* [Qemu-devel] [PATCH] i386: amd_iommu: fix MMIO register count and access
@ 2016-12-02 11:16 P J P
2016-12-13 10:12 ` P J P
0 siblings, 1 reply; 3+ messages in thread
From: P J P @ 2016-12-02 11:16 UTC (permalink / raw)
To: Qemu Developers; +Cc: Michael S . Tsirkin, Azureyang, Prasad J Pandit
From: Prasad J Pandit <pjp@fedoraproject.org>
IOMMU MMIO registers are divided in two groups by their offsets.
Low offsets(<0x2000) registers are grouped into 'amdvi_mmio_low'
table and higher offsets(>=0x2000) registers are grouped into
'amdvi_mmio_high' table. No of registers in each table is given
by macro 'AMDVI_MMIO_REGS_LOW' and 'AMDVI_MMIO_REGS_HIGH' resp.
Values of these two macros were swapped, resulting in an OOB
access when reading 'amdvi_mmio_high' table. Correct these two
macros. Also read from 'amdvi_mmio_low' table for lower address.
Reported-by: Azureyang <azureyang@tencent.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/i386/amd_iommu.c | 2 +-
hw/i386/amd_iommu.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 47b79d9..e0732cc 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -562,7 +562,7 @@ static void amdvi_mmio_trace(hwaddr addr, unsigned size)
trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
} else {
index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;
- trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
+ trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr & ~0x07);
}
}
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 884926e..0d3dc6a 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -49,8 +49,8 @@
#define AMDVI_CAPAB_INIT_TYPE (3 << 16)
/* No. of used MMIO registers */
-#define AMDVI_MMIO_REGS_HIGH 8
-#define AMDVI_MMIO_REGS_LOW 7
+#define AMDVI_MMIO_REGS_HIGH 7
+#define AMDVI_MMIO_REGS_LOW 8
/* MMIO registers */
#define AMDVI_MMIO_DEVICE_TABLE 0x0000
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] i386: amd_iommu: fix MMIO register count and access
2016-12-02 11:16 [Qemu-devel] [PATCH] i386: amd_iommu: fix MMIO register count and access P J P
@ 2016-12-13 10:12 ` P J P
2016-12-13 16:25 ` Michael S. Tsirkin
0 siblings, 1 reply; 3+ messages in thread
From: P J P @ 2016-12-13 10:12 UTC (permalink / raw)
To: Qemu Developers; +Cc: Azureyang, Michael S . Tsirkin
+-- On Fri, 2 Dec 2016, P J P wrote --+
| IOMMU MMIO registers are divided in two groups by their offsets.
| Low offsets(<0x2000) registers are grouped into 'amdvi_mmio_low'
| table and higher offsets(>=0x2000) registers are grouped into
| 'amdvi_mmio_high' table. No of registers in each table is given
| by macro 'AMDVI_MMIO_REGS_LOW' and 'AMDVI_MMIO_REGS_HIGH' resp.
| Values of these two macros were swapped, resulting in an OOB
| access when reading 'amdvi_mmio_high' table. Correct these two
| macros. Also read from 'amdvi_mmio_low' table for lower address.
|
| Reported-by: Azureyang <azureyang@tencent.com>
| Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
| ---
| hw/i386/amd_iommu.c | 2 +-
| hw/i386/amd_iommu.h | 4 ++--
| 2 files changed, 3 insertions(+), 3 deletions(-)
|
| diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
| index 47b79d9..e0732cc 100644
| --- a/hw/i386/amd_iommu.c
| +++ b/hw/i386/amd_iommu.c
| @@ -562,7 +562,7 @@ static void amdvi_mmio_trace(hwaddr addr, unsigned size)
| trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
| } else {
| index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;
| - trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
| + trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr & ~0x07);
| }
| }
|
| diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
| index 884926e..0d3dc6a 100644
| --- a/hw/i386/amd_iommu.h
| +++ b/hw/i386/amd_iommu.h
| @@ -49,8 +49,8 @@
| #define AMDVI_CAPAB_INIT_TYPE (3 << 16)
|
| /* No. of used MMIO registers */
| -#define AMDVI_MMIO_REGS_HIGH 8
| -#define AMDVI_MMIO_REGS_LOW 7
| +#define AMDVI_MMIO_REGS_HIGH 7
| +#define AMDVI_MMIO_REGS_LOW 8
|
| /* MMIO registers */
| #define AMDVI_MMIO_DEVICE_TABLE 0x0000
Ping..!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] i386: amd_iommu: fix MMIO register count and access
2016-12-13 10:12 ` P J P
@ 2016-12-13 16:25 ` Michael S. Tsirkin
0 siblings, 0 replies; 3+ messages in thread
From: Michael S. Tsirkin @ 2016-12-13 16:25 UTC (permalink / raw)
To: P J P; +Cc: Qemu Developers, Azureyang
On Tue, Dec 13, 2016 at 03:42:13PM +0530, P J P wrote:
> +-- On Fri, 2 Dec 2016, P J P wrote --+
> | IOMMU MMIO registers are divided in two groups by their offsets.
> | Low offsets(<0x2000) registers are grouped into 'amdvi_mmio_low'
> | table and higher offsets(>=0x2000) registers are grouped into
> | 'amdvi_mmio_high' table. No of registers in each table is given
> | by macro 'AMDVI_MMIO_REGS_LOW' and 'AMDVI_MMIO_REGS_HIGH' resp.
> | Values of these two macros were swapped, resulting in an OOB
> | access when reading 'amdvi_mmio_high' table. Correct these two
> | macros. Also read from 'amdvi_mmio_low' table for lower address.
> |
> | Reported-by: Azureyang <azureyang@tencent.com>
> | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> | ---
> | hw/i386/amd_iommu.c | 2 +-
> | hw/i386/amd_iommu.h | 4 ++--
> | 2 files changed, 3 insertions(+), 3 deletions(-)
> |
> | diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
> | index 47b79d9..e0732cc 100644
> | --- a/hw/i386/amd_iommu.c
> | +++ b/hw/i386/amd_iommu.c
> | @@ -562,7 +562,7 @@ static void amdvi_mmio_trace(hwaddr addr, unsigned size)
> | trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
> | } else {
> | index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;
> | - trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
> | + trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr & ~0x07);
> | }
> | }
> |
> | diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
> | index 884926e..0d3dc6a 100644
> | --- a/hw/i386/amd_iommu.h
> | +++ b/hw/i386/amd_iommu.h
> | @@ -49,8 +49,8 @@
> | #define AMDVI_CAPAB_INIT_TYPE (3 << 16)
> |
> | /* No. of used MMIO registers */
> | -#define AMDVI_MMIO_REGS_HIGH 8
> | -#define AMDVI_MMIO_REGS_LOW 7
> | +#define AMDVI_MMIO_REGS_HIGH 7
> | +#define AMDVI_MMIO_REGS_LOW 8
> |
> | /* MMIO registers */
> | #define AMDVI_MMIO_DEVICE_TABLE 0x0000
>
>
> Ping..!
Sorry missed 2.8. Wil be in 2.8.1
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-12-13 16:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-02 11:16 [Qemu-devel] [PATCH] i386: amd_iommu: fix MMIO register count and access P J P
2016-12-13 10:12 ` P J P
2016-12-13 16:25 ` Michael S. Tsirkin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).