mirror of https://github.com/xemu-project/xemu.git
6f4dc62715
QEMU invokes vhost_svq_add() when adding a guest's element into SVQ. In vhost_svq_add(), it uses vhost_svq_available_slots() to check whether QEMU can add the element into SVQ. If there is enough space, then QEMU combines some out descriptors and some in descriptors into one descriptor chain, and adds it into `svq->vring.desc` by vhost_svq_vring_write_descs(). Yet the problem is that, `svq->shadow_avail_idx - svq->shadow_used_idx` in vhost_svq_available_slots() returns the number of occupied elements, or the number of descriptor chains, instead of the number of occupied descriptors, which may cause wrapping in SVQ descriptor ring. Here is an example. In vhost_handle_guest_kick(), QEMU forwards as many available buffers to device by virtqueue_pop() and vhost_svq_add_element(). virtqueue_pop() returns a guest's element, and then this element is added into SVQ by vhost_svq_add_element(), a wrapper to vhost_svq_add(). If QEMU invokes virtqueue_pop() and vhost_svq_add_element() `svq->vring.num` times, vhost_svq_available_slots() thinks QEMU just ran out of slots and everything should work fine. But in fact, virtqueue_pop() returns `svq->vring.num` elements or descriptor chains, more than `svq->vring.num` descriptors due to guest memory fragmentation, and this causes wrapping in SVQ descriptor ring. This bug is valid even before marking the descriptors used. If the guest memory is fragmented, SVQ must add chains so it can try to add more descriptors than possible. This patch solves it by adding `num_free` field in VhostShadowVirtqueue structure and updating this field in vhost_svq_add() and vhost_svq_get_buf(), to record the number of free descriptors. Fixes: |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| meson.build | ||
| trace-events | ||
| trace.h | ||
| vhost-backend.c | ||
| vhost-iova-tree.c | ||
| vhost-iova-tree.h | ||
| vhost-scsi-pci.c | ||
| vhost-shadow-virtqueue.c | ||
| vhost-shadow-virtqueue.h | ||
| vhost-stub.c | ||
| vhost-user-blk-pci.c | ||
| vhost-user-fs-pci.c | ||
| vhost-user-fs.c | ||
| vhost-user-gpio-pci.c | ||
| vhost-user-gpio.c | ||
| vhost-user-i2c-pci.c | ||
| vhost-user-i2c.c | ||
| vhost-user-input-pci.c | ||
| vhost-user-rng-pci.c | ||
| vhost-user-rng.c | ||
| vhost-user-scsi-pci.c | ||
| vhost-user-vsock-pci.c | ||
| vhost-user-vsock.c | ||
| vhost-user.c | ||
| vhost-vdpa.c | ||
| vhost-vsock-common.c | ||
| vhost-vsock-pci.c | ||
| vhost-vsock.c | ||
| vhost.c | ||
| virtio-9p-pci.c | ||
| virtio-balloon-pci.c | ||
| virtio-balloon.c | ||
| virtio-blk-pci.c | ||
| virtio-bus.c | ||
| virtio-crypto-pci.c | ||
| virtio-crypto.c | ||
| virtio-input-host-pci.c | ||
| virtio-input-pci.c | ||
| virtio-iommu-pci.c | ||
| virtio-iommu.c | ||
| virtio-mem-pci.c | ||
| virtio-mem-pci.h | ||
| virtio-mem.c | ||
| virtio-mmio.c | ||
| virtio-net-pci.c | ||
| virtio-pci.c | ||
| virtio-pmem-pci.c | ||
| virtio-pmem-pci.h | ||
| virtio-pmem.c | ||
| virtio-rng-pci.c | ||
| virtio-rng.c | ||
| virtio-scsi-pci.c | ||
| virtio-serial-pci.c | ||
| virtio-stub.c | ||
| virtio.c | ||