With commit d4c19cde("virtio-serial: add missing virtio_detach_element() call"),
when virtio serial is throttled and closed by host, port->elem should be discard with virtqueue_push,
otherwise virtqueue will not rewind, guest will blocked finally and cannot write anymore data.
It can be reproduced with following steps:
Create a vm with virtio-serial device through libvirt:
<channel type='unix'>
<source mode='bind' path='/tmp/test'/>
<target type='virtio' name='com.test.channel.0'/>
<address type='virtio-serial' controller='0' bus='0' port='1'/>
</channel>
Host run:
watch -n0.5 'timeout 0.5 nc -U /tmp/test'
Guest run:
hexdump -C -v /dev/zero > /dev/vport1p1
After sometime, guest can not write any data to serial.
We can see vq->last_avail_idx - vq->used_idx = 128 with gdb.
(gdb) p *(struct VirtQueue *) 0x565161c5c788
$4 = {vring = {num = 128, num_default = 128, align = 4096, desc = 4316049408, avail = 4316051456, used = 4316051776,
caches = 0x7fc530067e60}, used_elems = 0x565161c88dc0, last_avail_idx = 7929, last_avail_wrap_counter = true,
shadow_avail_idx = 7929, shadow_avail_wrap_counter = true, used_idx = 7801, used_wrap_counter = true, signalled_used = 7801,
signalled_used_valid = true, notification = true, queue_index = 5, inuse = 0, vector = 1,
handle_output = 0x56515da8aea0 <handle_output>, handle_aio_output = 0x0, vdev = 0x565161c54e30, guest_notifier = {rfd = 0,
wfd = 0}, host_notifier = {rfd = 74, wfd = 74}, host_notifier_enabled = true, node = {le_next = 0x565161c5c6f0,
le_prev = 0x565161c5c8a8}}
Fixes: d4c19cde("virtio-serial: add missing virtio_detach_element() call")
Signed-off-by: Sun Feng <loyou85@gmail.com>
---
hw/char/virtio-serial-bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index dd619f0..30b00a4 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -151,7 +151,7 @@ static void discard_vq_data(VirtQueue *vq, VirtIODevice *vdev)
static void discard_throttle_data(VirtIOSerialPort *port)
{
if (port->elem) {
- virtqueue_detach_element(port->ovq, port->elem, 0);
+ virtqueue_push(port->ovq, port->elem, 0);
g_free(port->elem);
port->elem = NULL;
}
--
2.7.4