| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <c2f9aab1-35b2-98c2-6700-a04e59cf69c1@redhat.com>
Date: Wed, 30 Aug 2017 14:54:45 +0200
From: Auger Eric <eric.auger@...hat.com>
To: Marc Zyngier <marc.zyngier@....com>,
Christoffer Dall <cdall@...aro.org>
Cc: linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
kvmarm@...ts.cs.columbia.edu, kvm@...r.kernel.org,
Christoffer Dall <christoffer.dall@...aro.org>,
Thomas Gleixner <tglx@...utronix.de>,
Jason Cooper <jason@...edaemon.net>,
Shanker Donthineni <shankerd@...eaurora.org>,
Mark Rutland <mark.rutland@....com>,
Shameerali Kolothum Thodi
<shameerali.kolothum.thodi@...wei.com>
Subject: Re: [PATCH v3 41/59] KVM: arm/arm64: GICv4: Wire mapping/unmapping of
VLPIs in VFIO irq bypass
Hi Marc,
On 30/08/2017 12:42, Marc Zyngier wrote:
> Hi Eric,
>
> On 30/08/17 11:20, Auger Eric wrote:
>> Hi Marc,
>>
>> On 30/08/2017 11:42, Marc Zyngier wrote:
>>> On 26/08/17 20:48, Christoffer Dall wrote:
>>>> On Mon, Jul 31, 2017 at 06:26:19PM +0100, Marc Zyngier wrote:
>>>>> Let's use the irq bypass mechanism introduced for platform device
>>>>> interrupts to intercept the virtual PCIe endpoint configuration
>>>>> and establish our LPI->VLPI mapping.
>>>>>
>>>>> Signed-off-by: Marc Zyngier <marc.zyngier@....com>
>>>>> ---
>>>>> include/kvm/arm_vgic.h | 8 ++++
>>>>> virt/kvm/arm/arm.c | 27 ++++++++----
>>>>> virt/kvm/arm/vgic/vgic-v4.c | 103 ++++++++++++++++++++++++++++++++++++++++++++
>>>>> 3 files changed, 130 insertions(+), 8 deletions(-)
>>>>>
>>>>> diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
>>>>> index 359eeffe9857..050f78d4fb42 100644
>>>>> --- a/include/kvm/arm_vgic.h
>>>>> +++ b/include/kvm/arm_vgic.h
>>>>> @@ -367,4 +367,12 @@ int kvm_vgic_set_forwarding(struct kvm *kvm, unsigned int host_irq,
>>>>> void kvm_vgic_unset_forwarding(struct kvm *kvm, unsigned int host_irq,
>>>>> unsigned int vintid);
>>>>>
>>>>> +struct kvm_kernel_irq_routing_entry;
>>>>> +
>>>>> +int kvm_vgic_v4_set_forwarding(struct kvm *kvm, int irq,
>>>>> + struct kvm_kernel_irq_routing_entry *irq_entry);
>>>>> +
>>>>> +int kvm_vgic_v4_unset_forwarding(struct kvm *kvm, int irq,
>>>>> + struct kvm_kernel_irq_routing_entry *irq_entry);
>>>>> +
>>>>> #endif /* __KVM_ARM_VGIC_H */
>>>>> diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
>>>>> index ebab6c29e3be..6803ea27c47d 100644
>>>>> --- a/virt/kvm/arm/arm.c
>>>>> +++ b/virt/kvm/arm/arm.c
>>>>> @@ -1457,11 +1457,16 @@ int kvm_arch_irq_bypass_add_producer(struct irq_bypass_consumer *cons,
>>>>> struct kvm_kernel_irqfd *irqfd =
>>>>> container_of(cons, struct kvm_kernel_irqfd, consumer);
>>>>>
>>>>> - if (prod->type != IRQ_BYPASS_VFIO_PLATFORM)
>>>>> + switch (prod->type) {
>>>>> + case IRQ_BYPASS_VFIO_PLATFORM:
>>>>> + return kvm_vgic_set_forwarding(irqfd->kvm, prod->irq,
>>>>> + irqfd->gsi + VGIC_NR_PRIVATE_IRQS);
>>>>> + case IRQ_BYPASS_VFIO_PCI_MSI:
>>>>> + return kvm_vgic_v4_set_forwarding(irqfd->kvm, prod->irq,
>>>>> + &irqfd->irq_entry);
>>>>> + default:
>>>>> return 0;
>>>>> -
>>>>> - return kvm_vgic_set_forwarding(irqfd->kvm, prod->irq,
>>>>> - irqfd->gsi + VGIC_NR_PRIVATE_IRQS);
>>>>> + }
>>>>> }
>>>>> void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
>>>>> struct irq_bypass_producer *prod)
>>>>> @@ -1469,11 +1474,17 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
>>>>> struct kvm_kernel_irqfd *irqfd =
>>>>> container_of(cons, struct kvm_kernel_irqfd, consumer);
>>>>>
>>>>> - if (prod->type != IRQ_BYPASS_VFIO_PLATFORM)
>>>>> - return;
>>>>> + switch (prod->type) {
>>>>> + case IRQ_BYPASS_VFIO_PLATFORM:
>>>>> + kvm_vgic_unset_forwarding(irqfd->kvm, prod->irq,
>>>>> + irqfd->gsi + VGIC_NR_PRIVATE_IRQS);
>>>>> + break;
>>>>>
