{"push_id":2390809093,"size":8,"distinct_size":8,"ref":"refs/heads/upstream-master","head":"e4ae62b802cec437f877f2cadc4ef059cc0eca76","before":"b39b61e410022f96ceb53d4381d25cba5126ac44","commits":[{"sha":"c060332c762acbe7899b01edda972da7f9ec9057","author":{"name":"Deepa Srinivasan","email":"18dd79b889f512dd4ff5bf4d04c76a2c022a3ac2@oracle.com"},"message":"block: Fix qemu crash when using scsi-block\n\nStarting qemu with the following arguments causes qemu to segfault:\n... -device lsi,id=lsi0 -drive file=iscsi:<...>,format=raw,if=none,node-name=\niscsi1 -device scsi-block,bus=lsi0.0,id=<...>,drive=iscsi1\n\nThis patch fixes blk_aio_ioctl() so it does not pass stack addresses to\nblk_aio_ioctl_entry() which may be invoked after blk_aio_ioctl() returns. More\ndetails about the bug follow.\n\nblk_aio_ioctl() invokes blk_aio_prwv() with blk_aio_ioctl_entry as the\ncoroutine parameter. blk_aio_prwv() ultimately calls aio_co_enter().\n\nWhen blk_aio_ioctl() is executed from within a coroutine context (e.g.\niscsi_bh_cb()), aio_co_enter() adds the coroutine (blk_aio_ioctl_entry) to\nthe current coroutine's wakeup queue. blk_aio_ioctl() then returns.\n\nWhen blk_aio_ioctl_entry() executes later, it accesses an invalid pointer:\n....\n    BlkRwCo *rwco = &acb->rwco;\n\n    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset,\n                             rwco->qiov->iov[0].iov_base);  <--- qiov is\n                                                                 invalid here\n...\n\nIn the case when blk_aio_ioctl() is called from a non-coroutine context,\nblk_aio_ioctl_entry() executes immediately. But if bdrv_co_ioctl() calls\nqemu_coroutine_yield(), blk_aio_ioctl() will return. When the coroutine\nexecution is complete, control returns to blk_aio_ioctl_entry() after the call\nto blk_co_ioctl(). There is no invalid reference after this point, but the\nfunction is still holding on to invalid pointers.\n\nThe fix is to change blk_aio_prwv() to accept a void pointer for the IO buffer\nrather than a QEMUIOVector. blk_aio_prwv() passes this through in BlkRwCo and the\ncoroutine function casts it to QEMUIOVector or uses the void pointer directly.\n\nSigned-off-by: Deepa Srinivasan <deepa.srinivasan@oracle.com>\nSigned-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nReviewed-by: Mark Kanda <mark.kanda@oracle.com>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/c060332c762acbe7899b01edda972da7f9ec9057"},{"sha":"7c9e2748297d01222f5d5cbcdac7ec8126f1b139","author":{"name":"Fam Zheng","email":"fee53c2705d9be73af7f618dd56700ae37511c73@redhat.com"},"message":"README: Fix typo 'git-publish'\n\nReported-by: Alberto Garcia <berto@igalia.com>\nSigned-off-by: Fam Zheng <famz@redhat.com>\nReviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>\nMessage-id: 20180306024328.19195-1-famz@redhat.com\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/7c9e2748297d01222f5d5cbcdac7ec8126f1b139"},{"sha":"12c1c7d7cefb4dbffeb5712e75a33e4692f0a76b","author":{"name":"Sergio Lopez","email":"7ad7cb410d79db06c05b84efaf35c34a5539cdfa@redhat.com"},"message":"virtio-blk: dataplane: Don't batch notifications if EVENT_IDX is present\n\nCommit 5b2ffbe4d99843fd8305c573a100047a8c962327 (\"virtio-blk: dataplane:\nnotify guest as a batch\") deferred guest notification to a BH in order\nbatch notifications, with purpose of avoiding flooding the guest with\ninterruptions.\n\nThis optimization came with a cost. The average latency perceived in the\nguest is increased by a few microseconds, but also when multiple IO\noperations finish at the same time, the guest won't be notified until\nall completions from each operation has been run. On the contrary,\nvirtio-scsi issues the notification at the end of each completion.