[PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[Stefan Hajnoczi]

scsi_device_purge_requests() is called from I/O code by virtio-scsi TMF
emulation code. It must not call Global State APIs like blk_drain()
because that results in an assertion failure.

blk_drain() is a Global State API because it uses bdrv_unref(). Actually
ref/unref is unnecessary in device emulation code because the drive=
qdev property holds the reference.

Introduce blk_drain_noref(), a variant of blk_drain() that is
IO_OR_GS_CODE() and doesn't take a reference to the BlockBackend.

This fixes the following virtio-scsi IOThread assertion failure when
hot-plugging scsi-hd devices:

  qemu-kvm: ../block/block-backend.c:1780: void blk_drain(BlockBackend *): Assertion `qemu_in_main_thread()' failed.

  #0  0x00007f4b6a0a154c __pthread_kill_implementation (libc.so.6>
  #1  0x00007f4b6a054d46 raise (libc.so.6 + 0x54d46)
  #2  0x00007f4b6a0287f3 abort (libc.so.6 + 0x287f3)
  #3  0x00007f4b6a02871b __assert_fail_base.cold (libc.so.6 + 0x2>
  #4  0x00007f4b6a04dce6 __assert_fail (libc.so.6 + 0x4dce6)
  #5  0x000055c811253ac0 blk_drain (qemu-kvm + 0x808ac0)
  #6  0x000055c810ecb951 scsi_device_purge_requests (qemu-kvm + 0>
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^
  #7  0x000055c810ed6ab8 scsi_disk_reset (qemu-kvm + 0x48bab8)
  #8  0x000055c8111dc908 resettable_phase_hold (qemu-kvm + 0x7919>
  #9  0x000055c8111db7f0 device_cold_reset (qemu-kvm + 0x7907f0)
  #10 0x000055c8110bb1a6 virtio_scsi_handle_ctrl (qemu-kvm + 0x67>
  #11 0x000055c8110d458f virtio_queue_host_notifier_read (qemu-kv>
  #12 0x000055c811404a73 aio_dispatch_handler (qemu-kvm + 0x9b9a7>
  #13 0x000055c811405743 aio_poll (qemu-kvm + 0x9ba743)
  #14 0x000055c81121d532 iothread_run (qemu-kvm + 0x7d2532)
  #15 0x000055c81140926a qemu_thread_start (qemu-kvm + 0x9be26a)
  #16 0x00007f4b6a09f802 start_thread (libc.so.6 + 0x9f802)
  #17 0x00007f4b6a03f450 __clone3 (libc.so.6 + 0x3f450)

Reported-by: Qing Wang <qinwang@redhat.com>
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2155748
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/sysemu/block-backend-io.h |  1 +
 block/block-backend.c             | 23 +++++++++++++++++++++++
 hw/scsi/scsi-bus.c                |  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/include/sysemu/block-backend-io.h b/include/sysemu/block-backend-io.h
index 7ec6d978d4..f73db1f77c 100644
--- a/include/sysemu/block-backend-io.h
+++ b/include/sysemu/block-backend-io.h
@@ -73,6 +73,7 @@ void blk_iostatus_set_err(BlockBackend *blk, int error);
 int blk_get_max_iov(BlockBackend *blk);
 int blk_get_max_hw_iov(BlockBackend *blk);
 
+void blk_drain_noref(BlockBackend *blk);
 void blk_io_plug(BlockBackend *blk);
 void blk_io_unplug(BlockBackend *blk);
 AioContext *blk_get_aio_context(BlockBackend *blk);
diff --git a/block/block-backend.c b/block/block-backend.c
index ba7bf1d6bc..20914bae7b 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -1815,6 +1815,29 @@ void blk_drain(BlockBackend *blk)
     }
 }
 
+/*
+ * Same as blk_drain() but the caller must hold a reference to blk. May be
+ * called from Global State or I/O API code. Device emulation can call this
+ * because the qdev drive= property holds the reference.
+ */
+void blk_drain_noref(BlockBackend *blk)
+{
+    BlockDriverState *bs = blk_bs(blk);
+    IO_OR_GS_CODE();
+
+    if (bs) {
+        bdrv_drained_begin(bs);
+    }
+
+    /* We may have -ENOMEDIUM completions in flight */
+    AIO_WAIT_WHILE(blk_get_aio_context(blk),
+                   qatomic_mb_read(&blk->in_flight) > 0);
+
+    if (bs) {
+        bdrv_drained_end(bs);
+    }
+}
+
 void blk_drain_all(void)
 {
     BlockBackend *blk = NULL;
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index ceceafb2cd..110fd85106 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -1663,7 +1663,7 @@ void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
         req = QTAILQ_FIRST(&sdev->requests);
         scsi_req_cancel_async(req, NULL);
     }
-    blk_drain(sdev->conf.blk);
+    blk_drain_noref(sdev->conf.blk);
     aio_context_release(blk_get_aio_context(sdev->conf.blk));
     scsi_device_set_ua(sdev, sense);
 }
-- 
2.39.0

Re: [PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[Paolo Bonzini]

[-- Attachment #1: Type: text/plain, Size: 4907 bytes --]

blk_root_drained_end is not thread-safe too. I started looking at that with
https://www.mail-archive.com/qemu-devel@nongnu.org/msg925670.html; that's
certainly a prerequisite for this patch to be a full fix, but I have not
checked if it's enough because I don't have the QEMU sources at hand right
now.

