[RFC PATCH v2 04/16] vfio/pci: Gate BAR and ROM access

[Shameer Kolothum]

Protect the common I/O accessors used for BAR, VGA, port I/O and ioeventfd
accesses with access_srcu. Recovery can then block new accesses and wait
for admitted accesses to finish. Keep user copies outside SRCU so a
userspace fault cannot stall recovery.

Return -EIO before runtime resume if region access is already blocked.
This check avoids waking the device unnecessarily; it does not serialize
runtime resume against recovery. The I/O accessors check the gate again
under SRCU before touching hardware.

Hold one SRCU section across ROM mapping, the buffered hardware read and
unmapping. Copy the snapshot to userspace afterward, so recovery cannot
disable ROM decoding between read chunks or wait for a userspace fault.

Assisted-by: LLM
Signed-off-by: Shameer Kolothum <skolothumtho@xxxxxxxxxx>
---
 drivers/vfio/pci/vfio_pci_core.c |  4 ++++
 drivers/vfio/pci/vfio_pci_rdwr.c | 22 ++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 88a78766c178..323038cd0ca5 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -1666,6 +1666,10 @@ static ssize_t vfio_pci_rw(struct vfio_pci_core_device *vdev, char __user *buf,
 	if (index >= VFIO_PCI_NUM_REGIONS + vdev->num_regions)
 		return -EINVAL;
 
+	/* Avoid runtime resume when blocked; region handlers check access again. */
+	if (vdev->pci_recovery_supported && READ_ONCE(vdev->access_blocked))
+		return -EIO;
+
 	ret = pm_runtime_resume_and_get(&vdev->pdev->dev);
 	if (ret) {
 		pci_info_ratelimited(vdev->pdev, "runtime resume failed %d\n",
diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
index b4f2c9d967dd..40c9dd02c3df 100644
--- a/drivers/vfio/pci/vfio_pci_rdwr.c
+++ b/drivers/vfio/pci/vfio_pci_rdwr.c
@@ -44,10 +44,17 @@
 int vfio_pci_core_iowrite##size(struct vfio_pci_core_device *vdev,	\
 			bool test_mem, u##size val, void __iomem *io)	\
 {									\
+	int idx;							\
+									\
+	idx = vfio_pci_core_access_begin(vdev);				\
+	if (idx < 0)							\
+		return idx;						\
+									\
 	if (test_mem) {							\
 		down_read(&vdev->memory_lock);				\
 		if (!__vfio_pci_memory_enabled(vdev)) {			\
 			up_read(&vdev->memory_lock);			\
+			vfio_pci_core_access_end(vdev, idx);		\
 			return -EIO;					\
 		}							\
 	}								\
@@ -56,6 +63,7 @@ int vfio_pci_core_iowrite##size(struct vfio_pci_core_device *vdev,	\
 									\
 	if (test_mem)							\
 		up_read(&vdev->memory_lock);				\
+	vfio_pci_core_access_end(vdev, idx);				\
 									\
 	return 0;							\
 }									\
@@ -70,10 +78,17 @@ VFIO_IOWRITE(64)
 int vfio_pci_core_ioread##size(struct vfio_pci_core_device *vdev,	\
 			bool test_mem, u##size *val, void __iomem *io)	\
 {									\
+	int idx;							\
+									\
+	idx = vfio_pci_core_access_begin(vdev);				\
+	if (idx < 0)							\
+		return idx;						\
+									\
 	if (test_mem) {							\
 		down_read(&vdev->memory_lock);				\
 		if (!__vfio_pci_memory_enabled(vdev)) {			\
 			up_read(&vdev->memory_lock);			\
+			vfio_pci_core_access_end(vdev, idx);		\
 			return -EIO;					\
 		}							\
 	}								\
@@ -82,6 +97,7 @@ int vfio_pci_core_ioread##size(struct vfio_pci_core_device *vdev,	\
 									\
 	if (test_mem)							\
 		up_read(&vdev->memory_lock);				\
+	vfio_pci_core_access_end(vdev, idx);				\
 									\
 	return 0;							\
 }									\
@@ -209,6 +225,11 @@ static ssize_t vfio_pci_rom_read(struct vfio_pci_core_device *vdev,
 	void *data = NULL;
 	void __iomem *io;
 	ssize_t ret;
+	int idx;
+
+	idx = vfio_pci_core_access_begin(vdev);
+	if (idx < 0)
+		return idx;
 
 	/* Serialize ROM decoding with power-state and other ROM accesses. */
 	down_write(&vdev->memory_lock);
@@ -272,6 +293,7 @@ static ssize_t vfio_pci_rom_read(struct vfio_pci_core_device *vdev,
 		iounmap(io);
 out_unlock:
 	up_write(&vdev->memory_lock);
+	vfio_pci_core_access_end(vdev, idx);
 	if (ret < 0)
 		goto out_free;
 
-- 
2.43.0