[PATCH 1/2] multifd: Fix a race on reading MultiFDPages_t.block

[PATCH 1/2] multifd: Fix a race on reading MultiFDPages_t.block

[Zhenzhong Duan]

In multifd_queue_page() MultiFDPages_t.block is checked twice.
Between the two checks, MultiFDPages_t.block may be reset to NULL
by multifd thread. This lead to the 2nd check always true then a
redundant page submitted to multifd thread again.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 migration/multifd.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index 586ddc9d657a..36e2139995cf 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -447,6 +447,7 @@ static int multifd_send_pages(QEMUFile *f)
 int multifd_queue_page(QEMUFile *f, RAMBlock *block, ram_addr_t offset)
 {
     MultiFDPages_t *pages = multifd_send_state->pages;
+    bool changed = false;
 
     if (!pages->block) {
         pages->block = block;
@@ -459,14 +460,16 @@ int multifd_queue_page(QEMUFile *f, RAMBlock *block, ram_addr_t offset)
         if (pages->num < pages->allocated) {
             return 1;
         }
+    } else {
+        changed = true;
     }
 
     if (multifd_send_pages(f) < 0) {
         return -1;
     }
 
-    if (pages->block != block) {
-        return  multifd_queue_page(f, block, offset);
+    if (changed) {
+        return multifd_queue_page(f, block, offset);
     }
 
     return 1;
-- 
2.25.1

[PATCH 2/2] multifd: Fix flush of zero copy page send request

[Zhenzhong Duan]

Make IO channel flush call after the inflight request has been drained
in multifd thread, or else we may missed to flush the inflight request.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 migration/multifd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index 36e2139995cf..1e01873128f6 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -618,6 +618,12 @@ int multifd_send_sync_main(QEMUFile *f)
         ram_counters.transferred += p->packet_len;
         qemu_mutex_unlock(&p->mutex);
         qemu_sem_post(&p->sem);
+    }
+    for (i = 0; i < migrate_multifd_channels(); i++) {
+        MultiFDSendParams *p = &multifd_send_state->params[i];
+
+        trace_multifd_send_sync_main_wait(p->id);
+        qemu_sem_wait(&p->sem_sync);
 
         if (flush_zero_copy && p->c) {
             int ret;
@@ -632,12 +638,6 @@ int multifd_send_sync_main(QEMUFile *f)
             }
         }
     }
-    for (i = 0; i < migrate_multifd_channels(); i++) {
-        MultiFDSendParams *p = &multifd_send_state->params[i];
-
-        trace_multifd_send_sync_main_wait(p->id);
-        qemu_sem_wait(&p->sem_sync);
-    }
     trace_multifd_send_sync_main(multifd_send_state->packet_num);
 
     return 0;
-- 
2.25.1

Re: [PATCH 2/2] multifd: Fix flush of zero copy page send request

[Juan Quintela]

Zhenzhong Duan <zhenzhong.duan@intel.com> wrote:
> Make IO channel flush call after the inflight request has been drained
> in multifd thread, or else we may missed to flush the inflight request.
>
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>

Good catch!!!!!

Reviewed-by: Juan Quintela <quintela@redhat.com>

queued the whole series.

Re: [PATCH 1/2] multifd: Fix a race on reading MultiFDPages_t.block

[Juan Quintela]

Zhenzhong Duan <zhenzhong.duan@intel.com> wrote:
> In multifd_queue_page() MultiFDPages_t.block is checked twice.
> Between the two checks, MultiFDPages_t.block may be reset to NULL
> by multifd thread. This lead to the 2nd check always true then a
> redundant page submitted to multifd thread again.
>
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>

Reviewed-by: Juan Quintela <quintela@redhat.com>