diff mbox

[v4,09/16] memory: introduce mmio request pending to anti nested DMA

Message ID 1350897839-29593-10-git-send-email-pingfank@linux.vnet.ibm.com
State New
Headers show

Commit Message

pingfank@linux.vnet.ibm.com Oct. 22, 2012, 9:23 a.m. UTC 
Rejecting the nested mmio request which does not aim at RAM, so we
can avoid the potential deadlock caused by the random lock sequence
of two device's local lock.

Signed-off-by: Liu Ping Fan <pingfank@linux.vnet.ibm.com>
---
 cpus.c              |   14 ++++++++++++++
 exec.c              |   50 ++++++++++++++++++++++++++++++++++++--------------
 hw/hw.h             |    1 +
 kvm-all.c           |    2 ++
 qemu-thread-posix.h |    3 +++
 qemu-thread.h       |    2 ++
 6 files changed, 58 insertions(+), 14 deletions(-)

Comments

Gleb Natapov Oct. 23, 2012, 12:38 p.m. UTC | #1 
On Mon, Oct 22, 2012 at 05:23:52PM +0800, Liu Ping Fan wrote:
> Rejecting the nested mmio request which does not aim at RAM, so we
> can avoid the potential deadlock caused by the random lock sequence
> of two device's local lock.
> 
> Signed-off-by: Liu Ping Fan <pingfank@linux.vnet.ibm.com>
> ---
>  cpus.c              |   14 ++++++++++++++
>  exec.c              |   50 ++++++++++++++++++++++++++++++++++++--------------
>  hw/hw.h             |    1 +
>  kvm-all.c           |    2 ++
>  qemu-thread-posix.h |    3 +++
>  qemu-thread.h       |    2 ++
>  6 files changed, 58 insertions(+), 14 deletions(-)
> 
> diff --git a/cpus.c b/cpus.c
> index 4cd7f85..365a512 100644
> --- a/cpus.c
> +++ b/cpus.c
> @@ -729,6 +729,18 @@ static void qemu_kvm_wait_io_event(CPUArchState *env)
>      qemu_wait_io_event_common(env);
>  }
>  
> +int get_context_type(void)
> +{
> +    QemuThread *t = pthread_getspecific(qemu_thread_key);
> +    return t->context_type;
> +}
> +
You defined the function but not use it.

What 0/1 context_type means?

