* [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
@ 2024-12-19 6:38 Yunjian Wang
2024-12-19 8:24 ` David Marchand
` (3 more replies)
0 siblings, 4 replies; 9+ messages in thread
From: Yunjian Wang @ 2024-12-19 6:38 UTC (permalink / raw)
To: dev
Cc: maxime.coquelin, chenbox, jerry.lilijun, xiawei40, wangzengyuan,
Yunjian Wang, stable
The hdr->csum_start does two successive reads from user space to read a
variable length data structure. The result overflow if the data structure
changes between the two reads.
To fix this, we can prevent double fetch issue by copying virtio_hdr to
the temporary variable.
Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
Cc: stable@dpdk.org
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
lib/vhost/virtio_net.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 69901ab3b5..5c40ae7069 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
* in a contiguous virtual area.
*/
copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
- hdr = &tmp_hdr;
} else {
- hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
+ rte_memcpy((void *)(uintptr_t)&tmp_hdr,
+ (void *)(uintptr_t)buf_vec[0].buf_addr,
+ sizeof(struct virtio_net_hdr));
}
+ hdr = &tmp_hdr;
}
for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
@@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
{
uint16_t avail_idx = vq->last_avail_idx;
uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
- struct virtio_net_hdr *hdr;
+ struct virtio_net_hdr hdr;
uintptr_t desc_addrs[PACKED_BATCH_SIZE];
uint16_t ids[PACKED_BATCH_SIZE];
uint16_t i;
@@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
if (virtio_net_with_host_offload(dev)) {
vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
- hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
- vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
+ rte_memcpy((void *)(uintptr_t)&hdr,
+ (void *)(uintptr_t)desc_addrs[i], sizeof(struct virtio_net_hdr));
+ vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
}
}
--
2.33.0
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-19 6:38 [PATCH 1/1] vhost: fix a double fetch when dequeue offloading Yunjian Wang
@ 2024-12-19 8:24 ` David Marchand
2024-12-19 11:02 ` Wangyunjian(wangyunjian,TongTu)
2024-12-19 16:15 ` Stephen Hemminger
` (2 subsequent siblings)
3 siblings, 1 reply; 9+ messages in thread
From: David Marchand @ 2024-12-19 8:24 UTC (permalink / raw)
To: Yunjian Wang, maxime.coquelin
Cc: dev, chenbox, jerry.lilijun, xiawei40, wangzengyuan, stable
On Thu, Dec 19, 2024 at 7:38 AM Yunjian Wang <wangyunjian@huawei.com> wrote:
>
> The hdr->csum_start does two successive reads from user space to read a
> variable length data structure. The result overflow if the data structure
> changes between the two reads.
>
> To fix this, we can prevent double fetch issue by copying virtio_hdr to
> the temporary variable.
>
> Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
> Cc: stable@dpdk.org
>
> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
> ---
> lib/vhost/virtio_net.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> index 69901ab3b5..5c40ae7069 100644
> --- a/lib/vhost/virtio_net.c
> +++ b/lib/vhost/virtio_net.c
> @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
> * in a contiguous virtual area.
> */
> copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> - hdr = &tmp_hdr;
> } else {
> - hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> + rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> + (void *)(uintptr_t)buf_vec[0].buf_addr,
> + sizeof(struct virtio_net_hdr));
> }
> + hdr = &tmp_hdr;
> }
This will need some benchmark, as I remember putting rte_memcpy in
inlined helpers had some performance impact.
Instead, I would call copy_vnet_hdr_from_desc unconditionnally, and
store in a struct virtio_net_hdr hdr variable (+ a has_vnet_hdr
boolean to indicate validity).
Something like:
if (virtio_net_with_host_offload(dev)) {
- if (unlikely(buf_vec[0].buf_len < sizeof(struct
virtio_net_hdr))) {
- /*
- * No luck, the virtio-net header doesn't fit
- * in a contiguous virtual area.
