From patchwork Mon Apr 28 12:59:17 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Alex_Benn=C3=A9e?= X-Patchwork-Id: 885478 Delivered-To: patch@linaro.org Received: by 2002:a5d:474d:0:b0:38f:210b:807b with SMTP id o13csp5168313wrs; Mon, 28 Apr 2025 06:06:25 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCV/p/sNz4XR+Sg7nbTsmvDudlLIceIaYI3gtaLjASLopxbLYpwNgzpVbJUisVkO7VF8U9j7PQ==@linaro.org X-Google-Smtp-Source: AGHT+IGK9gMWnb+9frXW+Qlg2+lFSUt1smu5GNaNq8Xfy89VgMMhJMjKCmjIb6/uOS1b8+YiZ8P9 X-Received: by 2002:a17:907:c0e:b0:acb:ac30:61f2 with SMTP id a640c23a62f3a-ace73a45d9emr1108240966b.18.1745845584617; Mon, 28 Apr 2025 06:06:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1745845584; cv=none; d=google.com; s=arc-20240605; b=drrPEq2UeX35JQLY7uSY/BFTtUSsrem2gXiU0UFyJp5NToEwBJTYEUvZUmIwFZCxYn VuTlKcP1/t2h9MqxmTHZ+ERGTe8BX2xQ35bfDNTEwo8tYf8wDULLdwqEHJfI+lUJFn+S yxH6Ff1F34DVWgR8XdWIOZZppMmn69LYoe5SzMdyJfSajf66gR1r8qbYu+kAT+6+k7Cf kul1uBE8v5PWBQzNmt+d3x37YrLc4aePkw/s4nAf+xtRy2ilW8yMxJYhG2KqQsWioi7p FbUhbUrhQhTll8ZvASiRr8Ed8UmXAKI3ylHm/faMCOptmSKIA0vGtCNUsDkmjbpcz1Ot 8SRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=vC8n191P5j8mUKL+6H7GfxpWwzkXlFDtmwixiEivZfA=; fh=MbSZeyuHz1YMF37U3Zh5uEBxqt8d1r6Azei5dqApup4=; b=ehJY26jm1YGkyKRykyTuvSo8jUAsbKu8u82qv5C0t9uhcGTAoNjBH6RoAncHtwTKAb /3kbj2wpKr+8zrEG8I/aY2UZGwWoTDnX0gCAZJNxQauS36y1NB4OvA5Dy0xkJsMEqGuJ VC2t8oqEHQC4IEVprdKbr5N4y0L8v5z9/I3seuKNSyBSASvmngygvXgMvNHvx84Bj5j8 uMrf0zA2MQHlGe3TlzjaliICbws3jIkEp7m3lp76Euh3Au/nI5LYbkSf3ovTfY/Q3YGa XY2Qz56QeVYAviakai/8+jS1fIk9Kcqf4jo6HldWQwmPsqhaytxiF5huIFua2sfHtL38 23ZA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=LtbM9zZA; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org; dara=neutral header.i=@linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id a640c23a62f3a-ace6e432e1asi505835166b.61.2025.04.28.06.06.24 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 28 Apr 2025 06:06:24 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=LtbM9zZA; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org; dara=neutral header.i=@linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1u9O5Z-0000Cc-E0; Mon, 28 Apr 2025 09:00:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1u9O56-0007yB-Ho for qemu-devel@nongnu.org; Mon, 28 Apr 2025 08:59:32 -0400 Received: from mail-ej1-x62b.google.com ([2a00:1450:4864:20::62b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1u9O52-00038S-0f for qemu-devel@nongnu.org; Mon, 28 Apr 2025 08:59:32 -0400 Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-acb39c45b4eso752545766b.1 for ; Mon, 28 Apr 2025 05:59:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1745845166; x=1746449966; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=vC8n191P5j8mUKL+6H7GfxpWwzkXlFDtmwixiEivZfA=; b=LtbM9zZAjmrx8EPgUFzb4dwTkeIhqbUPaHQ8zrSMnBMSP9Ti1EBkrlViXT4GEk3Bd0 RtVT3VZHOOD7iyHbZ3/tiIKFjuj+1vdWpC+gnHactdN+hAr/rR3xCa5y5m5r6nBeyQJw zYwDZNA7ENipR08B+UJfNFKv61ITw0t/nYGheA3quvhrTy5uk6EsQcfXfpcxnWd/hdym +L8xonNM7mKLRwCBN9YWYH2ZY+pTPu9X5f5QCUNZACzIPMtzcYNm0c4IbA50wyK4+YUY wN9W3RhHDIsJXtmfCiX33HOAQ461RgZTvK3slBCmmTDvzSuQomnXwqiVt6k1tKsNZGT3 v2RQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1745845166; x=1746449966; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vC8n191P5j8mUKL+6H7GfxpWwzkXlFDtmwixiEivZfA=; b=I5nQPThjYVFX7Q6/gxKUb2l5Zjh5JwE37CV2YhX+lqXbeC2Zl+HSuLaMaSZ6lDsKpl qTFnh7jWUXourDOFyw1tQ9Hb0IksvWXfmCw2X6CvtIykYAXKX6jmqtoE95h+i8ShzRN7 GkeysOtHftvSMJZsNZpylLLIYO6mUlZ560tdI9dYUH2LM2TL/x+u4V56niS7RoeqFDb5 Uf5Jq4w7OgLDDwfBev1IuNulYtBnYuQyDehi4Vt9Aey+jgZsLIeQngQQL5hVf69p3En7 TjAu/xPNi8BbNgEAlQtn4v1tJ2McFm7ySGeHA9Ptjgn+6wKbCu9yQa+roXEeIfXtYQEC NxHg== X-Gm-Message-State: AOJu0YwbFGVL44PRcgpomCTyYJrT5VHprdvz+zJkkLY/5efd+20bGLYj GGkh9BaTJ6RKIO4kNS0lV55B1kOtxBFrsQEGnO6K0Sl9IuWeAOXtTCsvEI2q5RE= X-Gm-Gg: ASbGnctMx/d8kJ/JoUJEhUZIx4hch1PBKX3bypaK44jco45JduAmeCltU/ZgrVuuibO +ir5j8jnx4TJR72u4cbdx3bi6leeCkIwGa1YR+mhY6oYrPRIONAvHzPZqg1gzWg++EgSjqqKS7w mMeYUb1B3meaJXyfGIhi/zvADppvAflolPPx1m6bd/rJ1UgG3ft3yi/RakdLHHbPgJlSkR4i2mm xhLRLHmknRZaWelFmagh9VSqZWaoaYb7cW2mRma8EOy9hKj9sNYn8yK80Pt2dmyLsnL9q5ePk6C 4E0X+w1bjAPYszQ6sLwOpgY5UmZjsudGyGV1ONiFdueyqOxotogcAw== X-Received: by 2002:a17:907:2d94:b0:ace:6703:3cd5 with SMTP id a640c23a62f3a-ace73a45cd7mr1155454166b.19.1745845166242; Mon, 28 Apr 2025 05:59:26 -0700 (PDT) Received: from draig.lan ([185.126.160.109]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ace6e41b7f9sm623625266b.6.2025.04.28.05.59.