Patch "vdpa/mlx5: preserve CVQ vringh index" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    vdpa/mlx5: preserve CVQ vringh index

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vdpa-mlx5-preserve-cvq-vringh-index.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 32f92230e3a34972ec5069c84b0b68ffb8b0ad10
Author: Steve Sistare <steven.sistare@xxxxxxxxxx>
Date:   Fri Nov 3 05:26:27 2023 -0700

    vdpa/mlx5: preserve CVQ vringh index
    
    [ Upstream commit 480b3e73720f6b5d76bef2387b1f9d19ed67573b ]
    
    mlx5_vdpa does not preserve userland's view of vring base for the control
    queue in the following sequence:
    
    ioctl VHOST_SET_VRING_BASE
    ioctl VHOST_VDPA_SET_STATUS VIRTIO_CONFIG_S_DRIVER_OK
      mlx5_vdpa_set_status()
        setup_cvq_vring()
          vringh_init_iotlb()
            vringh_init_kern()
              vrh->last_avail_idx = 0;
    ioctl VHOST_GET_VRING_BASE
    
    To fix, restore the value of cvq->vring.last_avail_idx after calling
    vringh_init_iotlb.
    
    Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting")
    
    Signed-off-by: Steve Sistare <steven.sistare@xxxxxxxxxx>
    Acked-by: Eugenio Pérez <eperezma@xxxxxxxxxx>
    Acked-by: Jason Wang <jasowang@xxxxxxxxxx>
    Message-Id: <1699014387-194368-1-git-send-email-steven.sistare@xxxxxxxxxx>
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index 946488b8989f4..ca972af3c89a2 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -2795,13 +2795,18 @@ static int setup_cvq_vring(struct mlx5_vdpa_dev *mvdev)
 	struct mlx5_control_vq *cvq = &mvdev->cvq;
 	int err = 0;
 
-	if (mvdev->actual_features & BIT_ULL(VIRTIO_NET_F_CTRL_VQ))
+	if (mvdev->actual_features & BIT_ULL(VIRTIO_NET_F_CTRL_VQ)) {
+		u16 idx = cvq->vring.last_avail_idx;
+
 		err = vringh_init_iotlb(&cvq->vring, mvdev->actual_features,
 					MLX5_CVQ_MAX_ENT, false,
 					(struct vring_desc *)(uintptr_t)cvq->desc_addr,
 					(struct vring_avail *)(uintptr_t)cvq->driver_addr,
 					(struct vring_used *)(uintptr_t)cvq->device_addr);
 
+		if (!err)
+			cvq->vring.last_avail_idx = cvq->vring.last_used_idx = idx;
+	}
 	return err;
 }