[Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Ming Lei]

In case of vhost-scsi, the object type of VirtIODevice isn't
VirtIOSCSI, so use the cast trick to fix the problem like
in virtio_scsi_handle_cmd()

Cc: qemu-stable@nongnu.org
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
---
 hw/scsi/virtio-scsi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index b0d7517..13700f5 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -538,7 +538,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 
 static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 {
-    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
+    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 
     if (s->events_dropped) {
         virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
-- 
1.7.9.5

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Paolo Bonzini]

Il 18/06/2014 14:13, Ming Lei ha scritto:
> In case of vhost-scsi, the object type of VirtIODevice isn't
> VirtIOSCSI, so use the cast trick to fix the problem like
> in virtio_scsi_handle_cmd()
>
> Cc: qemu-stable@nongnu.org
> Cc: Anthony Liguori <aliguori@amazon.com>
> Cc: "Michael S. Tsirkin" <mst@redhat.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Ming Lei <ming.lei@canonical.com>
> ---
>  hw/scsi/virtio-scsi.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
> index b0d7517..13700f5 100644
> --- a/hw/scsi/virtio-scsi.c
> +++ b/hw/scsi/virtio-scsi.c
> @@ -538,7 +538,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
>
>  static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
>  {
> -    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
> +    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
>
>      if (s->events_dropped) {
>          virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
>

This should never be triggered by vhost-scsi.  Perhaps a bug in the kernel?

Paolo

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Ming Lei]

On Wed, Jun 18, 2014 at 8:29 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Il 18/06/2014 14:13, Ming Lei ha scritto:
>
>> In case of vhost-scsi, the object type of VirtIODevice isn't
>> VirtIOSCSI, so use the cast trick to fix the problem like
>> in virtio_scsi_handle_cmd()
>>
>> Cc: qemu-stable@nongnu.org
>> Cc: Anthony Liguori <aliguori@amazon.com>
>> Cc: "Michael S. Tsirkin" <mst@redhat.com>
>> Cc: Paolo Bonzini <pbonzini@redhat.com>
>> Signed-off-by: Ming Lei <ming.lei@canonical.com>
>> ---
>>  hw/scsi/virtio-scsi.c |    2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
>> index b0d7517..13700f5 100644
>> --- a/hw/scsi/virtio-scsi.c
>> +++ b/hw/scsi/virtio-scsi.c
>> @@ -538,7 +538,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s,
>> SCSIDevice *dev,
>>
>>  static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
>>  {
>> -    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
>> +    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
>>
>>      if (s->events_dropped) {
>>          virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
>>
>
> This should never be triggered by vhost-scsi.  Perhaps a bug in the kernel?

It can be triggered with rmmod, system suspend, reboot...

Thanks,
--
Ming Lei

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Andreas Färber]

Am 18.06.2014 14:13, schrieb Ming Lei:
> In case of vhost-scsi, the object type of VirtIODevice isn't
> VirtIOSCSI, so use the cast trick to fix the problem like
> in virtio_scsi_handle_cmd()
> 
> Cc: qemu-stable@nongnu.org
> Cc: Anthony Liguori <aliguori@amazon.com>
> Cc: "Michael S. Tsirkin" <mst@redhat.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Ming Lei <ming.lei@canonical.com>
> ---
>  hw/scsi/virtio-scsi.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
> index b0d7517..13700f5 100644
> --- a/hw/scsi/virtio-scsi.c
> +++ b/hw/scsi/virtio-scsi.c
> @@ -538,7 +538,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
>  
>  static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
>  {
> -    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
> +    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
>  
>      if (s->events_dropped) {

If s is not of type VirtIOSCSI as you indicate, then you shouldn't be
accessing its fields here either. You're basically disabling the safety
mechanism to avoid just that.

If you see a direct cast used elsewhere, it is most likely for
performance reasons, not for correctness.

Regards,
Andreas

>          virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
> 


-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Ming Lei]

[-- Attachment #1: Type: text/plain, Size: 1602 bytes --]

On Wed, Jun 18, 2014 at 10:23 PM, Andreas Färber <afaerber@suse.de> wrote:
> Am 18.06.2014 14:13, schrieb Ming Lei:
>> In case of vhost-scsi, the object type of VirtIODevice isn't
>> VirtIOSCSI, so use the cast trick to fix the problem like
>> in virtio_scsi_handle_cmd()
>>
>> Cc: qemu-stable@nongnu.org
>> Cc: Anthony Liguori <aliguori@amazon.com>
>> Cc: "Michael S. Tsirkin" <mst@redhat.com>
>> Cc: Paolo Bonzini <pbonzini@redhat.com>
>> Signed-off-by: Ming Lei <ming.lei@canonical.com>
>> ---
>>  hw/scsi/virtio-scsi.c |    2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
>> index b0d7517..13700f5 100644
>> --- a/hw/scsi/virtio-scsi.c
>> +++ b/hw/scsi/virtio-scsi.c
>> @@ -538,7 +538,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
>>
>>  static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
>>  {
>> -    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
>> +    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
>>
>>      if (s->events_dropped) {
>
> If s is not of type VirtIOSCSI as you indicate, then you shouldn't be
> accessing its fields here either. You're basically disabling the safety
> mechanism to avoid just that.

