On Fri, Jul 21, 2023 at 3:51 PM Hanna Czenczek <hre...@redhat.com> wrote:
> virtio_queue_packed_set_last_avail_idx() is used by vhost devices to set > the internal queue indices to what has been reported by the vhost > back-end through GET_VRING_BASE. For packed virtqueues, this > 32-bit value is expected to contain both the device's internal avail and > used indices, as well as their respective wrap counters. > > To get the used index, we shift the 32-bit value right by 16, and then > apply a mask of 0x7ffff. That seems to be a typo, because it should be > 0x7fff; first of all, the virtio specification says that the maximum > queue size for packed virt queues is 2^15, so the indices cannot exceed > 2^15 - 1 anyway, making 0x7fff the correct mask. Second, the mask > clearly is wrong from context, too, given that (A) `idx & 0x70000` must > be 0 at this point (`idx` is 32 bit and was shifted to the right by 16 > already), (B) `idx & 0x8000` is the used_wrap_counter, so should not be > part of the used index, and (C) `vq->used_idx` is a `uint16_t`, so > cannot fit the 0x70000 part of the mask anyway. > > This most likely never produced any guest-visible bugs, though, because > for a vhost device, qemu will probably not evaluate the used index > outside of virtio_queue_packed_get_last_avail_idx(), where we > reconstruct the 32-bit value from avail and used indices and their wrap > counters again. There, it does not matter whether the highest bit of > the used_idx is the used index wrap counter, because we put the wrap > counter exactly in that position anyway. > > Signed-off-by: Hanna Czenczek <hre...@redhat.com> > --- > hw/virtio/virtio.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > index 295a603e58..309038fd46 100644 > --- a/hw/virtio/virtio.c > +++ b/hw/virtio/virtio.c > @@ -3321,7 +3321,7 @@ static void > virtio_queue_packed_set_last_avail_idx(VirtIODevice *vdev, > vq->last_avail_wrap_counter = > vq->shadow_avail_wrap_counter = !!(idx & 0x8000); > idx >>= 16; > - vq->used_idx = idx & 0x7ffff; > + vq->used_idx = idx & 0x7fff; > isn't there a macro with this value? or a macro that convert a number of bits in a mask?, something like: #define BIT_MASK(n) (~(~0 << n)) > vq->used_wrap_counter = !!(idx & 0x8000); > } > > -- > 2.41.0 > > > -- German