>>>>> - kvm_vgic_unset_forwarding(irqfd->kvm, prod->irq,
>>>>> - irqfd->gsi + VGIC_NR_PRIVATE_IRQS);
>>>>> + case IRQ_BYPASS_VFIO_PCI_MSI:
>>>>> + kvm_vgic_v4_unset_forwarding(irqfd->kvm, prod->irq,
>>>>> + &irqfd->irq_entry);
>>>>> + break;
>>>>> + }
>>>>> }
>>>>>
>>>>> void kvm_arch_irq_bypass_stop(struct irq_bypass_consumer *cons)
>>>>> diff --git a/virt/kvm/arm/vgic/vgic-v4.c b/virt/kvm/arm/vgic/vgic-v4.c
>>>>> index 207e1fda0dcd..338c86c5159f 100644
>>>>> --- a/virt/kvm/arm/vgic/vgic-v4.c
>>>>> +++ b/virt/kvm/arm/vgic/vgic-v4.c
>>>>> @@ -72,3 +72,106 @@ void vgic_v4_teardown(struct kvm *kvm)
>>>>> its_vm->nr_vpes = 0;
>>>>> its_vm->vpes = NULL;
>>>>> }
>>>>> +
>>>>> +static struct vgic_its *vgic_get_its(struct kvm *kvm,
>>>>> + struct kvm_kernel_irq_routing_entry *irq_entry)
>>>>> +{
>>>>> + struct kvm_msi msi = (struct kvm_msi) {
>>>>> + .address_lo = irq_entry->msi.address_lo,
>>>>> + .address_hi = irq_entry->msi.address_hi,
>>>>> + .data = irq_entry->msi.data,
>>>>> + .flags = irq_entry->msi.flags,
>>>>> + .devid = irq_entry->msi.devid,
>>>>> + };
>>>>> +
>>>>> + /*
>>>>> + * Get a reference on the LPI. If NULL, this is not a valid
>>>>> + * translation for any of our vITSs.
>>>>> + */
>>>>> + return vgic_msi_to_its(kvm, &msi);
>>>>> +}
>>>>> +
>>>>> +int kvm_vgic_v4_set_forwarding(struct kvm *kvm, int virq,
>>>>> + struct kvm_kernel_irq_routing_entry *irq_entry)
>>>>> +{
>>>>> + struct vgic_its *its;
>>>>> + struct vgic_irq *irq;
>>>>> + struct its_vlpi_map map;
>>>>> + int ret;
>>>>> +
>>>>> + if (!vgic_is_v4_capable(kvm))
>>>>> + return 0;
>>>>> +
>>>>> + /*
>>>>> + * Get the ITS, and escape early on error (not a valid
>>>>> + * doorbell for any of our vITSs).
>>>>> + */
>>>>> + its = vgic_get_its(kvm, irq_entry);
>>>>> + if (IS_ERR(its))
>>>>> + return 0;
>>>>> +
>>>>> + mutex_lock(&its->its_lock);
>>>>> +
>>>>> + /* Perform then actual DevID/EventID -> LPI translation. */
>>>>> + ret = vgic_its_resolve_lpi(kvm, its, irq_entry->msi.devid,
>>>>> + irq_entry->msi.data, &irq);
>>>>> + if (ret)
>>>>> + goto out;
>>>>> +
>>>>> + /*
>>>>> + * Emit the mapping request. If it fails, the ITS probably
>>>>> + * isn't v4 compatible, so let's silently bail out. Holding
>>>>> + * the ITS lock should ensure that nothing can modify the
>>>>> + * target vcpu.
>>>>> + */
>>>>> + map = (struct its_vlpi_map) {
>>>>> + .vm = &kvm->arch.vgic.its_vm,
>>>>> + .vintid = irq->intid,
>>>>> + .db_enabled = true,
>>>>> + .vpe_idx = irq->target_vcpu->vcpu_id,
>>>>> + };
>>>>> +
>>>>> + if (its_map_vlpi(virq, &map))
>>>>> + goto out;
>>>>
>>>> This seems to be able to return things like -ENOMEM, whould we really
>>>> not report this back to the caller in any way?
>>>
>>>
>>> That's a good question.
>>>
>>> If we return -ENOMEM, we'll probably end-up returning an error to
>>> userspace (as a result of the VFIO ioctl), which will in turn probably
>>> terminate the guest (I'm guessing, I haven't actually looked at what
>>> userspace does).
>>>
>>> If we don't return the error, then we have a chance to keep the guest
>>> running by sticking to software injection.
>> I have not read the whole stuff yet but userspace is not aware of this
>> negotiation. Everything happens under the hood in kernel, see
>> virt/lib/irqbypass.c __connect(): if add_producer() fails
>> prod->del_consumer() is called and we should return to the not optimized
>> injection.
>
> Ah, fair enough. I guess del_consumer() does nothing on PCI?
Correct. For vfio-platform, it is switching back to automasked handler
but if you haven't implemented anything specific on vfio side in this
series, it is not even implemented.
Thanks
Eric
>
> Thanks,
>
> M.
>
Powered by blists - more mailing lists