virtio_pci: Limit DMA mask to 44 bits for legacy virtio devices

Legacy virtio defines the virtqueue base using a 32-bit PFN field, with
a read-only register indicating a fixed page size of 4k.

This can cause problems for DMA allocators that allocate top down from
the DMA mask, which is set to 64 bits. In this case, the addresses are
silently truncated to 44-bit, leading to IOMMU faults, failure to read
from the queue or data corruption.

This patch restricts the coherent DMA mask for legacy PCI virtio devices
to 44 bits, which matches the specification.

Cc: stable@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Benjamin Serebrin <serebrin@google.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index 8c4e61783441b9f818c18b6dedd0b113b575ab77..6d9e5173d5fa6b7f4da58b48268dd48c7e8c1e1f 100644 (file)
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -212,10 +212,18 @@ int virtio_pci_legacy_probe(struct virtio_pci_device *vp_dev)
                return -ENODEV;
        }
 
-       rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(64));
-       if (rc)
-               rc = dma_set_mask_and_coherent(&pci_dev->dev,
-                                               DMA_BIT_MASK(32));
+       rc = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(64));
+       if (rc) {
+               rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
+       } else {
+               /*
+                * The virtio ring base address is expressed as a 32-bit PFN,
+                * with a page size of 1 << VIRTIO_PCI_QUEUE_ADDR_SHIFT.
+                */
+               dma_set_coherent_mask(&pci_dev->dev,
+                               DMA_BIT_MASK(32 + VIRTIO_PCI_QUEUE_ADDR_SHIFT));
+       }
+
        if (rc)
                dev_warn(&pci_dev->dev, "Failed to enable 64-bit or 32-bit DMA.  Trying to continue, but this might not work.\n");