d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

VirtIO SCSI: validate seg_max on attach

Browse Source 
Until r349278, bhyve presented a seg_max to the guest that was too large.
Detect this case and clamp it to the virtqueue size.  Otherwise, we would
fail the "too many segments to enqueue" assertion in virtqueue_enqueue().

I hit this by running a guest with a MAXPHYS of 256 KB.

Reviewed by:	bryanv cem
MFC after:	1 week
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D20703
This commit is contained in:
vangyzen 2019-06-22 01:20:45 +00:00
parent 440ed42621
commit e18b1f330a
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
sys/dev/virtio/scsi/virtio_scsi.c
View File

@ -81,6 +81,7 @@ static void vtscsi_read_config(struct vtscsi_softc *,
struct virtio_scsi_config *);
static int vtscsi_maximum_segments(struct vtscsi_softc *, int);
static int vtscsi_alloc_virtqueues(struct vtscsi_softc *);
static void vtscsi_check_sizes(struct vtscsi_softc *);
static void vtscsi_write_device_config(struct vtscsi_softc *);
static int vtscsi_reinit(struct vtscsi_softc *);
@ -311,6 +312,8 @@ vtscsi_attach(device_t dev)
goto fail;
}
vtscsi_check_sizes(sc);
error = vtscsi_init_event_vq(sc);
if (error) {
device_printf(dev, "cannot populate the eventvq\n");
@ -477,6 +480,26 @@ vtscsi_alloc_virtqueues(struct vtscsi_softc *sc)
return (virtio_alloc_virtqueues(dev, 0, nvqs, vq_info));
}
static void
vtscsi_check_sizes(struct vtscsi_softc *sc)
{
int rqsize;
if ((sc->vtscsi_flags & VTSCSI_FLAG_INDIRECT) == 0) {
/*
* Ensure the assertions in virtqueue_enqueue(),
* even if the hypervisor reports a bad seg_max.
*/
rqsize = virtqueue_size(sc->vtscsi_request_vq);
if (sc->vtscsi_max_nsegs > rqsize) {
device_printf(sc->vtscsi_dev,
"clamping seg_max (%d %d)\n", sc->vtscsi_max_nsegs,
rqsize);
sc->vtscsi_max_nsegs = rqsize;
}
}
}
static void
vtscsi_write_device_config(struct vtscsi_softc *sc)
{