> -----Original Message----- > From: Jan Beulich [mailto:[email protected]] > Sent: 25 November 2016 10:06 > To: [email protected] > Cc: Anthony Perard <[email protected]>; Paul Durrant > <[email protected]>; Stefano Stabellini <[email protected]>; xen- > devel <[email protected]> > Subject: [PATCH v2 1/3] xen: fix quad word bufioreq handling > > We should not consume the second slot if it didn't get written yet. > Normal writers - i.e. Xen - would not update write_pointer between the > two writes, but the page may get fiddled with by the guest itself, and > we're better off avoiding to enter an infinite loop in that case. > > Reported-by: yanghongke <[email protected]> > Signed-off-by: Jan Beulich <[email protected]> > --- > v2: Bail (using hw_error()) instead of just breaking the loop.
LGTM. Reviewed-by: Paul Durrant <[email protected]> > > --- a/xen-hvm.c > +++ b/xen-hvm.c > @@ -1021,6 +1021,9 @@ static int handle_buffered_iopage(XenIOS > xen_rmb(); > qw = (req.size == 8); > if (qw) { > + if (rdptr + 1 == wrptr) { > + hw_error("Incomplete quad word buffered ioreq"); > + } > buf_req = &buf_page->buf_ioreq[(rdptr + 1) % > IOREQ_BUFFER_SLOT_NUM]; > req.data |= ((uint64_t)buf_req->data) << 32; > >
