cd9fb66
From ac9e40a75eba0019fb9930835804e8daceead981 Mon Sep 17 00:00:00 2001
cd9fb66
From: eperezma <eperezma@redhat.com>
cd9fb66
Date: Tue, 9 Feb 2021 10:38:16 -0300
cd9fb66
Subject: [PATCH 1/6] virtio: Add corresponding memory_listener_unregister to
cd9fb66
 unrealize
cd9fb66
MIME-Version: 1.0
cd9fb66
Content-Type: text/plain; charset=UTF-8
cd9fb66
Content-Transfer-Encoding: 8bit
cd9fb66
cd9fb66
RH-Author: eperezma <eperezma@redhat.com>
cd9fb66
Message-id: <20210209103816.1636200-2-eperezma@redhat.com>
cd9fb66
Patchwork-id: 101009
cd9fb66
O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 1/1] virtio: Add corresponding memory_listener_unregister to unrealize
cd9fb66
Bugzilla: 1903521
cd9fb66
RH-Acked-by: Peter Xu <peterx@redhat.com>
cd9fb66
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
cd9fb66
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
cd9fb66
cd9fb66
Address space is destroyed without proper removal of its listeners with
cd9fb66
current code. They are expected to be removed in
cd9fb66
virtio_device_instance_finalize [1], but qemu calls it through
cd9fb66
object_deinit, after address_space_destroy call through
cd9fb66
device_set_realized [2].
cd9fb66
cd9fb66
Move it to virtio_device_unrealize, called before device_set_realized
cd9fb66
[3] and making it symmetric with memory_listener_register in
cd9fb66
virtio_device_realize.
cd9fb66
cd9fb66
v2: Delete no-op call of virtio_device_instance_finalize.
cd9fb66
    Add backtraces.
cd9fb66
cd9fb66
[1]
cd9fb66
cd9fb66
 #0  virtio_device_instance_finalize (obj=0x555557de5120)
cd9fb66
     at /home/qemu/include/hw/virtio/virtio.h:71
cd9fb66
 #1  0x0000555555b703c9 in object_deinit (type=0x555556639860,
cd9fb66
      obj=<optimized out>) at ../qom/object.c:671
cd9fb66
 #2  object_finalize (data=0x555557de5120) at ../qom/object.c:685
cd9fb66
 #3  object_unref (objptr=0x555557de5120) at ../qom/object.c:1184
cd9fb66
 #4  0x0000555555b4de9d in bus_free_bus_child (kid=0x555557df0660)
cd9fb66
     at ../hw/core/qdev.c:55
cd9fb66
 #5  0x0000555555c65003 in call_rcu_thread (opaque=opaque@entry=0x0)
cd9fb66
     at ../util/rcu.c:281
cd9fb66
cd9fb66
Queued by:
cd9fb66
cd9fb66
 #0  bus_remove_child (bus=0x555557de5098,
cd9fb66
     child=child@entry=0x555557de5120) at ../hw/core/qdev.c:60
cd9fb66
 #1  0x0000555555b4ee31 in device_unparent (obj=<optimized out>)
cd9fb66
     at ../hw/core/qdev.c:984
cd9fb66
 #2  0x0000555555b70465 in object_finalize_child_property (
cd9fb66
     obj=<optimized out>, name=<optimized out>, opaque=0x555557de5120)
cd9fb66
     at ../qom/object.c:1725
cd9fb66
 #3  0x0000555555b6fa17 in object_property_del_child (
cd9fb66
     child=0x555557de5120, obj=0x555557ddcf90) at ../qom/object.c:645
cd9fb66
 #4  object_unparent (obj=0x555557de5120) at ../qom/object.c:664
cd9fb66
 #5  0x0000555555b4c071 in bus_unparent (obj=<optimized out>)
cd9fb66
     at ../hw/core/bus.c:147
cd9fb66
 #6  0x0000555555b70465 in object_finalize_child_property (
cd9fb66
     obj=<optimized out>, name=<optimized out>, opaque=0x555557de5098)
cd9fb66
     at ../qom/object.c:1725
cd9fb66
 #7  0x0000555555b6fa17 in object_property_del_child (
cd9fb66
     child=0x555557de5098, obj=0x555557ddcf90) at ../qom/object.c:645
cd9fb66
 #8  object_unparent (obj=0x555557de5098) at ../qom/object.c:664
cd9fb66
 #9  0x0000555555b4ee19 in device_unparent (obj=<optimized out>)
cd9fb66
     at ../hw/core/qdev.c:981
cd9fb66
 #10 0x0000555555b70465 in object_finalize_child_property (
cd9fb66
     obj=<optimized out>, name=<optimized out>, opaque=0x555557ddcf90)
cd9fb66
     at ../qom/object.c:1725
cd9fb66
 #11 0x0000555555b6fa17 in object_property_del_child (
cd9fb66
     child=0x555557ddcf90, obj=0x55555685da10) at ../qom/object.c:645
cd9fb66
 #12 object_unparent (obj=0x555557ddcf90) at ../qom/object.c:664
cd9fb66
 #13 0x00005555558dc331 in pci_for_each_device_under_bus (
cd9fb66
     opaque=<optimized out>, fn=<optimized out>, bus=<optimized out>)
cd9fb66
     at ../hw/pci/pci.c:1654
cd9fb66
cd9fb66
[2]
cd9fb66
cd9fb66
Optimizer omits pci_qdev_unrealize, called by device_set_realized, and
cd9fb66
do_pci_unregister_device, called by pci_qdev_unrealize and caller of
cd9fb66
address_space_destroy.
