Forum | Documentation | Website | Blog

Skip to content
Snippets Groups Projects
  1. Jul 04, 2024
  2. May 22, 2024
  3. Mar 19, 2024
  4. Jan 10, 2024
  5. Dec 27, 2023
  6. Nov 28, 2023
  7. Nov 01, 2023
    • Dan Carpenter's avatar
      vhost-vdpa: fix use after free in vhost_vdpa_probe() · e07754e0
      Dan Carpenter authored
      The put_device() calls vhost_vdpa_release_dev() which calls
      ida_simple_remove() and frees "v".  So this call to
      ida_simple_remove() is a use after free and a double free.
      
      Fixes: ebe6a354
      
       ("vhost-vdpa: Call ida_simple_remove() when failed")
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
      Message-Id: <cf53cb61-0699-4e36-a980-94fd4268ff00@moroto.mountain>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      e07754e0
    • Si-Wei Liu's avatar
      vhost-vdpa: clean iotlb map during reset for older userspace · bc91df5c
      Si-Wei Liu authored
      
      Using .compat_reset op from the previous patch, the buggy .reset
      behaviour can be kept as-is on older userspace apps, which don't ack the
      IOTLB_PERSIST backend feature. As this compatibility quirk is limited to
      those drivers that used to be buggy in the past, it won't affect change
      the behaviour or affect ABI on the setups with API compliant driver.
      
      The separation of .compat_reset from the regular .reset allows
      vhost-vdpa able to know which driver had broken behaviour before, so it
      can apply the corresponding compatibility quirk to the individual driver
      whenever needed.  Compared to overloading the existing .reset with
      flags, .compat_reset won't cause any extra burden to the implementation
      of every compliant driver.
      
      [mst: squashed in two fixup commits]
      
      Message-Id: <1697880319-4937-6-git-send-email-si-wei.liu@oracle.com>
      Message-Id: <1698102863-21122-1-git-send-email-si-wei.liu@oracle.com>
      Reported-by: default avatarDragos Tatulea <dtatulea@nvidia.com>
      Tested-by: default avatarDragos Tatulea <dtatulea@nvidia.com>
      Message-Id: <1698275594-19204-1-git-send-email-si-wei.liu@oracle.com>
      Reported-by: default avatarLei Yang <leiyang@redhat.com>
      Signed-off-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Tested-by: default avatarLei Yang <leiyang@redhat.com>
      bc91df5c
    • Si-Wei Liu's avatar
      vhost-vdpa: introduce IOTLB_PERSIST backend feature bit · 4398776f
      Si-Wei Liu authored
      
      Userspace needs this feature flag to distinguish if vhost-vdpa iotlb in
      the kernel can be trusted to persist IOTLB mapping across vDPA reset.
      Without it, userspace has no way to tell apart if it's running on an
      older kernel, which could silently drop all iotlb mapping across vDPA
      reset, especially with broken parent driver implementation for the
      .reset driver op. The broken driver may incorrectly drop all mappings of
      its own as part of .reset, which inadvertently ends up with corrupted
      mapping state between vhost-vdpa userspace and the kernel. As a
      workaround, to make the mapping behaviour predictable across reset,
      userspace has to pro-actively remove all mappings before vDPA reset, and
      then restore all the mappings afterwards. This workaround is done
      unconditionally on top of all parent drivers today, due to the parent
      driver implementation issue and no means to differentiate.  This
      workaround had been utilized in QEMU since day one when the
      corresponding vhost-vdpa userspace backend came to the world.
      
      There are 3 cases that backend may claim this feature bit on for:
      
      - parent device that has to work with platform IOMMU
      - parent device with on-chip IOMMU that has the expected
        .reset_map support in driver
      - parent device with vendor specific IOMMU implementation with
        persistent IOTLB mapping already that has to specifically
        declare this backend feature
      
      The reason why .reset_map is being one of the pre-condition for
      persistent iotlb is because without it, vhost-vdpa can't switch back
      iotlb to the initial state later on, especially for the on-chip IOMMU
      case which starts with identity mapping at device creation. virtio-vdpa
      requires on-chip IOMMU to perform 1:1 passthrough translation from PA to
      IOVA as-is to begin with, and .reset_map is the only means to turn back
      iotlb to the identity mapping mode after vhost-vdpa is gone.
      
