qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Paolo Bonzini <pbonzini@redhat.com>
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] [PATCH 3/4] scsi-disk: bump SCSIRequest reference count until aio completion runs
Date: Fri,  7 Oct 2011 10:59:13 +0200	[thread overview]
Message-ID: <1317977954-21366-4-git-send-email-pbonzini@redhat.com> (raw)
In-Reply-To: <1317977954-21366-1-git-send-email-pbonzini@redhat.com>

In some cases a request may be canceled before the completion callback
runs.  Keep a reference to the request between starting an AIO operation,
and let scsi_*_complete remove it.

Since scsi_handle_rw_error returns whether something else has to be done
for the request by the caller, it makes sense to transfer ownership of
the ref to scsi_handle_rw_error when it returns 1; scsi_dma_restart_bh
will then free the reference after restarting the operation.

This is reproducible by doing an "eject -f" during an installer's media
test, using the lsi adapter.  The resulting "ABORT" message causes the
request to be canceled and freed before the read completes.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi-disk.c |   14 ++++++++++++++
 1 files changed, 14 insertions(+), 0 deletions(-)

diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 6497655..d6f2345 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -139,6 +139,7 @@ static void scsi_read_complete(void * opaque, int ret)
 
     if (ret) {
         if (scsi_handle_rw_error(r, -ret, SCSI_REQ_STATUS_RETRY_READ)) {
+            /* Leave in ref for scsi_dma_restart_bh.  */
             return;
         }
     }
@@ -149,6 +150,7 @@ static void scsi_read_complete(void * opaque, int ret)
     r->sector += n;
     r->sector_count -= n;
     scsi_req_data(&r->req, r->qiov.size);
+    scsi_req_unref(&r->req);
 }
 
 static void scsi_flush_complete(void * opaque, int ret)
@@ -163,11 +165,13 @@ static void scsi_flush_complete(void * opaque, int ret)
 
     if (ret < 0) {
         if (scsi_handle_rw_error(r, -ret, SCSI_REQ_STATUS_RETRY_FLUSH)) {
+            /* Leave in ref for scsi_dma_restart_bh.  */
             return;
         }
     }
 
     scsi_req_complete(&r->req, GOOD);
+    scsi_req_unref(&r->req);
 }
 
 /* Read more data from scsi device into buffer.  */
@@ -202,6 +206,9 @@ static void scsi_read_data(SCSIRequest *req)
     if (s->tray_open) {
         scsi_read_complete(r, -ENOMEDIUM);
     }
+
+    /* Save a ref for scsi_read_complete, in case r is canceled.  */
+    scsi_req_ref(&r->req);
     n = scsi_init_iovec(r);
     bdrv_acct_start(s->bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
     r->req.aiocb = bdrv_aio_readv(s->bs, r->sector, &r->qiov, n,
@@ -278,6 +285,7 @@ static void scsi_write_complete(void * opaque, int ret)
         DPRINTF("Write complete tag=0x%x more=%d\n", r->req.tag, r->qiov.size);
         scsi_req_data(&r->req, r->qiov.size);
     }
+    scsi_req_unref(&r->req);
 }
 
 static void scsi_write_data(SCSIRequest *req)
@@ -295,6 +303,8 @@ static void scsi_write_data(SCSIRequest *req)
         return;
     }
 
+    /* Save a ref for scsi_write_complete, in case r is canceled.  */
+    scsi_req_ref(&r->req);
     n = r->qiov.size / 512;
     if (n) {
         if (s->tray_open) {
@@ -343,6 +353,8 @@ static void scsi_dma_restart_bh(void *opaque)
                     scsi_req_complete(&r->req, GOOD);
                 }
             }
+            /* This reference was left in by scsi_handle_rw_error.  */
+            scsi_req_unref(&r->req);
         }
     }
 }
@@ -1324,6 +1336,8 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf)
         r->iov.iov_len = rc;
         break;
     case SYNCHRONIZE_CACHE:
+        /* Save a ref for scsi_flush_complete, in case r is canceled.  */
+        scsi_req_ref(&r->req);
         bdrv_acct_start(s->bs, &r->acct, 0, BDRV_ACCT_FLUSH);
         r->req.aiocb = bdrv_aio_flush(s->bs, scsi_flush_complete, r);
         if (r->req.aiocb == NULL) {
-- 
1.7.6

  parent reply	other threads:[~2011-10-07  8:59 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-10-07  8:59 [Qemu-devel] [PATCH 0/4] scsi: miscellaneous fixes Paolo Bonzini
2011-10-07  8:59 ` [Qemu-devel] [PATCH 1/4] scsi-disk: fail READ CAPACITY if LBA != 0 but PMI == 0 Paolo Bonzini
2011-10-07  8:59 ` [Qemu-devel] [PATCH 2/4] scsi-disk: do not complete requests twice Paolo Bonzini
2011-10-07  8:59 ` Paolo Bonzini [this message]
2011-10-07  8:59 ` [Qemu-devel] [PATCH 4/4] scsi-disk: fix retrying a flush Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1317977954-21366-4-git-send-email-pbonzini@redhat.com \
    --to=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).