[Qemu-devel] [PATCH] virtio-pci: don't try to mask or unmask vqs without notifiers

[Qemu-devel] [PATCH] virtio-pci: don't try to mask or unmask vqs without notifiers

[Jason Wang]

We should validate the vq index against nvqs_with_notifiers. Otherwise we may
try to mask or unmask vector for vqs without notifiers (e.g control vq). This
will lead qemu abort on kvm_irqchip_commit_routes() when trying to boot win8.1
guest.

Fixes 851c2a75a6e80c8aa5e713864d98cfb512e7229b ("virtio-pci: speedup MSI-X
masking and unmasking")

Reported-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/virtio-pci.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 867c9d1..4f7ff42 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -638,21 +638,26 @@ static int virtio_pci_vector_unmask(PCIDevice *dev, unsigned vector,
         if (!virtio_queue_get_num(vdev, index)) {
             break;
         }
-        ret = virtio_pci_vq_vector_unmask(proxy, index, vector, msg);
-        if (ret < 0) {
-            goto undo;
+        if (index < proxy->nvqs_with_notifiers) {
+            ret = virtio_pci_vq_vector_unmask(proxy, index, vector, msg);
+            if (ret < 0) {
+                goto undo;
+            }
+            ++unmasked;
         }
         vq = virtio_vector_next_queue(vq);
-        ++unmasked;
     }
 
     return 0;
 
 undo:
     vq = virtio_vector_first_queue(vdev, vector);
-    while (vq && --unmasked >= 0) {
+    while (vq && unmasked >= 0) {
         index = virtio_get_queue_index(vq);
-        virtio_pci_vq_vector_mask(proxy, index, vector);
+        if (index < proxy->nvqs_with_notifiers) {
+            virtio_pci_vq_vector_mask(proxy, index, vector);
+            --unmasked;
+        }
         vq = virtio_vector_next_queue(vq);
     }
     return ret;
@@ -670,7 +675,9 @@ static void virtio_pci_vector_mask(PCIDevice *dev, unsigned vector)
         if (!virtio_queue_get_num(vdev, index)) {
             break;
         }
-        virtio_pci_vq_vector_mask(proxy, index, vector);
+        if (index < proxy->nvqs_with_notifiers) {
+            virtio_pci_vq_vector_mask(proxy, index, vector);
+        }
         vq = virtio_vector_next_queue(vq);
     }
 }
-- 
2.1.4