From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:56551) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RoSQK-0007Vz-O2 for qemu-devel@nongnu.org; Fri, 20 Jan 2012 23:19:40 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RoSQB-0001Tq-GY for qemu-devel@nongnu.org; Fri, 20 Jan 2012 23:19:28 -0500 From: Alexander Graf Date: Sat, 21 Jan 2012 05:19:05 +0100 Message-Id: <1327119551-29674-21-git-send-email-agraf@suse.de> In-Reply-To: <1327119551-29674-1-git-send-email-agraf@suse.de> References: <1327119551-29674-1-git-send-email-agraf@suse.de> Subject: [Qemu-devel] [PATCH 20/26] pseries: Use correct dispatcher for PCI config space accesses List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-ppc@nongnu.org Cc: Blue Swirl , qemu-devel Developers , Aurelien Jarno , David Gibson From: David Gibson The pseries machine expects a para-virtualized guest and so supplies RTAS functions (via a hypercall) for performing PCI config space access. Currently the implementation of these calls into pci_default_{read,write}_config(). However this would be incorrect for any PCI device which overrides the default config read/write functions. AFAICT there's only one such device today, but we should still get it right. In addition the pci_host_config_{read,write}_common() functions which do correctly do this dispatch, perform bounds checking on the config space address, lack of which currently leads to an exploitable bug. This patch corrects the problem. Signed-off-by: David Gibson Signed-off-by: Alexander Graf --- hw/spapr_pci.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c index 2550e19..f3f9246 100644 --- a/hw/spapr_pci.c +++ b/hw/spapr_pci.c @@ -82,7 +82,7 @@ static void rtas_ibm_read_pci_config(sPAPREnvironment *spapr, } size = rtas_ld(args, 3); addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - val = pci_default_read_config(dev, addr, size); + val = pci_host_config_read_common(dev, addr, pci_config_size(dev), size); rtas_st(rets, 0, 0); rtas_st(rets, 1, val); } @@ -101,7 +101,7 @@ static void rtas_read_pci_config(sPAPREnvironment *spapr, } size = rtas_ld(args, 1); addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - val = pci_default_read_config(dev, addr, size); + val = pci_host_config_read_common(dev, addr, pci_config_size(dev), size); rtas_st(rets, 0, 0); rtas_st(rets, 1, val); } @@ -122,7 +122,7 @@ static void rtas_ibm_write_pci_config(sPAPREnvironment *spapr, val = rtas_ld(args, 4); size = rtas_ld(args, 3); addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - pci_default_write_config(dev, addr, val, size); + pci_host_config_write_common(dev, addr, pci_config_size(dev), val, size); rtas_st(rets, 0, 0); } @@ -141,7 +141,7 @@ static void rtas_write_pci_config(sPAPREnvironment *spapr, val = rtas_ld(args, 2); size = rtas_ld(args, 1); addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); - pci_default_write_config(dev, addr, val, size); + pci_host_config_write_common(dev, addr, pci_config_size(dev), val, size); rtas_st(rets, 0, 0); } -- 1.6.0.2