| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 12 Mar 2020 14:56:56 +0800
From: Zenghui Yu <yuzenghui@...wei.com>
To: Marc Zyngier <maz@...nel.org>,
<linux-arm-kernel@...ts.infradead.org>,
<kvmarm@...ts.cs.columbia.edu>, <kvm@...r.kernel.org>,
<linux-kernel@...r.kernel.org>
CC: Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
Jason Cooper <jason@...edaemon.net>,
Robert Richter <rrichter@...vell.com>,
"Thomas Gleixner" <tglx@...utronix.de>,
Eric Auger <eric.auger@...hat.com>,
"James Morse" <james.morse@....com>,
Julien Thierry <julien.thierry.kdev@...il.com>,
Suzuki K Poulose <suzuki.poulose@....com>
Subject: Re: [PATCH v5 03/23] irqchip/gic-v4.1: Ensure mutual exclusion
between vPE affinity change and RD access
On 2020/3/5 4:33, Marc Zyngier wrote:
> Before GICv4.1, all operations would be serialized with the affinity
> changes by virtue of using the same ITS command queue. With v4.1, things
> change, as invalidations (and a number of other operations) are issued
> using the redistributor MMIO frame.
>
> We must thus make sure that these redistributor accesses cannot race
> against aginst the affinity change, or we may end-up talking to the
^^^^^^
> wrong redistributor.
>
> To ensure this, we expand the irq_to_cpuid() helper to take a spinlock
> when the LPI is mapped to a vLPI (a new per-VPE lock) on each operation
> that requires mutual exclusion.
>
> Signed-off-by: Marc Zyngier <maz@...nel.org>
Reviewed-by: Zenghui Yu <yuzenghui@...wei.com>
Thanks
> ---
> drivers/irqchip/irq-gic-v3-its.c | 56 +++++++++++++++++++++++++-----
> include/linux/irqchip/arm-gic-v4.h | 5 +++
> 2 files changed, 53 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> index da883a691028..1af713990123 100644
> --- a/drivers/irqchip/irq-gic-v3-its.c
> +++ b/drivers/irqchip/irq-gic-v3-its.c
> @@ -239,15 +239,41 @@ static struct its_vlpi_map *get_vlpi_map(struct irq_data *d)
> return NULL;
> }
>
> -static int irq_to_cpuid(struct irq_data *d)
> +static int vpe_to_cpuid_lock(struct its_vpe *vpe, unsigned long *flags)
> +{
> + raw_spin_lock_irqsave(&vpe->vpe_lock, *flags);
> + return vpe->col_idx;
> +}
> +
> +static void vpe_to_cpuid_unlock(struct its_vpe *vpe, unsigned long flags)
> +{
> + raw_spin_unlock_irqrestore(&vpe->vpe_lock, flags);
> +}
> +
> +static int irq_to_cpuid_lock(struct irq_data *d, unsigned long *flags)
> {
> - struct its_device *its_dev = irq_data_get_irq_chip_data(d);
> struct its_vlpi_map *map = get_vlpi_map(d);
> + int cpu;
>
> - if (map)
> - return map->vpe->col_idx;
> + if (map) {
> + cpu = vpe_to_cpuid_lock(map->vpe, flags);
> + } else {
> + /* Physical LPIs are already locked via the irq_desc lock */
> + struct its_device *its_dev = irq_data_get_irq_chip_data(d);
> + cpu = its_dev->event_map.col_map[its_get_event_id(d)];
> + /* Keep GCC quiet... */
> + *flags = 0;
> + }
>
> - return its_dev->event_map.col_map[its_get_event_id(d)];
> + return cpu;
> +}
> +
> +static void irq_to_cpuid_unlock(struct irq_data *d, unsigned long flags)
> +{
> + struct its_vlpi_map *map = get_vlpi_map(d);
> +
> + if (map)
> + vpe_to_cpuid_unlock(map->vpe, flags);
> }
>
> static struct its_collection *valid_col(struct its_collection *col)
> @@ -1329,7 +1355,9 @@ static void direct_lpi_inv(struct irq_data *d)
> {
> struct its_vlpi_map *map = get_vlpi_map(d);
> void __iomem *rdbase;
> + unsigned long flags;
> u64 val;
> + int cpu;
>
> if (map) {
> struct its_device *its_dev = irq_data_get_irq_chip_data(d);
> @@ -1344,10 +1372,12 @@ static void direct_lpi_inv(struct irq_data *d)
> }
>
> /* Target the redistributor this LPI is currently routed to */
> - rdbase = per_cpu_ptr(gic_rdists->rdist, irq_to_cpuid(d))->rd_base;
> + cpu = irq_to_cpuid_lock(d, &flags);
> + rdbase = per_cpu_ptr(gic_rdists->rdist, cpu)->rd_base;
> gic_write_lpir(val, rdbase + GICR_INVLPIR);
>
> wait_for_syncr(rdbase);
> + irq_to_cpuid_unlock(d, flags);
> }
>
> static void lpi_update_config(struct irq_data *d, u8 clr, u8 set)
> @@ -3486,17 +3516,25 @@ static int its_vpe_set_affinity(struct irq_data *d,
> {
> struct its_vpe *vpe = irq_data_get_irq_chip_data(d);
> int from, cpu = cpumask_first(mask_val);
> + unsigned long flags;
>
> /*
> * Changing affinity is mega expensive, so let's be as lazy as
> * we can and only do it if we really have to. Also, if mapped
> * into the proxy device, we need to move the doorbell
> * interrupt to its new location.
> + *
> + * Another thing is that changing the affinity of a vPE affects
> + * *other interrupts* such as all the vLPIs that are routed to
> + * this vPE. This means that the irq_desc lock is not enough to
> + * protect us, and that we must ensure nobody samples vpe->col_idx
> + * during the update, hence the lock below which must also be
> + * taken on any vLPI handling path that evaluates vpe->col_idx.
> */
> - if (vpe->col_idx == cpu)
> + from = vpe_to_cpuid_lock(vpe, &flags);
> + if (from == cpu)
> goto out;
>
> - from = vpe->col_idx;
> vpe->col_idx = cpu;
>
> /*
> @@ -3512,6 +3550,7 @@ static int its_vpe_set_affinity(struct irq_data *d,
>
> out:
> irq_data_update_effective_affinity(d, cpumask_of(cpu));
> + vpe_to_cpuid_unlock(vpe, flags);
>
> return IRQ_SET_MASK_OK_DONE;
> }
> @@ -3855,6 +3894,7 @@ static int its_vpe_init(struct its_vpe *vpe)
> return -ENOMEM;
> }
>
> + raw_spin_lock_init(&vpe->vpe_lock);
> vpe->vpe_id = vpe_id;
> vpe->vpt_page = vpt_page;
> if (gic_rdists->has_rvpeid)
> diff --git a/include/linux/irqchip/arm-gic-v4.h b/include/linux/irqchip/arm-gic-v4.h
> index d9c34968467a..439963f4c66a 100644
> --- a/include/linux/irqchip/arm-gic-v4.h
> +++ b/include/linux/irqchip/arm-gic-v4.h
> @@ -53,6 +53,11 @@ struct its_vpe {
> };
> };
>
> + /*
> + * Ensures mutual exclusion between affinity setting of the
> + * vPE and vLPI operations using vpe->col_idx.
> + */
> + raw_spinlock_t vpe_lock;
> /*
> * This collection ID is used to indirect the target
> * redistributor for this VPE. The ID itself isn't involved in
>
Powered by blists - more mailing lists