v3:
- Fix s/see/sees/ typo in Patch 2 commit description [Eric]
- Add call stack to Patch 3 commit description to make it clear how blk_drain()
is invoked [Kevin]
Unplugging SCSIDevices when virtio-scsi is using an IOThread suffers from race
conditions:
- scsi_device_purge_requests() is called from the IOThread in TMF emulation.
This is unsafe, it should only be called from the BQL.
- SCSIRequest->aiocb is not protected by a lock, so there are races between the
main loop thread and the IOThread when scsi_device_purge_requests() runs in
the main loop thread.
- DMAAIOCB->acb is not protected by a lock, so there are races in the DMA
helpers code when cancelling a request from the main loop thread.
These fixes solve assertion failures during SCSIDevice hot unplug in
virtio-scsi with IOThread. Expanding the use of the AioContext lock isn't great
since we're in the midst of trying to remove it. However, I think this solution
is appropriate so that stable trees or distros can backport the fix without
depending on QEMU multi-queue block layer refactoring.
Special thanks to Qing Wang, who helped me iterate these patches because I
couldn't reproduce the assertion failures myself.
Stefan Hajnoczi (3):
scsi: protect req->aiocb with AioContext lock
dma-helpers: prevent dma_blk_cb() vs dma_aio_cancel() race
virtio-scsi: reset SCSI devices from main loop thread
include/hw/virtio/virtio-scsi.h | 11 ++-
hw/scsi/scsi-disk.c | 23 +++--
hw/scsi/scsi-generic.c | 11 ++-
hw/scsi/virtio-scsi.c | 169 +++++++++++++++++++++++++-------
softmmu/dma-helpers.c | 12 ++-
5 files changed, 171 insertions(+), 55 deletions(-)
--
2.39.1