From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1J16cv-0001Ej-O3 for qemu-devel@nongnu.org; Sat, 08 Dec 2007 15:50:21 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1J16cs-0001B6-QG for qemu-devel@nongnu.org; Sat, 08 Dec 2007 15:50:21 -0500 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1J16cs-0001Au-Fy for qemu-devel@nongnu.org; Sat, 08 Dec 2007 15:50:18 -0500 Received: from os.inf.tu-dresden.de ([141.76.48.99]) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1J16cr-0006Ke-I6 for qemu-devel@nongnu.org; Sat, 08 Dec 2007 15:50:18 -0500 Received: from erwin.inf.tu-dresden.de ([141.76.48.80] helo=chrom.inf.tu-dresden.de) by os.inf.tu-dresden.de with esmtps (TLSv1:AES256-SHA:256) (Exim 4.68) id 1J16cn-000603-VJ for qemu-devel@nongnu.org; Sat, 08 Dec 2007 21:50:14 +0100 Received: from kauer by chrom.inf.tu-dresden.de with local (Exim 4.68) (envelope-from ) id 1J16cr-0001Lt-FR for qemu-devel@nongnu.org; Sat, 08 Dec 2007 21:50:17 +0100 Date: Sat, 8 Dec 2007 21:50:17 +0100 From: Bernhard Kauer Subject: Re: [Qemu-devel] [PATCH] SVM IOIO intercept does not check all bits Message-ID: <20071208205017.GA4269@chrom.inf.tu-dresden.de> References: <20071206193147.GA4033@chrom.inf.tu-dresden.de> <653ACA19-A2D2-444F-83AC-2DB98136C16A@csgraf.de> <20071207142002.GB14192@chrom.inf.tu-dresden.de> <7585B314-A65F-4D98-9854-74C01E288111@csgraf.de> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="7JfCtLOvnd9MIVvH" Content-Disposition: inline In-Reply-To: <7585B314-A65F-4D98-9854-74C01E288111@csgraf.de> Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org --7JfCtLOvnd9MIVvH Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Fri, Dec 07, 2007 at 04:16:00PM +0100, Alexander Graf wrote: >>>> For IN/OUT instructions that access more than a single byte, the >>>> permission bits for all bytes are checked; if any bit is set to 1, >>>> the I/O operation is intercepted. >>>> > > That was the one. Thank you. Unfortunately there is another bug in this line. As there is only a single byte read from the permission bitmap, an unaligned 4-byte access to port 0x7 would be possible even when the access to port 0x8-0xa is not allowed. The updated patch fixes also this case. Bernhard Kauer --7JfCtLOvnd9MIVvH Content-Type: text/x-diff; charset=us-ascii Content-Disposition: attachment; filename="qemu_ioio.diff" Index: target-i386/helper.c =================================================================== RCS file: /sources/qemu/qemu/target-i386/helper.c,v retrieving revision 1.95 diff -u -r1.95 helper.c --- target-i386/helper.c 18 Nov 2007 01:44:38 -0000 1.95 +++ target-i386/helper.c 8 Dec 2007 20:44:28 -0000 @@ -4250,7 +4332,8 @@ uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.iopm_base_pa)); uint16_t port = (uint16_t) (param >> 16); - if(ldub_phys(addr + port / 8) & (1 << (port % 8))) + uint16_t mask = (1 << ((param >> 4) & 7)) - 1; + if(lduw_phys(addr + port / 8) & (mask << (port & 7))) vmexit(type, param); } break; --7JfCtLOvnd9MIVvH--