Thanks for your reply.
I tried your patch but it didn't work for qemu crashed. The qemu
crash bt is below:
(gdb) bt
#0 bdrv_detach_aio_context (address@hidden)
#1 0x000055a9688249ae in bdrv_set_aio_context
(address@hidden,
address@hidden)
#2 0x000055a96885f721 in blk_set_aio_context (blk=0x55a96b792820,
new_context=0x55a96b766920)
#3 0x000055a9685ab797 in virtio_blk_data_plane_stop (vdev=<optimized
out>)
#4 0x000055a9687bf705 in virtio_bus_stop_ioeventfd (bus=0x55a96cc42220)
#5 0x000055a9685d9d94 in virtio_vmstate_change
(opaque=0x55a96cc42290, running=<optimized out>,
state=<optimized out>)
#6 0x000055a96866e1a2 in vm_state_notify (address@hidden,
address@hidden)
#7 0x000055a96857b4c5 in do_vm_stop (state=RUN_STATE_PAUSED)
#8 vm_stop (address@hidden)
#9 0x000055a96867d52b in qmp_stop (address@hidden)
#10 0x000055a96867b6ab in qmp_marshal_stop (args=<optimized out>,
ret=<optimized out>, errp=0x7fff4e54a
#11 0x000055a9688c2267 in do_qmp_dispatch (errp=0x7fff4e54a118,
request=0x55a96b7b4740)
#12 qmp_dispatch (address@hidden)
#13 0x000055a96857dd42 in handle_qmp_command (parser=<optimized out>,
tokens=<optimized out>)
#14 0x000055a9688c7534 in json_message_process_token
(lexer=0x55a96b776a68, input=0x55a96b70cae0, type=
x=36, y=91)
#15 0x000055a9688e960b in json_lexer_feed_char
(address@hidden, ch=125 '}',
address@hidden)
#16 0x000055a9688e96ce in json_lexer_feed (lexer=0x55a96b776a68,
buffer=<optimized out>, size=<optimize
#17 0x000055a9688c75f9 in json_message_parser_feed (parser=<optimized
out>, buffer=<optimized out>,
#18 0x000055a96857c5fb in monitor_qmp_read (opaque=<optimized out>,
buf=<optimized out>, size=<optimized out>)
#19 0x000055a968667596 in tcp_chr_read (chan=<optimized out>,
cond=<optimized out>, opaque=0x55a96b7748
#20 0x00007f8a9447899a in g_main_context_dispatch () from
/lib64/libglib-2.0.so.0
#21 0x000055a968828c3c in glib_pollfds_poll ()
#22 os_host_main_loop_wait (timeout=<optimized out>)
#23 main_loop_wait (nonblocking=<optimized out>)
#24 0x000055a96854351f in main_loop () at vl.c:2095
#25 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized
out>)
(gdb) p *bs
$1 = {total_sectors = 94186141054112, open_flags = 1811887680,
read_only = 169, encrypted = 85, valid_k
sg = false, probed = false, copy_on_read = 0, flush_queue =
{entries = {sqh_first = 0x0,
sqh_last = 0x55a96b79ca48}}, active_flush_req = false,
flushed_gen = 68727, drv = 0x0, opaque = 0
aio_context = 0x55a96b778cd0, aio_notifiers = {lh_first = 0x0},
walking_aio_notifiers = false,
filename = "/mnt/sdb/lzg/disk_10G.son", '\000' <repeats 4070 times>,
backing_file = "\000mnt/sdb/lzg/disk_10G.raw", '\000' <repeats 4070
times>,
backing_format = "\000aw", '\000' <repeats 12 times>,
full_open_options = 0x0,
exact_filename = "/mnt/sdb/lzg/disk_10G.son", '\000' <repeats 4070
times>, backing = 0x0, file = 0x0,
before_write_notifiers = {notifiers = {lh_first = 0x0}}, in_flight
= 0, serialising_in_flight = 0,
wakeup = false, wr_highest_offset = 35188224, bl =
{request_alignment = 0, max_pdiscard = 0,
pdiscard_alignment = 0, max_pwrite_zeroes = 0,
pwrite_zeroes_alignment = 0, opt_transfer = 0, max_t
min_mem_alignment = 0, opt_mem_alignment = 0, max_iov = 0},
