From patchwork Wed Mar 16 05:07:01 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: David Gibson X-Patchwork-Id: 8594831 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 4E740C0553 for ; Wed, 16 Mar 2016 05:06:35 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5B3C720218 for ; Wed, 16 Mar 2016 05:06:34 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B1389201FE for ; Wed, 16 Mar 2016 05:06:33 +0000 (UTC) Received: from localhost ([::1]:53145 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ag3fF-0001OW-1T for patchwork-qemu-devel@patchwork.kernel.org; Wed, 16 Mar 2016 01:06:33 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34260) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ag3es-0001Ac-Fp for qemu-devel@nongnu.org; Wed, 16 Mar 2016 01:06:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ag3ep-0005RT-Ln for qemu-devel@nongnu.org; Wed, 16 Mar 2016 01:06:10 -0400 Received: from ozlabs.org ([103.22.144.67]:34652) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ag3ep-0005PZ-AB; Wed, 16 Mar 2016 01:06:07 -0400 Received: by ozlabs.org (Postfix, from userid 1007) id 3qPzwC2HDlz9t5Z; Wed, 16 Mar 2016 16:06:02 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gibson.dropbear.id.au; s=201602; t=1458104763; bh=fF/OO4kQ9986PtlKBUCnmr61ZNn/bBOPe8vq0H6Pmcs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zp6o5CGA0w7GlTsr8ugWuOQzKeohK+ZeXS61y6MkIop30qP22mizB82Uj7RJ8KiCy hY0yF5+iMTNy9o/CxmkJCZcQXK6MSH+6xjaCPq9oMdWXUqQL13Hrq4oq75lTd6fdI4 A83z4h1kottlZ/Suf9vzE0yIxreDBGRIgj2tWvm4= From: David Gibson To: peter.maydell@linaro.org Date: Wed, 16 Mar 2016 16:07:01 +1100 Message-Id: <1458104828-32541-10-git-send-email-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1458104828-32541-1-git-send-email-david@gibson.dropbear.id.au> References: <1458104828-32541-1-git-send-email-david@gibson.dropbear.id.au> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 103.22.144.67 Cc: qemu-devel@nongnu.org, aik@ozlabs.ru, agraf@suse.de, mdroth@linux.vnet.ibm.com, alex.williamson@redhat.com, qemu-ppc@nongnu.org, David Gibson , Greg Kurz Subject: [Qemu-devel] [PULL 09/16] spapr_rng: fix race with main loop X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Greg Kurz Since commit "60253ed1e6ec rng: add request queue support to rng-random", the use of a spapr_rng device may hang vCPU threads. The following path is taken without holding the lock to the main loop mutex: h_random() rng_backend_request_entropy() rng_random_request_entropy() qemu_set_fd_handler() The consequence is that entropy_available() may be called before the vCPU thread could even queue the request: depending on the scheduling, it may happen that entropy_available() does not call random_recv()->qemu_sem_post(). The vCPU thread will then sleep forever in h_random()->qemu_sem_wait(). This could not happen before 60253ed1e6ec because entropy_available() used to call random_recv() unconditionally. This patch ensures the lock is held to avoid the race. Signed-off-by: Greg Kurz Reviewed-by: Cédric Le Goater Reviewed-by: Thomas Huth Signed-off-by: David Gibson --- hw/ppc/spapr_rng.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/ppc/spapr_rng.c b/hw/ppc/spapr_rng.c index a39d472..02d6be4 100644 --- a/hw/ppc/spapr_rng.c +++ b/hw/ppc/spapr_rng.c @@ -77,13 +77,13 @@ static target_ulong h_random(PowerPCCPU *cpu, sPAPRMachineState *spapr, hrdata.val.v64 = 0; hrdata.received = 0; - qemu_mutex_unlock_iothread(); while (hrdata.received < 8) { rng_backend_request_entropy(rngstate->backend, 8 - hrdata.received, random_recv, &hrdata); + qemu_mutex_unlock_iothread(); qemu_sem_wait(&hrdata.sem); + qemu_mutex_lock_iothread(); } - qemu_mutex_lock_iothread(); qemu_sem_destroy(&hrdata.sem); args[0] = hrdata.val.v64;