On 23.01.24 17:40, Hanna Czenczek wrote:
On 21.12.23 22:23, Kevin Wolf wrote:
From: Stefan Hajnoczi<stefa...@redhat.com>
Stop depending on the AioContext lock and instead access
SCSIDevice->requests from only one thread at a time:
- When the VM is running only the BlockBackend's AioContext may access
the requests list.
- When the VM is stopped only the main loop may access the requests
list.
These constraints protect the requests list without the need for locking
in the I/O code path.
Note that multiple IOThreads are not supported yet because the code
assumes all SCSIRequests are executed from a single AioContext. Leave
that as future work.
Signed-off-by: Stefan Hajnoczi<stefa...@redhat.com>
Reviewed-by: Eric Blake<ebl...@redhat.com>
Message-ID:<20231204164259.1515217-2-stefa...@redhat.com>
Signed-off-by: Kevin Wolf<kw...@redhat.com>
---
include/hw/scsi/scsi.h | 7 +-
hw/scsi/scsi-bus.c | 181 ++++++++++++++++++++++++++++-------------
2 files changed, 131 insertions(+), 57 deletions(-)
[...]
I don’t know anything about the problem yet, but as usual, I like
speculation and discovering how wrong I was later on, so one thing I
came across that’s funny about virtio-scsi is that requests can happen
even while a disk is being attached or detached. That is, Linux seems
to probe all LUNs when a new virtio-scsi device is being attached, and
it won’t stop just because a disk is being attached or removed. So
maybe that’s part of the problem, that we get a request while the BB
is being detached, and temporarily in an inconsistent state (BDS
context differs from BB context).
I’ll look more into it.
What I think happens is that scsi_device_purge_requests() runs (perhaps
through virtio_scsi_hotunplug() -> qdev_simple_device_unplug_cb() ->
scsi_qdev_unrealize()?), which schedules
scsi_device_for_each_req_async_bh() to run, but doesn’t await it. We go
on, begin to move the BB and its BDS back to the main context (via
blk_set_aio_context() in virtio_scsi_hotunplug()), but
scsi_device_for_each_req_async_bh() still runs in the I/O thread, it
calls blk_get_aio_context() while the contexts are inconsistent, and we
get the crash.
There is a comment above blk_get_aio_context() in
scsi_device_for_each_req_async_bh() about the BB potentially being moved
to a different context prior to the BH running, but it doesn’t consider
the possibility that that move may occur *concurrently*.
I don’t know how to fix this, though. The whole idea of anything
happening to a BB while it is being moved to a different context seems
so wrong to me that I’d want to slap a big lock on it, but I have the
feeling that that isn’t what we want.
Hanna
