Commit 3db3659b authored by Jan Kiszka's avatar Jan Kiszka Committed by Avi Kivity
Browse files

apic: Resolve potential endless loop around apic_update_irq 



Commit d96e1737 refactored the reinjection of pending PIC interrupts.
However, it missed the potential loop of apic_update_irq ->
apic_deliver_pic_intr -> apic_local_deliver -> apic_set_irq ->
apic_update_irq that /could/ occur if LINT0 is injected as APIC_DM_FIXED
and that vector is currently blocked via TPR.

Resolve this by reinjecting only where it matters: inside
apic_get_interrupt. This function may clear a vector while a
PIC-originated reason still exists.

Signed-off-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
parent a75b3e0f

hw/apic.c

+7 −3
Original line number Diff line number Diff line
@@ -363,9 +363,6 @@ static void apic_update_irq(APICCommonState *s) 
    }

    if (apic_irq_pending(s) > 0) {

        cpu_interrupt(s->cpu_env, CPU_INTERRUPT_HARD);

    } else if (apic_accept_pic_intr(&s->busdev.qdev) &&

               pic_get_output(isa_pic)) {

        apic_deliver_pic_intr(&s->busdev.qdev, 1);

    }

}
@@ -560,7 +557,14 @@ int apic_get_interrupt(DeviceState *d) 
    reset_bit(s->irr, intno);

    set_bit(s->isr, intno);

    apic_sync_vapic(s, SYNC_TO_VAPIC);



    /* re-inject if there is still a pending PIC interrupt */

    if (apic_accept_pic_intr(&s->busdev.qdev) && pic_get_output(isa_pic)) {

        apic_deliver_pic_intr(&s->busdev.qdev, 1);

    }



    apic_update_irq(s);



    return intno;

}