linux-user: call cpu_copy under clone_lock
PATCH 1/1 linux-user: call cpu_copy under clone_lock
cpu_copy adds newly created CPU object to container/machine/unattached, but does it w/o proper locking. As a result when multiple threads are created rapidly QEMU may abort with the following message:
GLib-CRITICAL **: g_hash_table_iter_next: assertion 'ri->version == ri->hash_table->version' failed
ERROR:qemu/qom/object.c:1663:object_get_canonical_path_component:
code should not be reached
Move cpu_copy invocation under clone_lock to fix that.
--- linux-user/syscall.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
linux-user/syscall.c +4 -3
@@ -6346,6 +6346,10 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp, ts =g_new0 (TaskState,1 );init_task_state (ts); + +/* Grab a mutex so that thread setup appears atomic. */ +pthread_mutex_lock (&clone_lock); +/* we create a new CPU instance. */ new_env =cpu_copy (env);/* Init regs that differ from the parent. */
@@ -6364,9 +6368,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,cpu_set_tls (new_env, newtls); } -/* Grab a mutex so that thread setup appears atomic. */ -pthread_mutex_lock (&clone_lock); -memset (&info,0 ,sizeof (info));pthread_mutex_init (&info.mutex,NULL );pthread_mutex_lock (&info.mutex);
Signature · 1 line
2.11.0
Le 30/03/2018 à 15:35, Max Filippov a écrit :
Quoted 9 lines
cpu_copyadds newly created CPU object to container/machine/unattached, but does it w/o proper locking. As a result when multiple threads are created rapidly QEMU may abort with the following message:GLib-CRITICAL **:
g_hash_table_iter_next: assertion 'ri->version==ri->hash_table->version' failedERROR:qemu/qom/object.c:1663:object_get_canonical_path_component:
code should not be reached
Also reported in https://bugs.launchpad.net/qemu/+bug/1756519
Quoted 24 lines
Move
cpu_copyinvocation underclone_lockto fix that.Signed-off-by Max Filippov <[email protected]>--- linux-user/syscall.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)linux-user/syscall.c +4
-0@@ -6346,6 +6346,10 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp, ts =g_new0 (TaskState,1 );init_task_state (ts); + +/* Grab a mutex so that thread setup appears atomic. */ +pthread_mutex_lock (&clone_lock); +/* we create a new CPU instance. */ new_env =cpu_copy (env);/* Init regs that differ from the parent. */
linux-user/syscall.c static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp, · line 6373
Quoted 9 lines
linux-user/syscall.c +0
-3@@ -6364,9 +6368,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,cpu_set_tls (new_env, newtls); } -/* Grab a mutex so that thread setup appears atomic. */ -pthread_mutex_lock (&clone_lock); -memset (&info,0 ,sizeof (info));pthread_mutex_init (&info.mutex,NULL );pthread_mutex_lock (&info.mutex);
This series failed docker-quick@centos6 build test. Please find the testing commands and their output below. If you have Docker installed, you can probably reproduce it locally.
Hi,
This series failed docker-quick@centos6 build test. Please find the testing commands and their output below. If you have Docker installed, you can probably reproduce it locally.
Type: series
Message-id: [email protected]
Subject: [Qemu-devel] [PATCH] linux-user: call cpu_copy under clone_lock
=== TEST SCRIPT BEGIN ===
#!/bin/bash
set -e
git submodule update --init dtc
# Let docker tests dump environment info
export SHOW_ENV=1
export J=8
time make docker-test-quick@centos6
=== TEST SCRIPT END ===
Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384 Switched to a new branch 'test'92f42e73b0 linux-user: call cpu_copy under clone_lock
=== OUTPUT BEGIN ===
Submodule 'dtc' (git://git.qemu-project.org/dtc.git) registered for path 'dtc'
Cloning into '/var/tmp/patchew-tester-tmp-1gu7zpou/src/dtc'...
Submodule path 'dtc': checked out 'e54388015af1fb4bf04d0bca99caba1074d9cc42'
BUILD centos6
make[1]: Entering directory '/var/tmp/patchew-tester-tmp-1gu7zpou/src'
GEN /var/tmp/patchew-tester-tmp-1gu7zpou/src/docker-src.2018-03-31-04.54.53.27138/qemu.tar
Cloning into '/var/tmp/patchew-tester-tmp-1gu7zpou/src/docker-src.2018-03-31-04.54.53.27138/qemu.tar.vroot'... done.
