diff options
author | David Gibson <david@gibson.dropbear.id.au> | 2017-06-06 17:01:21 +1000 |
---|---|---|
committer | David Gibson <david@gibson.dropbear.id.au> | 2017-06-08 14:38:26 +1000 |
commit | 454b580ae9ae3e7722f1cd5f6da7bb479f86bbd8 (patch) | |
tree | be99fdac2cfa1b215b83f1110bc6947758b8cda0 /hw | |
parent | f224d35be9fb971bf64b569b99ce2a582156bbf2 (diff) | |
download | qemu-454b580ae9ae3e7722f1cd5f6da7bb479f86bbd8.zip qemu-454b580ae9ae3e7722f1cd5f6da7bb479f86bbd8.tar.gz qemu-454b580ae9ae3e7722f1cd5f6da7bb479f86bbd8.tar.bz2 |
spapr: Don't misuse DR-indicator in spapr_recover_pending_dimm_state()
With some combinations of migration and hotplug we can lost temporary state
indicating how many DRCs (guest side hotplug handles) are still connected
to a DIMM object in the process of removal. When we hit that situation
spapr_recover_pending_dimm_state() is used to scan more extensively and
work out the right number.
It does this using drc->indicator state to determine what state of
disconnection the DRC is in. However, this is not safe, because the
indicator state is guest settable - in fact it's more-or-less a purely
guest->host notification mechanism which should have no bearing on the
internals of hotplug state management.
So, replace the test for this with a test on drc->dev, which is a purely
qemu side managed variable, and updated the same BQL critical section as
the indicator state.
This does introduce an off-by-one change, because the indicator state was
updated before the call to spapr_lmb_release() on the current DRC, whereas
drc->dev is updated afterwards. That's corrected by always decrementing
the nr_lmbs value instead of only doing so in the case where we didn't
have to recover information.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Acked-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'hw')
-rw-r--r-- | hw/ppc/spapr.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index 9b7ae28..b2311dc 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -2676,7 +2676,7 @@ static sPAPRDIMMState *spapr_recover_pending_dimm_state(sPAPRMachineState *ms, drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, addr / SPAPR_MEMORY_BLOCK_SIZE); g_assert(drc); - if (drc->indicator_state != SPAPR_DR_INDICATOR_STATE_INACTIVE) { + if (drc->dev) { avail_lmbs++; } addr += SPAPR_MEMORY_BLOCK_SIZE; @@ -2700,10 +2700,11 @@ void spapr_lmb_release(DeviceState *dev) * during the unplug process. In this case recover it. */ if (ds == NULL) { ds = spapr_recover_pending_dimm_state(spapr, PC_DIMM(dev)); - if (ds->nr_lmbs) { - return; - } - } else if (--ds->nr_lmbs) { + /* The DRC being examined by the caller at least must be counted */ + g_assert(ds->nr_lmbs); + } + + if (--ds->nr_lmbs) { return; } |