From d9429b84af2302b6e28bec3c52710cf67eda3cee Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Fri, 2 Dec 2016 16:46:26 +0530 Subject: i386: amd_iommu: fix MMIO register count and access IOMMU MMIO registers are divided in two groups by their offsets. Low offsets(<0x2000) registers are grouped into 'amdvi_mmio_low' table and higher offsets(>=0x2000) registers are grouped into 'amdvi_mmio_high' table. No of registers in each table is given by macro 'AMDVI_MMIO_REGS_LOW' and 'AMDVI_MMIO_REGS_HIGH' resp. Values of these two macros were swapped, resulting in an OOB access when reading 'amdvi_mmio_high' table. Correct these two macros. Also read from 'amdvi_mmio_low' table for lower address. Reported-by: Azureyang Signed-off-by: Prasad J Pandit Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/i386/amd_iommu.c | 2 +- hw/i386/amd_iommu.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'hw/i386') diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c index 47b79d9..e0732cc 100644 --- a/hw/i386/amd_iommu.c +++ b/hw/i386/amd_iommu.c @@ -562,7 +562,7 @@ static void amdvi_mmio_trace(hwaddr addr, unsigned size) trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07); } else { index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index; - trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07); + trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr & ~0x07); } } diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h index 884926e..0d3dc6a 100644 --- a/hw/i386/amd_iommu.h +++ b/hw/i386/amd_iommu.h @@ -49,8 +49,8 @@ #define AMDVI_CAPAB_INIT_TYPE (3 << 16) /* No. of used MMIO registers */ -#define AMDVI_MMIO_REGS_HIGH 8 -#define AMDVI_MMIO_REGS_LOW 7 +#define AMDVI_MMIO_REGS_HIGH 7 +#define AMDVI_MMIO_REGS_LOW 8 /* MMIO registers */ #define AMDVI_MMIO_DEVICE_TABLE 0x0000 -- cgit v1.1