Checking out files: 41% (2520/6066) Checking out files: 42% (2548/6066) Checking out files: 43% (2609/6066) Checking out files: 44% (2670/6066) Checking out files: 44% (2676/6066) Checking out files: 44% (2695/6066) Checking out files: 45% (2730/6066) Checking out files: 46% (2791/6066) Checking out files: 47% (2852/6066) Checking out files: 48% (2912/6066) Checking out files: 49% (2973/6066) Checking out files: 50% (3033/6066) Checking out files: 51% (3094/6066) Checking out files: 52% (3155/6066) Checking out files: 53% (3215/6066) Checking out files: 54% (3276/6066) Checking out files: 55% (3337/6066) Checking out files: 56% (3397/6066) Checking out files: 56% (3423/6066) Checking out files: 57% (3458/6066) Checking out files: 58% (3519/6066) Checking out files: 59% (3579/6066) Checking out files: 60% (3640/6066) Checking out files: 61% (3701/6066) Checking out files: 62% (3761/6066) Checking out files: 63% (3822/6066) Checking out files: 64% (3883/6066) Checking out files: 65% (3943/6066) Checking out files: 66% (4004/6066) Checking out files: 67% (4065/6066) Checking out files: 67% (4075/6066) Checking out files: 68% (4125/6066) Checking out files: 69% (4186/6066) Checking out files: 70% (4247/6066) Checking out files: 71% (4307/6066) Checking out files: 72% (4368/6066) Checking out files: 73% (4429/6066) Checking out files: 74% (4489/6066) Checking out files: 75% (4550/6066) Checking out files: 76% (4611/6066) Checking out files: 77% (4671/6066) Checking out files: 78% (4732/6066) Checking out files: 79% (4793/6066) Checking out files: 79% (4810/6066) Checking out files: 80% (4853/6066) Checking out files: 81% (4914/6066) Checking out files: 82% (4975/6066) Checking out files: 83% (5035/6066) Checking out files: 84% (5096/6066) Checking out files: 85% (5157/6066) Checking out files: 86% (5217/6066) Checking out files: 87% (5278/6066) Checking out files: 88% (5339/6066) Checking out files: 89% (5399/6066) Checking out files: 90% (5460/6066) Checking out files: 91% (5521/6066) Checking out files: 92% (5581/6066) Checking out files: 93% (5642/6066) Checking out files: 94% (5703/6066) Checking out files: 95% (5763/6066) Checking out files: 96% (5824/6066) Checking out files: 97% (5885/6066) Checking out files: 98% (5945/6066) Checking out files: 99% (6006/6066) Checking out files: 100% (6066/6066) Checking out files: 100% (6066/6066), done.
Your branch is up-to-date with 'origin/test'.
Submodule 'dtc' (git://git.qemu-project.org/dtc.git) registered for path 'dtc'
Cloning into '/var/tmp/patchew-tester-tmp-1gu7zpou/src/docker-src.2018-03-31-04.54.53.27138/qemu.tar.vroot/dtc'... Submodule path 'dtc': checked out 'e54388015af1fb4bf04d0bca99caba1074d9cc42'
Submodule 'ui/keycodemapdb' (git://git.qemu.org/keycodemapdb.git) registered for path 'ui/keycodemapdb' Cloning into '/var/tmp/patchew-tester-tmp-1gu7zpou/src/docker-src.2018-03-31-04.54.53.27138/qemu.tar.vroot/ui/keycodemapdb'... Submodule path 'ui/keycodemapdb': checked out '6b3d716e2b6472eb7189d3220552280ef3d832ce'
tar: /var/tmp/patchew-tester-tmp-1gu7zpou/src/docker-src.2018-03-31-04.54.53.27138/qemu.tar: Wrote only 2048 of 10240 bytes
tar: Error is not recoverable: exiting now
failed to create tar file
COPY RUNNER
RUN test-quick in qemu:centos6
tar: Unexpected EOF in archive
tar: rmtlseek not stopped at a record boundary
tar: Error is not recoverable: exiting now/var/tmp/qemu/run: line 32: prep_fail: command not found
Packages installed:
SDL-devel-1.2.14-7.el6_7.1.x86_64
bison-2.4.1-5.el6.x86_64
bzip2-devel-1.0.5-7.el6_0.x86_64
ccache-3.1.6-2.el6.x86_64
csnappy-devel-0-6.20150729gitd7bc683.el6.x86_64
flex-2.5.35-9.el6.x86_64
gcc-4.4.7-18.el6.x86_64
