* [PATCH 2/3 V3] kvm tools: Prevent PFN wraparound
[not found] <1305127045-3532-1-git-send-email-a>
@ 2011-05-11 15:17 ` levinsasha928
2011-05-11 15:17 ` [PATCH 3/3] kvm tools: Use definitions from kernel headers levinsasha928
1 sibling, 0 replies; 2+ messages in thread
From: levinsasha928 @ 2011-05-11 15:17 UTC (permalink / raw)
To: penberg; +Cc: mingo, asias.hejun, prasadjoshi124, avi, gorcunov, kvm,
Sasha Levin
From: Sasha Levin <levinsasha928@gmail.com>
queue->pfn may be used to point at addresses larger
than 32 bit.
Prevent a wraparound when shifting it left.
Changes in V2:
- Use helper function.
Changes in V3:
- Add warning for using guest_pfn_to_host() on 32-bit hosts.
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
---
tools/kvm/include/kvm/virtio.h | 10 ++++++++++
tools/kvm/virtio/blk.c | 2 +-
tools/kvm/virtio/console.c | 2 +-
tools/kvm/virtio/net.c | 2 +-
tools/kvm/virtio/rng.c | 2 +-
5 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/tools/kvm/include/kvm/virtio.h b/tools/kvm/include/kvm/virtio.h
index 7f92dea..bea63df 100644
--- a/tools/kvm/include/kvm/virtio.h
+++ b/tools/kvm/include/kvm/virtio.h
@@ -36,6 +36,16 @@ static inline bool virt_queue__available(struct virt_queue *vq)
return vq->vring.avail->idx != vq->last_avail_idx;
}
+/*
+ * Warning: on 32-bit hosts, shifting pfn left may cause a truncation of pfn values
+ * higher than 4GB - thus, pointing to the wrong area in guest virtual memory space
+ * and breaking the virt queue which owns this pfn.
+ */
+static inline void *guest_pfn_to_host(struct kvm *kvm, u32 pfn)
+{
+ return guest_flat_to_host(kvm, (unsigned long)pfn << 12);
+}
+
struct vring_used_elem *virt_queue__set_used_elem(struct virt_queue *queue, u32 head, u32 len);
u16 virt_queue__get_iov(struct virt_queue *queue, struct iovec iov[], u16 *out, u16 *in, struct kvm *kvm);
diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c
index 12c7029..9f1aa1d 100644
--- a/tools/kvm/virtio/blk.c
+++ b/tools/kvm/virtio/blk.c
@@ -197,7 +197,7 @@ static bool virtio_blk_pci_io_out(struct kvm *self, u16 port, void *data, int si
queue = &bdev->vqs[bdev->queue_selector];
queue->pfn = ioport__read32(data);
- p = guest_flat_to_host(self, queue->pfn << 12);
+ p = guest_pfn_to_host(self, queue->pfn);
vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, 4096);
diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c
index f9031cb..87b816a 100644
--- a/tools/kvm/virtio/console.c
+++ b/tools/kvm/virtio/console.c
@@ -199,7 +199,7 @@ static bool virtio_console_pci_io_out(struct kvm *self, u16 port, void *data, in
queue = &cdev.vqs[cdev.queue_selector];
queue->pfn = ioport__read32(data);
- p = guest_flat_to_host(self, queue->pfn << 12);
+ p = guest_pfn_to_host(self, queue->pfn);
vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, 4096);
diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c
index 8d430e3..3f3ee22 100644
--- a/tools/kvm/virtio/net.c
+++ b/tools/kvm/virtio/net.c
@@ -245,7 +245,7 @@ static bool virtio_net_pci_io_out(struct kvm *self, u16 port, void *data, int si
queue = &net_device.vqs[net_device.queue_selector];
queue->pfn = ioport__read32(data);
- p = guest_flat_to_host(self, queue->pfn << 12);
+ p = guest_pfn_to_host(self, queue->pfn);
vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, 4096);
diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c
index f692dfd..1951d0d1c 100644
--- a/tools/kvm/virtio/rng.c
+++ b/tools/kvm/virtio/rng.c
@@ -129,7 +129,7 @@ static bool virtio_rng_pci_io_out(struct kvm *kvm, u16 port, void *data, int siz
queue = &rdev.vqs[rdev.queue_selector];
queue->pfn = ioport__read32(data);
- p = guest_flat_to_host(kvm, queue->pfn << 12);
+ p = guest_pfn_to_host(kvm, queue->pfn);
vring_init(&queue->vring, VIRTIO_RNG_QUEUE_SIZE, p, 4096);
--
1.7.5.rc3
^ permalink raw reply related [flat|nested] 2+ messages in thread* [PATCH 3/3] kvm tools: Use definitions from kernel headers
[not found] <1305127045-3532-1-git-send-email-a>
2011-05-11 15:17 ` [PATCH 2/3 V3] kvm tools: Prevent PFN wraparound levinsasha928
@ 2011-05-11 15:17 ` levinsasha928
1 sibling, 0 replies; 2+ messages in thread
From: levinsasha928 @ 2011-05-11 15:17 UTC (permalink / raw)
To: penberg; +Cc: mingo, asias.hejun, prasadjoshi124, avi, gorcunov, kvm,
Sasha Levin
From: Sasha Levin <levinsasha928@gmail.com>
Instead of redefining virtio pci constants (or
not using them at all), use constants from kernel
header.
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
---
tools/kvm/include/kvm/virtio-pci-dev.h | 3 +
tools/kvm/include/kvm/virtio-pci.h | 74 --------------------------------
tools/kvm/include/kvm/virtio.h | 3 +-
tools/kvm/virtio/blk.c | 5 +-
tools/kvm/virtio/console.c | 9 ++--
tools/kvm/virtio/net.c | 9 ++--
tools/kvm/virtio/rng.c | 3 +-
7 files changed, 16 insertions(+), 90 deletions(-)
delete mode 100644 tools/kvm/include/kvm/virtio-pci.h
diff --git a/tools/kvm/include/kvm/virtio-pci-dev.h b/tools/kvm/include/kvm/virtio-pci-dev.h
index d2274d0..706ad20 100644
--- a/tools/kvm/include/kvm/virtio-pci-dev.h
+++ b/tools/kvm/include/kvm/virtio-pci-dev.h
@@ -16,4 +16,7 @@
#define PCI_SUBSYSTEM_ID_VIRTIO_CONSOLE 0x0003
#define PCI_SUBSYSTEM_ID_VIRTIO_RNG 0x0004
+#define PCI_VENDOR_ID_REDHAT_QUMRANET 0x1af4
+#define PCI_SUBSYSTEM_VENDOR_ID_REDHAT_QUMRANET 0x1af4
+
#endif /* VIRTIO_PCI_DEV_H_ */
diff --git a/tools/kvm/include/kvm/virtio-pci.h b/tools/kvm/include/kvm/virtio-pci.h
deleted file mode 100644
index b507d1d..0000000
--- a/tools/kvm/include/kvm/virtio-pci.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Virtio PCI driver
- *
- * This module allows virtio devices to be used over a virtual PCI device.
- * This can be used with QEMU based VMMs like KVM or Xen.
- *
- * Copyright IBM Corp. 2007
- *
- * Authors:
- * Anthony Liguori <aliguori@us.ibm.com>
- *
- * This header is BSD licensed so anyone can use the definitions to implement
- * compatible drivers/servers.
- */
-
-#ifndef _LINUX_VIRTIO_PCI_H
-#define _LINUX_VIRTIO_PCI_H
-
-/* A 32-bit r/o bitmask of the features supported by the host */
-#define VIRTIO_PCI_HOST_FEATURES 0
-
-/* A 32-bit r/w bitmask of features activated by the guest */
-#define VIRTIO_PCI_GUEST_FEATURES 4
-
-/* A 32-bit r/w PFN for the currently selected queue */
-#define VIRTIO_PCI_QUEUE_PFN 8
-
-/* A 16-bit r/o queue size for the currently selected queue */
-#define VIRTIO_PCI_QUEUE_NUM 12
-
-/* A 16-bit r/w queue selector */
-#define VIRTIO_PCI_QUEUE_SEL 14
-
-/* A 16-bit r/w queue notifier */
-#define VIRTIO_PCI_QUEUE_NOTIFY 16
-
-/* An 8-bit device status register */
-#define VIRTIO_PCI_STATUS 18
-
-/*
- * An 8-bit r/o interrupt status register.
