Commit b2a44fca authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

address_space_read: address_space_to_flatview needs RCU lock 



address_space_read is calling address_space_to_flatview but it can
be called outside the RCU lock.  To fix it, push the rcu_read_lock/unlock
pair up from flatview_read_full to address_space_read's constant size
fast path and address_space_read_full.

Reviewed-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 4c6ebbb3

exec.c

+25 −13
Original line number Diff line number Diff line
@@ -2616,6 +2616,8 @@ static const MemoryRegionOps watch_mem_ops = { 
    },

};



static MemTxResult flatview_read(FlatView *fv, hwaddr addr,

                                      MemTxAttrs attrs, uint8_t *buf, int len);

static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,

                                  const uint8_t *buf, int len);

static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
@@ -3165,24 +3167,18 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr, 
    return result;

}



MemTxResult flatview_read_full(FlatView *fv, hwaddr addr,

/* Called from RCU critical section.  */

static MemTxResult flatview_read(FlatView *fv, hwaddr addr,

                                 MemTxAttrs attrs, uint8_t *buf, int len)

{

    hwaddr l;

    hwaddr addr1;

    MemoryRegion *mr;

    MemTxResult result = MEMTX_OK;



    if (len > 0) {

        rcu_read_lock();

    l = len;

    mr = flatview_translate(fv, addr, &addr1, &l, false);

        result = flatview_read_continue(fv, addr, attrs, buf, len,

    return flatview_read_continue(fv, addr, attrs, buf, len,

                                  addr1, l, mr);

        rcu_read_unlock();

    }



    return result;

}



static MemTxResult flatview_rw(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
@@ -3203,6 +3199,22 @@ MemTxResult address_space_rw(AddressSpace *as, hwaddr addr, 
                       addr, attrs, buf, len, is_write);

}



MemTxResult address_space_read_full(AddressSpace *as, hwaddr addr,

                                    MemTxAttrs attrs, uint8_t *buf, int len)

{

    MemTxResult result = MEMTX_OK;

    FlatView *fv;



    if (len > 0) {

        rcu_read_lock();

        fv = address_space_to_flatview(as);

        result = flatview_read(fv, addr, attrs, buf, len);

        rcu_read_unlock();

    }



    return result;

}



MemTxResult address_space_write(AddressSpace *as, hwaddr addr,

                                MemTxAttrs attrs,

                                const uint8_t *buf, int len)

include/exec/memory.h

+10 −15
Original line number Diff line number Diff line
@@ -1917,13 +1917,12 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len, 




/* Internal functions, part of the implementation of address_space_read.  */

MemTxResult address_space_read_full(AddressSpace *as, hwaddr addr,

                                    MemTxAttrs attrs, uint8_t *buf, int len);

MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,

                                   MemTxAttrs attrs, uint8_t *buf,

                                   int len, hwaddr addr1, hwaddr l,

                                   MemoryRegion *mr);



MemTxResult flatview_read_full(FlatView *fv, hwaddr addr,

                               MemTxAttrs attrs, uint8_t *buf, int len);

void *qemu_map_ram_ptr(RAMBlock *ram_block, ram_addr_t addr);



static inline bool memory_access_is_direct(MemoryRegion *mr, bool is_write)
@@ -1942,25 +1941,28 @@ static inline bool memory_access_is_direct(MemoryRegion *mr, bool is_write) 
 *

 * Return a MemTxResult indicating whether the operation succeeded

 * or failed (eg unassigned memory, device rejected the transaction,

 * IOMMU fault).

 * IOMMU fault).  Called within RCU critical section.

 *

 * @fv: #FlatView to be accessed

 * @as: #AddressSpace to be accessed

 * @addr: address within that address space

 * @attrs: memory transaction attributes

 * @buf: buffer with the data transferred

 */

static inline __attribute__((__always_inline__))

MemTxResult flatview_read(FlatView *fv, hwaddr addr, MemTxAttrs attrs,

                          uint8_t *buf, int len)

MemTxResult address_space_read(AddressSpace *as, hwaddr addr,

                               MemTxAttrs attrs, uint8_t *buf,

                               int len)

{

    MemTxResult result = MEMTX_OK;

    hwaddr l, addr1;

    void *ptr;

    MemoryRegion *mr;

    FlatView *fv;



    if (__builtin_constant_p(len)) {

        if (len) {

            rcu_read_lock();

            fv = address_space_to_flatview(as);

            l = len;

            mr = flatview_translate(fv, addr, &addr1, &l, false);

            if (len == l && memory_access_is_direct(mr, false)) {
@@ -1973,18 +1975,11 @@ MemTxResult flatview_read(FlatView *fv, hwaddr addr, MemTxAttrs attrs, 
            rcu_read_unlock();

        }

    } else {

        result = flatview_read_full(fv, addr, attrs, buf, len);

        result = address_space_read_full(as, addr, attrs, buf, len);

    }

    return result;

}



static inline MemTxResult address_space_read(AddressSpace *as, hwaddr addr,

                                             MemTxAttrs attrs, uint8_t *buf,

                                             int len)

{

    return flatview_read(address_space_to_flatview(as), addr, attrs, buf, len);

}



/**

 * address_space_read_cached: read from a cached RAM region

 *