[PATCH 0/2] virtio: console: add locking around control out-vq

[PATCH 0/2] virtio: console: add locking around control out-vq

[Amit Shah]

The in-vq operations were protected by a lock, but the out-vq
operations were not.  This caused panics / errors as described in
patch 2.  Fix that.

The first patch renames the existing cvq_lock to c_ivq_lock to match
c_ivq.  The second patch introduces the c_ovq_lock for the c_ovq.

Please apply.  I also believe this is a candidate for stable.


Amit Shah (2):
  virtio: console: rename cvq_lock to c_ivq_lock
  virtio: console: add locking around c_ovq operations

 drivers/char/virtio_console.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

-- 
1.8.1.4

[PATCH 1/2] virtio: console: rename cvq_lock to c_ivq_lock

[Amit Shah]

The cvq_lock was taken for the c_ivq.  Rename the lock to make that
obvious.

We'll also add a lock around the c_ovq in the next commit, so there's no
ambiguity.

Signed-off-by: Amit Shah <amit.shah@redhat.com>
---
 drivers/char/virtio_console.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index e905d5f..7e9bc1d 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -149,7 +149,7 @@ struct ports_device {
 	spinlock_t ports_lock;
 
 	/* To protect the vq operations for the control channel */
-	spinlock_t cvq_lock;
+	spinlock_t c_ivq_lock;
 
 	/* The current config space is stored here */
 	struct virtio_console_config config;
@@ -1709,23 +1709,23 @@ static void control_work_handler(struct work_struct *work)
 	portdev = container_of(work, struct ports_device, control_work);
 	vq = portdev->c_ivq;
 
-	spin_lock(&portdev->cvq_lock);
+	spin_lock(&portdev->c_ivq_lock);
 	while ((buf = virtqueue_get_buf(vq, &len))) {
-		spin_unlock(&portdev->cvq_lock);
+		spin_unlock(&portdev->c_ivq_lock);
 
 		buf->len = len;
 		buf->offset = 0;
 
 		handle_control_message(portdev, buf);
 
-		spin_lock(&portdev->cvq_lock);
+		spin_lock(&portdev->c_ivq_lock);
 		if (add_inbuf(portdev->c_ivq, buf) < 0) {
 			dev_warn(&portdev->vdev->dev,
 				 "Error adding buffer to queue\n");
 			free_buf(buf, false);
 		}
 	}
-	spin_unlock(&portdev->cvq_lock);
+	spin_unlock(&portdev->c_ivq_lock);
 }
 
 static void out_intr(struct virtqueue *vq)
@@ -1986,10 +1986,11 @@ static int virtcons_probe(struct virtio_device *vdev)
 	if (multiport) {
 		unsigned int nr_added_bufs;
 
-		spin_lock_init(&portdev->cvq_lock);
+		spin_lock_init(&portdev->c_ivq_lock);
 		INIT_WORK(&portdev->control_work, &control_work_handler);
 
-		nr_added_bufs = fill_queue(portdev->c_ivq, &portdev->cvq_lock);
+		nr_added_bufs = fill_queue(portdev->c_ivq,
+					   &portdev->c_ivq_lock);
 		if (!nr_added_bufs) {
 			dev_err(&vdev->dev,
 				"Error allocating buffers for control queue\n");
@@ -2140,7 +2141,7 @@ static int virtcons_restore(struct virtio_device *vdev)
 		return ret;
 
 	if (use_multiport(portdev))
-		fill_queue(portdev->c_ivq, &portdev->cvq_lock);
+		fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
 
 	list_for_each_entry(port, &portdev->ports, list) {
 		port->in_vq = portdev->in_vqs[port->id];
-- 
1.8.1.4

[PATCH 2/2] virtio: console: add locking around c_ovq operations

[Amit Shah]

When multiple ovq operations are being performed (lots of open/close
operations on virtio_console fds), the __send_control_msg() function can
get confused without locking.

A simple recipe to cause badness is:
* create a QEMU VM with two virtio-serial ports
* in the guest, do
  while true;do echo abc >/dev/vport0p1;done
  while true;do echo edf >/dev/vport0p2;done

In one run, this caused a panic in __send_control_msg().  In another, I
got

   virtio_console virtio0: control-o:id 0 is not a head!