cd9fb66
cd9fb66
 #0  address_space_destroy (as=0x555557ddd1b8)
cd9fb66
     at ../softmmu/memory.c:2840
cd9fb66
 #1  0x0000555555b4fc53 in device_set_realized (obj=0x555557ddcf90,
cd9fb66
      value=<optimized out>, errp=0x7fffeea8f1e0)
cd9fb66
     at ../hw/core/qdev.c:850
cd9fb66
 #2  0x0000555555b6eaa6 in property_set_bool (obj=0x555557ddcf90,
cd9fb66
      v=<optimized out>, name=<optimized out>, opaque=0x555556650ba0,
cd9fb66
     errp=0x7fffeea8f1e0) at ../qom/object.c:2255
cd9fb66
 #3  0x0000555555b70e07 in object_property_set (
cd9fb66
      obj=obj@entry=0x555557ddcf90,
cd9fb66
      name=name@entry=0x555555db99df "realized",
cd9fb66
      v=v@entry=0x7fffe46b7500,
cd9fb66
      errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1400
cd9fb66
 #4  0x0000555555b73c5f in object_property_set_qobject (
cd9fb66
      obj=obj@entry=0x555557ddcf90,
cd9fb66
      name=name@entry=0x555555db99df "realized",
cd9fb66
      value=value@entry=0x7fffe44f6180,
cd9fb66
      errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/qom-qobject.c:28
cd9fb66
 #5  0x0000555555b71044 in object_property_set_bool (
cd9fb66
      obj=0x555557ddcf90, name=0x555555db99df "realized",
cd9fb66
      value=<optimized out>, errp=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1470
cd9fb66
 #6  0x0000555555921cb7 in pcie_unplug_device (bus=<optimized out>,
cd9fb66
      dev=0x555557ddcf90,
cd9fb66
      opaque=<optimized out>) at /home/qemu/include/hw/qdev-core.h:17
cd9fb66
 #7  0x00005555558dc331 in pci_for_each_device_under_bus (
cd9fb66
      opaque=<optimized out>, fn=<optimized out>,
cd9fb66
      bus=<optimized out>) at ../hw/pci/pci.c:1654
cd9fb66
cd9fb66
[3]
cd9fb66
cd9fb66
 #0  virtio_device_unrealize (dev=0x555557de5120)
cd9fb66
     at ../hw/virtio/virtio.c:3680
cd9fb66
 #1  0x0000555555b4fc63 in device_set_realized (obj=0x555557de5120,
cd9fb66
     value=<optimized out>, errp=0x7fffee28df90)
cd9fb66
     at ../hw/core/qdev.c:850
cd9fb66
 #2  0x0000555555b6eab6 in property_set_bool (obj=0x555557de5120,
cd9fb66
     v=<optimized out>, name=<optimized out>, opaque=0x555556650ba0,
cd9fb66
     errp=0x7fffee28df90) at ../qom/object.c:2255
cd9fb66
 #3  0x0000555555b70e17 in object_property_set (
cd9fb66
     obj=obj@entry=0x555557de5120,
cd9fb66
     name=name@entry=0x555555db99ff "realized",
cd9fb66
     v=v@entry=0x7ffdd8035040,
cd9fb66
     errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1400
cd9fb66
 #4  0x0000555555b73c6f in object_property_set_qobject (
cd9fb66
     obj=obj@entry=0x555557de5120,
cd9fb66
     name=name@entry=0x555555db99ff "realized",
cd9fb66
     value=value@entry=0x7ffdd8035020,
cd9fb66
     errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/qom-qobject.c:28
cd9fb66
 #5  0x0000555555b71054 in object_property_set_bool (
cd9fb66
     obj=0x555557de5120, name=name@entry=0x555555db99ff "realized",
cd9fb66
     value=value@entry=false, errp=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1470
cd9fb66
 #6  0x0000555555b4edc5 in qdev_unrealize (dev=<optimized out>)
cd9fb66
     at ../hw/core/qdev.c:403
cd9fb66
 #7  0x0000555555b4c2a9 in bus_set_realized (obj=<optimized out>,
cd9fb66
     value=<optimized out>, errp=<optimized out>)
cd9fb66
     at ../hw/core/bus.c:204
cd9fb66
 #8  0x0000555555b6eab6 in property_set_bool (obj=0x555557de5098,
cd9fb66
     v=<optimized out>, name=<optimized out>, opaque=0x555557df04c0,
cd9fb66
     errp=0x7fffee28e0a0) at ../qom/object.c:2255
cd9fb66
 #9  0x0000555555b70e17 in object_property_set (
cd9fb66
     obj=obj@entry=0x555557de5098,
cd9fb66
     name=name@entry=0x555555db99ff "realized",
cd9fb66
     v=v@entry=0x7ffdd8034f50,
cd9fb66
     errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1400
cd9fb66
 #10 0x0000555555b73c6f in object_property_set_qobject (
cd9fb66
     obj=obj@entry=0x555557de5098,
cd9fb66
     name=name@entry=0x555555db99ff "realized",