> +void set_context_type(int type)
> +{
> +    QemuThread *t = pthread_getspecific(qemu_thread_key);
> +    t->context_type = type;
> +}
> +
>  static void *qemu_kvm_cpu_thread_fn(void *arg)
>  {
>      CPUArchState *env = arg;
> @@ -736,6 +748,8 @@ static void *qemu_kvm_cpu_thread_fn(void *arg)
>      int r;
>  
>      pthread_setspecific(qemu_thread_key, cpu->thread);
> +    set_context_type(0);
> +
>      qemu_mutex_lock(&qemu_global_mutex);
>      qemu_thread_get_self(cpu->thread);
>      env->thread_id = qemu_get_thread_id();
> diff --git a/exec.c b/exec.c
> index 91b859b..a0327a1 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -3490,7 +3490,9 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>      uint32_t val;
>      target_phys_addr_t page;
>      MemoryRegionSection *section, obj_mrs;
> -    int safe_ref;
> +    int safe_ref, nested_dma = 0;
> +    QemuThread *thread = pthread_getspecific(qemu_thread_key);
> +    int context = thread->context_type;
>  
>      while (len > 0) {
>          page = addr & TARGET_PAGE_MASK;
> @@ -3500,7 +3502,8 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>          qemu_mutex_lock(&mem_map_lock);
>          safe_ref = phys_page_lookup(page, &obj_mrs);
>          qemu_mutex_unlock(&mem_map_lock);
> -        if (safe_ref == 0) {
> +
> +        if (safe_ref == 0 && context == 1) {
>              qemu_mutex_lock_iothread();
>              qemu_mutex_lock(&mem_map_lock);
>              /* At the 2nd try, mem map can change, so need to judge it again */
> @@ -3511,7 +3514,9 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>              }
>          }
>          section = &obj_mrs;
> -
> +        if (context == 1) {
> +            nested_dma = thread->mmio_request_pending++ > 1 ? 1 : 0;
> +        }
>          if (is_write) {
>              if (!memory_region_is_ram(section->mr)) {
>                  target_phys_addr_t addr1;
> @@ -3521,17 +3526,23 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>                  if (l >= 4 && ((addr1 & 3) == 0)) {
>                      /* 32 bit write access */
>                      val = ldl_p(buf);
> -                    io_mem_write(section->mr, addr1, val, 4);
> +                    if (!nested_dma) {
> +                        io_mem_write(section->mr, addr1, val, 4);
> +                    }
>                      l = 4;
>                  } else if (l >= 2 && ((addr1 & 1) == 0)) {
>                      /* 16 bit write access */
>                      val = lduw_p(buf);
> -                    io_mem_write(section->mr, addr1, val, 2);
> +                    if (!nested_dma) {
> +                        io_mem_write(section->mr, addr1, val, 2);
> +                    }
>                      l = 2;
>                  } else {
>                      /* 8 bit write access */
>                      val = ldub_p(buf);
> -                    io_mem_write(section->mr, addr1, val, 1);
> +                    if (!nested_dma) {
> +                        io_mem_write(section->mr, addr1, val, 1);
> +                    }
>                      l = 1;
>                  }
>              } else if (!section->readonly) {
> @@ -3552,24 +3563,31 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>              }
>          } else {
>              if (!(memory_region_is_ram(section->mr) ||
> -                  memory_region_is_romd(section->mr))) {
> +                  memory_region_is_romd(section->mr)) &&
> +                    !nested_dma) {
>                  target_phys_addr_t addr1;
>                  /* I/O case */
>                  addr1 = memory_region_section_addr(section, addr);
>                  if (l >= 4 && ((addr1 & 3) == 0)) {
>                      /* 32 bit read access */
> -                    val = io_mem_read(section->mr, addr1, 4);
> -                    stl_p(buf, val);
> +                    if (!nested_dma) {
> +                        val = io_mem_read(section->mr, addr1, 4);
> +                        stl_p(buf, val);
> +                    }
>                      l = 4;
>                  } else if (l >= 2 && ((addr1 & 1) == 0)) {
>                      /* 16 bit read access */
> -                    val = io_mem_read(section->mr, addr1, 2);
> -                    stw_p(buf, val);
> +                    if (!nested_dma) {
> +                        val = io_mem_read(section->mr, addr1, 2);
> +                        stw_p(buf, val);
> +                    }
>                      l = 2;
>                  } else {
>                      /* 8 bit read access */
> -                    val = io_mem_read(section->mr, addr1, 1);
> -                    stb_p(buf, val);
> +                    if (!nested_dma) {
> +                        val = io_mem_read(section->mr, addr1, 1);
> +                        stb_p(buf, val);
> +                    }
>                      l = 1;
>                  }
>              } else {
> @@ -3586,7 +3604,11 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>          len -= l;
>          buf += l;
>          addr += l;
> -        if (safe_ref == 0) {
> +
> +        if (context == 1) {
> +            thread->mmio_request_pending--;
> +        }
> +        if (safe_ref == 0 && context == 1) {
>              qemu_mutex_unlock_iothread();
>          }
>      }
> diff --git a/hw/hw.h b/hw/hw.h
> index e5cb9bf..935b045 100644
> --- a/hw/hw.h
> +++ b/hw/hw.h
> @@ -12,6 +12,7 @@
>  #include "irq.h"
>  #include "qemu-file.h"
>  #include "vmstate.h"
> +#include "qemu-thread.h"
>  
>  #ifdef NEED_CPU_H
>  #if TARGET_LONG_BITS == 64
> diff --git a/kvm-all.c b/kvm-all.c
> index 34b02c1..b3fa597 100644
> --- a/kvm-all.c
> +++ b/kvm-all.c
> @@ -1562,10 +1562,12 @@ int kvm_cpu_exec(CPUArchState *env)
>              break;
>          case KVM_EXIT_MMIO:
>              DPRINTF("handle_mmio\n");
> +            set_context_type(1);
>              cpu_physical_memory_rw(run->mmio.phys_addr,
>                                     run->mmio.data,
>                                     run->mmio.len,
>                                     run->mmio.is_write);
> +            set_context_type(0);
>              ret = 0;
>              break;
>          case KVM_EXIT_IRQ_WINDOW_OPEN:
> diff --git a/qemu-thread-posix.h b/qemu-thread-posix.h
> index 2607b1c..9fcc6f8 100644
> --- a/qemu-thread-posix.h
> +++ b/qemu-thread-posix.h
> @@ -12,6 +12,9 @@ struct QemuCond {
>  
>  struct QemuThread {
>      pthread_t thread;
> +    /* 0 clean; 1 mmio; 2 io */
> +    int context_type;
> +    int mmio_request_pending;
>  };
>  
>  extern pthread_key_t qemu_thread_key;
> diff --git a/qemu-thread.h b/qemu-thread.h
> index 4a6427d..88eaf94 100644
> --- a/qemu-thread.h
> +++ b/qemu-thread.h
> @@ -45,6 +45,8 @@ void *qemu_thread_join(QemuThread *thread);
>  void qemu_thread_get_self(QemuThread *thread);
>  bool qemu_thread_is_self(QemuThread *thread);
>  void qemu_thread_exit(void *retval);
> +int get_context_type(void);
> +void set_context_type(int type);
>  
>  void qemu_thread_key_create(void);
>  #endif
> -- 
> 1.7.4.4
> 