This also results repeated messages similar to these on the host:

  qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
  qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0

Reported-by: FuXiangChun <xfu@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
---
 drivers/char/virtio_console.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 7e9bc1d..410866c 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -150,6 +150,7 @@ struct ports_device {
 
 	/* To protect the vq operations for the control channel */
 	spinlock_t c_ivq_lock;
+	spinlock_t c_ovq_lock;
 
 	/* The current config space is stored here */
 	struct virtio_console_config config;
@@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
 	vq = portdev->c_ovq;
 
 	sg_init_one(sg, &cpkt, sizeof(cpkt));
+
+	spin_lock_irq(&portdev->c_ovq_lock);
 	if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
 		virtqueue_kick(vq);
 		while (!virtqueue_get_buf(vq, &len))
 			cpu_relax();
 	}
+	spin_unlock_irq(&portdev->c_ovq_lock);
 	return 0;
 }
 
@@ -1987,6 +1991,7 @@ static int virtcons_probe(struct virtio_device *vdev)
 		unsigned int nr_added_bufs;
 
 		spin_lock_init(&portdev->c_ivq_lock);
+		spin_lock_init(&portdev->c_ovq_lock);
 		INIT_WORK(&portdev->control_work, &control_work_handler);
 
 		nr_added_bufs = fill_queue(portdev->c_ivq,
-- 
1.8.1.4

Re: [PATCH 2/2] virtio: console: add locking around c_ovq operations

[Asias He]

On Thu, Mar 28, 2013 at 04:58:33PM +0530, Amit Shah wrote:
> When multiple ovq operations are being performed (lots of open/close
> operations on virtio_console fds), the __send_control_msg() function can
> get confused without locking.
> 
> A simple recipe to cause badness is:
> * create a QEMU VM with two virtio-serial ports
> * in the guest, do
>   while true;do echo abc >/dev/vport0p1;done
>   while true;do echo edf >/dev/vport0p2;done
> 
> In one run, this caused a panic in __send_control_msg().  In another, I
> got
> 
>    virtio_console virtio0: control-o:id 0 is not a head!
> 
> This also results repeated messages similar to these on the host:
> 
>   qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
>   qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0
> 
> Reported-by: FuXiangChun <xfu@redhat.com>
> Signed-off-by: Amit Shah <amit.shah@redhat.com>

So, probably this will not apply on virtio-next because of the
virtqueue_add_outbuf change.

Anyway,  Reviewed-by: Asias He <asias@redhat.com>

> ---
>  drivers/char/virtio_console.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index 7e9bc1d..410866c 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -150,6 +150,7 @@ struct ports_device {
>  
>  	/* To protect the vq operations for the control channel */
>  	spinlock_t c_ivq_lock;
> +	spinlock_t c_ovq_lock;
>  
>  	/* The current config space is stored here */
>  	struct virtio_console_config config;
> @@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
>  	vq = portdev->c_ovq;
>  
>  	sg_init_one(sg, &cpkt, sizeof(cpkt));
> +
> +	spin_lock_irq(&portdev->c_ovq_lock);
>  	if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
>  		virtqueue_kick(vq);
>  		while (!virtqueue_get_buf(vq, &len))
>  			cpu_relax();
>  	}
> +	spin_unlock_irq(&portdev->c_ovq_lock);
>  	return 0;
>  }
>  
> @@ -1987,6 +1991,7 @@ static int virtcons_probe(struct virtio_device *vdev)
>  		unsigned int nr_added_bufs;
>  
>  		spin_lock_init(&portdev->c_ivq_lock);
> +		spin_lock_init(&portdev->c_ovq_lock);
>  		INIT_WORK(&portdev->control_work, &control_work_handler);
>  
>  		nr_added_bufs = fill_queue(portdev->c_ivq,
> -- 
> 1.8.1.4
> 
> _______________________________________________
> Virtualization mailing list
> Virtualization@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/virtualization

-- 
Asias

Re: [PATCH 1/2] virtio: console: rename cvq_lock to c_ivq_lock

[Asias He]

