From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1J0MUS-00065A-4r
	for qemu-devel@nongnu.org; Thu, 06 Dec 2007 14:34:32 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1J0MUQ-00064v-RA
	for qemu-devel@nongnu.org; Thu, 06 Dec 2007 14:34:31 -0500
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1J0MUQ-00064o-Hn
	for qemu-devel@nongnu.org; Thu, 06 Dec 2007 14:34:30 -0500
Received: from os.inf.tu-dresden.de ([141.76.48.99])
	by monty-python.gnu.org with esmtps
	(TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60)
	(envelope-from <kauer@os.inf.tu-dresden.de>) id 1J0MUQ-0002dz-7l
	for qemu-devel@nongnu.org; Thu, 06 Dec 2007 14:34:30 -0500
Received: from erwin.inf.tu-dresden.de ([141.76.48.80]
	helo=chrom.inf.tu-dresden.de)
	by os.inf.tu-dresden.de with esmtps (TLSv1:AES256-SHA:256) (Exim 4.68)
	id 1J0MUO-000712-Ih
	for qemu-devel@nongnu.org; Thu, 06 Dec 2007 20:34:28 +0100
Received: from kauer by chrom.inf.tu-dresden.de with local (Exim 4.68)
	(envelope-from <kauer@chrom.inf.tu-dresden.de>) id 1J0MRn-0002lB-Rd
	for qemu-devel@nongnu.org; Thu, 06 Dec 2007 20:31:47 +0100
Date: Thu, 6 Dec 2007 20:31:47 +0100
From: Bernhard Kauer <kauer@os.inf.tu-dresden.de>
Message-ID: <20071206193147.GA4033@chrom.inf.tu-dresden.de>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="pWyiEgJYm5f9v55/"
Content-Disposition: inline
Subject: [Qemu-devel] [PATCH] SVM IOIO intercept does not check all bits
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org


--pWyiEgJYm5f9v55/
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

The SVM IOIO intercept does not check all bits in the IO permission map
for in/outs with word or long operand size. The attached patch fix this.


        Bernhard Kauer

--pWyiEgJYm5f9v55/
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="qemu_ioio.diff"

Index: target-i386/helper.c
--- target-i386/helper.c	18 Nov 2007 01:44:38 -0000	1.95
+++ target-i386/helper.c	6 Dec 2007 19:22:55 -0000
@@ -4250,8 +4331,8 @@
             uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.iopm_base_pa));
             uint16_t port = (uint16_t) (param >> 16);
 
-            if(ldub_phys(addr + port / 8) & (1 << (port % 8)))
-                vmexit(type, param);
+	    if(ldub_phys(addr + port / 8) & (((1 << ((param >> 4) & 0x7)) - 1) << (port % 8)))
+	      vmexit(type, param);
         }
         break;
 

--pWyiEgJYm5f9v55/--