accel/mshv: fix ioeventfd deassignment to forward correct datamatch value
unregister_ioevent() is not forwarding the datamatch (queue index) to the mshv driver, causing only the first VirtIO-MMIO queue to be deassigned correctly. Subsequent queues fail with `-ENOENT`, triggering a fatal abort(). This failure was discovered while booting arm64 EDK2 firmware with mshv accel. Signed-off-by: Aastha Rawat <aastharawat@linux.microsoft.com> Reviewed-by: Magnus Kulke <magnuskulke@linux.microsoft.com> Link: https://lore.kernel.org/r/20260409-fix_ioevent-v1-1-053b810ae6fb@linux.microsoft.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Aastha Rawat committed
Apr 9, 2026 at 11:53 UTC
a395d6a2fa17888f4a76cd71ed80bd29c2b739ca
1 file changed
+13
-3
accel/mshv/mshv-all.c
+13
-3
@@ -278,13 +278,22 @@ static int ioeventfd(int vm_fd, int event_fd, uint64_t addr, Datamatch dm,
278
return ioctl(vm_fd, MSHV_IOEVENTFD, &args);
279
}
280
281
-static int unregister_ioevent(int vm_fd, int event_fd, uint64_t mmio_addr)
281
+static int unregister_ioevent(int vm_fd, int event_fd, uint64_t mmio_addr,
282
+ uint64_t data, uint32_t len, bool data_match)
283
{
284
uint32_t flags = 0;
285
Datamatch dm = {0};
286
287
flags |= BIT(MSHV_IOEVENTFD_BIT_DEASSIGN);
287
- dm.tag = DATAMATCH_NONE;
288
+ if (!data_match) {
289
+ dm.tag = DATAMATCH_NONE;
290
+ } else if (len == sizeof(uint64_t)) {
291
+ dm.tag = DATAMATCH_U64;
292
+ dm.value.u64 = data;
293
+ } else {
294
+ dm.tag = DATAMATCH_U32;
295
+ dm.value.u32 = data;
296
+ }
297
298
return ioeventfd(vm_fd, event_fd, mmio_addr, dm, flags);
299
}
@@ -337,11 +346,12 @@ static void mem_ioeventfd_del(MemoryListener *listener,
346
int fd = event_notifier_get_fd(e);
347
int ret;
348
uint64_t addr = section->offset_within_address_space;
349
+ uint64_t len = int128_get64(section->size);
350
351
trace_mshv_mem_ioeventfd_del(section->offset_within_address_space,
352
int128_get64(section->size), data);
353
344
- ret = unregister_ioevent(mshv_state->vm, fd, addr);
354
+ ret = unregister_ioevent(mshv_state->vm, fd, addr, data, len, match_data);
355
if (ret < 0) {
356
error_report("Failed to unregister ioeventfd: %s (%d)", strerror(-ret),
357
-ret);