From 885910a88e6369acaec11b3e98a4e242e606e65e Mon Sep 17 00:00:00 2001
From: Cameron Gutman <aicommander@gmail.com>
Date: Wed, 28 Sep 2011 04:05:34 +0000
Subject: [PATCH] [ACPI] - The width parameter in AcpiOsReadPciConfiguration
 and AcpiOsWritePciConfiguration was in bits but we were treating it as a
 width in bytes - This caused overreads, memory corruption, and crashes when
 these functions were called (VMWare was particularly picky about bad accesses
 to the PCI configuration space) - A hack was (unknowingly) added which
 prevented some crashes but had a side-effect of causing the partial
 disruption of ACPI's PCI configuration space accesses while the others that
 went through wrote bad data to the PCI config space or corrupted kernel
 memory

svn path=/trunk/; revision=53880
---
 reactos/drivers/bus/acpi/osl.c | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/reactos/drivers/bus/acpi/osl.c b/reactos/drivers/bus/acpi/osl.c
index a4c47ceb8dc..b02f788c70f 100644
--- a/reactos/drivers/bus/acpi/osl.c
+++ b/reactos/drivers/bus/acpi/osl.c
@@ -456,26 +456,28 @@ AcpiOsReadPciConfiguration (
     NTSTATUS Status;
     PCI_SLOT_NUMBER slot;
 
-    if (Register == 0 || PciId->Device == 0 ||
-        Register + Width > PCI_COMMON_HDR_LENGTH)
-        return AE_ERROR;
-
     slot.u.AsULONG = 0;
     slot.u.bits.DeviceNumber = PciId->Device;
     slot.u.bits.FunctionNumber = PciId->Function;
 
     DPRINT("AcpiOsReadPciConfiguration, slot=0x%X, func=0x%X\n", slot.u.AsULONG, Register);
+
     Status = HalGetBusDataByOffset(PCIConfiguration,
         PciId->Bus,
         slot.u.AsULONG,
         Value,
         Register,
-        Width);
+        (Width / 8));
 
-    if (NT_SUCCESS(Status))
-        return AE_OK;
+    if (Status == 0 || Status == 2)
+    {
+        DPRINT1("HalGetBusDataByOffset failed (Status = %d)\n", Status);
+        return AE_NOT_FOUND;
+    }
     else
-        return AE_ERROR;
+    {
+        return AE_OK;
+    }
 }
 
 ACPI_STATUS
@@ -489,26 +491,26 @@ AcpiOsWritePciConfiguration (
     ULONG buf = Value;
     PCI_SLOT_NUMBER slot;
 
-    if (Register == 0 || PciId->Device == 0 ||
-        Register + Width > PCI_COMMON_HDR_LENGTH)
-        return AE_ERROR;
-
     slot.u.AsULONG = 0;
     slot.u.bits.DeviceNumber = PciId->Device;
     slot.u.bits.FunctionNumber = PciId->Function;
 
     DPRINT("AcpiOsWritePciConfiguration, slot=0x%x\n", slot.u.AsULONG);
+
     Status = HalSetBusDataByOffset(PCIConfiguration,
         PciId->Bus,
         slot.u.AsULONG,
         &buf,
         Register,
-        Width);
+        (Width / 8));
 
-    if (NT_SUCCESS(Status))
-        return AE_OK;
+    if (Status == 0 || Status == 2)
+    {
+        DPRINT1("HalSetBusDataByOffset failed (Status = %d)\n", Status);
+        return AE_NOT_FOUND;
+    }
     else
-        return AE_ERROR;
+        return AE_OK;
 }
 
 ACPI_STATUS