diff mbox series

[07/10] scsi/scsi-bus: scsi_device_find: don't return unrealized devices

Message ID 20200925172604.2142227-8-pbonzini@redhat.com
State New
Headers show
Series Fix scsi devices plug/unplug races w.r.t virtio-scsi iothread | expand

Commit Message

Paolo Bonzini Sept. 25, 2020, 5:26 p.m. UTC 
From: Maxim Levitsky <mlevitsk@redhat.com>

The device core first places a device on the bus and then realizes it.
Make scsi_device_find avoid returing such devices to avoid
races in drivers that use an iothread (currently virtio-scsi)

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1812399

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20200913160259.32145-7-mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-bus.c | 83 +++++++++++++++++++++++++++++-----------------
 1 file changed, 53 insertions(+), 30 deletions(-)

Comments

Maxim Levitsky Sept. 30, 2020, 2:32 p.m. UTC | #1 
On Fri, 2020-09-25 at 13:26 -0400, Paolo Bonzini wrote:
> From: Maxim Levitsky <mlevitsk@redhat.com>
> 
> The device core first places a device on the bus and then realizes it.
> Make scsi_device_find avoid returing such devices to avoid
> races in drivers that use an iothread (currently virtio-scsi)
> 
> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1812399
> 
> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
> Message-Id: <20200913160259.32145-7-mlevitsk@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  hw/scsi/scsi-bus.c | 83 +++++++++++++++++++++++++++++-----------------
>  1 file changed, 53 insertions(+), 30 deletions(-)
> 
> diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
> index 4ab9811cd8..7599113efe 100644
> --- a/hw/scsi/scsi-bus.c
> +++ b/hw/scsi/scsi-bus.c
> @@ -24,6 +24,55 @@ static void scsi_target_free_buf(SCSIRequest *req);
>  
>  static int next_scsi_bus;
>  
> +static SCSIDevice *do_scsi_device_find(SCSIBus *bus,
> +                                       int channel, int id, int lun,
> +                                       bool include_unrealized)
> +{
> +    BusChild *kid;
> +    SCSIDevice *retval = NULL;
> +
> +    QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) {
> +        DeviceState *qdev = kid->child;
> +        SCSIDevice *dev = SCSI_DEVICE(qdev);
> +
> +        if (dev->channel == channel && dev->id == id) {
> +            if (dev->lun == lun) {
> +                retval = dev;
> +                break;
Indeed, here no need to use goto, I probably removed some code that needed it
before or just forgot about.
> +            }
> +
> +            /*
> +             * If we don't find exact match (channel/bus/lun),
> +             * we will return the first device which matches channel/bus
> +             */
> +
> +            if (!retval) {
> +                retval = dev;
> +            }
> +        }
> +    }
> +
> +    /*
> +     * This function might run on the IO thread and we might race against
> +     * main thread hot-plugging the device.
> +     * We assume that as soon as .realized is set to true we can let
> +     * the user access the device.
> +     */
> +
> +    if (retval && !include_unrealized &&
> +        !qatomic_load_acquire(&retval->qdev.realized)) {
> +        retval = NULL;
> +    }
> +
> +    return retval;
> +}
I guess you dropped the RCU locking here since you want the callers
of this function to do it. I think it makes lot of sense.