- */
- copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
- hdr = &tmp_hdr;
- } else {
- hdr = (struct virtio_net_hdr
*)((uintptr_t)buf_vec[0].buf_addr);
- }
+ copy_vnet_hdr_from_desc(&hdr, buf_vec);
+ has_vnet_hdr = true;
}
(besides, in copy_vnet_hdr_from_desc, the while (cond) {} loop could
be changed to do a do {} while (cond), and that approach requires
performance numbers too)
>
> for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
> @@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
> {
> uint16_t avail_idx = vq->last_avail_idx;
> uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
> - struct virtio_net_hdr *hdr;
> + struct virtio_net_hdr hdr;
> uintptr_t desc_addrs[PACKED_BATCH_SIZE];
> uint16_t ids[PACKED_BATCH_SIZE];
> uint16_t i;
> @@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
>
> if (virtio_net_with_host_offload(dev)) {
> vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
> - hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
> - vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
> + rte_memcpy((void *)(uintptr_t)&hdr,
> + (void *)(uintptr_t)desc_addrs[i], sizeof(struct virtio_net_hdr));
> + vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
> }
> }
Here too, there may be an impact with adding rte_memcpy.
Just do a copy like:
if (virtio_net_with_host_offload(dev)) {
+ struct virtio_net_hdr hdr;
+
vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
- hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
- vhost_dequeue_offload(dev, hdr, pkts[i],
legacy_ol_flags);
+ hdr = *(struct virtio_net_hdr *)(desc_addrs[i]);
+ vhost_dequeue_offload(dev, &hdr, pkts[i],
legacy_ol_flags);
}
--
David Marchand
^ permalink raw reply [flat|nested] 9+ messages in thread
* RE: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-19 8:24 ` David Marchand
@ 2024-12-19 11:02 ` Wangyunjian(wangyunjian,TongTu)
0 siblings, 0 replies; 9+ messages in thread
From: Wangyunjian(wangyunjian,TongTu) @ 2024-12-19 11:02 UTC (permalink / raw)
To: David Marchand, maxime.coquelin
Cc: dev, chenbox, Lilijun (Jerry), xiawei (H), wangzengyuan, stable
> -----Original Message-----
> From: David Marchand [mailto:david.marchand@redhat.com]
> Sent: Thursday, December 19, 2024 4:24 PM
> To: Wangyunjian(wangyunjian,TongTu) <wangyunjian@huawei.com>;
> maxime.coquelin@redhat.com
> Cc: dev@dpdk.org; chenbox@nvidia.com; Lilijun (Jerry)
> <jerry.lilijun@huawei.com>; xiawei (H) <xiawei40@huawei.com>;
> wangzengyuan <wangzengyuan@huawei.com>; stable@dpdk.org
> Subject: Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
>
> On Thu, Dec 19, 2024 at 7:38 AM Yunjian Wang <wangyunjian@huawei.com>
> wrote:
> >
> > The hdr->csum_start does two successive reads from user space to read a
> > variable length data structure. The result overflow if the data structure
> > changes between the two reads.
> >
> > To fix this, we can prevent double fetch issue by copying virtio_hdr to
> > the temporary variable.
> >
> > Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
> > ---
> > lib/vhost/virtio_net.c | 13 ++++++++-----
> > 1 file changed, 8 insertions(+), 5 deletions(-)
> >
> > diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> > index 69901ab3b5..5c40ae7069 100644
> > --- a/lib/vhost/virtio_net.c
> > +++ b/lib/vhost/virtio_net.c
> > @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct
> vhost_virtqueue *vq,
> > * in a contiguous virtual area.
> > */
> > copy_vnet_hdr_from_desc(&tmp_hdr,
> buf_vec);
> > - hdr = &tmp_hdr;
> > } else {
> > - hdr = (struct virtio_net_hdr
> *)((uintptr_t)buf_vec[0].buf_addr);
> > + rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> > + (void
> *)(uintptr_t)buf_vec[0].buf_addr,
> > + sizeof(struct virtio_net_hdr));
> > }
> > + hdr = &tmp_hdr;
> > }
>
> This will need some benchmark, as I remember putting rte_memcpy in
> inlined helpers had some performance impact.
>
> Instead, I would call copy_vnet_hdr_from_desc unconditionnally, and
> store in a struct virtio_net_hdr hdr variable (+ a has_vnet_hdr
> boolean to indicate validity).
> Something like:
> if (virtio_net_with_host_offload(dev)) {
> - if (unlikely(buf_vec[0].buf_len < sizeof(struct
> virtio_net_hdr))) {
> - /*
> - * No luck, the virtio-net header doesn't fit
> - * in a contiguous virtual area.
