[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-ppc] [PATCH] spapr_pci: Fix number of returned vectors in ibm, cha
From: |
Alexey Kardashevskiy |
Subject: |
[Qemu-ppc] [PATCH] spapr_pci: Fix number of returned vectors in ibm, change-msi |
Date: |
Mon, 7 Apr 2014 22:53:21 +1000 |
Current guest kernels try allocating as many vectors as the quota is.
For example, in the case of virtio-net (which has just 3 vectors)
the guest requests 4 vectors (that is the quota in the test) and
the existing ibm,change-msi handler returns 4. But before it returns,
it calls msix_set_message() in a loop and corrupts memory behind
the end of msix_table.
This limits the number of vectors returned by ibm,change-msi to
the maximum supported by the actual device.
Signed-off-by: Alexey Kardashevskiy <address@hidden>
---
This might go to 2.0 actually.
---
hw/ppc/spapr_pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index cbef095..cdfa369 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -343,6 +343,9 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu,
sPAPREnvironment *spapr,
/* There is no cached config, allocate MSIs */
if (!phb->msi_table[ndev].nvec) {
+ if (req_num > pdev->msix_entries_nr) {
+ req_num = pdev->msix_entries_nr;
+ }
irq = spapr_allocate_irq_block(req_num, false,
ret_intr_type == RTAS_TYPE_MSI);
if (irq < 0) {
--
1.8.4.rc4
- [Qemu-ppc] [PATCH] spapr_pci: Fix number of returned vectors in ibm, change-msi,
Alexey Kardashevskiy <=