From 12b2e9f30f978f26f35f9df5c2ef96fbc019bab6 Mon Sep 17 00:00:00 2001 From: Tony Krowiak Date: Mon, 17 Dec 2018 10:57:30 -0500 Subject: qdev/core: fix qbus_is_full() The qbus_is_full(BusState *bus) function (qdev_monitor.c) compares the max_index value of the BusState structure with the max_dev value of the BusClass structure to determine whether the maximum number of children has been reached for the bus. The problem is, the max_index field of the BusState structure does not necessarily reflect the number of devices that have been plugged into the bus. Whenever a child device is plugged into the bus, the bus's max_index value is assigned to the child device and then incremented. If the child is subsequently unplugged, the value of the max_index does not change and no longer reflects the number of children. When the bus's max_index value reaches the maximum number of devices allowed for the bus (i.e., the max_dev field in the BusClass structure), attempts to plug another device will be rejected claiming that the bus is full -- even if the bus is actually empty. To resolve the problem, a new 'num_children' field is being added to the BusState structure to keep track of the number of children plugged into the bus. It will be incremented when a child is plugged, and decremented when a child is unplugged. Signed-off-by: Tony Krowiak Reviewed-by: Pierre Morel Reviewed-by: Halil Pasic Message-Id: <1545062250-7573-1-git-send-email-akrowiak@linux.ibm.com> Reviewed-by: Igor Mammedov Signed-off-by: Eduardo Habkost --- hw/core/qdev.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'hw') diff --git a/hw/core/qdev.c b/hw/core/qdev.c index d59071b8ed..00a5a39c76 100644 --- a/hw/core/qdev.c +++ b/hw/core/qdev.c @@ -59,6 +59,8 @@ static void bus_remove_child(BusState *bus, DeviceState *child) snprintf(name, sizeof(name), "child[%d]", kid->index); QTAILQ_REMOVE(&bus->children, kid, sibling); + bus->num_children--; + /* This gives back ownership of kid->child back to us. */ object_property_del(OBJECT(bus), name, NULL); object_unref(OBJECT(kid->child)); @@ -73,6 +75,7 @@ static void bus_add_child(BusState *bus, DeviceState *child) char name[32]; BusChild *kid = g_malloc0(sizeof(*kid)); + bus->num_children++; kid->index = bus->max_index++; kid->child = child; object_ref(OBJECT(kid->child)); -- cgit v1.2.3