[{"id":1772734,"web_url":"http://patchwork.ozlabs.org/comment/1772734/","msgid":"<a5b9c3ac-56fe-c29c-ed19-3eb5a5f159c2@redhat.com>","list_archive_url":null,"date":"2017-09-21T11:51:40","subject":"Re: [Qemu-devel] [PATCH qemu v5 04/18] memory: Move\n\tAddressSpaceDispatch from AddressSpace to FlatView","submitter":{"id":2701,"url":"http://patchwork.ozlabs.org/api/people/2701/","name":"Paolo Bonzini","email":"pbonzini@redhat.com"},"content":"On 21/09/2017 10:50, Alexey Kardashevskiy wrote:\n> * since FlatView::rcu is used now to dispose FV, call_rcu() in\n> address_space_update_topology() is replaced with direct call to\n> flatview_unref()\n\nHmm, this is not correct, as you could have\n\n\n   thread 1             thread 2             RCU thread\n  -------------------------------------------------------------\n   rcu_read_lock\n   read as->current_map\n                        set as->current_map\n                        flatview_unref\n                           '--> call_rcu\n   flatview_ref\n   rcu_read_unlock\n                                             flatview_destroy\n\nI need to think a bit more about this (and possibly ask Paul...).\n\nPaolo","headers":{"Return-Path":"<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=<UNKNOWN>)","Received":["from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xyZjC0ZJxz9s5L\n\tfor <incoming@patchwork.ozlabs.org>;\n\tThu, 21 Sep 2017 21:52:13 +1000 (AEST)","from localhost ([::1]:53069 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>)\n\tid 1dv01Y-0005A2-8M\n\tfor incoming@patchwork.ozlabs.org; Thu, 21 Sep 2017 07:52:08 -0400","from eggs.gnu.org ([2001:4830:134:3::10]:35023)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from <pbonzini@redhat.com>) id 1dv01F-00059n-MB\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 07:51:50 -0400","from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from <pbonzini@redhat.com>) id 1dv01A-0001zb-QU\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 07:51:49 -0400","from mail-wm0-f44.google.com ([74.125.82.44]:50840)\n\tby eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.71) (envelope-from <pbonzini@redhat.com>) id 1dv01A-0001zC-JQ\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 07:51:44 -0400","by mail-wm0-f44.google.com with SMTP id b195so1028019wmb.5\n\tfor <qemu-devel@nongnu.org>; Thu, 21 Sep 2017 04:51:44 -0700 (PDT)","from [192.168.10.165]\n\t(dynamic-adsl-78-12-246-117.clienti.tiscali.it. [78.12.246.117])\n\tby smtp.gmail.com with ESMTPSA id\n\t12sm1758687wmn.38.2017.09.21.04.51.41\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\n\tThu, 21 Sep 2017 04:51:41 -0700 (PDT)"],"X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=0k/s7Acnk7AKOVPOOS1l7WrseEi1tMYfG93/RoKb9xI=;\n\tb=TLUOEpscvCSkpKVNTiUj5QIRepzLyq5h48HDt94CKOYOXxli6DTjxfIGDxdDtAo5/H\n\tp+RMuD5xnTQBEPf2SPA7V/bBdYgNboKfMOKzemqYYel/M7uSArPfKvw8BY0FotSb7nfw\n\tkFFTGNketF2qd8GEfTtMNtd6CHQcW+ltjKvz5jv+Ua52UXJiYMHwF56bx2D8H60sExU3\n\tzTBBn6v6x33DenWe6rvFzvtB4vfpiXYiYeklwFX1QFWkSo7mQXNASo+6zvQYamI0t5Gz\n\tBpe+RD0aoYdLo6b18p6uzqnJoWQ6klPhbK7doZ1q445LareJnXI3gMI2iELHRm3EeDOc\n\tbwgw==","X-Gm-Message-State":"AHPjjUjzAQRZecm7AYLCXK6U2kyW6Ukz9SXC2NFc8eJKRJ1Ze6TU/8Bg\n\tKygerWgzI8oGa7qkUe3Zsn5qdvNwKLc=","X-Google-Smtp-Source":"AOwi7QDzX1q4/o79yVsPtq2Om7/3urbPhhRhqWDn6usreuDohkpjHbpsOn4mujiJjCq3oCg2qRdZkg==","X-Received":"by 10.28.66.16 with SMTP id p16mr840380wma.11.1505994703050;\n\tThu, 21 Sep 2017 04:51:43 -0700 (PDT)","To":"Alexey Kardashevskiy <aik@ozlabs.ru>, qemu-devel@nongnu.org","References":"<20170921085110.25598-1-aik@ozlabs.ru>\n\t<20170921085110.25598-5-aik@ozlabs.ru>","From":"Paolo