[PATCH v2 0/2] vdpa: do not save failed dma maps in SVQ iova tree

[PATCH v2 0/2] vdpa: do not save failed dma maps in SVQ iova tree

[Eugenio Pérez]

If a map fails for whatever reason, it must not be saved in the tree.
Otherwise, qemu will try to unmap it in cleanup, leaving to more errors.

v2: Do not dereference failed maps

Eugenio Pérez (2):
  vdpa: Skip the maps not in the iova tree
  vdpa: do not save failed dma maps in SVQ iova tree

 hw/virtio/vhost-vdpa.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

-- 
2.31.1

[PATCH v2 1/2] vdpa: Skip the maps not in the iova tree

[Eugenio Pérez]

Next patch will skip the registering of dma maps that the vdpa device
rejects in the iova tree. We need to consider that here or we cause a
SIGSEGV accessing result.

Reported-by: Lei Yang <leiyang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
---
 hw/virtio/vhost-vdpa.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 3ff9ce3501..983d3697b0 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -289,6 +289,10 @@ static void vhost_vdpa_listener_region_del(MemoryListener *listener,
         };
 
         result = vhost_iova_tree_find_iova(v->iova_tree, &mem_region);
+        if (!result) {
+            /* The memory listener map wasn't mapped */
+            return;
+        }
         iova = result->iova;
         vhost_iova_tree_remove(v->iova_tree, result);
     }
-- 
2.31.1

[PATCH v2 2/2] vdpa: do not save failed dma maps in SVQ iova tree

[Eugenio Pérez]

If a map fails for whatever reason, it must not be saved in the tree.
Otherwise, qemu will try to unmap it in cleanup, leaving to more errors.

Fixes: 34e3c94eda ("vdpa: Add custom IOTLB translations to SVQ")
Reported-by: Lei Yang <leiyang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
---
 hw/virtio/vhost-vdpa.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 983d3697b0..7e28d2f674 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -176,6 +176,7 @@ static void vhost_vdpa_listener_commit(MemoryListener *listener)
 static void vhost_vdpa_listener_region_add(MemoryListener *listener,
                                            MemoryRegionSection *section)
 {
+    DMAMap mem_region = {};
     struct vhost_vdpa *v = container_of(listener, struct vhost_vdpa, listener);
     hwaddr iova;
     Int128 llend, llsize;
@@ -212,13 +213,13 @@ static void vhost_vdpa_listener_region_add(MemoryListener *listener,

     llsize = int128_sub(llend, int128_make64(iova));
     if (v->shadow_vqs_enabled) {
-        DMAMap mem_region = {
-            .translated_addr = (hwaddr)(uintptr_t)vaddr,
-            .size = int128_get64(llsize) - 1,
-            .perm = IOMMU_ACCESS_FLAG(true, section->readonly),
-        };
+        int r;

-        int r = vhost_iova_tree_map_alloc(v->iova_tree, &mem_region);
+        mem_region.translated_addr = (hwaddr)(uintptr_t)vaddr,
+        mem_region.size = int128_get64(llsize) - 1,
+        mem_region.perm = IOMMU_ACCESS_FLAG(true, section->readonly),
+
+        r = vhost_iova_tree_map_alloc(v->iova_tree, &mem_region);
         if (unlikely(r != IOVA_OK)) {
             error_report("Can't allocate a mapping (%d)", r);
             goto fail;
@@ -232,11 +233,16 @@ static void vhost_vdpa_listener_region_add(MemoryListener *listener,
                              vaddr, section->readonly);
     if (ret) {
         error_report("vhost vdpa map fail!");
-        goto fail;
+        goto fail_map;
     }

     return;

+fail_map:
+    if (v->shadow_vqs_enabled) {
+        vhost_iova_tree_remove(v->iova_tree, &mem_region);
+    }
+
 fail:
     /*
      * On the initfn path, store the first error in the container so we
--
2.31.1

Re: [PATCH v2 1/2] vdpa: Skip the maps not in the iova tree

[Jason Wang]

