diff mbox

spice/qxl: locking fix for qemu-kvm

Message ID 1299069123-12823-1-git-send-email-alevy@redhat.com
State New
Headers show

Commit Message

Alon Levy March 2, 2011, 12:32 p.m. UTC 
From: Gerd Hoffmann <kraxel@redhat.com>

qxl needs to release the qemu lock before calling some libspice
functions (and re-aquire it later).  In upstream qemu qxl can just
use qemu_mutex_{unlock,lock}_iothread.  In qemu-kvm this doesn't
work, qxl needs additionally save+restore the cpu_single_env pointer
on unlock+lock.

This fixes the following assertion in kvm_mutex_unlock that happened in the
released qemu-kvm 0.14.0 on gentoo when using spice's qxl device:

> /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1724:
> kvm_mutex_unlock: Assertion `!cpu_single_env' failed.

Happening as a result of io from the guest (qxl reset):
> (gdb) bt
> #0  0x00007ffff5daa165 in raise () from /lib/libc.so.6
> #1  0x00007ffff5dab580 in abort () from /lib/libc.so.6
> #2  0x00007ffff5da3201 in __assert_fail () from /lib/libc.so.6
> #3  0x0000000000436f7e in kvm_mutex_unlock ()
>     at /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1724
> #4  qemu_mutex_unlock_iothread ()
>     at /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1737
> #5  0x00000000005e84ee in qxl_hard_reset (d=0x15d3080, loadvm=0)
>     at /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/hw/qxl.c:665
> #6  0x00000000005e9f9a in ioport_write (opaque=0x15d3080, addr=<value

According to Jan, this bug (the wrong value for cpu_single_env) is also present
in qemu, but no abort is triggered because it isn't asserted.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/qxl.c           |   37 +++++++++++++++++++++++++++++--------
 ui/spice-display.c |   12 ++++++------
 ui/spice-display.h |    6 ++++++
 3 files changed, 41 insertions(+), 14 deletions(-)

Comments

Alon Levy March 2, 2011, 12:40 p.m. UTC | #1 
On Wed, Mar 02, 2011 at 02:32:03PM +0200, Alon Levy wrote:
> From: Gerd Hoffmann <kraxel@redhat.com>

Err, that "From" got there by mistake, and the title should of course
not say "for qemu-kvm"..

