The virtio specification virtio-v1.1-cs01 states: "Transitional devices
MUST detect Legacy drivers by detecting that VIRTIO_F_VERSION_1 has not
been acknowledged by the driver." This is exactly what QEMU as of 6.1
has done relying solely on VIRTIO_F_VERSION_1 for detecting that.
However, the specification also says: "... the driver MAY read (but MUST
NOT write) the device-specific configuration fields to check that it can
support the device ..." before setting FEATURES_OK.
In that case, any transitional device relying solely on
VIRTIO_F_VERSION_1 for detecting legacy drivers will return data in
legacy format. In particular, this implies that it is in big endian
format for big endian guests. This naturally confuses the driver which
expects little endian in the modern mode.
It is probably a good idea to amend the spec to clarify that
VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
is complete. However, we already have a regression so let's try to address
it.
The regressions affect the VIRTIO_NET_F_MTU feature of virtio-net and
the VIRTIO_BLK_F_BLK_SIZE feature of virtio-blk for BE guests when
virtio 1.0 is used on both sides. The latter renders virtio-blk unusable
with DASD backing, because things simply don't work with the default.
Cc: <[email protected]> #v4.11
Signed-off-by: Halil Pasic <[email protected]>
Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in config space")
Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range")
Reported-by: [email protected]
---
drivers/virtio/virtio.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 0a5b54034d4b..236081afe9a2 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -239,6 +239,17 @@ static int virtio_dev_probe(struct device *_d)
driver_features_legacy = driver_features;
}
+ /*
+ * Some devices detect legacy solely via F_VERSION_1. Write
+ * F_VERSION_1 to force LE config space accesses before FEATURES_OK for
+ * these when needed.
+ */
+ if (drv->validate && !virtio_legacy_is_little_endian()
+ && device_features & BIT_ULL(VIRTIO_F_VERSION_1)) {
+ dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
+ dev->config->finalize_features(dev);
+ }
+
if (device_features & (1ULL << VIRTIO_F_VERSION_1))
dev->features = driver_features & device_features;
else
base-commit: 60a9483534ed0d99090a2ee1d4bb0b8179195f51
--
2.25.1
On Fri, Oct 08, 2021 at 02:34:22PM +0200, Halil Pasic wrote:
> The virtio specification virtio-v1.1-cs01 states: "Transitional devices
> MUST detect Legacy drivers by detecting that VIRTIO_F_VERSION_1 has not
> been acknowledged by the driver." This is exactly what QEMU as of 6.1
> has done relying solely on VIRTIO_F_VERSION_1 for detecting that.
>
> However, the specification also says: "... the driver MAY read (but MUST
> NOT write) the device-specific configuration fields to check that it can
> support the device ..." before setting FEATURES_OK.
>
> In that case, any transitional device relying solely on
> VIRTIO_F_VERSION_1 for detecting legacy drivers will return data in
> legacy format. In particular, this implies that it is in big endian
> format for big endian guests. This naturally confuses the driver which
> expects little endian in the modern mode.
>
> It is probably a good idea to amend the spec to clarify that
> VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
> is complete. However, we already have a regression so let's try to address
actually, regressions. and we can add
"since originally before validate callback existed
config space was only read after
FEATURES_OK. See Fixes tags for relevant commits"
> it.
>
> The regressions affect the VIRTIO_NET_F_MTU feature of virtio-net and
> the VIRTIO_BLK_F_BLK_SIZE feature of virtio-blk for BE guests when
> virtio 1.0 is used on both sides. The latter renders virtio-blk unusable
> with DASD backing, because things simply don't work with the default.
Let's add a work around description now:
For QEMU, we can work around the issue by writing out the features
register with VIRTIO_F_VERSION_1 bit set. We (ab) use the
finalize_features config op for this. It's not enough to address vhost
user and vhost block devices since these do not get the features until
FEATURES_OK, however it looks like these two actually never handled the
endian-ness for legacy mode correctly, so at least that's not a
regression.
No devices except virtio net and virtio blk seem to be affected.
Long term the right thing to do is to fix the hypervisors.
