similar to: drivers/vhost: sizing of ubuf_info and heads

ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get two callbacks on the same value. To fix use upend_idx which is guaranteed to be unique. Reported-by: Rusty Russell <rusty at rustcorp.com.au> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> Cc: stable at kernel.org --- Rusty's

ubuf info allocator uses guest controlled head as an index, so a malicious guest could put the same head entry in the ring twice, and we will get two callbacks on the same value. To fix use upend_idx which is guaranteed to be unique. Reported-by: Rusty Russell <rusty at rustcorp.com.au> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> Cc: stable at kernel.org --- Rusty's

Convert vhost net to use the new format-agnostic API. In particular, don't poke at vq internals such as the heads array. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- drivers/vhost/net.c | 153 +++++++++++++++++++++++--------------------- 1 file changed, 81 insertions(+), 72 deletions(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index

On top of 'vhost: Allow device specific fields per vq', we can move device specific fields to device virt queue from vhost virt queue. Signed-off-by: Asias He <asias at redhat.com> --- drivers/vhost/net.c | 164 +++++++++++++++++++++++++++++++++++++++++++------- drivers/vhost/vhost.c | 57 +----------------- drivers/vhost/vhost.h | 22 ------- 3 files changed, 142

On top of 'vhost: Allow device specific fields per vq', we can move device specific fields to device virt queue from vhost virt queue. Signed-off-by: Asias He <asias at redhat.com> --- drivers/vhost/net.c | 164 +++++++++++++++++++++++++++++++++++++++++++------- drivers/vhost/vhost.c | 57 +----------------- drivers/vhost/vhost.h | 22 ------- 3 files changed, 142

On 2020/6/2 ??9:06, Michael S. Tsirkin wrote: > Convert vhost net to use the new format-agnostic API. > In particular, don't poke at vq internals such as the > heads array. > > Signed-off-by: Michael S. Tsirkin <mst at redhat.com> > --- > drivers/vhost/net.c | 153 +++++++++++++++++++++++--------------------- > 1 file changed, 81 insertions(+), 72 deletions(-)

This adds experimental zero copy support in vhost-net, disabled by default. To enable, set the zerocopytx module option to 1. This patch maintains the outstanding userspace buffers in the sequence it is delivered to vhost. The outstanding userspace buffers will be marked as done once the lower device buffers DMA has finished. This is monitored through last reference of kfree_skb callback. Two

This adds experimental zero copy support in vhost-net, disabled by default. To enable, set the zerocopytx module option to 1. This patch maintains the outstanding userspace buffers in the sequence it is delivered to vhost. The outstanding userspace buffers will be marked as done once the lower device buffers DMA has finished. This is monitored through last reference of kfree_skb callback. Two

>From: Shirley Ma <mashirle at us.ibm.com> This adds experimental zero copy support in vhost-net, disabled by default. To enable, set experimental_zcopytx module option to 1. This patch maintains the outstanding userspace buffers in the sequence it is delivered to vhost. The outstanding userspace buffers will be marked as done once the lower device buffers DMA has finished. This is

>From: Shirley Ma <mashirle at us.ibm.com> This adds experimental zero copy support in vhost-net, disabled by default. To enable, set experimental_zcopytx module option to 1. This patch maintains the outstanding userspace buffers in the sequence it is delivered to vhost. The outstanding userspace buffers will be marked as done once the lower device buffers DMA has finished. This is

From: Shirley Ma <mashirle at us.ibm.com> This adds experimental zero copy support in vhost-net, disabled by default. To enable, set the zerocopytx module option to 1. This patch maintains the outstanding userspace buffers in the sequence it is delivered to vhost. The outstanding userspace buffers will be marked as done once the lower device buffers DMA has finished. This is monitored

From: Shirley Ma <mashirle at us.ibm.com> This adds experimental zero copy support in vhost-net, disabled by default. To enable, set the zerocopytx module option to 1. This patch maintains the outstanding userspace buffers in the sequence it is delivered to vhost. The outstanding userspace buffers will be marked as done once the lower device buffers DMA has finished. This is monitored

On 09/04/2013 07:59 PM, Michael S. Tsirkin wrote: > On Mon, Sep 02, 2013 at 04:40:59PM +0800, Jason Wang wrote: >> Currently, even if the packet length is smaller than VHOST_GOODCOPY_LEN, if >> upend_idx != done_idx we still set zcopy_used to true and rollback this choice >> later. This could be avoided by determining zerocopy once by checking all >> conditions at one

On Mon, Sep 02, 2013 at 04:40:59PM +0800, Jason Wang wrote: > Currently, even if the packet length is smaller than VHOST_GOODCOPY_LEN, if > upend_idx != done_idx we still set zcopy_used to true and rollback this choice > later. This could be avoided by determining zerocopy once by checking all > conditions at one time before. > > Signed-off-by: Jason Wang <jasowang at

On Mon, Sep 02, 2013 at 04:40:59PM +0800, Jason Wang wrote: > Currently, even if the packet length is smaller than VHOST_GOODCOPY_LEN, if > upend_idx != done_idx we still set zcopy_used to true and rollback this choice > later. This could be avoided by determining zerocopy once by checking all > conditions at one time before. > > Signed-off-by: Jason Wang <jasowang at

Currently, even if the packet length is smaller than VHOST_GOODCOPY_LEN, if upend_idx != done_idx we still set zcopy_used to true and rollback this choice later. This could be avoided by determine zerocopy once by checking all conditions at one time before. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 46 +++++++++++++++++++--------------------------- 1

Currently, even if the packet length is smaller than VHOST_GOODCOPY_LEN, if upend_idx != done_idx we still set zcopy_used to true and rollback this choice later. This could be avoided by determining zerocopy once by checking all conditions at one time before. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 47 ++++++++++++++++++++--------------------------- 1

vhost_net_clear_ubuf_info didn't clear ubuf_info after kfree, this could trigger double free. Fix this and simplify this code to make it more robust: make sure ubuf info is always freed through vhost_net_clear_ubuf_info. Reported-by: Tommi Rantala <tt.rantala at gmail.com> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- drivers/vhost/net.c | 22 +++++++--------------- 1

This patch implements basic batched processing of tx virtqueue by prefetching desc indices and updating used ring in a batch. For non-zerocopy case, vq->heads were used for storing the prefetched indices and updating used ring. It is also a requirement for doing more batching on top. For zerocopy case and for simplicity, batched processing were simply disabled by only fetching and processing

On Thu, Sep 05, 2013 at 10:54:44AM +0800, Jason Wang wrote: > On 09/04/2013 07:59 PM, Michael S. Tsirkin wrote: > > On Mon, Sep 02, 2013 at 04:40:59PM +0800, Jason Wang wrote: > >> Currently, even if the packet length is smaller than VHOST_GOODCOPY_LEN, if > >> upend_idx != done_idx we still set zcopy_used to true and rollback this choice > >> later. This could