Re: [Qemu-devel] [PATCH v2 2/5] vfio-ccw: concurrent I/O handling

[Halil Pasic]

On Mon, 21 Jan 2019 12:03:51 +0100
Cornelia Huck <address@hidden> wrote:

> Rework handling of multiple I/O requests to return -EAGAIN if
> we are already processing an I/O request. Introduce a mutex
> to disallow concurrent writes to the I/O region.
> 
> The expectation is that userspace simply retries the operation
> if it gets -EAGAIN.
> 
> We currently don't allow multiple ssch requests at the same
> time, as we don't have support for keeping channel programs
> around for more than one request.
> 
> Signed-off-by: Cornelia Huck <address@hidden>
> ---

[..]

>  static ssize_t vfio_ccw_mdev_write(struct mdev_device *mdev,
> @@ -188,25 +192,30 @@ static ssize_t vfio_ccw_mdev_write(struct mdev_device 
> *mdev,
>  {
>       struct vfio_ccw_private *private;
>       struct ccw_io_region *region;
> +     int ret;
>  
>       if (*ppos + count > sizeof(*region))
>               return -EINVAL;
>  
>       private = dev_get_drvdata(mdev_parent_dev(mdev));
> -     if (private->state != VFIO_CCW_STATE_IDLE)
> +     if (private->state == VFIO_CCW_STATE_NOT_OPER ||
> +         private->state == VFIO_CCW_STATE_STANDBY)
>               return -EACCES;
> +     if (!mutex_trylock(&private->io_mutex))
> +             return -EAGAIN;
>  
>       region = private->io_region;
> -     if (copy_from_user((void *)region + *ppos, buf, count))
> -             return -EFAULT;
> +     if (copy_from_user((void *)region + *ppos, buf, count)) {

This might race with vfio_ccw_sch_io_todo() on
private->io_region->irb_area, or?

> +             ret = -EFAULT;
> +             goto out_unlock;
> +     }
>  
>       vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_IO_REQ);
> -     if (region->ret_code != 0) {
> -             private->state = VFIO_CCW_STATE_IDLE;
> -             return region->ret_code;
> -     }
> +     ret = (region->ret_code != 0) ? region->ret_code : count;
>  
> -     return count;
> +out_unlock:
> +     mutex_unlock(&private->io_mutex);
> +     return ret;
>  }
>  
[..]