Paolo

Il mer 4 gen 2023, 20:56 Stefan Hajnoczi <stefanha@redhat.com> ha scritto:

> scsi_device_purge_requests() is called from I/O code by virtio-scsi TMF
> emulation code. It must not call Global State APIs like blk_drain()
> because that results in an assertion failure.
>
> blk_drain() is a Global State API because it uses bdrv_unref(). Actually
> ref/unref is unnecessary in device emulation code because the drive=
> qdev property holds the reference.
>
> Introduce blk_drain_noref(), a variant of blk_drain() that is
> IO_OR_GS_CODE() and doesn't take a reference to the BlockBackend.
>
> This fixes the following virtio-scsi IOThread assertion failure when
> hot-plugging scsi-hd devices:
>
>   qemu-kvm: ../block/block-backend.c:1780: void blk_drain(BlockBackend *):
> Assertion `qemu_in_main_thread()' failed.
>
>   #0  0x00007f4b6a0a154c __pthread_kill_implementation (libc.so.6>
>   #1  0x00007f4b6a054d46 raise (libc.so.6 + 0x54d46)
>   #2  0x00007f4b6a0287f3 abort (libc.so.6 + 0x287f3)
>   #3  0x00007f4b6a02871b __assert_fail_base.cold (libc.so.6 + 0x2>
>   #4  0x00007f4b6a04dce6 __assert_fail (libc.so.6 + 0x4dce6)
>   #5  0x000055c811253ac0 blk_drain (qemu-kvm + 0x808ac0)
>   #6  0x000055c810ecb951 scsi_device_purge_requests (qemu-kvm + 0>
>                          ^^^^^^^^^^^^^^^^^^^^^^^^^^
>   #7  0x000055c810ed6ab8 scsi_disk_reset (qemu-kvm + 0x48bab8)
>   #8  0x000055c8111dc908 resettable_phase_hold (qemu-kvm + 0x7919>
>   #9  0x000055c8111db7f0 device_cold_reset (qemu-kvm + 0x7907f0)
>   #10 0x000055c8110bb1a6 virtio_scsi_handle_ctrl (qemu-kvm + 0x67>
>   #11 0x000055c8110d458f virtio_queue_host_notifier_read (qemu-kv>
>   #12 0x000055c811404a73 aio_dispatch_handler (qemu-kvm + 0x9b9a7>
>   #13 0x000055c811405743 aio_poll (qemu-kvm + 0x9ba743)
>   #14 0x000055c81121d532 iothread_run (qemu-kvm + 0x7d2532)
>   #15 0x000055c81140926a qemu_thread_start (qemu-kvm + 0x9be26a)
>   #16 0x00007f4b6a09f802 start_thread (libc.so.6 + 0x9f802)
>   #17 0x00007f4b6a03f450 __clone3 (libc.so.6 + 0x3f450)
>
> Reported-by: Qing Wang <qinwang@redhat.com>
> Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2155748
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Cc: Emanuele Giuseppe Esposito <eesposit@redhat.com>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  include/sysemu/block-backend-io.h |  1 +
>  block/block-backend.c             | 23 +++++++++++++++++++++++
>  hw/scsi/scsi-bus.c                |  2 +-
>  3 files changed, 25 insertions(+), 1 deletion(-)
>
> diff --git a/include/sysemu/block-backend-io.h
> b/include/sysemu/block-backend-io.h
> index 7ec6d978d4..f73db1f77c 100644
> --- a/include/sysemu/block-backend-io.h
> +++ b/include/sysemu/block-backend-io.h
> @@ -73,6 +73,7 @@ void blk_iostatus_set_err(BlockBackend *blk, int error);
>  int blk_get_max_iov(BlockBackend *blk);
>  int blk_get_max_hw_iov(BlockBackend *blk);
>
> +void blk_drain_noref(BlockBackend *blk);
>  void blk_io_plug(BlockBackend *blk);
>  void blk_io_unplug(BlockBackend *blk);
>  AioContext *blk_get_aio_context(BlockBackend *blk);
> diff --git a/block/block-backend.c b/block/block-backend.c
> index ba7bf1d6bc..20914bae7b 100644
> --- a/block/block-backend.c
> +++ b/block/block-backend.c
> @@ -1815,6 +1815,29 @@ void blk_drain(BlockBackend *blk)
>      }
>  }
>
> +/*
> + * Same as blk_drain() but the caller must hold a reference to blk. May be
> + * called from Global State or I/O API code. Device emulation can call
> this
> + * because the qdev drive= property holds the reference.
> + */
> +void blk_drain_noref(BlockBackend *blk)
> +{
> +    BlockDriverState *bs = blk_bs(blk);
> +    IO_OR_GS_CODE();
> +
> +    if (bs) {
> +        bdrv_drained_begin(bs);
> +    }
> +
> +    /* We may have -ENOMEDIUM completions in flight */
> +    AIO_WAIT_WHILE(blk_get_aio_context(blk),
> +                   qatomic_mb_read(&blk->in_flight) > 0);
> +
> +    if (bs) {
> +        bdrv_drained_end(bs);
> +    }
> +}
> +
>  void blk_drain_all(void)
>  {
>      BlockBackend *blk = NULL;
> diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
> index ceceafb2cd..110fd85106 100644
> --- a/hw/scsi/scsi-bus.c
> +++ b/hw/scsi/scsi-bus.c
> @@ -1663,7 +1663,7 @@ void scsi_device_purge_requests(SCSIDevice *sdev,
> SCSISense sense)
>          req = QTAILQ_FIRST(&sdev->requests);
>          scsi_req_cancel_async(req, NULL);
>      }
> -    blk_drain(sdev->conf.blk);
> +    blk_drain_noref(sdev->conf.blk);
>      aio_context_release(blk_get_aio_context(sdev->conf.blk));
>      scsi_device_set_ua(sdev, sense);
>  }
> --
> 2.39.0
>
>

