From mboxrd@z Thu Jan  1 00:00:00 1970
From: =?iso-8859-1?Q?Beno=EEt?= Canet <benoit.canet-J9ArbTHlV+bR7s880joybQ@public.gmane.org>
Subject: vhost-user deconnection bug
Date: Thu, 26 Feb 2015 16:28:41 +0100
Message-ID: <20150226152841.GA12516@irqsave.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
To: huawei.xie-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org
Return-path: <dev-bounces-VfR2kkLFssw@public.gmane.org>
Resent-Message-ID: <20150226152901.GB12516@irqsave.net>
Content-Disposition: inline
List-Id: patches and discussions about DPDK <dev.dpdk.org>
List-Unsubscribe: <http://dpdk.org/ml/options/dev>,
 <mailto:dev-request-VfR2kkLFssw@public.gmane.org?subject=unsubscribe>
List-Archive: <http://dpdk.org/ml/archives/dev/>
List-Post: <mailto:dev-VfR2kkLFssw@public.gmane.org>
List-Help: <mailto:dev-request-VfR2kkLFssw@public.gmane.org?subject=help>
List-Subscribe: <http://dpdk.org/ml/listinfo/dev>,
 <mailto:dev-request-VfR2kkLFssw@public.gmane.org?subject=subscribe>
Errors-To: dev-bounces-VfR2kkLFssw@public.gmane.org
Sender: "dev" <dev-bounces-VfR2kkLFssw@public.gmane.org>


Hi Xie,

I connected a QEMU from git master with the vhost-user from git master
and noticed the following bug.

In the following code:

void                                                                     =
      =20
user_destroy_device(struct vhost_device_ctx ctx)                         =
      =20
{                                                                        =
      =20
        struct virtio_net *dev =3D get_device(ctx);                      =
        =20
                                                                         =
      =20
        if (dev && (dev->flags & VIRTIO_DEV_RUNNING))                    =
    =20
                notify_ops->destroy_device(dev);                         =
      =20
                                                                         =
      =20
        if (dev && dev->mem) {                                           =
      =20
                free_mem_region(dev);                                    =
      =20
                free(dev->mem);                                          =
      =20
                dev->mem =3D NULL;                                       =
        =20
        }                                                                =
      =20
}

The if (dev && (dev->flags & VIRTIO_DEV_RUNNING)) is evaluated false
and notify_ops->destroy_device(dev); is not called when QEMU terminate
and provocate the deconnexion.

As a consequence any piece of code busy polling or bursting on
the vhost-user device will segfault since it will not be notified
of the deconnexion.

By the way VIRTIO_DEV_RUNNING does not seem to be set anywhere.

Best regards

Beno=EEt                     =20