From patchwork Thu Aug 15 14:49:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Alex_Benn=C3=A9e?= X-Patchwork-Id: 819429 Delivered-To: patch@linaro.org Received: by 2002:adf:cd01:0:b0:367:895a:4699 with SMTP id w1csp1198019wrm; Thu, 15 Aug 2024 07:52:59 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWbQYEXSS17JF2Jyb72R4A/Ul2P1BKzT0PvZ2PySWyUVTbPLYZDE9VvMoHTJBMKBIibN8x4PUOZxOSnZlYZfq7f X-Google-Smtp-Source: AGHT+IHUj/M0agBE8BQDNBpyDKVxz2nQUP/6w4D9XG/hrSU9/mNgU3ugbD9Obmn4/JL6Zi0FUaAY X-Received: by 2002:a0c:be84:0:b0:6bf:5da4:96dc with SMTP id 6a1803df08f44-6bf5da496f5mr59193776d6.45.1723733579456; Thu, 15 Aug 2024 07:52:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1723733579; cv=none; d=google.com; s=arc-20160816; b=LTcqxN1OA1Rztot/YLWC6xiznQsLb7zNu/f6elkmnH+aGJfo0R7Ieo/6XPXIBZlRVP sdDz796AY4lyr3k1BqpRnBI3N53i0dm5rFGChOK44fiMjaIfhoCrrrpCr5GbB6XRpYTL BbEOr3CwKuQPHKF/dPDZBOOpx7SJD1eSyTZV9n6OYz7JZnuFmYVFnkloxucxTYxSh6g+ jpTg4RQyQPPB636SMmmguQ1a+314m9p12tFDMt41pa/QzvZl0SATZTawaoKsEzpuDaRa 0eBOEIHsWZQxmWOQqejItWx/GnXukWYoW2RKPBWd1ubfsNh7KFhi2SMZuPA2lvWH/USV arUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=fGNwWa3S5TX7tw+jVxHwopux+SCGaD9vnHCk/doezEQ=; fh=zpmTh0lFY8Y9gScv4m7Dcr2yTbITQ9nqGHuTTiGY4tw=; b=t6qVcsdeMrIstOf9oDGqIf0Drbq9fCaObaS0QSpFXv9k9WDAFPhNdluDg0FmTQCtbd mVV/c7KO/uX+b/on7IfW6Wx0+QWML14fIVXl/KdppsuMfqYneMe2m4aEqHnT6gM/mxly HHXX9DvFhlxoIuXlBJ5QkVL9+iuvS8UhjJmUBGEIBjLrRSlWpsokYrCIHuZ0hC5mkuup RcRIDJ47K/lK0jLSgd1W71dtzAOU+t5XtnTeFvyPCB8XZhScQBhqO0J6gqRARdHFKPQ5 //NIjoE86vTIePevukZXHhQP5HIR4sIfogqs8kRFu0LanFh/1zjP9LZz24r5/vTV90dC 9tkA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=TEradAnQ; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org; dara=neutral header.i=@linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6bf6fef3872si18968536d6.404.2024.08.15.07.52.59 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 15 Aug 2024 07:52:59 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=TEradAnQ; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org; dara=neutral header.i=@linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sebnI-0004E2-3e; Thu, 15 Aug 2024 10:49:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sebn5-0003aR-8F for qemu-devel@nongnu.org; Thu, 15 Aug 2024 10:49:27 -0400 Received: from mail-ej1-x62c.google.com ([2a00:1450:4864:20::62c]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sebn2-0000Dr-Cm for qemu-devel@nongnu.org; Thu, 15 Aug 2024 10:49:26 -0400 Received: by mail-ej1-x62c.google.com with SMTP id a640c23a62f3a-a7aac70e30dso120862566b.1 for ; Thu, 15 Aug 2024 07:49:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1723733363; x=1724338163; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=fGNwWa3S5TX7tw+jVxHwopux+SCGaD9vnHCk/doezEQ=; b=TEradAnQNc2vat9wviJ0YlSOR+iYRNK5Md2UgbZ2CGu4ikk0fsM5iS1IwZuOUMpVDs s1wCAuL+1IWS0JbCnS99fJ4BzqSBEAdCtX9blWUpm5fxL5w6IGxv1dNijYTxGkZYEeYi bReg9k+Yvlcfpe5RLmrJdJ+C4xxFmb7+BTD+8YAlGbKzUSRzhKKY4xSq2bM3GO1YRGu8 sftTUXw39akPMU8ZP17NF/Ie+18Cofx6jri4jbwFT50hir7i7pgER5L7dnThl6Psif7j JYaPEdlKjC0GWITM1b6RZU1qLj2M7aweKsA/k874a5DXnzd+hlv8A6NezVR7c1Q2+CSC Idsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723733363; x=1724338163; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=fGNwWa3S5TX7tw+jVxHwopux+SCGaD9vnHCk/doezEQ=; b=tuswgPRJrqRA6zICxyTD8YE5rU3fVh7MX2VwVDutwJBopvm54pbNHI7MkvYTb4d9v/ +BqQNZHHYeNs6ig1skV75hC1EkicS1bGKWkeNDhfhD7BwAzpZC1TFJm8cqvcrjGsBILz AfuHGDkkei1/zLCA1mqHNxUtmNJcEbeB3OpuGxrPhRI2qCpL6mmdTYK0QfNkRpyUmqO8 G1uzIW9lpfOvnGYxESwBI6XURhLxqy4h66kMKwzQZDhl2U1YlphJGRagKwQQqMP5Lmcg a9wbWZ+w+RVL4DQPxMxrdrsd3jF9AnxbrQ8C0Ho6FQ8VANiO7CEH3x3F/vaBR7737DYz FU9g== X-Gm-Message-State: AOJu0YzuixN3NxeQppnajZ5zvy5vYdmhsryW6T4L4CvqltqpvUxIZPP6 J8tt+SMM8guz+keOSZDpOJGcAxJUmvUypaT8Xue+AkuozQidBZJvk4mBPVTtCOzlUrWu1ubSU8g 6 X-Received: by 2002:a17:907:d58f:b0:a77:d7f1:42eb with SMTP id a640c23a62f3a-a8366d396ebmr495271366b.23.1723733362446; Thu, 15 Aug 2024 07:49:22 -0700 (PDT) Received: from draig.lan ([85.9.250.243]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a83838cefe0sm112307466b.47.2024.08.15.07.49.