- *
- * Reading the value will return the current contents of
- * the ISR and will also clear it. This is effectively
- * a read-and-acknowledge.
- */
-#define VIRTIO_PCI_ISR 19
-
-/*
- * MSI-X registers: only enabled if MSI-X is enabled.
- */
-
-/* A 16-bit vector for configuration changes */
-#define VIRTIO_MSI_CONFIG_VECTOR 20
-
-/* A 16-bit vector for selected queue notifications */
-#define VIRTIO_MSI_QUEUE_VECTOR 22
-
-/* Vector value used to disable MSI for queue */
-#define VIRTIO_MSI_NO_VECTOR 0xffff
-
-/*
- * Config space size.
- */
-#define VIRTIO_PCI_CONFIG_NOMSI 20
-#define VIRTIO_PCI_CONFIG_MSI 24
-
-/*
- * Virtio config space constants.
- */
-#define PCI_VENDOR_ID_REDHAT_QUMRANET 0x1af4
-#define PCI_SUBSYSTEM_VENDOR_ID_REDHAT_QUMRANET 0x1af4
-
-#endif /* _LINUX_VIRTIO_PCI_H */
diff --git a/tools/kvm/include/kvm/virtio.h b/tools/kvm/include/kvm/virtio.h
index bea63df..66e6fdb 100644
--- a/tools/kvm/include/kvm/virtio.h
+++ b/tools/kvm/include/kvm/virtio.h
@@ -2,6 +2,7 @@
#define KVM__VIRTIO_H
#include <linux/virtio_ring.h>
+#include <linux/virtio_pci.h>
#include <linux/types.h>
#include <sys/uio.h>
@@ -43,7 +44,7 @@ static inline bool virt_queue__available(struct virt_queue *vq)
*/
static inline void *guest_pfn_to_host(struct kvm *kvm, u32 pfn)
{
- return guest_flat_to_host(kvm, (unsigned long)pfn << 12);
+ return guest_flat_to_host(kvm, (unsigned long)pfn << VIRTIO_PCI_QUEUE_ADDR_SHIFT);
}
struct vring_used_elem *virt_queue__set_used_elem(struct virt_queue *queue, u32 head, u32 len);
diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c
index 9f1aa1d..8d480bf 100644
--- a/tools/kvm/virtio/blk.c
+++ b/tools/kvm/virtio/blk.c
@@ -1,6 +1,5 @@
#include "kvm/virtio-blk.h"
-#include "kvm/virtio-pci.h"
#include "kvm/virtio-pci-dev.h"
#include "kvm/irq.h"
#include "kvm/disk-image.h"
@@ -58,7 +57,7 @@ static bool virtio_blk_dev_in(struct blk_dev *bdev, void *data, unsigned long of
if (size != 1 || count != 1)
return false;
- ioport__write8(data, config_space[offset - VIRTIO_PCI_CONFIG_NOMSI]);
+ ioport__write8(data, config_space[offset - VIRTIO_MSI_CONFIG_VECTOR]);
return true;
}
@@ -199,7 +198,7 @@ static bool virtio_blk_pci_io_out(struct kvm *self, u16 port, void *data, int si
queue->pfn = ioport__read32(data);
p = guest_pfn_to_host(self, queue->pfn);
- vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, 4096);
+ vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, VIRTIO_PCI_VRING_ALIGN);
*job = (struct blk_dev_job) {
.vq = queue,
diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c
index 87b816a..38f52f9 100644
--- a/tools/kvm/virtio/console.c
+++ b/tools/kvm/virtio/console.c
@@ -1,5 +1,4 @@
#include "kvm/virtio-console.h"
-#include "kvm/virtio-pci.h"
#include "kvm/virtio-pci-dev.h"
#include "kvm/disk-image.h"
#include "kvm/virtio.h"
@@ -104,10 +103,10 @@ static bool virtio_console_pci_io_device_specific_in(void *data, unsigned long o
if (size != 1 || count != 1)
return false;