--
			Gleb.
pingfan liu Oct. 24, 2012, 6:31 a.m. UTC | #2 
On Tue, Oct 23, 2012 at 8:38 PM, Gleb Natapov <gleb@redhat.com> wrote:
> On Mon, Oct 22, 2012 at 05:23:52PM +0800, Liu Ping Fan wrote:
>> Rejecting the nested mmio request which does not aim at RAM, so we
>> can avoid the potential deadlock caused by the random lock sequence
>> of two device's local lock.
>>
>> Signed-off-by: Liu Ping Fan <pingfank@linux.vnet.ibm.com>
>> ---
>>  cpus.c              |   14 ++++++++++++++
>>  exec.c              |   50 ++++++++++++++++++++++++++++++++++++--------------
>>  hw/hw.h             |    1 +
>>  kvm-all.c           |    2 ++
>>  qemu-thread-posix.h |    3 +++
>>  qemu-thread.h       |    2 ++
>>  6 files changed, 58 insertions(+), 14 deletions(-)
>>
>> diff --git a/cpus.c b/cpus.c
>> index 4cd7f85..365a512 100644
>> --- a/cpus.c
>> +++ b/cpus.c
>> @@ -729,6 +729,18 @@ static void qemu_kvm_wait_io_event(CPUArchState *env)
>>      qemu_wait_io_event_common(env);
>>  }
>>
>> +int get_context_type(void)
>> +{
>> +    QemuThread *t = pthread_getspecific(qemu_thread_key);
>> +    return t->context_type;
>> +}
>> +
> You defined the function but not use it.
>
> What 0/1 context_type means?
>
Will s/t->context/get_context_type/ . The context_type is just for
device's function to tell whether it is called by local lock or
biglock.  0 is initial value, 1 is under mmio dispatching, 2 is under
io dispatching.  Will use enum to define them.