>
> Cc: <[email protected]> #v4.11
> Signed-off-by: Halil Pasic <[email protected]>
> Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in config space")
> Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range")
> Reported-by: [email protected]
> ---
> drivers/virtio/virtio.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
> index 0a5b54034d4b..236081afe9a2 100644
> --- a/drivers/virtio/virtio.c
> +++ b/drivers/virtio/virtio.c
> @@ -239,6 +239,17 @@ static int virtio_dev_probe(struct device *_d)
> driver_features_legacy = driver_features;
> }
>
> + /*
> + * Some devices detect legacy solely via F_VERSION_1. Write
> + * F_VERSION_1 to force LE config space accesses before FEATURES_OK for
> + * these when needed.
> + */
> + if (drv->validate && !virtio_legacy_is_little_endian()
> + && device_features & BIT_ULL(VIRTIO_F_VERSION_1)) {
> + dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
> + dev->config->finalize_features(dev);
> + }
> +
> if (device_features & (1ULL << VIRTIO_F_VERSION_1))
> dev->features = driver_features & device_features;
> else
>
> base-commit: 60a9483534ed0d99090a2ee1d4bb0b8179195f51
> --
> 2.25.1
On Fri, 8 Oct 2021 09:05:03 -0400
"Michael S. Tsirkin" <[email protected]> wrote:
> On Fri, Oct 08, 2021 at 02:34:22PM +0200, Halil Pasic wrote:
> > The virtio specification virtio-v1.1-cs01 states: "Transitional devices
> > MUST detect Legacy drivers by detecting that VIRTIO_F_VERSION_1 has not
> > been acknowledged by the driver." This is exactly what QEMU as of 6.1
> > has done relying solely on VIRTIO_F_VERSION_1 for detecting that.
> >
> > However, the specification also says: "... the driver MAY read (but MUST
> > NOT write) the device-specific configuration fields to check that it can
> > support the device ..." before setting FEATURES_OK.
> >
> > In that case, any transitional device relying solely on
> > VIRTIO_F_VERSION_1 for detecting legacy drivers will return data in
> > legacy format. In particular, this implies that it is in big endian
> > format for big endian guests. This naturally confuses the driver which
> > expects little endian in the modern mode.
> >
> > It is probably a good idea to amend the spec to clarify that
> > VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
> > is complete. However, we already have a regression so let's try to address
>
> actually, regressions. and we can add
> "since originally before validate callback existed
> config space was only read after
> FEATURES_OK. See Fixes tags for relevant commits"
>
> > it.
How about replacing the paragraph above with the following?
"It is probably a good idea to amend the spec to clarify that
VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
is complete. Before validate callback existed, config space was only
read after FEATURES_OK. However, we already have two regression, so
let's address this here as well."
> >
> > The regressions affect the VIRTIO_NET_F_MTU feature of virtio-net and
> > the VIRTIO_BLK_F_BLK_SIZE feature of virtio-blk for BE guests when
> > virtio 1.0 is used on both sides. The latter renders virtio-blk
> > unusable with DASD backing, because things simply don't work with
> > the default.
and add
"See Fixes tags for relevant commits."
here.
>
> Let's add a work around description now:
>
>
> For QEMU, we can work around the issue by writing out the features
> register with VIRTIO_F_VERSION_1 bit set. We (ab) use the
s/features register/feature bits/
rationale: ccw does not have a features register, and qemu does not
really act as if its behavior was controlled by the values in a features
register. I.e. when we read the register we see VIRTIO_F_VERSION_!
because the feature is offered. In QEMU we basically read host_featues
but write the guest_features. And what drives device behavior is mostly
guest_features.
s/(ab) use/(ab)use/
> finalize_features config op for this. It's not enough to address vhost
s/It's/This is/
> user and vhost block devices since these do not get the features until
s/vhost user and vhost block/some vhost-user and vhost-vdpa/ ?
Ratioale: I think vhost block is just a vhost-user device. On the other
hand vhost-user-fs works like charm because the config space is
implemented in qemu and not in the vhost-user device. I
didn't check vhost_net. I'm not even sure qemu offers a vhost_net
implementation. Anyway I wouldn't like to make any false statements here.
