mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-23 02:51:47 +00:00
939779f515
This patch validate the used buffer length provided by the device before trying to use it. This is done by record the in buffer length in a new field in desc_state structure during virtqueue_add(), then we can fail the virtqueue_get_buf() when we find the device is trying to give us a used buffer length which is greater than the in buffer length. Since some drivers have already done the validation by themselves, this patch tries to makes the core validation optional. For the driver that doesn't want the validation, it can set the suppress_used_validation to be true (which could be overridden by force_used_validation module parameter). To be more efficient, a dedicate array is used for storing the validate used length, this helps to eliminate the cache stress if validation is done by the driver. Signed-off-by: Jason Wang <jasowang@redhat.com> Link: https://lore.kernel.org/r/20211027022107.14357-2-jasowang@redhat.com Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
200 lines
6.9 KiB
C
200 lines
6.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_VIRTIO_H
|
|
#define _LINUX_VIRTIO_H
|
|
/* Everything a virtio driver needs to work with any particular virtio
|
|
* implementation. */
|
|
#include <linux/types.h>
|
|
#include <linux/scatterlist.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/device.h>
|
|
#include <linux/mod_devicetable.h>
|
|
#include <linux/gfp.h>
|
|
|
|
/**
|
|
* virtqueue - a queue to register buffers for sending or receiving.
|
|
* @list: the chain of virtqueues for this device
|
|
* @callback: the function to call when buffers are consumed (can be NULL).
|
|
* @name: the name of this virtqueue (mainly for debugging)
|
|
* @vdev: the virtio device this queue was created for.
|
|
* @priv: a pointer for the virtqueue implementation to use.
|
|
* @index: the zero-based ordinal number for this queue.
|
|
* @num_free: number of elements we expect to be able to fit.
|
|
*
|
|
* A note on @num_free: with indirect buffers, each buffer needs one
|
|
* element in the queue, otherwise a buffer will need one element per
|
|
* sg element.
|
|
*/
|
|
struct virtqueue {
|
|
struct list_head list;
|
|
void (*callback)(struct virtqueue *vq);
|
|
const char *name;
|
|
struct virtio_device *vdev;
|
|
unsigned int index;
|
|
unsigned int num_free;
|
|
void *priv;
|
|
};
|
|
|
|
int virtqueue_add_outbuf(struct virtqueue *vq,
|
|
struct scatterlist sg[], unsigned int num,
|
|
void *data,
|
|
gfp_t gfp);
|
|
|
|
int virtqueue_add_inbuf(struct virtqueue *vq,
|
|
struct scatterlist sg[], unsigned int num,
|
|
void *data,
|
|
gfp_t gfp);
|
|
|
|
int virtqueue_add_inbuf_ctx(struct virtqueue *vq,
|
|
struct scatterlist sg[], unsigned int num,
|
|
void *data,
|
|
void *ctx,
|
|
gfp_t gfp);
|
|
|
|
int virtqueue_add_sgs(struct virtqueue *vq,
|
|
struct scatterlist *sgs[],
|
|
unsigned int out_sgs,
|
|
unsigned int in_sgs,
|
|
void *data,
|
|
gfp_t gfp);
|
|
|
|
bool virtqueue_kick(struct virtqueue *vq);
|
|
|
|
bool virtqueue_kick_prepare(struct virtqueue *vq);
|
|
|
|
bool virtqueue_notify(struct virtqueue *vq);
|
|
|
|
void *virtqueue_get_buf(struct virtqueue *vq, unsigned int *len);
|
|
|
|
void *virtqueue_get_buf_ctx(struct virtqueue *vq, unsigned int *len,
|
|
void **ctx);
|
|
|
|
void virtqueue_disable_cb(struct virtqueue *vq);
|
|
|
|
bool virtqueue_enable_cb(struct virtqueue *vq);
|
|
|
|
unsigned virtqueue_enable_cb_prepare(struct virtqueue *vq);
|
|
|
|
bool virtqueue_poll(struct virtqueue *vq, unsigned);
|
|
|
|
bool virtqueue_enable_cb_delayed(struct virtqueue *vq);
|
|
|
|
void *virtqueue_detach_unused_buf(struct virtqueue *vq);
|
|
|
|
unsigned int virtqueue_get_vring_size(struct virtqueue *vq);
|
|
|
|
bool virtqueue_is_broken(struct virtqueue *vq);
|
|
|
|
const struct vring *virtqueue_get_vring(struct virtqueue *vq);
|
|
dma_addr_t virtqueue_get_desc_addr(struct virtqueue *vq);
|
|
dma_addr_t virtqueue_get_avail_addr(struct virtqueue *vq);
|
|
dma_addr_t virtqueue_get_used_addr(struct virtqueue *vq);
|
|
|
|
/**
|
|
* virtio_device - representation of a device using virtio
|
|
* @index: unique position on the virtio bus
|
|
* @failed: saved value for VIRTIO_CONFIG_S_FAILED bit (for restore)
|
|
* @config_enabled: configuration change reporting enabled
|
|
* @config_change_pending: configuration change reported while disabled
|
|
* @config_lock: protects configuration change reporting
|
|
* @dev: underlying device.
