On Wed, Oct 22, 2025 at 3:50 PM Eugenio Perez Martin <[email protected]> wrote: > > On Wed, Oct 22, 2025 at 3:32 PM <[email protected]> wrote: > > > > From: German Maglione <[email protected]> > > > > QEMU sends all of VHOST_USER_SET_VRING_KICK, _CALL, and _ERR without > > setting the NEED_REPLY flag, i.e. by the time the respective > > vhost_user_set_vring_*() function returns, it is completely up to chance > > whether whether the back-end has already processed the request and > > switched over to the new FD for interrupts. > > > > At least for vhost_user_set_vring_call(), that is a problem: It is > > called through vhost_virtqueue_mask(), which is generally used in the > > VirtioDeviceClass.guest_notifier_mask() implementation, which is in turn > > called by virtio_pci_one_vector_unmask(). The fact that we do not wait > > for the back-end to install the FD leads to a race there: > > > > Masking interrupts is implemented by redirecting interrupts to an > > internal event FD that is not connected to the guest. Unmasking then > > re-installs the guest-connected IRQ FD, then checks if there are pending > > interrupts left on the masked event FD, and if so, issues an interrupt > > to the guest. > > > > Because guest_notifier_mask() (through vhost_user_set_vring_call()) > > doesn't wait for the back-end to switch over to the actual IRQ FD, it's > > possible we check for pending interrupts while the back-end is still > > using the masked event FD, and then we will lose interrupts that occur > > before the back-end finally does switch over. > > > > Fix this by setting NEED_REPLY on those VHOST_USER_SET_VRING_* messages, > > so when we get that reply, we know that the back-end is now using the > > new FD. > > > > Fixes: 5f6f6664bf24 ("Add vhost-user as a vhost backend.") ?
sorry, I missed this, Michael, should I add this in a new patch version? > > > Signed-off-by: German Maglione <[email protected]> > > Signed-off-by: Hanna Czenczek <[email protected]> > > --- > > hw/virtio/vhost-user.c | 18 +++++++++++++++++- > > 1 file changed, 17 insertions(+), 1 deletion(-) > > > > diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c > > index 36c9c2e04d..641960293b 100644 > > --- a/hw/virtio/vhost-user.c > > +++ b/hw/virtio/vhost-user.c > > @@ -1327,8 +1327,11 @@ static int vhost_set_vring_file(struct vhost_dev > > *dev, > > VhostUserRequest request, > > struct vhost_vring_file *file) > > { > > + int ret; > > int fds[VHOST_USER_MAX_RAM_SLOTS]; > > size_t fd_num = 0; > > + bool reply_supported = virtio_has_feature(dev->protocol_features, > > + > > VHOST_USER_PROTOCOL_F_REPLY_ACK); > > Why not use vhost_user_write_sync directly? > > > VhostUserMsg msg = { > > .hdr.request = request, > > .hdr.flags = VHOST_USER_VERSION, > > @@ -1336,13 +1339,26 @@ static int vhost_set_vring_file(struct vhost_dev > > *dev, > > .hdr.size = sizeof(msg.payload.u64), > > }; > > > > + if (reply_supported) { > > + msg.hdr.flags |= VHOST_USER_NEED_REPLY_MASK; > > + } > > + > > if (file->fd > 0) { > > fds[fd_num++] = file->fd; > > } else { > > msg.payload.u64 |= VHOST_USER_VRING_NOFD_MASK; > > } > > > > - return vhost_user_write(dev, &msg, fds, fd_num); > > + ret = vhost_user_write(dev, &msg, fds, fd_num); > > + if (ret < 0) { > > + return ret; > > + } > > + > > + if (reply_supported) { > > + return process_message_reply(dev, &msg); > > + } > > + > > + return 0; > > } > > > > static int vhost_user_set_vring_kick(struct vhost_dev *dev, > > -- > > 2.49.0 > > > -- German