On Thu, Mar 28, 2013 at 04:58:32PM +0530, Amit Shah wrote:
> The cvq_lock was taken for the c_ivq.  Rename the lock to make that
> obvious.
> 
> We'll also add a lock around the c_ovq in the next commit, so there's no
> ambiguity.
> 
> Signed-off-by: Amit Shah <amit.shah@redhat.com>

Reviewed-by: Asias He <asias@redhat.com>

> ---
>  drivers/char/virtio_console.c | 17 +++++++++--------
>  1 file changed, 9 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index e905d5f..7e9bc1d 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -149,7 +149,7 @@ struct ports_device {
>  	spinlock_t ports_lock;
>  
>  	/* To protect the vq operations for the control channel */
> -	spinlock_t cvq_lock;
> +	spinlock_t c_ivq_lock;
>  
>  	/* The current config space is stored here */
>  	struct virtio_console_config config;
> @@ -1709,23 +1709,23 @@ static void control_work_handler(struct work_struct *work)
>  	portdev = container_of(work, struct ports_device, control_work);
>  	vq = portdev->c_ivq;
>  
> -	spin_lock(&portdev->cvq_lock);
> +	spin_lock(&portdev->c_ivq_lock);
>  	while ((buf = virtqueue_get_buf(vq, &len))) {
> -		spin_unlock(&portdev->cvq_lock);
> +		spin_unlock(&portdev->c_ivq_lock);
>  
>  		buf->len = len;
>  		buf->offset = 0;
>  
>  		handle_control_message(portdev, buf);
>  
> -		spin_lock(&portdev->cvq_lock);
> +		spin_lock(&portdev->c_ivq_lock);
>  		if (add_inbuf(portdev->c_ivq, buf) < 0) {
>  			dev_warn(&portdev->vdev->dev,
>  				 "Error adding buffer to queue\n");
>  			free_buf(buf, false);
>  		}
>  	}
> -	spin_unlock(&portdev->cvq_lock);
> +	spin_unlock(&portdev->c_ivq_lock);
>  }
>  
>  static void out_intr(struct virtqueue *vq)
> @@ -1986,10 +1986,11 @@ static int virtcons_probe(struct virtio_device *vdev)
>  	if (multiport) {
>  		unsigned int nr_added_bufs;
>  
> -		spin_lock_init(&portdev->cvq_lock);
> +		spin_lock_init(&portdev->c_ivq_lock);
>  		INIT_WORK(&portdev->control_work, &control_work_handler);
>  
> -		nr_added_bufs = fill_queue(portdev->c_ivq, &portdev->cvq_lock);
> +		nr_added_bufs = fill_queue(portdev->c_ivq,
> +					   &portdev->c_ivq_lock);
>  		if (!nr_added_bufs) {
>  			dev_err(&vdev->dev,
>  				"Error allocating buffers for control queue\n");
> @@ -2140,7 +2141,7 @@ static int virtcons_restore(struct virtio_device *vdev)
>  		return ret;
>  
>  	if (use_multiport(portdev))
> -		fill_queue(portdev->c_ivq, &portdev->cvq_lock);
> +		fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
>  
>  	list_for_each_entry(port, &portdev->ports, list) {
>  		port->in_vq = portdev->in_vqs[port->id];
> -- 
> 1.8.1.4
> 
> _______________________________________________
> Virtualization mailing list
> Virtualization@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/virtualization

-- 
Asias

Re: [PATCH 0/2] virtio: console: add locking around control out-vq

[Asias He]

On Thu, Mar 28, 2013 at 04:58:31PM +0530, Amit Shah wrote:
> The in-vq operations were protected by a lock, but the out-vq
> operations were not.  This caused panics / errors as described in
> patch 2.  Fix that.