Regards,
pingfan
>> +void set_context_type(int type)
>> +{
>> +    QemuThread *t = pthread_getspecific(qemu_thread_key);
>> +    t->context_type = type;
>> +}
>> +
>>  static void *qemu_kvm_cpu_thread_fn(void *arg)
>>  {
>>      CPUArchState *env = arg;
>> @@ -736,6 +748,8 @@ static void *qemu_kvm_cpu_thread_fn(void *arg)
>>      int r;
>>
>>      pthread_setspecific(qemu_thread_key, cpu->thread);
>> +    set_context_type(0);
>> +
>>      qemu_mutex_lock(&qemu_global_mutex);
>>      qemu_thread_get_self(cpu->thread);
>>      env->thread_id = qemu_get_thread_id();
>> diff --git a/exec.c b/exec.c
>> index 91b859b..a0327a1 100644
>> --- a/exec.c
>> +++ b/exec.c
>> @@ -3490,7 +3490,9 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>>      uint32_t val;
>>      target_phys_addr_t page;
>>      MemoryRegionSection *section, obj_mrs;
>> -    int safe_ref;
>> +    int safe_ref, nested_dma = 0;
>> +    QemuThread *thread = pthread_getspecific(qemu_thread_key);
>> +    int context = thread->context_type;
>>
>>      while (len > 0) {
>>          page = addr & TARGET_PAGE_MASK;
>> @@ -3500,7 +3502,8 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>>          qemu_mutex_lock(&mem_map_lock);
>>          safe_ref = phys_page_lookup(page, &obj_mrs);
>>          qemu_mutex_unlock(&mem_map_lock);
>> -        if (safe_ref == 0) {
>> +
>> +        if (safe_ref == 0 && context == 1) {
>>              qemu_mutex_lock_iothread();
>>              qemu_mutex_lock(&mem_map_lock);
>>              /* At the 2nd try, mem map can change, so need to judge it again */
>> @@ -3511,7 +3514,9 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>>              }
>>          }
>>          section = &obj_mrs;
>> -
>> +        if (context == 1) {
>> +            nested_dma = thread->mmio_request_pending++ > 1 ? 1 : 0;
>> +        }
>>          if (is_write) {
>>              if (!memory_region_is_ram(section->mr)) {
>>                  target_phys_addr_t addr1;
>> @@ -3521,17 +3526,23 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>>                  if (l >= 4 && ((addr1 & 3) == 0)) {
>>                      /* 32 bit write access */
>>                      val = ldl_p(buf);
>> -                    io_mem_write(section->mr, addr1, val, 4);
>> +                    if (!nested_dma) {
>> +                        io_mem_write(section->mr, addr1, val, 4);
>> +                    }
>>                      l = 4;
>>                  } else if (l >= 2 && ((addr1 & 1) == 0)) {
>>                      /* 16 bit write access */
>>                      val = lduw_p(buf);
>> -                    io_mem_write(section->mr, addr1, val, 2);
>> +                    if (!nested_dma) {
>> +                        io_mem_write(section->mr, addr1, val, 2);
>> +                    }
>>                      l = 2;
>>                  } else {
>>                      /* 8 bit write access */
>>                      val = ldub_p(buf);
>> -                    io_mem_write(section->mr, addr1, val, 1);
>> +                    if (!nested_dma) {
>> +                        io_mem_write(section->mr, addr1, val, 1);
>> +                    }
>>                      l = 1;
>>                  }
>>              } else if (!section->readonly) {
>> @@ -3552,24 +3563,31 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>>              }
>>          } else {
>>              if (!(memory_region_is_ram(section->mr) ||
>> -                  memory_region_is_romd(section->mr))) {
>> +                  memory_region_is_romd(section->mr)) &&
>> +                    !nested_dma) {
>>                  target_phys_addr_t addr1;