> FEATURES_OK, however it looks like these two actually never handled the
> endian-ness for legacy mode correctly, so at least that's not a
> regression.
>
> No devices except virtio net and virtio blk seem to be affected.
>
> Long term the right thing to do is to fix the hypervisors.
>
Sounds good. Thanks! Are you OK with my changes proposed to your changes?
Regards,
Halil
>
> >
> > Cc: <[email protected]> #v4.11
> > Signed-off-by: Halil Pasic <[email protected]>
> > Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in
> > config space") Fixes: fe36cbe0671e ("virtio_net: clear MTU when out
> > of range") Reported-by: [email protected]
> > ---
> > drivers/virtio/virtio.c | 11 +++++++++++
> > 1 file changed, 11 insertions(+)
> >
> > diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
> > index 0a5b54034d4b..236081afe9a2 100644
> > --- a/drivers/virtio/virtio.c
> > +++ b/drivers/virtio/virtio.c
> > @@ -239,6 +239,17 @@ static int virtio_dev_probe(struct device *_d)
> > driver_features_legacy = driver_features;
> > }
> >
> > + /*
> > + * Some devices detect legacy solely via F_VERSION_1. Write
> > + * F_VERSION_1 to force LE config space accesses before
> > FEATURES_OK for
> > + * these when needed.
> > + */
> > + if (drv->validate && !virtio_legacy_is_little_endian()
> > + && device_features &
> > BIT_ULL(VIRTIO_F_VERSION_1)) {
> > + dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
> > + dev->config->finalize_features(dev);
> > + }
> > +
> > if (device_features & (1ULL << VIRTIO_F_VERSION_1))
> > dev->features = driver_features & device_features;
> > else
> >
> > base-commit: 60a9483534ed0d99090a2ee1d4bb0b8179195f51
> > --
> > 2.25.1
>
On Fri, Oct 08 2021, Halil Pasic <[email protected]> wrote:
> On Fri, 8 Oct 2021 09:05:03 -0400
> "Michael S. Tsirkin" <[email protected]> wrote:
>
>> On Fri, Oct 08, 2021 at 02:34:22PM +0200, Halil Pasic wrote:
>> > The virtio specification virtio-v1.1-cs01 states: "Transitional devices
>> > MUST detect Legacy drivers by detecting that VIRTIO_F_VERSION_1 has not
>> > been acknowledged by the driver." This is exactly what QEMU as of 6.1
>> > has done relying solely on VIRTIO_F_VERSION_1 for detecting that.
>> >
>> > However, the specification also says: "... the driver MAY read (but MUST
>> > NOT write) the device-specific configuration fields to check that it can
>> > support the device ..." before setting FEATURES_OK.
>> >
>> > In that case, any transitional device relying solely on
>> > VIRTIO_F_VERSION_1 for detecting legacy drivers will return data in
>> > legacy format. In particular, this implies that it is in big endian
>> > format for big endian guests. This naturally confuses the driver which
>> > expects little endian in the modern mode.
>> >
>> > It is probably a good idea to amend the spec to clarify that
>> > VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
>> > is complete. However, we already have a regression so let's try to address
>>
>> actually, regressions. and we can add
>> "since originally before validate callback existed
>> config space was only read after
>> FEATURES_OK. See Fixes tags for relevant commits"
>>
>> > it.
>
> How about replacing the paragraph above with the following?
>
> "It is probably a good idea to amend the spec to clarify that
> VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
> is complete. Before validate callback existed, config space was only
> read after FEATURES_OK. However, we already have two regression, so
> let's address this here as well."
>> >
>> > The regressions affect the VIRTIO_NET_F_MTU feature of virtio-net and
>> > the VIRTIO_BLK_F_BLK_SIZE feature of virtio-blk for BE guests when
>> > virtio 1.0 is used on both sides. The latter renders virtio-blk
>> > unusable with DASD backing, because things simply don't work with
>> > the default.
>
> and add
> "See Fixes tags for relevant commits."
> here.
>>
>> Let's add a work around description now:
>>
>>
>> For QEMU, we can work around the issue by writing out the features
>> register with VIRTIO_F_VERSION_1 bit set. We (ab) use the
> s/features register/feature bits/
> rationale: ccw does not have a features register, and qemu does not
> really act as if its behavior was controlled by the values in a features
> register. I.e. when we read the register we see VIRTIO_F_VERSION_!