Bonzini <pbonzini@redhat.com>","Message-ID":"<a5b9c3ac-56fe-c29c-ed19-3eb5a5f159c2@redhat.com>","Date":"Thu, 21 Sep 2017 13:51:40 +0200","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.3.0","MIME-Version":"1.0","In-Reply-To":"<20170921085110.25598-5-aik@ozlabs.ru>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-US","Content-Transfer-Encoding":"7bit","X-detected-operating-system":"by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]\n\t[fuzzy]","X-Received-From":"74.125.82.44","Subject":"Re: [Qemu-devel] [PATCH qemu v5 04/18] memory: Move\n\tAddressSpaceDispatch from AddressSpace to FlatView","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.21","Precedence":"list","List-Id":"<qemu-devel.nongnu.org>","List-Unsubscribe":"<https://lists.nongnu.org/mailman/options/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>","List-Archive":"<http://lists.nongnu.org/archive/html/qemu-devel/>","List-Post":"<mailto:qemu-devel@nongnu.org>","List-Help":"<mailto:qemu-devel-request@nongnu.org?subject=help>","List-Subscribe":"<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=subscribe>","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"\"Qemu-devel\"\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>"}},{"id":1772812,"web_url":"http://patchwork.ozlabs.org/comment/1772812/","msgid":"<4d0450a8-00be-01d3-79d6-2c25a7081cf6@ozlabs.ru>","list_archive_url":null,"date":"2017-09-21T13:44:59","subject":"Re: [Qemu-devel] [PATCH qemu v5 04/18] memory: Move\n\tAddressSpaceDispatch from AddressSpace to FlatView","submitter":{"id":7621,"url":"http://patchwork.ozlabs.org/api/people/7621/","name":"Alexey Kardashevskiy","email":"aik@ozlabs.ru"},"content":"On 21/09/17 21:51, Paolo Bonzini wrote:\n> On 21/09/2017 10:50, Alexey Kardashevskiy wrote:\n>> * since FlatView::rcu is used now to dispose FV, call_rcu() in\n>> address_space_update_topology() is replaced with direct call to\n>> flatview_unref()\n> \n> Hmm, this is not correct, as you could have\n> \n> \n>    thread 1             thread 2             RCU thread\n>   -------------------------------------------------------------\n>    rcu_read_lock\n>    read as->current_map\n>                         set as->current_map\n>                         flatview_unref\n>                            '--> call_rcu\n>    flatview_ref\n>    rcu_read_unlock\n>                                              flatview_destroy\n> \n> I need to think a bit more about this (and possibly ask Paul...).\n> \n> Paolo\n> \n\nNah, you're right, it should be like this:\n\n\ndiff --git a/memory.c b/memory.c\nindex 35b2fc5f7f..689bf53866 100644\n--- a/memory.c\n+++ b/memory.c\n@@ -317,7 +317,7 @@ static void flatview_ref(FlatView *view)\n static void flatview_unref(FlatView *view)\n {\n     if (atomic_fetch_dec(&view->ref) == 1) {\n-        call_rcu(view, flatview_destroy, rcu);\n+        flatview_destroy(view);\n     }\n }\n\n@@ -768,7 +768,7 @@ static FlatView *generate_memory_topology(MemoryRegion *mr)\n         flatview_simplify(view);\n\n         if (!view->nr) {\n-            flatview_destroy(view);\n+            flatview_unref(view);\n             use_empty = true;\n         }\n     }\n@@ -1026,7 +1026,7 @@ static void address_space_set_flatview(AddressSpace *as)\n     /* Writes are protected by the BQL.  */\n     atomic_rcu_set(&as->current_map, new_view);\n     if (old_view) {\n-        flatview_unref(old_view);\n+        call_rcu(view, flatview_unref, rcu);\n     }","headers":{"Return-Path":"<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=<UNKNOWN>)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=ozlabs-ru.20150623.gappssmtp.com\n\theader.i=@ozlabs-ru.20150623.gappssmtp.com\n\theader.b=\"ht2Tvjgt\"; dkim-atps=neutral"],"Received":["from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xydDK2zn0z9t42\n\tfor <incoming@patchwork.ozlabs.org>;\n\tThu, 21 Sep 2017 23:45:53 +1000 (AEST)","from localhost ([::1]:53811 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>)\n\tid 1dv1nb-0004rR-Gq\n\tfor incoming@patchwork.ozlabs.org; Thu, 21 Sep 2017 09:45:51 -0400","from eggs.gnu.org ([2001:4830:134:3::10]:35703)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from <aik@ozlabs.ru>) id 1dv1mw-0004ku-KM\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 09:45:13 -0400","from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from <aik@ozlabs.ru>) id 1dv1mr-0003ki-8l\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 09:45:10 -0400","from mail-pg0-x244.google.com ([2607:f8b0:400e:c05::244]:37062)\n\tby eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.71) (envelope-from <aik@ozlabs.ru>) id 1dv1mr-0003kH-1r\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 09:45:05 -0400","by mail-pg0-x244.google.com with SMTP id v5so3453085pgn.4\n\tfor <qemu-devel@nongnu.org>; Thu, 21 Sep 2017 06:45:04 -0700 (PDT)","from [192.168.10.22] (124-171-134-202.dyn.iinet.net.au.\n\t[124.171.134.202]) by smtp.googlemail.com with ESMTPSA id\n\tg68sm3524863pfk.136.2017.09.21.06.45.01\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\n\tThu, 21 Sep 2017 06:45:03 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=ozlabs-ru.20150623.gappssmtp.com; s=20150623;\n\th=subject:to:references:from:message-id:date:user-agent:mime-version\n\t:in-reply-to:content-language:content-transfer-encoding;\n\tbh=R7OXdDFdQKJxmqB9Kt4Lq7SBGm0zupkHjBdz4xssMmM=;\n\tb=ht2TvjgtxkCY3UvA2BJ6L4tkOqdTmXGm2ut4XwaPKC4148jrMFR9Vr6tc1eVmqNRwF\n\twM77tWHwUG0MmazT+hJYWDbmQOmeOGbyy+gmMMQ650C7juFhjh1btjXQAErXQz4/3hFQ\n\tKdCckzy3AEt9I+CN5qlIYvR4sFAfctYPETAPc7vGwa6hgGvwnzCSZ4LPa46d8Iwkc6a8\n\twkN5yEBVhvZcE9LL2yZU90XJ70WNOxC0+aKmBgvVn749iiClr8SrVRN5Q8XPHKPXMQbl\n\togaStnQtrrwcDznMpkmkiUHEmVkxLggkDFhgfoxQY3+GyUkWQ7+OOpDu0YkDsE+bPsAc\n\tp64w==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:subject:to:references:from:message-id:date\n\t:user-agent:mime-version:in-reply-to:content-language\n\t:content-transfer-encoding;\n\tbh=R7OXdDFdQKJxmqB9Kt4Lq7SBGm0zupkHjBdz4xssMmM=;\n\tb=lctst1iXEvLKhHrojI7mLDe8lGdF6YZ4yREPdRm1vcKT3R1NmAYWpZ4elivelwjfD0\n\tQ3+ObXl+PDrIQxZfYOkaSe6yJ59dFcU6pnhU6/K/jExrrW7SIGUFGWGteW9F3pykrtY8\n\t5p63UGNwFMp8EOmvgvWbmiSWpwYnbFZZtRHWHTQf2XLw7oMTIPn0WM3v5oq50I/ceJi2\n\tAuLl2ir7zZtJ4LVkZ2klFfm0EdwBqGaceGeHztlVXFv7T53Esp1s9JDdNYvTRmVnptR1\n\t+YcBDLMvbI++nMOQgkEiN3d28cxNXgrXh7WydFNNdVxmTh1TMu/WdMrzCcingwnbQyb5\n\tnwxQ==","X-Gm-Message-State":"AHPjjUiK94ahhfeDA1z6HYoXBztl42GiNNuh2OQuRhEzbBYN+Cjpv1AD\n\tdtY/kBh0sTv1v5cgQgUpYe4fxnWA","X-Google-Smtp-Source":"AOwi7QBxNc0IKxP/Ly2YKMTdUEkhvQwNKp9G2/4jhVYbAXWbWALVoWcMZ/bJsHflYRhQheNkOBO9TQ==","X-Received":"by 10.84.138.193 with SMTP id 59mr5785717plp.414.1506001503873; \n\tThu, 21 Sep 2017 06:45:03 -0700 (PDT)","To":"Paolo Bonzini <pbonzini@redhat.com>, qemu-devel@nongnu.org","References":"<20170921085110.25598-1-aik@ozlabs.ru>\n\t<20170921085110.25598-5-aik@ozlabs.ru>\n\t<a5b9c3ac-56fe-c29c-ed19-3eb5a5f159c2@redhat.com>","From":"Alexey Kardashevskiy <aik@ozlabs.ru>","Message-ID":"<4d0450a8-00be-01d3-79d6-2c25a7081cf6@ozlabs.ru>","Date":"Thu, 21 Sep 2017 23:44:59 +1000","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.2.1","MIME-Version":"1.0","In-Reply-To":"<a5b9c3ac-56fe-c29c-ed19-3eb5a5f159c2@redhat.com>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-AU","Content-Transfer-Encoding":"7bit","X-detected-operating-system":"by eggs.gnu.org: Genre and OS details not\n\trecognized.","X-Received-From":"2607:f8b0:400e:c05::244","Subject":"Re: [Qemu-devel] [PATCH qemu v5 04/18] memory: Move\n\tAddressSpaceDispatch from AddressSpace to FlatView","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.21","Precedence":"list","List-Id":"<qemu-devel.nongnu.org>","List-Unsubscribe":"<https://lists.nongnu.org/mailman/options/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>","List-Archive":"<http://lists.nongnu.org/archive/html/qemu-devel/>","List-Post":"<mailto:qemu-devel@nongnu.org>","List-Help":"<mailto:qemu-devel-request@nongnu.org?subject=help>","List-Subscribe":"<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=subscribe>","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"\"Qemu-devel\"\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>"}},{"id":1772816,"web_url":"http://patchwork.ozlabs.org/comment/1772816/","msgid":"<3f53a5e7-9d94-8c81-7d0c-7e65d9026d3c@redhat.com>","list_archive_url":null,"date":"2017-09-21T13:54:56","subject":"Re: [Qemu-devel] [PATCH qemu v5 04/18] memory: Move\n\tAddressSpaceDispatch from AddressSpace to FlatView","submitter":{"id":2701,"url":"http://patchwork.ozlabs.org/api/people/2701/","name":"Paolo Bonzini","email":"pbonzini@redhat.com"},"content":"On 21/09/2017 15:44, Alexey Kardashevskiy wrote:\n> On 21/09/17 21:51, Paolo Bonzini wrote:\n>> On 21/09/2017 10:50, Alexey Kardashevskiy wrote:\n>>> * since FlatView::rcu is used now to dispose FV, call_rcu() in\n>>> address_space_update_topology() is replaced with direct call to\n>>> flatview_unref()\n>>\n>> Hmm, this is not correct, as you could have\n>>\n>>\n>>    thread 1             thread 2             RCU thread\n>>   -------------------------------------------------------------\n>>    rcu_read_lock\n>>    read as->current_map\n>>                         set as->current_map\n>>                         flatview_unref\n>>                            '--> call_rcu\n>>    flatview_ref\n>>    rcu_read_unlock\n>>                                              flatview_destroy\n>>\n>> I need to think a bit more about this (and possibly ask Paul...).\n>>\n>> Paolo\n>>\n> \n> Nah, you're right, it should be like this:\n> \n> \n> diff --git a/memory.c b/memory.c\n> index 35b2fc5f7f..689bf53866 100644\n> --- a/memory.c\n> +++ b/memory.c\n> @@ -317,7 +317,7 @@ static void flatview_ref(FlatView *view)\n>  static void flatview_unref(FlatView *view)\n>  {\n>      if (atomic_fetch_dec(&view->ref) == 1) {\n> -        call_rcu(view, flatview_destroy, rcu);\n> +        flatview_destroy(view);\n>      }\n>  }\n> \n> @@ -768,7 +768,7 @@ static FlatView *generate_memory_topology(MemoryRegion *mr)\n>          flatview_simplify(view);\n> \n>          if (!view->nr) {\n> -            flatview_destroy(view);\n> +            flatview_unref(view);\n>              use_empty = true;\n>          }\n>      }\n> @@ -1026,7 +1026,7 @@ static void address_space_set_flatview(AddressSpace *as)\n>      /* Writes are protected by the BQL.  */\n>      atomic_rcu_set(&as->current_map, new_view);\n>      if (old_view) {\n> -        flatview_unref(old_view);\n> +        call_rcu(view, flatview_unref, rcu);\n>      }\n\nThis still doesn't cover address_space_get_flatview, i.e. it is a \npre-existing bug.