[Qemu-commits] [qemu/qemu] 9a4b6a: virtio-scsi: fix race in virtio_scsi_dataplane_sta...

[Richard Henderson]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 9a4b6a63aee885931622549c85669dcca03bed39
      
https://github.com/qemu/qemu/commit/9a4b6a63aee885931622549c85669dcca03bed39
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/block/dataplane/virtio-blk.c
    M hw/scsi/virtio-scsi-dataplane.c

  Log Message:
  -----------
  virtio-scsi: fix race in virtio_scsi_dataplane_start()

As soon as virtio_scsi_data_plane_start() attaches host notifiers the
IOThread may start virtqueue processing. There is a race between
IOThread virtqueue processing and virtio_scsi_data_plane_start() because
it only assigns s->dataplane_started after attaching host notifiers.

When a virtqueue handler function in the IOThread calls
virtio_scsi_defer_to_dataplane() it may see !s->dataplane_started and
attempt to start dataplane even though we're already in the IOThread:

  #0  0x00007f67b360857c __pthread_kill_implementation (libc.so.6 + 0xa257c)
  #1  0x00007f67b35bbd56 raise (libc.so.6 + 0x55d56)
  #2  0x00007f67b358e833 abort (libc.so.6 + 0x28833)
  #3  0x00007f67b358e75b __assert_fail_base.cold (libc.so.6 + 0x2875b)
  #4  0x00007f67b35b4cd6 __assert_fail (libc.so.6 + 0x4ecd6)
  #5  0x000055ca87fd411b memory_region_transaction_commit (qemu-kvm + 0x67511b)
  #6  0x000055ca87e17811 virtio_pci_ioeventfd_assign (qemu-kvm + 0x4b8811)
  #7  0x000055ca87e14836 virtio_bus_set_host_notifier (qemu-kvm + 0x4b5836)
  #8  0x000055ca87f8e14e virtio_scsi_set_host_notifier (qemu-kvm + 0x62f14e)
  #9  0x000055ca87f8dd62 virtio_scsi_dataplane_start (qemu-kvm + 0x62ed62)
  #10 0x000055ca87e14610 virtio_bus_start_ioeventfd (qemu-kvm + 0x4b5610)
  #11 0x000055ca87f8c29a virtio_scsi_handle_ctrl (qemu-kvm + 0x62d29a)
  #12 0x000055ca87fa5902 virtio_queue_host_notifier_read (qemu-kvm + 0x646902)
  #13 0x000055ca882c099e aio_dispatch_handler (qemu-kvm + 0x96199e)
  #14 0x000055ca882c1761 aio_poll (qemu-kvm + 0x962761)
  #15 0x000055ca880e1052 iothread_run (qemu-kvm + 0x782052)
  #16 0x000055ca882c562a qemu_thread_start (qemu-kvm + 0x96662a)

This patch assigns s->dataplane_started before attaching host notifiers
so that virtqueue handler functions that run in the IOThread before
virtio_scsi_data_plane_start() returns correctly identify that dataplane
does not need to be started. This fix is taken from the virtio-blk
dataplane code and it's worth adding a comment in virtio-blk as well to
explain why it works.

Note that s->dataplane_started does not need the AioContext lock because
it is set before attaching host notifiers and cleared after detaching
host notifiers. In other words, the IOThread always sees the value true
and the main loop thread does not modify it while the IOThread is
active.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2099541
Reported-by: Qing Wang <qinwang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20220808162134.240405-1-stefanha@redhat.com>
Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: f20400ed0de62ba7682b864e270804ceb3df784a
      
https://github.com/qemu/qemu/commit/f20400ed0de62ba7682b864e270804ceb3df784a
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/virtio/vhost.c

  Log Message:
  -----------
  hw/virtio: gracefully handle unset vhost_dev vdev

I've noticed asserts firing because we query the status of vdev after
a vhost connection is closed down. Rather than faulting on the NULL
indirect just quietly reply false.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20220728135503.1060062-3-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 5a9d5f09b1f61bc7072c2389ba5b11350ae76b0d
      
https://github.com/qemu/qemu/commit/5a9d5f09b1f61bc7072c2389ba5b11350ae76b0d
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/virtio/virtio-pci.c

  Log Message:
  -----------
  hw/virtio: handle un-configured shutdown in virtio-pci

The assert() protecting against leakage is a little aggressive and
causes needless crashes if a device is shutdown without having been
configured. In this case no descriptors are lost because none have
been assigned.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20220728135503.1060062-4-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 643a943554041a10f372a33a5ce7c9ef51007a74
      
https://github.com/qemu/qemu/commit/643a943554041a10f372a33a5ce7c9ef51007a74
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/virtio/vhost-user.c

  Log Message:
  -----------
  hw/virtio: fix vhost_user_read tracepoint

As reads happen in the callback we were never seeing them. We only
really care about the header so move the tracepoint to when the header
is complete.

