hw/pci-bridge: fix pcie root port's IO hints capability
The gen_pcie_root_port mem-reserve and pref32-reserve properties are
defined as size (so uint64_t), but passed as uint32_t when building
the 'IO hints' vendor specific capability.
Passing 4G (or more) gets truncated and passed as a zero reservation.
Is not a huge issue since the guest firmware will always compare the
hints with the default value and take the maximum.
Fix it by passing the values as uint64_t and failing to init the
gen_pcie_root_port id invalid values are used.
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index b2e50c3..40a39f5 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -412,22 +412,36 @@
int pci_bridge_qemu_reserve_cap_init(PCIDevice *dev, int cap_offset,
uint32_t bus_reserve, uint64_t io_reserve,
- uint32_t mem_non_pref_reserve,
- uint32_t mem_pref_32_reserve,
+ uint64_t mem_non_pref_reserve,
+ uint64_t mem_pref_32_reserve,
uint64_t mem_pref_64_reserve,
Error **errp)
{
- if (mem_pref_32_reserve != (uint32_t)-1 &&
+ if (mem_pref_32_reserve != (uint64_t)-1 &&
mem_pref_64_reserve != (uint64_t)-1) {
error_setg(errp,
"PCI resource reserve cap: PREF32 and PREF64 conflict");
return -EINVAL;
}
+ if (mem_non_pref_reserve != (uint64_t)-1 &&
+ mem_non_pref_reserve >= (1ULL << 32)) {
+ error_setg(errp,
+ "PCI resource reserve cap: mem-reserve must be less than 4G");
+ return -EINVAL;
+ }
+
+ if (mem_pref_32_reserve != (uint64_t)-1 &&
+ mem_pref_32_reserve >= (1ULL << 32)) {
+ error_setg(errp,
+ "PCI resource reserve cap: pref32-reserve must be less than 4G");
+ return -EINVAL;
+ }
+
if (bus_reserve == (uint32_t)-1 &&
io_reserve == (uint64_t)-1 &&
- mem_non_pref_reserve == (uint32_t)-1 &&
- mem_pref_32_reserve == (uint32_t)-1 &&
+ mem_non_pref_reserve == (uint64_t)-1 &&
+ mem_pref_32_reserve == (uint64_t)-1 &&
mem_pref_64_reserve == (uint64_t)-1) {
return 0;
}
diff --git a/include/hw/pci/pci_bridge.h b/include/hw/pci/pci_bridge.h
index 9b44ffd..0347da5 100644
--- a/include/hw/pci/pci_bridge.h
+++ b/include/hw/pci/pci_bridge.h
@@ -135,8 +135,8 @@
int pci_bridge_qemu_reserve_cap_init(PCIDevice *dev, int cap_offset,
uint32_t bus_reserve, uint64_t io_reserve,
- uint32_t mem_non_pref_reserve,
- uint32_t mem_pref_32_reserve,
+ uint64_t mem_non_pref_reserve,
+ uint64_t mem_pref_32_reserve,
uint64_t mem_pref_64_reserve,
Error **errp);
