On Fri, Nov 12, 2021 at 6:04 PM Michael S. Tsirkin <m...@redhat.com> wrote: > > On Fri, Nov 12, 2021 at 10:23:12AM +0800, Jason Wang wrote: > > On Thu, Nov 11, 2021 at 4:27 PM Michael S. Tsirkin <m...@redhat.com> wrote: > > > > > > On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > > > > We used to access packed descriptor flags via > > > > address_space_{write|read}_cached(). When we hit the cache, memcpy() > > > > is used which is not an atomic operation which may lead a wrong value > > > > is read or wrote. > > > > > > Could you clarify where's the memcpy that you see? > > > Thanks! > > > > In the address_space_{write|read}_cached it self: > > > > static inline MemTxResult > > =>dress_space_write_cached(MemoryRegionCache *cache, hwaddr addr, > > const void *buf, hwaddr len) > > { > > assert(addr < cache->len && len <= cache->len - addr); > > if (likely(cache->ptr)) { > > memcpy(cache->ptr + addr, buf, len); > > return MEMTX_OK; > > } else { > > return address_space_write_cached_slow(cache, addr, buf, len); > > } > > } > > > > Thanks > > But that's a copy from the cache, not from guest memory.
I may miss something but it looks to me the cache is the cache of address translation not the cache from guest memory: See address_space_cache_init(): cache->ptr = qemu_ram_ptr_length(mr->ram_block, cache->xlat, &l, true); > I don't see how it can change so I don't see why it needs > to be atomic. Was there an actual issue you observed or > is this theoretical? During code review. Thanks > > > > > > > > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > > > > sure the aceess is atomic. > > > > > > > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > > > > Cc: qemu-sta...@nongnu.org > > > > Signed-off-by: Jason Wang <jasow...@redhat.com> > > > > --- > > > > hw/virtio/virtio.c | 11 ++++------- > > > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > > > > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > > > > index cc69a9b881..939bcbfeb9 100644 > > > > --- a/hw/virtio/virtio.c > > > > +++ b/hw/virtio/virtio.c > > > > @@ -507,11 +507,9 @@ static void > > > > vring_packed_desc_read_flags(VirtIODevice *vdev, > > > > MemoryRegionCache *cache, > > > > int i) > > > > { > > > > - address_space_read_cached(cache, > > > > - i * sizeof(VRingPackedDesc) + > > > > - offsetof(VRingPackedDesc, flags), > > > > - flags, sizeof(*flags)); > > > > - virtio_tswap16s(vdev, flags); > > > > + hwaddr off = i * sizeof(VRingPackedDesc) + > > > > offsetof(VRingPackedDesc, flags); > > > > + > > > > + *flags = virtio_lduw_phys_cached(vdev, cache, off); > > > > } > > > > > > > > static void vring_packed_desc_read(VirtIODevice *vdev, > > > > @@ -564,8 +562,7 @@ static void > > > > vring_packed_desc_write_flags(VirtIODevice *vdev, > > > > { > > > > hwaddr off = i * sizeof(VRingPackedDesc) + > > > > offsetof(VRingPackedDesc, flags); > > > > > > > > - virtio_tswap16s(vdev, &desc->flags); > > > > - address_space_write_cached(cache, off, &desc->flags, > > > > sizeof(desc->flags)); > > > > + virtio_stw_phys_cached(vdev, cache, off, desc->flags); > > > > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > > > > } > > > > > > > > -- > > > > 2.25.1 > > > >