From nobody Thu May 2 20:50:28 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489601083556624.8822610925946; Wed, 15 Mar 2017 11:04:43 -0700 (PDT) Received: from localhost ([::1]:38850 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDHt-00058d-B8 for importer@patchew.org; Wed, 15 Mar 2017 14:04:41 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50644) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDEk-00033K-5M for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1coDEi-0006k5-R2 for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:26 -0400 Received: from mail.kernel.org ([198.145.29.136]:59012) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1coDEi-0006il-K3 for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:24 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id AF8E9203E5; Wed, 15 Mar 2017 18:01:21 +0000 (UTC) Received: from redhat.com (pool-96-237-235-121.bstnma.fios.verizon.net [96.237.235.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3A1BA20382; Wed, 15 Mar 2017 18:01:20 +0000 (UTC) Date: Wed, 15 Mar 2017 20:01:19 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1489600837-11541-2-git-send-email-mst@redhat.com> References: <1489600837-11541-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1489600837-11541-1-git-send-email-mst@redhat.com> X-Mailer: git-send-email 2.8.0.287.g0deeb61 X-Mutt-Fcc: =sent X-Virus-Scanned: ClamAV using ClamSMTP X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 198.145.29.136 Subject: [Qemu-devel] [PULL 1/7] Bugfix: Handle error if VM Generation ID device not present X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , "Dr. David Alan Gilbert" , Ben Warren , Igor Mammedov Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ben Warren This was crashing due to NULL-pointer dereference QMP Test case: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D (QEMU) query-vm-generation-id {"error": {"class": "GenericError", "desc": "VM Generation ID device not found"}} HMP Test case: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D virsh # qemu-monitor-command --hmp 3 info vm-generation-id VM Generation ID device not found Signed-off-by: Ben Warren Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: Eric Blake --- hmp.c | 4 +++- hw/acpi/vmgenid.c | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/hmp.c b/hmp.c index 261843f..edb8970 100644 --- a/hmp.c +++ b/hmp.c @@ -2608,9 +2608,11 @@ void hmp_hotpluggable_cpus(Monitor *mon, const QDict= *qdict) =20 void hmp_info_vm_generation_id(Monitor *mon, const QDict *qdict) { - GuidInfo *info =3D qmp_query_vm_generation_id(NULL); + Error *err =3D NULL; + GuidInfo *info =3D qmp_query_vm_generation_id(&err); if (info) { monitor_printf(mon, "%s\n", info->guid); } + hmp_handle_error(mon, &err); qapi_free_GuidInfo(info); } diff --git a/hw/acpi/vmgenid.c b/hw/acpi/vmgenid.c index 744f284..7a3ad17 100644 --- a/hw/acpi/vmgenid.c +++ b/hw/acpi/vmgenid.c @@ -248,6 +248,7 @@ GuidInfo *qmp_query_vm_generation_id(Error **errp) Object *obj =3D find_vmgenid_dev(); =20 if (!obj) { + error_setg(errp, "VM Generation ID device not found"); return NULL; } vms =3D VMGENID(obj); --=20 MST From nobody Thu May 2 20:50:28 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489600954352743.6477945936672; Wed, 15 Mar 2017 11:02:34 -0700 (PDT) Received: from localhost ([::1]:38842 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDFm-00035S-PK for importer@patchew.org; Wed, 15 Mar 2017 14:02:30 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50668) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDEl-00033z-6c for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1coDEk-0006l4-Cb for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:27 -0400 Received: from mail.kernel.org ([198.145.29.136]:59036) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1coDEk-0006kY-6X for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:26 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 3207D20382; Wed, 15 Mar 2017 18:01:24 +0000 (UTC) Received: from redhat.com (pool-96-237-235-121.bstnma.fios.verizon.net [96.237.235.