[SeaBIOS] [Qemu-devel] [PATCH v3] pci: clean all funcs when hot-removing multifunc device

[Amos Kong]

On 05/11/2012 07:54 AM, Amos Kong wrote:
> On 05/11/2012 02:55 AM, Michael S. Tsirkin wrote:
>> On Fri, May 11, 2012 at 01:09:13AM +0800, Jiang Liu wrote:
>>> On 05/10/2012 11:44 PM, Amos Kong wrote:
>>>
>>>> diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
>>>> index 806c44f..a7442d9 100644
>>>> --- a/drivers/pci/hotplug/acpiphp_glue.c
>>>> +++ b/drivers/pci/hotplug/acpiphp_glue.c
>>>> @@ -885,7 +885,7 @@ static void disable_bridges(struct pci_bus *bus)
>>>>  static int disable_device(struct acpiphp_slot *slot)
>>>>  {
>>>>  	struct acpiphp_func *func;
>>>> -	struct pci_dev *pdev;
>>>> +	struct pci_dev *pdev, *tmp;
>>>>  	struct pci_bus *bus = slot->bridge->pci_bus;
>>>>  
>>>>  	/* The slot will be enabled when func 0 is added, so check
>>>> @@ -902,9 +902,10 @@ static int disable_device(struct acpiphp_slot *slot)
>>>>  			func->bridge = NULL;
>>>>  		}
>>>>  
>>>> -		pdev = pci_get_slot(slot->bridge->pci_bus,
>>>> -				    PCI_DEVFN(slot->device, func->function));
>>>> -		if (pdev) {
>>>> +		list_for_each_entry_safe(pdev, tmp, &bus->devices, bus_list) {
>>>> +			if (PCI_SLOT(pdev->devfn) != slot->device)
>>>> +				continue;
>>>> +
>>> The pci_bus_sem lock should be acquired when walking the bus->devices list.
>>> Otherwise it may cause invalid memory access if another thread is modifying
>>> the bus->devices list concurrently.

pci_bus_sem lock is only request for writing &bus->devices list, right ?
and this protection already exists in pci_destory_dev().


static int disable_device(struct acpiphp_slot *slot)
    \_ list_for_each_entry_safe(pdev, tmp, &bus->devices, bus_list) {
        \_  __pci_remove_bus_device(pdev);
               \_ pci_destroy_dev(dev);


static void pci_destroy_dev(struct pci_dev *dev)
{
        /* Remove the device from the device lists, and prevent any further
         * list accesses from this device */
        down_write(&pci_bus_sem);
        list_del(&dev->bus_list);
        dev->bus_list.next = dev->bus_list.prev = NULL;
        up_write(&pci_bus_sem);
        ...
}


-- 
			Amos.