Re: [PATCH 1/2] virtio: use virtio accessor to access packed descriptor flags
On Fri, Nov 12, 2021 at 6:04 PM Michael S. Tsirkin wrote: > > On Fri, Nov 12, 2021 at 10:23:12AM +0800, Jason Wang wrote: > > On Thu, Nov 11, 2021 at 4:27 PM Michael S. Tsirkin wrote: > > > > > > On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > > > > We used to access packed descriptor flags via > > > > address_space_{write|read}_cached(). When we hit the cache, memcpy() > > > > is used which is not an atomic operation which may lead a wrong value > > > > is read or wrote. > > > > > > Could you clarify where's the memcpy that you see? > > > Thanks! > > > > In the address_space_{write|read}_cached it self: > > > > static inline MemTxResult > > =>dress_space_write_cached(MemoryRegionCache *cache, hwaddr addr, > >const void *buf, hwaddr len) > > { > > assert(addr < cache->len && len <= cache->len - addr); > > if (likely(cache->ptr)) { > > memcpy(cache->ptr + addr, buf, len); > > return MEMTX_OK; > > } else { > > return address_space_write_cached_slow(cache, addr, buf, len); > > } > > } > > > > Thanks > > But that's a copy from the cache, not from guest memory. I may miss something but it looks to me the cache is the cache of address translation not the cache from guest memory: See address_space_cache_init(): cache->ptr = qemu_ram_ptr_length(mr->ram_block, cache->xlat, , true); > I don't see how it can change so I don't see why it needs > to be atomic. Was there an actual issue you observed or > is this theoretical? During code review. Thanks > > > > > > > > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > > > > sure the aceess is atomic. > > > > > > > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > > > > Cc: qemu-sta...@nongnu.org > > > > Signed-off-by: Jason Wang > > > > --- > > > > hw/virtio/virtio.c | 11 --- > > > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > > > > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > > > > index cc69a9b881..939bcbfeb9 100644 > > > > --- a/hw/virtio/virtio.c > > > > +++ b/hw/virtio/virtio.c > > > > @@ -507,11 +507,9 @@ static void > > > > vring_packed_desc_read_flags(VirtIODevice *vdev, > > > > MemoryRegionCache *cache, > > > > int i) > > > > { > > > > -address_space_read_cached(cache, > > > > - i * sizeof(VRingPackedDesc) + > > > > - offsetof(VRingPackedDesc, flags), > > > > - flags, sizeof(*flags)); > > > > -virtio_tswap16s(vdev, flags); > > > > +hwaddr off = i * sizeof(VRingPackedDesc) + > > > > offsetof(VRingPackedDesc, flags); > > > > + > > > > +*flags = virtio_lduw_phys_cached(vdev, cache, off); > > > > } > > > > > > > > static void vring_packed_desc_read(VirtIODevice *vdev, > > > > @@ -564,8 +562,7 @@ static void > > > > vring_packed_desc_write_flags(VirtIODevice *vdev, > > > > { > > > > hwaddr off = i * sizeof(VRingPackedDesc) + > > > > offsetof(VRingPackedDesc, flags); > > > > > > > > -virtio_tswap16s(vdev, >flags); > > > > -address_space_write_cached(cache, off, >flags, > > > > sizeof(desc->flags)); > > > > +virtio_stw_phys_cached(vdev, cache, off, desc->flags); > > > > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > > > > } > > > > > > > > -- > > > > 2.25.1 > > > >
Re: [PATCH 1/2] virtio: use virtio accessor to access packed descriptor flags
On Fri, Nov 12, 2021 at 10:23:12AM +0800, Jason Wang wrote: > On Thu, Nov 11, 2021 at 4:27 PM Michael S. Tsirkin wrote: > > > > On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > > > We used to access packed descriptor flags via > > > address_space_{write|read}_cached(). When we hit the cache, memcpy() > > > is used which is not an atomic operation which may lead a wrong value > > > is read or wrote. > > > > Could you clarify where's the memcpy that you see? > > Thanks! > > In the address_space_{write|read}_cached it self: > > static inline MemTxResult > =>dress_space_write_cached(MemoryRegionCache *cache, hwaddr addr, >const void *buf, hwaddr len) > { > assert(addr < cache->len && len <= cache->len - addr); > if (likely(cache->ptr)) { > memcpy(cache->ptr + addr, buf, len); > return MEMTX_OK; > } else { > return address_space_write_cached_slow(cache, addr, buf, len); > } > } > > Thanks But that's a copy from the cache, not from guest memory. I don't see how it can change so I don't see why it needs to be atomic. Was there an actual issue you observed or is this theoretical? > > > > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > > > sure the aceess is atomic. > > > > > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > > > Cc: qemu-sta...@nongnu.org > > > Signed-off-by: Jason Wang > > > --- > > > hw/virtio/virtio.c | 11 --- > > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > > > index cc69a9b881..939bcbfeb9 100644 > > > --- a/hw/virtio/virtio.c > > > +++ b/hw/virtio/virtio.c > > > @@ -507,11 +507,9 @@ static void > > > vring_packed_desc_read_flags(VirtIODevice *vdev, > > > MemoryRegionCache *cache, > > > int i) > > > { > > > -address_space_read_cached(cache, > > > - i * sizeof(VRingPackedDesc) + > > > - offsetof(VRingPackedDesc, flags), > > > - flags, sizeof(*flags)); > > > -virtio_tswap16s(vdev, flags); > > > +hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, > > > flags); > > > + > > > +*flags = virtio_lduw_phys_cached(vdev, cache, off); > > > } > > > > > > static void vring_packed_desc_read(VirtIODevice *vdev, > > > @@ -564,8 +562,7 @@ static void > > > vring_packed_desc_write_flags(VirtIODevice *vdev, > > > { > > > hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, > > > flags); > > > > > > -virtio_tswap16s(vdev, >flags); > > > -address_space_write_cached(cache, off, >flags, > > > sizeof(desc->flags)); > > > +virtio_stw_phys_cached(vdev, cache, off, desc->flags); > > > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > > > } > > > > > > -- > > > 2.25.1 > >
