From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43266) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VW7lz-0006Bb-Lh for qemu-devel@nongnu.org; Tue, 15 Oct 2013 12:47:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VW7lt-0007UP-N8 for qemu-devel@nongnu.org; Tue, 15 Oct 2013 12:47:07 -0400 From: Paolo Bonzini Date: Tue, 15 Oct 2013 18:46:38 +0200 Message-Id: <1381855610-6890-1-git-send-email-pbonzini@redhat.com> In-Reply-To: <1379689080-32396-2-git-send-email-pbonzini@redhat.com> References: <1379689080-32396-2-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH v3 00/12] virtio: cleanup and fix hot-unplug List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: cornelia.huck@de.ibm.com, qemu-stable@nongnu.org, mst@redhat.com This series fixes hot-unplug of virtio devices, which can crash due to dangling pointer accesses. The current implementation supports guest-initiated hot-unplug via the virtio_bus_destroy_device function, but not hot-unplugging the virtio device by virtue of unplugging its parent container device. The problem is that the callback for the bus implementation to cleanup is placed in the wrong place; it is in virtio_bus_destroy_device, which should be called by the bus, instead of being somewhere in device code. We need to have the callback in device code (for example in dc->exit), so that we invoke it on every unplug action, no matter who starts it. Thus, the series cleans up plugging and unplugging of virtio devices so that it does not need any help from the bus (patches 2-5). It then stops the virtio devices' overriding of dc->exit, moving their cleanup code to the new exit callback in VirtioDeviceClass (patches 6-11). Finally, patch 12 can make virtio-pci implement the device_unplugged callback. A similar dangling-pointer bug is exposed by this change in virtio-ccw. Patch 1 avoids this; it is kept at the beginning to ensure bisectability. v2->v3: fix to s390 patch; added Reviewed-by and Cced patch 1 to qemu-stable. v1->v2: remove useless pointer chasing in virtio_pci_notify, add patch 1 to fix breakage reported by Cornelia. Paolo Bonzini (12): virtio-ccw: move virtio_ccw_stop_ioeventfd to virtio_ccw_busdev_unplug virtio-bus: remove vdev field virtio-ccw: remove vdev field virtio-pci: remove vdev field virtio-bus: cleanup plug/unplug interface virtio-blk: switch exit callback to VirtioDeviceClass virtio-serial: switch exit callback to VirtioDeviceClass virtio-net: switch exit callback to VirtioDeviceClass virtio-scsi: switch exit callback to VirtioDeviceClass virtio-balloon: switch exit callback to VirtioDeviceClass virtio-rng: switch exit callback to VirtioDeviceClass virtio-pci: add device_unplugged callback hw/block/virtio-blk.c | 10 ++-- hw/char/virtio-serial-bus.c | 10 ++-- hw/net/virtio-net.c | 11 ++-- hw/s390x/virtio-ccw.c | 83 +++++++++++++++------------ hw/s390x/virtio-ccw.h | 1 - hw/scsi/vhost-scsi.c | 11 ++-- hw/scsi/virtio-scsi.c | 15 +++-- hw/virtio/virtio-balloon.c | 10 ++-- hw/virtio/virtio-bus.c | 81 ++++++++++++++------------ hw/virtio/virtio-mmio.c | 9 +-- hw/virtio/virtio-pci.c | 122 ++++++++++++++++++++++++---------------- hw/virtio/virtio-pci.h | 1 - hw/virtio/virtio-rng.c | 10 ++-- hw/virtio/virtio.c | 7 ++- include/hw/virtio/virtio-bus.h | 22 +++++--- include/hw/virtio/virtio-scsi.h | 2 +- include/hw/virtio/virtio.h | 1 + 17 files changed, 227 insertions(+), 179 deletions(-) -- 1.8.3.1