[dpdk-stable] patch 'vhost: protect log address translation in IOTLB update' has been queued to stable release 19.11.1

[luca.boccassi@gmail.com]

Hi,

FYI, your patch has been queued to stable release 19.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 02/19/20. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Thanks.

Luca Boccassi

---
From 37d6a69f880b9c9292f7adbc72c4aba008e03115 Mon Sep 17 00:00:00 2001
From: Adrian Moreno <amorenoz@redhat.com>
Date: Thu, 13 Feb 2020 11:04:58 +0100
Subject: [PATCH] vhost: protect log address translation in IOTLB update

[ upstream commit 4f37df14c405b754b5e971c75f4f67f4bb5bfdde ]

Currently, the log address translation only  happens in the vhost-user's
translate_ring_addresses(). However, the IOTLB update handler is not
checking if it was mapped to re-trigger that translation.

Since the log address mapping could fail, check it on iotlb updates.
Also, check it on vring_translate() so we do not dirty pages if the
logging address is not yet ready.

Additionally, properly protect the accesses to the iotlb structures.

Fixes: fbda9f145927 ("vhost: translate incoming log address to GPA")

Signed-off-by: Adrian Moreno <amorenoz@redhat.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
 lib/librte_vhost/vhost.c      | 56 ++++++++++++++++++++++++++++++++++
 lib/librte_vhost/vhost.h      | 15 +++++++--
 lib/librte_vhost/vhost_user.c | 57 +++++++++++++++--------------------
 3 files changed, 93 insertions(+), 35 deletions(-)

diff --git a/lib/librte_vhost/vhost.c b/lib/librte_vhost/vhost.c
index 1cbe948f74..20fda61518 100644
--- a/lib/librte_vhost/vhost.c
+++ b/lib/librte_vhost/vhost.c
@@ -350,6 +350,57 @@ free_device(struct virtio_net *dev)
 	rte_free(dev);
 }
 
+static __rte_always_inline int
+log_translate(struct virtio_net *dev, struct vhost_virtqueue *vq)
+{
+	if (likely(!(vq->ring_addrs.flags & (1 << VHOST_VRING_F_LOG))))
+		return 0;
+
+	vq->log_guest_addr = translate_log_addr(dev, vq,
+						vq->ring_addrs.log_guest_addr);
+	if (vq->log_guest_addr == 0)
+		return -1;
+
+	return 0;
+}
+
+/*
+ * Converts vring log address to GPA
+ * If IOMMU is enabled, the log address is IOVA
+ * If IOMMU not enabled, the log address is already GPA
+ *
+ * Caller should have iotlb_lock read-locked
+ */
+uint64_t
+translate_log_addr(struct virtio_net *dev, struct vhost_virtqueue *vq,
+		uint64_t log_addr)
+{
+	if (dev->features & (1ULL << VIRTIO_F_IOMMU_PLATFORM)) {
+		const uint64_t exp_size = sizeof(uint64_t);
+		uint64_t hva, gpa;
+		uint64_t size = exp_size;
+
+		hva = vhost_iova_to_vva(dev, vq, log_addr,
+					&size, VHOST_ACCESS_RW);
+
+		if (size != exp_size)
+			return 0;
+
+		gpa = hva_to_gpa(dev, hva, exp_size);
+		if (!gpa) {
+			RTE_LOG(ERR, VHOST_CONFIG,
+				"VQ: Failed to find GPA for log_addr: 0x%"
+				PRIx64 " hva: 0x%" PRIx64 "\n",
+				log_addr, hva);
+			return 0;
+		}
+		return gpa;
+
+	} else
+		return log_addr;
+}
+
+/* Caller should have iotlb_lock read-locked */
 static int
 vring_translate_split(struct virtio_net *dev, struct vhost_virtqueue *vq)
 {
@@ -388,6 +439,7 @@ vring_translate_split(struct virtio_net *dev, struct vhost_virtqueue *vq)
 	return 0;
 }
 