gettext-0.17-18.el6.x86_64
git-1.7.1-9.el6_9.x86_64
glib2-devel-2.28.8-9.el6.x86_64
libepoxy-devel-1.2-3.el6.x86_64
libfdt-devel-1.4.0-1.el6.x86_64
librdmacm-devel-1.0.21-0.el6.x86_64
lzo-devel-2.03-3.1.el6_5.1.x86_64
make-3.81-23.el6.x86_64
mesa-libEGL-devel-11.0.7-4.el6.x86_64
mesa-libgbm-devel-11.0.7-4.el6.x86_64
package g++ is not installed
pixman-devel-0.32.8-1.el6.x86_64
spice-glib-devel-0.26-8.el6.x86_64
spice-server-devel-0.12.4-16.el6.x86_64
tar-1.23-15.el6_8.x86_64
vte-devel-0.25.1-9.el6.x86_64
xen-devel-4.6.6-2.el6.x86_64
zlib-devel-1.2.3-29.el6.x86_64
Environment variables:
PACKAGES=bison bzip2-devel ccache csnappy-devel flex g++ gcc gettext git glib2-devel libepoxy-devel libfdt-devel librdmacm-devel lzo-devel make mesa-libEGL-devel mesa-libgbm-devel pixman-devel SDL-devel spice-glib-devel spice-server-devel tar vte-devel xen-devel zlib-devel
HOSTNAME=53ead536cc4a
MAKEFLAGS= -j8
J=8
CCACHE_DIR=/var/tmp/ccache
EXTRA_CONFIGURE_OPTS=
V=
SHOW_ENV=1 PATH=/usr/lib/ccache:/usr/lib64/ccache:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin PWD=/
TARGET_LIST=
SHLVL=1
HOME=/root
TEST_DIR=/tmp/qemu-test
FEATURES= dtc
DEBUG=
_=/usr/bin/env
/var/tmp/qemu/run: line 52: cd: /tmp/qemu-test/src/tests/docker: No such file or directory /var/tmp/qemu/run: line 57: /test-quick: No such file or directory /var/tmp/qemu/run: line 57: exec: /test-quick: cannot execute: No such file or directory Traceback (most recent call last):
File "./tests/docker/docker.py", line 407, in <module>
sys.exit(main())
File "./tests/docker/docker.py", line 404, in main
return args.cmdobj.run(args, argv)
File "./tests/docker/docker.py", line 261, in run
return Docker().run(argv, args.keep, quiet=args.quiet)
File "./tests/docker/docker.py", line 229, in run
quiet=quiet)
File "./tests/docker/docker.py", line 147, in _do_check
return subprocess.check_call(self._command + cmd, **kwargs)
File "/usr/lib64/python2.7/subprocess.py", line 186, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['docker', 'run', '--label', 'com.qemu.instance.uuid=3958b04c34c111e8aedb52540069c830', '-u', '0', '--security-opt', 'seccomp=unconfined', '--rm', '--net=none', '-e', 'TARGET_LIST=', '-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=8', '-e', 'DEBUG=', '-e', 'SHOW_ENV=1', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', '/root/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', '/var/tmp/patchew-tester-tmp-1gu7zpou/src/docker-src.2018-03-31-04.54.53.27138:/var/tmp/qemu:z,ro', 'qemu:centos6', '/var/tmp/qemu/run', 'test-quick']' returned non-zero exit status 126 make[1]: *** [tests/docker/Makefile.include:129: docker-run] Error 1
make[1]: Leaving directory '/var/tmp/patchew-tester-tmp-1gu7zpou/src'
make: *** [tests/docker/Makefile.include:163: docker-run-test-quick@centos6] Error 2
real 0m31.842s
user 0m9.193s
sys 0m6.370s
=== OUTPUT END ===
Test command exited with code: 2
---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to [email protected]
Quoted 11 lines · Max Filippov
cpu_copyadds newly created CPU object to container/machine/unattached, but does it w/o proper locking. As a result when multiple threads are created rapidly QEMU may abort with the following message:GLib-CRITICAL **:
g_hash_table_iter_next: assertion 'ri->version==ri->hash_table->version' failedERROR:qemu/qom/object.c:1663:object_get_canonical_path_component:
code should not be reachedMove
cpu_copyinvocation underclone_lockto fix that.
So my main concern is are we duplicating something already (should be?) handled by fork_start/fork_end?
This serialises forks and ensures things like the cpu_list (which ~ a thread list for linux-user) are updated safely.
