On Mon, 2014-03-03 at 11:24 +0800, Gavin Shan wrote: > According PCI local bus specification, the register of Message > Control for MSI (offset: 2, length: 2) has bit#0 to enable or > disable MSI logic and it shouldn't be part contributing to the > calculation of MSI interrupt count. > > The patch fixes above issue. Also, the patch renames local variable > "flags" to "ctl" for both MSI and MSIx case.
I agree with the count fix, but not the variable rename, unless you also want to rename PCI_MSI_FLAGS to PCI_MSI_CTL. Looking at the severity of this bug, QEMU never uses the count we report and while we will let userspace attempt to enable more vectors than are available on the device, we never let them access data beyond what actually gets enabled. So I don't think it has any security implications. Good find though! Thanks, Alex > Signed-off-by: Gavin Shan <[email protected]> > --- > drivers/vfio/pci/vfio_pci.c | 14 ++++++-------- > 1 file changed, 6 insertions(+), 8 deletions(-) > > diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c > index 7ba0424..5760ea6 100644 > --- a/drivers/vfio/pci/vfio_pci.c > +++ b/drivers/vfio/pci/vfio_pci.c > @@ -190,25 +190,23 @@ static int vfio_pci_get_irq_count(struct > vfio_pci_device *vdev, int irq_type) > > } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) { > u8 pos; > - u16 flags; > + u16 ctl; > > pos = vdev->pdev->msi_cap; > if (pos) { > pci_read_config_word(vdev->pdev, > - pos + PCI_MSI_FLAGS, &flags); > - > - return 1 << (flags & PCI_MSI_FLAGS_QMASK); > + pos + PCI_MSI_FLAGS, &ctl); > + return 1 << ((ctl & PCI_MSI_FLAGS_QMASK) >> 1); > } > } else if (irq_type == VFIO_PCI_MSIX_IRQ_INDEX) { > u8 pos; > - u16 flags; > + u16 ctl; > > pos = vdev->pdev->msix_cap; > if (pos) { > pci_read_config_word(vdev->pdev, > - pos + PCI_MSIX_FLAGS, &flags); > - > - return (flags & PCI_MSIX_FLAGS_QSIZE) + 1; > + pos + PCI_MSIX_FLAGS, &ctl); > + return (ctl & PCI_MSIX_FLAGS_QSIZE) + 1; > } > } else if (irq_type == VFIO_PCI_ERR_IRQ_INDEX) > if (pci_is_pcie(vdev->pdev)) -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