Re: [PATCH 1/2] virtio: use virtio accessor to access packed descriptor flags
On Thu, Nov 11, 2021 at 4:27 PM Michael S. Tsirkin wrote: > > On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > > We used to access packed descriptor flags via > > address_space_{write|read}_cached(). When we hit the cache, memcpy() > > is used which is not an atomic operation which may lead a wrong value > > is read or wrote. > > Could you clarify where's the memcpy that you see? > Thanks! In the address_space_{write|read}_cached it self: static inline MemTxResult =>dress_space_write_cached(MemoryRegionCache *cache, hwaddr addr, const void *buf, hwaddr len) { assert(addr < cache->len && len <= cache->len - addr); if (likely(cache->ptr)) { memcpy(cache->ptr + addr, buf, len); return MEMTX_OK; } else { return address_space_write_cached_slow(cache, addr, buf, len); } } Thanks > > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > > sure the aceess is atomic. > > > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > > Cc: qemu-sta...@nongnu.org > > Signed-off-by: Jason Wang > > --- > > hw/virtio/virtio.c | 11 --- > > 1 file changed, 4 insertions(+), 7 deletions(-) > > > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > > index cc69a9b881..939bcbfeb9 100644 > > --- a/hw/virtio/virtio.c > > +++ b/hw/virtio/virtio.c > > @@ -507,11 +507,9 @@ static void vring_packed_desc_read_flags(VirtIODevice > > *vdev, > > MemoryRegionCache *cache, > > int i) > > { > > -address_space_read_cached(cache, > > - i * sizeof(VRingPackedDesc) + > > - offsetof(VRingPackedDesc, flags), > > - flags, sizeof(*flags)); > > -virtio_tswap16s(vdev, flags); > > +hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, > > flags); > > + > > +*flags = virtio_lduw_phys_cached(vdev, cache, off); > > } > > > > static void vring_packed_desc_read(VirtIODevice *vdev, > > @@ -564,8 +562,7 @@ static void vring_packed_desc_write_flags(VirtIODevice > > *vdev, > > { > > hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, > > flags); > > > > -virtio_tswap16s(vdev, >flags); > > -address_space_write_cached(cache, off, >flags, > > sizeof(desc->flags)); > > +virtio_stw_phys_cached(vdev, cache, off, desc->flags); > > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > > } > > > > -- > > 2.25.1 >
Re: [PATCH 1/2] virtio: use virtio accessor to access packed descriptor flags
On Thu, Nov 11, 2021 at 02:38:53PM +0800, Jason Wang wrote: > We used to access packed descriptor flags via > address_space_{write|read}_cached(). When we hit the cache, memcpy() > is used which is not an atomic operation which may lead a wrong value > is read or wrote. Could you clarify where's the memcpy that you see? Thanks! > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > sure the aceess is atomic. > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > Cc: qemu-sta...@nongnu.org > Signed-off-by: Jason Wang > --- > hw/virtio/virtio.c | 11 --- > 1 file changed, 4 insertions(+), 7 deletions(-) > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > index cc69a9b881..939bcbfeb9 100644 > --- a/hw/virtio/virtio.c > +++ b/hw/virtio/virtio.c > @@ -507,11 +507,9 @@ static void vring_packed_desc_read_flags(VirtIODevice > *vdev, > MemoryRegionCache *cache, > int i) > { > -address_space_read_cached(cache, > - i * sizeof(VRingPackedDesc) + > - offsetof(VRingPackedDesc, flags), > - flags, sizeof(*flags)); > -virtio_tswap16s(vdev, flags); > +hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, > flags); > + > +*flags = virtio_lduw_phys_cached(vdev, cache, off); > } > > static void vring_packed_desc_read(VirtIODevice *vdev, > @@ -564,8 +562,7 @@ static void vring_packed_desc_write_flags(VirtIODevice > *vdev, > { > hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, > flags); > > -virtio_tswap16s(vdev, >flags); > -address_space_write_cached(cache, off, >flags, > sizeof(desc->flags)); > +virtio_stw_phys_cached(vdev, cache, off, desc->flags); > address_space_cache_invalidate(cache, off, sizeof(desc->flags)); > } > > -- > 2.25.1
Re: [PATCH 1/2] virtio: use virtio accessor to access packed descriptor flags
On 11/11/21 07:38, Jason Wang wrote: > We used to access packed descriptor flags via > address_space_{write|read}_cached(). When we hit the cache, memcpy() > is used which is not an atomic operation which may lead a wrong value > is read or wrote. > > So this patch switches to use virito_{stw|lduw}_phys_cached() to make > sure the aceess is atomic. > > Fixes: 86044b24e865f ("virtio: basic packed virtqueue support") > Cc: qemu-sta...@nongnu.org > Signed-off-by: Jason Wang > --- > hw/virtio/virtio.c | 11 --- > 1 file changed, 4 insertions(+), 7 deletions(-) Reviewed-by: Philippe Mathieu-Daudé