d481617765
Details: https://gitlab.com/qemu-project/qemu/-/issues/3144 The function schedule_next_request is called with tg->lock held and it may call throttle_group_co_restart_queue, which takes tgm->throttled_reqs_lock, qemu_co_mutex_lock may leave current coroutine if other iothread has taken the lock. If the next coroutine will call throttle_group_co_io_limits_intercept - it will try to take the mutex tg->lock which will never be released. Here is the backtrace of the iothread: Thread 30 (Thread 0x7f8aad1fd6c0 (LWP 24240) "IO iothread2"): #0 futex_wait (futex_word=0x5611adb7d828, expected=2, private=0) at ../sysdeps/nptl/futex-internal.h:146 #1 __GI___lll_lock_wait (futex=futex@entry=0x5611adb7d828, private=0) at lowlevellock.c:49 #2 0x00007f8ab5a97501 in lll_mutex_lock_optimized (mutex=0x5611adb7d828) at pthread_mutex_lock.c:48 #3 ___pthread_mutex_lock (mutex=0x5611adb7d828) at pthread_mutex_lock.c:93 #4 0x00005611823f5482 in qemu_mutex_lock_impl (mutex=0x5611adb7d828, file=0x56118289daca "../block/throttle-groups.c", line=372) at ../util/qemu-thread-posix.c:94 #5 0x00005611822b0b39 in throttle_group_co_io_limits_intercept (tgm=0x5611af1bb4d8, bytes=4096, direction=THROTTLE_READ) at ../block/throttle-groups.c:372 #6 0x00005611822473b1 in blk_co_do_preadv_part (blk=0x5611af1bb490, offset=15972311040, bytes=4096, qiov=0x7f8aa4000f98, qiov_offset=0, flags=BDRV_REQ_REGISTERED_BUF) at ../block/block-backend.c:1354 #7 0x0000561182247fa0 in blk_aio_read_entry (opaque=0x7f8aa4005910) at ../block/block-backend.c:1619 #8 0x000056118241952e in coroutine_trampoline (i0=-1543497424, i1=32650) at ../util/coroutine-ucontext.c:175 #9 0x00007f8ab5a56f70 in ?? () at ../sysdeps/unix/sysv/linux/x86_64/__start_context.S:66 from target:/lib64/libc.so.6 #10 0x00007f8aad1ef190 in ?? () #11 0x0000000000000000 in ?? () The lock is taken in line 386: (gdb) p tg.lock $1 = {lock = {__data = {__lock = 2, __count = 0, __owner = 24240, __nusers = 1, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = "\002\000\000\000\000\000\000\000\260^\000\000\001", '\000' <repeats 26 times>, __align = 2}, file = 0x56118289daca "../block/throttle-groups.c", line = 386, initialized = true} The solution is to use tg->lock to protect both ThreadGroup fields and ThrottleGroupMember.throttled_reqs. It doesn't seem to be possible to use separate locks because we need to first manipulate ThrottleGroup fields, then schedule next coroutine using throttled_reqs and after than update token field from ThrottleGroup depending on the throttled_reqs state. Signed-off-by: Dmitry Guryanov <dmitry.guryanov@gmail.com> Message-ID: <20251208085528.890098-1-dmitry.guryanov@gmail.com> Reviewed-by: Hanna Czenczek <hreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
91 lines
3.2 KiB
C
91 lines
3.2 KiB
C
/*
|
|
* QEMU block throttling group infrastructure
|
|
*
|
|
* Copyright (C) Nodalink, EURL. 2014
|
|
* Copyright (C) Igalia, S.L. 2015
|
|
*
|
|
* Authors:
|
|
* Benoît Canet <benoit.canet@nodalink.com>
|
|
* Alberto Garcia <berto@igalia.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as
|
|
* published by the Free Software Foundation; either version 2 or
|
|
* (at your option) version 3 of the License.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#ifndef THROTTLE_GROUPS_H
|
|
#define THROTTLE_GROUPS_H
|
|
|
|
#include "qemu/coroutine.h"
|
|
#include "qemu/throttle.h"
|
|
#include "qom/object.h"
|
|
|
|
/* The ThrottleGroupMember structure indicates membership in a ThrottleGroup
|
|
* and holds related data.
|
|
*/
|
|
|
|
typedef struct ThrottleGroupMember {
|
|
AioContext *aio_context;
|
|
/* Protected by ThrottleGroup.lock */
|
|
CoQueue throttled_reqs[THROTTLE_MAX];
|
|
|
|
/* Nonzero if the I/O limits are currently being ignored; generally
|
|
* it is zero. Accessed with atomic operations.
|
|
*/
|
|
unsigned int io_limits_disabled;
|
|
|
|
/* Number of pending throttle_group_restart_queue_entry() coroutines.
|
|
* Accessed with atomic operations.
|
|
*/
|
|
unsigned int restart_pending;
|
|
|
|
/* The following fields are protected by the ThrottleGroup lock.
|
|
* See the ThrottleGroup documentation for details.
|
|
* throttle_state tells us if I/O limits are configured. */
|
|
ThrottleState *throttle_state;
|
|
ThrottleTimers throttle_timers;
|
|
unsigned pending_reqs[THROTTLE_MAX];
|
|
QLIST_ENTRY(ThrottleGroupMember) round_robin;
|
|
|
|
} ThrottleGroupMember;
|
|
|
|
#define TYPE_THROTTLE_GROUP "throttle-group"
|
|
OBJECT_DECLARE_SIMPLE_TYPE(ThrottleGroup, THROTTLE_GROUP)
|
|
|
|
const char *throttle_group_get_name(ThrottleGroupMember *tgm);
|
|
|
|
ThrottleState *throttle_group_incref(const char *name);
|
|
void throttle_group_unref(ThrottleState *ts);
|
|
|
|
void throttle_group_config(ThrottleGroupMember *tgm, ThrottleConfig *cfg);
|
|
void throttle_group_get_config(ThrottleGroupMember *tgm, ThrottleConfig *cfg);
|
|
|
|
void throttle_group_register_tgm(ThrottleGroupMember *tgm,
|
|
const char *groupname,
|
|
AioContext *ctx);
|
|
void throttle_group_unregister_tgm(ThrottleGroupMember *tgm);
|
|
void throttle_group_restart_tgm(ThrottleGroupMember *tgm);
|
|
|
|
void coroutine_fn throttle_group_co_io_limits_intercept(ThrottleGroupMember *tgm,
|
|
int64_t bytes,
|
|
ThrottleDirection direction);
|
|
void throttle_group_attach_aio_context(ThrottleGroupMember *tgm,
|
|
AioContext *new_context);
|
|
void throttle_group_detach_aio_context(ThrottleGroupMember *tgm);
|
|
/*
|
|
* throttle_group_exists() must be called under the global
|
|
* mutex.
|
|
*/
|
|
bool throttle_group_exists(const char *name);
|
|
|
|
#endif
|