在 2022/8/4 23:54, Eugenio Pérez 写道:
> Next patch will skip the registering of dma maps that the vdpa device
> rejects in the iova tree. We need to consider that here or we cause a
> SIGSEGV accessing result.
>
> Reported-by: Lei Yang <leiyang@redhat.com>
> Signed-off-by: Eugenio Pérez <eperezma@redhat.com>


Acked-by: Jason Wang <jasowang@redhat.com>


> ---
>   hw/virtio/vhost-vdpa.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
> index 3ff9ce3501..983d3697b0 100644
> --- a/hw/virtio/vhost-vdpa.c
> +++ b/hw/virtio/vhost-vdpa.c
> @@ -289,6 +289,10 @@ static void vhost_vdpa_listener_region_del(MemoryListener *listener,
>           };
>   
>           result = vhost_iova_tree_find_iova(v->iova_tree, &mem_region);
> +        if (!result) {
> +            /* The memory listener map wasn't mapped */
> +            return;
> +        }
>           iova = result->iova;
>           vhost_iova_tree_remove(v->iova_tree, result);
>       }

Re: [PATCH v2 2/2] vdpa: do not save failed dma maps in SVQ iova tree

[Jason Wang]

On Thu, Aug 4, 2022 at 11:54 PM Eugenio Pérez <eperezma@redhat.com> wrote:
>
> If a map fails for whatever reason, it must not be saved in the tree.
> Otherwise, qemu will try to unmap it in cleanup, leaving to more errors.
>
> Fixes: 34e3c94eda ("vdpa: Add custom IOTLB translations to SVQ")
> Reported-by: Lei Yang <leiyang@redhat.com>
> Signed-off-by: Eugenio Pérez <eperezma@redhat.com>

Acked-by: Jason Wang <jasowang@redhat.com>

> ---
>  hw/virtio/vhost-vdpa.c | 20 +++++++++++++-------
>  1 file changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
> index 983d3697b0..7e28d2f674 100644
> --- a/hw/virtio/vhost-vdpa.c
> +++ b/hw/virtio/vhost-vdpa.c
> @@ -176,6 +176,7 @@ static void vhost_vdpa_listener_commit(MemoryListener *listener)
>  static void vhost_vdpa_listener_region_add(MemoryListener *listener,
>                                             MemoryRegionSection *section)
>  {
> +    DMAMap mem_region = {};
>      struct vhost_vdpa *v = container_of(listener, struct vhost_vdpa, listener);
>      hwaddr iova;
>      Int128 llend, llsize;
> @@ -212,13 +213,13 @@ static void vhost_vdpa_listener_region_add(MemoryListener *listener,
>
>      llsize = int128_sub(llend, int128_make64(iova));
>      if (v->shadow_vqs_enabled) {
> -        DMAMap mem_region = {
> -            .translated_addr = (hwaddr)(uintptr_t)vaddr,
> -            .size = int128_get64(llsize) - 1,
> -            .perm = IOMMU_ACCESS_FLAG(true, section->readonly),
> -        };
> +        int r;
>
> -        int r = vhost_iova_tree_map_alloc(v->iova_tree, &mem_region);
> +        mem_region.translated_addr = (hwaddr)(uintptr_t)vaddr,
> +        mem_region.size = int128_get64(llsize) - 1,
> +        mem_region.perm = IOMMU_ACCESS_FLAG(true, section->readonly),
> +
> +        r = vhost_iova_tree_map_alloc(v->iova_tree, &mem_region);
>          if (unlikely(r != IOVA_OK)) {
>              error_report("Can't allocate a mapping (%d)", r);
>              goto fail;
> @@ -232,11 +233,16 @@ static void vhost_vdpa_listener_region_add(MemoryListener *listener,
>                               vaddr, section->readonly);
>      if (ret) {
>          error_report("vhost vdpa map fail!");
> -        goto fail;
> +        goto fail_map;
>      }
>
>      return;
>
> +fail_map:
> +    if (v->shadow_vqs_enabled) {
> +        vhost_iova_tree_remove(v->iova_tree, &mem_region);
> +    }
> +
>  fail:
>      /*
>       * On the initfn path, store the first error in the container so we
> --
> 2.31.1
>