From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mailout1.w1.samsung.com (mailout1.w1.samsung.com [210.118.77.11]) by dpdk.org (Postfix) with ESMTP id 21A8D2C47 for ; Thu, 2 Jun 2016 12:46:34 +0200 (CEST) Received: from eucpsbgm2.samsung.com (unknown [203.254.199.245]) by mailout1.w1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0O85009SP4LK0Z60@mailout1.w1.samsung.com> for dev@dpdk.org; Thu, 02 Jun 2016 11:46:32 +0100 (BST) X-AuditID: cbfec7f5-f792a6d000001302-1e-57500e884098 Received: from eusync1.samsung.com ( [203.254.199.211]) by eucpsbgm2.samsung.com (EUCPMTA) with SMTP id 02.70.04866.88E00575; Thu, 2 Jun 2016 11:46:32 +0100 (BST) Received: from [106.109.129.180] by eusync1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0O8500GB34LJ69A0@eusync1.samsung.com>; Thu, 02 Jun 2016 11:46:32 +0100 (BST) To: Rich Lane References: <1463748604-27251-1-git-send-email-i.maximets@samsung.com> Cc: dev@dpdk.org, Huawei Xie , Yuanhan Liu , Dyasly Sergey , Heetae Ahn , Jianfeng Tan From: Ilya Maximets Message-id: <57500E86.3070104@samsung.com> Date: Thu, 02 Jun 2016 13:46:30 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-version: 1.0 In-reply-to: Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrPLMWRmVeSWpSXmKPExsVy+t/xy7odfAHhBh0tLBbvPm1nspj2+Ta7 RfvMs0wWV9p/slt0z/7CZrHp3SRWi8mzpSyuT7jA6sDh8eDyTSaPXwuWsnos3vOSyWPeyUCP vi2rGANYo7hsUlJzMstSi/TtErgyrt1az1jQJVJx9/oM5gbGeXxdjJwcEgImEl2bL7NC2GIS F+6tZ+ti5OIQEljKKLHw8FNmkISQwAtGiXPTxEBsYQE/ibUbJjGC2CIC6hJvn/UwQjT0Mkq8 ufkErJtZ4AajxIuJl8Cq2AR0JE6tPgJm8wpoSTxfNocJxGYRUJXY1PYbbIOoQITErO0/mCBq BCV+TL7HAmJzCgRLnF72C+g8DqCh6hJTpuSChJkF5CU2r3nLPIFRYBaSjlkIVbOQVC1gZF7F KJpamlxQnJSea6RXnJhbXJqXrpecn7uJERLsX3cwLj1mdYhRgINRiYeXQcc/XIg1say4MvcQ owQHs5II707ugHAh3pTEyqrUovz4otKc1OJDjNIcLErivDN3vQ8REkhPLEnNTk0tSC2CyTJx cEo1MJ6KS4hMVg5yYIm4+3I/G4/Fh/nvzjA5xoroHNtUuXPtzjku+e9deoUmxH1XPzxB51SQ DH9UVOB3acGHFpPT/6/5l2+zctor3zNz/vStErgnkh7VMcddt2yejnbdUubge+WnJh3qKSvL UE/ckiag/EHksGwd16oak4o1vkF/g4xXd55SWdRXqMRSnJFoqMVcVJwIAJxwjwFyAgAA Subject: Re: [dpdk-dev] [PATCH] vhost: fix segfault on bad descriptor address. X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jun 2016 10:46:34 -0000 Hi, Rich. Thank you for testing and analysing. On 01.06.2016 01:06, Rich Lane wrote: > On Fri, May 20, 2016 at 5:50 AM, Ilya Maximets > wrote: > > In current implementation guest application can reinitialize vrings > by executing start after stop. In the same time host application > can still poll virtqueue while device stopped in guest and it will > crash with segmentation fault while vring reinitialization because > of dereferencing of bad descriptor addresses. > > > I see a performance regression with this patch at large packet sizes (> 768 bytes). rte_vhost_enqueue_burst is consuming 10% more cycles. Strangely, there's actually a ~1% performance improvement at small packet sizes. > > The regression happens with GCC 4.8.4 and 5.3.0, but not 6.1.1. > > AFAICT this is just the compiler generating bad code. One difference is that it's storing the offset on the stack instead of in a register. A workaround is to move the !desc_addr check outside the unlikely macros. > > --- a/lib/librte_vhost/vhost_rxtx.c > +++ b/lib/librte_vhost/vhost_rxtx.c > @@ -147,10 +147,10 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq, > struct virtio_net_hdr_mrg_rxbuf virtio_hdr = {{0, 0, 0, 0, 0, 0}, 0}; > > desc = &vq->desc[desc_idx]; > - if (unlikely(desc->len < vq->vhost_hlen)) > + desc_addr = gpa_to_vva(dev, desc->addr); > + if (unlikely(desc->len < vq->vhost_hlen || !desc_addr)) > > > Workaround: change to "if (unlikely(desc->len < vq->vhost_hlen) || !desc_addr)". > > return -1; > > > - desc_addr = gpa_to_vva(dev, desc->addr); > rte_prefetch0((void *)(uintptr_t)desc_addr); > > virtio_enqueue_offload(m, &virtio_hdr.hdr); > @@ -184,6 +184,9 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq, > > desc = &vq->desc[desc->next]; > desc_addr = gpa_to_vva(dev, desc->addr); > + if (unlikely(!desc_addr)) > > > Workaround: change to "if (!desc_addr)". > > > + return -1; > + > desc_offset = 0; > desc_avail = desc->len; > } > What about other places? Is there same issues or it's only inside copy_mbuf_to_desc() ? Best regards, Ilya Maximets.