Re: [Xen-devel] [PATCH v7.1 4/4] xen/x86: Allow stubdom access to irq created for msi.

From: Jan Beulich <jbeulich@suse.com>
To: "Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>
Cc: "Kevin Tian" <kevin.tian@intel.com>,
	"Stefano Stabellini" <sstabellini@kernel.org>,
	"Wei Liu" <wl@xen.org>,
	"Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
	"George Dunlap" <George.Dunlap@eu.citrix.com>,
	"Andrew Cooper" <andrew.cooper3@citrix.com>,
	"Ian Jackson" <ian.jackson@eu.citrix.com>,
	"Tim Deegan" <tim@xen.org>,
	"Simon Gaiser" <simon@invisiblethingslab.com>,
	"Julien Grall" <julien.grall@arm.com>,
	"Suravee Suthikulpanit" <suravee.suthikulpanit@amd.com>,
	xen-devel@lists.xenproject.org,
	"Roger Pau Monné" <roger.pau@citrix.com>
Subject: Re: [Xen-devel] [PATCH v7.1 4/4] xen/x86: Allow stubdom access to irq created for msi.
Date: Fri, 27 Sep 2019 14:27:48 +0200	[thread overview]
Message-ID: <46f2394b-120a-8fe8-eda1-2f4c8fcbadb8@suse.com> (raw)
In-Reply-To: <c446916b9572a6425a994e9f8c6c995b8b38c518.1569470669.git-series.marmarek@invisiblethingslab.com>

On 26.09.2019 06:05, Marek Marczykowski-Górecki  wrote:
> Stubdomains need to be given sufficient privilege over the guest which it
> provides emulation for in order for PCI passthrough to work correctly.
> When a HVM domain try to enable MSI, QEMU in stubdomain calls
> PHYSDEVOP_map_pirq, but later it needs to call XEN_DOMCTL_bind_pt_irq as
> part of xc_domain_update_msi_irq. Give the stubdomain enough permissions
> over the mapped interrupt in order to bind it successfully to it's
> target domain.
> 
> This is not needed for PCI INTx, because IRQ in that case is known
> beforehand and the stubdomain is given permissions over this IRQ by
> libxl__device_pci_add (there's a do_pci_add against the stubdomain).
> 
> create_irq() already grant IRQ access to hardware_domain, with
> assumption the device model lives there.
> Modify create_irq() to take additional parameter, whether to grant
> permissions to the domain creating the IRQ, which may be dom0 or a
> stubdomain. Do this instead of granting access always to
> hardware_domain. Save ID of the domain given permission, to revoke it in
> destroy_irq() - easier and cleaner than replaying logic of create_irq()
> parameter. Use domid instead of actual reference to the domain,
> because it might get destroyed before destroying IRQ (stubdomain is
> destroyed before its target domain). And it is not an issue,
> because IRQ permissions live within domain structure, so destroying
> a domain also implicitly revoke the permission.  Potential domid
> reuse is detected by checking if that domain does have permission
> over the IRQ being destroyed.
> 
> Then, adjust all callers to provide the parameter. In case of Xen
> internal allocations, set it to false, but for domain accessible
> interrupt set it to true.
> 
> Inspired by https://github.com/OpenXT/xenclient-oe/blob/5e0e7304a5a3c75ef01240a1e3673665b2aaf05e/recipes-extended/xen/files/stubdomain-msi-irq-access.patch by Eric Chanudet <chanudete@ainfosec.com>.
> 
> Signed-off-by: Simon Gaiser <simon@invisiblethingslab.com>
> Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>

Acked-by: Jan Beulich <jbeulich@suse.com>
with a couple of cosmetic things addressed, which I'll do while
committing.

Jan

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel