On Fri, 2020-09-25 at 13:26 -0400, Paolo Bonzini wrote:
> From: Maxim Levitsky <mlevi...@redhat.com>
>
> The device core first places a device on the bus and then realizes it.
> Make scsi_device_find avoid returing such devices to avoid
> races in drivers that use an iothread (currently virtio-scsi)
>
> Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1812399
>
> Suggested-by: Paolo Bonzini <pbonz...@redhat.com>
> Signed-off-by: Maxim Levitsky <mlevi...@redhat.com>
> Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
> Message-Id: <20200913160259.32145-7-mlevi...@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
> ---
> hw/scsi/scsi-bus.c | 83 +++++++++++++++++++++++++++++-----------------
> 1 file changed, 53 insertions(+), 30 deletions(-)
>
> diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
> index 4ab9811cd8..7599113efe 100644
> --- a/hw/scsi/scsi-bus.c
> +++ b/hw/scsi/scsi-bus.c
> @@ -24,6 +24,55 @@ static void scsi_target_free_buf(SCSIRequest *req);
>
> static int next_scsi_bus;
>
> +static SCSIDevice *do_scsi_device_find(SCSIBus *bus,
> + int channel, int id, int lun,
> + bool include_unrealized)
> +{
> + BusChild *kid;
> + SCSIDevice *retval = NULL;
> +
> + QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) {
> + DeviceState *qdev = kid->child;
> + SCSIDevice *dev = SCSI_DEVICE(qdev);
> +
> + if (dev->channel == channel && dev->id == id) {
> + if (dev->lun == lun) {
> + retval = dev;
> + break;
Indeed, here no need to use goto, I probably removed some code that needed it
before or just forgot about.
> + }
> +
> + /*
> + * If we don't find exact match (channel/bus/lun),
> + * we will return the first device which matches channel/bus
> + */
> +
> + if (!retval) {
> + retval = dev;
> + }
> + }
> + }
> +
> + /*
> + * This function might run on the IO thread and we might race against
> + * main thread hot-plugging the device.
> + * We assume that as soon as .realized is set to true we can let
> + * the user access the device.
> + */
> +
> + if (retval && !include_unrealized &&
> + !qatomic_load_acquire(&retval->qdev.realized)) {
> + retval = NULL;
> + }
> +
> + return retval;
> +}
I guess you dropped the RCU locking here since you want the callers
of this function to do it. I think it makes lot of sense.
> +
> +SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
> +{
> + RCU_READ_LOCK_GUARD();
> + return do_scsi_device_find(bus, channel, id, lun, false);
> +}
> +
> static void scsi_device_realize(SCSIDevice *s, Error **errp)
> {
> SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
> @@ -137,7 +186,10 @@ static bool scsi_bus_is_address_free(SCSIBus *bus,
> int channel, int target, int lun,
> SCSIDevice **p_dev)
> {
> - SCSIDevice *d = scsi_device_find(bus, channel, target, lun);
> + SCSIDevice *d;
> +
> + RCU_READ_LOCK_GUARD();
> + d = do_scsi_device_find(bus, channel, target, lun, true);
> if (d && d->lun == lun) {
> if (p_dev) {
> *p_dev = d;
> @@ -1570,35 +1622,6 @@ static char *scsibus_get_fw_dev_path(DeviceState *dev)
> qdev_fw_name(dev), d->id, d->lun);
> }
>
> -SCSIDevice *scsi_device_find(SCSIBus *bus, int channel, int id, int lun)
> -{
> - BusChild *kid;
> - SCSIDevice *target_dev = NULL;
> -
> - RCU_READ_LOCK_GUARD();
> - QTAILQ_FOREACH_RCU(kid, &bus->qbus.children, sibling) {
> - DeviceState *qdev = kid->child;
> - SCSIDevice *dev = SCSI_DEVICE(qdev);
> -
> - if (dev->channel == channel && dev->id == id) {
> - if (dev->lun == lun) {
> - return dev;
> - }
> -
> - /*
> - * If we don't find exact match (channel/bus/lun),
> - * we will return the first device which matches channel/bus
> - */
> -
> - if (!target_dev) {
> - target_dev = dev;
> - }
> - }
> - }
> -
> - return target_dev;
> -}
> -
> /* SCSI request list. For simplicity, pv points to the whole device */
>
> static int put_scsi_requests(QEMUFile *f, void *pv, size_t size,
Best regards,
Maxim Levitsky
