[RFC PATCH v2 07/16] vfio/pci: Gate function reset and runtime power management

[Shameer Kolothum]

Reject function reset and low-power entry or exit while device access is
blocked. Hold access_srcu across reset and runtime power-management
updates so recovery waits for admitted operations to finish.

Perform the reset ioctl's D0 transition before taking SRCU, preserving
VFIO's pm_save handling. Keep memory_lock held across D0 preparation and
reset so a concurrent guest D3 write cannot intervene. Check the blocked
state before D0 and check SRCU admission afterward. A rejected reset does
not queue a deferred D0 request.

The reset uses pci_try_reset_function(), which returns -EAGAIN if AER
holds device_lock.

Assisted-by: LLM
Signed-off-by: Shameer Kolothum <skolothumtho@xxxxxxxxxx>
---
Note: D0 remains outside SRCU, but this series introduces a recovery
locking dependency involving memory_lock and pci_bus_sem through ASPM.
This remains unresolved. See the cover letter's "Locking and open
questions" section.
---
 drivers/vfio/pci/vfio_pci_priv.h   |  3 +++
 drivers/vfio/pci/vfio_pci_config.c |  4 ++--
 drivers/vfio/pci/vfio_pci_core.c   | 32 ++++++++++++++++++++++++++++--
 3 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h
index 623e73f379cc..f757e5407ce4 100644
--- a/drivers/vfio/pci/vfio_pci_priv.h
+++ b/drivers/vfio/pci/vfio_pci_priv.h
@@ -41,6 +41,9 @@ ssize_t vfio_pci_config_rw_single(struct vfio_pci_core_device *vdev,
 				  char __user *buf, size_t count, loff_t *ppos,
 				  bool iswrite);
 
+int vfio_lock_and_set_power_state(struct vfio_pci_core_device *vdev,
+				 pci_power_t state);
+
 ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *vdev, char __user *buf,
 			size_t count, loff_t *ppos, bool iswrite);
 
diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index e9480b573381..f3366df4af68 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -720,8 +720,8 @@ static int __init init_pci_cap_basic_perm(struct perm_bits *perm)
  * It takes all the required locks to protect the access of power related
  * variables and then invokes vfio_pci_set_power_state().
  */
-static int vfio_lock_and_set_power_state(struct vfio_pci_core_device *vdev,
-					 pci_power_t state)
+int vfio_lock_and_set_power_state(struct vfio_pci_core_device *vdev,
+				 pci_power_t state)
 {
 	if (state >= PCI_D3hot) {
 		vfio_pci_zap_and_down_write_memory_lock(vdev);
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 91c92e8f3daa..38551bdedc89 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -372,6 +372,12 @@ int vfio_pci_set_power_state(struct vfio_pci_core_device *vdev, pci_power_t stat
 static int vfio_pci_runtime_pm_entry(struct vfio_pci_core_device *vdev,
 				     struct eventfd_ctx *efdctx)
 {
+	int idx;
+
+	idx = vfio_pci_core_access_begin(vdev);
+	if (idx < 0)
+		return idx;
+
 	/*
 	 * The vdev power related flags are protected with 'memory_lock'
 	 * semaphore.
@@ -381,6 +387,7 @@ static int vfio_pci_runtime_pm_entry(struct vfio_pci_core_device *vdev,
 
 	if (vdev->pm_runtime_engaged) {
 		up_write(&vdev->memory_lock);
+		vfio_pci_core_access_end(vdev, idx);
 		return -EINVAL;
 	}
 
@@ -388,6 +395,7 @@ static int vfio_pci_runtime_pm_entry(struct vfio_pci_core_device *vdev,
 	vdev->pm_wake_eventfd_ctx = efdctx;
 	pm_runtime_put_noidle(&vdev->pdev->dev);
 	up_write(&vdev->memory_lock);
+	vfio_pci_core_access_end(vdev, idx);
 
 	return 0;
 }
@@ -470,7 +478,7 @@ static void vfio_pci_runtime_pm_exit(struct vfio_pci_core_device *vdev)
 static int vfio_pci_core_pm_exit(struct vfio_pci_core_device *vdev, u32 flags,
 				 void __user *arg, size_t argsz)
 {
-	int ret;
+	int ret, idx;
 
 	ret = vfio_check_feature(flags, argsz, VFIO_DEVICE_FEATURE_SET, 0);
 	if (ret != 1)
@@ -483,7 +491,11 @@ static int vfio_pci_core_pm_exit(struct vfio_pci_core_device *vdev, u32 flags,
 	 * already signaled the eventfd and exited low power mode itself.
 	 * pm_runtime_engaged protects the redundant call here.
 	 */
+	idx = vfio_pci_core_access_begin(vdev);
+	if (idx < 0)
+		return idx;
 	vfio_pci_runtime_pm_exit(vdev);
+	vfio_pci_core_access_end(vdev, idx);
 	return 0;
 }
 
@@ -1387,12 +1399,16 @@ static int vfio_pci_ioctl_set_irqs(struct vfio_pci_core_device *vdev,
 static int vfio_pci_ioctl_reset(struct vfio_pci_core_device *vdev,
 				void __user *arg)
 {
-	int ret;
+	int ret, idx;
 
 	if (!vdev->reset_works)
 		return -EINVAL;
 
 	vfio_pci_zap_and_down_write_memory_lock(vdev);
+	if (vdev->pci_recovery_supported && READ_ONCE(vdev->access_blocked)) {
+		up_write(&vdev->memory_lock);
+		return -EIO;
+	}
 
 	/*
 	 * This function can be invoked while the power state is non-D0. If
@@ -1402,15 +1418,27 @@ static int vfio_pci_ioctl_reset(struct vfio_pci_core_device *vdev,
 	 * have NoSoftRst-, the reset function can cause the PCI config space
 	 * reset without restoring the original state (saved locally in
 	 * 'vdev->pm_save').
+	 *
+	 * Do the D0 transition outside access_srcu because it can acquire
+	 * pci_bus_sem through ASPM. Keep memory_lock held through reset to
+	 * prevent a concurrent power-state write from putting the device in D3.
 	 */
 	vfio_pci_set_power_state(vdev, PCI_D0);
 
+	idx = vfio_pci_core_access_begin(vdev);
+	if (idx < 0) {
+		up_write(&vdev->memory_lock);
+		return idx;
+	}
+
 	vfio_pci_dma_buf_move(vdev, true);
 	ret = pci_try_reset_function(vdev->pdev);
 	if (__vfio_pci_memory_enabled(vdev))
 		vfio_pci_dma_buf_move(vdev, false);
 	up_write(&vdev->memory_lock);
 
+	vfio_pci_core_access_end(vdev, idx);
+
 	return ret;
 }
 
-- 
2.43.0