Yes, you are right, and the correct approach should let VirtIOSCSI
as parent of VHostSCSI, so how about attached patch?

>
> If you see a direct cast used elsewhere, it is most likely for
> performance reasons, not for correctness.

The other two places aren't for performance reason, and it is
designed as so.


Thanks,
--
Ming Lei

[-- Attachment #2: 0001-virtio-scsi-fix-object-check-failure.patch --]
[-- Type: text/x-patch, Size: 2699 bytes --]

From b1e09246ee961a67a301dd0591a2919cd9b5bab3 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@canonical.com>
Date: Wed, 18 Jun 2014 20:06:55 +0800
Subject: [PATCH] virtio-scsi: fix object check failure

In case of vhost-scsi, the object type of VirtIODevice isn't
VirtIOSCSI, so use the cast trick to fix the problem like
in virtio_scsi_handle_cmd()

Cc: qemu-stable@nongnu.org
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
---
 hw/scsi/vhost-scsi.c           |    2 +-
 hw/scsi/virtio-scsi.c          |    2 +-
 hw/virtio/virtio-pci.c         |    2 +-
 include/hw/virtio/vhost-scsi.h |    2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 3983a5b..76985a7 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -257,7 +257,7 @@ static void vhost_scsi_unrealize(DeviceState *dev, Error **errp)
 }
 
 static Property vhost_scsi_properties[] = {
-    DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSI, parent_obj.conf),
+    DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSI, parent.parent_obj.conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index b0d7517..13700f5 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -538,7 +538,7 @@ static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
 
 static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
 {
-    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
+    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
 
     if (s->events_dropped) {
         virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index af2e1c3..b428898 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1199,7 +1199,7 @@ static const TypeInfo virtio_scsi_pci_info = {
 static Property vhost_scsi_pci_properties[] = {
     DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
                        DEV_NVECTORS_UNSPECIFIED),
-    DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSIPCI, vdev.parent_obj.conf),
+    DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSIPCI, vdev.parent.parent_obj.conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/virtio/vhost-scsi.h b/include/hw/virtio/vhost-scsi.h
index 85cc031..62fc820 100644
--- a/include/hw/virtio/vhost-scsi.h
+++ b/include/hw/virtio/vhost-scsi.h
@@ -55,7 +55,7 @@ enum vhost_scsi_vq_list {
         OBJECT_CHECK(VHostSCSI, (obj), TYPE_VHOST_SCSI)
 
 typedef struct VHostSCSI {
-    VirtIOSCSICommon parent_obj;
+    VirtIOSCSI parent;
 
     Error *migration_blocker;
 
-- 
1.7.9.5

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Paolo Bonzini]

Il 18/06/2014 16:18, Ming Lei ha scritto:
>> > This should never be triggered by vhost-scsi.  Perhaps a bug in the kernel?
> It can be triggered with rmmod, system suspend, reboot...

Yes, but it should not.

What happens if you change VHOST_SCSI_VQ_NUM_FIXED from 2 to 3?

Paolo

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Paolo Bonzini]

Il 18/06/2014 17:02, Paolo Bonzini ha scritto:
> Il 18/06/2014 16:18, Ming Lei ha scritto:
>>> > This should never be triggered by vhost-scsi.  Perhaps a bug in the
>>> kernel?
>> It can be triggered with rmmod, system suspend, reboot...
>
> Yes, but it should not.
>
> What happens if you change VHOST_SCSI_VQ_NUM_FIXED from 2 to 3?

Sorry, brain fart here.  The number of interrupts in virtio-scsi is 
queues+3 because of the configuration interrupt.  This does not apply here.

Anyway, vhost-scsi passes the number of virtqueues correctly to the kernel.

QEMU might be triggering this because, when vhost is stopped, the queue 
is still not empty (as expected, since it's a receive queue).

Can you check that this is the case?

If so, patching QEMU is correct, but you need to change 
VIRTIO_SCSI(vdev) to VIRTIO_SCSI_COMMON(vdev), and move events_dropped 
from VirtIOSCSI to VirtIOSCSICommon.