> 
> qxl needs to release the qemu lock before calling some libspice
> functions (and re-aquire it later).  In upstream qemu qxl can just
> use qemu_mutex_{unlock,lock}_iothread.  In qemu-kvm this doesn't
> work, qxl needs additionally save+restore the cpu_single_env pointer
> on unlock+lock.
> 
> This fixes the following assertion in kvm_mutex_unlock that happened in the
> released qemu-kvm 0.14.0 on gentoo when using spice's qxl device:
> 
> > /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1724:
> > kvm_mutex_unlock: Assertion `!cpu_single_env' failed.
> 
> Happening as a result of io from the guest (qxl reset):
> > (gdb) bt
> > #0  0x00007ffff5daa165 in raise () from /lib/libc.so.6
> > #1  0x00007ffff5dab580 in abort () from /lib/libc.so.6
> > #2  0x00007ffff5da3201 in __assert_fail () from /lib/libc.so.6
> > #3  0x0000000000436f7e in kvm_mutex_unlock ()
> >     at /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1724
> > #4  qemu_mutex_unlock_iothread ()
> >     at /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/qemu-kvm.c:1737
> > #5  0x00000000005e84ee in qxl_hard_reset (d=0x15d3080, loadvm=0)
> >     at /var/tmp/portage/app-emulation/qemu-kvm-0.14.0/work/qemu-kvm-0.14.0/hw/qxl.c:665
> > #6  0x00000000005e9f9a in ioport_write (opaque=0x15d3080, addr=<value
> 
> According to Jan, this bug (the wrong value for cpu_single_env) is also present
> in qemu, but no abort is triggered because it isn't asserted.
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
>  hw/qxl.c           |   37 +++++++++++++++++++++++++++++--------
>  ui/spice-display.c |   12 ++++++------
>  ui/spice-display.h |    6 ++++++
>  3 files changed, 41 insertions(+), 14 deletions(-)
> 
> diff --git a/hw/qxl.c b/hw/qxl.c
> index fe4212b..117f7c8 100644
> --- a/hw/qxl.c
> +++ b/hw/qxl.c
> @@ -125,6 +125,27 @@ static void qxl_reset_memslots(PCIQXLDevice *d);
>  static void qxl_reset_surfaces(PCIQXLDevice *d);
>  static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
>  
> +/* qemu-kvm locking ... */
> +void qxl_unlock_iothread(SimpleSpiceDisplay *ssd)
> +{
> +    if (cpu_single_env) {
> +        assert(ssd->env == NULL);
> +        ssd->env = cpu_single_env;
> +        cpu_single_env = NULL;
> +    }
> +    qemu_mutex_unlock_iothread();
> +}
> +
> +void qxl_lock_iothread(SimpleSpiceDisplay *ssd)
> +{
> +    qemu_mutex_lock_iothread();
> +    if (ssd->env) {
> +        assert(cpu_single_env == NULL);
> +        cpu_single_env = ssd->env;
> +        ssd->env = NULL;
> +    }
> +}
> +
>  static inline uint32_t msb_mask(uint32_t val)
>  {
>      uint32_t mask;
> @@ -662,10 +683,10 @@ static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)
>      dprint(d, 1, "%s: start%s\n", __FUNCTION__,
>             loadvm ? " (loadvm)" : "");
>  
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(&d->ssd);
>      d->ssd.worker->reset_cursor(d->ssd.worker);
>      d->ssd.worker->reset_image_cache(d->ssd.worker);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(&d->ssd);
>      qxl_reset_surfaces(d);
>      qxl_reset_memslots(d);
>  
> @@ -795,9 +816,9 @@ static void qxl_reset_surfaces(PCIQXLDevice *d)
>  {
>      dprint(d, 1, "%s:\n", __FUNCTION__);
>      d->mode = QXL_MODE_UNDEFINED;
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(&d->ssd);
>      d->ssd.worker->destroy_surfaces(d->ssd.worker);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(&d->ssd);
>      memset(&d->guest_surfaces.cmds, 0, sizeof(d->guest_surfaces.cmds));
>  }
>  
> @@ -866,9 +887,9 @@ static void qxl_destroy_primary(PCIQXLDevice *d)
>      dprint(d, 1, "%s\n", __FUNCTION__);
>  
>      d->mode = QXL_MODE_UNDEFINED;
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(&d->ssd);
>      d->ssd.worker->destroy_primary_surface(d->ssd.worker, 0);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(&d->ssd);
>  }
>  
>  static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
> @@ -938,10 +959,10 @@ static void ioport_write(void *opaque, uint32_t addr, uint32_t val)
>      case QXL_IO_UPDATE_AREA:
>      {
>          QXLRect update = d->ram->update_area;
> -        qemu_mutex_unlock_iothread();
> +        qxl_unlock_iothread(&d->ssd);
>          d->ssd.worker->update_area(d->ssd.worker, d->ram->update_surface,
>                                     &update, NULL, 0, 0);
> -        qemu_mutex_lock_iothread();
> +        qxl_lock_iothread(&d->ssd);
>          break;
>      }
>      case QXL_IO_NOTIFY_CMD:
> diff --git a/ui/spice-display.c b/ui/spice-display.c
> index 020b423..defe652 100644
> --- a/ui/spice-display.c
> +++ b/ui/spice-display.c
> @@ -186,18 +186,18 @@ void qemu_spice_create_host_primary(SimpleSpiceDisplay *ssd)
>      surface.mem        = (intptr_t)ssd->buf;
>      surface.group_id   = MEMSLOT_GROUP_HOST;
>  
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(ssd);
>      ssd->worker->create_primary_surface(ssd->worker, 0, &surface);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(ssd);
>  }
>  
>  void qemu_spice_destroy_host_primary(SimpleSpiceDisplay *ssd)
>  {
>      dprint(1, "%s:\n", __FUNCTION__);
>  
> -    qemu_mutex_unlock_iothread();
> +    qxl_unlock_iothread(ssd);
>      ssd->worker->destroy_primary_surface(ssd->worker, 0);
> -    qemu_mutex_lock_iothread();
> +    qxl_lock_iothread(ssd);
>  }
>  
>  void qemu_spice_vm_change_state_handler(void *opaque, int running, int reason)
> @@ -207,9 +207,9 @@ void qemu_spice_vm_change_state_handler(void *opaque, int running, int reason)
>      if (running) {
>          ssd->worker->start(ssd->worker);
>      } else {
> -        qemu_mutex_unlock_iothread();
> +        qxl_unlock_iothread(ssd);
>          ssd->worker->stop(ssd->worker);
> -        qemu_mutex_lock_iothread();
> +        qxl_lock_iothread(ssd);
>      }
>      ssd->running = running;
>  }
> diff --git a/ui/spice-display.h b/ui/spice-display.h
> index aef0464..df74828 100644
> --- a/ui/spice-display.h
> +++ b/ui/spice-display.h
> @@ -43,6 +43,9 @@ typedef struct SimpleSpiceDisplay {
>      QXLRect dirty;
>      int notify;
>      int running;
> +
> +    /* qemu-kvm locking ... */
> +    void *env;
>  } SimpleSpiceDisplay;
>  
>  typedef struct SimpleSpiceUpdate {
> @@ -52,6 +55,9 @@ typedef struct SimpleSpiceUpdate {
>      uint8_t *bitmap;
>  } SimpleSpiceUpdate;
>  
> +void qxl_unlock_iothread(SimpleSpiceDisplay *ssd);
> +void qxl_lock_iothread(SimpleSpiceDisplay *ssd);
> +
>  int qemu_spice_rect_is_empty(const QXLRect* r);
>  void qemu_spice_rect_union(QXLRect *dest, const QXLRect *r);
>  
> -- 
> 1.7.4.1
> 
>
diff mbox

