From 4712c158c5276fd3c401152f4bb5c3fccf185946 Mon Sep 17 00:00:00 2001 From: Jan Kiszka Date: Thu, 5 Apr 2018 19:41:47 +0200 Subject: [PATCH 1/2] e1000e: Prevent MSI/MSI-X storms Only signal MSI/MSI-X events on rising edges. So far we re-triggered the interrupt sources even if the guest did no consumed the pending one, easily causing interrupt storms. Issue was observable with Linux 4.16 e1000e driver when MSI-X was used. Vector 2 was causing interrupt storms after the driver activated the device. Signed-off-by: Jan Kiszka Signed-off-by: Jason Wang --- hw/net/e1000e_core.c | 11 +++++++++++ hw/net/e1000e_core.h | 2 ++ 2 files changed, 13 insertions(+) diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c index 950489160a..2a221c2ef9 100644 --- a/hw/net/e1000e_core.c +++ b/hw/net/e1000e_core.c @@ -2023,6 +2023,7 @@ e1000e_msix_notify_one(E1000ECore *core, uint32_t cause, uint32_t int_cfg) effective_eiac = core->mac[EIAC] & cause; core->mac[ICR] &= ~effective_eiac; + core->msi_causes_pending &= ~effective_eiac; if (!(core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME)) { core->mac[IMS] &= ~effective_eiac; @@ -2119,6 +2120,13 @@ e1000e_send_msi(E1000ECore *core, bool msix) { uint32_t causes = core->mac[ICR] & core->mac[IMS] & ~E1000_ICR_ASSERTED; + core->msi_causes_pending &= causes; + causes ^= core->msi_causes_pending; + if (causes == 0) { + return; + } + core->msi_causes_pending |= causes; + if (msix) { e1000e_msix_notify(core, causes); } else { @@ -2156,6 +2164,9 @@ e1000e_update_interrupt_state(E1000ECore *core) core->mac[ICS] = core->mac[ICR]; interrupts_pending = (core->mac[IMS] & core->mac[ICR]) ? true : false; + if (!interrupts_pending) { + core->msi_causes_pending = 0; + } trace_e1000e_irq_pending_interrupts(core->mac[ICR] & core->mac[IMS], core->mac[ICR], core->mac[IMS]); diff --git a/hw/net/e1000e_core.h b/hw/net/e1000e_core.h index 7d8ff41890..63a15510cc 100644 --- a/hw/net/e1000e_core.h +++ b/hw/net/e1000e_core.h @@ -109,6 +109,8 @@ struct E1000Core { NICState *owner_nic; PCIDevice *owner; void (*owner_start_recv)(PCIDevice *d); + + uint32_t msi_causes_pending; }; void From 323e7c117754e4d4ce6b4282d74ad01c99d67714 Mon Sep 17 00:00:00 2001 From: Yunjian Wang Date: Thu, 31 May 2018 15:28:22 +0800 Subject: [PATCH 2/2] tap: fix memory leak on success to create a tap device The memory leak on success to create a tap device. And the nfds and nvhosts may not be the same and need to be processed separately. Fixes: 07825977 ("tap: fix memory leak on failure to create a multiqueue tap device") Fixes: 264986e2 ("tap: multiqueue support") Cc: qemu-stable@nongnu.org Signed-off-by: Yunjian Wang Signed-off-by: Jason Wang --- net/tap.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/net/tap.c b/net/tap.c index 2126f4882d..cc8525f154 100644 --- a/net/tap.c +++ b/net/tap.c @@ -805,7 +805,8 @@ int net_init_tap(const Netdev *netdev, const char *name, } else if (tap->has_fds) { char **fds; char **vhost_fds; - int nfds, nvhosts; + int nfds = 0, nvhosts = 0; + int ret = 0; if (tap->has_ifname || tap->has_script || tap->has_downscript || tap->has_vnet_hdr || tap->has_helper || tap->has_queues || @@ -825,6 +826,7 @@ int net_init_tap(const Netdev *netdev, const char *name, if (nfds != nvhosts) { error_setg(errp, "The number of fds passed does not match " "the number of vhostfds passed"); + ret = -1; goto free_fail; } } @@ -833,6 +835,7 @@ int net_init_tap(const Netdev *netdev, const char *name, fd = monitor_fd_param(cur_mon, fds[i], &err); if (fd == -1) { error_propagate(errp, err); + ret = -1; goto free_fail; } @@ -843,6 +846,7 @@ int net_init_tap(const Netdev *netdev, const char *name, } else if (vnet_hdr != tap_probe_vnet_hdr(fd)) { error_setg(errp, "vnet_hdr not consistent across given tap fds"); + ret = -1; goto free_fail; } @@ -852,21 +856,21 @@ int net_init_tap(const Netdev *netdev, const char *name, vnet_hdr, fd, &err); if (err) { error_propagate(errp, err); + ret = -1; goto free_fail; } } - g_free(fds); - g_free(vhost_fds); - return 0; free_fail: + for (i = 0; i < nvhosts; i++) { + g_free(vhost_fds[i]); + } for (i = 0; i < nfds; i++) { g_free(fds[i]); - g_free(vhost_fds[i]); } g_free(fds); g_free(vhost_fds); - return -1; + return ret; } else if (tap->has_helper) { if (tap->has_ifname || tap->has_script || tap->has_downscript || tap->has_vnet_hdr || tap->has_queues || tap->has_vhostfds) {