The feature negotiation was designed in a way that makes it possible for devices to know which config fields will be accessed by drivers. This is broken since commit 404123c2db79 ("virtio: allow drivers to validate features") with fallout in at least block and net. We have a partial work-around in commit 2f9a174f918e ("virtio: write back F_VERSION_1 before validate") which at least lets devices find out which format should config space have, but this is a partial fix: guests should not access config space without acknowledging features since otherwise we'll never be able to change the config space format. To fix, split finalize_features from virtio_finalize_features and call finalize_features with all feature bits before validation, and then - if validation changed any bits - once again after. Since virtio_finalize_features no longer writes out features rename it to virtio_features_ok - since that is what it does: checks that features are ok with the device. As a side effect, this also reduces the amount of hypervisor accesses - we now only acknowledge features once unless we are clearing any features when validating (which is uncommon). IRC I think that this was more or less always the intent in the spec but unfortunately the way the spec is worded does not say this explicitly, I plan to address this at the spec level, too.
Unified · Split
| @@ -166,14 +166,13 @@ void virtio_add_status(struct virtio_device *dev, unsigned int status) · 165 unmodified lines | |||
| 166 | } | 166 | } |
| 167 | EXPORT_SYMBOL_GPL(virtio_add_status); | 167 | EXPORT_SYMBOL_GPL(virtio_add_status); |
| 168 | 168 | ||
| 169 | static int virtio_finalize_features(struct virtio_device *dev) | 169 | /* Do some validation, then set FEATURES_OK */ |
| 170 | static int virtio_features_ok(struct virtio_device *dev) | ||
| 170 | { | 171 | { |
| 171 | int ret = dev->config->finalize_features(dev); | ||
| 172 | unsigned status; | 172 | unsigned status; |
| 173 | int ret; | ||
| 173 | 174 | ||
| 174 | might_sleep(); | 175 | might_sleep(); |
| 175 | if (ret) | ||
| 176 | return ret; | ||
| 177 | 176 | ||
| 178 | ret = arch_has_restricted_virtio_memory_access(); | 177 | ret = arch_has_restricted_virtio_memory_access(); |
| 179 | if (ret) { | 178 | if (ret) { |
| @@ -244,17 +243,6 @@ static int virtio_dev_probe(struct device *_d) · 64 unmodified lines | |||
| 244 | driver_features_legacy = driver_features; | 243 | driver_features_legacy = driver_features; |
| 245 | } | 244 | } |
| 246 | 245 | ||
| 247 | /* | ||
| 248 | * Some devices detect legacy solely via F_VERSION_1. Write | ||
| 249 | * F_VERSION_1 to force LE config space accesses before FEATURES_OK for | ||
| 250 | * these when needed. | ||
| 251 | */ | ||
| 252 | if (drv->validate && !virtio_legacy_is_little_endian() | ||
| 253 | && device_features & BIT_ULL(VIRTIO_F_VERSION_1)) { | ||
| 254 | dev->features = BIT_ULL(VIRTIO_F_VERSION_1); | ||
| 255 | dev->config->finalize_features(dev); | ||
| 256 | } | ||
| 257 | |||
| 258 | if (device_features & (1ULL << VIRTIO_F_VERSION_1)) | 246 | if (device_features & (1ULL << VIRTIO_F_VERSION_1)) |
| 259 | dev->features = driver_features & device_features; | 247 | dev->features = driver_features & device_features; |
| 260 | else | 248 | else |
| @@ -265,13 +253,26 @@ static int virtio_dev_probe(struct device *_d) · 4 unmodified lines | |||
| 265 | if (device_features & (1ULL << i)) | 253 | if (device_features & (1ULL << i)) |
| 266 | __virtio_set_bit(dev, i); | 254 | __virtio_set_bit(dev, i); |
| 267 | 255 | ||
| 256 | err = dev->config->finalize_features(dev); | ||
| 257 | if (err) | ||
| 258 | goto err; | ||
| 259 | |||
| 268 | if (drv->validate) { | 260 | if (drv->validate) { |
| 261 | u64 features = dev->features; | ||
| 262 | |||
| 269 | err = drv->validate(dev); | 263 | err = drv->validate(dev); |
| 270 | if (err) | 264 | if (err) |
| 271 | goto err; | 265 | goto err; |
| 266 | |||
| 267 | /* Did validation change any features? Then write them again. */ | ||
| 268 | if (features != dev->features) { | ||
| 269 | err = dev->config->finalize_features(dev); | ||
| 270 | if (err) | ||
| 271 | goto err; | ||
| 272 | } | ||
| 272 | } | 273 | } |
| 273 | 274 | ||
| 274 | err = virtio_finalize_features(dev); | 275 | err = virtio_features_ok(dev); |
| 275 | if (err) | 276 | if (err) |
| 276 | goto err; | 277 | goto err; |
| 277 | 278 | ||
| @@ -495,7 +496,11 @@ int virtio_device_restore(struct virtio_device *dev) · 217 unmodified lines | |||
| 495 | /* We have a driver! */ | 496 | /* We have a driver! */ |
| 496 | virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER); | 497 | virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER); |
| 497 | 498 | ||
| 498 | ret = virtio_finalize_features(dev); | 499 | ret = dev->config->finalize_features(dev); |
| 500 | if (ret) | ||
| 501 | goto err; | ||
| 502 | |||
| 503 | ret = virtio_features_ok(dev); | ||
| 499 | if (ret) | 504 | if (ret) |
| 500 | goto err; | 505 | goto err; |
| 501 | 506 | ||
| @@ -64,8 +64,9 @@ struct virtio_shm_region { · 63 unmodified lines | |||
| 64 | * Returns the first 64 feature bits (all we currently need). | 64 | * Returns the first 64 feature bits (all we currently need). |
| 65 | * @finalize_features: confirm what device features we'll be using. | 65 | * @finalize_features: confirm what device features we'll be using. |
| 66 | * vdev: the virtio_device | 66 | * vdev: the virtio_device |
| 67 | * This gives the final feature bits for the device: it can change | 67 | * This sends the driver feature bits to the device: it can change |
| 68 | * the dev->feature bits if it wants. | 68 | * the dev->feature bits if it wants. |
| 69 | * Note: despite the name this can be called any number of times. | ||
| 69 | * Returns 0 on success or error status | 70 | * Returns 0 on success or error status |
| 70 | * @bus_name: return the bus name associated with the device (optional) | 71 | * @bus_name: return the bus name associated with the device (optional) |
| 71 | * vdev: the virtio_device | 72 | * vdev: the virtio_device |