search for: used_offset

...s/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 24a129fcdd61..a9a1709a859a 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) ret = translate_desc(vq, (uintptr_t)vq->used + used_offset, len, iov, 64, VHOST_ACCESS_WO); - if (ret) + if (ret <= 0) return ret; for (i = 0; i < ret; i++) { -- 2.20.1

...s/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 24a129fcdd61..a9a1709a859a 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) ret = translate_desc(vq, (uintptr_t)vq->used + used_offset, len, iov, 64, VHOST_ACCESS_WO); - if (ret) + if (ret <= 0) return ret; for (i = 0; i < ret; i++) { -- 2.20.1

...s/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 24a129fcdd61..a2e5dc7716e2 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) ret = translate_desc(vq, (uintptr_t)vq->used + used_offset, len, iov, 64, VHOST_ACCESS_WO); - if (ret) + if (ret < 0) return ret; for (i = 0; i < ret; i++) { -- 2.17.1

...s/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 24a129fcdd61..a2e5dc7716e2 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) ret = translate_desc(vq, (uintptr_t)vq->used + used_offset, len, iov, 64, VHOST_ACCESS_WO); - if (ret) + if (ret < 0) return ret; for (i = 0; i < ret; i++) { -- 2.17.1

...make ARCH=i386 All warnings (new ones prefixed by >>): drivers//vhost/vhost.c: In function 'log_used': >> drivers//vhost/vhost.c:1771:27: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] ret = translate_desc(vq, (u64)vq->used + used_offset, len, iov, 64, ^ drivers//vhost/vhost.c:1776:27: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] ret = log_write_hva(vq, (u64)iov[i].iov_base, iov[i].iov_len); ^ drivers//vhost/vhost.c: In functi...

...st.c b/drivers/vhost/vhost.c > index b45519c..41769de 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -1884,25 +1884,31 @@ static int log_write_hva(struct vhost_virtqueue *vq, > u64 hva, u64 len) > > static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) > { > - struct iovec iov[64]; > + struct iovec *iov; > int i, ret; > > if (!vq->iotlb) > return log_write(vq->log_base, vq->log_addr + used_offset, len); > > + iov = kcalloc(64, sizeof(*iov), GFP_KERNEL); > + if (!iov) > + return -ENO...

...t; + WARN_ON(!hit); Maybe it should but userspace can trigger this easily I think. We need to stop the device not warn in kernel log. Also there's an error fd: VHOST_SET_VRING_ERR, need to wake it up. > + return 0; > +} > + > +static void log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) > +{ > + struct iovec iov[64]; > + int i, ret; > + > + if (!vq->iotlb) { > + log_write(vq->log_base, vq->log_addr + used_offset, len); > + return; > + } This change seems questionable. used ring writes use their own machinery it does not go through iot...

...t; + WARN_ON(!hit); Maybe it should but userspace can trigger this easily I think. We need to stop the device not warn in kernel log. Also there's an error fd: VHOST_SET_VRING_ERR, need to wake it up. > + return 0; > +} > + > +static void log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) > +{ > + struct iovec iov[64]; > + int i, ret; > + > + if (!vq->iotlb) { > + log_write(vq->log_base, vq->log_addr + used_offset, len); > + return; > + } This change seems questionable. used ring writes use their own machinery it does not go through iot...

...+ len) { + gpa = u->start + hva - u->userspace_addr; + r = log_write(vq->log_base, gpa, len); + if (r < 0) + return r; + hit = true; + } + } + + /* No reverse mapping, should be a bug */ + WARN_ON(!hit); + return 0; +} + +static void log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) +{ + struct iovec iov[64]; + int i, ret; + + if (!vq->iotlb) { + log_write(vq->log_base, vq->log_addr + used_offset, len); + return; + } + + ret = translate_desc(vq, (u64)vq->used + used_offset, len, iov, 64, + VHOST_ACCESS_WO); + WARN_ON(ret < 0); + + for (i = 0;...

...+ len) { + gpa = u->start + hva - u->userspace_addr; + r = log_write(vq->log_base, gpa, len); + if (r < 0) + return r; + hit = true; + } + } + + /* No reverse mapping, should be a bug */ + WARN_ON(!hit); + return 0; +} + +static void log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) +{ + struct iovec iov[64]; + int i, ret; + + if (!vq->iotlb) { + log_write(vq->log_base, vq->log_addr + used_offset, len); + return; + } + + ret = translate_desc(vq, (u64)(uintptr_t)vq->used + used_offset, + len, iov, 64, VHOST_ACCESS_WO); + WARN_ON(ret < 0); + + f...

...s/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 24a129fcdd61..a2e5dc7716e2 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) ret = translate_desc(vq, (uintptr_t)vq->used + used_offset, len, iov, 64, VHOST_ACCESS_WO); - if (ret) + if (ret < 0) return ret; for (i = 0; i < ret; i++) { -- 2.17.1

...changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index 24a129fcdd61..a9a1709a859a 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -1788,7 +1788,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) > > ret = translate_desc(vq, (uintptr_t)vq->used + used_offset, > len, iov, 64, VHOST_ACCESS_WO); > - if (ret) > + if (ret <= 0) > return ret; > > for (i = 0; i < ret; i++) { > -- > 2.20.1

...userspace can trigger this easily I think. > We need to stop the device not warn in kernel log. > > Also there's an error fd: VHOST_SET_VRING_ERR, need to wake it up. > Ok. >> + return 0; >> +} >> + >> +static void log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) >> +{ >> + struct iovec iov[64]; >> + int i, ret; >> + >> + if (!vq->iotlb) { >> + log_write(vq->log_base, vq->log_addr + used_offset, len); >> + return; >> + } > This change seems questionable. used ring writes > use their...

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was done

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was done

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4-7 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4-7 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was

...top the device not warn in kernel log. > > > > Also there's an error fd: VHOST_SET_VRING_ERR, need to wake it up. > > > > Ok. > > > > > + return 0; > > > +} > > > + > > > +static void log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) > > > +{ > > > + struct iovec iov[64]; > > > + int i, ret; > > > + > > > + if (!vq->iotlb) { > > > + log_write(vq->log_base, vq->log_addr + used_offset, len); > > > + return; > > > + } > > This change...

...top the device not warn in kernel log. > > > > Also there's an error fd: VHOST_SET_VRING_ERR, need to wake it up. > > > > Ok. > > > > > + return 0; > > > +} > > > + > > > +static void log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) > > > +{ > > > + struct iovec iov[64]; > > > + int i, ret; > > > + > > > + if (!vq->iotlb) { > > > + log_write(vq->log_base, vq->log_addr + used_offset, len); > > > + return; > > > + } > > This change...

...rs/vhost/vhost.c b/drivers/vhost/vhost.c > index b45519c..31837a5 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -1884,7 +1884,7 @@ static int log_write_hva(struct vhost_virtqueue *vq, u64 hva, u64 len) > > static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len) > { > - struct iovec iov[64]; > + struct iovec *iov = vq->log_iov; > int i, ret; > > if (!vq->iotlb) > diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h > index 9032d3c..5fe4b47 > --- a/drivers/vhost/vhost.h > +++ b/drivers/vhost/vho...