Quoted 22 lines
Signed-off-by Max Filippov <[email protected]>--- linux-user/syscall.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)linux-user/syscall.c +4
-0@@ -6346,6 +6346,10 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp, ts =g_new0 (TaskState,1 );init_task_state (ts); + +/* Grab a mutex so that thread setup appears atomic. */ +pthread_mutex_lock (&clone_lock); +/* we create a new CPU instance. */ new_env =cpu_copy (env);/* Init regs that differ from the parent. */
linux-user/syscall.c static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp, · line 6373
Quoted 9 lines
linux-user/syscall.c +0
-3@@ -6364,9 +6368,6 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,cpu_set_tls (new_env, newtls); } -/* Grab a mutex so that thread setup appears atomic. */ -pthread_mutex_lock (&clone_lock); -memset (&info,0 ,sizeof (info));pthread_mutex_init (&info.mutex,NULL );pthread_mutex_lock (&info.mutex);
--
Alex Bennée
Hi Alex,
Quoted 9 lines · Alex Bennée
Quoted 7 lines · Max Filippov
cpu_copyadds newly created CPU object to container/machine/unattached, but does it w/o proper locking. As a result when multiple threads are created rapidly QEMU may abort with the following message:GLib-CRITICAL **:
g_hash_table_iter_next: assertion 'ri->version==ri->hash_table->version' failed
Quoted 7 lines
Quoted 4 lines
ERROR:qemu/qom/object.c:1663:object_get_canonical_path_component:
code should not be reachedMove
cpu_copyinvocation underclone_lockto fix that.So my main concern is are we duplicating something already (should be?) handled by fork_start/fork_end?
clone_lock already exists, it protects state in case of thread creation, it just didn't protect enough of it.
The work done by fork_start/fork_end appears to be heavier than what's needed for thread creation, because fork_start stops all other CPUs (to make sure that child process won't get locks owned by threads that no longer exist in the child process), which is not required for thread creation, hence thread creation uses clone_lock.
Quoted 2 lines
This serialises forks and ensures things like the
cpu_list(which ~ a thread list for linux-user) are updated safely.
Signature · 2 lines
Thanks. -- Max
Quoted 20 lines · Max Filippov
Hi Alex,
Quoted 9 lines · Alex Bennée
Quoted 7 lines · Max Filippov
cpu_copyadds newly created CPU object to container/machine/unattached, but does it w/o proper locking. As a result when multiple threads are created rapidly QEMU may abort with the following message:GLib-CRITICAL **:
g_hash_table_iter_next: assertion 'ri->version==ri->hash_table->version' failedQuoted 7 lines
Quoted 4 lines
ERROR:qemu/qom/object.c:1663:object_get_canonical_path_component:
code should not be reachedMove
cpu_copyinvocation underclone_lockto fix that.So my main concern is are we duplicating something already (should be?) handled by fork_start/fork_end?
Quoted 8 lines
clone_lockalready exists, it protects state in case of thread creation, it just didn't protect enough of it.The work done by fork_start/fork_end appears to be heavier than what's needed for thread creation, because
fork_startstops all other CPUs (to make sure that child process won't get locks owned by threads that no longer exist in the child process), which is not required for thread creation, hence thread creation usesclone_lock.
I'm wondering if it should be doing more. After all start/end_exclusive rely on the cpu list and that isn't updated on thread creation - and without that a bunch of other things fail like ld/st exclusive after your first new thread is spawned.
This really needs some test cases to check.
So while I think clone_lock fixes this immediate problem I suspect there is more to do for this case.
Quoted 3 lines
Quoted 3 lines
This serialises forks and ensures things like the
cpu_list(which ~ a thread list for linux-user) are updated safely.
--
Alex Bennée
Quoted 4 lines · Alex Bennée
I'm wondering if it should be doing more. After all start/end_exclusive rely on the cpu list and that isn't updated on thread creation - and without that a bunch of other things fail like ld/st exclusive after your first new thread is spawned.
I think that is handled because creating a new thread calls cpu_copy(), which creates a new CPU object, which adds itself to the CPU list in its realize function (same as for system emulation new CPU objects).
thanks
-- PMM
Quoted 10 lines · Peter Maydell
Quoted 4 lines · Alex Bennée
I'm wondering if it should be doing more. After all start/end_exclusive rely on the cpu list and that isn't updated on thread creation - and without that a bunch of other things fail like ld/st exclusive after your first new thread is spawned.
I think that is handled because creating a new thread calls
cpu_copy(), which creates a new CPU object, which adds itself to the CPU list in its realize function (same as for system emulation new CPU objects).
Ahh that makes sense - I missed it hidden behind the realize.
--
Alex Bennée