Beth Kon wrote:
This patch is also based on the patch by Vincent Minet. It corrects the size
calculation of the RSDT, and checks for overflow of MAX_RSDT_ENTRIES,
assuming that the external table entry count is contained within
MAX_RSDT_ENTRIES.
Signed-off-by: Beth Kon <eak@xxxxxxxxxx>
diff --git a/kvm/bios/rombios32.c b/kvm/bios/rombios32.c
index 7f62e4f..ac8f9c5 100755
--- a/kvm/bios/rombios32.c
+++ b/kvm/bios/rombios32.c
@@ -1626,7 +1626,7 @@ void acpi_bios_init(void)
addr = base_addr = ram_size - ACPI_DATA_SIZE;
rsdt_addr = addr;
rsdt = (void *)(addr);
- rsdt_size = sizeof(*rsdt) + external_tables * 4;
+ rsdt_size = sizeof(*rsdt);
addr += rsdt_size;
fadt_addr = addr;
@@ -1873,16 +1873,6 @@ void acpi_bios_init(void)
"HPET", sizeof(*hpet), 1);
#endif
- acpi_additional_tables(); /* resets cfg to required entry */
- for(i = 0; i < external_tables; i++) {
- uint16_t len;
- if(acpi_load_table(i, addr, &len) < 0)
- BX_PANIC("Failed to load ACPI table from QEMU\n");
- rsdt->table_offset_entry[nb_rsdt_entries++] = cpu_to_le32(addr);
- addr += len;
- if(addr >= ram_size)
- BX_PANIC("ACPI table overflow\n");
- }
#endif
/* RSDT */
@@ -1895,6 +1885,19 @@ void acpi_bios_init(void)
// rsdt->table_offset_entry[nb_rsdt_entries++] = cpu_to_le32(hpet_addr);
if (nb_numa_nodes > 0)
rsdt->table_offset_entry[nb_rsdt_entries++] = cpu_to_le32(srat_addr);
+ acpi_additional_tables(); /* resets cfg to required entry */
+ /* external_tables load must occur last to
+ * properly check for MAX_RSDT_ENTRIES overflow.
+ */
+ for(i = 0; i < external_tables; i++) {
+ uint16_t len;
+ if(acpi_load_table(i, addr, &len) < 0)
+ BX_PANIC("Failed to load ACPI table from QEMU\n");
+ rsdt->table_offset_entry[nb_rsdt_entries++] = cpu_to_le32(addr);
+ addr += len;
+ if((addr >= ram_size) || (nb_rsdt_entries > MAX_RSDT_ENTRIES))
+ BX_PANIC("ACPI table overflow\n");
+ }
#endif
rsdt_size -= MAX_RSDT_ENTRIES * 4;
rsdt_size += nb_rsdt_entries * 4;
Same comment - instead of calculating the size incrementally, set
rsdt_end = &rsdt->table_offset_entry[nb_rsdt_entries] and calculate the
size from that.
btw, why did you move the code?
--
Do not meddle in the internals of kernels, for they are subtle and quick to panic.
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