- if ((offset - VIRTIO_PCI_CONFIG_NOMSI) > sizeof(struct virtio_console_config))
- error("config offset is too big: %li", offset - VIRTIO_PCI_CONFIG_NOMSI);
+ if ((offset - VIRTIO_MSI_CONFIG_VECTOR) > sizeof(struct virtio_console_config))
+ error("config offset is too big: %li", offset - VIRTIO_MSI_CONFIG_VECTOR);
- ioport__write8(data, config_space[offset - VIRTIO_PCI_CONFIG_NOMSI]);
+ ioport__write8(data, config_space[offset - VIRTIO_MSI_CONFIG_VECTOR]);
return true;
}
@@ -201,7 +200,7 @@ static bool virtio_console_pci_io_out(struct kvm *self, u16 port, void *data, in
queue->pfn = ioport__read32(data);
p = guest_pfn_to_host(self, queue->pfn);
- vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, 4096);
+ vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, VIRTIO_PCI_VRING_ALIGN);
if (cdev.queue_selector == VIRTIO_CONSOLE_TX_QUEUE)
cdev.jobs[cdev.queue_selector] = thread_pool__add_job(self, virtio_console_handle_callback, queue);
diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c
index 3f3ee22..2009d4a 100644
--- a/tools/kvm/virtio/net.c
+++ b/tools/kvm/virtio/net.c
@@ -1,5 +1,4 @@
#include "kvm/virtio-net.h"
-#include "kvm/virtio-pci.h"
#include "kvm/virtio-pci-dev.h"
#include "kvm/virtio.h"
#include "kvm/ioport.h"
@@ -154,10 +153,10 @@ static bool virtio_net_pci_io_device_specific_in(void *data, unsigned long offse
if (size != 1 || count != 1)
return false;
- if ((offset - VIRTIO_PCI_CONFIG_NOMSI) > sizeof(struct virtio_net_config))
- error("config offset is too big: %li", offset - VIRTIO_PCI_CONFIG_NOMSI);
+ if ((offset - VIRTIO_MSI_CONFIG_VECTOR) > sizeof(struct virtio_net_config))
+ error("config offset is too big: %li", offset - VIRTIO_MSI_CONFIG_VECTOR);
- ioport__write8(data, config_space[offset - VIRTIO_PCI_CONFIG_NOMSI]);
+ ioport__write8(data, config_space[offset - VIRTIO_MSI_CONFIG_VECTOR]);
return true;
}
@@ -247,7 +246,7 @@ static bool virtio_net_pci_io_out(struct kvm *self, u16 port, void *data, int si
queue->pfn = ioport__read32(data);
p = guest_pfn_to_host(self, queue->pfn);
- vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, 4096);
+ vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, VIRTIO_PCI_VRING_ALIGN);
break;
}
diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c
index 1951d0d1c..cf258fa 100644
--- a/tools/kvm/virtio/rng.c
+++ b/tools/kvm/virtio/rng.c
@@ -1,6 +1,5 @@
#include "kvm/virtio-rng.h"
-#include "kvm/virtio-pci.h"
#include "kvm/virtio-pci-dev.h"
#include "kvm/disk-image.h"
@@ -131,7 +130,7 @@ static bool virtio_rng_pci_io_out(struct kvm *kvm, u16 port, void *data, int siz
queue->pfn = ioport__read32(data);
p = guest_pfn_to_host(kvm, queue->pfn);
- vring_init(&queue->vring, VIRTIO_RNG_QUEUE_SIZE, p, 4096);
+ vring_init(&queue->vring, VIRTIO_RNG_QUEUE_SIZE, p, VIRTIO_PCI_VRING_ALIGN);
rdev.jobs[rdev.queue_selector] = thread_pool__add_job(kvm, virtio_rng_do_io, queue);
--
1.7.5.rc3
^ permalink raw reply related [flat|nested] 2+ messages in thread