From mboxrd@z Thu Jan 1 00:00:00 1970 From: Maxime Coquelin Subject: [PATCH 2/3] vhost: protect dirty logging against logging base change Date: Fri, 24 Nov 2017 18:48:24 +0100 Message-ID: <20171124174825.15567-3-maxime.coquelin@redhat.com> References: <20171124174825.15567-1-maxime.coquelin@redhat.com> Cc: stable@dpdk.org, jfreiman@redhat.com, Maxime Coquelin To: dev@dpdk.org, yliu@fridaylinux.org, tiwei.bie@intel.com, jianfeng.tan@intel.com, vkaplans@redhat.com Return-path: In-Reply-To: <20171124174825.15567-1-maxime.coquelin@redhat.com> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" When performing live-migration with multiple queue pairs, VHOST_USER_SET_LOG_BASE request is sent multiple times. If packets are being processed by the PMD threads, it is possible that they are setting bits in the dirty log map while its region is being unmapped by the vhost-user protocol thread. It results in the following crash: Thread 3 "lcore-slave-2" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f71ca495700 (LWP 32451)] 0x00000000004bfc8a in vhost_set_bit (addr=0x7f71cbe18432 , nr=1) at /home/max/projects/src/mainline/dpdk/lib/librte_vhost/vhost.h:267 267 __sync_fetch_and_or_8(addr, (1U << nr)); We can see the vhost-user protocol thread just did the unmap of the dirty log region when it happens. This patch prevents this by introducing a RW lock to protect the log base. Fixes: 54f9e32305d4 ("vhost: handle dirty pages logging request") Cc: stable@dpdk.org Signed-off-by: Maxime Coquelin --- lib/librte_vhost/vhost.c | 2 ++ lib/librte_vhost/vhost.h | 10 ++++++++-- lib/librte_vhost/vhost_user.c | 4 ++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/lib/librte_vhost/vhost.c b/lib/librte_vhost/vhost.c index 4f8b73a09..5a7699da0 100644 --- a/lib/librte_vhost/vhost.c +++ b/lib/librte_vhost/vhost.c @@ -311,6 +311,8 @@ vhost_new_device(void) return -1; } + rte_rwlock_init(&dev->log_lock); + vhost_devices[i] = dev; dev->vid = i; dev->slave_req_fd = -1; diff --git a/lib/librte_vhost/vhost.h b/lib/librte_vhost/vhost.h index 1cc81c17c..0f76d6495 100644 --- a/lib/librte_vhost/vhost.h +++ b/lib/librte_vhost/vhost.h @@ -243,6 +243,7 @@ struct virtio_net { uint64_t log_size; uint64_t log_base; uint64_t log_addr; + rte_rwlock_t log_lock; struct ether_addr mac; uint16_t mtu; @@ -278,12 +279,14 @@ vhost_log_write(struct virtio_net *dev, uint64_t addr, uint64_t len) { uint64_t page; + rte_rwlock_read_lock(&dev->log_lock); + if (likely(((dev->features & (1ULL << VHOST_F_LOG_ALL)) == 0) || !dev->log_base || !len)) - return; + goto unlock; if (unlikely(dev->log_size <= ((addr + len - 1) / VHOST_LOG_PAGE / 8))) - return; + goto unlock; /* To make sure guest memory updates are committed before logging */ rte_smp_wmb(); @@ -293,6 +296,9 @@ vhost_log_write(struct virtio_net *dev, uint64_t addr, uint64_t len) vhost_log_page((uint8_t *)(uintptr_t)dev->log_base, page); page += 1; } + +unlock: + rte_rwlock_read_unlock(&dev->log_lock); } static __rte_always_inline void diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c index f06d9bb65..4b03dbbca 100644 --- a/lib/librte_vhost/vhost_user.c +++ b/lib/librte_vhost/vhost_user.c @@ -929,6 +929,8 @@ vhost_user_set_log_base(struct virtio_net *dev, struct VhostUserMsg *msg) goto out; } + rte_rwlock_write_lock(&dev->log_lock); + /* * Free previously mapped log memory on occasionally * multiple VHOST_USER_SET_LOG_BASE. @@ -940,6 +942,8 @@ vhost_user_set_log_base(struct virtio_net *dev, struct VhostUserMsg *msg) dev->log_base = dev->log_addr + off; dev->log_size = size; + rte_rwlock_write_unlock(&dev->log_lock); + out: close(fd); -- 2.14.3