From patchwork Mon Aug 12 22:07:48 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pierrick Bouvier X-Patchwork-Id: 818576 Delivered-To: patch@linaro.org Received: by 2002:adf:cd01:0:b0:367:895a:4699 with SMTP id w1csp24519wrm; Mon, 12 Aug 2024 15:08:21 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUc7fhDSJNOWfx2O29D+6tjCVj0++D1wqg7DT8BhVLfDbbkIklOVPBRzK7lUwLooGbwEDYgtuWEVmVO6JvsJthJ X-Google-Smtp-Source: AGHT+IGBpVYloQGNhusOL5UUNjL/ZTG5Eh8ftPnSINCByly2G00yvI3gK8apXmOgqgr+QOQkGAGm X-Received: by 2002:a05:6359:4c04:b0:1a2:5c3a:f0f4 with SMTP id e5c5f4694b2df-1b19d2c3fcemr223120255d.10.1723500501257; Mon, 12 Aug 2024 15:08:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1723500501; cv=none; d=google.com; s=arc-20160816; b=TeU79C5lDw6sQ2hYBgb79Uzh1aurNxgSVYxv6tXW00trVEuUmnxYtYLX0zazUO25u9 pBYVJpjqqcJhXfu0uK+pRSdCkjyVrmJgTBYEWzcMiuU4hN1FilanlMBdcCQSIIQxTxOs tB7n6hAI/LUivqjOe5HNamkZx0CgS35Y3b6aJccelagemKavDygk9l/wz/c5eKO+s8UI kimcP0DfS3jXL4535VdnijYkBev6WOokcLevK4r/qOPmUD6pGpSdfG70A+FWEO2j0CMO vgdrXGKj7tKKJ22Key8dAlCdnr7U7YkocShj0Zf9zmtcXiM56CKSHa9FHPxtu11swkMP Yvtw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=ttAfjKeU6u7wb2c6jWg45GDLBDcHd62FQu7Ts/cTRl4=; fh=RtUd3DS4kHwsGPhIXfIqZKVpLxPkLpupYTyINqaKY0M=; b=vumrHQvoPyuJMBpZd3s/V8rXPqMznR0fo9Y2RfQ0VAnuPaKyBFqJQwiEfgf7w32h+7 REeSCc3GH3r1vcyNx0MzWUn6KjjfmltZ2rHI3YavOskcnWYWBHXuLPspC4tFsbKuFxc9 jp1Y58vOiWIfczSTuGwag7T5XDRpzj3r/0KMIeCEtvxotVRPHEPu0oZt26+dzbbLJYBX 6zTBsc31yhOH3nUYYYuXXLO2ML1Ld38NXq/I7SwbH/n5YLXWwgBYWkVLNy9rtS+0SyzM 6OzBjXkfJxj2IudiWwDs29Jxmd3hx1dO048YOOQcFoV8q9SyJs1ln5gs/bR2vSwpe7K5 44Bw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=kQNu9gLv; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org; dara=neutral header.i=@linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a4c7e07667si680120285a.461.2024.08.12.15.08.20 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 12 Aug 2024 15:08:21 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=kQNu9gLv; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org; dara=neutral header.i=@linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sddCx-0000y8-ES; Mon, 12 Aug 2024 18:08:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sddCt-0000jq-5W for qemu-devel@nongnu.org; Mon, 12 Aug 2024 18:08:03 -0400 Received: from mail-pl1-x629.google.com ([2607:f8b0:4864:20::629]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sddCq-0002by-JM for qemu-devel@nongnu.org; Mon, 12 Aug 2024 18:08:02 -0400 Received: by mail-pl1-x629.google.com with SMTP id d9443c01a7336-1fd90c2fc68so32876215ad.1 for ; Mon, 12 Aug 2024 15:08:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1723500479; x=1724105279; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ttAfjKeU6u7wb2c6jWg45GDLBDcHd62FQu7Ts/cTRl4=; b=kQNu9gLvQOkAGthh83MNyyQ5skgg1MmXhF5KLd1+qY9CYr7K2nQawOcaD6ijat/01Z 0QQ1m/kdtoefI2Y2Xa43NIDTVdmIYwrflQV2eix4oneCATMA2RgI7qBvxhqDhk8qDHy6 RUPzytpGSHvN2/6HLySdNDyC94d5xGJSOsS2w10N0qqQS8sTpsqECpgdrQ1VNLu3uJXb jghqS3maT18fpDHz4V0cJ9G3LargzbrDebi/+cU9IJwSgMfWSdx5eHL24ulmHnuATY1w WBhLPpLQoDlyA3Kf73VKS05DbA2XWulepqDlWmRHPo1S2rMXjHcfV/2LC228egZtQ58G e7fA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723500479; x=1724105279; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ttAfjKeU6u7wb2c6jWg45GDLBDcHd62FQu7Ts/cTRl4=; b=IjaP9BAyOfC+tg37eoDnUVBU7etY7+/qHvwCPjL5zNRLn0TnbGw9LTuqU2eB7YjxkM fDevav3uVQg+7Uz5IyFkLBkoQPLMlItSV42LZkT20mHW+GNBjLp1uuBQJ0DKTU+6Vlit Hs00mxPA/DKbD7FDK9lWdlRQGxIHZTdGh3Pry+63XfcjeEnl4vr90+2aWyCf096zgXfF 6vFBnm1/1fU4g5lhw1O/gOUY2rnduYucdpyiWjOryiH0Wr3j0aUSV6tO+5dVbHB1Y/a4 1qrBWod/Y0XjIJJZXOLhBuVXzpMbeou3KJc5Q4xeGzIjwA98ZT8CeYpB/0eMu4HV0D9n gUpA== X-Gm-Message-State: AOJu0Yzim1QYzyifi/+ux6qtA8I9zz1U62Fen00HMNtBY0B7HcUpSI3X HV/TEbm1jn3aYMEELKSYYxl7b08bJWdrCVHb4K0r2djiTRkshD5VlQaQ9rkTsKs66gLljO+7NES evUQ= X-Received: by 2002:a17:902:f54c:b0:1fb:67e0:2e0a with SMTP id d9443c01a7336-201ca1acaf7mr20732765ad.48.1723500478864; Mon, 12 Aug 2024 15:07:58 -0700 (PDT) Received: from linaro.vn.shawcable.net ([2604:3d08:9384:1d00:5b09:8db7:b002:cf61]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-201cd13169esm1588355ad.24.2024.08.12.15.07.