be2c42b97c
When an IOThread is configured, the ctrl virtqueue is processed in the IOThread. TMFs that reset SCSI devices are currently called directly from the IOThread and trigger an assertion failure in blk_drain() from the following call stack: virtio_scsi_handle_ctrl_req -> virtio_scsi_do_tmf -> device_code_reset -> scsi_disk_reset -> scsi_device_purge_requests -> blk_drain ../block/block-backend.c:1780: void blk_drain(BlockBackend *): Assertion `qemu_in_main_thread()' failed. The blk_drain() function is not designed to be called from an IOThread because it needs the Big QEMU Lock (BQL). This patch defers TMFs that reset SCSI devices to a Bottom Half (BH) that runs in the main loop thread under the BQL. This way it's safe to call blk_drain() and the assertion failure is avoided. Introduce s->tmf_bh_list for tracking TMF requests that have been deferred to the BH. When the BH runs it will grab the entire list and process all requests. Care must be taken to clear the list when the virtio-scsi device is reset or unrealized. Otherwise deferred TMF requests could execute later and lead to use-after-free or other undefined behavior. The s->resetting counter that's used by TMFs that reset SCSI devices is accessed from multiple threads. This patch makes that explicit by using atomic accessor functions. With this patch applied the counter is only modified by the main loop thread under the BQL but can be read by any thread. Reported-by: Qing Wang <qinwang@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20230221212218.1378734-4-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
130 lines
3.4 KiB
C
130 lines
3.4 KiB
C
/*
|
|
* Virtio SCSI HBA
|
|
*
|
|
* Copyright IBM, Corp. 2010
|
|
*
|
|
* Authors:
|
|
* Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
* the COPYING file in the top-level directory.
|
|
*
|
|
*/
|
|
|
|
#ifndef QEMU_VIRTIO_SCSI_H
|
|
#define QEMU_VIRTIO_SCSI_H
|
|
#include "qom/object.h"
|
|
|
|
/* Override CDB/sense data size: they are dynamic (guest controlled) in QEMU */
|
|
#define VIRTIO_SCSI_CDB_SIZE 0
|
|
#define VIRTIO_SCSI_SENSE_SIZE 0
|
|
#include "standard-headers/linux/virtio_scsi.h"
|
|
#include "hw/virtio/virtio.h"
|
|
#include "hw/scsi/scsi.h"
|
|
#include "chardev/char-fe.h"
|
|
#include "sysemu/iothread.h"
|
|
|
|
#define TYPE_VIRTIO_SCSI_COMMON "virtio-scsi-common"
|
|
OBJECT_DECLARE_SIMPLE_TYPE(VirtIOSCSICommon, VIRTIO_SCSI_COMMON)
|
|
|
|
#define TYPE_VIRTIO_SCSI "virtio-scsi-device"
|
|
OBJECT_DECLARE_SIMPLE_TYPE(VirtIOSCSI, VIRTIO_SCSI)
|
|
|
|
#define VIRTIO_SCSI_MAX_CHANNEL 0
|
|
#define VIRTIO_SCSI_MAX_TARGET 255
|
|
#define VIRTIO_SCSI_MAX_LUN 16383
|
|
|
|
/* Number of virtqueues that are always present */
|
|
#define VIRTIO_SCSI_VQ_NUM_FIXED 2
|
|
|
|
#define VIRTIO_SCSI_AUTO_NUM_QUEUES UINT32_MAX
|
|
|
|
typedef struct virtio_scsi_cmd_req VirtIOSCSICmdReq;
|
|
typedef struct virtio_scsi_cmd_resp VirtIOSCSICmdResp;
|
|
typedef struct virtio_scsi_ctrl_tmf_req VirtIOSCSICtrlTMFReq;
|
|
typedef struct virtio_scsi_ctrl_tmf_resp VirtIOSCSICtrlTMFResp;
|
|
typedef struct virtio_scsi_ctrl_an_req VirtIOSCSICtrlANReq;
|
|
typedef struct virtio_scsi_ctrl_an_resp VirtIOSCSICtrlANResp;
|
|
typedef struct virtio_scsi_event VirtIOSCSIEvent;
|
|
typedef struct virtio_scsi_config VirtIOSCSIConfig;
|
|
|
|
struct VirtIOSCSIConf {
|
|
uint32_t num_queues;
|
|
uint32_t virtqueue_size;
|
|
bool seg_max_adjust;
|
|
uint32_t max_sectors;
|
|
uint32_t cmd_per_lun;
|
|
char *vhostfd;
|
|
char *wwpn;
|
|
CharBackend chardev;
|
|
uint32_t boot_tpgt;
|
|
IOThread *iothread;
|
|
};
|
|
|
|
struct VirtIOSCSI;
|
|
|
|
struct VirtIOSCSICommon {
|
|
VirtIODevice parent_obj;
|
|
VirtIOSCSIConf conf;
|
|
|
|
uint32_t sense_size;
|
|
uint32_t cdb_size;
|
|
VirtQueue *ctrl_vq;
|
|
VirtQueue *event_vq;
|
|
VirtQueue **cmd_vqs;
|
|
};
|
|
|
|
struct VirtIOSCSIReq;
|
|
|
|
struct VirtIOSCSI {
|
|
VirtIOSCSICommon parent_obj;
|
|
|
|
SCSIBus bus;
|
|
int resetting; /* written from main loop thread, read from any thread */
|
|
bool events_dropped;
|
|
|
|
/*
|
|
* TMFs deferred to main loop BH. These fields are protected by
|
|
* virtio_scsi_acquire().
|
|
*/
|
|
QEMUBH *tmf_bh;
|
|
QTAILQ_HEAD(, VirtIOSCSIReq) tmf_bh_list;
|
|
|
|
/* Fields for dataplane below */
|
|
AioContext *ctx; /* one iothread per virtio-scsi-pci for now */
|
|
|
|
bool dataplane_started;
|
|
bool dataplane_starting;
|
|
bool dataplane_stopping;
|
|
bool dataplane_fenced;
|
|
uint32_t host_features;
|
|
};
|
|
|
|
static inline void virtio_scsi_acquire(VirtIOSCSI *s)
|
|
{
|
|
if (s->ctx) {
|
|
aio_context_acquire(s->ctx);
|
|
}
|
|
}
|
|
|
|
static inline void virtio_scsi_release(VirtIOSCSI *s)
|
|
{
|
|
if (s->ctx) {
|
|
aio_context_release(s->ctx);
|
|
}
|
|
}
|
|
|
|
void virtio_scsi_common_realize(DeviceState *dev,
|
|
VirtIOHandleOutput ctrl,
|
|
VirtIOHandleOutput evt,
|
|
VirtIOHandleOutput cmd,
|
|
Error **errp);
|
|
|
|
void virtio_scsi_common_unrealize(DeviceState *dev);
|
|
|
|
void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp);
|
|
int virtio_scsi_dataplane_start(VirtIODevice *s);
|
|
void virtio_scsi_dataplane_stop(VirtIODevice *s);
|
|
|
|
#endif /* QEMU_VIRTIO_SCSI_H */
|