diff options
| author | Matthew Rosato | 2020-11-16 22:42:35 +0100 |
|---|---|---|
| committer | Cornelia Huck | 2020-11-18 16:57:49 +0100 |
| commit | e67ad058e45aa8b23e9b94e793b9fcf66e70ebb0 (patch) | |
| tree | 2f766d0b039d5ae0dc0e0ab4c35fce9e5f811db7 /linux-user/linux_loop.h | |
| parent | s390/kvm: fix diag318 propagation and reset functionality (diff) | |
| download | qemu-e67ad058e45aa8b23e9b94e793b9fcf66e70ebb0.tar.gz qemu-e67ad058e45aa8b23e9b94e793b9fcf66e70ebb0.tar.xz qemu-e67ad058e45aa8b23e9b94e793b9fcf66e70ebb0.zip | |
s390x/pci: Unregister listeners before destroying IOMMU address space
Hot-unplugging a vfio-pci device on s390x causes a QEMU crash:
qemu-system-s390x: ../softmmu/memory.c:2772:
do_address_space_destroy: Assertion `QTAILQ_EMPTY(&as->listeners)' failed.
In s390, the IOMMU address space is freed during device unplug but the
associated vfio-pci device may not yet be finalized and therefore may
still have a listener registered to the IOMMU address space.
Commit a2166410ad74 ("spapr_pci: Unregister listeners before destroying
the IOMMU address space") previously resolved this issue for spapr_pci.
We are now seeing this in s390x; it would seem the possibility for this
issue was already present but based on a bisect commit 2d24a6466154
("device-core: use RCU for list of children of a bus") has now changed
the timing such that it is now readily reproducible.
Add logic to ensure listeners are removed before destroying the address
space.
Reported-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <1605562955-21152-1-git-send-email-mjrosato@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Diffstat (limited to 'linux-user/linux_loop.h')
0 files changed, 0 insertions, 0 deletions