From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <junjie.j.chen@intel.com>
Received: from mga11.intel.com (mga11.intel.com [192.55.52.93])
 by dpdk.org (Postfix) with ESMTP id 126331B1C8
 for <dev@dpdk.org>; Wed, 17 Jan 2018 04:01:40 +0100 (CET)
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
Received: from orsmga008.jf.intel.com ([10.7.209.65])
 by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;
 16 Jan 2018 19:01:39 -0800
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.46,371,1511856000"; d="scan'208";a="10700839"
Received: from dpdk-dev.sh.intel.com ([10.67.111.147])
 by orsmga008.jf.intel.com with ESMTP; 16 Jan 2018 19:01:38 -0800
From: Junjie Chen <junjie.j.chen@intel.com>
To: yliu@fridaylinux.org,
	maxime.coquelin@redhat.com
Cc: dev@dpdk.org,
	Junjie Chen <junjie.j.chen@intel.com>
Date: Wed, 17 Jan 2018 05:42:06 -0500
Message-Id: <1516185726-31797-1-git-send-email-junjie.j.chen@intel.com>
X-Mailer: git-send-email 2.0.1
Subject: [dpdk-dev] [PATCH] vhost: dequeue zero copy should restore mbuf
	before return to pool
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://dpdk.org/ml/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://dpdk.org/ml/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://dpdk.org/ml/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Jan 2018 03:01:41 -0000

dequeue zero copy change buf_addr and buf_iova of mbuf, and return
to mbuf pool without restore them, it breaks vm memory if others allocate
mbuf from same pool since mbuf reset doesn't reset buf_addr and buf_iova.

Signed-off-by: Junjie Chen <junjie.j.chen@intel.com>
---
 lib/librte_vhost/virtio_net.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index 568ad0e..e9aaf6d 100644
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -1158,6 +1158,26 @@ mbuf_is_consumed(struct rte_mbuf *m)
 	return true;
 }
 
+
+static __rte_always_inline void
+restore_mbuf(struct rte_mbuf *m)
+{
+	uint32_t mbuf_size, priv_size;
+
+	while (m) {
+		priv_size = rte_pktmbuf_priv_size(m->pool);
+		mbuf_size = sizeof(struct rte_mbuf) + priv_size;
+		/* start of buffer is after mbuf structure and priv data */
+		m->priv_size = priv_size;
+
+		m->buf_addr = (char *)m + mbuf_size;
+		m->buf_iova = rte_mempool_virt2iova(m) + mbuf_size;
+		m->data_off = RTE_MIN(RTE_PKTMBUF_HEADROOM,
+			(uint16_t)m->buf_len);
+		m = m->next;
+	}
+}
+
 uint16_t
 rte_vhost_dequeue_burst(int vid, uint16_t queue_id,
 	struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count)
@@ -1209,6 +1229,7 @@ rte_vhost_dequeue_burst(int vid, uint16_t queue_id,
 				nr_updated += 1;
 
 				TAILQ_REMOVE(&vq->zmbuf_list, zmbuf, next);
+				restore_mbuf(zmbuf->mbuf);
 				rte_pktmbuf_free(zmbuf->mbuf);
 				put_zmbuf(zmbuf);
 				vq->nr_zmbuf -= 1;
-- 
2.0.1