cd9fb66
     value=value@entry=0x7ffdd8020630,
cd9fb66
     errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/qom-qobject.c:28
cd9fb66
 #11 0x0000555555b71054 in object_property_set_bool (
cd9fb66
     obj=obj@entry=0x555557de5098,
cd9fb66
     name=name@entry=0x555555db99ff "realized",
cd9fb66
     value=value@entry=false, errp=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1470
cd9fb66
 #12 0x0000555555b4c725 in qbus_unrealize (
cd9fb66
     bus=bus@entry=0x555557de5098) at ../hw/core/bus.c:178
cd9fb66
 #13 0x0000555555b4fc00 in device_set_realized (obj=0x555557ddcf90,
cd9fb66
     value=<optimized out>, errp=0x7fffee28e1e0)
cd9fb66
     at ../hw/core/qdev.c:844
cd9fb66
 #14 0x0000555555b6eab6 in property_set_bool (obj=0x555557ddcf90,
cd9fb66
     v=<optimized out>, name=<optimized out>, opaque=0x555556650ba0,
cd9fb66
     errp=0x7fffee28e1e0) at ../qom/object.c:2255
cd9fb66
 #15 0x0000555555b70e17 in object_property_set (
cd9fb66
     obj=obj@entry=0x555557ddcf90,
cd9fb66
     name=name@entry=0x555555db99ff "realized",
cd9fb66
     v=v@entry=0x7ffdd8020560,
cd9fb66
     errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1400
cd9fb66
 #16 0x0000555555b73c6f in object_property_set_qobject (
cd9fb66
     obj=obj@entry=0x555557ddcf90,
cd9fb66
     name=name@entry=0x555555db99ff "realized",
cd9fb66
     value=value@entry=0x7ffdd8020540,
cd9fb66
     errp=errp@entry=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/qom-qobject.c:28
cd9fb66
 #17 0x0000555555b71054 in object_property_set_bool (
cd9fb66
     obj=0x555557ddcf90, name=0x555555db99ff "realized",
cd9fb66
     value=<optimized out>, errp=0x5555565bbf38 <error_abort>)
cd9fb66
     at ../qom/object.c:1470
cd9fb66
 #18 0x0000555555921cb7 in pcie_unplug_device (bus=<optimized out>,
cd9fb66
     dev=0x555557ddcf90, opaque=<optimized out>)
cd9fb66
     at /home/qemu/include/hw/qdev-core.h:17
cd9fb66
 #19 0x00005555558dc331 in pci_for_each_device_under_bus (
cd9fb66
     opaque=<optimized out>, fn=<optimized out>, bus=<optimized out>)
cd9fb66
     at ../hw/pci/pci.c:1654
cd9fb66
cd9fb66
Fixes: c611c76417f ("virtio: add MemoryListener to cache ring translations")
cd9fb66
Buglink: https://bugs.launchpad.net/qemu/+bug/1912846
cd9fb66
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
cd9fb66
Message-Id: <20210125192505.390554-1-eperezma@redhat.com>
cd9fb66
Reviewed-by: Peter Xu <peterx@redhat.com>
cd9fb66
Acked-by: Jason Wang <jasowang@redhat.com>
cd9fb66
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
cd9fb66
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
cd9fb66
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
cd9fb66
(cherry picked from commit f6ab64c05f8a6229bf6569d3791c23abb9f6eee4)
cd9fb66
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
cd9fb66
Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
cd9fb66
---
cd9fb66
 hw/virtio/virtio.c | 2 +-
cd9fb66
 1 file changed, 1 insertion(+), 1 deletion(-)
cd9fb66
cd9fb66
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
cd9fb66
index ceb58fda6c..9312e7191b 100644
cd9fb66
--- a/hw/virtio/virtio.c
cd9fb66
+++ b/hw/virtio/virtio.c
cd9fb66
@@ -3677,6 +3677,7 @@ static void virtio_device_unrealize(DeviceState *dev)
cd9fb66
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
cd9fb66
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(dev);
cd9fb66
 
cd9fb66
+    memory_listener_unregister(&vdev->listener);
cd9fb66
     virtio_bus_device_unplugged(vdev);
cd9fb66
 
cd9fb66
     if (vdc->unrealize != NULL) {
cd9fb66
@@ -3707,7 +3708,6 @@ static void virtio_device_instance_finalize(Object *obj)
cd9fb66
 {
cd9fb66
     VirtIODevice *vdev = VIRTIO_DEVICE(obj);
cd9fb66
 
cd9fb66
-    memory_listener_unregister(&vdev->listener);
cd9fb66
     virtio_device_free_virtqueues(vdev);
cd9fb66
 
cd9fb66
     g_free(vdev->config);
cd9fb66
-- 
cd9fb66
2.27.0
cd9fb66