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C0420202DD; Wed, 15 Mar 2017 18:01:22 +0000 (UTC) Date: Wed, 15 Mar 2017 20:01:21 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1489600837-11541-3-git-send-email-mst@redhat.com> References: <1489600837-11541-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1489600837-11541-1-git-send-email-mst@redhat.com> X-Mailer: git-send-email 2.8.0.287.g0deeb61 X-Mutt-Fcc: =sent X-Virus-Scanned: ClamAV using ClamSMTP X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 198.145.29.136 Subject: [Qemu-devel] [PULL 2/7] virtio: guard against NULL pfn X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Cornelia Huck , Peter Maydell , Jason Wang , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jason Wang To avoid access stale memory region cache after reset, this patch check the existence of virtqueue pfn for all exported virtqueue access helpers before trying to use them. Cc: Cornelia Huck Cc: Paolo Bonzini Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/virtio.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index efce4b3..9164579 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -318,6 +318,10 @@ int virtio_queue_ready(VirtQueue *vq) * Called within rcu_read_lock(). */ static int virtio_queue_empty_rcu(VirtQueue *vq) { + if (unlikely(!vq->vring.avail)) { + return 1; + } + if (vq->shadow_avail_idx !=3D vq->last_avail_idx) { return 0; } @@ -329,6 +333,10 @@ int virtio_queue_empty(VirtQueue *vq) { bool empty; =20 + if (unlikely(!vq->vring.avail)) { + return 1; + } + if (vq->shadow_avail_idx !=3D vq->last_avail_idx) { return 0; } @@ -431,6 +439,10 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElem= ent *elem, return; } =20 + if (unlikely(!vq->vring.used)) { + return; + } + idx =3D (idx + vq->used_idx) % vq->vring.num; =20 uelem.id =3D elem->index; @@ -448,6 +460,10 @@ void virtqueue_flush(VirtQueue *vq, unsigned int count) return; } =20 + if (unlikely(!vq->vring.used)) { + return; + } + /* Make sure buffer is written before we update index. */ smp_wmb(); trace_virtqueue_flush(vq, count); @@ -546,6 +562,16 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned= int *in_bytes, int64_t len =3D 0; int rc; =20 + if (unlikely(!vq->vring.desc)) { + if (in_bytes) { + *in_bytes =3D 0; + } + if (out_bytes) { + *out_bytes =3D 0; + } + return; + } + rcu_read_lock(); idx =3D vq->last_avail_idx; total_bufs =3D in_total =3D out_total =3D 0; --=20 MST From nobody Thu May 2 20:50:28 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489601103057706.4484432009414; Wed, 15 Mar 2017 11:05:03 -0700 (PDT) Received: from localhost ([::1]:38852 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDIC-0005Px-Po for importer@patchew.org; Wed, 15 Mar 2017 14:05:00 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50714) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDEp-00037m-13 for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1coDEn-0006oR-MJ for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:31 -0400 Received: from mail.kernel.org ([198.145.29.136]:59074) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1coDEn-0006ma-6J for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:29 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E4EDA203E1; Wed, 15 Mar 2017 18:01:26 +0000 (UTC) Received: from redhat.com (pool-96-237-235-121.bstnma.fios.verizon.net [96.237.235.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 42DE4202DD; Wed, 15 Mar 2017 18:01:25 +0000 (UTC) Date: Wed, 15 Mar 2017 20:01:24 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1489600837-11541-4-git-send-email-mst@redhat.com> References: <1489600837-11541-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1489600837-11541-1-git-send-email-mst@redhat.com> X-Mailer: git-send-email 2.8.0.287.g0deeb61 X-Mutt-Fcc: =sent X-Virus-Scanned: ClamAV using ClamSMTP X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 198.145.29.136 Subject: [Qemu-devel] [PULL 3/7] virtio: destroy region cache during reset X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Cornelia Huck , Peter Maydell , Jason Wang , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jason Wang We don't destroy region cache during reset which can make the maps of previous driver leaked to a buggy or malicious driver that don't set vring address before starting to use the device. Fix this by destroy the region cache during reset and validate it before trying to see them. Cc: Cornelia Huck Cc: Paolo Bonzini Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/virtio.c | 45 ++++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 9164579..a00380f 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -185,10 +185,16 @@ static void vring_desc_read(VirtIODevice *vdev, VRing= Desc *desc, virtio_tswap16s(vdev, &desc->next); } =20 +static VRingMemoryRegionCaches *vring_get_region_caches(struct VirtQueue *= vq) +{ + VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + assert(caches !