[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 09/16] spapr_rng: fix race with main loop
From: |
David Gibson |
Subject: |
[Qemu-devel] [PULL 09/16] spapr_rng: fix race with main loop |
Date: |
Wed, 16 Mar 2016 16:07:01 +1100 |
From: Greg Kurz <address@hidden>
Since commit "60253ed1e6ec rng: add request queue support to rng-random",
the use of a spapr_rng device may hang vCPU threads.
The following path is taken without holding the lock to the main loop mutex:
h_random()
rng_backend_request_entropy()
rng_random_request_entropy()
qemu_set_fd_handler()
The consequence is that entropy_available() may be called before the vCPU
thread could even queue the request: depending on the scheduling, it may
happen that entropy_available() does not call random_recv()->qemu_sem_post().
The vCPU thread will then sleep forever in h_random()->qemu_sem_wait().
This could not happen before 60253ed1e6ec because entropy_available() used
to call random_recv() unconditionally.
This patch ensures the lock is held to avoid the race.
Signed-off-by: Greg Kurz <address@hidden>
Reviewed-by: Cédric Le Goater <address@hidden>
Reviewed-by: Thomas Huth <address@hidden>
Signed-off-by: David Gibson <address@hidden>
---
hw/ppc/spapr_rng.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/ppc/spapr_rng.c b/hw/ppc/spapr_rng.c
index a39d472..02d6be4 100644
--- a/hw/ppc/spapr_rng.c
+++ b/hw/ppc/spapr_rng.c
@@ -77,13 +77,13 @@ static target_ulong h_random(PowerPCCPU *cpu,
sPAPRMachineState *spapr,
hrdata.val.v64 = 0;
hrdata.received = 0;
- qemu_mutex_unlock_iothread();
while (hrdata.received < 8) {
rng_backend_request_entropy(rngstate->backend, 8 - hrdata.received,
random_recv, &hrdata);
+ qemu_mutex_unlock_iothread();
qemu_sem_wait(&hrdata.sem);
+ qemu_mutex_lock_iothread();
}
- qemu_mutex_lock_iothread();
qemu_sem_destroy(&hrdata.sem);
args[0] = hrdata.val.v64;
--
2.5.0
- [Qemu-devel] [PULL 00/16] ppc-for-2.6 queue 20160316, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 02/16] ppc: Fix migration of the TAR SPR, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 11/16] spapr_pci: Switch to vfio_eeh_as_op() interface, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 03/16] ppc: Add a few more P8 PMU SPRs, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 09/16] spapr_rng: fix race with main loop,
David Gibson <=
- [Qemu-devel] [PULL 15/16] spapr_pci: Remove finish_realize hook, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 07/16] target-ppc: Add helpers for updating a CPU's SDR1 and external HPT, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 16/16] vfio: Eliminate vfio_container_ioctl(), David Gibson, 2016/03/16
- [Qemu-devel] [PULL 14/16] spapr_pci: (Mostly) remove spapr-pci-vfio-host-bridge, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 08/16] target-ppc: Eliminate kvmppc_kern_htab global, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 12/16] spapr_pci: Eliminate class callbacks, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 06/16] target-ppc: Split out SREGS get/put functions, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 01/16] ppc: Define the PSPB register on POWER8, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 10/16] vfio: Start improving VFIO/EEH interface, David Gibson, 2016/03/16
- [Qemu-devel] [PULL 13/16] spapr_pci: Allow EEH on spapr-pci-host-bridge, David Gibson, 2016/03/16