OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

qemu/msix: fix table access issues

Browse Source 
Fixes a couple of issues with msix table access:
- With misbehaving guests, misaligned 4 byte access could overflow
  msix table and cause qemu to segfault. Since PCI spec requires
  host to only issue dword-aligned accesses, as a fix,
  it's enough to mask the address low bits.
- Tables use pci format, not native format, and so
  we must use pci_[sg]et_long on read/write.

Reported-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Michael S. Tsirkin 2009-10-26 16:22:44 +02:00 committed by Anthony Liguori
parent 79758e95d7
commit 76f5159d7f
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/msix.c
View File

@ -128,13 +128,10 @@ void msix_write_config(PCIDevice *dev, uint32_t addr,
static uint32_t msix_mmio_readl(void *opaque, target_phys_addr_t addr) static uint32_t msix_mmio_readl(void *opaque, target_phys_addr_t addr)
{ {
PCIDevice *dev = opaque; PCIDevice *dev = opaque;
unsigned int offset = addr & (MSIX_PAGE_SIZE - 1); unsigned int offset = addr & (MSIX_PAGE_SIZE - 1) & ~0x3;
void *page = dev->msix_table_page; void *page = dev->msix_table_page;
uint32_t val = 0;
memcpy(&val, (void *)((char *)page + offset), 4); return pci_get_long(page + offset);
return val;
} }
static uint32_t msix_mmio_read_unallowed(void *opaque, target_phys_addr_t addr) static uint32_t msix_mmio_read_unallowed(void *opaque, target_phys_addr_t addr)
@ -178,9 +175,9 @@ static void msix_mmio_writel(void *opaque, target_phys_addr_t addr,
uint32_t val) uint32_t val)
{ {
PCIDevice *dev = opaque; PCIDevice *dev = opaque;
unsigned int offset = addr & (MSIX_PAGE_SIZE - 1); unsigned int offset = addr & (MSIX_PAGE_SIZE - 1) & ~0x3;
int vector = offset / MSIX_ENTRY_SIZE; int vector = offset / MSIX_ENTRY_SIZE;
memcpy(dev->msix_table_page + offset, &val, 4); pci_set_long(dev->msix_table_page + offset, val);
if (!msix_is_masked(dev, vector) && msix_is_pending(dev, vector)) { if (!msix_is_masked(dev, vector) && msix_is_pending(dev, vector)) {
msix_clr_pending(dev, vector); msix_clr_pending(dev, vector);
msix_notify(dev, vector); msix_notify(dev, vector);