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Apr 2025 05:59:22 -0700 (PDT) Received: from draig.lan (localhost [IPv6:::1]) by draig.lan (Postfix) with ESMTP id 032375FAF0; Mon, 28 Apr 2025 13:59:19 +0100 (BST) From: =?utf-8?q?Alex_Benn=C3=A9e?= To: qemu-devel@nongnu.org Cc: Thomas Huth , Alexandre Iooss , "Michael S. Tsirkin" , Paolo Bonzini , =?utf-8?q?Alex_Benn=C3=A9e?= , David Hildenbrand , Pierrick Bouvier , qemu-arm@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Peter Xu , Peter Maydell , Mahmoud Mandour , Manos Pitsidianakis , qemu-stable@nongnu.org Subject: [PATCH 8/9] virtio-gpu: fix hang under TCG when unmapping blob Date: Mon, 28 Apr 2025 13:59:17 +0100 Message-Id: <20250428125918.449346-9-alex.bennee@linaro.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250428125918.449346-1-alex.bennee@linaro.org> References: <20250428125918.449346-1-alex.bennee@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::62b; envelope-from=alex.bennee@linaro.org; helo=mail-ej1-x62b.google.com X-Spam_score_int: 12 X-Spam_score: 1.2 X-Spam_bar: + X-Spam_report: (1.2 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Manos Pitsidianakis This commit fixes an indefinite hang when using VIRTIO GPU blob objects under TCG in certain conditions. The VIRTIO_GPU_CMD_RESOURCE_MAP_BLOB VIRTIO command creates a MemoryRegion and attaches it to an offset on a PCI BAR of the VirtIOGPUdevice. The VIRTIO_GPU_CMD_RESOURCE_UNMAP_BLOB command unmaps it. Because virglrenderer commands are not thread-safe they are only called on the main context and QEMU performs the cleanup in three steps to prevent a use-after-free scenario where the guest can access the region after it’s unmapped: 1. From the main context, the region’s field finish_unmapping is false by default, so it sets a variable cmd_suspended, increases the renderer_blocked variable, deletes the blob subregion, and unparents the blob subregion causing its reference count to decrement. 2. From an RCU context, the MemoryView gets freed, the FlatView gets recalculated, the free callback of the blob region virtio_gpu_virgl_hostmem_region_free is called which sets the region’s field finish_unmapping to true, allowing the main thread context to finish replying to the command 3. From the main context, the command is processed again, but this time finish_unmapping is true, so virgl_renderer_resource_unmap can be called and a response is sent to the guest. It happens so that under TCG, if the guest has no timers configured (and thus no interrupt will cause the CPU to exit), the RCU thread does not have enough time to grab the locks and recalculate the FlatView. That’s not a big problem in practice since most guests will assume a response will happen later in time and go on to do different things, potentially triggering interrupts and allowing the RCU context to run. If the guest waits for the unmap command to complete though, it blocks indefinitely. Attaching to the QEMU monitor and force quitting the guest allows the cleanup to continue. There's no reason why the FlatView recalculation can't occur right away when we delete the blob subregion, however. It does not, because when we create the subregion we set the object as its own parent: memory_region_init_ram_ptr(mr, OBJECT(mr), "blob", size, data); The extra reference is what prevents freeing the memory region object in the memory transaction of deleting the subregion. This commit changes the owner object to the device, which removes the extra owner reference in the memory region and causes the MR to be freed right away in the main context. Acked-by: Michael S. Tsirkin Signed-off-by: Manos Pitsidianakis Reviewed-by: Alex Bennée Tested-by: Alex Bennée Message-Id: <20250410122643.1747913-3-manos.pitsidianakis@linaro.org> Cc: qemu-stable@nongnu.org --- hw/display/virtio-gpu-virgl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index 71a7500de9..8fbe4e70cc 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -112,7 +112,7 @@ virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g, vmr->g = g; mr = g_new0(MemoryRegion, 1); - memory_region_init_ram_ptr(mr, OBJECT(mr), "blob", size, data); + memory_region_init_ram_ptr(mr, OBJECT(g), "blob", size, data); memory_region_add_subregion(&b->hostmem, offset, mr); memory_region_set_enabled(mr, true);