> - */
> - copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> - hdr = &tmp_hdr;
> - } else {
> - hdr = (struct virtio_net_hdr
> *)((uintptr_t)buf_vec[0].buf_addr);
> - }
> + copy_vnet_hdr_from_desc(&hdr, buf_vec);
> + has_vnet_hdr = true;
> }
>
> (besides, in copy_vnet_hdr_from_desc, the while (cond) {} loop could
> be changed to do a do {} while (cond), and that approach requires
> performance numbers too)
How about this?
@@ -2904,8 +2904,8 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
uint32_t hdr_remain = dev->vhost_hlen;
uint32_t cpy_len;
struct rte_mbuf *cur = m, *prev = m;
- struct virtio_net_hdr tmp_hdr;
- struct virtio_net_hdr *hdr = NULL;
+ bool has_vnet_hdr = false;
+ struct virtio_net_hdr hdr;
uint16_t vec_idx;
struct vhost_async *async = vq->async;
struct async_inflight_info *pkts_info;
@@ -2921,11 +2921,11 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
* No luck, the virtio-net header doesn't fit
* in a contiguous virtual area.
*/
- copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
- hdr = &tmp_hdr;
+ copy_vnet_hdr_from_desc(&hdr, buf_vec);
} else {
- hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
+ hdr = *(struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
}
+ has_vnet_hdr = true;
}
>
>
> >
> > for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
> > @@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net
> *dev,
> > {
> > uint16_t avail_idx = vq->last_avail_idx;
> > uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
> > - struct virtio_net_hdr *hdr;
> > + struct virtio_net_hdr hdr;
> > uintptr_t desc_addrs[PACKED_BATCH_SIZE];
> > uint16_t ids[PACKED_BATCH_SIZE];
> > uint16_t i;
> > @@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net
> *dev,
> >
> > if (virtio_net_with_host_offload(dev)) {
> > vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
> > - hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
> > - vhost_dequeue_offload(dev, hdr, pkts[i],
> legacy_ol_flags);
> > + rte_memcpy((void *)(uintptr_t)&hdr,
> > + (void *)(uintptr_t)desc_addrs[i],
> sizeof(struct virtio_net_hdr));
> > + vhost_dequeue_offload(dev, &hdr, pkts[i],
> legacy_ol_flags);
> > }
> > }
>
> Here too, there may be an impact with adding rte_memcpy.
> Just do a copy like:
>
> if (virtio_net_with_host_offload(dev)) {
> + struct virtio_net_hdr hdr;
> +
> vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
> - hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
> - vhost_dequeue_offload(dev, hdr, pkts[i],
> legacy_ol_flags);
> + hdr = *(struct virtio_net_hdr *)(desc_addrs[i]);
> + vhost_dequeue_offload(dev, &hdr, pkts[i],
> legacy_ol_flags);
> }
>
Thanks for your suggestion, will include them in next version.
>
> --
> David Marchand
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-19 6:38 [PATCH 1/1] vhost: fix a double fetch when dequeue offloading Yunjian Wang
2024-12-19 8:24 ` David Marchand
@ 2024-12-19 16:15 ` Stephen Hemminger
2024-12-20 2:17 ` Wangyunjian(wangyunjian,TongTu)
2024-12-20 3:49 ` [PATCH v2 " Yunjian Wang
2024-12-20 16:35 ` [PATCH " Stephen Hemminger
3 siblings, 1 reply; 9+ messages in thread
From: Stephen Hemminger @ 2024-12-19 16:15 UTC (permalink / raw)
To: Yunjian Wang
Cc: dev, maxime.coquelin, chenbox, jerry.lilijun, xiawei40,
wangzengyuan, stable
On Thu, 19 Dec 2024 14:38:28 +0800
Yunjian Wang <wangyunjian@huawei.com> wrote:
> - hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> + rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> + (void *)(uintptr_t)buf_vec[0].buf_addr,
> + sizeof(struct virtio_net_hdr));
> }
Do not introduce more rte_memcpy of a fixed size.
You don't need that many casts!
Why can you not use a structure assignment here.
