* [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-18 21:32 ` Ricardo Koller 0 siblings, 0 replies; 14+ messages in thread From: Ricardo Koller @ 2021-08-18 21:32 UTC (permalink / raw) To: kvmarm, kvm Cc: maz, james.morse, alexandru.elisei, drjones, catalin.marinas, suzuki.poulose, oupton, jingzhangos, pshier, rananta, reijiw, Ricardo Koller vgic_get_irq(intid) is used all over the vgic code in order to get a reference to a struct irq. It warns whenever intid is not a valid number (like when it's a reserved IRQ number). The issue is that this warning can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). Drop the WARN call from vgic_get_irq. Signed-off-by: Ricardo Koller <ricarkol@google.com> --- arch/arm64/kvm/vgic/vgic.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c index 111bff47e471..81cec508d413 100644 --- a/arch/arm64/kvm/vgic/vgic.c +++ b/arch/arm64/kvm/vgic/vgic.c @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, if (intid >= VGIC_MIN_LPI) return vgic_get_lpi(kvm, intid); - WARN(1, "Looking up struct vgic_irq for reserved INTID"); return NULL; } -- 2.33.0.rc2.250.ged5fa647cd-goog ^ permalink raw reply related [flat|nested] 14+ messages in thread
* [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-18 21:32 ` Ricardo Koller 0 siblings, 0 replies; 14+ messages in thread From: Ricardo Koller @ 2021-08-18 21:32 UTC (permalink / raw) To: kvmarm, kvm; +Cc: maz, rananta, pshier, catalin.marinas vgic_get_irq(intid) is used all over the vgic code in order to get a reference to a struct irq. It warns whenever intid is not a valid number (like when it's a reserved IRQ number). The issue is that this warning can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). Drop the WARN call from vgic_get_irq. Signed-off-by: Ricardo Koller <ricarkol@google.com> --- arch/arm64/kvm/vgic/vgic.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c index 111bff47e471..81cec508d413 100644 --- a/arch/arm64/kvm/vgic/vgic.c +++ b/arch/arm64/kvm/vgic/vgic.c @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, if (intid >= VGIC_MIN_LPI) return vgic_get_lpi(kvm, intid); - WARN(1, "Looking up struct vgic_irq for reserved INTID"); return NULL; } -- 2.33.0.rc2.250.ged5fa647cd-goog _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq 2021-08-18 21:32 ` Ricardo Koller @ 2021-08-18 21:34 ` Oliver Upton -1 siblings, 0 replies; 14+ messages in thread From: Oliver Upton @ 2021-08-18 21:34 UTC (permalink / raw) To: Ricardo Koller Cc: kvmarm, kvm, maz, james.morse, Alexandru.Elisei, drjones, catalin.marinas, suzuki.poulose, jingzhangos, pshier, rananta, reijiw Hi Ricardo, On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > vgic_get_irq(intid) is used all over the vgic code in order to get a > reference to a struct irq. It warns whenever intid is not a valid number > (like when it's a reserved IRQ number). The issue is that this warning > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > Drop the WARN call from vgic_get_irq. > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > --- > arch/arm64/kvm/vgic/vgic.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > index 111bff47e471..81cec508d413 100644 > --- a/arch/arm64/kvm/vgic/vgic.c > +++ b/arch/arm64/kvm/vgic/vgic.c > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > if (intid >= VGIC_MIN_LPI) > return vgic_get_lpi(kvm, intid); > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); Could we maybe downgrade the message to WARN_ONCE() (to get a stack) or pr_warn_ratelimited()? I agree it is problematic that userspace can cause this WARN to fire, but it'd be helpful for debugging too. -- Thanks, Oliver > return NULL; > } > > -- > 2.33.0.rc2.250.ged5fa647cd-goog > ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-18 21:34 ` Oliver Upton 0 siblings, 0 replies; 14+ messages in thread From: Oliver Upton @ 2021-08-18 21:34 UTC (permalink / raw) To: Ricardo Koller; +Cc: kvm, maz, rananta, pshier, catalin.marinas, kvmarm Hi Ricardo, On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > vgic_get_irq(intid) is used all over the vgic code in order to get a > reference to a struct irq. It warns whenever intid is not a valid number > (like when it's a reserved IRQ number). The issue is that this warning > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > Drop the WARN call from vgic_get_irq. > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > --- > arch/arm64/kvm/vgic/vgic.