Re: [Qemu-devel] [PATCH] ehci: fix fetch qtd race

[Gerd Hoffmann]

On Mon, Nov 26, 2018 at 10:34:13AM +0000, li qiang wrote:
> 
> 在 2018/11/26 18:08, Gerd Hoffmann 写道:
> > The token field contains the (guest-filled) state of the qtd, which
> > indicates whenever the other fields are valid or not.  So make sure
> > we read the token first, otherwise we may end up with an stale next
> > pointer:
> >
> >    (1) ehci reads next
> >    (2) guest writes next
> >    (3) guest writes token
> >    (4) ehci reads token
> >    (5) ehci operates with stale next.
> 
> Hello Gerd,
> 
> Could you please explain how this can happen?
> 
> IMO, the device emulation holds the BQL and the guest can't execute, how 
> can the guest

No.  vcpus can run in parallel to the iothread (at least as long as they
are running in guest context, when they vmexit they have to wait for the
BQL).

cheers,
  Gerd