>>                  /* I/O case */
>>                  addr1 = memory_region_section_addr(section, addr);
>>                  if (l >= 4 && ((addr1 & 3) == 0)) {
>>                      /* 32 bit read access */
>> -                    val = io_mem_read(section->mr, addr1, 4);
>> -                    stl_p(buf, val);
>> +                    if (!nested_dma) {
>> +                        val = io_mem_read(section->mr, addr1, 4);
>> +                        stl_p(buf, val);
>> +                    }
>>                      l = 4;
>>                  } else if (l >= 2 && ((addr1 & 1) == 0)) {
>>                      /* 16 bit read access */
>> -                    val = io_mem_read(section->mr, addr1, 2);
>> -                    stw_p(buf, val);
>> +                    if (!nested_dma) {
>> +                        val = io_mem_read(section->mr, addr1, 2);
>> +                        stw_p(buf, val);
>> +                    }
>>                      l = 2;
>>                  } else {
>>                      /* 8 bit read access */
>> -                    val = io_mem_read(section->mr, addr1, 1);
>> -                    stb_p(buf, val);
>> +                    if (!nested_dma) {
>> +                        val = io_mem_read(section->mr, addr1, 1);
>> +                        stb_p(buf, val);
>> +                    }
>>                      l = 1;
>>                  }
>>              } else {
>> @@ -3586,7 +3604,11 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
>>          len -= l;
>>          buf += l;
>>          addr += l;
>> -        if (safe_ref == 0) {
>> +
>> +        if (context == 1) {
>> +            thread->mmio_request_pending--;
>> +        }
>> +        if (safe_ref == 0 && context == 1) {
>>              qemu_mutex_unlock_iothread();
>>          }
>>      }
>> diff --git a/hw/hw.h b/hw/hw.h
>> index e5cb9bf..935b045 100644
>> --- a/hw/hw.h
>> +++ b/hw/hw.h
>> @@ -12,6 +12,7 @@
>>  #include "irq.h"
>>  #include "qemu-file.h"
>>  #include "vmstate.h"
>> +#include "qemu-thread.h"
>>
>>  #ifdef NEED_CPU_H
>>  #if TARGET_LONG_BITS == 64
>> diff --git a/kvm-all.c b/kvm-all.c
>> index 34b02c1..b3fa597 100644
>> --- a/kvm-all.c
>> +++ b/kvm-all.c
>> @@ -1562,10 +1562,12 @@ int kvm_cpu_exec(CPUArchState *env)
>>              break;
>>          case KVM_EXIT_MMIO:
>>              DPRINTF("handle_mmio\n");
>> +            set_context_type(1);
>>              cpu_physical_memory_rw(run->mmio.phys_addr,
>>                                     run->mmio.data,
>>                                     run->mmio.len,
>>                                     run->mmio.is_write);
>> +            set_context_type(0);
>>              ret = 0;
>>              break;
>>          case KVM_EXIT_IRQ_WINDOW_OPEN:
>> diff --git a/qemu-thread-posix.h b/qemu-thread-posix.h
>> index 2607b1c..9fcc6f8 100644
>> --- a/qemu-thread-posix.h
>> +++ b/qemu-thread-posix.h
>> @@ -12,6 +12,9 @@ struct QemuCond {
>>
>>  struct QemuThread {
>>      pthread_t thread;
>> +    /* 0 clean; 1 mmio; 2 io */
>> +    int context_type;
>> +    int mmio_request_pending;
>>  };
>>
>>  extern pthread_key_t qemu_thread_key;
>> diff --git a/qemu-thread.h b/qemu-thread.h
>> index 4a6427d..88eaf94 100644
>> --- a/qemu-thread.h
>> +++ b/qemu-thread.h
>> @@ -45,6 +45,8 @@ void *qemu_thread_join(QemuThread *thread);
>>  void qemu_thread_get_self(QemuThread *thread);
>>  bool qemu_thread_is_self(QemuThread *thread);
>>  void qemu_thread_exit(void *retval);
>> +int get_context_type(void);
>> +void set_context_type(int type);
>>
>>  void qemu_thread_key_create(void);
>>  #endif
>> --
>> 1.7.4.4
>>
>
> --
>                         Gleb.
>
diff mbox