BTW, this looks suspicious. Why no lock here?

   static void remove_controlq_data(struct ports_device *portdev)
   {
           struct port_buffer *buf;
           unsigned int len;
   
           if (!use_multiport(portdev))
                   return;
   
           while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
                   free_buf(buf, true);
   
           while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
                   free_buf(buf, true);
   }




> The first patch renames the existing cvq_lock to c_ivq_lock to match
> c_ivq.  The second patch introduces the c_ovq_lock for the c_ovq.
> 
> Please apply.  I also believe this is a candidate for stable.
> 
> 
> Amit Shah (2):
>   virtio: console: rename cvq_lock to c_ivq_lock
>   virtio: console: add locking around c_ovq operations
> 
>  drivers/char/virtio_console.c | 22 ++++++++++++++--------
>  1 file changed, 14 insertions(+), 8 deletions(-)
> 
> -- 
> 1.8.1.4
> 
> _______________________________________________
> Virtualization mailing list
> Virtualization@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/virtualization

-- 
Asias

Re: [PATCH 1/2] virtio: console: rename cvq_lock to c_ivq_lock

[Wanlong Gao]

On 03/28/2013 07:28 PM, Amit Shah wrote:
> The cvq_lock was taken for the c_ivq.  Rename the lock to make that
> obvious.
> 
> We'll also add a lock around the c_ovq in the next commit, so there's no
> ambiguity.
> 
> Signed-off-by: Amit Shah <amit.shah@redhat.com>

Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com>

> ---
>  drivers/char/virtio_console.c | 17 +++++++++--------
>  1 file changed, 9 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index e905d5f..7e9bc1d 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -149,7 +149,7 @@ struct ports_device {
>  	spinlock_t ports_lock;
>  
>  	/* To protect the vq operations for the control channel */
> -	spinlock_t cvq_lock;
> +	spinlock_t c_ivq_lock;
>  
>  	/* The current config space is stored here */
>  	struct virtio_console_config config;
> @@ -1709,23 +1709,23 @@ static void control_work_handler(struct work_struct *work)
>  	portdev = container_of(work, struct ports_device, control_work);
>  	vq = portdev->c_ivq;
>  
> -	spin_lock(&portdev->cvq_lock);
> +	spin_lock(&portdev->c_ivq_lock);
>  	while ((buf = virtqueue_get_buf(vq, &len))) {
> -		spin_unlock(&portdev->cvq_lock);
> +		spin_unlock(&portdev->c_ivq_lock);
>  
>  		buf->len = len;
>  		buf->offset = 0;
>  
>  		handle_control_message(portdev, buf);
>  
> -		spin_lock(&portdev->cvq_lock);
> +		spin_lock(&portdev->c_ivq_lock);
>  		if (add_inbuf(portdev->c_ivq, buf) < 0) {
>  			dev_warn(&portdev->vdev->dev,
>  				 "Error adding buffer to queue\n");
>  			free_buf(buf, false);
>  		}
>  	}
> -	spin_unlock(&portdev->cvq_lock);
> +	spin_unlock(&portdev->c_ivq_lock);
>  }
>  
>  static void out_intr(struct virtqueue *vq)
> @@ -1986,10 +1986,11 @@ static int virtcons_probe(struct virtio_device *vdev)
>  	if (multiport) {
>  		unsigned int nr_added_bufs;
>  
> -		spin_lock_init(&portdev->cvq_lock);
> +		spin_lock_init(&portdev->c_ivq_lock);
>  		INIT_WORK(&portdev->control_work, &control_work_handler);
>  
> -		nr_added_bufs = fill_queue(portdev->c_ivq, &portdev->cvq_lock);
> +		nr_added_bufs = fill_queue(portdev->c_ivq,
> +					   &portdev->c_ivq_lock);
>  		if (!nr_added_bufs) {
>  			dev_err(&vdev->dev,
>  				"Error allocating buffers for control queue\n");
> @@ -2140,7 +2141,7 @@ static int virtcons_restore(struct virtio_device *vdev)
>  		return ret;
>  
>  	if (use_multiport(portdev))
> -		fill_queue(portdev->c_ivq, &portdev->cvq_lock);
> +		fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
>  
>  	list_for_each_entry(port, &portdev->ports, list) {
>  		port->in_vq = portdev->in_vqs[port->id];
> 

Re: [PATCH 2/2] virtio: console: add locking around c_ovq operations

[Wanlong Gao]