Patch

diff --git a/hw/qxl.c b/hw/qxl.c
index fe4212b..117f7c8 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -125,6 +125,27 @@  static void qxl_reset_memslots(PCIQXLDevice *d);
 static void qxl_reset_surfaces(PCIQXLDevice *d);
 static void qxl_ring_set_dirty(PCIQXLDevice *qxl);
 
+/* qemu-kvm locking ... */
+void qxl_unlock_iothread(SimpleSpiceDisplay *ssd)
+{
+    if (cpu_single_env) {
+        assert(ssd->env == NULL);
+        ssd->env = cpu_single_env;
+        cpu_single_env = NULL;
+    }
+    qemu_mutex_unlock_iothread();
+}
+
+void qxl_lock_iothread(SimpleSpiceDisplay *ssd)
+{
+    qemu_mutex_lock_iothread();
+    if (ssd->env) {
+        assert(cpu_single_env == NULL);
+        cpu_single_env = ssd->env;
+        ssd->env = NULL;
+    }
+}
+
 static inline uint32_t msb_mask(uint32_t val)
 {
     uint32_t mask;
@@ -662,10 +683,10 @@  static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)
     dprint(d, 1, "%s: start%s\n", __FUNCTION__,
            loadvm ? " (loadvm)" : "");
 
-    qemu_mutex_unlock_iothread();
+    qxl_unlock_iothread(&d->ssd);
     d->ssd.worker->reset_cursor(d->ssd.worker);
     d->ssd.worker->reset_image_cache(d->ssd.worker);
-    qemu_mutex_lock_iothread();
+    qxl_lock_iothread(&d->ssd);
     qxl_reset_surfaces(d);
     qxl_reset_memslots(d);
 
