* Re: [Qemu-devel] virtio-scsi WRITE_VERIFY crash
2013-04-08 15:53 ` Stefan Hajnoczi
@ 2013-04-08 16:28 ` ronnie sahlberg
2013-04-08 16:52 ` Paolo Bonzini
1 sibling, 0 replies; 4+ messages in thread
From: ronnie sahlberg @ 2013-04-08 16:28 UTC (permalink / raw)
To: Stefan Hajnoczi; +Cc: Paolo Bonzini, Asias He, qemu-devel, Venkatesh Srinivas
I dont think QEMU scsi emulation supports WRITE_VERIFY.
In the past there was a few instances where the code in the SCSI emulation
that determines the transfer direction, based on the opcode, did not contain
a new opcode, so it got the xfer direction wrong and crashed.
I dont have access to my box with QEMU right now,
but I would check if it is something similar to this patch :
http://lists.gnu.org/archive/html/qemu-devel/2012-04/msg04130.html
regards
ronnie sahlberg
On Mon, Apr 8, 2013 at 8:53 AM, Stefan Hajnoczi <stefanha@gmail.com> wrote:
> On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote:
>> When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
>> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
>> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
>> command has no IOCB.
>>
>> The callpath is:
>> scsi_dma_complete
>> dma_complete
>> dma_bdrv_cb
>> dma_bdrv_io
>> dma_bdrv_read
>> scsi_do_read
>> bdrv_co_em_bh
>> aio_bh_poll
>> aio_poll.
>>
>> At the assertion, we have a zero-element iovector and the request has
>> a status of -1.
>
> CCing Paolo Bonzini and Asias He. See the ./MAINTAINERS file to find
> people that can help with specific QEMU subsystems.
>
> It would be nice to include a full gdb backtrace when possible since
> that may include extra information like that value of arguments in the
> call stack.
>
> Stefan
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] virtio-scsi WRITE_VERIFY crash
2013-04-08 15:53 ` Stefan Hajnoczi
2013-04-08 16:28 ` ronnie sahlberg
@ 2013-04-08 16:52 ` Paolo Bonzini
1 sibling, 0 replies; 4+ messages in thread
From: Paolo Bonzini @ 2013-04-08 16:52 UTC (permalink / raw)
To: Stefan Hajnoczi; +Cc: Asias He, qemu-devel, Venkatesh Srinivas
[-- Attachment #1: Type: text/plain, Size: 1014 bytes --]
Il 08/04/2013 17:53, Stefan Hajnoczi ha scritto:
> On Fri, Apr 05, 2013 at 11:30:00AM -0700, Venkatesh Srinivas wrote:
>> When a Linux guest does a simple 'sg_verify /dev/<scsi disk on a
>> virtio-scsi HBA>', qemu (-master from git) crashes, tripping an
>> assertion in scsi-disk.c:scsi_dma_complete(), that the completing DMA
>> command has no IOCB.
>>
>> The callpath is:
>> scsi_dma_complete
>> dma_complete
>> dma_bdrv_cb
>> dma_bdrv_io
>> dma_bdrv_read
>> scsi_do_read
>> bdrv_co_em_bh
>> aio_bh_poll
>> aio_poll.
>>
>> At the assertion, we have a zero-element iovector and the request has
>> a status of -1.
>
> CCing Paolo Bonzini and Asias He. See the ./MAINTAINERS file to find
> people that can help with specific QEMU subsystems.
>
> It would be nice to include a full gdb backtrace when possible since
> that may include extra information like that value of arguments in the
> call stack.
The bug should actually be quite trivial, but I will only test the
attached patch tomorrow.
Thanks,
Paolo
[-- Attachment #2: 0001-scsi-avoid-assertion-failure-on-VERIFY-command.patch --]
[-- Type: text/x-patch, Size: 1896 bytes --]
>From 38d68bdee0d4cc75527da963e3b66a67aa0aadcc Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Apr 2013 18:50:15 +0200
Subject: [PATCH] scsi: avoid assertion failure on VERIFY command
A verify command is not an actual read (we do not implement
compare mode) and thus does not have an AIOCB attached. Do
not crash in scsi_dma_complete.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
hw/scsi-disk.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index c5c7bf3..068d9bb 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -244,14 +244,15 @@ done:
}
}
-static void scsi_dma_complete(void *opaque, int ret)
+static void scsi_dma_complete_noio(void *opaque, int ret)
{
SCSIDiskReq *r = (SCSIDiskReq *)opaque;
SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- assert(r->req.aiocb != NULL);
- r->req.aiocb = NULL;
- bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+ if (r->req.aiocb != NULL) {
+ r->req.aiocb = NULL;
+ bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+ }
if (r->req.io_canceled) {
goto done;
}
@@ -277,6 +278,14 @@ done:
}
}
+static void scsi_dma_complete(void *opaque, int ret)
+{
+ SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+
+ assert(r->req.aiocb != NULL);
+ scsi_dma_complete_noio(opaque, ret);
+}
+
static void scsi_read_complete(void * opaque, int ret)
{
SCSIDiskReq *r = (SCSIDiskReq *)opaque;
@@ -496,7 +505,7 @@ static void scsi_write_data(SCSIRequest *req)
if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
r->req.cmd.buf[0] == VERIFY_16) {
if (r->req.sg) {
- scsi_dma_complete(r, 0);
+ scsi_dma_complete_noio(r, 0);
} else {
scsi_write_complete(r, 0);
}
--
1.8.2
^ permalink raw reply related [flat|nested] 4+ messages in thread