The end vector calculation has a bug that results in polling fewer
than required vectors when reading at a non-zero offset in PBA memory.

Fixes: bbef882cc193 ("msi: add API to get notified about pending bit poll")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
Taking closer look at my msix pba mmio write patch, it looks like there
might be a bug in the calculation from the code I copied? I haven't
looked into how to test these poll notifiers though.

Thanks,
Nick

 hw/pci/msix.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci/msix.c b/hw/pci/msix.c
index 487e49834ee..cc6e79ec678 100644
--- a/hw/pci/msix.c
+++ b/hw/pci/msix.c
@@ -250,7 +250,7 @@ static uint64_t msix_pba_mmio_read(void *opaque, hwaddr addr,
     PCIDevice *dev = opaque;
     if (dev->msix_vector_poll_notifier) {
         unsigned vector_start = addr * 8;
-        unsigned vector_end = MIN(addr + size * 8, dev->msix_entries_nr);
+        unsigned vector_end = MIN((addr + size) * 8, dev->msix_entries_nr);
         dev->msix_vector_poll_notifier(dev, vector_start, vector_end);
     }
 
-- 
2.45.2

12.12.2024 15:04, Nicholas Piggin wrote:
> The end vector calculation has a bug that results in polling fewer
> than required vectors when reading at a non-zero offset in PBA memory.
> 
> Fixes: bbef882cc193 ("msi: add API to get notified about pending bit poll")
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>

This smells like a qemu-stable material?
Though given the bug age, maybe not?

Thanks,

/mjt

> diff --git a/hw/pci/msix.c b/hw/pci/msix.c
> index 487e49834ee..cc6e79ec678 100644
> --- a/hw/pci/msix.c
> +++ b/hw/pci/msix.c
> @@ -250,7 +250,7 @@ static uint64_t msix_pba_mmio_read(void *opaque, hwaddr addr,
>       PCIDevice *dev = opaque;
>       if (dev->msix_vector_poll_notifier) {
>           unsigned vector_start = addr * 8;
> -        unsigned vector_end = MIN(addr + size * 8, dev->msix_entries_nr);
> +        unsigned vector_end = MIN((addr + size) * 8, dev->msix_entries_nr);
>           dev->msix_vector_poll_notifier(dev, vector_start, vector_end);
>       }
>

On 12/12/24 13:04, Nicholas Piggin wrote:
> The end vector calculation has a bug that results in polling fewer
> than required vectors when reading at a non-zero offset in PBA memory.
> 
> Fixes: bbef882cc193 ("msi: add API to get notified about pending bit poll")
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> ---
> Taking closer look at my msix pba mmio write patch, it looks like there
> might be a bug in the calculation from the code I copied? I haven't
> looked into how to test these poll notifiers though.
> 
> Thanks,
> Nick
> 
>   hw/pci/msix.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>