\n\nI found a similar case in Linux, here is how they solved it:\n\ncommit 358136532dd29e9ed96e0e523d2d510e71bda003\nAuthor: Paolo Bonzini <pbonzini@redhat.com>\nDate:   Thu Sep 21 14:32:47 2017 +0200\n\n    memory: avoid \"resurrection\" of dead FlatViews\n    \n    It's possible for address_space_get_flatview() as it currently stands\n    to cause a use-after-free for the returned FlatView, if the reference\n    count is incremented after the FlatView has been replaced by a writer:\n    \n       thread 1             thread 2             RCU thread\n      -------------------------------------------------------------\n       rcu_read_lock\n       read as->current_map\n                            set as->current_map\n                            flatview_unref\n                               '--> call_rcu\n       flatview_ref\n         [ref=1]\n       rcu_read_unlock\n                                                 flatview_destroy\n       <badness>\n    \n    Since FlatViews are not updated very often, we can just detect the\n    situation using a new atomic op atomic_fetch_inc_nonzero, similar to\n    Linux's atomic_inc_not_zero, which performs the refcount increment only if\n    it hasn't already hit zero.  This is similar to Linux commit de09a9771a53\n    (\"CRED: Fix get_task_cred() and task_state() to not resurrect dead\n    credentials\", 2010-07-29).\n    \n    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>\n\ndiff --git a/docs/devel/atomics.txt b/docs/devel/atomics.txt\nindex 048e5f23cb..10c5fa37e8 100644\n--- a/docs/devel/atomics.txt\n+++ b/docs/devel/atomics.txt\n@@ -64,6 +64,7 @@ operations:\n     typeof(*ptr) atomic_fetch_and(ptr, val)\n     typeof(*ptr) atomic_fetch_or(ptr, val)\n     typeof(*ptr) atomic_fetch_xor(ptr, val)\n+    typeof(*ptr) atomic_fetch_inc_nonzero(ptr)\n     typeof(*ptr) atomic_xchg(ptr, val)\n     typeof(*ptr) atomic_cmpxchg(ptr, old, new)\n \ndiff --git a/include/qemu/atomic.h b/include/qemu/atomic.h\nindex b6b62fb771..44ad1e6c32 100644\n--- a/include/qemu/atomic.h\n+++ b/include/qemu/atomic.h\n@@ -197,6 +197,15 @@\n     atomic_cmpxchg__nocheck(ptr, old, new);                             \\\n })\n \n+#define atomic_fetch_inc_nonzero(ptr) ({                                \\\n+    QEMU_BUILD_BUG_ON(sizeof(*ptr) > ATOMIC_REG_SIZE);                  \\\n+    typeof_strip_qual(*ptr) _oldn = atomic_read(ptr);                   \\\n+    while (_oldn && atomic_cmpxchg(ptr, _oldn, _oldn + 1) != _oldn) {   \\\n+        _oldn = atomic_read(ptr);                                       \\\n+    }                                                                   \\\n+    _oldn;                                                              \\\n+})\n+\n /* Provide shorter names for GCC atomic builtins, return old value */\n #define atomic_fetch_inc(ptr)  __atomic_fetch_add(ptr, 1, __ATOMIC_SEQ_CST)\n #define atomic_fetch_dec(ptr)  __atomic_fetch_sub(ptr, 1, __ATOMIC_SEQ_CST)\ndiff --git a/memory.c b/memory.c\nindex 2b90117c60..51f54ab430 100644\n--- a/memory.c\n+++ b/memory.c\n@@ -294,9 +294,9 @@ static void flatview_destroy(FlatView *view)\n     g_free(view);\n }\n \n-static void flatview_ref(FlatView *view)\n+static bool flatview_ref(FlatView *view)\n {\n-    atomic_inc(&view->ref);\n+    return atomic_fetch_inc_nonzero(&view->ref) > 0;\n }\n \n static void flatview_unref(FlatView *view)\n@@ -773,8 +773,12 @@ static FlatView *address_space_get_flatview(AddressSpace *as)\n     FlatView *view;\n \n     rcu_read_lock();\n-    view = atomic_rcu_read(&as->current_map);\n-    flatview_ref(view);\n+    do {\n+        view = atomic_rcu_read(&as->current_map);\n+        /* If somebody has replaced as->current_map concurrently,\n+         * flatview_ref returns false.