Paolo

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Ming Lei]

On Wed, Jun 18, 2014 at 11:06 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Il 18/06/2014 17:02, Paolo Bonzini ha scritto:
>
>> Il 18/06/2014 16:18, Ming Lei ha scritto:
>>>>
>>>> > This should never be triggered by vhost-scsi.  Perhaps a bug in the
>>>> kernel?
>>>
>>> It can be triggered with rmmod, system suspend, reboot...
>>
>>
>> Yes, but it should not.
>>
>> What happens if you change VHOST_SCSI_VQ_NUM_FIXED from 2 to 3?
>
>
> Sorry, brain fart here.  The number of interrupts in virtio-scsi is queues+3
> because of the configuration interrupt.  This does not apply here.
>
> Anyway, vhost-scsi passes the number of virtqueues correctly to the kernel.
>
> QEMU might be triggering this because, when vhost is stopped, the queue is
> still not empty (as expected, since it's a receive queue).
>
> Can you check that this is the case?

Yes, that is the case.

>
> If so, patching QEMU is correct, but you need to change VIRTIO_SCSI(vdev) to
> VIRTIO_SCSI_COMMON(vdev), and move events_dropped from VirtIOSCSI to
> VirtIOSCSICommon.

This approach should be better.

Thanks,
--
Ming Lei

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Nicholas A. Bellinger]

Hi Ming & Paolo,

On Wed, 2014-06-18 at 23:11 +0800, Ming Lei wrote:
> On Wed, Jun 18, 2014 at 11:06 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> > Il 18/06/2014 17:02, Paolo Bonzini ha scritto:
> >
> >> Il 18/06/2014 16:18, Ming Lei ha scritto:
> >>>>
> >>>> > This should never be triggered by vhost-scsi.  Perhaps a bug in the
> >>>> kernel?
> >>>
> >>> It can be triggered with rmmod, system suspend, reboot...
> >>
> >>
> >> Yes, but it should not.
> >>
> >> What happens if you change VHOST_SCSI_VQ_NUM_FIXED from 2 to 3?
> >
> >
> > Sorry, brain fart here.  The number of interrupts in virtio-scsi is queues+3
> > because of the configuration interrupt.  This does not apply here.
> >
> > Anyway, vhost-scsi passes the number of virtqueues correctly to the kernel.
> >
> > QEMU might be triggering this because, when vhost is stopped, the queue is
> > still not empty (as expected, since it's a receive queue).
> >
> > Can you check that this is the case?
> 
> Yes, that is the case.
> 
> >
> > If so, patching QEMU is correct, but you need to change VIRTIO_SCSI(vdev) to
> > VIRTIO_SCSI_COMMON(vdev), and move events_dropped from VirtIOSCSI to
> > VirtIOSCSICommon.
> 
> This approach should be better.

Just curious if this patch was picked up by upstream yet, and if it
needs to be CC'd to stable for vhost-scsi code in >= v1.5.y ..?

Thanks,

--nab

Re: [Qemu-devel] [PATCH] virtio-scsi: fix object check failure

[Ming Lei]

On Sat, Jul 26, 2014 at 7:10 AM, Nicholas A. Bellinger
<nab@linux-iscsi.org> wrote:
> Hi Ming & Paolo,
>
> On Wed, 2014-06-18 at 23:11 +0800, Ming Lei wrote:
>> On Wed, Jun 18, 2014 at 11:06 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>> > Il 18/06/2014 17:02, Paolo Bonzini ha scritto:
>> >
>> >> Il 18/06/2014 16:18, Ming Lei ha scritto:
>> >>>>
>> >>>> > This should never be triggered by vhost-scsi.  Perhaps a bug in the
>> >>>> kernel?
>> >>>
>> >>> It can be triggered with rmmod, system suspend, reboot...
>> >>
>> >>
>> >> Yes, but it should not.
>> >>
>> >> What happens if you change VHOST_SCSI_VQ_NUM_FIXED from 2 to 3?
>> >
>> >
>> > Sorry, brain fart here.  The number of interrupts in virtio-scsi is queues+3
>> > because of the configuration interrupt.  This does not apply here.
>> >
>> > Anyway, vhost-scsi passes the number of virtqueues correctly to the kernel.
>> >
>> > QEMU might be triggering this because, when vhost is stopped, the queue is
>> > still not empty (as expected, since it's a receive queue).
>> >
>> > Can you check that this is the case?
>>
>> Yes, that is the case.
>>
>> >
>> > If so, patching QEMU is correct, but you need to change VIRTIO_SCSI(vdev) to
>> > VIRTIO_SCSI_COMMON(vdev), and move events_dropped from VirtIOSCSI to
>> > VirtIOSCSICommon.
>>
>> This approach should be better.
>
> Just curious if this patch was picked up by upstream yet, and if it
> needs to be CC'd to stable for vhost-scsi code in >= v1.5.y ..?

Below is the merged version which has been marked as stable:

http://git.qemu.org/?p=qemu.git;a=commit;h=91d670fbf9945ca4ecbd123affb36889e7fe8a5d

Thanks,