+/* Caller should have iotlb_lock read-locked */
 static int
 vring_translate_packed(struct virtio_net *dev, struct vhost_virtqueue *vq)
 {
@@ -434,6 +486,10 @@ vring_translate(struct virtio_net *dev, struct vhost_virtqueue *vq)
 		if (vring_translate_split(dev, vq) < 0)
 			return -1;
 	}
+
+	if (log_translate(dev, vq) < 0)
+		return -1;
+
 	vq->access_ok = 1;
 
 	return 0;
diff --git a/lib/librte_vhost/vhost.h b/lib/librte_vhost/vhost.h
index 9f11b28a31..9ec5934566 100644
--- a/lib/librte_vhost/vhost.h
+++ b/lib/librte_vhost/vhost.h
@@ -462,14 +462,23 @@ static __rte_always_inline void
 vhost_log_cache_used_vring(struct virtio_net *dev, struct vhost_virtqueue *vq,
 			uint64_t offset, uint64_t len)
 {
-	vhost_log_cache_write(dev, vq, vq->log_guest_addr + offset, len);
+	if (unlikely(dev->features & (1ULL << VHOST_F_LOG_ALL))) {
+		if (unlikely(vq->log_guest_addr == 0))
+			return;
+		__vhost_log_cache_write(dev, vq, vq->log_guest_addr + offset,
+					len);
+	}
 }
 
 static __rte_always_inline void
 vhost_log_used_vring(struct virtio_net *dev, struct vhost_virtqueue *vq,
 		     uint64_t offset, uint64_t len)
 {
-	vhost_log_write(dev, vq->log_guest_addr + offset, len);
+	if (unlikely(dev->features & (1ULL << VHOST_F_LOG_ALL))) {
+		if (unlikely(vq->log_guest_addr == 0))
+			return;
+		__vhost_log_write(dev, vq->log_guest_addr + offset, len);
+	}
 }
 
 static __rte_always_inline void
@@ -620,6 +629,8 @@ void *vhost_alloc_copy_ind_table(struct virtio_net *dev,
 			struct vhost_virtqueue *vq,
 			uint64_t desc_addr, uint64_t desc_len);
 int vring_translate(struct virtio_net *dev, struct vhost_virtqueue *vq);
+uint64_t translate_log_addr(struct virtio_net *dev, struct vhost_virtqueue *vq,
+		uint64_t log_addr);
 void vring_invalidate(struct virtio_net *dev, struct vhost_virtqueue *vq);
 
 static __rte_always_inline uint64_t
diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
index 8a33510a47..40c4520c08 100644
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -656,13 +656,11 @@ ring_addr_to_vva(struct virtio_net *dev, struct vhost_virtqueue *vq,
 {
 	if (dev->features & (1ULL << VIRTIO_F_IOMMU_PLATFORM)) {
 		uint64_t vva;
-		uint64_t req_size = *size;
 
-		vva = vhost_user_iotlb_cache_find(vq, ra,
+		vhost_user_iotlb_rd_lock(vq);
+		vva = vhost_iova_to_vva(dev, vq, ra,
 					size, VHOST_ACCESS_RW);
-		if (req_size != *size)
-			vhost_user_iotlb_miss(dev, (ra + *size),
-					      VHOST_ACCESS_RW);
+		vhost_user_iotlb_rd_unlock(vq);
 
 		return vva;
 	}
@@ -670,37 +668,16 @@ ring_addr_to_vva(struct virtio_net *dev, struct vhost_virtqueue *vq,
 	return qva_to_vva(dev, ra, size);
 }
 
-/*
- * Converts vring log address to GPA
- * If IOMMU is enabled, the log address is IOVA
- * If IOMMU not enabled, the log address is already GPA
- */
 static uint64_t
-translate_log_addr(struct virtio_net *dev, struct vhost_virtqueue *vq,
-		uint64_t log_addr)
+log_addr_to_gpa(struct virtio_net *dev, struct vhost_virtqueue *vq)
 {
-	if (dev->features & (1ULL << VIRTIO_F_IOMMU_PLATFORM)) {
-		const uint64_t exp_size = sizeof(struct vring_used) +
-			sizeof(struct vring_used_elem) * vq->size;
-		uint64_t hva, gpa;
-		uint64_t size = exp_size;
+	uint64_t log_gpa;
 