^ permalink raw reply [flat|nested] 9+ messages in thread
* RE: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-19 16:15 ` Stephen Hemminger
@ 2024-12-20 2:17 ` Wangyunjian(wangyunjian,TongTu)
2024-12-20 4:59 ` Stephen Hemminger
0 siblings, 1 reply; 9+ messages in thread
From: Wangyunjian(wangyunjian,TongTu) @ 2024-12-20 2:17 UTC (permalink / raw)
To: Stephen Hemminger
Cc: dev, maxime.coquelin, chenbox, Lilijun (Jerry), xiawei (H),
wangzengyuan, stable
> -----Original Message-----
> From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> Sent: Friday, December 20, 2024 12:16 AM
> To: Wangyunjian(wangyunjian,TongTu) <wangyunjian@huawei.com>
> Cc: dev@dpdk.org; maxime.coquelin@redhat.com; chenbox@nvidia.com;
> Lilijun (Jerry) <jerry.lilijun@huawei.com>; xiawei (H) <xiawei40@huawei.com>;
> wangzengyuan <wangzengyuan@huawei.com>; stable@dpdk.org
> Subject: Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
>
> On Thu, 19 Dec 2024 14:38:28 +0800
> Yunjian Wang <wangyunjian@huawei.com> wrote:
>
> > - hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> > + rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> > + (void *)(uintptr_t)buf_vec[0].buf_addr,
> > + sizeof(struct virtio_net_hdr));
> > }
>
> Do not introduce more rte_memcpy of a fixed size.
> You don't need that many casts!
> Why can you not use a structure assignment here.
The virtio_hdr is a shared component, and other fields within it are read
multiple times. This can potentially result in a double fetch scenario.
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v2 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-19 6:38 [PATCH 1/1] vhost: fix a double fetch when dequeue offloading Yunjian Wang
2024-12-19 8:24 ` David Marchand
2024-12-19 16:15 ` Stephen Hemminger
@ 2024-12-20 3:49 ` Yunjian Wang
2024-12-20 17:10 ` Stephen Hemminger
2024-12-20 16:35 ` [PATCH " Stephen Hemminger
3 siblings, 1 reply; 9+ messages in thread
From: Yunjian Wang @ 2024-12-20 3:49 UTC (permalink / raw)
To: dev
Cc: maxime.coquelin, chenbox, jerry.lilijun, xiawei40, wangzengyuan,
Yunjian Wang, stable
The hdr->csum_start does two successive reads from user space to read a
variable length data structure. The result overflow if the data structure
changes between the two reads.
To fix this, we can prevent double fetch issue by copying virtio_hdr to
the temporary variable.
Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
Cc: stable@dpdk.org
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
v2: update code styles suggested by David Marchand
---
lib/vhost/virtio_net.c | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 69901ab3b5..2676447906 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2896,8 +2896,8 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
uint32_t hdr_remain = dev->vhost_hlen;
uint32_t cpy_len;
struct rte_mbuf *cur = m, *prev = m;
- struct virtio_net_hdr tmp_hdr;
- struct virtio_net_hdr *hdr = NULL;
+ bool has_vnet_hdr = false;
+ struct virtio_net_hdr hdr;
uint16_t vec_idx;
struct vhost_async *async = vq->async;
struct async_inflight_info *pkts_info;
@@ -2913,11 +2913,11 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
* No luck, the virtio-net header doesn't fit
* in a contiguous virtual area.