=3D NULL); + return caches; +} /* Called within rcu_read_lock(). */ static inline uint16_t vring_avail_flags(VirtQueue *vq) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); hwaddr pa =3D offsetof(VRingAvail, flags); return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa); } @@ -196,7 +202,7 @@ static inline uint16_t vring_avail_flags(VirtQueue *vq) /* Called within rcu_read_lock(). */ static inline uint16_t vring_avail_idx(VirtQueue *vq) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); hwaddr pa =3D offsetof(VRingAvail, idx); vq->shadow_avail_idx =3D virtio_lduw_phys_cached(vq->vdev, &caches->av= ail, pa); return vq->shadow_avail_idx; @@ -205,7 +211,7 @@ static inline uint16_t vring_avail_idx(VirtQueue *vq) /* Called within rcu_read_lock(). */ static inline uint16_t vring_avail_ring(VirtQueue *vq, int i) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); hwaddr pa =3D offsetof(VRingAvail, ring[i]); return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa); } @@ -220,7 +226,7 @@ static inline uint16_t vring_get_used_event(VirtQueue *= vq) static inline void vring_used_write(VirtQueue *vq, VRingUsedElem *uelem, int i) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); hwaddr pa =3D offsetof(VRingUsed, ring[i]); virtio_tswap32s(vq->vdev, &uelem->id); virtio_tswap32s(vq->vdev, &uelem->len); @@ -231,7 +237,7 @@ static inline void vring_used_write(VirtQueue *vq, VRin= gUsedElem *uelem, /* Called within rcu_read_lock(). */ static uint16_t vring_used_idx(VirtQueue *vq) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); hwaddr pa =3D offsetof(VRingUsed, idx); return virtio_lduw_phys_cached(vq->vdev, &caches->used, pa); } @@ -239,7 +245,7 @@ static uint16_t vring_used_idx(VirtQueue *vq) /* Called within rcu_read_lock(). */ static inline void vring_used_idx_set(VirtQueue *vq, uint16_t val) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); hwaddr pa =3D offsetof(VRingUsed, idx); virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val); address_space_cache_invalidate(&caches->used, pa, sizeof(val)); @@ -249,7 +255,7 @@ static inline void vring_used_idx_set(VirtQueue *vq, ui= nt16_t val) /* Called within rcu_read_lock(). */ static inline void vring_used_flags_set_bit(VirtQueue *vq, int mask) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); VirtIODevice *vdev =3D vq->vdev; hwaddr pa =3D offsetof(VRingUsed, flags); uint16_t flags =3D virtio_lduw_phys_cached(vq->vdev, &caches->used, pa= ); @@ -261,7 +267,7 @@ static inline void vring_used_flags_set_bit(VirtQueue *= vq, int mask) /* Called within rcu_read_lock(). */ static inline void vring_used_flags_unset_bit(VirtQueue *vq, int mask) { - VRingMemoryRegionCaches *caches =3D atomic_rcu_read(&vq->vring.caches); + VRingMemoryRegionCaches *caches =3D vring_get_region_caches(vq); VirtIODevice *vdev =3D vq->vdev; hwaddr pa =3D offsetof(VRingUsed, flags); uint16_t flags =3D virtio_lduw_phys_cached(vq->vdev, &caches->used, pa= ); @@ -279,7 +285,7 @@ static inline void vring_set_avail_event(VirtQueue *vq,= uint16_t val) return; } =20 - caches =3D atomic_rcu_read(&vq->vring.caches); + caches =3D vring_get_region_caches(vq); pa =3D offsetof(VRingUsed, ring[vq->vring.num]); virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val); address_space_cache_invalidate(&caches->used, pa, sizeof(val)); @@ -577,7 +583,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned = int *in_bytes, total_bufs =3D in_total =3D out_total =3D 0; =20 max =3D vq->vring.num; - caches =3D atomic_rcu_read(&vq->vring.caches); + caches =3D vring_get_region_caches(vq); if (caches->desc.len < max * sizeof(VRingDesc)) { virtio_error(vdev, "Cannot map descriptor ring"); goto err; @@ -844,7 +850,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz) =20 i =3D head; =20 - caches =3D atomic_rcu_read(&vq->vring.caches); + caches =3D vring_get_region_caches(vq); if (caches->desc.len < max * sizeof(VRingDesc)) { virtio_error(vdev, "Cannot map descriptor ring"); goto done; @@ -1143,6 +1149,17 @@ static enum virtio_device_endian virtio_current_cpu_= endian(void) } } =20 +static void virtio_virtqueue_reset_region_cache(struct VirtQueue *vq) +{ + VRingMemoryRegionCaches *caches; + + caches =3D atomic_read(&vq->vring.caches); + atomic_rcu_set(&vq->vring.caches, NULL); + if (caches) { + call_rcu(caches, virtio_free_region_cache, rcu); + } +} + void virtio_reset(void *opaque) { VirtIODevice *vdev =3D opaque; @@ -1183,6 +1200,7 @@ void virtio_reset(void *opaque) vdev->vq[i].notification =3D true; vdev->vq[i].vring.num =3D vdev->vq[i].vring.num_default; vdev->vq[i].inuse =3D 0; + virtio_virtqueue_reset_region_cache(&vdev->vq[i]); } } =20 @@ -2477,13 +2495,10 @@ static void virtio_device_free_virtqueues(VirtIODev= ice *vdev) } =20 for (i =3D 0; i < VIRTIO_QUEUE_MAX; i++) { - VRingMemoryRegionCaches *caches; if (vdev->vq[i].vring.num =3D=3D 0) { break; } - caches =3D atomic_read(&vdev->vq[i].vring.caches); - atomic_set(&vdev->vq[i].vring.caches, NULL); - virtio_free_region_cache(caches); + virtio_virtqueue_reset_region_cache(&vdev->vq[i]); } g_free(vdev->vq); } --=20 MST From nobody Thu May 2 20:50:28 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489601193469355.8976549335207; Wed, 15 Mar 2017 11:06:33 -0700 (PDT) Received: from localhost ([::1]:38861 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDJd-0006pI-6X for importer@patchew.org; Wed, 15 Mar 2017 14:06:29 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50738) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDEq-00039A-V4 for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1coDEp-0006q2-Jx for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:33 -0400 Received: from mail.kernel.org ([198.145.29.136]:59106) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1coDEp-0006pF-BI for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:31 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 642BF202DD; Wed, 15 Mar 2017 18:01:29 +0000 (UTC) Received: from redhat.com (pool-96-237-235-121.bstnma.fios.verizon.net [96.237.235.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F3B6A203E5; Wed, 15 Mar 2017 18:01:27 +0000 (UTC) Date: Wed, 15 Mar 2017 20:01:27 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1489600837-11541-5-git-send-email-mst@redhat.com> References: <1489600837-11541-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1489600837-11541-1-git-send-email-mst@redhat.com> X-Mailer: git-send-email 2.8.0.287.g0deeb61 X-Mutt-Fcc: =sent X-Virus-Scanned: ClamAV using ClamSMTP X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 198.145.29.136 Subject: [Qemu-devel] [PULL 4/7] virtio: validate address space cache during init X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Cornelia Huck , Peter Maydell , Jason Wang , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jason Wang We don't check the return value of address_space_cache_init(), this may lead buggy driver use incorrect region caches. Instead of triggering an assert, catch and warn this early in virtio_init_region_cache(). Cc: Cornelia Huck Cc: Paolo Bonzini Reviewed-by: Cornelia Huck Signed-off-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/virtio.c | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index a00380f..82b6060 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -131,6 +131,7 @@ static void virtio_init_region_cache(VirtIODevice *vdev= , int n) VRingMemoryRegionCaches *new; hwaddr addr, size; int event_size; + int64_t len; =20 event_size =3D virtio_vdev_has_feature(vq->vdev, VIRTIO_RING_F_EVENT_I= DX) ? 2 : 0; =20 @@ -140,21 +141,41 @@ static void virtio_init_region_cache(VirtIODevice *vd= ev, int n) } new =3D g_new0(VRingMemoryRegionCaches, 1); size =3D virtio_queue_get_desc_size(vdev, n); - address_space_cache_init(&new->desc, vdev->dma_as, - addr, size, false); + len =3D address_space_cache_init(&new->desc, vdev->dma_as, + addr, size, false); + if (len < size) { + virtio_error(vdev, "Cannot map desc"); + goto err_desc; + } =20 size =3D virtio_queue_get_used_size(vdev, n) + event_size; - address_space_cache_init(&new->used, vdev->dma_as, - vq->vring.used, size, true); + len =3D address_space_cache_init(&new->used, vdev->dma_as, + vq->vring.used, size, true); + if (len < size) { + virtio_error(vdev, "Cannot map used"); + goto err_used; + } =20 size =3D virtio_queue_get_avail_size(vdev, n) + event_size; - address_space_cache_init(&new->avail, vdev->dma_as, - vq->vring.avail, size, false); + len =3D address_space_cache_init(&new->avail, vdev->dma_as, + vq->vring.avail, size, false); + if (len < size) { + virtio_error(vdev, "Cannot map avail"); + goto err_avail; + } =20 atomic_rcu_set(&vq->vring.caches, new); if (old) { call_rcu(old, virtio_free_region_cache, rcu); } + return; + +err_avail: + address_space_cache_destroy(&new->used); +err_used: + address_space_cache_destroy(&new->desc); +err_desc: + g_free(new); } =20 /* virt queue functions */ --=20 MST From nobody Thu May 2 20:50:28 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489600983746203.51705775191124; Wed, 15 Mar 2017 11:03:03 -0700 (PDT) Received: from localhost ([::1]:38844 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDGF-0003Pk-6o for importer@patchew.org; Wed, 15 Mar 2017 14:02:59 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50920) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDF7-0003Ld-RL for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1coDF2-0006wW-62 for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:49 -0400 Received: from mail.kernel.org ([198.145.29.136]:59162) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1coDF1-0006w6-Ta for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:44 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id DD4AF202DD; Wed, 15 Mar 2017 18:01:41 +0000 (UTC) Received: from redhat.com (pool-96-237-235-121.bstnma.fios.verizon.net [96.237.235.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7408520382; Wed, 15 Mar 2017 18:01:40 +0000 (UTC) Date: Wed, 15 Mar 2017 20:01:39 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1489600837-11541-6-git-send-email-mst@redhat.com> References: <1489600837-11541-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1489600837-11541-1-git-send-email-mst@redhat.com> X-Mailer: git-send-email 2.8.0.287.g0deeb61 X-Mutt-Fcc: =sent X-Virus-Scanned: ClamAV using ClamSMTP X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 198.145.29.136 Subject: [Qemu-devel] [PULL 5/7] pci: introduce a bus master container X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Marcel Apfelbaum , Peter Maydell , Jason Wang , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jason Wang 96a8821d2141 ("virtio: unbreak virtio-pci with IOMMU after caching ring translations") tries to make IOMMU works with virtio memory region cache, but it requires IOMMU to be created before any virtio devices. This is sub optimal, fixing this by introduce a bus master container to make sure address space can be initialized during device registering, and then we can safely set alias and make bus_master_enable_region as its subregion during bus master initialization. Cc: Paolo Bonzini Signed-off-by: Jason Wang Reviewed-by: Paolo Bonzini Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- include/hw/pci/pci.h | 1 + hw/pci/pci.c | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h index 9349acb..713ede0 100644 --- a/include/hw/pci/pci.h +++ b/include/hw/pci/pci.h @@ -284,6 +284,7 @@ struct PCIDevice { char name[64]; PCIIORegion io_regions[PCI_NUM_REGIONS]; AddressSpace bus_master_as; + MemoryRegion bus_master_container_region; MemoryRegion bus_master_enable_region; =20 /* do not access the following fields */ diff --git a/hw/pci/pci.c b/hw/pci/pci.c index 273f1e4..ad46390 100644 --- a/hw/pci/pci.c +++ b/hw/pci/pci.c @@ -88,8 +88,8 @@ static void pci_init_bus_master(PCIDevice *pci_dev) OBJECT(pci_dev), "bus master", dma_as->root, 0, memory_region_size(dma_as->r= oot)); memory_region_set_enabled(&pci_dev->bus_master_enable_region, false); - address_space_init(&pci_dev->bus_master_as, - &pci_dev->bus_master_enable_region, pci_dev->name); + memory_region_add_subregion(&pci_dev->bus_master_container_region, 0, + &pci_dev->bus_master_enable_region); } =20 static void pcibus_machine_done(Notifier *notifier, void *data) @@ -995,6 +995,11 @@ static PCIDevice *do_pci_register_device(PCIDevice *pc= i_dev, PCIBus *bus, pci_dev->devfn =3D devfn; pci_dev->requester_id_cache =3D pci_req_id_cache_get(pci_dev); =20 + memory_region_init(&pci_dev->bus_master_container_region, OBJECT(pci_d= ev), + "bus master container", UINT64_MAX); + address_space_init(&pci_dev->bus_master_as, + &pci_dev->bus_master_container_region, pci_dev->nam= e); + if (qdev_hotplug) { pci_init_bus_master(pci_dev); } --=20 MST From nobody Thu May 2 20:50:28 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489601100205679.031232770772; Wed, 15 Mar 2017 11:05:00 -0700 (PDT) Received: from localhost ([::1]:38851 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDI5-0005MW-36 for importer@patchew.org; Wed, 15 Mar 2017 14:04:53 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50884) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDF6-0003KO-2U for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:49 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1coDF4-0006xg-6L for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:48 -0400 Received: from mail.kernel.org ([198.145.29.136]:59188) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1coDF4-0006x9-0Z for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:46 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 32B89202DD; Wed, 15 Mar 2017 18:01:44 +0000 (UTC) Received: from redhat.com (pool-96-237-235-121.bstnma.fios.verizon.net [96.237.235.