supported_write_flags = 0,
supported_zero_flags = 4, node_name = "#block349", '\000' <repeats
22 times>, node_list = {
tqe_next = 0x55a96b7b14f0, tqe_prev = 0x0}, bs_list = {tqe_next =
0x55a96b7ab240, tqe_prev = 0x0},
monitor_list = {tqe_next = 0x0, tqe_prev = 0x0}, dirty_bitmaps =
{lh_first = 0x0}, refcnt = 0,
tracked_requests = {lh_first = 0x0}, op_blockers = {{lh_first =
0x0} <repeats 18 times>}, job = 0x0,
inherits_from = 0x0, children = {lh_first = 0x0}, parents =
{lh_first = 0x0}, options = 0x0,
explicit_options = 0x0, detect_zeroes =
BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, backing_blocker = 0x0,
write_threshold_offset = 0, write_threshold_notifier = {notify =
0x0, node = {le_next = 0x0, le_prev
io_plugged = 0, quiesce_counter = 0, write_gen = 68727}
(gdb) p *bs->drv
Cannot access memory at address 0x0
From the bt we can see, qemu met a Null pointer reference in
bdrv_detach_aio_context. The code is below:
void bdrv_detach_aio_context(BlockDriverState *bs)
{
.........
QLIST_FOREACH_SAFE(baf, &bs->aio_notifiers, list, baf_tmp) {
if (baf->deleted) {
bdrv_do_remove_aio_context_notifier(baf);
} else {
baf->detach_aio_context(baf->opaque);
}
}
/* Never mind iterating again to check for ->deleted.
bdrv_close() will
* remove remaining aio notifiers if we aren't called again.
*/
bs->walking_aio_notifiers = false;
if (bs->drv->bdrv_detach_aio_context) {
bs->drv->bdrv_detach_aio_context(bs);
}
..................
}
In your patch, the mirror_exit is done in
aio_poll(qemu_get_aio_context(), true). In
mirror_exit, the top bs willl be free by bdrv_unref. So it will make a
Null pointer access in the follow-up procedure.
On 2018/6/10 15:43, Fam Zheng wrote:
On Sat, 06/09 17:10, l00284672 wrote:
Hi, I found a dead loop in qemu when do blockJobAbort and vm suspend
coinstantaneously.
The qemu bt is below:
#0 0x00007ff58b53af1f in ppoll () from /lib64/libc.so.6
#1 0x00000000007fdbd9 in ppoll (__ss=0x0, __timeout=0x7ffcf7055390,
__nfds=<optimized out>, __fds=<optimized out>) at
/usr/include/bits/poll2.h:77
#2 qemu_poll_ns (fds=<optimized out>, nfds=<optimized out>,
address@hidden) at util/qemu-timer.c:334
#3 0x00000000007ff83a in aio_poll (address@hidden,
address@hidden) at util/aio-posix.c:629
#4 0x0000000000776e91 in bdrv_drain_recurse (address@hidden) at
block/io.c:198
#5 0x0000000000776ef2 in bdrv_drain_recurse (address@hidden) at
block/io.c:215
#6 0x00000000007774b8 in bdrv_do_drained_begin (bs=0x3665990,
recursive=<optimized out>, parent=0x0) at block/io.c:291
#7 0x000000000076a79e in blk_drain (blk=0x2780fc0) at
block/block-backend.c:1586
#8 0x000000000072d2a9 in block_job_drain (job=0x29df040) at blockjob.c:123
#9 0x000000000072d228 in block_job_detach_aio_context (opaque=0x29df040) at
blockjob.c:139
#10 0x00000000007298b1 in bdrv_detach_aio_context (address@hidden) at
block.c:4885
#11 0x0000000000729a46 in bdrv_set_aio_context (bs=0x3665990,
new_context=0x268e140) at block.c:4946
#12 0x0000000000499743 in virtio_blk_data_plane_stop (vdev=<optimized out>)
at
/mnt/sdb/lzg/code/shequ_code/5_29/qemu/hw/block/dataplane/virtio-blk.c:285
#13 0x00000000006bce30 in virtio_bus_stop_ioeventfd (bus=0x3de5378) at
hw/virtio/virtio-bus.c:246