> because the feature is offered. In QEMU we basically read host_featues
> but write the guest_features. And what drives device behavior is mostly
> guest_features.
>
> s/(ab) use/(ab)use/
>
>> finalize_features config op for this. It's not enough to address vhost
>
> s/It's/This is/
>
>> user and vhost block devices since these do not get the features until
>
> s/vhost user and vhost block/some vhost-user and vhost-vdpa/ ?
>
> Ratioale: I think vhost block is just a vhost-user device. On the other
> hand vhost-user-fs works like charm because the config space is
> implemented in qemu and not in the vhost-user device. I
> didn't check vhost_net. I'm not even sure qemu offers a vhost_net
> implementation. Anyway I wouldn't like to make any false statements here.
>
>> FEATURES_OK, however it looks like these two actually never handled the
>> endian-ness for legacy mode correctly, so at least that's not a
>> regression.
>>
>> No devices except virtio net and virtio blk seem to be affected.
>>
>> Long term the right thing to do is to fix the hypervisors.
>>
>
> Sounds good. Thanks! Are you OK with my changes proposed to your changes?
>
> Regards,
> Halil
>>
>> >
>> > Cc: <[email protected]> #v4.11
>> > Signed-off-by: Halil Pasic <[email protected]>
>> > Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in
>> > config space") Fixes: fe36cbe0671e ("virtio_net: clear MTU when out
>> > of range") Reported-by: [email protected]
>> > ---
>> > drivers/virtio/virtio.c | 11 +++++++++++
>> > 1 file changed, 11 insertions(+)
>> >
>> > diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
>> > index 0a5b54034d4b..236081afe9a2 100644
>> > --- a/drivers/virtio/virtio.c
>> > +++ b/drivers/virtio/virtio.c
>> > @@ -239,6 +239,17 @@ static int virtio_dev_probe(struct device *_d)
>> > driver_features_legacy = driver_features;
>> > }
>> >
>> > + /*
>> > + * Some devices detect legacy solely via F_VERSION_1. Write
>> > + * F_VERSION_1 to force LE config space accesses before
>> > FEATURES_OK for
>> > + * these when needed.
>> > + */
>> > + if (drv->validate && !virtio_legacy_is_little_endian()
>> > + && device_features &
>> > BIT_ULL(VIRTIO_F_VERSION_1)) {
>> > + dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
>> > + dev->config->finalize_features(dev);
>> > + }
>> > +
>> > if (device_features & (1ULL << VIRTIO_F_VERSION_1))
>> > dev->features = driver_features & device_features;
>> > else
>> >
>> > base-commit: 60a9483534ed0d99090a2ee1d4bb0b8179195f51
FWIW, with the amends:
Reviewed-by: Cornelia Huck <[email protected]>
On Fri, Oct 08, 2021 at 03:51:56PM +0200, Halil Pasic wrote:
> On Fri, 8 Oct 2021 09:05:03 -0400
> "Michael S. Tsirkin" <[email protected]> wrote:
>
> > On Fri, Oct 08, 2021 at 02:34:22PM +0200, Halil Pasic wrote:
> > > The virtio specification virtio-v1.1-cs01 states: "Transitional devices
> > > MUST detect Legacy drivers by detecting that VIRTIO_F_VERSION_1 has not
> > > been acknowledged by the driver." This is exactly what QEMU as of 6.1
> > > has done relying solely on VIRTIO_F_VERSION_1 for detecting that.
> > >
> > > However, the specification also says: "... the driver MAY read (but MUST
> > > NOT write) the device-specific configuration fields to check that it can
> > > support the device ..." before setting FEATURES_OK.
> > >
> > > In that case, any transitional device relying solely on
> > > VIRTIO_F_VERSION_1 for detecting legacy drivers will return data in
> > > legacy format. In particular, this implies that it is in big endian
> > > format for big endian guests. This naturally confuses the driver which
> > > expects little endian in the modern mode.