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id ECEE620382; Wed, 15 Mar 2017 18:01:42 +0000 (UTC) Date: Wed, 15 Mar 2017 20:01:42 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1489600837-11541-7-git-send-email-mst@redhat.com> References: <1489600837-11541-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1489600837-11541-1-git-send-email-mst@redhat.com> X-Mailer: git-send-email 2.8.0.287.g0deeb61 X-Mutt-Fcc: =sent X-Virus-Scanned: ClamAV using ClamSMTP X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 198.145.29.136 Subject: [Qemu-devel] [PULL 6/7] Revert "virtio: unbreak virtio-pci with IOMMU after caching ring translations" X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Jason Wang , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jason Wang This reverts commit 96a8821d21411f10d77ea994af369c6e5c35a2cc. Previous patch is a better solution which does not require a strict order between virtio and IOMMU. CC: Paolo Bonzini Signed-off-by: Jason Wang --- hw/virtio/virtio-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c index b76f3f6..5ce42af 100644 --- a/hw/virtio/virtio-pci.c +++ b/hw/virtio/virtio-pci.c @@ -1153,7 +1153,7 @@ static AddressSpace *virtio_pci_get_dma_as(DeviceStat= e *d) VirtIOPCIProxy *proxy =3D VIRTIO_PCI(d); PCIDevice *dev =3D &proxy->pci_dev; =20 - return pci_device_iommu_address_space(dev); + return pci_get_address_space(dev); } =20 static int virtio_pci_add_mem_cap(VirtIOPCIProxy *proxy, --=20 MST From nobody Thu May 2 20:50:28 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1489601256291817.623623996477; Wed, 15 Mar 2017 11:07:36 -0700 (PDT) Received: from localhost ([::1]:38872 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDKe-0007yl-20 for importer@patchew.org; Wed, 15 Mar 2017 14:07:32 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50914) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1coDF7-0003LP-B8 for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1coDF6-0006yy-NQ for qemu-devel@nongnu.org; Wed, 15 Mar 2017 14:01:49 -0400 Received: from mail.kernel.org ([198.145.29.136]:59214) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1coDF6-0006yP-He; Wed, 15 Mar 2017 14:01:48 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A99B2202DD; Wed, 15 Mar 2017 18:01:46 +0000 (UTC) Received: from redhat.com (pool-96-237-235-121.bstnma.fios.verizon.net [96.237.235.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3FFB420382; Wed, 15 Mar 2017 18:01:45 +0000 (UTC) Date: Wed, 15 Mar 2017 20:01:44 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1489600837-11541-8-git-send-email-mst@redhat.com> References: <1489600837-11541-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1489600837-11541-1-git-send-email-mst@redhat.com> X-Mailer: git-send-email 2.8.0.287.g0deeb61 X-Mutt-Fcc: =sent X-Virus-Scanned: ClamAV using ClamSMTP X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 198.145.29.136 Subject: [Qemu-devel] [PULL 7/7] virtio-pci: reset modern vq meta data X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Jason Wang , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jason Wang We don't reset proxy->vqs[].{num|desc[]|avail[]|used[]}. This means if a driver enable the vq without setting vq address after reset. The old addresses were leaked. Fixing this by resetting modern vq meta data during device reset. Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/virtio-pci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c index 5ce42af..69cc471 100644 --- a/hw/virtio/virtio-pci.c +++ b/hw/virtio/virtio-pci.c @@ -1857,6 +1857,10 @@ static void virtio_pci_reset(DeviceState *qdev) =20 for (i =3D 0; i < VIRTIO_QUEUE_MAX; i++) { proxy->vqs[i].enabled =3D 0; + proxy->vqs[i].num =3D 0; + proxy->vqs[i].desc[0] =3D proxy->vqs[i].desc[1] =3D 0; + proxy->vqs[i].avail[0] =3D proxy->vqs[i].avail[1] =3D 0; + proxy->vqs[i].used[0] =3D proxy->vqs[i].used[1] =3D 0; } } =20 --=20 MST