linux-kernel - Re: [RFC PATCH v1] fixup! s390/vfio-ap: Notify userspace that guest's AP config changed when mdev removed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4bf76371-43ea-4c1a-8a7f-500b0b0195b6@linux.ibm.com>
Date: Tue, 4 Mar 2025 08:36:32 -0500
From: Anthony Krowiak <akrowiak@...ux.ibm.com>
To: Rorie Reyes <rreyes@...ux.ibm.com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc: hca@...ux.ibm.com, borntraeger@...ibm.com, agordeev@...ux.ibm.com,
        gor@...ux.ibm.com, pasic@...ux.ibm.com, jjherne@...ux.ibm.com,
        alex.williamson@...hat.com
Subject: Re: [RFC PATCH v1] fixup! s390/vfio-ap: Notify userspace that guest's
 AP config changed when mdev removed




On 3/3/25 2:11 PM, Rorie Reyes wrote:
> This patch is based on the s390/features branch
>
> The guest's AP configuration is cleared when the mdev is removed, so
> userspace must be notified that the AP configuration has changed. To this
> end, this patch:
>
> * Removes call to 'signal_guest_ap_cfg_changed()' function from the
>    'vfio_ap_mdev_unset_kvm()' function because it has no affect given it is
>    called after the mdev fd is closed.
>
> * Adds call to 'signal_guest_ap_cfg_changed()' function to the
>    'vfio_ap_mdev_request()' function to notify userspace that the guest's
>    AP configuration has changed before signaling the request to remove the
>    mdev.
>
> Minor change - Fixed an indentation issue in function
> 'signal_guest_ap_cfg_changed()'
>
> Fixes: 2ba4410dd477 ("s390/vfio-ap: Signal eventfd when guest AP configuration is changed")
> Signed-off-by: Rorie Reyes <rreyes@...ux.ibm.com>
> ---
>   drivers/s390/crypto/vfio_ap_ops.c | 19 ++++++++++++++++---
>   1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
> index 571f5dcb49c5..c1afac5ac555 100644
> --- a/drivers/s390/crypto/vfio_ap_ops.c
> +++ b/drivers/s390/crypto/vfio_ap_ops.c
> @@ -652,8 +652,8 @@ static void vfio_ap_matrix_init(struct ap_config_info *info,
>   
>   static void signal_guest_ap_cfg_changed(struct ap_matrix_mdev *matrix_mdev)
>   {
> -		if (matrix_mdev->cfg_chg_trigger)
> -			eventfd_signal(matrix_mdev->cfg_chg_trigger);
> +	if (matrix_mdev->cfg_chg_trigger)
> +		eventfd_signal(matrix_mdev->cfg_chg_trigger);
>   }
>   
>   static void vfio_ap_mdev_update_guest_apcb(struct ap_matrix_mdev *matrix_mdev)
> @@ -1870,7 +1870,6 @@ static void vfio_ap_mdev_unset_kvm(struct ap_matrix_mdev *matrix_mdev)
>   		get_update_locks_for_kvm(kvm);
>   
>   		kvm_arch_crypto_clear_masks(kvm);
> -		signal_guest_ap_cfg_changed(matrix_mdev);
>   		vfio_ap_mdev_reset_queues(matrix_mdev);
>   		kvm_put_kvm(kvm);
>   		matrix_mdev->kvm = NULL;
> @@ -2057,6 +2056,14 @@ static void vfio_ap_mdev_request(struct vfio_device *vdev, unsigned int count)
>   
>   	matrix_mdev = container_of(vdev, struct ap_matrix_mdev, vdev);
>   
> +	if (matrix_mdev->kvm) {
> +		get_update_locks_for_kvm(matrix_mdev->kvm);

I know we talked about this prior to submission of this patch, but 
looking at this again I think
you should use the get_update_locks_for_mdev() function for two reasons:

1. It is safer because it will take the matrix_dev->guests_lock which 
will prevent the matrix_mdev->kvm
     field from changing before you check it

2. I will eliminate the need for the else

get_update_locks_for_mdev(matrix_mdev)
if (matrix_mdev->kvm) {
     clear the masks
     signal guest config changed
}
...
release_update_locks_for_mdev(matrix_mdev); Sorry about not seeing this 
before you posted this patch.
> +		kvm_arch_crypto_clear_masks(matrix_mdev->kvm);
> +		signal_guest_ap_cfg_changed(matrix_mdev);
> +	} else {
> +		mutex_lock(&matrix_dev->mdevs_lock);
> +	}
> +
>   	if (matrix_mdev->req_trigger) {
>   		if (!(count % 10))
>   			dev_notice_ratelimited(dev,
> @@ -2068,6 +2075,12 @@ static void vfio_ap_mdev_request(struct vfio_device *vdev, unsigned int count)
>   		dev_notice(dev,
>   			   "No device request registered, blocked until released by user\n");
>   	}
> +
> +	if (matrix_mdev->kvm)
> +		release_update_locks_for_kvm(matrix_mdev->kvm);
> +	else
> +		mutex_unlock(&matrix_dev->mdevs_lock);
> +
>   }
>   
>   static int vfio_ap_mdev_get_device_info(unsigned long arg)