> +
> +SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
> +{
> +    RCU_READ_LOCK_GUARD();
> +    return do_scsi_device_find(bus, channel, id, lun, false);
> +}
> +
>  static void scsi_device_realize(SCSIDevice *s, Error **errp)
>  {
>      SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
> @@ -137,7 +186,10 @@ static bool scsi_bus_is_address_free(SCSIBus *bus,
>  				     int channel, int target, int lun,
>  				     SCSIDevice **p_dev)
>  {
> -    SCSIDevice *d = scsi_device_find(bus, channel, target, lun);
> +    SCSIDevice *d;
> +
> +    RCU_READ_LOCK_GUARD();
> +    d = do_scsi_device_find(bus, channel, target, lun, true);
>      if (d && d->lun == lun) {
>          if (p_dev) {
>              *p_dev = d;
> @@ -1570,35 +1622,6 @@ static char *scsibus_get_fw_dev_path(DeviceState *dev)
>                             qdev_fw_name(dev), d->id, d->lun);
>  }
>  
> -SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
> -{
> -    BusChild *kid;
> -    SCSIDevice *target_dev = NULL;
> -
> -    RCU_READ_LOCK_GUARD();
> -    QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) {
> -        DeviceState *qdev = kid->child;
> -        SCSIDevice *dev = SCSI_DEVICE(qdev);
> -
> -        if (dev->channel == channel && dev->id == id) {
> -            if (dev->lun == lun) {
> -                return dev;
> -            }
> -
> -            /*
> -             * If we don't find exact match (channel/bus/lun),
> -             * we will return the first device which matches channel/bus
> -             */
> -
> -            if (!target_dev) {
> -                target_dev = dev;
> -            }
> -        }
> -    }
> -
> -    return target_dev;
> -}
> -
>  /* SCSI request list.  For simplicity, pv points to the whole device */
>  
>  static int put_scsi_requests(QEMUFile *f, void *pv, size_t size,

Best regards,
	Maxim Levitsky
diff mbox series

Patch

diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index 4ab9811cd8..7599113efe 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -24,6 +24,55 @@  static void scsi_target_free_buf(SCSIRequest *req);
 
 static int next_scsi_bus;
 
+static SCSIDevice *do_scsi_device_find(SCSIBus *bus,
+                                       int channel, int id, int lun,
+                                       bool include_unrealized)
+{
+    BusChild *kid;
+    SCSIDevice *retval = NULL;
+
+    QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) {
+        DeviceState *qdev = kid->child;
+        SCSIDevice *dev = SCSI_DEVICE(qdev);
+
+        if (dev->channel == channel && dev->id == id) {
+            if (dev->lun == lun) {
+                retval = dev;
+                break;
+            }
+
+            /*
+             * If we don't find exact match (channel/bus/lun),
+             * we will return the first device which matches channel/bus
+             */
+
+            if (!retval) {
+                retval = dev;
+            }
+        }
+    }
+
+    /*
+     * This function might run on the IO thread and we might race against
+     * main thread hot-plugging the device.
+     * We assume that as soon as .realized is set to true we can let
+     * the user access the device.
+     */
+
+    if (retval && !include_unrealized &&
+        !qatomic_load_acquire(&retval->qdev.realized)) {
+        retval = NULL;
+    }
+
+    return retval;
+}
+
+SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
+{
+    RCU_READ_LOCK_GUARD();
+    return do_scsi_device_find(bus, channel, id, lun, false);
+}
+
 static void scsi_device_realize(SCSIDevice *s, Error **errp)
 {
     SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
@@ -137,7 +186,10 @@  static bool scsi_bus_is_address_free(SCSIBus *bus,
 				     int channel, int target, int lun,
 				     SCSIDevice **p_dev)
 {
-    SCSIDevice *d = scsi_device_find(bus, channel, target, lun);
+    SCSIDevice *d;
+
+    RCU_READ_LOCK_GUARD();
+    d = do_scsi_device_find(bus, channel, target, lun, true);
     if (d && d->lun == lun) {
         if (p_dev) {
             *p_dev = d;
@@ -1570,35 +1622,6 @@  static char *scsibus_get_fw_dev_path(DeviceState *dev)
                            qdev_fw_name(dev), d->id, d->lun);
 }
 
-SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
-{
-    BusChild *kid;
-    SCSIDevice *target_dev = NULL;
-
-    RCU_READ_LOCK_GUARD();
-    QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) {
-        DeviceState *qdev = kid->child;
-        SCSIDevice *dev = SCSI_DEVICE(qdev);
-
-        if (dev->channel == channel && dev->id == id) {
-            if (dev->lun == lun) {
-                return dev;
-            }
-
-            /*
-             * If we don't find exact match (channel/bus/lun),
-             * we will return the first device which matches channel/bus
-             */
-
-            if (!target_dev) {
-                target_dev = dev;
-            }
-        }
-    }
-
-    return target_dev;
-}
-
 /* SCSI request list.  For simplicity, pv points to the whole device */
 
 static int put_scsi_requests(QEMUFile *f, void *pv, size_t size,