aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorMatthew Rosato <mjrosato@linux.ibm.com>2020-11-16 16:42:35 -0500
committerCornelia Huck <cohuck@redhat.com>2020-11-18 16:57:49 +0100
commite67ad058e45aa8b23e9b94e793b9fcf66e70ebb0 (patch)
tree2f766d0b039d5ae0dc0e0ab4c35fce9e5f811db7 /hw
parente2c6cd567422bfa563be026b9741a1854aecdc06 (diff)
downloadqemu-e67ad058e45aa8b23e9b94e793b9fcf66e70ebb0.zip
qemu-e67ad058e45aa8b23e9b94e793b9fcf66e70ebb0.tar.gz
qemu-e67ad058e45aa8b23e9b94e793b9fcf66e70ebb0.tar.bz2
s390x/pci: Unregister listeners before destroying IOMMU address space
Hot-unplugging a vfio-pci device on s390x causes a QEMU crash: qemu-system-s390x: ../softmmu/memory.c:2772: do_address_space_destroy: Assertion `QTAILQ_EMPTY(&as->listeners)' failed. In s390, the IOMMU address space is freed during device unplug but the associated vfio-pci device may not yet be finalized and therefore may still have a listener registered to the IOMMU address space. Commit a2166410ad74 ("spapr_pci: Unregister listeners before destroying the IOMMU address space") previously resolved this issue for spapr_pci. We are now seeing this in s390x; it would seem the possibility for this issue was already present but based on a bisect commit 2d24a6466154 ("device-core: use RCU for list of children of a bus") has now changed the timing such that it is now readily reproducible. Add logic to ensure listeners are removed before destroying the address space. Reported-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Tested-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Pierre Morel <pmorel@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <1605562955-21152-1-git-send-email-mjrosato@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/s390x/s390-pci-bus.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 48a3be8..e0dc20c 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -732,6 +732,13 @@ static void s390_pci_iommu_free(S390pciState *s, PCIBus *bus, int32_t devfn)
table->iommu[PCI_SLOT(devfn)] = NULL;
g_hash_table_destroy(iommu->iotlb);
+ /*
+ * An attached PCI device may have memory listeners, eg. VFIO PCI.
+ * The associated subregion will already have been unmapped in
+ * s390_pci_iommu_disable in response to the guest deconfigure request.
+ * Remove the listeners now before destroying the address space.
+ */
+ address_space_remove_listeners(&iommu->as);
address_space_destroy(&iommu->as);
object_unparent(OBJECT(&iommu->mr));
object_unparent(OBJECT(iommu));