linux-kernel - [PATCH 0/3] s390/vfio-ap: fix hang when mdev attached to guest is removed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230530223538.279198-1-akrowiak@linux.ibm.com>
Date:   Tue, 30 May 2023 18:35:35 -0400
From:   Tony Krowiak <akrowiak@...ux.ibm.com>
To:     linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org,
        kvm@...r.kernel.org
Cc:     jjherne@...ux.ibm.com, pasic@...ux.ibm.com, farman@...ux.ibm.com,
        mjrosato@...ux.ibm.com, alex.williamson@...hat.com,
        borntraeger@...ux.ibm.com
Subject: [PATCH 0/3] s390/vfio-ap: fix hang when mdev attached to guest is removed

When a user attempts to remove a vfio-ap mediated device attached to a
guest, the operation hangs until the mdev's fd is closed by the guest
(i.e., the hostdev is detached or the guest is shut down). This patch 
series provides kernel-side code that allows userspace to set up a 
communication channel that will allow the vfio_ap device driver to notify 
userspace when a request to release the mdev is received, so that userspace
can close the mdev fd and avoid the hang. The patch series provides the 
following:  

1. Introduces code to handle the VFIO_DEVICE_GET_IRQ_INFO and 
   VFIO_DEVICE_SET_IRQS ioctl calls to set the eventfd_ctx for signaling a
   device request to userspace. 

2. Wires up the VFIO bus driver callback to request a release of the mdev.
   When invoked, the vfio_ap device driver will use the eventfd_ctx set up
   in #1 to signal a request to userspace to release the mdev.

Note:
----
If a user subsequently attempts to restart the guest or re-attach the mdev,
the operation will fail with a message indicating the domain is already
active. This is a libvirt problem resolved with the following commit:

commit ebd004a03dbd ("security: do not remember/recall labels for VFIO 
MDEVs") 

Tony Krowiak (3):
  vfio: ap: realize the VFIO_DEVICE_GET_IRQ_INFO ioctl
  vfio: ap: realize the VFIO_DEVICE_SET_IRQS ioctl
  s390/vfio-ap: Wire in the vfio_device_ops request callback

 drivers/s390/crypto/vfio_ap_ops.c     | 134 +++++++++++++++++++++++++-
 drivers/s390/crypto/vfio_ap_private.h |   3 +
 include/uapi/linux/vfio.h             |   9 ++
 3 files changed, 145 insertions(+), 1 deletion(-)

-- 
2.31.1