From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by dpdk.org (Postfix) with ESMTP id 126331B1C8 for ; Wed, 17 Jan 2018 04:01:40 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Jan 2018 19:01:39 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,371,1511856000"; d="scan'208";a="10700839" Received: from dpdk-dev.sh.intel.com ([10.67.111.147]) by orsmga008.jf.intel.com with ESMTP; 16 Jan 2018 19:01:38 -0800 From: Junjie Chen To: yliu@fridaylinux.org, maxime.coquelin@redhat.com Cc: dev@dpdk.org, Junjie Chen Date: Wed, 17 Jan 2018 05:42:06 -0500 Message-Id: <1516185726-31797-1-git-send-email-junjie.j.chen@intel.com> X-Mailer: git-send-email 2.0.1 Subject: [dpdk-dev] [PATCH] vhost: dequeue zero copy should restore mbuf before return to pool X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jan 2018 03:01:41 -0000 dequeue zero copy change buf_addr and buf_iova of mbuf, and return to mbuf pool without restore them, it breaks vm memory if others allocate mbuf from same pool since mbuf reset doesn't reset buf_addr and buf_iova. Signed-off-by: Junjie Chen --- lib/librte_vhost/virtio_net.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index 568ad0e..e9aaf6d 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -1158,6 +1158,26 @@ mbuf_is_consumed(struct rte_mbuf *m) return true; } + +static __rte_always_inline void +restore_mbuf(struct rte_mbuf *m) +{ + uint32_t mbuf_size, priv_size; + + while (m) { + priv_size = rte_pktmbuf_priv_size(m->pool); + mbuf_size = sizeof(struct rte_mbuf) + priv_size; + /* start of buffer is after mbuf structure and priv data */ + m->priv_size = priv_size; + + m->buf_addr = (char *)m + mbuf_size; + m->buf_iova = rte_mempool_virt2iova(m) + mbuf_size; + m->data_off = RTE_MIN(RTE_PKTMBUF_HEADROOM, + (uint16_t)m->buf_len); + m = m->next; + } +} + uint16_t rte_vhost_dequeue_burst(int vid, uint16_t queue_id, struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count) @@ -1209,6 +1229,7 @@ rte_vhost_dequeue_burst(int vid, uint16_t queue_id, nr_updated += 1; TAILQ_REMOVE(&vq->zmbuf_list, zmbuf, next); + restore_mbuf(zmbuf->mbuf); rte_pktmbuf_free(zmbuf->mbuf); put_zmbuf(zmbuf); vq->nr_zmbuf -= 1; -- 2.0.1