Am 16.09.26 um 22:32 schrieb Eric Farman:
The ioctl to determine whether KVM_DEV_FLIC_CLEAR_IO_IRQ is present
receives the contents of the attribute struct as its payload,
rather than a pointer to the payload itself as is convention.
This may result in erroneous errors from the ioctl, which would
result in clear_io_supported being false when it otherwise could
be used (which is helpful in device recovery).
Cc: [email protected]
Fixes: 9eccb8622c ("s390x/kvm: add interface for clearing IO irqs")
Signed-off-by: Eric Farman <[email protected]>
---
hw/intc/s390_flic_kvm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c
index f833a3996a..5e6d422fba 100644
--- a/hw/intc/s390_flic_kvm.c
+++ b/hw/intc/s390_flic_kvm.c
@@ -633,7 +633,7 @@ static void kvm_s390_flic_realize(DeviceState *dev, Error
**errp)
/* Check clear_io_irq support */
test_attr.group = KVM_DEV_FLIC_CLEAR_IO_IRQ;
flic_state->clear_io_supported = !ioctl(flic_state->fd,
- KVM_HAS_DEVICE_ATTR, test_attr);
+ KVM_HAS_DEVICE_ATTR, &test_attr);
}
static void kvm_s390_flic_reset(DeviceState *dev)
Certainly a correct fix but maybe its not as bad. Aggregates > 8 byte are
passed as
reference. Looks like the third argument is a pointer to a stack copy when
testing, so
the old code might have worked by accident.
f8c: d2 0f f0 a8 f0 d8 mvc 168(16,%r15),216(%r15) <---
stack copy
f92: b9 14 00 20 lgfr %r2,%r0
f96: 41 40 f0 a8 la %r4,168(%r15) <-- pointer
f9a: c0 31 40 18 ae e3 lgfi %r3,1075359459
fa0: d2 07 f0 b8 f0 e8 mvc 184(8,%r15),232(%r15)
fa6: c0 e5 00 00 00 00 brasl %r14,fa6
<kvm_s390_flic_realize+0x136>
fa8: R_390_PLT32DBL ioctl+0x2
KVM_HAS_DEVICE_ATTR, test_attr);
