[RFC PATCH v4 16/25] vfio/pci: Check whether BAR state changes are allowed before reset

["Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>]

Add checks in vfio_pci_ioctl_reset(), vfio_exp_config_write() and
vfio_af_config_write() before resetting the device. Check PCIe and AF
FLR request bits before vfio_default_config_write() updates vconfig, so
a rejected request returns -EBUSY without changing virtual state.

Use vfio_pci_begin_bar_state_change() and
vfio_pci_end_bar_state_change() around function resets. These retain the
existing memory_lock protection while allowing reset to be rejected
before BAR mappings are removed.

In vfio_pci_dev_set_hot_reset(), check every device in
dev_set->device_list while holding the existing dev_set->lock. Reject
the reset before acquiring runtime-PM references for the device set or
removing BAR mappings if any device fails the check.

vfio_pci_bar_state_change_allowed() currently returns true. Later
patches reject resets while a device supplies guest_memfd backing.

Cc: Alex Williamson <alex@shazbot.org>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: David Hildenbrand <david@kernel.org>
Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
---
 drivers/vfio/pci/vfio_pci_config.c | 38 ++++++++++++++++++++++++++----
 drivers/vfio/pci/vfio_pci_core.c   | 20 ++++++++++++++--
 2 files changed, 52 insertions(+), 6 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 5b97f64ab3ba..537e7f8bc884 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -733,6 +733,24 @@ static int __init init_pci_cap_basic_perm(struct perm_bits *perm)
 	return 0;
 }
 
+/* Config accesses are split into aligned byte, word or dword chunks. */
+static bool vfio_pcie_flr_requested(int offset, int count, __le32 val)
+{
+	if (offset == PCI_EXP_DEVCTL && count >= 2)
+		return le32_to_cpu(val) & PCI_EXP_DEVCTL_BCR_FLR;
+
+	if (offset == PCI_EXP_DEVCTL + 1)
+		return le32_to_cpu(val) & (PCI_EXP_DEVCTL_BCR_FLR >> 8);
+
+	return false;
+}
+
+static bool vfio_af_flr_requested(int offset, __le32 val)
+{
+	return offset == PCI_AF_CTRL &&
+	       (le32_to_cpu(val) & PCI_AF_CTRL_FLR);
+}
+
 /*
  * It takes all the required locks to protect the access of power related
  * variables and then invokes vfio_pci_set_power_state().
@@ -915,6 +933,10 @@ static int vfio_exp_config_write(struct vfio_pci_core_device *vdev, int pos,
 				  offset + PCI_EXP_DEVCTL);
 	int readrq = le16_to_cpu(*ctrl) & PCI_EXP_DEVCTL_READRQ;
 
+	if (vfio_pcie_flr_requested(offset, count, val) &&
+	    !vfio_pci_bar_state_change_allowed(vdev))
+		return -EBUSY;
+
 	count = vfio_default_config_write(vdev, pos, count, perm, offset, val);
 	if (count < 0)
 		return count;
@@ -936,12 +958,14 @@ static int vfio_exp_config_write(struct vfio_pci_core_device *vdev, int pos,
 						 &cap);
 
 		if (!ret && (cap & PCI_EXP_DEVCAP_FLR)) {
-			vfio_pci_zap_and_down_write_memory_lock(vdev);
+			ret = vfio_pci_begin_bar_state_change(vdev);
+			if (ret)
+				return ret;
 			vfio_pci_dma_buf_move(vdev, true);
 			pci_try_reset_function(vdev->pdev);
 			if (__vfio_pci_memory_enabled(vdev))
 				vfio_pci_dma_buf_move(vdev, false);
-			up_write(&vdev->memory_lock);
+			vfio_pci_end_bar_state_change(vdev);
 		}
 	}
 
@@ -1000,6 +1024,10 @@ static int vfio_af_config_write(struct vfio_pci_core_device *vdev, int pos,
 {
 	u8 *ctrl = vdev->vconfig + pos - offset + PCI_AF_CTRL;
 
+	if (vfio_af_flr_requested(offset, val) &&
+	    !vfio_pci_bar_state_change_allowed(vdev))
+		return -EBUSY;
+
 	count = vfio_default_config_write(vdev, pos, count, perm, offset, val);
 	if (count < 0)
 		return count;
@@ -1021,12 +1049,14 @@ static int vfio_af_config_write(struct vfio_pci_core_device *vdev, int pos,
 						&cap);
 
 		if (!ret && (cap & PCI_AF_CAP_FLR) && (cap & PCI_AF_CAP_TP)) {
-			vfio_pci_zap_and_down_write_memory_lock(vdev);
+			ret = vfio_pci_begin_bar_state_change(vdev);
+			if (ret)
+				return ret;
 			vfio_pci_dma_buf_move(vdev, true);
 			pci_try_reset_function(vdev->pdev);
 			if (__vfio_pci_memory_enabled(vdev))
 				vfio_pci_dma_buf_move(vdev, false);
-			up_write(&vdev->memory_lock);
+			vfio_pci_end_bar_state_change(vdev);
 		}
 	}
 
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 99778cf0cc3c..f31fbd980f3e 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -1307,7 +1307,9 @@ static int vfio_pci_ioctl_reset(struct vfio_pci_core_device *vdev,
 	if (!vdev->reset_works)
 		return -EINVAL;
 
-	vfio_pci_zap_and_down_write_memory_lock(vdev);
+	ret = vfio_pci_begin_bar_state_change(vdev);
+	if (ret)
+		return ret;
 
 	/*
 	 * This function can be invoked while the power state is non-D0. If
@@ -1324,7 +1326,7 @@ static int vfio_pci_ioctl_reset(struct vfio_pci_core_device *vdev,
 	ret = pci_try_reset_function(vdev->pdev);
 	if (__vfio_pci_memory_enabled(vdev))
 		vfio_pci_dma_buf_move(vdev, false);
-	up_write(&vdev->memory_lock);
+	vfio_pci_end_bar_state_change(vdev);
 
 	return ret;
 }
@@ -2503,6 +2505,20 @@ static int vfio_pci_dev_set_hot_reset(struct vfio_device_set *dev_set,
 
 	mutex_lock(&dev_set->lock);
 
+	/*
+	 * Check every device before acquiring runtime-PM references for the
+	 * device set or removing BAR mappings. Generic ioctl dispatch already
+	 * holds a PM reference for the target. Holding dev_set->lock prevents
+	 * gmem_attached from changing during these checks and the reset.
+	 */
+	lockdep_assert_held(&dev_set->lock);
+	list_for_each_entry(vdev, &dev_set->device_list, vdev.dev_set_list) {
+		if (!vfio_pci_bar_state_change_allowed(vdev)) {
+			ret = -EBUSY;
+			goto err_unlock;
+		}
+	}
+
 	pdev = vfio_pci_dev_set_resettable(dev_set);
 	if (!pdev) {
 		ret = -EINVAL;
-- 
2.43.0