> > >
> > > It is probably a good idea to amend the spec to clarify that
> > > VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
> > > is complete. However, we already have a regression so let's try to address
> >
> > actually, regressions. and we can add
> > "since originally before validate callback existed
> > config space was only read after
> > FEATURES_OK. See Fixes tags for relevant commits"
> >
> > > it.
>
> How about replacing the paragraph above with the following?
>
> "It is probably a good idea to amend the spec to clarify that
> VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
> is complete. Before validate callback existed, config space was only
> read after FEATURES_OK. However, we already have two regression,
two regressions
> so
> let's address this here as well."
> > >
> > > The regressions affect the VIRTIO_NET_F_MTU feature of virtio-net and
> > > the VIRTIO_BLK_F_BLK_SIZE feature of virtio-blk for BE guests when
> > > virtio 1.0 is used on both sides. The latter renders virtio-blk
> > > unusable with DASD backing, because things simply don't work with
> > > the default.
>
> and add
> "See Fixes tags for relevant commits."
> here.
> >
> > Let's add a work around description now:
> >
> >
> > For QEMU, we can work around the issue by writing out the features
> > register with VIRTIO_F_VERSION_1 bit set. We (ab) use the
> s/features register/feature bits/
> rationale: ccw does not have a features register, and qemu does not
> really act as if its behavior was controlled by the values in a features
> register. I.e. when we read the register we see VIRTIO_F_VERSION_!
> because the feature is offered. In QEMU we basically read host_featues
> but write the guest_features. And what drives device behavior is mostly
> guest_features.
>
> s/(ab) use/(ab)use/
>
> > finalize_features config op for this. It's not enough to address vhost
>
> s/It's/This is/
>
> > user and vhost block devices since these do not get the features until
>
> s/vhost user and vhost block/some vhost-user and vhost-vdpa/ ?
Let's just say "not enough to address vhost devices since some
of these etc"
> Ratioale: I think vhost block is just a vhost-user device. On the other
> hand vhost-user-fs works like charm because the config space is
> implemented in qemu and not in the vhost-user device. I
> didn't check vhost_net. I'm not even sure qemu offers a vhost_net
> implementation.
it does
> Anyway I wouldn't like to make any false statements here.
ok
> > FEATURES_OK, however it looks like these two actually never handled the
> > endian-ness for legacy mode correctly, so at least that's not a
> > regression.
> >
> > No devices except virtio net and virtio blk seem to be affected.
> >
> > Long term the right thing to do is to fix the hypervisors.
> >
>
> Sounds good. Thanks! Are you OK with my changes proposed to your changes?
>
> Regards,
> Halil
yes.
> >
> > >
> > > Cc: <[email protected]> #v4.11
> > > Signed-off-by: Halil Pasic <[email protected]>
> > > Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in
> > > config space") Fixes: fe36cbe0671e ("virtio_net: clear MTU when out
> > > of range") Reported-by: [email protected]
> > > ---
> > > drivers/virtio/virtio.c | 11 +++++++++++
> > > 1 file changed, 11 insertions(+)
> > >
> > > diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
> > > index 0a5b54034d4b..236081afe9a2 100644
> > > --- a/drivers/virtio/virtio.c
> > > +++ b/drivers/virtio/virtio.c
> > > @@ -239,6 +239,17 @@ static int virtio_dev_probe(struct device *_d)
> > > driver_features_legacy = driver_features;
> > > }
> > >
> > > + /*
> > > + * Some devices detect legacy solely via F_VERSION_1. Write
> > > + * F_VERSION_1 to force LE config space accesses before
> > > FEATURES_OK for
> > > + * these when needed.
> > > + */
> > > + if (drv->validate && !virtio_legacy_is_little_endian()
> > > + && device_features &
> > > BIT_ULL(VIRTIO_F_VERSION_1)) {
> > > + dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
> > > + dev->config->finalize_features(dev);
> > > + }
> > > +
> > > if (device_features & (1ULL << VIRTIO_F_VERSION_1))
> > > dev->features = driver_features & device_features;
> > > else
> > >
> > > base-commit: 60a9483534ed0d99090a2ee1d4bb0b8179195f51
> > > --
> > > 2.25.1
> >