On 03/28/2013 07:28 PM, Amit Shah wrote:
> When multiple ovq operations are being performed (lots of open/close
> operations on virtio_console fds), the __send_control_msg() function can
> get confused without locking.
> 
> A simple recipe to cause badness is:
> * create a QEMU VM with two virtio-serial ports
> * in the guest, do
>   while true;do echo abc >/dev/vport0p1;done
>   while true;do echo edf >/dev/vport0p2;done
> 
> In one run, this caused a panic in __send_control_msg().  In another, I
> got
> 
>    virtio_console virtio0: control-o:id 0 is not a head!
> 
> This also results repeated messages similar to these on the host:
> 
>   qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
>   qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0
> 
> Reported-by: FuXiangChun <xfu@redhat.com>
> Signed-off-by: Amit Shah <amit.shah@redhat.com>
> ---
>  drivers/char/virtio_console.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index 7e9bc1d..410866c 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -150,6 +150,7 @@ struct ports_device {
>  
>  	/* To protect the vq operations for the control channel */
>  	spinlock_t c_ivq_lock;
> +	spinlock_t c_ovq_lock;
>  
>  	/* The current config space is stored here */
>  	struct virtio_console_config config;
> @@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
>  	vq = portdev->c_ovq;
>  
>  	sg_init_one(sg, &cpkt, sizeof(cpkt));
> +
> +	spin_lock_irq(&portdev->c_ovq_lock);
>  	if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
>  		virtqueue_kick(vq);
>  		while (!virtqueue_get_buf(vq, &len))
>  			cpu_relax();
>  	}
> +	spin_unlock_irq(&portdev->c_ovq_lock);

While you lock the irq, why don't we need to save and restore the irq flags here?

Thanks,
Wanlong Gao

>  	return 0;
>  }
>  
> @@ -1987,6 +1991,7 @@ static int virtcons_probe(struct virtio_device *vdev)
>  		unsigned int nr_added_bufs;
>  
>  		spin_lock_init(&portdev->c_ivq_lock);
> +		spin_lock_init(&portdev->c_ovq_lock);
>  		INIT_WORK(&portdev->control_work, &control_work_handler);
>  
>  		nr_added_bufs = fill_queue(portdev->c_ivq,
> 

Re: [PATCH 0/2] virtio: console: add locking around control out-vq

[Amit Shah]

On (Fri) 29 Mar 2013 [08:38:49], Asias He wrote:
> On Thu, Mar 28, 2013 at 04:58:31PM +0530, Amit Shah wrote:
> > The in-vq operations were protected by a lock, but the out-vq
> > operations were not.  This caused panics / errors as described in
> > patch 2.  Fix that.
> 
> BTW, this looks suspicious. Why no lock here?
> 
>    static void remove_controlq_data(struct ports_device *portdev)
>    {
>            struct port_buffer *buf;
>            unsigned int len;
>    
>            if (!use_multiport(portdev))
>                    return;
>    
>            while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
>                    free_buf(buf, true);
>    
>            while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
>                    free_buf(buf, true);
>    }

Since this is c_ivq, you mean why can't the host be queueing up data
in the vq while we're removing the buffers from the vq.

This function is called from two places, virtcons_remove() and
virtcons_freeze(). In both the cases, everything is set up so the host
can't send anything: vdev->config->reset() ensures that.

Is there something else that can be happening?

		Amit

Re: [PATCH 2/2] virtio: console: add locking around c_ovq operations

[Amit Shah]

