diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-12-02 16:46:26 +0530 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2016-12-16 01:14:38 +0200 |
| commit | d9429b84af2302b6e28bec3c52710cf67eda3cee (patch) | |
| tree | bd2c363db117e20496965501db75c137cf523ffb /hw/i386/amd_iommu.h | |
| parent | e10e798c85c2331dab338b6a01835ebde81136e5 (diff) | |
| download | focaccia-qemu-d9429b84af2302b6e28bec3c52710cf67eda3cee.tar.gz focaccia-qemu-d9429b84af2302b6e28bec3c52710cf67eda3cee.zip | |
i386: amd_iommu: fix MMIO register count and access
IOMMU MMIO registers are divided in two groups by their offsets. Low offsets(<0x2000) registers are grouped into 'amdvi_mmio_low' table and higher offsets(>=0x2000) registers are grouped into 'amdvi_mmio_high' table. No of registers in each table is given by macro 'AMDVI_MMIO_REGS_LOW' and 'AMDVI_MMIO_REGS_HIGH' resp. Values of these two macros were swapped, resulting in an OOB access when reading 'amdvi_mmio_high' table. Correct these two macros. Also read from 'amdvi_mmio_low' table for lower address. Reported-by: Azureyang <azureyang@tencent.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/i386/amd_iommu.h')
| -rw-r--r-- | hw/i386/amd_iommu.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h index 884926e9e7..0d3dc6a9f2 100644 --- a/hw/i386/amd_iommu.h +++ b/hw/i386/amd_iommu.h @@ -49,8 +49,8 @@ #define AMDVI_CAPAB_INIT_TYPE (3 << 16) /* No. of used MMIO registers */ -#define AMDVI_MMIO_REGS_HIGH 8 -#define AMDVI_MMIO_REGS_LOW 7 +#define AMDVI_MMIO_REGS_HIGH 7 +#define AMDVI_MMIO_REGS_LOW 8 /* MMIO registers */ #define AMDVI_MMIO_DEVICE_TABLE 0x0000 |