提交 e6af578c 编写于 作者: M Michael S. Tsirkin 提交者: Rusty Russell

virtio-pci: make reset operation safer

virtio pci device reset actually just does an I/O
write, which in PCI is really posted, that is it
can complete on CPU before the device has received it.

Further, interrupts might have been pending on
another CPU, so device callback might get invoked after reset.

This conflicts with how drivers use reset, which is typically:
	reset
	unregister
a callback running after reset completed can race with
unregister, potentially leading to use after free bugs.

Fix by flushing out the write, and flushing pending interrupts.

This assumes that device is never reset from
its vq/config callbacks, or in parallel with being
added/removed, document this assumption.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
上级 fe1a7fe2
...@@ -169,11 +169,29 @@ static void vp_set_status(struct virtio_device *vdev, u8 status) ...@@ -169,11 +169,29 @@ static void vp_set_status(struct virtio_device *vdev, u8 status)
iowrite8(status, vp_dev->ioaddr + VIRTIO_PCI_STATUS); iowrite8(status, vp_dev->ioaddr + VIRTIO_PCI_STATUS);
} }
/* wait for pending irq handlers */
static void vp_synchronize_vectors(struct virtio_device *vdev)
{
struct virtio_pci_device *vp_dev = to_vp_device(vdev);
int i;
if (vp_dev->intx_enabled)
synchronize_irq(vp_dev->pci_dev->irq);
for (i = 0; i < vp_dev->msix_vectors; ++i)
synchronize_irq(vp_dev->msix_entries[i].vector);
}
static void vp_reset(struct virtio_device *vdev) static void vp_reset(struct virtio_device *vdev)
{ {
struct virtio_pci_device *vp_dev = to_vp_device(vdev); struct virtio_pci_device *vp_dev = to_vp_device(vdev);
/* 0 status means a reset. */ /* 0 status means a reset. */
iowrite8(0, vp_dev->ioaddr + VIRTIO_PCI_STATUS); iowrite8(0, vp_dev->ioaddr + VIRTIO_PCI_STATUS);
/* Flush out the status write, and flush in device writes,
* including MSi-X interrupts, if any. */
ioread8(vp_dev->ioaddr + VIRTIO_PCI_STATUS);
/* Flush pending VQ/configuration callbacks. */
vp_synchronize_vectors(vdev);
} }
/* the notify function used when creating a virt queue */ /* the notify function used when creating a virt queue */
......
...@@ -85,6 +85,8 @@ ...@@ -85,6 +85,8 @@
* @reset: reset the device * @reset: reset the device
* vdev: the virtio device * vdev: the virtio device
* After this, status and feature negotiation must be done again * After this, status and feature negotiation must be done again
* Device must not be reset from its vq/config callbacks, or in
* parallel with being added/removed.
* @find_vqs: find virtqueues and instantiate them. * @find_vqs: find virtqueues and instantiate them.
* vdev: the virtio_device * vdev: the virtio_device
* nvqs: the number of virtqueues to find * nvqs: the number of virtqueues to find
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册