| Message ID | 20211111063854.29060-1-jasowang@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [1/2] virtio: use virtio accessor to access packed descriptor flags | expand |
On 11/11/21 07:38, Jason Wang wrote: > We used to access packed descriptor flags via > address_space_{write|read}_cached(). When we hit the cache, memcpy() > is used which is not an atomic operation which may lead a wrong value > is read or wrote. > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > sure the aceess is atomic. > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > Cc: qemu-stable@nongnu.org > Signed-off-by: Jason Wang <jasowang@redhat.com> > --- > hw/virtio/virtio.c | 11 ++++------- > 1 file changed, 4 insertions(+), 7 deletions(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > We used to access packed descriptor flags via > address_space_{write|read}_cached(). When we hit the cache, memcpy() > is used which is not an atomic operation which may lead a wrong value > is read or wrote. Could you clarify where's the memcpy that you see? Thanks! > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > sure the aceess is atomic. > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > Cc: qemu-stable@nongnu.org > Signed-off-by: Jason Wang <jasowang@redhat.com> > --- > hw/virtio/virtio.c | 11 ++++------- > 1 file changed, 4 insertions(+), 7 deletions(-) > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > index cc69a9b881..939bcbfeb9 100644 > --- a/hw/virtio/virtio.c > +++ b/hw/virtio/virtio.c > @@ -507,11 +507,9 @@ static void vring_packed_desc_read_flags(VirtIODevice *vdev, > MemoryRegionCache *cache, > int i) > { > - address_space_read_cached(cache, > - i * sizeof(VRingPackedDesc) + > - offsetof(VRingPackedDesc, flags), > - flags, sizeof(*flags)); > - virtio_tswap16s(vdev, flags); > + hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > + > + *flags = virtio_lduw_phys_cached(vdev, cache, off); > } > > static void vring_packed_desc_read(VirtIODevice *vdev, > @@ -564,8 +562,7 @@ static void vring_packed_desc_write_flags(VirtIODevice *vdev, > { > hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > > - virtio_tswap16s(vdev, &desc->flags); > - address_space_write_cached(cache, off, &desc->flags, sizeof(desc->flags)); > + virtio_stw_phys_cached(vdev, cache, off, desc->flags); > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > } > > -- > 2.25.1
On Thu, Nov 11, 2021 at 4:27 PM Michael S. Tsirkin <mst@redhat.com> wrote: > > On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > > We used to access packed descriptor flags via > > address_space_{write|read}_cached(). When we hit the cache, memcpy() > > is used which is not an atomic operation which may lead a wrong value > > is read or wrote. > > Could you clarify where's the memcpy that you see? > Thanks! In the address_space_{write|read}_cached it self: static inline MemTxResult =>dress_space_write_cached(MemoryRegionCache *cache, hwaddr addr, const void *buf, hwaddr len) { assert(addr < cache->len && len <= cache->len - addr); if (likely(cache->ptr)) { memcpy(cache->ptr + addr, buf, len); return MEMTX_OK; } else { return address_space_write_cached_slow(cache, addr, buf, len); } } Thanks > > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > > sure the aceess is atomic. > > > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > > Cc: qemu-stable@nongnu.org > > Signed-off-by: Jason Wang <jasowang@redhat.com> > > --- > > hw/virtio/virtio.c | 11 ++++------- > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > > index cc69a9b881..939bcbfeb9 100644 > > --- a/hw/virtio/virtio.c > > +++ b/hw/virtio/virtio.c > > @@ -507,11 +507,9 @@ static void vring_packed_desc_read_flags(VirtIODevice *vdev, > > MemoryRegionCache *cache, > > int i) > > { > > - address_space_read_cached(cache, > > - i * sizeof(VRingPackedDesc) + > > - offsetof(VRingPackedDesc, flags), > > - flags, sizeof(*flags)); > > - virtio_tswap16s(vdev, flags); > > + hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > > + > > + *flags = virtio_lduw_phys_cached(vdev, cache, off); > > } > > > > static void vring_packed_desc_read(VirtIODevice *vdev, > > @@ -564,8 +562,7 @@ static void vring_packed_desc_write_flags(VirtIODevice *vdev, > > { > > hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > > > > - virtio_tswap16s(vdev, &desc->flags); > > - address_space_write_cached(cache, off, &desc->flags, sizeof(desc->flags)); > > + virtio_stw_phys_cached(vdev, cache, off, desc->flags); > > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > > } > > > > -- > > 2.25.1 >
On Fri, Nov 12, 2021 at 10:23:12AM +0800, Jason Wang wrote: > On Thu, Nov 11, 2021 at 4:27 PM Michael S. Tsirkin <mst@redhat.com> wrote: > > > > On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > > > We used to access packed descriptor flags via > > > address_space_{write|read}_cached(). When we hit the cache, memcpy() > > > is used which is not an atomic operation which may lead a wrong value > > > is read or wrote. > > > > Could you clarify where's the memcpy that you see? > > Thanks! > > In the address_space_{write|read}_cached it self: > > static inline MemTxResult > =>dress_space_write_cached(MemoryRegionCache *cache, hwaddr addr, > const void *buf, hwaddr len) > { > assert(addr < cache->len && len <= cache->len - addr); > if (likely(cache->ptr)) { > memcpy(cache->ptr + addr, buf, len); > return MEMTX_OK; > } else { > return address_space_write_cached_slow(cache, addr, buf, len); > } > } > > Thanks But that's a copy from the cache, not from guest memory. I don't see how it can change so I don't see why it needs to be atomic. Was there an actual issue you observed or is this theoretical? > > > > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > > > sure the aceess is atomic. > > > > > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > > > Cc: qemu-stable@nongnu.org > > > Signed-off-by: Jason Wang <jasowang@redhat.com> > > > --- > > > hw/virtio/virtio.c | 11 ++++------- > > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > > > index cc69a9b881..939bcbfeb9 100644 > > > --- a/hw/virtio/virtio.c > > > +++ b/hw/virtio/virtio.c > > > @@ -507,11 +507,9 @@ static void vring_packed_desc_read_flags(VirtIODevice *vdev, > > > MemoryRegionCache *cache, > > > int i) > > > { > > > - address_space_read_cached(cache, > > > - i * sizeof(VRingPackedDesc) + > > > - offsetof(VRingPackedDesc, flags), > > > - flags, sizeof(*flags)); > > > - virtio_tswap16s(vdev, flags); > > > + hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > > > + > > > + *flags = virtio_lduw_phys_cached(vdev, cache, off); > > > } > > > > > > static void vring_packed_desc_read(VirtIODevice *vdev, > > > @@ -564,8 +562,7 @@ static void vring_packed_desc_write_flags(VirtIODevice *vdev, > > > { > > > hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > > > > > > - virtio_tswap16s(vdev, &desc->flags); > > > - address_space_write_cached(cache, off, &desc->flags, sizeof(desc->flags)); > > > + virtio_stw_phys_cached(vdev, cache, off, desc->flags); > > > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > > > } > > > > > > -- > > > 2.25.1 > >
On Fri, Nov 12, 2021 at 6:04 PM Michael S. Tsirkin <mst@redhat.com> wrote: > > On Fri, Nov 12, 2021 at 10:23:12AM +0800, Jason Wang wrote: > > On Thu, Nov 11, 2021 at 4:27 PM Michael S. Tsirkin <mst@redhat.com> wrote: > > > > > > On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > > > > We used to access packed descriptor flags via > > > > address_space_{write|read}_cached(). When we hit the cache, memcpy() > > > > is used which is not an atomic operation which may lead a wrong value > > > > is read or wrote. > > > > > > Could you clarify where's the memcpy that you see? > > > Thanks! > > > > In the address_space_{write|read}_cached it self: > > > > static inline MemTxResult > > =>dress_space_write_cached(MemoryRegionCache *cache, hwaddr addr, > > const void *buf, hwaddr len) > > { > > assert(addr < cache->len && len <= cache->len - addr); > > if (likely(cache->ptr)) { > > memcpy(cache->ptr + addr, buf, len); > > return MEMTX_OK; > > } else { > > return address_space_write_cached_slow(cache, addr, buf, len); > > } > > } > > > > Thanks > > But that's a copy from the cache, not from guest memory. I may miss something but it looks to me the cache is the cache of address translation not the cache from guest memory: See address_space_cache_init(): cache->ptr = qemu_ram_ptr_length(mr->ram_block, cache->xlat, &l, true); > I don't see how it can change so I don't see why it needs > to be atomic. Was there an actual issue you observed or > is this theoretical? During code review. Thanks > > > > > > > > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > > > > sure the aceess is atomic. > > > > > > > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > > > > Cc: qemu-stable@nongnu.org > > > > Signed-off-by: Jason Wang <jasowang@redhat.com> > > > > --- > > > > hw/virtio/virtio.c | 11 ++++------- > > > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > > > > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > > > > index cc69a9b881..939bcbfeb9 100644 > > > > --- a/hw/virtio/virtio.c > > > > +++ b/hw/virtio/virtio.c > > > > @@ -507,11 +507,9 @@ static void vring_packed_desc_read_flags(VirtIODevice *vdev, > > > > MemoryRegionCache *cache, > > > > int i) > > > > { > > > > - address_space_read_cached(cache, > > > > - i * sizeof(VRingPackedDesc) + > > > > - offsetof(VRingPackedDesc, flags), > > > > - flags, sizeof(*flags)); > > > > - virtio_tswap16s(vdev, flags); > > > > + hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > > > > + > > > > + *flags = virtio_lduw_phys_cached(vdev, cache, off); > > > > } > > > > > > > > static void vring_packed_desc_read(VirtIODevice *vdev, > > > > @@ -564,8 +562,7 @@ static void vring_packed_desc_write_flags(VirtIODevice *vdev, > > > > { > > > > hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); > > > > > > > > - virtio_tswap16s(vdev, &desc->flags); > > > > - address_space_write_cached(cache, off, &desc->flags, sizeof(desc->flags)); > > > > + virtio_stw_phys_cached(vdev, cache, off, desc->flags); > > > > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > > > > } > > > > > > > > -- > > > > 2.25.1 > > > >
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index cc69a9b881..939bcbfeb9 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -507,11 +507,9 @@ static void vring_packed_desc_read_flags(VirtIODevice *vdev, MemoryRegionCache *cache, int i) { - address_space_read_cached(cache, - i * sizeof(VRingPackedDesc) + - offsetof(VRingPackedDesc, flags), - flags, sizeof(*flags)); - virtio_tswap16s(vdev, flags); + hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); + + *flags = virtio_lduw_phys_cached(vdev, cache, off); } static void vring_packed_desc_read(VirtIODevice *vdev, @@ -564,8 +562,7 @@ static void vring_packed_desc_write_flags(VirtIODevice *vdev, { hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags); - virtio_tswap16s(vdev, &desc->flags); - address_space_write_cached(cache, off, &desc->flags, sizeof(desc->flags)); + virtio_stw_phys_cached(vdev, cache, off, desc->flags); address_space_cache_invalidate(cache, off, sizeof(desc->flags)); }
We used to access packed descriptor flags via address_space_{write|read}_cached(). When we hit the cache, memcpy() is used which is not an atomic operation which may lead a wrong value is read or wrote. So this patch switches to use virito_{stw|lduw}_phys_cached() to make sure the aceess is atomic. Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> --- hw/virtio/virtio.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)