[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 095/103] qdev: recursively unrealize devices when unr
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 095/103] qdev: recursively unrealize devices when unrealizing bus |
Date: |
Tue, 17 Jun 2014 20:42:10 +0300 |
From: Paolo Bonzini <address@hidden>
When the patch was posted that became 5c21ce7 (qdev: Realize buses
on device realization, 2014-03-12), it included recursive realization
and unrealization of devices when the bus's "realized" property
was toggled.
However, due to the same old worries about recursive realization
and prerequisites not being realized yet, those hunks were dropped when
committing the patch. Unfortunately, this causes a use-after-free bug
(easily reproduced by a PCI hot-unplug action).
Before the patch, device_unparent behaved as follows:
for each child bus
unparent bus ----------------------------.
| for each child device |
| unparent device ---------------. |
| | unrealize device | |
| | call dc->unparent | |
| '------------------------------- |
'----------------------------------------'
unrealize device
After the patch, it behaves as follows instead:
unrealize device --------------------.
| for each child bus |
| unrealize bus (A) |
'------------------------------------'
for each child bus
unparent bus ----------------------.
| for each child device |
| unrealize device (B) |
| call dc->unparent |
'----------------------------------'
At the step marked (B) the device might use data from the bus that is
not available anymore due to step (A).
To fix this, we need to unrealize devices before step (A). To sidestep
concerns about recursive realization, only do recursive unrealization
and leave the "value && !bus->realized" case as it is.
The resulting flow is:
for each child bus
unrealize bus ---------------------.
| for each child device |
| unrealize device (B) |
| call bc->unrealize (A) |
'----------------------------------'
unrealize device
for each child bus
unparent bus ----------------------.
| for each child device |
| unparent device |
'----------------------------------'
where everything is "powered down" before it is unassembled.
Cc: address@hidden
Signed-off-by: Paolo Bonzini <address@hidden>
Tested-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
---
hw/core/qdev.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 65aa041..b9cd4fc 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -568,14 +568,25 @@ static void bus_set_realized(Object *obj, bool value,
Error **errp)
{
BusState *bus = BUS(obj);
BusClass *bc = BUS_GET_CLASS(bus);
+ BusChild *kid;
Error *local_err = NULL;
if (value && !bus->realized) {
if (bc->realize) {
bc->realize(bus, &local_err);
}
+
+ /* TODO: recursive realization */
} else if (!value && bus->realized) {
- if (bc->unrealize) {
+ QTAILQ_FOREACH(kid, &bus->children, sibling) {
+ DeviceState *dev = kid->child;
+ object_property_set_bool(OBJECT(dev), false, "realized",
+ &local_err);
+ if (local_err != NULL) {
+ break;
+ }
+ }
+ if (bc->unrealize && local_err == NULL) {
bc->unrealize(bus, &local_err);
}
}
--
MST
- [Qemu-devel] [PULL 083/103] hostmem: add file-based HostMemoryBackend, (continued)
- [Qemu-devel] [PULL 083/103] hostmem: add file-based HostMemoryBackend, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 077/103] memory: move mem_path handling to memory_region_allocate_system_memory, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 084/103] hostmem: add merge and dump properties, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 085/103] hostmem: allow preallocation of any memory region, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 089/103] hmp: add info memdev, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 090/103] tests: fix memory leak in test of string input visitor, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 091/103] qapi: make string input visitor parse int list, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 092/103] qapi: make string output visitor parse int list, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 093/103] qapi: fix build on glib < 2.28, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 094/103] qdev: reorganize error reporting in bus_set_realized, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 095/103] qdev: recursively unrealize devices when unrealizing bus,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 096/103] qmp: clean out whitespace, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 048/103] Add G_IO_HUP handler for socket chardev, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 063/103] NUMA: check if the total numa memory size is equal to ram_size, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 064/103] NUMA: Add numa_info structure to contain numa nodes info, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 099/103] qmp: add query-memory-devices command, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 100/103] acpi: introduce TYPE_ACPI_DEVICE_IF interface, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 062/103] NUMA: move numa related code to new file numa.c, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 097/103] pc: acpi: do not hardcode preprocessor, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 098/103] numa: handle mmaped memory allocation failure correctly, Michael S. Tsirkin, 2014/06/17
- [Qemu-devel] [PULL 102/103] qmp: add query-acpi-ospm-status command, Michael S. Tsirkin, 2014/06/17