a2166410ad
Hot-unplugging a PHB with a VFIO device connected to it crashes QEMU: -device spapr-pci-host-bridge,index=1,id=phb1 \ -device vfio-pci,host=0034:01:00.3,id=vfio0 (qemu) device_del phb1 [ 357.207183] iommu: Removing device 0001:00:00.0 from group 1 [ 360.375523] rpadlpar_io: slot PHB 1 removed qemu-system-ppc64: memory.c:2742: do_address_space_destroy: Assertion `QTAILQ_EMPTY(&as->listeners)' failed. 'as' is the IOMMU address space, which indeed has a listener registered to by vfio_connect_container() when the VFIO device is realized. This listener is supposed to be unregistered by vfio_disconnect_container() when the VFIO device is finalized. Unfortunately, the VFIO device hasn't reached finalize yet at the time the PHB unrealize function is called, and address_space_destroy() gets called with the VFIO listener still being registered. All regions have just been unmapped from the address space. Listeners aren't needed anymore at this point. Remove them before destroying the address space. The VFIO code will try to remove them _again_ at device finalize, but it is okay since memory_listener_unregister() is idempotent. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <156110925375.92514.11649846071216864570.stgit@bahia.lan> Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru> [dwg: Correct spelling error pointed out by aik] Signed-off-by: David Gibson <david@gibson.dropbear.id.au> |
||
|---|---|---|
| .. | ||
| user | ||
| address-spaces.h | ||
| cpu_ldst_template.h | ||
| cpu_ldst_useronly_template.h | ||
| cpu_ldst.h | ||
| cpu-all.h | ||
| cpu-common.h | ||
| cpu-defs.h | ||
| cputlb.h | ||
| exec-all.h | ||
| gdbstub.h | ||
| gen-icount.h | ||
| helper-gen.h | ||
| helper-head.h | ||
| helper-proto.h | ||
| helper-tcg.h | ||
| hwaddr.h | ||
| ioport.h | ||
| log.h | ||
| memattrs.h | ||
| memory_ldst_cached.inc.h | ||
| memory_ldst_phys.inc.h | ||
| memory_ldst.inc.h | ||
| memory-internal.h | ||
| memory.h | ||
| poison.h | ||
| ram_addr.h | ||
| ramlist.h | ||
| softmmu-semi.h | ||
| target_page.h | ||
| tb-context.h | ||
| tb-hash.h | ||
| tb-lookup.h | ||
| translator.h | ||