virtio: Return true from virtio_queue_empty if broken

Both virtio-blk and virtio-scsi use virtio_queue_empty() as the
loop condition in VQ handlers (virtio_blk_handle_vq,
virtio_scsi_handle_cmd_vq). When a device is marked broken in
virtqueue_pop, for example if a vIOMMU address translation failed, we
want to break out of the loop.

This fixes a hanging problem when booting a CentOS 3.10.0-862.el7.x86_64
kernel with ATS enabled:

  $ qemu-system-x86_64 \
    ... \
    -device intel-iommu,intremap=on,caching-mode=on,eim=on,device-iotlb=on \
    -device virtio-scsi-pci,iommu_platform=on,ats=on,id=scsi0,bus=pci.4,addr=0x0

The dead loop happens immediately when the kernel boots and initializes
the device, where virtio_scsi_data_plane_handle_cmd will not return:

    > ...
    > qemu#13 0x00005586602b7793 in virtio_scsi_handle_cmd_vq
    > qemu#14 0x00005586602b8d66 in virtio_scsi_data_plane_handle_cmd
    > qemu#15 0x00005586602ddab7 in virtio_queue_notify_aio_vq
    > qemu#16 0x00005586602dfc9f in virtio_queue_host_notifier_aio_poll
    > qemu#17 0x00005586607885da in run_poll_handlers_once
    > qemu#18 0x000055866078880e in try_poll_mode
    > qemu#19 0x00005586607888eb in aio_poll
    > qemu#20 0x0000558660784561 in aio_wait_bh_oneshot
    > qemu#21 0x00005586602b9582 in virtio_scsi_dataplane_stop
    > qemu#22 0x00005586605a7110 in virtio_bus_stop_ioeventfd
    > qemu#23 0x00005586605a9426 in virtio_pci_stop_ioeventfd
    > qemu#24 0x00005586605ab808 in virtio_pci_common_write
    > qemu#25 0x0000558660242396 in memory_region_write_accessor
    > qemu#26 0x00005586602425ab in access_with_adjusted_size
    > qemu#27 0x0000558660245281 in memory_region_dispatch_write
    > qemu#28 0x00005586601e008e in flatview_write_continue
    > qemu#29 0x00005586601e01d8 in flatview_write
    > qemu#30 0x00005586601e04de in address_space_write
    > qemu#31 0x00005586601e052f in address_space_rw
    > qemu#32 0x00005586602607f2 in kvm_cpu_exec
    > qemu#33 0x0000558660227148 in qemu_kvm_cpu_thread_fn
    > qemu#34 0x000055866078bde7 in qemu_thread_start
    > qemu#35 0x00007f5784906594 in start_thread
    > qemu#36 0x00007f5784639e6f in clone

With this patch, virtio_queue_empty will now return 1 as soon as the
vdev is marked as broken, after a "virtio: zero sized buffers are not
allowed" error.

To be consistent, update virtio_queue_empty_rcu as well.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20180910145616.8598-2-famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

hw/virtio/virtio.c

@@ -358,6 +358,10 @@ int virtio_queue_ready(VirtQueue *vq)
  * Called within rcu_read_lock().  */
 static int virtio_queue_empty_rcu(VirtQueue *vq)
 {
+    if (unlikely(vq->vdev->broken)) {
+        return 1;
+    }
+
     if (unlikely(!vq->vring.avail)) {
         return 1;
     }
@@ -373,6 +377,10 @@ int virtio_queue_empty(VirtQueue *vq)
 {
     bool empty;
 
+    if (unlikely(vq->vdev->broken)) {
+        return 1;
+    }
+
     if (unlikely(!vq->vring.avail)) {
         return 1;
     }