[PATCH RFC v2 00/13] vhost-user: isolated memory

This patch series implements a memory isolation mode in vhost-user. The
purpose of this mode is to provide the option of additional security by
eliminating direct access of guest memory by vhost-user devices.
At a high level this works by:

1. Adding qdev and qapi properties required to enable isolation mode for
   various devices.
2. Allocating an isolation memory region in an anonymous file and mapping it
   to host memory.  This isolation region will hold the bounce buffers and
   vrings necessary to move data.
3. Using a vhost-iova-tree to allocate and track the mapping between
   guest regions and their corresponding bounce buffers in the isolation
   memory.
4. Creating shadow virtqueues to intercept request notifications.  As
   kick and call events are received by an svq, it copies buffer
   contents and descriptors between isolation and guest memory before
   notifying the backend or guest.   

Note: This project is currently in a partially functional state.
While the overall method will stay the same, the implementation
is planned to move up into vhost to simplify some elements of
initializing and using the shadow virtqueues.
However, the desire is to make this work public at this stage
for comment on the overall approach.

To: [email protected]
Cc: Michael S. Tsirkin <[email protected]>
Cc: Stefano Garzarella <[email protected]>
Cc: Alex Bennée <[email protected]>
Cc: Viresh Kumar <[email protected]>
Cc: Gerd Hoffmann <[email protected]>
Cc: Mathieu Poirier <[email protected]>
Cc: Manos Pitsidianakis <[email protected]>
Cc: Raphael Norwitz <[email protected]>
Cc: Kevin Wolf <[email protected]>
Cc: Hanna Reitz <[email protected]>
Cc: Marc-André Lureau <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Cc: Fam Zheng <[email protected]>
Cc: Stefan Hajnoczi <[email protected]>
Cc: Milan Zamazal <[email protected]>
Cc: Akihiko Odaki <[email protected]>
Cc: Dmitry Osipenko <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: Gonglei (Arei) <[email protected]>
Cc: zhenwei pi <[email protected]>
Cc: Daniel P. Berrangé <[email protected]>
Cc: Eric Blake <[email protected]>
Cc: Markus Armbruster <[email protected]>
Cc: Jason Wang <[email protected]>
Cc: Peter Xu <[email protected]>
Cc: Eugenio Pérez <[email protected]>
Cc: Alyssa Ross <[email protected]>
Cc: Demi Marie Obenour <[email protected]>
Signed-off-by: Connor Kite <[email protected]>

Based-on: [email protected]
---
Changelog:
V2:
Series:
- Updates to svq address translation moved to a different patch series.
  Link: https://lore.kernel.org/qemu-devel/[email protected] 
- The "shadow vq cleanup" has been merged into the earlier patch
  handling svq setup.
- Link to v1: https://lore.kernel.org/qemu-devel/[email protected]

Individual Patches:
vhost-user: Consolidate chardev property definitions
- Patch author updated from ConKite to Connor Kite

util/iova-tree: g_tree_foreach wrapper
- Added clarification comments about the function passed to
  iova_tree_foreach

hw/virtio: iova_tree_foreach wrapper
- Corrected comment about GTraverseFUnc end condition

hw/virtio/vhost-shadow-virtqueue: used callback
- Changed name of "used_handler" to "used_callback"
- Added handling if callback returns with error value
- Comments added clarifying callback return values

hw/virtio/vhost-shadow-virtqueue: specified vring placement
- Formatting improvements
- Change hwaddr to void * for pointers to host memory
- Bounds checking added when allocating vrings

vhost-user: add memory_isolation to VhostUserState
- Updated net_passt_vhost_user_init signature that is active when
  !defined(CONFIG_VHOST_USER)
- Comment updates for clarity

hw/virtio/vhost-user: create isolation region
- Formatting fixes
- Many comments added
- Read-after-zeroing bug fixed in cleanup_isolation_regions
- User-after-free bug in init_isolation_regions fixed by removing
  duplicate calls, and consolidating those steps in
  cleanup_isolation_regions
- Data unique to isolation mode consolidated in IsolationModeCtx struct
- Vring memory size calculations now only done via an API exposed by
  vhost-shadow-virtqueue
- Isolation region memfd file given a unique name
- Iova-tree IOVA space now starts at 0 + page_size to avoid exposing
  qemu addresses
- buffer_regions array moved changed from GArray to dynamically
  allocated array of predetermined size.  Avoids GArray formatting
  ugliness

  Note: Devicies implemented with multiple vhost threads, like
  virtio-net, are not currently supported.  Work is still required to
  update the vring allocation code to run only for vq_index=0 and
  propagate to the other vhost-user instances.

