mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-11-25 11:53:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

pcie_host: verify mmcfg address range

Browse Source 
For a conventional pci device behind
a pcie-to-pci bridge, pci_host handlers get confused by
an out of bounds access in the range [256, 4K).

Check for such an access and make it have no effect.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Isaku Yamahata 2011-07-29 10:01:43 +09:00 committed by Michael S. Tsirkin
parent 845f85fa15
commit 43e86c8f5b
1 changed files with 22 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
hw/pcie_host.c
View File

@ -56,23 +56,39 @@ static void pcie_mmcfg_data_write(PCIBus *s,
uint32_t mmcfg_addr, uint32_t val, int len)
{
PCIDevice *pci_dev = pcie_dev_find_by_mmcfg_addr(s, mmcfg_addr);
uint32_t addr;
uint32_t limit;
if (!pci_dev) {
return;
}
pci_host_config_write_common(pci_dev, PCIE_MMCFG_CONFOFFSET(mmcfg_addr),
pci_config_size(pci_dev), val, len);
addr = PCIE_MMCFG_CONFOFFSET(mmcfg_addr);
limit = pci_config_size(pci_dev);
if (limit <= addr) {
/* conventional pci device can be behind pcie-to-pci bridge.
256 <= addr < 4K has no effects. */
return;
}
pci_host_config_write_common(pci_dev, addr, limit, val, len);
}
static uint32_t pcie_mmcfg_data_read(PCIBus *s, uint32_t addr, int len)
static uint32_t pcie_mmcfg_data_read(PCIBus *s, uint32_t mmcfg_addr, int len)
{
PCIDevice *pci_dev = pcie_dev_find_by_mmcfg_addr(s, addr);
PCIDevice *pci_dev = pcie_dev_find_by_mmcfg_addr(s, mmcfg_addr);
uint32_t addr;
uint32_t limit;
if (!pci_dev) {
return ~0x0;
}
return pci_host_config_read_common(pci_dev, PCIE_MMCFG_CONFOFFSET(addr),
pci_config_size(pci_dev), len);
addr = PCIE_MMCFG_CONFOFFSET(mmcfg_addr);
limit = pci_config_size(pci_dev);
if (limit <= addr) {
/* conventional pci device can be behind pcie-to-pci bridge.
256 <= addr < 4K has no effects. */
return ~0x0;
}
return pci_host_config_read_common(pci_dev, addr, limit, len);
}
static void pcie_mmcfg_data_writeb(void *opaque,