From a821ce59338c79bb72dc844dd44ea53701965b2b Mon Sep 17 00:00:00 2001 From: Michael S. Tsirkin Date: Mon, 23 Apr 2012 15:46:22 +0300 Subject: virtio: order index/descriptor reads virtio has the equivalent of: if (vq->last_avail_index != vring_avail_idx(vq)) { read descriptor head at vq->last_avail_index; } In theory, processor can reorder descriptor head read to happen speculatively before the index read. this would trigger the following race: host descriptor head read <- reads invalid head from ring guest writes valid descriptor head guest writes avail index host avail index read <- observes valid index as a result host will use an invalid head value. This was not observed in the field by me but after the experience with the previous two races I think it is prudent to address this theoretical race condition. Signed-off-by: Michael S. Tsirkin --- hw/virtio.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'hw/virtio.c') diff --git a/hw/virtio.c b/hw/virtio.c index 5615b59a6c..168abe4864 100644 --- a/hw/virtio.c +++ b/hw/virtio.c @@ -287,6 +287,11 @@ static int virtqueue_num_heads(VirtQueue *vq, unsigned int idx) idx, vring_avail_idx(vq)); exit(1); } + /* On success, callers read a descriptor at vq->last_avail_idx. + * Make sure descriptor read does not bypass avail index read. */ + if (num_heads) { + smp_rmb(); + } return num_heads; } -- cgit v1.2.3-55-g7522