diff options
author | Alexey Kardashevskiy <aik@ozlabs.ru> | 2014-04-07 22:53:21 +1000 |
---|---|---|
committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-07-20 22:20:07 -0500 |
commit | 32c113c182baf66fa01a4f863fac3689ac838b6c (patch) | |
tree | 6963dbf9200d5700bcedddf9be41068608a5a3da | |
parent | 912d9cc089fbc8044d97106e9abfec603d83ef52 (diff) | |
download | qemu-32c113c182baf66fa01a4f863fac3689ac838b6c.zip qemu-32c113c182baf66fa01a4f863fac3689ac838b6c.tar.gz qemu-32c113c182baf66fa01a4f863fac3689ac838b6c.tar.bz2 |
spapr_pci: Fix number of returned vectors in ibm, change-msi
Current guest kernels try allocating as many vectors as the quota is.
For example, in the case of virtio-net (which has just 3 vectors)
the guest requests 4 vectors (that is the quota in the test) and
the existing ibm,change-msi handler returns 4. But before it returns,
it calls msix_set_message() in a loop and corrupts memory behind
the end of msix_table.
This limits the number of vectors returned by ibm,change-msi to
the maximum supported by the actual device.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Cc: qemu-stable@nongnu.org
[agraf: squash in bugfix from aik]
Signed-off-by: Alexander Graf <agraf@suse.de>
(cherry picked from commit b26696b519f853c9844e5154858e583600ee3cdc)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
-rw-r--r-- | hw/ppc/spapr_pci.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c index cbef095..000c94f 100644 --- a/hw/ppc/spapr_pci.c +++ b/hw/ppc/spapr_pci.c @@ -343,6 +343,21 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr, /* There is no cached config, allocate MSIs */ if (!phb->msi_table[ndev].nvec) { + int max_irqs = 0; + if (ret_intr_type == RTAS_TYPE_MSI) { + max_irqs = msi_nr_vectors_allocated(pdev); + } else if (ret_intr_type == RTAS_TYPE_MSIX) { + max_irqs = pdev->msix_entries_nr; + } + if (!max_irqs) { + error_report("Requested interrupt type %d is not enabled for device#%d", + ret_intr_type, ndev); + rtas_st(rets, 0, -1); /* Hardware error */ + return; + } + if (req_num > max_irqs) { + req_num = max_irqs; + } irq = spapr_allocate_irq_block(req_num, false, ret_intr_type == RTAS_TYPE_MSI); if (irq < 0) { |