mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-08-05 00:33:55 -06:00
13df93244e
The high order bits of the address of the OS event queue is stored in bits [4-31] of word2 of the XIVE END internal structures and the low order bits in word3. This structure is using Big Endian ordering and computing the value requires some simple arithmetic which happens to be wrong. The mask removing bits [0-3] of word2 is applied to the wrong value and the resulting address is bogus when above 64GB. Guests with more than 64GB of RAM will allocate pages for the OS event queues which will reside above the 64GB limit. In this case, the XIVE device model will wake up the CPUs in case of a notification, such as IPIs, but the update of the event queue will be written at the wrong place in memory. The result is uncertain as the guest memory is trashed and IPI are not delivered. Introduce a helper xive_end_qaddr() to compute this value correctly in all places where it is used. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20190508171946.657-3-clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> |
||
|---|---|---|
| .. | ||
| fdt.h | ||
| mac_dbdma.h | ||
| openpic.h | ||
| openpic_kvm.h | ||
| pnv.h | ||
| pnv_core.h | ||
| pnv_lpc.h | ||
| pnv_occ.h | ||
| pnv_psi.h | ||
| pnv_xive.h | ||
| pnv_xscom.h | ||
| ppc.h | ||
| ppc4xx.h | ||
| ppc_e500.h | ||
| spapr.h | ||
| spapr_cpu_core.h | ||
| spapr_drc.h | ||
| spapr_irq.h | ||
| spapr_ovec.h | ||
| spapr_rtas.h | ||
| spapr_vio.h | ||
| spapr_xive.h | ||
| xics.h | ||
| xics_spapr.h | ||
| xive.h | ||
| xive_regs.h | ||