Changeset 84126 in vbox for trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp

Timestamp:

May 2, 2020 9:08:45 AM (5 years ago)

Author:

vboxsync

Message:

AMD IOMMU: bugref:9654 Bits.

File:

• trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp (modified) (2 diffs)

trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp

@@ -2753 +2753 @@
     uint32_t const offBuf = u64Value & IOMMU_CMD_BUF_TAIL_PTR_VALID_MASK;
     uint32_t const cbBuf  = iommuAmdGetBufLength(pThis->CmdBufBaseAddr.n.u4Len);
+    Assert(cbBuf <= _512K);
     if (offBuf >= cbBuf)
     {
@@ -2760 +2761 @@
     }
 
-    /** @todo More validation. Prevent wrap-around overwrite? */
-
+    /*
+     * IOMMU behavior is undefined if software advances the tail pointer equal to or beyond the
+     * head pointer after adding one or more commands to the buffer.
+     *
+     * However, we cannot enforce this strictly because it's legal for software to shrink the
+     * command queue (by reducing the offset) as well as wrap around the pointer (when head isn't
+     * at 0). Software might even make the queue empty by making head and tail equal which is
+     * allowed. I don't think we can or should try too hard to prevent software shooting itself
+     * in the foot here. As long as we make sure the offset value is within the circular buffer
+     * bounds (which we do by masking bits above) it should be sufficient.
+     */
     pThis->CmdBufTailPtr.au32[0] = offBuf;
     LogFlow((IOMMU_LOG_PFX ": Set CmdBufTailPtr to %#RX32\n", offBuf));