\n\nOn the other hand, nowadays we have the EVENT_IDX feature that allows a\nbetter coordination between QEMU and the Guest OS to avoid sending\nunnecessary interruptions.\n\nWith this change, virtio-blk/dataplane only batches notifications if the\nEVENT_IDX feature is not present.\n\nSome numbers obtained with fio (ioengine=sync, iodepth=1, direct=1):\n - Test specs:\n   * fio-3.4 (ioengine=sync, iodepth=1, direct=1)\n   * qemu master\n   * virtio-blk with a dedicated iothread (default poll-max-ns)\n   * backend: null_blk nr_devices=1 irqmode=2 completion_nsec=280000\n   * 8 vCPUs pinned to isolated physical cores\n   * Emulator and iothread also pinned to separate isolated cores\n   * variance between runs < 1%\n\n - Not patched\n   * numjobs=1:  lat_avg=327.32  irqs=29998\n   * numjobs=4:  lat_avg=337.89  irqs=29073\n   * numjobs=8:  lat_avg=342.98  irqs=28643\n\n - Patched:\n   * numjobs=1:  lat_avg=323.92  irqs=30262\n   * numjobs=4:  lat_avg=332.65  irqs=29520\n   * numjobs=8:  lat_avg=335.54  irqs=29323\n\nSigned-off-by: Sergio Lopez <slp@redhat.com>\nMessage-id: 20180307114459.26636-1-slp@redhat.com\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/12c1c7d7cefb4dbffeb5712e75a33e4692f0a76b"},{"sha":"b89d92f3cfc0f6e6d05e146e7a5fb8c759978051","author":{"name":"Stefan Hajnoczi","email":"94c9a8f93d854d47ca810881c950deb3298e8e1d@redhat.com"},"message":"block: add aio_wait_bh_oneshot()\n\nSometimes it's necessary for the main loop thread to run a BH in an\nIOThread and wait for its completion.  This primitive is useful during\nstartup/shutdown to synchronize and avoid race conditions.\n\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>\nReviewed-by: Fam Zheng <famz@redhat.com>\nAcked-by: Paolo Bonzini <pbonzini@redhat.com>\nMessage-id: 20180307144205.20619-2-stefanha@redhat.com\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/b89d92f3cfc0f6e6d05e146e7a5fb8c759978051"},{"sha":"1010cadf62332017648abee0d7a3dc7f2eef9632","author":{"name":"Stefan Hajnoczi","email":"94c9a8f93d854d47ca810881c950deb3298e8e1d@redhat.com"},"message":"virtio-blk: fix race between .ioeventfd_stop() and vq handler\n\nIf the main loop thread invokes .ioeventfd_stop() just as the vq handler\nfunction begins in the IOThread then the handler may lose the race for\nthe AioContext lock.  By the time the vq handler is able to acquire the\nAioContext lock the ioeventfd has already been removed and the handler\nisn't supposed to run anymore!\n\nUse the new aio_wait_bh_oneshot() function to perform ioeventfd removal\nfrom within the IOThread.  This way no races with the vq handler are\npossible.\n\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>\nReviewed-by: Fam Zheng <famz@redhat.com>\nAcked-by: Paolo Bonzini <pbonzini@redhat.com>\nMessage-id: 20180307144205.20619-3-stefanha@redhat.com\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/1010cadf62332017648abee0d7a3dc7f2eef9632"},{"sha":"184b9623461e73ef79f5cebe68bdbcf2e4751e22","author":{"name":"Stefan Hajnoczi","email":"94c9a8f93d854d47ca810881c950deb3298e8e1d@redhat.com"},"message":"virtio-scsi: fix race between .ioeventfd_stop() and vq handler\n\nIf the main loop thread invokes .ioeventfd_stop() just as the vq handler\nfunction begins in the IOThread then the handler may lose the race for\nthe AioContext lock.  By the time the vq handler is able to acquire the\nAioContext lock the ioeventfd has already been removed and the handler\nisn't supposed to run anymore!