[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] pci_change_irq_level is broken...

From: Alan Amaral
Subject: Re: [Qemu-devel] pci_change_irq_level is broken...
Date: Tue, 20 Sep 2011 15:19:18 -0400

QEMU emulator version 0.14.50, Copyright (c) 2003-2008 Fabrice Bellard
You are correct, it's not hardcoded to 4.  However, when it's allocated the number of elements IS 4.  Also,
there's a comment just above pci_set_irq which says:
/* 0 <= irq_num <= 3. level must be 0 or 1 */
static void pci_set_irq(void *opaque, int irq_num, int level)

so, that implies to me that it's probably always 4...  Sorry for the confusion.

From: Richard Henderson
Sent: Tue 9/20/2011 2:57 PM
To: Alan Amaral
Cc: address@hidden
Subject: Re: [Qemu-devel] pci_change_irq_level is broken...

On 09/20/2011 10:24 AM, Alan Amaral wrote:
> I'm not on this mailing list, so please CC me on any replies.  Thanks.
> I ran qemu with valgrind last night and found an error in the pci emulation code, which may,
> or may not, be biting us.  So far the effects seem benign, although there exists the possibility
> of trashing random memory.
> In the function pci_change_irq_level() the argument irq_num is passed in as 0-3, and used
> as an index to change bus->irq_count[4].

I don't know what version of qemu you're using, but this is

      int *irq_count;

in current sources.  There's certainly no hard-coded "4".

>     assert(irq_num >= 0);
>     assert(irq_num < bus->nirq);
>     bus->irq_count[irq_num] += change;
>     bus->set_irq(bus->irq_opaque, bus_irq_num, bus->irq_count[irq_num] != 0);

This version with the asserts, though, could be done.  The site
that created the bus ought to match up nirq with the map function.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]