Changeset 64808 in vbox

Timestamp:

Dec 8, 2016 12:08:01 PM (8 years ago)

Author:

vboxsync

Message:

LsiLogic: Protect the request queue and writes to the reply free queue against concurrent access from the guest when using multiple vCPUs, should fix task aborts observed with Linux kernels starting from at least 3.18 (maybe even earlier, last known godd kernel is 3.14)

Location:

trunk/src/VBox/Devices

Files:

• Storage/DevLsiLogicSCSI.cpp (modified) (6 diffs)
• testcase/tstDeviceStructSizeRC.cpp (modified) (1 diff)

trunk/src/VBox/Devices/Storage/DevLsiLogicSCSI.cpp

@@ -287 +287 @@
     /** Critical section protecting the reply free queue. */
     PDMCRITSECT           ReplyFreeQueueCritSect;
+    /** Critical section protecting the request queue against
+     * concurrent access from the guest. */
+    PDMCRITSECT           RequestQueueCritSect;
+    /** Critical section protecting the reply free queue against
+     * concurrent write access from the guest. */
+    PDMCRITSECT           ReplyFreeQueueWriteCritSect;
 
     /** Pointer to the start of the reply free queue - R3. */
@@ -1276 +1282 @@
         case LSILOGIC_REG_REPLY_QUEUE:
         {
+            int rc = PDMCritSectEnter(&pThis->ReplyFreeQueueWriteCritSect, VINF_IOM_R3_MMIO_WRITE);
+            if (rc != VINF_SUCCESS)
+                return rc;
             /* Add the entry to the reply free queue. */
             ASMAtomicWriteU32(&pThis->CTX_SUFF(pReplyFreeQueueBase)[pThis->uReplyFreeQueueNextEntryFreeWrite], u32);
             pThis->uReplyFreeQueueNextEntryFreeWrite++;
             pThis->uReplyFreeQueueNextEntryFreeWrite %= pThis->cReplyQueueEntries;
+            PDMCritSectLeave(&pThis->ReplyFreeQueueWriteCritSect);
             break;
         }
         case LSILOGIC_REG_REQUEST_QUEUE:
         {
+            int rc = PDMCritSectEnter(&pThis->RequestQueueCritSect, VINF_IOM_R3_MMIO_WRITE);
+            if (rc != VINF_SUCCESS)
+                return rc;
+
             uint32_t uNextWrite = ASMAtomicReadU32(&pThis->uRequestQueueNextEntryFreeWrite);
 
@@ -1297 +1311 @@
             uNextWrite %= pThis->cRequestQueueEntries;
             ASMAtomicWriteU32(&pThis->uRequestQueueNextEntryFreeWrite, uNextWrite);
+            PDMCritSectLeave(&pThis->RequestQueueCritSect);
 
             /* Send notification to R3 if there is not one sent already. Do this
@@ -1310 +1325 @@
 #else
                     LogFlowFunc(("Signal event semaphore\n"));
-                    int rc = SUPSemEventSignal(pThis->pSupDrvSession, pThis->hEvtProcess);
+                    rc = SUPSemEventSignal(pThis->pSupDrvSession, pThis->hEvtProcess);
                     AssertRC(rc);
 #endif
@@ -5305 +5320 @@
     PDMR3CritSectDelete(&pThis->ReplyFreeQueueCritSect);
     PDMR3CritSectDelete(&pThis->ReplyPostQueueCritSect);
+    PDMR3CritSectDelete(&pThis->RequestQueueCritSect);
+    PDMR3CritSectDelete(&pThis->ReplyFreeQueueWriteCritSect);
 
     RTMemFree(pThis->paDeviceStates);
@@ -5470 +5487 @@
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc, N_("LsiLogic: cannot create critical section for reply post queue"));
+
+    rc = PDMDevHlpCritSectInit(pDevIns, &pThis->RequestQueueCritSect, RT_SRC_POS, "%sRQ", szDevTag);
+    if (RT_FAILURE(rc))
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("LsiLogic: cannot create critical section for request queue"));
+
+    rc = PDMDevHlpCritSectInit(pDevIns, &pThis->ReplyFreeQueueWriteCritSect, RT_SRC_POS, "%sRFQW", szDevTag);
+    if (RT_FAILURE(rc))
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("LsiLogic: cannot create critical section for reply free queue write access"));
 
     /*

trunk/src/VBox/Devices/testcase/tstDeviceStructSizeRC.cpp

@@ -1745 +1745 @@
     GEN_CHECK_OFF(LSILOGICSCSI, ReplyPostQueueCritSect);
     GEN_CHECK_OFF(LSILOGICSCSI, ReplyFreeQueueCritSect);
+    GEN_CHECK_OFF(LSILOGICSCSI, RequestQueueCritSect);
+    GEN_CHECK_OFF(LSILOGICSCSI, ReplyFreeQueueWriteCritSect);
     GEN_CHECK_OFF(LSILOGICSCSI, pReplyFreeQueueBaseR3);
     GEN_CHECK_OFF(LSILOGICSCSI, pReplyPostQueueBaseR3);