Patch

diff --git a/cpus.c b/cpus.c
index 4cd7f85..365a512 100644
--- a/cpus.c
+++ b/cpus.c
@@ -729,6 +729,18 @@  static void qemu_kvm_wait_io_event(CPUArchState *env)
     qemu_wait_io_event_common(env);
 }
 
+int get_context_type(void)
+{
+    QemuThread *t = pthread_getspecific(qemu_thread_key);
+    return t->context_type;
+}
+
+void set_context_type(int type)
+{
+    QemuThread *t = pthread_getspecific(qemu_thread_key);
+    t->context_type = type;
+}
+
 static void *qemu_kvm_cpu_thread_fn(void *arg)
 {
     CPUArchState *env = arg;
@@ -736,6 +748,8 @@  static void *qemu_kvm_cpu_thread_fn(void *arg)
     int r;
 
     pthread_setspecific(qemu_thread_key, cpu->thread);
+    set_context_type(0);
+
     qemu_mutex_lock(&qemu_global_mutex);
     qemu_thread_get_self(cpu->thread);
     env->thread_id = qemu_get_thread_id();
diff --git a/exec.c b/exec.c
index 91b859b..a0327a1 100644
--- a/exec.c
+++ b/exec.c
@@ -3490,7 +3490,9 @@  void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
     uint32_t val;
     target_phys_addr_t page;
     MemoryRegionSection *section, obj_mrs;
-    int safe_ref;
+    int safe_ref, nested_dma = 0;
+    QemuThread *thread = pthread_getspecific(qemu_thread_key);
+    int context = thread->context_type;
 
