|
 |
958e1b |
From e346f15b5c72e3cf58fbf1af4a89c929dea783ad Mon Sep 17 00:00:00 2001
|
|
|
958e1b |
From: Marcel Apfelbaum <marcel.a@redhat.com>
|
|
|
958e1b |
Date: Tue, 28 Oct 2014 14:13:15 +0100
|
|
|
958e1b |
Subject: [PATCH 2/9] hw/pci: fix error flow in pci multifunction init
|
|
|
958e1b |
|
|
|
958e1b |
Message-id: <1414505595-17009-1-git-send-email-marcel.a@redhat.com>
|
|
|
958e1b |
Patchwork-id: 61953
|
|
|
958e1b |
O-Subject: [RHEL-7.1 qemu-kvm PATCH] hw/pci: fix error flow in pci multifunction init
|
|
|
958e1b |
Bugzilla: 1049734
|
|
|
958e1b |
RH-Acked-by: Amos Kong <akong@redhat.com>
|
|
|
958e1b |
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
|
|
|
958e1b |
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
958e1b |
|
|
|
958e1b |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1049734
|
|
|
958e1b |
Brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=8164686
|
|
|
958e1b |
Upstream-status: 306077640a652e090779498aadbeb0c605feaacd
|
|
|
958e1b |
|
|
|
958e1b |
Scenario:
|
|
|
958e1b |
- There is a non multifunction pci device A on 00:0X.0.
|
|
|
958e1b |
- Hot-plug another multifunction pci device B at 00:0X.1.
|
|
|
958e1b |
- The operation will fail of course.
|
|
|
958e1b |
- Try to hot-plug the B device 2-3 more times, qemu will crash.
|
|
|
958e1b |
|
|
|
958e1b |
Reason: The error flow leaves the B's address space into global address spaces
|
|
|
958e1b |
list, but the device object is freed. Fixed that.
|
|
|
958e1b |
|
|
|
958e1b |
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
|
|
|
958e1b |
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
958e1b |
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
958e1b |
(cherry picked from commit 306077640a652e090779498aadbeb0c605feaacd)
|
|
|
958e1b |
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
|
|
|
958e1b |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
958e1b |
|
|
|
958e1b |
Conflicts:
|
|
|
958e1b |
hw/pci/pci.c
|
|
|
958e1b |
- The patch moves a function within a file and the function's
|
|
|
958e1b |
content is different from upstream.
|
|
|
958e1b |
- The upstream does not call anymore to qemu_free_irqs, but
|
|
|
958e1b |
the downstream version still does. We need to check that
|
|
|
958e1b |
the irq is allocated before calling it.
|
|
|
958e1b |
|
|
|
958e1b |
scripts/git-backport-diff:
|
|
|
958e1b |
001/1:[0021] [FC] 'hw/pci: fix error flow in pci multifunction init'
|
|
|
958e1b |
|
|
|
958e1b |
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
|
|
|
958e1b |
---
|
|
|
958e1b |
hw/pci/pci.c | 33 ++++++++++++++++++---------------
|
|
|
958e1b |
1 file changed, 18 insertions(+), 15 deletions(-)
|
|
|
958e1b |
---
|
|
|
958e1b |
hw/pci/pci.c | 33 ++++++++++++++++++---------------
|
|
|
958e1b |
1 file changed, 18 insertions(+), 15 deletions(-)
|
|
|
958e1b |
|
|
|
958e1b |
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
|
|
|
958e1b |
index d166ab0..703b111 100644
|
|
|
958e1b |
--- a/hw/pci/pci.c
|
|
|
958e1b |
+++ b/hw/pci/pci.c
|
|
|
958e1b |
@@ -784,6 +784,23 @@ static void pci_config_free(PCIDevice *pci_dev)
|
|
|
958e1b |
g_free(pci_dev->used);
|
|
|
958e1b |
}
|
|
|
958e1b |
|
|
|
958e1b |
+static void do_pci_unregister_device(PCIDevice *pci_dev)
|
|
|
958e1b |
+{
|
|
|
958e1b |
+ if (pci_dev->irq) {
|
|
|
958e1b |
+ qemu_free_irqs(pci_dev->irq);
|
|
|
958e1b |
+ }
|
|
|
958e1b |
+
|
|
|
958e1b |
+ pci_dev->bus->devices[pci_dev->devfn] = NULL;
|
|
|
958e1b |
+ pci_config_free(pci_dev);
|
|
|
958e1b |
+
|
|
|
958e1b |
+ if (!pci_dev->bus->dma_context_fn) {
|
|
|
958e1b |
+ address_space_destroy(&pci_dev->bus_master_as);
|
|
|
958e1b |
+ memory_region_destroy(&pci_dev->bus_master_enable_region);
|
|
|
958e1b |
+ g_free(pci_dev->dma);
|
|
|
958e1b |
+ pci_dev->dma = NULL;
|
|
|
958e1b |
+ }
|
|
|
958e1b |
+}
|
|
|
958e1b |
+
|
|
|
958e1b |
/* -1 for devfn means auto assign */
|
|
|
958e1b |
static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
|
|
|
958e1b |
const char *name, int devfn)
|
|
|
958e1b |
@@ -852,7 +869,7 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
|
|
|
958e1b |
pci_init_mask_bridge(pci_dev);
|
|
|
958e1b |
}
|
|
|
958e1b |
if (pci_init_multifunction(bus, pci_dev)) {
|
|
|
958e1b |
- pci_config_free(pci_dev);
|
|
|
958e1b |
+ do_pci_unregister_device(pci_dev);
|
|
|
958e1b |
return NULL;
|
|
|
958e1b |
}
|
|
|
958e1b |
|
|
|
958e1b |
@@ -868,20 +885,6 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
|
|
|
958e1b |
return pci_dev;
|
|
|
958e1b |
}
|
|
|
958e1b |
|
|
|
958e1b |
-static void do_pci_unregister_device(PCIDevice *pci_dev)
|
|
|
958e1b |
-{
|
|
|
958e1b |
- qemu_free_irqs(pci_dev->irq);
|
|
|
958e1b |
- pci_dev->bus->devices[pci_dev->devfn] = NULL;
|
|
|
958e1b |
- pci_config_free(pci_dev);
|
|
|
958e1b |
-
|
|
|
958e1b |
- if (!pci_dev->bus->dma_context_fn) {
|
|
|
958e1b |
- address_space_destroy(&pci_dev->bus_master_as);
|
|
|
958e1b |
- memory_region_destroy(&pci_dev->bus_master_enable_region);
|
|
|
958e1b |
- g_free(pci_dev->dma);
|
|
|
958e1b |
- pci_dev->dma = NULL;
|
|
|
958e1b |
- }
|
|
|
958e1b |
-}
|
|
|
958e1b |
-
|
|
|
958e1b |
static void pci_unregister_io_regions(PCIDevice *pci_dev)
|
|
|
958e1b |
{
|
|
|
958e1b |
PCIIORegion *r;
|
|
|
958e1b |
--
|
|
|
958e1b |
1.8.3.1
|
|
|
958e1b |
|