From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:36878) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SSjpo-00035y-9z for qemu-devel@nongnu.org; Fri, 11 May 2012 03:00:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SSjpj-0006Gj-AV for qemu-devel@nongnu.org; Fri, 11 May 2012 03:00:15 -0400 Received: from mail-yw0-f45.google.com ([209.85.213.45]:43460) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SSjpj-0006GD-64 for qemu-devel@nongnu.org; Fri, 11 May 2012 03:00:11 -0400 Received: by yhoo21 with SMTP id o21so2950202yho.4 for ; Fri, 11 May 2012 00:00:09 -0700 (PDT) Message-ID: <4FACB8EF.1040104@ozlabs.ru> Date: Fri, 11 May 2012 16:59:59 +1000 From: Alexey Kardashevskiy MIME-Version: 1.0 Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [RFC PATCH] qemu pci: pci_add_capability enhancement to prevent damaging config space List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: aik@ozlabs.ru, kvm@vger.kernel.org Normally the pci_add_capability is called on devices to add new capability. This is ok for emulated devices which capabilities list is being built by QEMU. In the case of VFIO the capability may already exist and adding new capability into the beginning of the linked list may create a loop. For example, the old code destroys the following config of PCIe Intel E1000E: before adding PCI_CAP_ID_MSI (0x05): 0x34: 0xC8 0xC8: 0x01 0xD0 0xD0: 0x05 0xE0 0xE0: 0x10 0x00 after: 0x34: 0xD0 0xC8: 0x01 0xD0 0xD0: 0x05 0xC8 0xE0: 0x10 0x00 As result capabilities 0x01 and 0x05 point to each other. The proposed patch does not change capability pointers when the same type capability is about to add. Signed-off-by: Alexey Kardashevskiy --- hw/pci.c | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) diff --git a/hw/pci.c b/hw/pci.c index aa0c0b8..1f7c924 100644 --- a/hw/pci.c +++ b/hw/pci.c @@ -1794,10 +1794,12 @@ int pci_add_capability(PCIDevice *pdev, uint8_t cap_id, } config = pdev->config + offset; - config[PCI_CAP_LIST_ID] = cap_id; - config[PCI_CAP_LIST_NEXT] = pdev->config[PCI_CAPABILITY_LIST]; - pdev->config[PCI_CAPABILITY_LIST] = offset; - pdev->config[PCI_STATUS] |= PCI_STATUS_CAP_LIST; + if (config[PCI_CAP_LIST_ID] != cap_id) { + config[PCI_CAP_LIST_ID] = cap_id; + config[PCI_CAP_LIST_NEXT] = pdev->config[PCI_CAPABILITY_LIST]; + pdev->config[PCI_CAPABILITY_LIST] = offset; + pdev->config[PCI_STATUS] |= PCI_STATUS_CAP_LIST; + } memset(pdev->used + offset, 0xFF, size); /* Make capability read-only by default */ memset(pdev->wmask + offset, 0, size); -- Alexey