\n\nUse the new aio_wait_bh_oneshot() function to perform ioeventfd removal\nfrom within the IOThread.  This way no races with the vq handler are\npossible.\n\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>\nReviewed-by: Fam Zheng <famz@redhat.com>\nAcked-by: Paolo Bonzini <pbonzini@redhat.com>\nMessage-id: 20180307144205.20619-4-stefanha@redhat.com\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/184b9623461e73ef79f5cebe68bdbcf2e4751e22"},{"sha":"4486e89c219c0d1b9bd8dfa0b1dd5b0d51ff2268","author":{"name":"Stefan Hajnoczi","email":"94c9a8f93d854d47ca810881c950deb3298e8e1d@redhat.com"},"message":"vl: introduce vm_shutdown()\n\nCommit 00d09fdbbae5f7864ce754913efc84c12fdf9f1a (\"vl: pause vcpus before\nstopping iothreads\") and commit dce8921b2baaf95974af8176406881872067adfa\n(\"iothread: Stop threads before main() quits\") tried to work around the\nfact that emulation was still active during termination by stopping\niothreads.  They suffer from race conditions:\n1. virtio_scsi_handle_cmd_vq() racing with iothread_stop_all() hits the\n   virtio_scsi_ctx_check() assertion failure because the BDS AioContext\n   has been modified by iothread_stop_all().\n2. Guest vq kick racing with main loop termination leaves a readable\n   ioeventfd that is handled by the next aio_poll() when external\n   clients are enabled again, resulting in unwanted emulation activity.\n\nThis patch obsoletes those commits by fully disabling emulation activity\nwhen vcpus are stopped.\n\nUse the new vm_shutdown() function instead of pause_all_vcpus() so that\nvm change state handlers are invoked too.  Virtio devices will now stop\ntheir ioeventfds, preventing further emulation activity after vm_stop().\n\nNote that vm_stop(RUN_STATE_SHUTDOWN) cannot be used because it emits a\nQMP STOP event that may affect existing clients.\n\nIt is no longer necessary to call replay_disable_events() directly since\nvm_shutdown() does so already.\n\nDrop iothread_stop_all() since it is no longer used.\n\nCc: Fam Zheng <famz@redhat.com>\nCc: Kevin Wolf <kwolf@redhat.com>\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>\nReviewed-by: Fam Zheng <famz@redhat.com>\nAcked-by: Paolo Bonzini <pbonzini@redhat.com>\nMessage-id: 20180307144205.20619-5-stefanha@redhat.com\nSigned-off-by: Stefan Hajnoczi <stefanha@redhat.com>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/4486e89c219c0d1b9bd8dfa0b1dd5b0d51ff2268"},{"sha":"e4ae62b802cec437f877f2cadc4ef059cc0eca76","author":{"name":"Peter Maydell","email":"d4da0cae8bdd6af8ce5950fc7fec7c012df68229@linaro.org"},"message":"Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging\n\n# gpg: Signature made Fri 09 Mar 2018 13:19:02 GMT\n# gpg:                using RSA key 9CA4ABB381AB73C8\n# gpg: Good signature from \"Stefan Hajnoczi <stefanha@redhat.com>\"\n# gpg:                 aka \"Stefan Hajnoczi <stefanha@gmail.com>\"\n# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8\n\n* remotes/stefanha/tags/block-pull-request:\n  vl: introduce vm_shutdown()\n  virtio-scsi: fix race between .ioeventfd_stop() and vq handler\n  virtio-blk: fix race between .ioeventfd_stop() and vq handler\n  block: add aio_wait_bh_oneshot()\n  virtio-blk: dataplane: Don't batch notifications if EVENT_IDX is present\n  README: Fix typo 'git-publish'\n  block: Fix qemu crash when using scsi-block\n\nSigned-off-by: Peter Maydell <peter.maydell@linaro.org>","distinct":true,"url":"https://api.github.com/repos/aosp-mirror/platform_external_qemu/commits/e4ae62b802cec437f877f2cadc4ef059cc0eca76"}]}
{"actor":{"display_login":"hubot"}}