\n+         */\n+    } while (!flatview_ref(view));\n     rcu_read_unlock();\n     return view;\n }","headers":{"Return-Path":"<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=<UNKNOWN>)","ext-mx06.extmail.prod.ext.phx2.redhat.com;\n\tdmarc=none (p=none dis=none) header.from=redhat.com","ext-mx06.extmail.prod.ext.phx2.redhat.com;\n\tspf=fail smtp.mailfrom=pbonzini@redhat.com"],"Received":["from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xydRN68R8z9ryv\n\tfor <incoming@patchwork.ozlabs.org>;\n\tThu, 21 Sep 2017 23:55:28 +1000 (AEST)","from localhost ([::1]:53870 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>)\n\tid 1dv1wt-0001te-0b\n\tfor incoming@patchwork.ozlabs.org; Thu, 21 Sep 2017 09:55:27 -0400","from eggs.gnu.org ([2001:4830:134:3::10]:38504)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from <pbonzini@redhat.com>) id 1dv1wX-0001tR-HW\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 09:55:06 -0400","from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from <pbonzini@redhat.com>) id 1dv1wS-0001OY-KA\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 09:55:05 -0400","from mx1.redhat.com ([209.132.183.28]:10969)\n\tby eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)\n\t(Exim 4.71) (envelope-from <pbonzini@redhat.com>) id 1dv1wS-0001OC-Ae\n\tfor qemu-devel@nongnu.org; Thu, 21 Sep 2017 09:55:00 -0400","from smtp.corp.redhat.com\n\t(int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])\n\t(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby mx1.redhat.com (Postfix) with ESMTPS id 4BBE4356D7;\n\tThu, 21 Sep 2017 13:54:59 +0000 (UTC)","from [10.36.117.52] (ovpn-117-52.ams2.redhat.com [10.36.117.52])\n\tby smtp.corp.redhat.com (Postfix) with ESMTPS id 76FD560178;\n\tThu, 21 Sep 2017 13:54:58 +0000 (UTC)"],"DMARC-Filter":"OpenDMARC Filter v1.3.2 mx1.redhat.com 4BBE4356D7","To":"Alexey Kardashevskiy <aik@ozlabs.ru>, qemu-devel@nongnu.org","References":"<20170921085110.25598-1-aik@ozlabs.ru>\n\t<20170921085110.25598-5-aik@ozlabs.ru>\n\t<a5b9c3ac-56fe-c29c-ed19-3eb5a5f159c2@redhat.com>\n\t<4d0450a8-00be-01d3-79d6-2c25a7081cf6@ozlabs.ru>","From":"Paolo Bonzini <pbonzini@redhat.com>","Message-ID":"<3f53a5e7-9d94-8c81-7d0c-7e65d9026d3c@redhat.com>","Date":"Thu, 21 Sep 2017 15:54:56 +0200","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.3.0","MIME-Version":"1.0","In-Reply-To":"<4d0450a8-00be-01d3-79d6-2c25a7081cf6@ozlabs.ru>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-US","Content-Transfer-Encoding":"7bit","X-Scanned-By":"MIMEDefang 2.79 on 10.5.11.11","X-Greylist":"Sender IP whitelisted, not delayed by milter-greylist-4.5.16\n\t(mx1.redhat.com [10.5.110.30]);\n\tThu, 21 Sep 2017 13:54:59 +0000 (UTC)","X-detected-operating-system":"by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]\n\t[fuzzy]","X-Received-From":"209.132.183.28","Subject":"Re: [Qemu-devel] [PATCH qemu v5 04/18] memory: Move\n\tAddressSpaceDispatch from AddressSpace to FlatView","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.21","Precedence":"list","List-Id":"<qemu-devel.nongnu.org>","List-Unsubscribe":"<https://lists.nongnu.org/mailman/options/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>","List-Archive":"<http://lists.nongnu.org/archive/html/qemu-devel/>","List-Post":"<mailto:qemu-devel@nongnu.org>","List-Help":"<mailto:qemu-devel-request@nongnu.org?subject=help>","List-Subscribe":"<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n\t<mailto:qemu-devel-request@nongnu.org?subject=subscribe>","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"\"Qemu-devel\"\n\t<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>"}}]