     while (len > 0) {
         page = addr & TARGET_PAGE_MASK;
@@ -3500,7 +3502,8 @@  void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
         qemu_mutex_lock(&mem_map_lock);
         safe_ref = phys_page_lookup(page, &obj_mrs);
         qemu_mutex_unlock(&mem_map_lock);
-        if (safe_ref == 0) {
+
+        if (safe_ref == 0 && context == 1) {
             qemu_mutex_lock_iothread();
             qemu_mutex_lock(&mem_map_lock);
             /* At the 2nd try, mem map can change, so need to judge it again */
@@ -3511,7 +3514,9 @@  void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
             }
         }
         section = &obj_mrs;
-
+        if (context == 1) {
+            nested_dma = thread->mmio_request_pending++ > 1 ? 1 : 0;
+        }
         if (is_write) {
             if (!memory_region_is_ram(section->mr)) {
                 target_phys_addr_t addr1;
@@ -3521,17 +3526,23 @@  void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
                 if (l >= 4 && ((addr1 & 3) == 0)) {
                     /* 32 bit write access */
                     val = ldl_p(buf);
-                    io_mem_write(section->mr, addr1, val, 4);
+                    if (!nested_dma) {
+                        io_mem_write(section->mr, addr1, val, 4);
+                    }
                     l = 4;
                 } else if (l >= 2 && ((addr1 & 1) == 0)) {
                     /* 16 bit write access */
                     val = lduw_p(buf);
-                    io_mem_write(section->mr, addr1, val, 2);
+                    if (!nested_dma) {
+                        io_mem_write(section->mr, addr1, val, 2);
+                    }
                     l = 2;
                 } else {
                     /* 8 bit write access */
                     val = ldub_p(buf);
-                    io_mem_write(section->mr, addr1, val, 1);
+                    if (!nested_dma) {
+                        io_mem_write(section->mr, addr1, val, 1);
+                    }
                     l = 1;
                 }
             } else if (!section->readonly) {
@@ -3552,24 +3563,31 @@  void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
             }
         } else {
             if (!(memory_region_is_ram(section->mr) ||
-                  memory_region_is_romd(section->mr))) {
+                  memory_region_is_romd(section->mr)) &&
+                    !nested_dma) {
                 target_phys_addr_t addr1;
                 /* I/O case */
                 addr1 = memory_region_section_addr(section, addr);
                 if (l >= 4 && ((addr1 & 3) == 0)) {
                     /* 32 bit read access */
-                    val = io_mem_read(section->mr, addr1, 4);
-                    stl_p(buf, val);
+                    if (!nested_dma) {
+                        val = io_mem_read(section->mr, addr1, 4);
+                        stl_p(buf, val);
+                    }
                     l = 4;
                 } else if (l >= 2 && ((addr1 & 1) == 0)) {
                     /* 16 bit read access */
-                    val = io_mem_read(section->mr, addr1, 2);
-                    stw_p(buf, val);
+                    if (!nested_dma) {
+                        val = io_mem_read(section->mr, addr1, 2);
+                        stw_p(buf, val);
+                    }
                     l = 2;
                 } else {
                     /* 8 bit read access */
-                    val = io_mem_read(section->mr, addr1, 1);
-                    stb_p(buf, val);
+                    if (!nested_dma) {
+                        val = io_mem_read(section->mr, addr1, 1);
+                        stb_p(buf, val);
+                    }
                     l = 1;
                 }
             } else {
@@ -3586,7 +3604,11 @@  void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
         len -= l;
         buf += l;
         addr += l;
-        if (safe_ref == 0) {
+
+        if (context == 1) {
+            thread->mmio_request_pending--;
+        }
+        if (safe_ref == 0 && context == 1) {
             qemu_mutex_unlock_iothread();
         }
     }
diff --git a/hw/hw.h b/hw/hw.h
index e5cb9bf..935b045 100644
--- a/hw/hw.h
+++ b/hw/hw.h
@@ -12,6 +12,7 @@ 
 #include "irq.h"
 #include "qemu-file.h"
 #include "vmstate.h"
+#include "qemu-thread.h"
 
 #ifdef NEED_CPU_H
 #if TARGET_LONG_BITS == 64
diff --git a/kvm-all.c b/kvm-all.c
index 34b02c1..b3fa597 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1562,10 +1562,12 @@  int kvm_cpu_exec(CPUArchState *env)
             break;
         case KVM_EXIT_MMIO:
             DPRINTF("handle_mmio\n");
+            set_context_type(1);
             cpu_physical_memory_rw(run->mmio.phys_addr,
                                    run->mmio.data,
                                    run->mmio.len,
                                    run->mmio.is_write);
+            set_context_type(0);
             ret = 0;
             break;
         case KVM_EXIT_IRQ_WINDOW_OPEN:
diff --git a/qemu-thread-posix.h b/qemu-thread-posix.h
index 2607b1c..9fcc6f8 100644
--- a/qemu-thread-posix.h
+++ b/qemu-thread-posix.h
@@ -12,6 +12,9 @@  struct QemuCond {
 
 struct QemuThread {
     pthread_t thread;
+    /* 0 clean; 1 mmio; 2 io */
+    int context_type;
+    int mmio_request_pending;
 };
 
 extern pthread_key_t qemu_thread_key;
diff --git a/qemu-thread.h b/qemu-thread.h
index 4a6427d..88eaf94 100644
--- a/qemu-thread.h
+++ b/qemu-thread.h
@@ -45,6 +45,8 @@  void *qemu_thread_join(QemuThread *thread);
 void qemu_thread_get_self(QemuThread *thread);
 bool qemu_thread_is_self(QemuThread *thread);
 void qemu_thread_exit(void *retval);
+int get_context_type(void);
+void set_context_type(int type);
 
 void qemu_thread_key_create(void);
 #endif