Fixes: 6ca6d8ee9d (hw/virtio: add vhost_user_[read|write] trace points)
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20220728135503.1060062-5-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 3824e25db1a84fadc50b88dfbe27047aa2f7f85d
      
https://github.com/qemu/qemu/commit/3824e25db1a84fadc50b88dfbe27047aa2f7f85d
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/i386/microvm.c
    M hw/i386/pc_piix.c
    M hw/i386/pc_q35.c

  Log Message:
  -----------
  x86: disable rng seeding via setup_data

Causes regressions when doing direct kernel boots with OVMF.

At this point in the release cycle the only sensible action
is to just disable this for 7.1 and sort it properly in the
7.2 devel cycle.

Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Eduardo Habkost <eduardo@habkost.net>
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-Id: <20220817083940.3174933-1-kraxel@redhat.com>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Eduardo Habkost <eduardo@habkost.net>
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>


  Commit: a99fbb003b2558cb4ff426d8144eff7cc1e2d7dc
      
https://github.com/qemu/qemu/commit/a99fbb003b2558cb4ff426d8144eff7cc1e2d7dc
  Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/cxl/cxl-host.c

  Log Message:
  -----------
  hw/cxl: Fix memory leak in error paths

Use g_autofree to free the CXLFixedWindow structure if an
error occurs in configuration before we have added to
the list (via g_steal_pointer())

Fix Coverity CID: 1488872

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20220808122051.14822-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: d2289b524e71970ea8ca5602f219cc92b8e5896b
      
https://github.com/qemu/qemu/commit/d2289b524e71970ea8ca5602f219cc92b8e5896b
  Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/cxl/cxl-host.c

  Log Message:
  -----------
  hw/cxl: Fix wrong query of target ports

Two issues were present in this code:
1) Check on which register to look in was inverted.
2) Both branches use the _LO register.

Whilst here moved to extract32() rather than hand rolling
the field extraction as simpler and hopefully less error prone.

Fixes Coverity CID: 1488873

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20220808122051.14822-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 29d1fbc6c6ff04492fc67626aec5ebf2439739d0
      
https://github.com/qemu/qemu/commit/29d1fbc6c6ff04492fc67626aec5ebf2439739d0
  Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/cxl/cxl-device-utils.c

  Log Message:
  -----------
  hw/cxl: Add stub write function for RO MemoryRegionOps entries.

There is no checking on the availability of a write callback.
Hence QEMU crashes if a write does occur to one of these regions.

Discovered whilst chasing a Linux kernel bug that incorrectly
wrote into one of these regions.

Fixes: 6364adacdf ("hw/cxl/device: Implement the CAP array (8.2.8.1-2)")
Reported-by: Bobo WL <lmw.bobo@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20220817145759.32603-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 66a2356485895f82b14585bda8e04bd190841fc0
      
https://github.com/qemu/qemu/commit/66a2356485895f82b14585bda8e04bd190841fc0
  Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/cxl/cxl-mailbox-utils.c

  Log Message:
  -----------
  hw/cxl: Fix Get LSA input payload size which should be 8 bytes.

Get LSA needs 4 byte offset and 4 byte length arguments.
CXL rev 2.0 Table 178.

Fixes: 3ebe676a34 ("hw/cxl/device: Implement get/set Label Storage Area (LSA)")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20220817145759.32603-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 4f41b4e445d09651988df36615c3a64853d5bc4a
      
https://github.com/qemu/qemu/commit/4f41b4e445d09651988df36615c3a64853d5bc4a
  Author: Jonathan Cameron <Jonathan.Cameron@huawei.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/cxl/cxl-mailbox-utils.c

  Log Message:
  -----------
  hw/cxl: Correctly handle variable sized mailbox input payloads.

A placeholder of ~0 is used to indicate variable payload size.
Whilst the checks for output payload correctly took this into
account, those for input payload did not.

This results in failure of the Set LSA command.