*/
- copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
- hdr = &tmp_hdr;
+ copy_vnet_hdr_from_desc(&hdr, buf_vec);
} else {
- hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
+ hdr = *(struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
}
+ has_vnet_hdr = true;
}
for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
@@ -2953,7 +2953,7 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
if (async_fill_seg(dev, vq, cur, mbuf_offset,
buf_iova + buf_offset, cpy_len, false) < 0)
goto error;
- } else if (likely(hdr && cur == m)) {
+ } else if (likely(has_vnet_hdr && cur == m)) {
rte_memcpy(rte_pktmbuf_mtod_offset(cur, void *, mbuf_offset),
(void *)((uintptr_t)(buf_addr + buf_offset)),
cpy_len);
@@ -3013,10 +3013,10 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
if (is_async) {
async_iter_finalize(async);
- if (hdr)
- pkts_info[slot_idx].nethdr = *hdr;
- } else if (hdr) {
- vhost_dequeue_offload(dev, hdr, m, legacy_ol_flags);
+ if (has_vnet_hdr)
+ pkts_info[slot_idx].nethdr = hdr;
+ } else if (has_vnet_hdr) {
+ vhost_dequeue_offload(dev, &hdr, m, legacy_ol_flags);
}
return 0;
@@ -3363,7 +3363,6 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
{
uint16_t avail_idx = vq->last_avail_idx;
uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
- struct virtio_net_hdr *hdr;
uintptr_t desc_addrs[PACKED_BATCH_SIZE];
uint16_t ids[PACKED_BATCH_SIZE];
uint16_t i;
@@ -3381,9 +3380,11 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
pkts[i]->pkt_len);
if (virtio_net_with_host_offload(dev)) {
+ struct virtio_net_hdr hdr;
+
vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
- hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
- vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
+ hdr = *(struct virtio_net_hdr *)(desc_addrs[i]);
+ vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
}
}
--
2.33.0
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-20 2:17 ` Wangyunjian(wangyunjian,TongTu)
@ 2024-12-20 4:59 ` Stephen Hemminger
0 siblings, 0 replies; 9+ messages in thread
From: Stephen Hemminger @ 2024-12-20 4:59 UTC (permalink / raw)
To: Wangyunjian(wangyunjian,TongTu)
Cc: dev, maxime.coquelin, chenbox, Lilijun (Jerry), xiawei (H),
wangzengyuan, stable
On Fri, 20 Dec 2024 02:17:12 +0000
"Wangyunjian(wangyunjian,TongTu)" <wangyunjian@huawei.com> wrote:
> > -----Original Message-----
> > From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> > Sent: Friday, December 20, 2024 12:16 AM
> > To: Wangyunjian(wangyunjian,TongTu) <wangyunjian@huawei.com>
> > Cc: dev@dpdk.org; maxime.coquelin@redhat.com; chenbox@nvidia.com;
> > Lilijun (Jerry) <jerry.lilijun@huawei.com>; xiawei (H) <xiawei40@huawei.com>;
> > wangzengyuan <wangzengyuan@huawei.com>; stable@dpdk.org
> > Subject: Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
> >
> > On Thu, 19 Dec 2024 14:38:28 +0800
> > Yunjian Wang <wangyunjian@huawei.com> wrote:
> >
> > > - hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> > > + rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> > > + (void *)(uintptr_t)buf_vec[0].buf_addr,
> > > + sizeof(struct virtio_net_hdr));
> > > }
> >
> > Do not introduce more rte_memcpy of a fixed size.
> > You don't need that many casts!
> > Why can you not use a structure assignment here.
>
> The virtio_hdr is a shared component, and other fields within it are read
> multiple times. This can potentially result in a double fetch scenario.
The point is do a copy, but not with rte_memcpy.
Also you need a rte_compiler_barrier() anyway.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-19 6:38 [PATCH 1/1] vhost: fix a double fetch when dequeue offloading Yunjian Wang
` (2 preceding siblings ...)
2024-12-20 3:49 ` [PATCH v2 " Yunjian Wang
@ 2024-12-20 16:35 ` Stephen Hemminger
3 siblings, 0 replies; 9+ messages in thread
From: Stephen Hemminger @ 2024-12-20 16:35 UTC (permalink / raw)
To: Yunjian Wang
Cc: dev, maxime.coquelin, chenbox, jerry.lilijun, xiawei40,
wangzengyuan, stable
On Thu, 19 Dec 2024 14:38:28 +0800
Yunjian Wang <wangyunjian@huawei.com> wrote:
> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> index 69901ab3b5..5c40ae7069 100644
> --- a/lib/vhost/virtio_net.c
> +++ b/lib/vhost/virtio_net.c
> @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
> * in a contiguous virtual area.
> */
> copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> - hdr = &tmp_hdr;
> } else {
> - hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> + rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> + (void *)(uintptr_t)buf_vec[0].buf_addr,
> + sizeof(struct virtio_net_hdr));
> }
> + hdr = &tmp_hdr;
Since this if block is just an optimization of the case where vnet header
is contiguous why not just always use copy_vnet_hdr_from_desc? and inline it?
