[Qemu-devel] [PATCH] vhost: fix corrupting GPA 0 when using uninitialized queues

[Qemu-devel] [PATCH] vhost: fix corrupting GPA 0 when using uninitialized queues

[Zheng Xiang]

When guest driver only setup part of queues declared in QEMU, it
would corrupt guest's physical address 0 when using uninitialized
queues in vhost_virtqueue_start.

In AARCH64 virtual machines, the address of system memory starts at
0x40000000 and the address of rom starts at 0. So, when using qemu
with vhost-scsi, it will fail with below error:
qemu-kvm: Error start vhost dev
qemu-kvm: unable to start vhost-scsi: Cannot allocate memory

This patch fix this issue by skipping calling vhost_virtqueue_start
for uninitialized queues.

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Zheng Xiang <zhengxiang9@huawei.com>
---
 hw/virtio/vhost.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index e4290ce..ac79ffd 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1532,6 +1532,8 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev)
         goto fail_mem;
     }
     for (i = 0; i < hdev->nvqs; ++i) {
+        if (virtio_queue_get_desc_addr(vdev, hdev->vq_index + i) == 0) 
+            continue;
         r = vhost_virtqueue_start(hdev,
                                   vdev,
                                   hdev->vqs + i,
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH] vhost: fix corrupting GPA 0 when using uninitialized queues

[Maxime Coquelin]

On 01/12/2018 11:13 AM, Zheng Xiang wrote:
> When guest driver only setup part of queues declared in QEMU, it
> would corrupt guest's physical address 0 when using uninitialized
> queues in vhost_virtqueue_start.
> 
> In AARCH64 virtual machines, the address of system memory starts at
> 0x40000000 and the address of rom starts at 0. So, when using qemu
> with vhost-scsi, it will fail with below error:
> qemu-kvm: Error start vhost dev
> qemu-kvm: unable to start vhost-scsi: Cannot allocate memory
> 
> This patch fix this issue by skipping calling vhost_virtqueue_start
> for uninitialized queues.
> 
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Zheng Xiang <zhengxiang9@huawei.com>
> ---
>   hw/virtio/vhost.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
> index e4290ce..ac79ffd 100644
> --- a/hw/virtio/vhost.c
> +++ b/hw/virtio/vhost.c
> @@ -1532,6 +1532,8 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev)
>           goto fail_mem;
>       }
>       for (i = 0; i < hdev->nvqs; ++i) {
> +        if (virtio_queue_get_desc_addr(vdev, hdev->vq_index + i) == 0)
> +            continue;
>           r = vhost_virtqueue_start(hdev,
>                                     vdev,
>                                     hdev->vqs + i,
> 

Thanks, it fixes the silent corruption that happens with vhost-user net
backend and Windows guests, when the number of queues pairs declared in
Qemu is higher than the number of vcpus.

Tested-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Maxime

Re: [Qemu-devel] [PATCH] vhost: fix corrupting GPA 0 when using uninitialized queues

[no-reply]

Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 20180112101356.27044-1-zhengxiang9@huawei.com
Subject: [Qemu-devel] [PATCH] vhost: fix corrupting GPA 0 when using uninitialized queues

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
fb66f184ae vhost: fix corrupting GPA 0 when using uninitialized queues

=== OUTPUT BEGIN ===
Checking PATCH 1/1: vhost: fix corrupting GPA 0 when using uninitialized queues...
ERROR: trailing whitespace
#32: FILE: hw/virtio/vhost.c:1535:
+        if (virtio_queue_get_desc_addr(vdev, hdev->vq_index + i) == 0) $

total: 1 errors, 0 warnings, 8 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org