#14 0x00000000004c654d in virtio_vmstate_change (opaque=0x3de53f0,
running=<optimized out>, state=<optimized out>)
at /mnt/sdb/lzg/code/shequ_code/5_29/qemu/hw/virtio/virtio.c:2222
#15 0x0000000000561b52 in vm_state_notify (address@hidden,
address@hidden) at vl.c:1514
#16 0x000000000045d67a in do_vm_stop (address@hidden,
address@hidden)
at /mnt/sdb/lzg/code/shequ_code/5_29/qemu/cpus.c:1012
#17 0x000000000045dafd in vm_stop (address@hidden) at
/mnt/sdb/lzg/code/shequ_code/5_29/qemu/cpus.c:2035
#18 0x000000000057301b in qmp_stop (address@hidden) at
qmp.c:106
#19 0x000000000056bf7a in qmp_marshal_stop (args=<optimized out>,
ret=<optimized out>, errp=0x7ffcf7055738) at qapi/qapi-commands-misc.c:784
#20 0x00000000007f2d27 in do_qmp_dispatch (errp=0x7ffcf7055730,
request=0x3e121e0, cmds=<optimized out>) at qapi/qmp-dispatch.c:119
#21 qmp_dispatch (cmds=<optimized out>, address@hidden) at
qapi/qmp-dispatch.c:168
#22 0x00000000004655be in monitor_qmp_dispatch_one
(address@hidden) at
/mnt/sdb/lzg/code/shequ_code/5_29/qemu/monitor.c:4088
#23 0x0000000000465894 in monitor_qmp_bh_dispatcher (data=<optimized out>)
at /mnt/sdb/lzg/code/shequ_code/5_29/qemu/monitor.c:4146
#24 0x00000000007fc571 in aio_bh_call (bh=0x26de7e0) at util/async.c:90
#25 aio_bh_poll (address@hidden) at util/async.c:118
#26 0x00000000007ff6f0 in aio_dispatch (ctx=0x268dd50) at
util/aio-posix.c:436
#27 0x00000000007fc44e in aio_ctx_dispatch (source=<optimized out>,
callback=<optimized out>, user_data=<optimized out>) at util/async.c:261
#28 0x00007ff58bc7c99a in g_main_context_dispatch () from
/lib64/libglib-2.0.so.0
#29 0x00000000007fea3a in glib_pollfds_poll () at util/main-loop.c:215
#30 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:238
#31 main_loop_wait (address@hidden) at util/main-loop.c:497
#32 0x0000000000561cad in main_loop () at vl.c:1848
#33 0x000000000041995c in main (argc=<optimized out>, argv=<optimized out>,
envp=<optimized out>) at vl.c:4605
The disk is a virtio-blk dataplane disk with a mirror job running. The dead
loop is here:
static void block_job_detach_aio_context(void *opaque)
{
BlockJob *job = opaque;
/* In case the job terminates during aio_poll()... */
job_ref(&job->job);
job_pause(&job->job);
while (!job->job.paused && !job_is_completed(&job->job)) {
job_drain(&job->job);
}
job->job.aio_context = NULL;
job_unref(&job->job);
}
The job is deferred to main loop now, but the job_drain only processes the
AIO context of bs which has no more work to do,
while the main loop BH is scheduled for setting the job->completed flag is
never processed.
In that case, main loop's AioContext should be driven like in job_finish_sync().
Could you try this patch?
diff --git a/blockjob.c b/blockjob.c
index 0306533a2e..72aa82ac2d 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -135,7 +135,15 @@ static void block_job_detach_aio_context(void *opaque)
job_pause(&job->job);
- while (!job->job.paused && !job_is_completed(&job->job)) {
+
+ while (true) {
+ if (job->job.paused || job_is_completed(&job->job)) {
+ break;
+ }
+ if (job->deferred_to_main_loop) {
+ aio_poll(qemu_get_aio_context(), true);
+ continue;
+ }
job_drain(&job->job);
}
.
lizhengui.vcf