提交 30ef7a8a 编写于 作者: E Eli Cohen 提交者: Michael S. Tsirkin

vdpa: Read device configuration only if FEATURES_OK

Avoid reading device configuration during feature negotiation. Read
device status and verify that VIRTIO_CONFIG_S_FEATURES_OK is set.

Protect the entire operation, including configuration read with cf_mutex
to ensure integrity of the results.
Signed-off-by: NEli Cohen <elic@nvidia.com>
Link: https://lore.kernel.org/r/20220105114646.577224-5-elic@nvidia.comSigned-off-by: NMichael S. Tsirkin <mst@redhat.com>
Acked-by: NJason Wang <jasowang@redhat.com>
上级 73bc0dbb
...@@ -393,6 +393,21 @@ void vdpa_mgmtdev_unregister(struct vdpa_mgmt_dev *mdev) ...@@ -393,6 +393,21 @@ void vdpa_mgmtdev_unregister(struct vdpa_mgmt_dev *mdev)
} }
EXPORT_SYMBOL_GPL(vdpa_mgmtdev_unregister); EXPORT_SYMBOL_GPL(vdpa_mgmtdev_unregister);
static void vdpa_get_config_unlocked(struct vdpa_device *vdev,
unsigned int offset,
void *buf, unsigned int len)
{
const struct vdpa_config_ops *ops = vdev->config;
/*
* Config accesses aren't supposed to trigger before features are set.
* If it does happen we assume a legacy guest.
*/
if (!vdev->features_valid)
vdpa_set_features(vdev, 0);
ops->get_config(vdev, offset, buf, len);
}
/** /**
* vdpa_get_config - Get one or more device configuration fields. * vdpa_get_config - Get one or more device configuration fields.
* @vdev: vdpa device to operate on * @vdev: vdpa device to operate on
...@@ -403,16 +418,8 @@ EXPORT_SYMBOL_GPL(vdpa_mgmtdev_unregister); ...@@ -403,16 +418,8 @@ EXPORT_SYMBOL_GPL(vdpa_mgmtdev_unregister);
void vdpa_get_config(struct vdpa_device *vdev, unsigned int offset, void vdpa_get_config(struct vdpa_device *vdev, unsigned int offset,
void *buf, unsigned int len) void *buf, unsigned int len)
{ {
const struct vdpa_config_ops *ops = vdev->config;
mutex_lock(&vdev->cf_mutex); mutex_lock(&vdev->cf_mutex);
/* vdpa_get_config_unlocked(vdev, offset, buf, len);
* Config accesses aren't supposed to trigger before features are set.
* If it does happen we assume a legacy guest.
*/
if (!vdev->features_valid)
vdpa_set_features(vdev, 0);
ops->get_config(vdev, offset, buf, len);
mutex_unlock(&vdev->cf_mutex); mutex_unlock(&vdev->cf_mutex);
} }
EXPORT_SYMBOL_GPL(vdpa_get_config); EXPORT_SYMBOL_GPL(vdpa_get_config);
...@@ -813,7 +820,7 @@ static int vdpa_dev_net_config_fill(struct vdpa_device *vdev, struct sk_buff *ms ...@@ -813,7 +820,7 @@ static int vdpa_dev_net_config_fill(struct vdpa_device *vdev, struct sk_buff *ms
u64 features; u64 features;
u16 val_u16; u16 val_u16;
vdpa_get_config(vdev, 0, &config, sizeof(config)); vdpa_get_config_unlocked(vdev, 0, &config, sizeof(config));
if (nla_put(msg, VDPA_ATTR_DEV_NET_CFG_MACADDR, sizeof(config.mac), if (nla_put(msg, VDPA_ATTR_DEV_NET_CFG_MACADDR, sizeof(config.mac),
config.mac)) config.mac))
...@@ -838,12 +845,23 @@ vdpa_dev_config_fill(struct vdpa_device *vdev, struct sk_buff *msg, u32 portid, ...@@ -838,12 +845,23 @@ vdpa_dev_config_fill(struct vdpa_device *vdev, struct sk_buff *msg, u32 portid,
{ {
u32 device_id; u32 device_id;
void *hdr; void *hdr;
u8 status;
int err; int err;
mutex_lock(&vdev->cf_mutex);
status = vdev->config->get_status(vdev);
if (!(status & VIRTIO_CONFIG_S_FEATURES_OK)) {
NL_SET_ERR_MSG_MOD(extack, "Features negotiation not completed");
err = -EAGAIN;
goto out;
}
hdr = genlmsg_put(msg, portid, seq, &vdpa_nl_family, flags, hdr = genlmsg_put(msg, portid, seq, &vdpa_nl_family, flags,
VDPA_CMD_DEV_CONFIG_GET); VDPA_CMD_DEV_CONFIG_GET);
if (!hdr) if (!hdr) {
return -EMSGSIZE; err = -EMSGSIZE;
goto out;
}
if (nla_put_string(msg, VDPA_ATTR_DEV_NAME, dev_name(&vdev->dev))) { if (nla_put_string(msg, VDPA_ATTR_DEV_NAME, dev_name(&vdev->dev))) {
err = -EMSGSIZE; err = -EMSGSIZE;
...@@ -867,11 +885,14 @@ vdpa_dev_config_fill(struct vdpa_device *vdev, struct sk_buff *msg, u32 portid, ...@@ -867,11 +885,14 @@ vdpa_dev_config_fill(struct vdpa_device *vdev, struct sk_buff *msg, u32 portid,
if (err) if (err)
goto msg_err; goto msg_err;
mutex_unlock(&vdev->cf_mutex);
genlmsg_end(msg, hdr); genlmsg_end(msg, hdr);
return 0; return 0;
msg_err: msg_err:
genlmsg_cancel(msg, hdr); genlmsg_cancel(msg, hdr);
out:
mutex_unlock(&vdev->cf_mutex);
return err; return err;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册