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 15 Aug 2024 07:49:20 -0700 (PDT) Received: from draig.lan (localhost [IPv6:::1]) by draig.lan (Postfix) with ESMTP id B35ED5F8ED; Thu, 15 Aug 2024 15:49:13 +0100 (BST) From: =?utf-8?q?Alex_Benn=C3=A9e?= To: qemu-devel@nongnu.org Cc: Pierrick Bouvier , =?utf-8?q?Alex_Benn?= =?utf-8?q?=C3=A9e?= , Richard Henderson , Alexandre Iooss , Mahmoud Mandour Subject: [PULL 21/21] plugins: fix race condition with scoreboards Date: Thu, 15 Aug 2024 15:49:11 +0100 Message-Id: <20240815144911.1931487-22-alex.bennee@linaro.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240815144911.1931487-1-alex.bennee@linaro.org> References: <20240815144911.1931487-1-alex.bennee@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::62c; envelope-from=alex.bennee@linaro.org; helo=mail-ej1-x62c.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Pierrick Bouvier A deadlock can be created if a new vcpu (a) triggers a scoreboard reallocation, and another vcpu (b) wants to create a new scoreboard at the same time. In this case, (a) holds the plugin lock, and starts an exclusive section, waiting for (b). But at the same time, (b) is waiting for plugin lock. The solution is to drop the lock before entering the exclusive section. This bug can be easily reproduced by creating a callback for any tb exec, that allocates a new scoreboard. In this case, as soon as we reach more than 16 vcpus, the deadlock occurs. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2344 Signed-off-by: Pierrick Bouvier Message-Id: <20240812220748.95167-2-pierrick.bouvier@linaro.org> [AJB: tweak var position to meet coding style] Signed-off-by: Alex Bennée Reviewed-by: Richard Henderson Message-Id: <20240813202329.1237572-22-alex.bennee@linaro.org> diff --git a/plugins/core.c b/plugins/core.c index 12c67b4b4e..2897453cac 100644 --- a/plugins/core.c +++ b/plugins/core.c @@ -214,30 +214,49 @@ CPUPluginState *qemu_plugin_create_vcpu_state(void) static void plugin_grow_scoreboards__locked(CPUState *cpu) { - if (cpu->cpu_index < plugin.scoreboard_alloc_size) { + size_t scoreboard_size = plugin.scoreboard_alloc_size; + bool need_realloc = false; + + if (cpu->cpu_index < scoreboard_size) { return; } - bool need_realloc = FALSE; - while (cpu->cpu_index >= plugin.scoreboard_alloc_size) { - plugin.scoreboard_alloc_size *= 2; - need_realloc = TRUE; + while (cpu->cpu_index >= scoreboard_size) { + scoreboard_size *= 2; + need_realloc = true; } + if (!need_realloc) { + return; + } - if (!need_realloc || QLIST_EMPTY(&plugin.scoreboards)) { - /* nothing to do, we just updated sizes for future scoreboards */ + if (QLIST_EMPTY(&plugin.scoreboards)) { + /* just update size for future scoreboards */ + plugin.scoreboard_alloc_size = scoreboard_size; return; } + /* + * A scoreboard creation/deletion might be in progress. If a new vcpu is + * initialized at the same time, we are safe, as the new + * plugin.scoreboard_alloc_size was not yet written. + */ + qemu_rec_mutex_unlock(&plugin.lock); + /* cpus must be stopped, as tb might still use an existing scoreboard. */ start_exclusive(); - struct qemu_plugin_scoreboard *score; - QLIST_FOREACH(score, &plugin.scoreboards, entry) { - g_array_set_size(score->data, plugin.scoreboard_alloc_size); + /* re-acquire lock */ + qemu_rec_mutex_lock(&plugin.lock); + /* in case another vcpu is created between unlock and exclusive section. */ + if (scoreboard_size > plugin.scoreboard_alloc_size) { + struct qemu_plugin_scoreboard *score; + QLIST_FOREACH(score, &plugin.scoreboards, entry) { + g_array_set_size(score->data, scoreboard_size); + } + plugin.scoreboard_alloc_size = scoreboard_size; + /* force all tb to be flushed, as scoreboard pointers were changed. */ + tb_flush(cpu); } - /* force all tb to be flushed, as scoreboard pointers were changed. */ - tb_flush(cpu); end_exclusive(); }