From mboxrd@z Thu Jan 1 00:00:00 1970 From: Wei Wang2 Subject: [PATCH] msi: Avoid uninitialized msi descriptors Date: Wed, 11 Aug 2010 15:43:02 +0200 Message-ID: <201008111543.03377.wei.wang2@amd.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="Boundary-00=_njqYMzbTXjBa9Gh" Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: "xen-devel@lists.xensource.com" List-Id: xen-devel@lists.xenproject.org --Boundary-00=_njqYMzbTXjBa9Gh Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Hi, When __pci_enable_msix() returns early, output parameter (struct msi_desc=20 **desc) will not be initialized. On my machine, a Broadcom BCM5709 nic has= =20 both MSI and MSIX capability blocks and when guest tries to enable msix=20 interrupts but __pci_enable_msix() returns early for encountering a msi=20 block, the whole system will crash for fatal page fault immediately. Thanks,=20 Wei Signed-off-by: Wei Wang =2D-=20 AMD GmbH, Germany Operating System Research Center Legal Information: Advanced Micro Devices GmbH Karl-Hammerschmidt-Str. 34 85609 Dornach b. M=FCnchen Gesch=E4ftsf=FChrer: Andrew Bowd, Thomas M. McCoy, Giuliano Meroni Sitz: Dornach, Gemeinde Aschheim, Landkreis M=FCnchen Registergericht M=FCnchen, HRB Nr. 43632 --Boundary-00=_njqYMzbTXjBa9Gh Content-Type: text/x-diff; charset="iso-8859-1"; name="fix_msi.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="fix_msi.patch" diff -r ef5f25de00da xen/arch/x86/msi.c --- a/xen/arch/x86/msi.c Mon Aug 02 17:19:06 2010 +0100 +++ b/xen/arch/x86/msi.c Wed Aug 11 14:07:02 2010 +0200 @@ -607,30 +607,35 @@ static int msix_capability_init(struct p * indicates the successful setup of an entry zero with the new MSI * irq or non-zero for otherwise. **/ + static int __pci_enable_msi(struct msi_info *msi, struct msi_desc **desc) { int status; struct pci_dev *pdev; + struct msi_desc *old_desc; ASSERT(spin_is_locked(&pcidevs_lock)); pdev = pci_get_pdev(msi->bus, msi->devfn); if ( !pdev ) return -ENODEV; - if ( find_msi_entry(pdev, msi->irq, PCI_CAP_ID_MSI) ) + old_desc = find_msi_entry(pdev, msi->irq, PCI_CAP_ID_MSI); + if ( old_desc ) { dprintk(XENLOG_WARNING, "irq %d has already mapped to MSI on " "device %02x:%02x.%01x.\n", msi->irq, msi->bus, PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn)); + *desc = old_desc; return 0; } - if ( find_msi_entry(pdev, -1, PCI_CAP_ID_MSIX) ) + old_desc = find_msi_entry(pdev, -1, PCI_CAP_ID_MSIX); + if ( old_desc ) { dprintk(XENLOG_WARNING, "MSI-X is already in use on " "device %02x:%02x.%01x\n", msi->bus, PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn)); - return 0; + pci_disable_msi(old_desc); } status = msi_capability_init(pdev, msi->irq, desc); @@ -679,6 +684,7 @@ static int __pci_enable_msix(struct msi_ u16 control; u8 slot = PCI_SLOT(msi->devfn); u8 func = PCI_FUNC(msi->devfn); + struct msi_desc *old_desc; ASSERT(spin_is_locked(&pcidevs_lock)); pdev = pci_get_pdev(msi->bus, msi->devfn); @@ -691,20 +697,24 @@ static int __pci_enable_msix(struct msi_ if (msi->entry_nr >= nr_entries) return -EINVAL; - if ( find_msi_entry(pdev, msi->irq, PCI_CAP_ID_MSIX) ) + old_desc = find_msi_entry(pdev, msi->irq, PCI_CAP_ID_MSIX); + if ( old_desc ) { dprintk(XENLOG_WARNING, "irq %d has already mapped to MSIX on " "device %02x:%02x.%01x.\n", msi->irq, msi->bus, PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn)); + *desc = old_desc; return 0; } - if ( find_msi_entry(pdev, -1, PCI_CAP_ID_MSI) ) + old_desc = find_msi_entry(pdev, -1, PCI_CAP_ID_MSI); + if ( old_desc ) { dprintk(XENLOG_WARNING, "MSI is already in use on " "device %02x:%02x.%01x\n", msi->bus, PCI_SLOT(msi->devfn), PCI_FUNC(msi->devfn)); - return 0; + pci_disable_msi(old_desc); + } status = msix_capability_init(pdev, msi, desc); --Boundary-00=_njqYMzbTXjBa9Gh Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --Boundary-00=_njqYMzbTXjBa9Gh--