motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-04 16:23:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

vfio: convert to 128 bit arithmetic calculations when adding mem regions

Browse source 
vfio_listener_region_add for a iommu mr results in
an overflow assert since iommu memory region is initialized
with UINT64_MAX. Convert calculations to 128 bit arithmetic
for iommu memory regions and let int128_get64 assert for non iommu
regions if there's an overflow.

Suggested-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Bandan Das <bsd@redhat.com>
[missed (end - 1) on 2nd trace call, move llsize closer to use]
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
This commit is contained in:
Bandan Das 2016-03-23 20:37:25 -04:00 • committed by Alex Williamson
parent b68a80139e
commit 55efcc537d
1 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
hw/vfio/common.c
View file

@ -323,7 +323,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
{ {
VFIOContainer *container = container_of(listener, VFIOContainer, listener); VFIOContainer *container = container_of(listener, VFIOContainer, listener);
hwaddr iova, end; hwaddr iova, end;
Int128 llend; Int128 llend, llsize;
void *vaddr; void *vaddr;
int ret; int ret;
@ -349,12 +349,12 @@ static void vfio_listener_region_add(MemoryListener *listener,
if (int128_ge(int128_make64(iova), llend)) { if (int128_ge(int128_make64(iova), llend)) {
return; return;
} }
end = int128_get64(llend); end = int128_get64(int128_sub(llend, int128_one()));
if ((iova < container->min_iova) || ((end - 1) > container->max_iova)) { if ((iova < container->min_iova) || (end > container->max_iova)) {
error_report("vfio: IOMMU container %p can't map guest IOVA region" error_report("vfio: IOMMU container %p can't map guest IOVA region"
" 0x%"HWADDR_PRIx"..0x%"HWADDR_PRIx, " 0x%"HWADDR_PRIx"..0x%"HWADDR_PRIx,
container, iova, end - 1); container, iova, end);
ret = -EFAULT; ret = -EFAULT;
goto fail; goto fail;
} }
@ -364,7 +364,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
if (memory_region_is_iommu(section->mr)) { if (memory_region_is_iommu(section->mr)) {
VFIOGuestIOMMU *giommu; VFIOGuestIOMMU *giommu;
trace_vfio_listener_region_add_iommu(iova, end - 1); trace_vfio_listener_region_add_iommu(iova, end);
/* /*
* FIXME: We should do some checking to see if the * FIXME: We should do some checking to see if the
* capabilities of the host VFIO IOMMU are adequate to model * capabilities of the host VFIO IOMMU are adequate to model
@ -395,13 +395,16 @@ static void vfio_listener_region_add(MemoryListener *listener,
section->offset_within_region + section->offset_within_region +
(iova - section->offset_within_address_space); (iova - section->offset_within_address_space);
trace_vfio_listener_region_add_ram(iova, end - 1, vaddr); trace_vfio_listener_region_add_ram(iova, end, vaddr);
ret = vfio_dma_map(container, iova, end - iova, vaddr, section->readonly); llsize = int128_sub(llend, int128_make64(iova));
ret = vfio_dma_map(container, iova, int128_get64(llsize),
vaddr, section->readonly);
if (ret) { if (ret) {
error_report("vfio_dma_map(%p, 0x%"HWADDR_PRIx", " error_report("vfio_dma_map(%p, 0x%"HWADDR_PRIx", "
"0x%"HWADDR_PRIx", %p) = %d (%m)", "0x%"HWADDR_PRIx", %p) = %d (%m)",
container, iova, end - iova, vaddr, ret); container, iova, int128_get64(llsize), vaddr, ret);
goto fail; goto fail;
} }