[-- Attachment #2: Type: text/html, Size: 6461 bytes --]

Re: [PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 532 bytes --]

On Wed, Jan 04, 2023 at 10:37:34PM +0100, Paolo Bonzini wrote:
> blk_root_drained_end is not thread-safe too. I started looking at that with
> https://www.mail-archive.com/qemu-devel@nongnu.org/msg925670.html; that's
> certainly a prerequisite for this patch to be a full fix, but I have not
> checked if it's enough because I don't have the QEMU sources at hand right
> now.

Thanks for letting me know.

Do you think blk_drain_noref() makes sense at all, or should
scsi_purge_requests() avoid calling blk_drain() somehow?

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[Paolo Bonzini]

[-- Attachment #1: Type: text/plain, Size: 961 bytes --]

Il gio 5 gen 2023, 12:35 Stefan Hajnoczi <stefanha@redhat.com> ha scritto:

> On Wed, Jan 04, 2023 at 10:37:34PM +0100, Paolo Bonzini wrote:
> > blk_root_drained_end is not thread-safe too. I started looking at that
> with
> > https://www.mail-archive.com/qemu-devel@nongnu.org/msg925670.html;
> that's
> > certainly a prerequisite for this patch to be a full fix, but I have not
> > checked if it's enough because I don't have the QEMU sources at hand
> right
> > now.
>
> Thanks for letting me know.
>
> Do you think blk_drain_noref() makes sense at all, or should
> scsi_purge_requests() avoid calling blk_drain() somehow?
>

I think it makes sense as a stop gap measure.

Perhaps these iothread unrefs could also be changed to happen in a
main-loop BH, but I wouldn't rush that. Unref is also the main culprit for
functions that end up calling aio_poll from coroutine context (which should
be prohibited!) and Kevin was looking at that.

Paolo


> Stefan
>

[-- Attachment #2: Type: text/html, Size: 1758 bytes --]

Re: [PATCH] block-backend: fix virtio-scsi assertion failure with blk_drain_noref()

[Kevin Wolf]

Am 04.01.2023 um 20:56 hat Stefan Hajnoczi geschrieben:
> scsi_device_purge_requests() is called from I/O code by virtio-scsi TMF
> emulation code. It must not call Global State APIs like blk_drain()
> because that results in an assertion failure.
> 
> blk_drain() is a Global State API because it uses bdrv_unref(). Actually
> ref/unref is unnecessary in device emulation code because the drive=
> qdev property holds the reference.

Just for the record: We came to the conclusion that this isn't true.

We're not doing blk_ref/unref here, but bdrv_ref/unref. The function
calls bdrv_drained_end(bs), so the node must still exist at that point
and the ref/unref is required to ensure this.

The root node of the BlockBackend can change, so without the ref/unref
pair the last reference to the node can go away even if the BlockBackend
still exists.

So we'll need a different solution.

Kevin