Re: [PATCH v3 2/2] vhost-net: Fix the virtio features negotiation flaw

[Hyman]

在 2022/11/11 3:00, Michael S. Tsirkin 写道:
> On Sun, Oct 30, 2022 at 09:52:39PM +0800, huangy81@chinatelecom.cn wrote:
> > From: Hyman Huang(黄勇) <huangy81@chinatelecom.cn>
> >
> > Save the acked_features once it be configured by guest
> > virtio driver so it can't miss any features.
> >
> > Note that this patch also change the features saving logic
> > in chr_closed_bh, which originally backup features no matter
> > whether the features are 0 or not, but now do it only if
> > features aren't 0.
>
> I'm not sure how is this change even related to what we
> are trying to do (fix a bug). Explain here?
For this series, all we want to do is to making sure acked_features
in the NetVhostUserState is credible and uptodate in the scenario that 
virtio features negotiation and openvswitch service restart happens 
simultaneously.

To make sure that happens, we save the acked_features to 
NetVhostUserState right after guest setting virtio-net features.

Assume that we do not save acked_features to NetVhostUserState just as 
it is, the acked_features in NetVhostUserState has chance to be assigned 
only when chr_closed_bh/vhost_user_stop happen. Note that openvswitch 
service stop will cause chr_closed_bh happens and acked_features in 
vhost_dev will be stored into NetVhostUserState, if the acked_features 
in vhost_dev are out-of-date(may be updated in the next few seconds), so 
does the acked_features in NetVhostUserState after doing the assignment, 
this is the bug.

Let's refine the scenario and derive the bug:
    qemu thread                                        dpdk
        |                                               |
   vhost_net_init()                                     |
        |                                               |
 assign acked_features in vhost_dev                     |
   with 0x40000000                                      |
        |                                      openvswitch.service stop
   chr_closed_bh                                        |
        |                                               |
 assign acked_features in                               |
 NetVhostUserState with 0x40000000                      |
        |                                               |
   virtio_net_set_features()                            |
        |                                               |
 assign acked_features in vhost_dev                     |
   with 0x7060a782                                      |
        |                                      openvswitch.service start
        |                                               |
   vhost_user_start                                     |
        |                                               |
 assign acked_features in vhost_dev                     |
   with 0x40000000                                      |
        |                                               |

As the step shows, if we do not keep the acked_features in 
NetVhostUserState up-to-date, the acked_features in vhost_dev may be 
reloaded with the wrong value(eg, 0x40000000) when vhost_user_start happens.
> > As to reset acked_features to 0 if needed, Qemu always
> > keeping the backup acked_features up-to-date, and save the
> > acked_features after virtio_net_set_features in advance,
> > including reset acked_features to 0, so the behavior is
> > also covered.
> >
> > Signed-off-by: Hyman Huang(黄勇) <huangy81@chinatelecom.cn>
> > Signed-off-by: Guoyi Tu <tugy@chinatelecom.cn>
> > ---
> >   hw/net/vhost_net.c      | 9 +++++++++
> >   hw/net/virtio-net.c     | 5 +++++
> >   include/net/vhost_net.h | 2 ++
> >   net/vhost-user.c        | 6 +-----
> >   4 files changed, 17 insertions(+), 5 deletions(-)
> >
> > diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
> > index d28f8b9..2bffc27 100644
> > --- a/hw/net/vhost_net.c
> > +++ b/hw/net/vhost_net.c
> > @@ -141,6 +141,15 @@ uint64_t vhost_net_get_acked_features(VHostNetState *net)
> >       return net->dev.acked_features;
> >   }
> >   
> > +void vhost_net_save_acked_features(NetClientState *nc)
> > +{
> > +    if (nc->info->type != NET_CLIENT_DRIVER_VHOST_USER) {
> > +        return;
> > +    }
> > +
> > +    vhost_user_save_acked_features(nc, false);
> > +}
> > +
> >   static int vhost_net_get_fd(NetClientState *backend)
> >   {
> >       switch (backend->info->type) {
> > diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> > index e9f696b..5f8f788 100644
> > --- a/hw/net/virtio-net.c
> > +++ b/hw/net/virtio-net.c
> > @@ -924,6 +924,11 @@ static void virtio_net_set_features(VirtIODevice *vdev, 
> > uint64_t features)
> >               continue;
> >           }
> >           vhost_net_ack_features(get_vhost_net(nc->peer), features);
> > +        /*
> > +         * keep acked_features in NetVhostUserState up-to-date so it
> > +         * can't miss any features configured by guest virtio driver.
> > +         */
> > +        vhost_net_save_acked_features(nc->peer);
> >       }
> >   
> >       if (virtio_has_feature(features, VIRTIO_NET_F_CTRL_VLAN)) {
> > diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
> > index 387e913..3a5579b 100644
> > --- a/include/net/vhost_net.h
> > +++ b/include/net/vhost_net.h
> > @@ -46,6 +46,8 @@ int vhost_set_vring_enable(NetClientState * nc, int enable);
> >   
> >   uint64_t vhost_net_get_acked_features(VHostNetState *net);
> >   
> > +void vhost_net_save_acked_features(NetClientState *nc);
> > +
> >   int vhost_net_set_mtu(struct vhost_net *net, uint16_t mtu);
> >   
> >   #endif
> > diff --git a/net/vhost-user.c b/net/vhost-user.c
> > index 74f349c..c512cc9 100644
> > --- a/net/vhost-user.c
> > +++ b/net/vhost-user.c
> > @@ -258,11 +258,7 @@ static void chr_closed_bh(void *opaque)
> >       s = DO_UPCAST(NetVhostUserState, nc, ncs[0]);
> >   
> >       for (i = queues -1; i >= 0; i--) {
> > -        s = DO_UPCAST(NetVhostUserState, nc, ncs[i]);
> > -
> > -        if (s->vhost_net) {
> > -            s->acked_features = vhost_net_get_acked_features(s->vhost_net);
> > -        }
> > +        vhost_user_save_acked_features(ncs[i], false);
> >       }
> >   
> >       qmp_set_link(name, false, &err);
>
>
> Split this last chunk into a patch of its own?
>
> > --
> > 1.8.3.1