@@ -795,9 +816,9 @@  static void qxl_reset_surfaces(PCIQXLDevice *d)
 {
     dprint(d, 1, "%s:\n", __FUNCTION__);
     d->mode = QXL_MODE_UNDEFINED;
-    qemu_mutex_unlock_iothread();
+    qxl_unlock_iothread(&d->ssd);
     d->ssd.worker->destroy_surfaces(d->ssd.worker);
-    qemu_mutex_lock_iothread();
+    qxl_lock_iothread(&d->ssd);
     memset(&d->guest_surfaces.cmds, 0, sizeof(d->guest_surfaces.cmds));
 }
 
@@ -866,9 +887,9 @@  static void qxl_destroy_primary(PCIQXLDevice *d)
     dprint(d, 1, "%s\n", __FUNCTION__);
 
     d->mode = QXL_MODE_UNDEFINED;
-    qemu_mutex_unlock_iothread();
+    qxl_unlock_iothread(&d->ssd);
     d->ssd.worker->destroy_primary_surface(d->ssd.worker, 0);
-    qemu_mutex_lock_iothread();
+    qxl_lock_iothread(&d->ssd);
 }
 
 static void qxl_set_mode(PCIQXLDevice *d, int modenr, int loadvm)
@@ -938,10 +959,10 @@  static void ioport_write(void *opaque, uint32_t addr, uint32_t val)
     case QXL_IO_UPDATE_AREA:
     {
         QXLRect update = d->ram->update_area;
-        qemu_mutex_unlock_iothread();
+        qxl_unlock_iothread(&d->ssd);
         d->ssd.worker->update_area(d->ssd.worker, d->ram->update_surface,
                                    &update, NULL, 0, 0);
-        qemu_mutex_lock_iothread();
+        qxl_lock_iothread(&d->ssd);
         break;
     }
     case QXL_IO_NOTIFY_CMD:
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 020b423..defe652 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -186,18 +186,18 @@  void qemu_spice_create_host_primary(SimpleSpiceDisplay *ssd)
     surface.mem        = (intptr_t)ssd->buf;
     surface.group_id   = MEMSLOT_GROUP_HOST;
 
-    qemu_mutex_unlock_iothread();
+    qxl_unlock_iothread(ssd);
     ssd->worker->create_primary_surface(ssd->worker, 0, &surface);
-    qemu_mutex_lock_iothread();
+    qxl_lock_iothread(ssd);
 }
 
 void qemu_spice_destroy_host_primary(SimpleSpiceDisplay *ssd)
 {
     dprint(1, "%s:\n", __FUNCTION__);
 
-    qemu_mutex_unlock_iothread();
+    qxl_unlock_iothread(ssd);
     ssd->worker->destroy_primary_surface(ssd->worker, 0);
-    qemu_mutex_lock_iothread();
+    qxl_lock_iothread(ssd);
 }
 
 void qemu_spice_vm_change_state_handler(void *opaque, int running, int reason)
@@ -207,9 +207,9 @@  void qemu_spice_vm_change_state_handler(void *opaque, int running, int reason)
     if (running) {
         ssd->worker->start(ssd->worker);
     } else {
-        qemu_mutex_unlock_iothread();
+        qxl_unlock_iothread(ssd);
         ssd->worker->stop(ssd->worker);
-        qemu_mutex_lock_iothread();
+        qxl_lock_iothread(ssd);
     }
     ssd->running = running;
 }
diff --git a/ui/spice-display.h b/ui/spice-display.h
index aef0464..df74828 100644
--- a/ui/spice-display.h
+++ b/ui/spice-display.h
@@ -43,6 +43,9 @@  typedef struct SimpleSpiceDisplay {
     QXLRect dirty;
     int notify;
     int running;
+
+    /* qemu-kvm locking ... */
+    void *env;
 } SimpleSpiceDisplay;
 
 typedef struct SimpleSpiceUpdate {
@@ -52,6 +55,9 @@  typedef struct SimpleSpiceUpdate {
     uint8_t *bitmap;
 } SimpleSpiceUpdate;
 
+void qxl_unlock_iothread(SimpleSpiceDisplay *ssd);
+void qxl_lock_iothread(SimpleSpiceDisplay *ssd);
+
 int qemu_spice_rect_is_empty(const QXLRect* r);
 void qemu_spice_rect_union(QXLRect *dest, const QXLRect *r);