From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:53435) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4dJI-0006YV-Sj for qemu-devel@nongnu.org; Mon, 05 Mar 2012 14:11:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S4dJD-0000Qe-UO for qemu-devel@nongnu.org; Mon, 05 Mar 2012 14:11:04 -0500 Received: from mail-pz0-f46.google.com ([209.85.210.46]:36826) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4dJD-0000O2-MZ for qemu-devel@nongnu.org; Mon, 05 Mar 2012 14:10:59 -0500 Received: by mail-pz0-f46.google.com with SMTP id r28so6798479daj.33 for ; Mon, 05 Mar 2012 11:10:58 -0800 (PST) Sender: fluxion From: Michael Roth Date: Mon, 5 Mar 2012 13:10:33 -0600 Message-Id: <1330974634-7527-7-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1330974634-7527-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1330974634-7527-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH v3 6/7] qdev: use int32_t container for devfn property List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, aliguori@us.ibm.com, afaerber@suse.de Valid range for devfn is -1 to 255 (-1 for automatic assignment). We do not currently validate this due to devfn being stored as a uint32_t. This can lead to segfaults and other strange behavior. We could technically just cast it to int32_t to implement the checking, but this will not work for visitor-based setting where we may do additional bounds-checking based on target container type, which is int32_t for this case. Signed-off-by: Michael Roth --- hw/pci.c | 2 +- hw/pci.h | 2 +- hw/qdev-properties.c | 11 ++++------- hw/qdev.h | 2 +- 4 files changed, 7 insertions(+), 10 deletions(-) diff --git a/hw/pci.c b/hw/pci.c index bf046bf..40574b8 100644 --- a/hw/pci.c +++ b/hw/pci.c @@ -1539,7 +1539,7 @@ PCIDevice *pci_create_multifunction(PCIBus *bus, int devfn, bool multifunction, DeviceState *dev; dev = qdev_create(&bus->qbus, name); - qdev_prop_set_uint32(dev, "addr", devfn); + qdev_prop_set_int32(dev, "addr", devfn); qdev_prop_set_bit(dev, "multifunction", multifunction); return PCI_DEVICE(dev); } diff --git a/hw/pci.h b/hw/pci.h index 4f19fdb..3edf38a 100644 --- a/hw/pci.h +++ b/hw/pci.h @@ -188,7 +188,7 @@ struct PCIDevice { /* the following fields are read only */ PCIBus *bus; - uint32_t devfn; + int32_t devfn; char name[64]; PCIIORegion io_regions[PCI_NUM_REGIONS]; diff --git a/hw/qdev-properties.c b/hw/qdev-properties.c index 0423af1..e2bfeff 100644 --- a/hw/qdev-properties.c +++ b/hw/qdev-properties.c @@ -826,7 +826,7 @@ static void set_pci_devfn(Object *obj, Visitor *v, void *opaque, { DeviceState *dev = DEVICE(obj); Property *prop = opaque; - uint32_t *ptr = qdev_get_prop_ptr(dev, prop); + int32_t *ptr = qdev_get_prop_ptr(dev, prop); unsigned int slot, fn, n; Error *local_err = NULL; char *str = (char *)""; @@ -859,7 +859,7 @@ invalid: static int print_pci_devfn(DeviceState *dev, Property *prop, char *dest, size_t len) { - uint32_t *ptr = qdev_get_prop_ptr(dev, prop); + int32_t *ptr = qdev_get_prop_ptr(dev, prop); if (*ptr == -1) { return snprintf(dest, len, ""); @@ -874,11 +874,8 @@ PropertyInfo qdev_prop_pci_devfn = { .print = print_pci_devfn, .get = get_int32, .set = set_pci_devfn, - /* FIXME: this should be -1...255, but the address is stored - * into an uint32_t rather than int32_t. - */ - .min = 0, - .max = 0xFFFFFFFFULL, + .min = -1, + .max = 255, }; /* --- public helpers --- */ diff --git a/hw/qdev.h b/hw/qdev.h index 9cc3f98..d6f5f3a 100644 --- a/hw/qdev.h +++ b/hw/qdev.h @@ -265,7 +265,7 @@ extern PropertyInfo qdev_prop_pci_devfn; #define DEFINE_PROP_HEX64(_n, _s, _f, _d) \ DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_hex64, uint64_t) #define DEFINE_PROP_PCI_DEVFN(_n, _s, _f, _d) \ - DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_pci_devfn, uint32_t) + DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_pci_devfn, int32_t) #define DEFINE_PROP_PTR(_n, _s, _f) \ DEFINE_PROP(_n, _s, _f, qdev_prop_ptr, void*) -- 1.7.4.1