[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 43/91] vhost: Track descriptor chain in private at SVQ
From: |
Michael S. Tsirkin |
Subject: |
[PULL 43/91] vhost: Track descriptor chain in private at SVQ |
Date: |
Mon, 16 May 2022 06:38:06 -0400 |
From: Eugenio Pérez <eperezma@redhat.com>
The device could have access to modify them, and it definitely have
access when we implement packed vq. Harden SVQ maintaining a private
copy of the descriptor chain. Other fields like buffer addresses are
already maintained sepparatedly.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20220512175747.142058-2-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
hw/virtio/vhost-shadow-virtqueue.h | 6 ++++++
hw/virtio/vhost-shadow-virtqueue.c | 12 +++++++-----
2 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/hw/virtio/vhost-shadow-virtqueue.h
b/hw/virtio/vhost-shadow-virtqueue.h
index e5e24c536d..c132c994e9 100644
--- a/hw/virtio/vhost-shadow-virtqueue.h
+++ b/hw/virtio/vhost-shadow-virtqueue.h
@@ -53,6 +53,12 @@ typedef struct VhostShadowVirtqueue {
/* Next VirtQueue element that guest made available */
VirtQueueElement *next_guest_avail_elem;
+ /*
+ * Backup next field for each descriptor so we can recover securely, not
+ * needing to trust the device access.
+ */
+ uint16_t *desc_next;
+
/* Next head to expose to the device */
uint16_t shadow_avail_idx;
diff --git a/hw/virtio/vhost-shadow-virtqueue.c
b/hw/virtio/vhost-shadow-virtqueue.c
index 1e5cfe2af6..1d6552b0fe 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -138,6 +138,7 @@ static void vhost_vring_write_descs(VhostShadowVirtqueue
*svq, hwaddr *sg,
for (n = 0; n < num; n++) {
if (more_descs || (n + 1 < num)) {
descs[i].flags = flags | cpu_to_le16(VRING_DESC_F_NEXT);
+ descs[i].next = cpu_to_le16(svq->desc_next[i]);
} else {
descs[i].flags = flags;
}
@@ -145,10 +146,10 @@ static void vhost_vring_write_descs(VhostShadowVirtqueue
*svq, hwaddr *sg,
descs[i].len = cpu_to_le32(iovec[n].iov_len);
last = i;
- i = cpu_to_le16(descs[i].next);
+ i = cpu_to_le16(svq->desc_next[i]);
}
- svq->free_head = le16_to_cpu(descs[last].next);
+ svq->free_head = le16_to_cpu(svq->desc_next[last]);
}
static bool vhost_svq_add_split(VhostShadowVirtqueue *svq,
@@ -336,7 +337,6 @@ static void
vhost_svq_disable_notification(VhostShadowVirtqueue *svq)
static VirtQueueElement *vhost_svq_get_buf(VhostShadowVirtqueue *svq,
uint32_t *len)
{
- vring_desc_t *descs = svq->vring.desc;
const vring_used_t *used = svq->vring.used;
vring_used_elem_t used_elem;
uint16_t last_used;
@@ -365,7 +365,7 @@ static VirtQueueElement
*vhost_svq_get_buf(VhostShadowVirtqueue *svq,
return NULL;
}
- descs[used_elem.id].next = svq->free_head;
+ svq->desc_next[used_elem.id] = svq->free_head;
svq->free_head = used_elem.id;
*len = used_elem.len;
@@ -540,8 +540,9 @@ void vhost_svq_start(VhostShadowVirtqueue *svq,
VirtIODevice *vdev,
svq->vring.used = qemu_memalign(qemu_real_host_page_size(), device_size);
memset(svq->vring.used, 0, device_size);
svq->ring_id_maps = g_new0(VirtQueueElement *, svq->vring.num);
+ svq->desc_next = g_new0(uint16_t, svq->vring.num);
for (unsigned i = 0; i < svq->vring.num - 1; i++) {
- svq->vring.desc[i].next = cpu_to_le16(i + 1);
+ svq->desc_next[i] = cpu_to_le16(i + 1);
}
}
@@ -574,6 +575,7 @@ void vhost_svq_stop(VhostShadowVirtqueue *svq)
virtqueue_detach_element(svq->vq, next_avail_elem, 0);
}
svq->vq = NULL;
+ g_free(svq->desc_next);
g_free(svq->ring_id_maps);
qemu_vfree(svq->vring.desc);
qemu_vfree(svq->vring.used);
--
MST
- [PULL 33/91] CXL/cxl_component: Add cxl_get_hb_cstate(), (continued)
- [PULL 33/91] CXL/cxl_component: Add cxl_get_hb_cstate(), Michael S. Tsirkin, 2022/05/16
- [PULL 35/91] cxl/cxl-host: Add memops for CFMWS region., Michael S. Tsirkin, 2022/05/16
- [PULL 34/91] mem/cxl_type3: Add read and write functions for associated hostmem., Michael S. Tsirkin, 2022/05/16
- [PULL 36/91] hw/cxl/component Add a dumb HDM decoder handler, Michael S. Tsirkin, 2022/05/16
- [PULL 37/91] i386/pc: Enable CXL fixed memory windows, Michael S. Tsirkin, 2022/05/16
- [PULL 39/91] qtests/bios-tables-test: Add a test for CXL emulation., Michael S. Tsirkin, 2022/05/16
- [PULL 38/91] tests/acpi: q35: Allow addition of a CXL test., Michael S. Tsirkin, 2022/05/16
- [PULL 40/91] tests/acpi: Add tables for CXL emulation., Michael S. Tsirkin, 2022/05/16
- [PULL 41/91] qtest/cxl: Add more complex test cases with CFMWs, Michael S. Tsirkin, 2022/05/16
- [PULL 42/91] docs/cxl: Add initial Compute eXpress Link (CXL) documentation., Michael S. Tsirkin, 2022/05/16
- [PULL 43/91] vhost: Track descriptor chain in private at SVQ,
Michael S. Tsirkin <=
- [PULL 44/91] vhost: Fix device's used descriptor dequeue, Michael S. Tsirkin, 2022/05/16
- [PULL 45/91] vdpa: Fix bad index calculus at vhost_vdpa_get_vring_base, Michael S. Tsirkin, 2022/05/16
- [PULL 48/91] vhost: Fix element in vhost_svq_add failure, Michael S. Tsirkin, 2022/05/16
- [PULL 47/91] hw/virtio: Replace g_memdup() by g_memdup2(), Michael S. Tsirkin, 2022/05/16
- [PULL 46/91] vdpa: Fix index calculus at vhost_vdpa_svqs_start, Michael S. Tsirkin, 2022/05/16
- [PULL 49/91] target/i386: Fix sanity check on max APIC ID / X2APIC enablement, Michael S. Tsirkin, 2022/05/16
- [PULL 50/91] intel_iommu: Support IR-only mode without DMA translation, Michael S. Tsirkin, 2022/05/16
- [PULL 51/91] intel_iommu: Only allow interrupt remapping to be enabled if it's supported, Michael S. Tsirkin, 2022/05/16
- [PULL 52/91] intel_iommu: Fix irqchip / X2APIC configuration checks, Michael S. Tsirkin, 2022/05/16
- [PULL 53/91] intel-iommu: remove VTD_FR_RESERVED_ERR, Michael S. Tsirkin, 2022/05/16