Re: [Qemu-devel] [PATCH] spice/qxl: locking fix for qemu-kvm

[Alon Levy]

On Wed, Mar 02, 2011 at 02:32:03PM +0200, Alon Levy wrote:
> From: Gerd Hoffmann <address@hidden>

Err, that "From" got there by mistake, and the title should of course
not say "for qemu-kvm"..

> 
> qxl needs to release the qemu lock before calling some libspice
> functions (and re-aquire it later).  In upstream qemu qxl can just
> use qemu_mutex_{unlock,lock}_iothread.  In qemu-kvm this doesn't
> work, qxl needs additionally save+restore the cpu_single_env pointer
> on unlock+lock.
> 
> This fixes the following assertion in kvm_mutex_unlock that happened in the
> released qemu-kvm 0.14.0 on gentoo when using spice's qxl device:
> 
> > /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1724:
> > kvm_mutex_unlock: Assertion `!cpu_single_env' failed.
> 
> Happening as a result of io from the guest (qxl reset):
> > (gdb) bt
> > #0  0x00007ffff5daa165 in raise () from /lib/libc.so.6
> > #1  0x00007ffff5dab580 in abort () from /lib/libc.so.6
> > #2  0x00007ffff5da3201 in __assert_fail () from /lib/libc.so.6
> > #3  0x0000000000436f7e in kvm_mutex_unlock ()
> >     at 
> > /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1724
> > #4  qemu_mutex_unlock_iothread ()
> >     at 
> > /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1737
> > #5  0x00000000005e84ee in qxl_hard_reset (d=0x15d3080, loadvm=0)
> >     at 
> > /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/hw/qxl.c:665
> > #6  0x00000000005e9f9a in ioport_write (opaque=0x15d3080, addr=<value
> 
> According to Jan, this bug (the wrong value for cpu_single_env) is also 
> present
> in qemu, but no abort is triggered because it isn't asserted.
> 
> Signed-off-by: Gerd Hoffmann <address@hidden>
> ---
>  hw/qxl.c           |   37 +++++++++++++++++++++++++++++--------
>  ui/spice-display.c |   12 ++++++------
>  ui/spice-display.h |    6 ++++++
>  3 files changed, 41 insertions(+), 14 deletions(-)
> 
> diff --git a/hw/qxl.c b/hw/qxl.c
> index fe4212b..117f7c8 100644
> --- a/hw/qxl.c
> +++ b/hw/qxl.c
> @@ -125,6 +125,27 @@ static void qxl_reset_memslots(PCIQXLDevice *d);
>  static void qxl_reset_surfaces(PCIQXLDevice *d);
>  static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
>  
> +/* qemu-kvm locking ... */
> +void qxl_unlock_iothread(SimpleSpiceDisplay *ssd)
> +{
> +    if (cpu_single_env) {
> +        assert(ssd->env == NULL);
> +        ssd->env = cpu_single_env;
> +        cpu_single_env = NULL;
> +    }
> +    qemu_mutex_unlock_iothread();
> +}
> +
> +void qxl_lock_iothread(SimpleSpiceDisplay *ssd)
> +{
> +    qemu_mutex_lock_iothread();
> +    if (ssd->env) {
> +        assert(cpu_single_env == NULL);
> +        cpu_single_env = ssd->env;
> +        ssd->env = NULL;
> +    }
> +}
> +
>  static inline uint32_t msb_mask(uint32_t val)
>  {
>      uint32_t mask;
> @@ -662,10 +683,10 @@ static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)
>      dprint(d, 1, "%s: start%s\n", __FUNCTION__,
>             loadvm ? " (loadvm)" : "");
>  
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(&d->ssd);
>      d->ssd.worker->reset_cursor(d->ssd.worker);
>      d->ssd.worker->reset_image_cache(d->ssd.worker);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(&d->ssd);
>      qxl_reset_surfaces(d);
>      qxl_reset_memslots(d);
>  
> @@ -795,9 +816,9 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
