| Message ID | 20171211072110.9058-5-lprosek@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | ivshmem: MSI bug fixes | expand |
Ladi Prosek <lprosek@redhat.com> writes: > The effects of ivshmem_enable_irqfd() was not undone on device reset. > > This manifested as: > ivshmem_add_kvm_msi_virq: Assertion `!s->msi_vectors[vector].pdev' failed. > > when irqfd was enabled before reset and then enabled again after reset, making > ivshmem_enable_irqfd() run for the second time. > > To reproduce, run: > > ivshmem-server > > and QEMU with: > > -device ivshmem-doorbell,chardev=iv > -chardev socket,path=/tmp/ivshmem_socket,id=iv > > then install the Windows driver, at the time of writing available at: > > https://github.com/virtio-win/kvm-guest-drivers-windows/tree/master/ivshmem > > and crash-reboot the guest by inducing a BSOD. > > Signed-off-by: Ladi Prosek <lprosek@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index d1bb246d12..9c7e74ef12 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -758,10 +758,14 @@ static void ivshmem_msix_vector_use(IVShmemState *s) } } +static void ivshmem_disable_irqfd(IVShmemState *s); + static void ivshmem_reset(DeviceState *d) { IVShmemState *s = IVSHMEM_COMMON(d); + ivshmem_disable_irqfd(s); + s->intrstatus = 0; s->intrmask = 0; if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
The effects of ivshmem_enable_irqfd() was not undone on device reset. This manifested as: ivshmem_add_kvm_msi_virq: Assertion `!s->msi_vectors[vector].pdev' failed. when irqfd was enabled before reset and then enabled again after reset, making ivshmem_enable_irqfd() run for the second time. To reproduce, run: ivshmem-server and QEMU with: -device ivshmem-doorbell,chardev=iv -chardev socket,path=/tmp/ivshmem_socket,id=iv then install the Windows driver, at the time of writing available at: https://github.com/virtio-win/kvm-guest-drivers-windows/tree/master/ivshmem and crash-reboot the guest by inducing a BSOD. Signed-off-by: Ladi Prosek <lprosek@redhat.com> --- hw/misc/ivshmem.c | 4 ++++ 1 file changed, 4 insertions(+)