ShuriZma
/
xqemu
mirror of https://github.com/xqemu/xqemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

spapr_pci: Fix number of returned vectors in ibm, change-msi 

Current guest kernels try allocating as many vectors as the quota is.
For example, in the case of virtio-net (which has just 3 vectors)
the guest requests 4 vectors (that is the quota in the test) and
the existing ibm,change-msi handler returns 4. But before it returns,
it calls msix_set_message() in a loop and corrupts memory behind
the end of msix_table.

This limits the number of vectors returned by ibm,change-msi to
the maximum supported by the actual device.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Cc: qemu-stable@nongnu.org
[agraf: squash in bugfix from aik]
Signed-off-by: Alexander Graf <agraf@suse.de>
This commit is contained in:
Alexey Kardashevskiy 2014-04-07 22:53:21 +10:00 committed by Alexander Graf
parent fabe9ee113
commit b26696b519
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
hw/ppc/spapr_pci.c
View File

@ -343,6 +343,21 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
/* There is no cached config, allocate MSIs */
if (!phb->msi_table[ndev].nvec) {
int max_irqs = 0;
if (ret_intr_type == RTAS_TYPE_MSI) {
max_irqs = msi_nr_vectors_allocated(pdev);
} else if (ret_intr_type == RTAS_TYPE_MSIX) {
max_irqs = pdev->msix_entries_nr;
}
if (!max_irqs) {
error_report("Requested interrupt type %d is not enabled for device#%d",
ret_intr_type, ndev);
rtas_st(rets, 0, -1); /* Hardware error */
return;
}
if (req_num > max_irqs) {
req_num = max_irqs;
}
irq = spapr_allocate_irq_block(req_num, false,
ret_intr_type == RTAS_TYPE_MSI);
if (irq < 0) {