      The difference in behavior did not matter as QEMU unmaps all the memory
      unregistering the memory listener at vhost_vdpa_dev_start( started =
      false), but the backend acknowledging this feature flag allows QEMU to
      make sure it is safe to skip this unmap & map in the case of vhost stop
      & start cycle.
      
      In that sense, this feature flag is actually a signal for userspace to
      know that the driver bug has been solved. Not offering it indicates that
      userspace cannot trust the kernel will retain the maps.
      
      Signed-off-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Acked-by: default avatarEugenio Pérez <eperezma@redhat.com>
      Message-Id: <1697880319-4937-4-git-send-email-si-wei.liu@oracle.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Tested-by: default avatarLei Yang <leiyang@redhat.com>
      4398776f
    • Si-Wei Liu's avatar
      vhost-vdpa: reset vendor specific mapping to initial state in .release · 1d0f874b
      Si-Wei Liu authored
      
      Devices with on-chip IOMMU or vendor specific IOTLB implementation may
      need to restore iotlb mapping to the initial or default state using the
      .reset_map op, as it's desirable for some parent devices to not work
      with DMA ops and maintain a simple IOMMU model with .reset_map. In
      particular, device reset should not cause mapping to go away on such
      IOTLB model, so persistent mapping is implied across reset. Before the
      userspace process using vhost-vdpa is gone, give it a chance to reset
      iotlb back to the initial state in vhost_vdpa_cleanup().
      
      Signed-off-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Acked-by: default avatarEugenio Pérez <eperezma@redhat.com>
      Message-Id: <1697880319-4937-3-git-send-email-si-wei.liu@oracle.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Tested-by: default avatarLei Yang <leiyang@redhat.com>
      1d0f874b
    • Si-Wei Liu's avatar
      vhost-vdpa: uAPI to get dedicated descriptor group id · c8068d9b
      Si-Wei Liu authored
      
      With _F_DESC_ASID backend feature, the device can now support the
      VHOST_VDPA_GET_VRING_DESC_GROUP ioctl, and it may expose the descriptor
      table (including avail and used ring) in a different group than the
      buffers it contains. This new uAPI will fetch the group ID of the
      descriptor table.
      
      Signed-off-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Acked-by: default avatarEugenio Pérez <eperezma@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Message-Id: <20231018171456.1624030-6-dtatulea@nvidia.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Reviewed-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Tested-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Tested-by: default avatarLei Yang <leiyang@redhat.com>
      c8068d9b
    • Si-Wei Liu's avatar
      vhost-vdpa: introduce descriptor group backend feature · 7db0d602
      Si-Wei Liu authored
      
      Userspace knows if the device has dedicated descriptor group or not
      by checking this feature bit.
      
      It's only exposed if the vdpa driver backend implements the
      .get_vq_desc_group() operation callback. Userspace trying to negotiate
      this feature when it or the dependent _F_IOTLB_ASID feature hasn't
      been exposed will result in an error.
      
      Signed-off-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Acked-by: default avatarEugenio Pérez <eperezma@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Message-Id: <20231018171456.1624030-5-dtatulea@nvidia.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Reviewed-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Tested-by: default avatarSi-Wei Liu <si-wei.liu@oracle.com>
      Tested-by: default avatarLei Yang <leiyang@redhat.com>
      7db0d602
  8. Sep 03, 2023
  9. Jun 09, 2023
  10. Jun 08, 2023
  11. Apr 21, 2023
  12. Mar 23, 2023
  13. Mar 13, 2023
    • Gautam Dawar's avatar
      vhost-vdpa: free iommu domain after last use during cleanup · 5a522150
      Gautam Dawar authored
      Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling
      `iommu_unmap(v->domain, map->start, map->size);`
      from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't
      provide DMA config operations.
      
      However, the IOMMU domain referred to by `v->domain` is freed in
      vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in
      vhost_vdpa_release() which results in NULL pointer de-reference.
      Accordingly, moving the call to vhost_vdpa_free_domain() in
      vhost_vdpa_cleanup() would makes sense. This will also help
      detaching the dma device in error handling of vhost_vdpa_alloc_domain().
      
      This issue was observed on terminating QEMU with SIGQUIT.
      