-		hva = vhost_iova_to_vva(dev, vq, log_addr,
-					&size, VHOST_ACCESS_RW);
-		if (size != exp_size)
-			return 0;
+	vhost_user_iotlb_rd_lock(vq);
+	log_gpa = translate_log_addr(dev, vq, vq->ring_addrs.log_guest_addr);
+	vhost_user_iotlb_rd_unlock(vq);
 
-		gpa = hva_to_gpa(dev, hva, exp_size);
-		if (!gpa) {
-			RTE_LOG(ERR, VHOST_CONFIG,
-				"VQ: Failed to find GPA for log_addr: 0x%" PRIx64 " hva: 0x%" PRIx64 "\n",
-				log_addr, hva);
-			return 0;
-		}
-		return gpa;
-
-	} else
-		return log_addr;
+	return log_gpa;
 }
 
 static struct virtio_net *
@@ -712,7 +689,7 @@ translate_ring_addresses(struct virtio_net *dev, int vq_index)
 
 	if (addr->flags & (1 << VHOST_VRING_F_LOG)) {
 		vq->log_guest_addr =
-			translate_log_addr(dev, vq, addr->log_guest_addr);
+			log_addr_to_gpa(dev, vq);
 		if (vq->log_guest_addr == 0) {
 			RTE_LOG(DEBUG, VHOST_CONFIG,
 				"(%d) failed to map log_guest_addr.\n",
@@ -2251,6 +2228,13 @@ is_vring_iotlb_split(struct vhost_virtqueue *vq, struct vhost_iotlb_msg *imsg)
 	if (ra->used_user_addr < end && (ra->used_user_addr + len) > start)
 		return 1;
 
+	if (ra->flags & (1 << VHOST_VRING_F_LOG)) {
+		len = sizeof(uint64_t);
+		if (ra->log_guest_addr < end &&
+		    (ra->log_guest_addr + len) > start)
+			return 1;
+	}
+
 	return 0;
 }
 
@@ -2276,6 +2260,13 @@ is_vring_iotlb_packed(struct vhost_virtqueue *vq, struct vhost_iotlb_msg *imsg)
 	if (ra->used_user_addr < end && (ra->used_user_addr + len) > start)
 		return 1;
 
+	if (ra->flags & (1 << VHOST_VRING_F_LOG)) {
+		len = sizeof(uint64_t);
+		if (ra->log_guest_addr < end &&
+		    (ra->log_guest_addr + len) > start)
+			return 1;
+	}
+
 	return 0;
 }
 
-- 
2.20.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2020-02-17 17:00:16.509727070 +0000
+++ 0043-vhost-protect-log-address-translation-in-IOTLB-updat.patch	2020-02-17 17:00:15.367951305 +0000
@@ -1,8 +1,10 @@
-From 4f37df14c405b754b5e971c75f4f67f4bb5bfdde Mon Sep 17 00:00:00 2001
+From 37d6a69f880b9c9292f7adbc72c4aba008e03115 Mon Sep 17 00:00:00 2001
 From: Adrian Moreno <amorenoz@redhat.com>
 Date: Thu, 13 Feb 2020 11:04:58 +0100
 Subject: [PATCH] vhost: protect log address translation in IOTLB update
 
+[ upstream commit 4f37df14c405b754b5e971c75f4f67f4bb5bfdde ]
+
 Currently, the log address translation only  happens in the vhost-user's
 translate_ring_addresses(). However, the IOTLB update handler is not
 checking if it was mapped to re-trigger that translation.
@@ -14,7 +16,6 @@
 Additionally, properly protect the accesses to the iotlb structures.
 
