From patchwork Tue Oct 15 16:46:50 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 283741 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id E14AC2C012D for ; Wed, 16 Oct 2013 03:51:36 +1100 (EST) Received: from localhost ([::1]:43028 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VW7qI-0004rC-F8 for incoming@patchwork.ozlabs.org; Tue, 15 Oct 2013 12:51:34 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43590) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VW7mR-0006p9-3Q for qemu-devel@nongnu.org; Tue, 15 Oct 2013 12:47:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VW7mM-0007eY-3e for qemu-devel@nongnu.org; Tue, 15 Oct 2013 12:47:35 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45906) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VW7mL-0007eG-RW; Tue, 15 Oct 2013 12:47:30 -0400 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r9FGlQqj018357 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 15 Oct 2013 12:47:26 -0400 Received: from playground.com (ovpn-112-59.ams2.redhat.com [10.36.112.59]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r9FGkq61011192; Tue, 15 Oct 2013 12:47:24 -0400 From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Tue, 15 Oct 2013 18:46:50 +0200 Message-Id: <1381855610-6890-13-git-send-email-pbonzini@redhat.com> In-Reply-To: <1381855610-6890-1-git-send-email-pbonzini@redhat.com> References: <1379689080-32396-2-git-send-email-pbonzini@redhat.com> <1381855610-6890-1-git-send-email-pbonzini@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.25 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: cornelia.huck@de.ibm.com, qemu-stable@nongnu.org, mst@redhat.com Subject: [Qemu-devel] [PATCH v3 12/12] virtio-pci: add device_unplugged callback X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org This fixes a crash in hot-unplug of virtio-pci devices behind a PCIe switch. The crash happens because the ioeventfd is still set whent the child is destroyed (destruction happens in postorder). Then the proxy tries to unset to ioeventfd, but the virtqueue structure that holds the EventNotifier has been trashed in the meanwhile. kvm_set_ioeventfd_pio does not expect failure and aborts. The fix is simply to move parts of uninitialization to a new device_unplugged callback, which is called before the child is destroyed. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini --- hw/virtio/virtio-pci.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c index 89af295..a191c24 100644 --- a/hw/virtio/virtio-pci.c +++ b/hw/virtio/virtio-pci.c @@ -1002,6 +1002,15 @@ static void virtio_pci_device_plugged(DeviceState *d) proxy->host_features); } +static void virtio_pci_device_unplugged(DeviceState *d) +{ + PCIDevice *pci_dev = PCI_DEVICE(d); + VirtIOPCIProxy *proxy = VIRTIO_PCI(d); + + virtio_pci_stop_ioeventfd(proxy); + msix_uninit_exclusive_bar(pci_dev); +} + static int virtio_pci_init(PCIDevice *pci_dev) { VirtIOPCIProxy *dev = VIRTIO_PCI(pci_dev); @@ -1016,9 +1025,7 @@ static int virtio_pci_init(PCIDevice *pci_dev) static void virtio_pci_exit(PCIDevice *pci_dev) { VirtIOPCIProxy *proxy = VIRTIO_PCI(pci_dev); - virtio_pci_stop_ioeventfd(proxy); memory_region_destroy(&proxy->bar); - msix_uninit_exclusive_bar(pci_dev); } static void virtio_pci_reset(DeviceState *qdev) @@ -1553,6 +1560,7 @@ static void virtio_pci_bus_class_init(ObjectClass *klass, void *data) k->set_guest_notifiers = virtio_pci_set_guest_notifiers; k->vmstate_change = virtio_pci_vmstate_change; k->device_plugged = virtio_pci_device_plugged; + k->device_unplugged = virtio_pci_device_unplugged; } static const TypeInfo virtio_pci_bus_info = {