      Fixes: 037d4305
      
       ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
      Signed-off-by: default avatarGautam Dawar <gautam.dawar@amd.com>
      Message-Id: <20230301163203.29883-1-gautam.dawar@amd.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
      5a522150
  14. Feb 20, 2023
  15. Feb 09, 2023
  16. Jan 25, 2023
  17. Dec 28, 2022
    • Cindy Lu's avatar
      vhost_vdpa: fix the crash in unmap a large memory · e794070a
      Cindy Lu authored
      While testing in vIOMMU, sometimes Guest will unmap very large memory,
      which will cause the crash. To fix this, add a new function
      vhost_vdpa_general_unmap(). This function will only unmap the memory
      that saved in iotlb.
      
      Call Trace:
      [  647.820144] ------------[ cut here ]------------
      [  647.820848] kernel BUG at drivers/iommu/intel/iommu.c:1174!
      [  647.821486] invalid opcode: 0000 [#1] PREEMPT SMP PTI
      [  647.822082] CPU: 10 PID: 1181 Comm: qemu-system-x86 Not tainted 6.0.0-rc1home_lulu_2452_lulu7_vhost+ #62
      [  647.823139] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qem4
      [  647.824365] RIP: 0010:domain_unmap+0x48/0x110
      [  647.825424] Code: 48 89 fb 8d 4c f6 1e 39 c1 0f 4f c8 83 e9 0c 83 f9 3f 7f 18 48 89 e8 48 d3 e8 48 85 c0 75 59
      [  647.828064] RSP: 0018:ffffae5340c0bbf0 EFLAGS: 00010202
      [  647.828973] RAX: 0000000000000001 RBX: ffff921793d10540 RCX: 000000000000001b
      [  647.830083] RDX: 00000000080000ff RSI: 0000000000000001 RDI: ffff921793d10540
      [  647.831214] RBP: 0000000007fc0100 R08: ffffae5340c0bcd0 R09: 0000000000000003
      [  647.832388] R10: 0000007fc0100000 R11: 0000000000100000 R12: 00000000080000ff
      [  647.833668] R13: ffffae5340c0bcd0 R14: ffff921793d10590 R15: 0000008000100000
      [  647.834782] FS:  00007f772ec90640(0000) GS:ffff921ce7a80000(0000) knlGS:0000000000000000
      [  647.836004] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  647.836990] CR2: 00007f02c27a3a20 CR3: 0000000101b0c006 CR4: 0000000000372ee0
      [  647.838107] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  647.839283] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  647.840666] Call Trace:
      [  647.841437]  <TASK>
      [  647.842107]  intel_iommu_unmap_pages+0x93/0x140
      [  647.843112]  __iommu_unmap+0x91/0x1b0
      [  647.844003]  iommu_unmap+0x6a/0x95
      [  647.844885]  vhost_vdpa_unmap+0x1de/0x1f0 [vhost_vdpa]
      [  647.845985]  vhost_vdpa_process_iotlb_msg+0xf0/0x90b [vhost_vdpa]
      [  647.847235]  ? _raw_spin_unlock+0x15/0x30
      [  647.848181]  ? _copy_from_iter+0x8c/0x580
      [  647.849137]  vhost_chr_write_iter+0xb3/0x430 [vhost]
      [  647.850126]  vfs_write+0x1e4/0x3a0
      [  647.850897]  ksys_write+0x53/0xd0
      [  647.851688]  do_syscall_64+0x3a/0x90
      [  647.852508]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
      [  647.853457] RIP: 0033:0x7f7734ef9f4f
      [  647.854408] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 76 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c8
      [  647.857217] RSP: 002b:00007f772ec8f040 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
      [  647.858486] RAX: ffffffffffffffda RBX: 00000000fef00000 RCX: 00007f7734ef9f4f
      [  647.859713] RDX: 0000000000000048 RSI: 00007f772ec8f090 RDI: 0000000000000010
      [  647.860942] RBP: 00007f772ec8f1a0 R08: 0000000000000000 R09: 0000000000000000
      [  647.862206] R10: 0000000000000001 R11: 0000000000000293 R12: 0000000000000010
      [  647.863446] R13: 0000000000000002 R14: 0000000000000000 R15: ffffffff01100000
      [  647.864692]  </TASK>
      [  647.865458] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs v]
      [  647.874688] ---[ end trace 0000000000000000 ]---
      