Fixes: 464e14ac43 ("hw/cxl/device: Implement basic mailbox (8.2.8.4)")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20220817145759.32603-4-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 888fbaaf029dde7b86d2be24bded6fda6bd80b6c
      
https://github.com/qemu/qemu/commit/888fbaaf029dde7b86d2be24bded6fda6bd80b6c
  Author: Igor Mammedov <imammedo@redhat.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M tests/qtest/bios-tables-test.c

  Log Message:
  -----------
  tests: acpi: silence applesmc warning about invalid key

OSK value is irrelevant for ACPI test case.
Supply fake OSK explicitly to prevent QEMU complaining about
invalid key when it fallbacks to default_osk.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20220728133713.1369596-1-imammedo@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 9afb4177d66ac1eee858aba07fa2fc729b274eb4
      
https://github.com/qemu/qemu/commit/9afb4177d66ac1eee858aba07fa2fc729b274eb4
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   2022-08-17 (Wed, 17 Aug 2022)

  Changed paths:
    M hw/virtio/virtio-pci.c

  Log Message:
  -----------
  virtio-pci: don't touch pci on virtio reset

virtio level reset should not affect pci express
registers such as PM, error or link.

Fixes: 27ce0f3afc ("hw/virtio: fix Power Management Control Register for PCI 
Express virtio devices")
Fixes: d584f1b9ca ("hw/virtio: fix Link Control Register for PCI Express virtio 
devices")
Fixes: c2cabb3422 ("hw/virtio: fix error enabling flags in Device Control 
register")
Cc: "Marcel Apfelbaum" <marcel@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: a89a946f019400a0d740e1647a155c49e36fd4aa
      
https://github.com/qemu/qemu/commit/a89a946f019400a0d740e1647a155c49e36fd4aa
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2022-08-18 (Thu, 18 Aug 2022)

  Changed paths:
    M hw/block/dataplane/virtio-blk.c
    M hw/cxl/cxl-device-utils.c
    M hw/cxl/cxl-host.c
    M hw/cxl/cxl-mailbox-utils.c
    M hw/i386/microvm.c
    M hw/i386/pc_piix.c
    M hw/i386/pc_q35.c
    M hw/scsi/virtio-scsi-dataplane.c
    M hw/virtio/vhost-user.c
    M hw/virtio/vhost.c
    M hw/virtio/virtio-pci.c
    M tests/qtest/bios-tables-test.c

  Log Message:
  -----------
  Merge tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu 
into staging

pc,virtio: fixes

Several bugfixes, they all look very safe to me. Revert
seed support since we aren't any closer to a proper fix.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmL9IIQPHG1zdEByZWRo
# YXQuY29tAAoJECgfDbjSjVRpKCkH/2KjgmgG2BpeSm5WHm2ySMZ8aNactDhjc/zg
# S2iFMPRx6at4fagErT0h4hdI2SunbWz+dH8v6wdPmiIX//HNRUiZPW6vItib3aaN
# b6IxG+yWasRxFhLMZ41634vCUmnISkCsbMwJYTUMZjUV3iuEVnK8rQpIuGIkmvYK
# nt3Y3TLospn19ZrTbV00flghHnmU4WIZkyJv7T64bvvlgxITIw/02XxAI5QvhWb9
# qANmT+T9IPsZXdXOGj9W2d23Ejl9fRfvJSgRJsmxcOH24ozDUNGfia/ZDuq7J9rB
# NZ+g29j27oU5hdazOZR5e9q5SaFfaNZ3uYsU/A+lZkt/9+7G1u0=
# =soZc
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 17 Aug 2022 10:08:20 AM PDT
# gpg:                using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg:                issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined]
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
#      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

* tag 'for_upstream' of git://git.kernel.org/pub/scm/virt/kvm/mst/qemu:
  virtio-pci: don't touch pci on virtio reset
  tests: acpi: silence applesmc warning about invalid key
  hw/cxl: Correctly handle variable sized mailbox input payloads.
  hw/cxl: Fix Get LSA input payload size which should be 8 bytes.
  hw/cxl: Add stub write function for RO MemoryRegionOps entries.
  hw/cxl: Fix wrong query of target ports
  hw/cxl: Fix memory leak in error paths
  x86: disable rng seeding via setup_data
  hw/virtio: fix vhost_user_read tracepoint
  hw/virtio: handle un-configured shutdown in virtio-pci
  hw/virtio: gracefully handle unset vhost_dev vdev
  virtio-scsi: fix race in virtio_scsi_dataplane_start()

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>


Compare: https://github.com/qemu/qemu/compare/c7208a6e0d04...a89a946f0194