hw/virtio/vhost-user: send isolation regions to device
- Formatting improvements
- Vring region combined with contiguous buffer region in IOVA space to
  avoid wasting one of the available region slots that can be sent to
  the back-end
- Traversal callback for filling out msg regions renamed to
  vhost_user_fill_msg_reg_from_tree and simplified
- Check added if postcopy is in use as it is not currently supported

hw/virtio/vhost-user: add shadow virtqueues and eventfd intercepts
- Vring mapping now occurs during the vhost_user_set_mem_tables call,
  which means that vring addresses can be sent to the backend when
  expected by vhost
- The svq's device-facing event notifiers are now cleaned up in case of
  error or reset
- Bounds checking on vq index added in various locations
- SVQ cleanup code added

hw/virtio/vhost-user: handle data movement with shadow vqs
- Removed unecessary changes to elements during handling
- Fixed incorrect memcpy of used buffers in reverse direction
- Formatting improvements
- Bounds and error checking to handle mapping failures or buffers with
  invalid ranges
- Add error if isolation mode is used while IOMMU is active
- Add error if isolation mode is used with packed vrings

vhost-user: Add memory-isolation qdev property to vhost-user devices
- Patch moved to end of patch series
- Fixed overlong lines

backends/cryptodev-vhost-user: add memory isolation bool
- Fixed style in qapi and added "since" field
- Clarification added to comments
- The memory_isolation bool can no longer be set in vhost-cryptodev once
  initialization finishes

net/vhost-user: add memory isolation
- Moved to the back of the patch series
- Dead code removed by hard-coding memory_isolation args to vhost_user_init

---
Connor Kite (13):
      vhost-user: Consolidate chardev property definitions
      util/iova-tree: g_tree_foreach wrapper
      hw/virtio: iova_tree_foreach wrapper
      hw/virtio/vhost-shadow-virtqueue: used callback
      hw/virtio/vhost-shadow-virtqueue: specified vring placement
      vhost-user: add memory_isolation to VhostUserState
      hw/virtio/vhost-user: create isolation region
      hw/virtio/vhost-user: send isolation regions to device
      hw/virtio/vhost-user: add shadow virtqueues and eventfd intercepts
      hw/virtio/vhost-user: handle data movement with shadow vqs
      vhost-user: Add memory-isolation qdev property to vhost-user devices
      backends/cryptodev-vhost-user: add memory isolation bool
      net/vhost-user: add memory isolation

 backends/cryptodev-vhost-user.c      |  28 +-
 backends/vhost-user.c                |   4 +-
 hw/block/vhost-user-blk.c            |   4 +-
 hw/display/vhost-user-gpu.c          |   4 +-
 hw/scsi/vhost-user-scsi.c            |   5 +-
 hw/virtio/vhost-iova-tree.c          |  15 +
 hw/virtio/vhost-iova-tree.h          |   2 +
 hw/virtio/vhost-shadow-virtqueue.c   |  80 ++++-
 hw/virtio/vhost-shadow-virtqueue.h   |  25 +-
 hw/virtio/vhost-stub.c               |   3 +-
 hw/virtio/vhost-user-base.c          |  14 +-
 hw/virtio/vhost-user-fs.c            |   5 +-
 hw/virtio/vhost-user-gpio.c          |   4 -
 hw/virtio/vhost-user-i2c.c           |   5 -
 hw/virtio/vhost-user-input.c         |   5 -
 hw/virtio/vhost-user-rng.c           |   5 -
 hw/virtio/vhost-user-rtc.c           |   4 -
 hw/virtio/vhost-user-scmi.c          |   5 +-
 hw/virtio/vhost-user-snd.c           |   1 -
 hw/virtio/vhost-user-spi.c           |   5 -
 hw/virtio/vhost-user-test-device.c   |   1 -
 hw/virtio/vhost-user-vsock.c         |   5 +-
 hw/virtio/vhost-user.c               | 657 ++++++++++++++++++++++++++++++++++-
 include/hw/virtio/vhost-user-base.h  |   1 +
 include/hw/virtio/vhost-user-blk.h   |   1 +
 include/hw/virtio/vhost-user-fs.h    |   1 +
 include/hw/virtio/vhost-user-scmi.h  |   1 +
 include/hw/virtio/vhost-user-vsock.h |   1 +
 include/hw/virtio/vhost-user.h       |   6 +-
 include/hw/virtio/virtio-gpu.h       |   1 +
 include/hw/virtio/virtio-scsi.h      |   1 +
 include/qemu/iova-tree.h             |  21 ++
 include/system/vhost-user-backend.h  |   3 +-
 net/passt.c                          |  19 +-
 net/vhost-user.c                     |  11 +-
 qapi/net.json                        |  16 +-
 qapi/qom.json                        |   8 +-
 util/iova-tree.c                     |   5 +
 38 files changed, 903 insertions(+), 79 deletions(-)
---
base-commit: 88aac004fb1bef50277d8484f4aeacf2e8cb9e38
change-id: 20260604-vhost-user-isolated-memory-070ed4833ee7

Best regards,
-- 
Connor Kite <[email protected]>