      Cc: stable@vger.kernel.org
      Fixes: 4c8cf318
      
       ("vhost: introduce vDPA-based backend")
      Signed-off-by: default avatarCindy Lu <lulu@redhat.com>
      Message-Id: <20221219073331.556140-1-lulu@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      e794070a
    • Stefano Garzarella's avatar
      vhost-vdpa: fix an iotlb memory leak · c070c191
      Stefano Garzarella authored
      Before commit 3d569879 ("vhost-vdpa: introduce asid based IOTLB")
      we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during
      release to free all the resources allocated when processing user IOTLB
      messages through vhost_vdpa_process_iotlb_update().
      That commit changed the handling of IOTLB a bit, and we accidentally
      removed some code called during the release.
      
      We partially fixed this with commit 037d4305 ("vhost-vdpa: call
      vhost_vdpa_cleanup during the release") but a potential memory leak is
      still there as showed by kmemleak if the application does not send
      VHOST_IOTLB_INVALIDATE or crashes:
      
        unreferenced object 0xffff888007fbaa30 (size 16):
          comm "blkio-bench", pid 914, jiffies 4294993521 (age 885.500s)
          hex dump (first 16 bytes):
            40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00  @sA.............
          backtrace:
            [<0000000087736d2a>] kmem_cache_alloc_trace+0x142/0x1c0
            [<0000000060740f50>] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa]
            [<0000000083e8e205>] vhost_chr_write_iter+0xc0/0x4a0 [vhost]
            [<000000008f2f414a>] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa]
            [<00000000de1cd4a0>] vfs_write+0x216/0x4b0
            [<00000000a2850200>] ksys_write+0x71/0xf0
            [<00000000de8e720b>] __x64_sys_write+0x19/0x20
            [<0000000018b12cbb>] do_syscall_64+0x3f/0x90
            [<00000000986ec465>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
      
      Let's fix this calling vhost_vdpa_iotlb_unmap() on the whole range in
      vhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup()
      since we need a valid v->vdev.mm in vhost_vdpa_pa_unmap().
      vhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap()
      on the whole range removes all the entries.
      
      The kmemleak log reported was observed with a vDPA device that has `use_va`
      set to true (e.g. VDUSE). This patch has been tested with both types of
      devices.
      
      Fixes: 037d4305 ("vhost-vdpa: call vhost_vdpa_cleanup during the release")
      Fixes: 3d569879
      
       ("vhost-vdpa: introduce asid based IOTLB")
      Signed-off-by: default avatarStefano Garzarella <sgarzare@redhat.com>
      Message-Id: <20221109154213.146789-1-sgarzare@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      c070c191
  18. Aug 11, 2022
  19. Jun 27, 2022
    • Stefano Garzarella's avatar
      vhost-vdpa: call vhost_vdpa_cleanup during the release · 037d4305
      Stefano Garzarella authored
      Before commit 3d569879 ("vhost-vdpa: introduce asid based IOTLB")
      we call vhost_vdpa_iotlb_free() during the release to clean all regions
      mapped in the iotlb.
      
      That commit removed vhost_vdpa_iotlb_free() and added vhost_vdpa_cleanup()
      to do some cleanup, including deleting all mappings, but we forgot to call
      it in vhost_vdpa_release().
      
      This causes that if an application does not remove all mappings explicitly
      (or it crashes), the mappings remain in the iotlb and subsequent
      applications may fail if they map the same addresses.
      
      Calling vhost_vdpa_cleanup() also fixes a memory leak since we are not
      freeing `v->vdev.vqs` during the release from the same commit.
      
      Since vhost_vdpa_cleanup() calls vhost_dev_cleanup() we can remove its
      call from vhost_vdpa_release().
      
      Fixes: 3d569879
      
       ("vhost-vdpa: introduce asid based IOTLB")
      Cc: gautam.dawar@xilinx.com
      Signed-off-by: default avatarStefano Garzarella <sgarzare@redhat.com>
      Message-Id: <20220622151407.51232-1-sgarzare@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
      Tested-by: default avatarEugenio Pérez <eperezma@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      037d4305
  20. Jun 09, 2022
  21. May 31, 2022