From: Hao Zhang The I/O APIC sets remote_irr for level-triggered interrupts that have been accepted by a local APIC and are waiting for an EOI. ioapic_service() currently treats any non-zero return from kvm_irq_delivery_to_apic() as successful delivery. But negative return values are failures, not successful delivery. Setting remote_irr after such a failed delivery leaves the pin blocked forever waiting for an EOI that will never be generated. The bug dates back to commit 4925663a079c ("KVM: Report IRQ injection status to userspace."), which made ioapic_service() preserve and return the delivery result, initialized the result to -1, but kept using "ret != 0" as the condition for setting remote_irr. As a result, any negative delivery failure that reaches this path is incorrectly treated as a delivered level-triggered interrupt. Update remote_irr only when the delivery result is positive, i.e. when at least one local APIC accepted the interrupt. Fixes: 4925663a079c ("KVM: Report IRQ injection status to userspace.") Reviewed-by: Kai Huang Signed-off-by: Hao Zhang --- arch/x86/kvm/ioapic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c index 757667fb2bfa..24a7cc3b8b7e 100644 --- a/arch/x86/kvm/ioapic.c +++ b/arch/x86/kvm/ioapic.c @@ -491,7 +491,7 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status) } else ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe); - if (ret && irqe.trig_mode == IOAPIC_LEVEL_TRIG) + if (ret > 0 && irqe.trig_mode == IOAPIC_LEVEL_TRIG) entry->fields.remote_irr = 1; return ret; -- 2.15.0