu: fix MMIO register count and ac
From: |
P J P |
Subject: |
Re: [Qemu-devel] [PATCH] i386: amd_iommu: fix MMIO register count and access |
Date: |
Tue, 13 Dec 2016 15:42:13 +0530 (IST) |
+-- On Fri, 2 Dec 2016, P J P wrote --+
| IOMMU MMIO registers are divided in two groups by their offsets.
| Low offsets(<0x2000) registers are grouped into 'amdvi_mmio_low'
| table and higher offsets(>=0x2000) registers are grouped into
| 'amdvi_mmio_high' table. No of registers in each table is given
| by macro 'AMDVI_MMIO_REGS_LOW' and 'AMDVI_MMIO_REGS_HIGH' resp.
| Values of these two macros were swapped, resulting in an OOB
| access when reading 'amdvi_mmio_high' table. Correct these two
| macros. Also read from 'amdvi_mmio_low' table for lower address.
|
| Reported-by: Azureyang <address@hidden>
| Signed-off-by: Prasad J Pandit <address@hidden>
| ---
| hw/i386/amd_iommu.c | 2 +-
| hw/i386/amd_iommu.h | 4 ++--
| 2 files changed, 3 insertions(+), 3 deletions(-)
|
| diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
| index 47b79d9..e0732cc 100644
| --- a/hw/i386/amd_iommu.c
| +++ b/hw/i386/amd_iommu.c
| @@ -562,7 +562,7 @@ static void amdvi_mmio_trace(hwaddr addr, unsigned size)
| trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr &
~0x07);
| } else {
| index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;
| - trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr &
~0x07);
| + trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr &
~0x07);
| }
| }
|
| diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
| index 884926e..0d3dc6a 100644
| --- a/hw/i386/amd_iommu.h
| +++ b/hw/i386/amd_iommu.h
| @@ -49,8 +49,8 @@
| #define AMDVI_CAPAB_INIT_TYPE (3 << 16)
|
| /* No. of used MMIO registers */
| -#define AMDVI_MMIO_REGS_HIGH 8
| -#define AMDVI_MMIO_REGS_LOW 7
| +#define AMDVI_MMIO_REGS_HIGH 7
| +#define AMDVI_MMIO_REGS_LOW 8
|
| /* MMIO registers */
| #define AMDVI_MMIO_DEVICE_TABLE 0x0000
Ping..!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F