|
|
* @id: the device type identification (used to match it with a driver).
|
|
* @config: the configuration ops for this device.
|
|
* @vringh_config: configuration ops for host vrings.
|
|
* @vqs: the list of virtqueues for this device.
|
|
* @features: the features supported by both driver and device.
|
|
* @priv: private pointer for the driver's use.
|
|
*/
|
|
struct virtio_device {
|
|
int index;
|
|
bool failed;
|
|
bool config_enabled;
|
|
bool config_change_pending;
|
|
spinlock_t config_lock;
|
|
spinlock_t vqs_list_lock; /* Protects VQs list access */
|
|
struct device dev;
|
|
struct virtio_device_id id;
|
|
const struct virtio_config_ops *config;
|
|
const struct vringh_config_ops *vringh_config;
|
|
struct list_head vqs;
|
|
u64 features;
|
|
void *priv;
|
|
};
|
|
|
|
static inline struct virtio_device *dev_to_virtio(struct device *_dev)
|
|
{
|
|
return container_of(_dev, struct virtio_device, dev);
|
|
}
|
|
|
|
void virtio_add_status(struct virtio_device *dev, unsigned int status);
|
|
int register_virtio_device(struct virtio_device *dev);
|
|
void unregister_virtio_device(struct virtio_device *dev);
|
|
bool is_virtio_device(struct device *dev);
|
|
|
|
void virtio_break_device(struct virtio_device *dev);
|
|
|
|
void virtio_config_changed(struct virtio_device *dev);
|
|
int virtio_finalize_features(struct virtio_device *dev);
|
|
#ifdef CONFIG_PM_SLEEP
|
|
int virtio_device_freeze(struct virtio_device *dev);
|
|
int virtio_device_restore(struct virtio_device *dev);
|
|
#endif
|
|
|
|
size_t virtio_max_dma_size(struct virtio_device *vdev);
|
|
|
|
#define virtio_device_for_each_vq(vdev, vq) \
|
|
list_for_each_entry(vq, &vdev->vqs, list)
|
|
|
|
/**
|
|
* virtio_driver - operations for a virtio I/O driver
|
|
* @driver: underlying device driver (populate name and owner).
|
|
* @id_table: the ids serviced by this driver.
|
|
* @feature_table: an array of feature numbers supported by this driver.
|
|
* @feature_table_size: number of entries in the feature table array.
|
|
* @feature_table_legacy: same as feature_table but when working in legacy mode.
|
|
* @feature_table_size_legacy: number of entries in feature table legacy array.
|
|
* @suppress_used_validation: set to not have core validate used length
|
|
* @probe: the function to call when a device is found. Returns 0 or -errno.
|
|
* @scan: optional function to call after successful probe; intended
|
|
* for virtio-scsi to invoke a scan.
|
|
* @remove: the function to call when a device is removed.
|
|
* @config_changed: optional function to call when the device configuration
|
|
* changes; may be called in interrupt context.
|
|
* @freeze: optional function to call during suspend/hibernation.
|
|
* @restore: optional function to call on resume.
|
|
*/
|
|
struct virtio_driver {
|
|
struct device_driver driver;
|
|
const struct virtio_device_id *id_table;
|
|
const unsigned int *feature_table;
|
|
unsigned int feature_table_size;
|
|
const unsigned int *feature_table_legacy;
|
|
unsigned int feature_table_size_legacy;
|
|
bool suppress_used_validation;
|
|
int (*validate)(struct virtio_device *dev);
|
|
int (*probe)(struct virtio_device *dev);
|
|
void (*scan)(struct virtio_device *dev);
|
|
void (*remove)(struct virtio_device *dev);
|
|
void (*config_changed)(struct virtio_device *dev);
|
|
#ifdef CONFIG_PM
|
|
int (*freeze)(struct virtio_device *dev);
|
|
int (*restore)(struct virtio_device *dev);
|
|
#endif
|
|
};
|
|
|
|
static inline struct virtio_driver *drv_to_virtio(struct device_driver *drv)
|
|
{
|
|
return container_of(drv, struct virtio_driver, driver);
|
|
}
|
|
|
|
int register_virtio_driver(struct virtio_driver *drv);
|
|
void unregister_virtio_driver(struct virtio_driver *drv);
|
|
|
|
/* module_virtio_driver() - Helper macro for drivers that don't do
|
|
* anything special in module init/exit. This eliminates a lot of
|
|
* boilerplate. Each module may only use this macro once, and
|
|
* calling it replaces module_init() and module_exit()
|
|
*/
|
|
#define module_virtio_driver(__virtio_driver) \
|
|
module_driver(__virtio_driver, register_virtio_driver, \
|
|
unregister_virtio_driver)
|
|
#endif /* _LINUX_VIRTIO_H */
|