>  {
>      dprint(d, 1, "%s:\n", __FUNCTION__);
>      d->mode = QXL_MODE_UNDEFINED;
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(&d->ssd);
>      d->ssd.worker->destroy_surfaces(d->ssd.worker);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(&d->ssd);
>      memset(&d->guest_surfaces.cmds, 0, sizeof(d->guest_surfaces.cmds));
>  }
>  
> @@ -866,9 +887,9 @@ static void qxl_destroy_primary(PCIQXLDevice *d)
>      dprint(d, 1, "%s\n", __FUNCTION__);
>  
>      d->mode = QXL_MODE_UNDEFINED;
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(&d->ssd);
>      d->ssd.worker->destroy_primary_surface(d->ssd.worker, 0);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(&d->ssd);
>  }
>  
>  static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
> @@ -938,10 +959,10 @@ static void ioport_write(void *opaque, uint32_t addr, 
> uint32_t val)
>      case QXL_IO_UPDATE_AREA:
>      {
>          QXLRect update = d->ram->update_area;
> -        qemu_mutex_unlock_iothread();
> +        qxl_unlock_iothread(&d->ssd);
>          d->ssd.worker->update_area(d->ssd.worker, d->ram->update_surface,
>                                     &update, NULL, 0, 0);
> -        qemu_mutex_lock_iothread();
> +        qxl_lock_iothread(&d->ssd);
>          break;
>      }
>      case QXL_IO_NOTIFY_CMD:
> diff --git a/ui/spice-display.c b/ui/spice-display.c
> index 020b423..defe652 100644
> --- a/ui/spice-display.c
> +++ b/ui/spice-display.c
> @@ -186,18 +186,18 @@ void qemu_spice_create_host_primary(SimpleSpiceDisplay 
> *ssd)
>      surface.mem        = (intptr_t)ssd->buf;
>      surface.group_id   = MEMSLOT_GROUP_HOST;
>  
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(ssd);
>      ssd->worker->create_primary_surface(ssd->worker, 0, &surface);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(ssd);
>  }
>  
>  void qemu_spice_destroy_host_primary(SimpleSpiceDisplay *ssd)
>  {
>      dprint(1, "%s:\n", __FUNCTION__);
>  
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(ssd);
>      ssd->worker->destroy_primary_surface(ssd->worker, 0);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(ssd);
>  }
>  
>  void qemu_spice_vm_change_state_handler(void *opaque, int running, int 
> reason)
> @@ -207,9 +207,9 @@ void qemu_spice_vm_change_state_handler(void *opaque, int 
> running, int reason)
>      if (running) {
>          ssd->worker->start(ssd->worker);
>      } else {
> -        qemu_mutex_unlock_iothread();
> +        qxl_unlock_iothread(ssd);
>          ssd->worker->stop(ssd->worker);
> -        qemu_mutex_lock_iothread();
> +        qxl_lock_iothread(ssd);
>      }
>      ssd->running = running;
>  }
> diff --git a/ui/spice-display.h b/ui/spice-display.h
> index aef0464..df74828 100644
> --- a/ui/spice-display.h
> +++ b/ui/spice-display.h
> @@ -43,6 +43,9 @@ typedef struct SimpleSpiceDisplay {
>      QXLRect dirty;
>      int notify;
>      int running;
> +
> +    /* qemu-kvm locking ... */
> +    void *env;
>  } SimpleSpiceDisplay;
>  
>  typedef struct SimpleSpiceUpdate {
> @@ -52,6 +55,9 @@ typedef struct SimpleSpiceUpdate {
>      uint8_t *bitmap;
>  } SimpleSpiceUpdate;
>  
> +void qxl_unlock_iothread(SimpleSpiceDisplay *ssd);
> +void qxl_lock_iothread(SimpleSpiceDisplay *ssd);
> +
>  int qemu_spice_rect_is_empty(const QXLRect* r);
>  void qemu_spice_rect_union(QXLRect *dest, const QXLRect *r);
>  
> -- 
> 1.7.4.1
> 
>