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/1] vhost: fix a double fetch when dequeue offloading
2024-12-20 3:49 ` [PATCH v2 " Yunjian Wang
@ 2024-12-20 17:10 ` Stephen Hemminger
0 siblings, 0 replies; 9+ messages in thread
From: Stephen Hemminger @ 2024-12-20 17:10 UTC (permalink / raw)
To: Yunjian Wang
Cc: dev, maxime.coquelin, chenbox, jerry.lilijun, xiawei40,
wangzengyuan, stable
On Fri, 20 Dec 2024 11:49:55 +0800
Yunjian Wang <wangyunjian@huawei.com> wrote:
> The hdr->csum_start does two successive reads from user space to read a
> variable length data structure. The result overflow if the data structure
> changes between the two reads.
>
> To fix this, we can prevent double fetch issue by copying virtio_hdr to
> the temporary variable.
>
> Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
> Cc: stable@dpdk.org
>
> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
How about something like the following *untested*
diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 69901ab3b5..c65cb639b2 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2861,25 +2861,28 @@ vhost_dequeue_offload(struct virtio_net *dev, struct virtio_net_hdr *hdr,
}
}
-static __rte_noinline void
+static inline int
copy_vnet_hdr_from_desc(struct virtio_net_hdr *hdr,
- struct buf_vector *buf_vec)
+ const struct buf_vector *buf_vec,
+ uint16_t nr_vec)
{
- uint64_t len;
- uint64_t remain = sizeof(struct virtio_net_hdr);
- uint64_t src;
- uint64_t dst = (uint64_t)(uintptr_t)hdr;
+ size_t remain = sizeof(struct virtio_net_hdr);
+ uint8_t *dst = (uint8_t *)hdr;
- while (remain) {
- len = RTE_MIN(remain, buf_vec->buf_len);
- src = buf_vec->buf_addr;
- rte_memcpy((void *)(uintptr_t)dst,
- (void *)(uintptr_t)src, len);
+ while (remain > 0) {
+ size_t len = RTE_MIN(remain, buf_vec->buf_len);
+ const void *src = (const void *)(uintptr_t)buf_vec->buf_addr;
+ if (unlikely(nr_vec == 0))
+ return -1;
+
+ memcpy(dst, src, len);
remain -= len;
dst += len;
buf_vec++;
+ --nr_vec;
}
+ return 0;
}
static __rte_always_inline int
@@ -2908,16 +2911,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
*/
if (virtio_net_with_host_offload(dev)) {
- if (unlikely(buf_vec[0].buf_len < sizeof(struct virtio_net_hdr))) {
- /*
- * No luck, the virtio-net header doesn't fit
- * in a contiguous virtual area.
- */
- copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
- hdr = &tmp_hdr;
- } else {
- hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
- }
+ if (unlikely(copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec, nr_vec) != 0))
+ return -1;
+
+ /* ensure that compiler does not delay copy */
+ rte_compiler_barrier();
+ hdr = &tmp_hdr;
}
for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
@@ -3363,7 +3362,6 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
{
uint16_t avail_idx = vq->last_avail_idx;
uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
- struct virtio_net_hdr *hdr;
uintptr_t desc_addrs[PACKED_BATCH_SIZE];
uint16_t ids[PACKED_BATCH_SIZE];
uint16_t i;
@@ -3382,8 +3380,12 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
if (virtio_net_with_host_offload(dev)) {
vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
- hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
- vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
+ struct virtio_net_hdr hdr;
+
+ memcpy(&hdr, (void *)desc_addrs[i], sizeof(struct virtio_net_hdr));
+ rte_compiler_barrier();
+
+ vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
}
}
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2024-12-20 17:10 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-12-19 6:38 [PATCH 1/1] vhost: fix a double fetch when dequeue offloading Yunjian Wang
2024-12-19 8:24 ` David Marchand
2024-12-19 11:02 ` Wangyunjian(wangyunjian,TongTu)
2024-12-19 16:15 ` Stephen Hemminger
2024-12-20 2:17 ` Wangyunjian(wangyunjian,TongTu)
2024-12-20 4:59 ` Stephen Hemminger
2024-12-20 3:49 ` [PATCH v2 " Yunjian Wang
2024-12-20 17:10 ` Stephen Hemminger
2024-12-20 16:35 ` [PATCH " Stephen Hemminger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).