diff mbox

[dpdk-dev,v3,1/4] vhost: prevent features to be changed while device is running

Message ID 20171206092048.3568-2-maxime.coquelin@redhat.com (mailing list archive)
State Superseded, archived
Headers

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Maxime Coquelin Dec. 6, 2017, 9:20 a.m. UTC 
  As section 2.2 of the Virtio spec states about features
negotiation:
"During device initialization, the driver reads this and tells
the device the subset that it accepts. The only way to
renegotiate is to reset the device."

This patch implements a check to prevent illegal features change
while the device is running.

One exception is the VHOST_F_LOG_ALL feature bit, which is enabled
when live-migration is initiated. But this feature is not negotiated
with the Virtio driver, but directly with the Vhost master.

Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
---
 lib/librte_vhost/vhost_user.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

Comments

Tiwei Bie Dec. 7, 2017, 8:08 a.m. UTC | #1 
On Wed, Dec 06, 2017 at 10:20:45AM +0100, Maxime Coquelin wrote:
> As section 2.2 of the Virtio spec states about features
> negotiation:
> "During device initialization, the driver reads this and tells
> the device the subset that it accepts. The only way to
> renegotiate is to reset the device."
> 
> This patch implements a check to prevent illegal features change
> while the device is running.
> 
> One exception is the VHOST_F_LOG_ALL feature bit, which is enabled
> when live-migration is initiated. But this feature is not negotiated
> with the Virtio driver, but directly with the Vhost master.
> 
> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> ---
>  lib/librte_vhost/vhost_user.c | 17 ++++++++++++++++-
>  1 file changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
> index f4c7ce462..2d86c0ca8 100644
> --- a/lib/librte_vhost/vhost_user.c
> +++ b/lib/librte_vhost/vhost_user.c
> @@ -183,7 +183,22 @@ vhost_user_set_features(struct virtio_net *dev, uint64_t features)
>  		return -1;
>  	}
>  
> -	if ((dev->flags & VIRTIO_DEV_RUNNING) && dev->features != features) {
> +	if (dev->features == features)
> +		return 0;
> +

We couldn't return directly when dev->features == features.
Otherwise, if the features provided by virtio driver is 0,
dev->vhost_hlen won't get a chance to be initialized.

Best regards,
Tiwei Bie
Maxime Coquelin Dec. 7, 2017, 8:39 a.m. UTC | #2 
On 12/07/2017 09:08 AM, Tiwei Bie wrote:
> On Wed, Dec 06, 2017 at 10:20:45AM +0100, Maxime Coquelin wrote:
>> As section 2.2 of the Virtio spec states about features
>> negotiation:
>> "During device initialization, the driver reads this and tells
>> the device the subset that it accepts. The only way to
>> renegotiate is to reset the device."
>>
>> This patch implements a check to prevent illegal features change
>> while the device is running.
>>
>> One exception is the VHOST_F_LOG_ALL feature bit, which is enabled
>> when live-migration is initiated. But this feature is not negotiated
>> with the Virtio driver, but directly with the Vhost master.
>>
>> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
>> ---
>>   lib/librte_vhost/vhost_user.c | 17 ++++++++++++++++-
>>   1 file changed, 16 insertions(+), 1 deletion(-)
>>
>> diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
>> index f4c7ce462..2d86c0ca8 100644
>> --- a/lib/librte_vhost/vhost_user.c
>> +++ b/lib/librte_vhost/vhost_user.c
>> @@ -183,7 +183,22 @@ vhost_user_set_features(struct virtio_net *dev, uint64_t features)
>>   		return -1;
>>   	}
>>   
>> -	if ((dev->flags & VIRTIO_DEV_RUNNING) && dev->features != features) {
>> +	if (dev->features == features)
>> +		return 0;
>> +
> 
> We couldn't return directly when dev->features == features.
> Otherwise, if the features provided by virtio driver is 0,
> dev->vhost_hlen won't get a chance to be initialized.

Good catch.

Either we do :
if ((dev->features == features) && dev->vhost_len)
     return 0;

Or we could initialize dev->vhost_len to sizeof(struct virtio_net_hdr)
at alloc time.

I prefer the former, what do you think?

Thanks,
Maxime

> Best regards,
> Tiwei Bie
>
Tiwei Bie Dec. 7, 2017, 10:29 a.m. UTC | #3 
On Thu, Dec 07, 2017 at 09:39:06AM +0100, Maxime Coquelin wrote:
> On 12/07/2017 09:08 AM, Tiwei Bie wrote:
> > On Wed, Dec 06, 2017 at 10:20:45AM +0100, Maxime Coquelin wrote:
> > > As section 2.2 of the Virtio spec states about features
> > > negotiation:
> > > "During device initialization, the driver reads this and tells
> > > the device the subset that it accepts. The only way to
> > > renegotiate is to reset the device."
> > > 
> > > This patch implements a check to prevent illegal features change
> > > while the device is running.
> > > 
> > > One exception is the VHOST_F_LOG_ALL feature bit, which is enabled
> > > when live-migration is initiated. But this feature is not negotiated
> > > with the Virtio driver, but directly with the Vhost master.
> > > 
> > > Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
> > > ---
> > >   lib/librte_vhost/vhost_user.c | 17 ++++++++++++++++-
> > >   1 file changed, 16 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
> > > index f4c7ce462..2d86c0ca8 100644
> > > --- a/lib/librte_vhost/vhost_user.c
> > > +++ b/lib/librte_vhost/vhost_user.c
> > > @@ -183,7 +183,22 @@ vhost_user_set_features(struct virtio_net *dev, uint64_t features)
> > >   		return -1;
> > >   	}
> > > -	if ((dev->flags & VIRTIO_DEV_RUNNING) && dev->features != features) {
> > > +	if (dev->features == features)
> > > +		return 0;
> > > +
> > 
> > We couldn't return directly when dev->features == features.
> > Otherwise, if the features provided by virtio driver is 0,
> > dev->vhost_hlen won't get a chance to be initialized.
> 
> Good catch.
> 
> Either we do :
> if ((dev->features == features) && dev->vhost_len)
>     return 0;
> 
> Or we could initialize dev->vhost_len to sizeof(struct virtio_net_hdr)
> at alloc time.
> 
> I prefer the former, what do you think?
> 

I prefer to give other code (e.g. LOG code) a chance
to run. So maybe we could remove the "fast return" and
check whether the features are changed when calling
dev->notify_ops->features_changed()? Or return only
when device is running and features are not changed?

Best regards,
Tiwei Bie
diff mbox

Patch

diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
index f4c7ce462..2d86c0ca8 100644
--- a/lib/librte_vhost/vhost_user.c
+++ b/lib/librte_vhost/vhost_user.c
@@ -183,7 +183,22 @@  vhost_user_set_features(struct virtio_net *dev, uint64_t features)
 		return -1;
 	}
 
-	if ((dev->flags & VIRTIO_DEV_RUNNING) && dev->features != features) {
+	if (dev->features == features)
+		return 0;
+
+	if (dev->flags & VIRTIO_DEV_RUNNING) {
+		/*
+		 * Error out if master tries to change features while device is
+		 * in running state. The exception being VHOST_F_LOG_ALL, which
+		 * is enabled when the live-migration starts.
+		 */
+		if ((dev->features ^ features) & ~(1ULL << VHOST_F_LOG_ALL)) {
+			RTE_LOG(ERR, VHOST_CONFIG,
+				"(%d) features changed while device is running.\n",
+				dev->vid);
+			return -1;
+		}
+
 		if (dev->notify_ops->features_changed)
 			dev->notify_ops->features_changed(dev->vid, features);
 	}