 Fixes: fbda9f145927 ("vhost: translate incoming log address to GPA")
-Cc: stable@dpdk.org
 
 Signed-off-by: Adrian Moreno <amorenoz@redhat.com>
 Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
@@ -25,10 +26,10 @@
  3 files changed, 93 insertions(+), 35 deletions(-)
 
 diff --git a/lib/librte_vhost/vhost.c b/lib/librte_vhost/vhost.c
-index c819a84774..0266318440 100644
+index 1cbe948f74..20fda61518 100644
 --- a/lib/librte_vhost/vhost.c
 +++ b/lib/librte_vhost/vhost.c
-@@ -353,6 +353,57 @@ free_device(struct virtio_net *dev)
+@@ -350,6 +350,57 @@ free_device(struct virtio_net *dev)
  	rte_free(dev);
  }
  
@@ -70,7 +71,7 @@
 +
 +		gpa = hva_to_gpa(dev, hva, exp_size);
 +		if (!gpa) {
-+			VHOST_LOG_CONFIG(ERR,
++			RTE_LOG(ERR, VHOST_CONFIG,
 +				"VQ: Failed to find GPA for log_addr: 0x%"
 +				PRIx64 " hva: 0x%" PRIx64 "\n",
 +				log_addr, hva);
@@ -86,7 +87,7 @@
  static int
  vring_translate_split(struct virtio_net *dev, struct vhost_virtqueue *vq)
  {
-@@ -391,6 +442,7 @@ vring_translate_split(struct virtio_net *dev, struct vhost_virtqueue *vq)
+@@ -388,6 +439,7 @@ vring_translate_split(struct virtio_net *dev, struct vhost_virtqueue *vq)
  	return 0;
  }
  
@@ -94,7 +95,7 @@
  static int
  vring_translate_packed(struct virtio_net *dev, struct vhost_virtqueue *vq)
  {
-@@ -437,6 +489,10 @@ vring_translate(struct virtio_net *dev, struct vhost_virtqueue *vq)
+@@ -434,6 +486,10 @@ vring_translate(struct virtio_net *dev, struct vhost_virtqueue *vq)
  		if (vring_translate_split(dev, vq) < 0)
  			return -1;
  	}
@@ -106,7 +107,7 @@
  
  	return 0;
 diff --git a/lib/librte_vhost/vhost.h b/lib/librte_vhost/vhost.h
-index 686ce42a20..2087d1400e 100644
+index 9f11b28a31..9ec5934566 100644
 --- a/lib/librte_vhost/vhost.h
 +++ b/lib/librte_vhost/vhost.h
 @@ -462,14 +462,23 @@ static __rte_always_inline void
@@ -135,7 +136,7 @@
  }
  
  static __rte_always_inline void
-@@ -626,6 +635,8 @@ void *vhost_alloc_copy_ind_table(struct virtio_net *dev,
+@@ -620,6 +629,8 @@ void *vhost_alloc_copy_ind_table(struct virtio_net *dev,
  			struct vhost_virtqueue *vq,
  			uint64_t desc_addr, uint64_t desc_len);
  int vring_translate(struct virtio_net *dev, struct vhost_virtqueue *vq);
@@ -145,7 +146,7 @@
  
  static __rte_always_inline uint64_t
 diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
-index 9a7b8b3088..bd1be01040 100644
+index 8a33510a47..40c4520c08 100644
 --- a/lib/librte_vhost/vhost_user.c
 +++ b/lib/librte_vhost/vhost_user.c
 @@ -656,13 +656,11 @@ ring_addr_to_vva(struct virtio_net *dev, struct vhost_virtqueue *vq,
@@ -196,7 +197,7 @@
  
 -		gpa = hva_to_gpa(dev, hva, exp_size);
 -		if (!gpa) {
--			VHOST_LOG_CONFIG(ERR,
+-			RTE_LOG(ERR, VHOST_CONFIG,
 -				"VQ: Failed to find GPA for log_addr: 0x%" PRIx64 " hva: 0x%" PRIx64 "\n",
 -				log_addr, hva);
 -			return 0;
@@ -216,7 +217,7 @@
 -			translate_log_addr(dev, vq, addr->log_guest_addr);
 +			log_addr_to_gpa(dev, vq);
  		if (vq->log_guest_addr == 0) {
- 			VHOST_LOG_CONFIG(DEBUG,
+ 			RTE_LOG(DEBUG, VHOST_CONFIG,
  				"(%d) failed to map log_guest_addr.\n",
 @@ -2251,6 +2228,13 @@ is_vring_iotlb_split(struct vhost_virtqueue *vq, struct vhost_iotlb_msg *imsg)
  	if (ra->used_user_addr < end && (ra->used_user_addr + len) > start)