On (Fri) 29 Mar 2013 [08:57:44], Wanlong Gao wrote:
> On 03/28/2013 07:28 PM, Amit Shah wrote:
> > When multiple ovq operations are being performed (lots of open/close
> > operations on virtio_console fds), the __send_control_msg() function can
> > get confused without locking.
> > 
> > A simple recipe to cause badness is:
> > * create a QEMU VM with two virtio-serial ports
> > * in the guest, do
> >   while true;do echo abc >/dev/vport0p1;done
> >   while true;do echo edf >/dev/vport0p2;done
> > 
> > In one run, this caused a panic in __send_control_msg().  In another, I
> > got
> > 
> >    virtio_console virtio0: control-o:id 0 is not a head!
> > 
> > This also results repeated messages similar to these on the host:
> > 
> >   qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
> >   qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0
> > 
> > Reported-by: FuXiangChun <xfu@redhat.com>
> > Signed-off-by: Amit Shah <amit.shah@redhat.com>
> > ---
> >  drivers/char/virtio_console.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> > 
> > diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> > index 7e9bc1d..410866c 100644
> > --- a/drivers/char/virtio_console.c
> > +++ b/drivers/char/virtio_console.c
> > @@ -150,6 +150,7 @@ struct ports_device {
> >  
> >  	/* To protect the vq operations for the control channel */
> >  	spinlock_t c_ivq_lock;
> > +	spinlock_t c_ovq_lock;
> >  
> >  	/* The current config space is stored here */
> >  	struct virtio_console_config config;
> > @@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
> >  	vq = portdev->c_ovq;
> >  
> >  	sg_init_one(sg, &cpkt, sizeof(cpkt));
> > +
> > +	spin_lock_irq(&portdev->c_ovq_lock);
> >  	if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
> >  		virtqueue_kick(vq);
> >  		while (!virtqueue_get_buf(vq, &len))
> >  			cpu_relax();
> >  	}
> > +	spin_unlock_irq(&portdev->c_ovq_lock);
> 
> While you lock the irq, why don't we need to save and restore the irq flags here?

_irq isn't actually needed; I'll send a v2 with just spin_lock/unlock.

Thanks,

		Amit

Re: [PATCH 2/2] virtio: console: add locking around c_ovq operations

[Amit Shah]

On (Fri) 29 Mar 2013 [08:29:01], Asias He wrote:
> On Thu, Mar 28, 2013 at 04:58:33PM +0530, Amit Shah wrote:
> > When multiple ovq operations are being performed (lots of open/close
> > operations on virtio_console fds), the __send_control_msg() function can
> > get confused without locking.
> > 
> > A simple recipe to cause badness is:
> > * create a QEMU VM with two virtio-serial ports
> > * in the guest, do
> >   while true;do echo abc >/dev/vport0p1;done
> >   while true;do echo edf >/dev/vport0p2;done
> > 
> > In one run, this caused a panic in __send_control_msg().  In another, I
> > got
> > 
> >    virtio_console virtio0: control-o:id 0 is not a head!
> > 
> > This also results repeated messages similar to these on the host:
> > 
> >   qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
> >   qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0
> > 
> > Reported-by: FuXiangChun <xfu@redhat.com>
> > Signed-off-by: Amit Shah <amit.shah@redhat.com>
> 
> So, probably this will not apply on virtio-next because of the
> virtqueue_add_outbuf change.

Yes, one-line context change.

> Anyway,  Reviewed-by: Asias He <asias@redhat.com>

Thanks!

		Amit

Re: [PATCH 0/2] virtio: console: add locking around control out-vq

[Asias He]

On Fri, Mar 29, 2013 at 04:05:00PM +0530, Amit Shah wrote:
> On (Fri) 29 Mar 2013 [08:38:49], Asias He wrote:
> > On Thu, Mar 28, 2013 at 04:58:31PM +0530, Amit Shah wrote:
> > > The in-vq operations were protected by a lock, but the out-vq
> > > operations were not.  This caused panics / errors as described in
> > > patch 2.  Fix that.
> > 
> > BTW, this looks suspicious. Why no lock here?
> > 
> >    static void remove_controlq_data(struct ports_device *portdev)
> >    {
> >            struct port_buffer *buf;
> >            unsigned int len;
> >    
> >            if (!use_multiport(portdev))
> >                    return;
> >    
> >            while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
> >                    free_buf(buf, true);
> >    
> >            while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
> >                    free_buf(buf, true);
> >    }
> 
> Since this is c_ivq, you mean why can't the host be queueing up data
> in the vq while we're removing the buffers from the vq.
> 
> This function is called from two places, virtcons_remove() and
> virtcons_freeze(). In both the cases, everything is set up so the host
> can't send anything: vdev->config->reset() ensures that.
> 
> Is there something else that can be happening?

OK, this makes sense to me now. Thanks.  

> 		Amit

-- 
Asias