[Qemu-devel] [PATCH] spapr_pci: Fix config space corruption

[Qemu-devel] [PATCH] spapr_pci: Fix config space corruption

[Alexey Kardashevskiy]

When disabling MSI/MSIX via "ibm,change-msi" RTAS call, no check was made
if MSI or MSIX is actually supported and the MSI message was reset
unconditionally. If this happened on a device which does not support MSI
(but does support MSIX, otherwise "ibm,change-msi" would not be called),
this device would have PCIDevice::msi_cap field (MSI capability offset)
set to zero and writing a vector would actually clear PCI status.

This clears MSI message only if MSI or MSIX is present on a device.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
 hw/ppc/spapr_pci.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index d1f4c86..c0e703f 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -263,7 +263,6 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     unsigned int irq, max_irqs = 0, num = 0;
     sPAPRPHBState *phb = NULL;
     PCIDevice *pdev = NULL;
-    bool msix = false;
     spapr_pci_msi *msi;
     int *config_addr_key;
 
@@ -301,7 +300,12 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
         }
 
         xics_free(spapr->icp, msi->first_irq, msi->num);
-        spapr_msi_setmsg(pdev, 0, msix, 0, num);
+        if (msi_present(pdev)) {
+            spapr_msi_setmsg(pdev, 0, false, 0, num);
+        }
+        if (msix_present(pdev)) {
+            spapr_msi_setmsg(pdev, 0, true, 0, num);
+        }
         g_hash_table_remove(phb->msi, &config_addr);
 
         trace_spapr_pci_msi("Released MSIs", config_addr);
-- 
2.0.0

Re: [Qemu-devel] [PATCH] spapr_pci: Fix config space corruption

[Alexey Kardashevskiy]

On 08/13/2014 05:20 PM, Alexey Kardashevskiy wrote:
> When disabling MSI/MSIX via "ibm,change-msi" RTAS call, no check was made
> if MSI or MSIX is actually supported and the MSI message was reset
> unconditionally. If this happened on a device which does not support MSI
> (but does support MSIX, otherwise "ibm,change-msi" would not be called),
> this device would have PCIDevice::msi_cap field (MSI capability offset)
> set to zero and writing a vector would actually clear PCI status.
> 
> This clears MSI message only if MSI or MSIX is present on a device.

Ping?


> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
> ---
>  hw/ppc/spapr_pci.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
> index d1f4c86..c0e703f 100644
> --- a/hw/ppc/spapr_pci.c
> +++ b/hw/ppc/spapr_pci.c
> @@ -263,7 +263,6 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
>      unsigned int irq, max_irqs = 0, num = 0;
>      sPAPRPHBState *phb = NULL;
>      PCIDevice *pdev = NULL;
> -    bool msix = false;
>      spapr_pci_msi *msi;
>      int *config_addr_key;
>  
> @@ -301,7 +300,12 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPREnvironment *spapr,
>          }
>  
>          xics_free(spapr->icp, msi->first_irq, msi->num);
> -        spapr_msi_setmsg(pdev, 0, msix, 0, num);
> +        if (msi_present(pdev)) {
> +            spapr_msi_setmsg(pdev, 0, false, 0, num);
> +        }
> +        if (msix_present(pdev)) {
> +            spapr_msi_setmsg(pdev, 0, true, 0, num);
> +        }
>          g_hash_table_remove(phb->msi, &config_addr);
>  
>          trace_spapr_pci_msi("Released MSIs", config_addr);
> 


-- 
Alexey

Re: [Qemu-devel] [PATCH] spapr_pci: Fix config space corruption

[Alexander Graf]

On 13.08.14 09:20, Alexey Kardashevskiy wrote:
> When disabling MSI/MSIX via "ibm,change-msi" RTAS call, no check was made
> if MSI or MSIX is actually supported and the MSI message was reset
> unconditionally. If this happened on a device which does not support MSI
> (but does support MSIX, otherwise "ibm,change-msi" would not be called),
> this device would have PCIDevice::msi_cap field (MSI capability offset)
> set to zero and writing a vector would actually clear PCI status.
> 
> This clears MSI message only if MSI or MSIX is present on a device.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

Thanks, applied to ppc-next.


Alex