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Aug 2024 15:07:58 -0700 (PDT) From: Pierrick Bouvier To: qemu-devel@nongnu.org Cc: Pierrick Bouvier , Mahmoud Mandour , =?utf-8?q?Alex_Benn=C3=A9e?= , Alexandre Iooss Subject: [PATCH v2 1/1] plugins: fix race condition with scoreboards Date: Mon, 12 Aug 2024 15:07:48 -0700 Message-Id: <20240812220748.95167-2-pierrick.bouvier@linaro.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240812220748.95167-1-pierrick.bouvier@linaro.org> References: <20240812220748.95167-1-pierrick.bouvier@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::629; envelope-from=pierrick.bouvier@linaro.org; helo=mail-pl1-x629.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org A deadlock can be created if a new vcpu (a) triggers a scoreboard reallocation, and another vcpu (b) wants to create a new scoreboard at the same time. In this case, (a) holds the plugin lock, and starts an exclusive section, waiting for (b). But at the same time, (b) is waiting for plugin lock. The solution is to drop the lock before entering the exclusive section. This bug can be easily reproduced by creating a callback for any tb exec, that allocates a new scoreboard. In this case, as soon as we reach more than 16 vcpus, the deadlock occurs. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2344 Signed-off-by: Pierrick Bouvier Reviewed-by: Richard Henderson --- plugins/core.c | 38 ++++++++++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 10 deletions(-) diff --git a/plugins/core.c b/plugins/core.c index 12c67b4b4eb..84e2872083b 100644 --- a/plugins/core.c +++ b/plugins/core.c @@ -214,30 +214,48 @@ CPUPluginState *qemu_plugin_create_vcpu_state(void) static void plugin_grow_scoreboards__locked(CPUState *cpu) { - if (cpu->cpu_index < plugin.scoreboard_alloc_size) { + size_t scoreboard_size = plugin.scoreboard_alloc_size; + if (cpu->cpu_index < scoreboard_size) { return; } bool need_realloc = FALSE; - while (cpu->cpu_index >= plugin.scoreboard_alloc_size) { - plugin.scoreboard_alloc_size *= 2; + while (cpu->cpu_index >= scoreboard_size) { + scoreboard_size *= 2; need_realloc = TRUE; } + if (!need_realloc) { + return; + } - if (!need_realloc || QLIST_EMPTY(&plugin.scoreboards)) { - /* nothing to do, we just updated sizes for future scoreboards */ + if (QLIST_EMPTY(&plugin.scoreboards)) { + /* just update size for future scoreboards */ + plugin.scoreboard_alloc_size = scoreboard_size; return; } + /* + * A scoreboard creation/deletion might be in progress. If a new vcpu is + * initialized at the same time, we are safe, as the new + * plugin.scoreboard_alloc_size was not yet written. + */ + qemu_rec_mutex_unlock(&plugin.lock); + /* cpus must be stopped, as tb might still use an existing scoreboard. */ start_exclusive(); - struct qemu_plugin_scoreboard *score; - QLIST_FOREACH(score, &plugin.scoreboards, entry) { - g_array_set_size(score->data, plugin.scoreboard_alloc_size); + /* re-acquire lock */ + qemu_rec_mutex_lock(&plugin.lock); + /* in case another vcpu is created between unlock and exclusive section. */ + if (scoreboard_size > plugin.scoreboard_alloc_size) { + struct qemu_plugin_scoreboard *score; + QLIST_FOREACH(score, &plugin.scoreboards, entry) { + g_array_set_size(score->data, scoreboard_size); + } + plugin.scoreboard_alloc_size = scoreboard_size; + /* force all tb to be flushed, as scoreboard pointers were changed. */ + tb_flush(cpu); } - /* force all tb to be flushed, as scoreboard pointers were changed. */ - tb_flush(cpu); end_exclusive(); }