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > index 111bff47e471..81cec508d413 100644 > --- a/arch/arm64/kvm/vgic/vgic.c > +++ b/arch/arm64/kvm/vgic/vgic.c > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > if (intid >= VGIC_MIN_LPI) > return vgic_get_lpi(kvm, intid); > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); Could we maybe downgrade the message to WARN_ONCE() (to get a stack) or pr_warn_ratelimited()? I agree it is problematic that userspace can cause this WARN to fire, but it'd be helpful for debugging too. -- Thanks, Oliver > return NULL; > } > > -- > 2.33.0.rc2.250.ged5fa647cd-goog > _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq 2021-08-18 21:34 ` Oliver Upton @ 2021-08-18 21:45 ` Ricardo Koller -1 siblings, 0 replies; 14+ messages in thread From: Ricardo Koller @ 2021-08-18 21:45 UTC (permalink / raw) To: Oliver Upton Cc: kvmarm, kvm, maz, james.morse, Alexandru.Elisei, drjones, catalin.marinas, suzuki.poulose, jingzhangos, pshier, rananta, reijiw On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > Hi Ricardo, > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > reference to a struct irq. It warns whenever intid is not a valid number > > (like when it's a reserved IRQ number). The issue is that this warning > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > Drop the WARN call from vgic_get_irq. > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > --- > > arch/arm64/kvm/vgic/vgic.c | 1 - > > 1 file changed, 1 deletion(-) > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > index 111bff47e471..81cec508d413 100644 > > --- a/arch/arm64/kvm/vgic/vgic.c > > +++ b/arch/arm64/kvm/vgic/vgic.c > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > if (intid >= VGIC_MIN_LPI) > > return vgic_get_lpi(kvm, intid); > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > or pr_warn_ratelimited()? I agree it is problematic that userspace can > cause this WARN to fire, but it'd be helpful for debugging too. > Was thinking about that, until I found this in bug.h: /* * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report * significant kernel issues that need prompt attention if they should ever * appear at runtime. * * Do not use these macros when checking for invalid external inputs * (e.g. invalid system call arguments, or invalid data coming from * network/devices), Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like 1020). I think it's more appropriate for the vmm to log it. What do you think? Thanks, Ricardo > -- > Thanks, > Oliver > > > return NULL; > > } > > > > -- > > 2.33.0.rc2.250.ged5fa647cd-goog > > ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-18 21:45 ` Ricardo Koller 0 siblings, 0 replies; 14+ messages in thread From: Ricardo Koller @ 2021-08-18 21:45 UTC (permalink / raw) To: Oliver Upton; +Cc: kvm, maz, rananta, pshier, catalin.marinas, kvmarm On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > Hi Ricardo, > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > reference to a struct irq. It warns whenever intid is not a valid number > > (like when it's a reserved IRQ number). The issue is that this warning > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > Drop the WARN call from vgic_get_irq. > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > --- > > arch/arm64/kvm/vgic/vgic.c | 1 - > > 1 file changed, 1 deletion(-) > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > index 111bff47e471..81cec508d413 100644 > > --- a/arch/arm64/kvm/vgic/vgic.c > > +++ b/arch/arm64/kvm/vgic/vgic.c > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > if (intid >= VGIC_MIN_LPI) > > return vgic_get_lpi(kvm, intid); > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > or pr_warn_ratelimited()? I agree it is problematic that userspace can > cause this WARN to fire, but it'd be helpful for debugging too. > Was thinking about that, until I found this in bug.h: /* * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report * significant kernel issues that need prompt attention if they should ever * appear at runtime. * * Do not use these macros when checking for invalid external inputs * (e.g. invalid system call arguments, or invalid data coming from * network/devices), Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like 1020). I think it's more appropriate for the vmm to log it. What do you think? Thanks, Ricardo > -- > Thanks, > Oliver > > > return NULL; > > } > > > > -- > > 2.33.0.rc2.250.ged5fa647cd-goog > > _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq 2021-08-18 21:45 ` Ricardo Koller @ 2021-08-19 7:41 ` Oliver Upton -1 siblings, 0 replies; 14+ messages in thread From: Oliver Upton @ 2021-08-19 7:41 UTC (permalink / raw) To: Ricardo Koller Cc: kvmarm, kvm, maz, james.morse, Alexandru.Elisei, drjones, catalin.marinas, suzuki.poulose, jingzhangos, pshier, rananta, reijiw On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller <ricarkol@google.com> wrote: > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > Hi Ricardo, > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > reference to a struct irq. It warns whenever intid is not a valid number > > > (like when it's a reserved IRQ number). The issue is that this warning > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > > --- > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > 1 file changed, 1 deletion(-) > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > index 111bff47e471..81cec508d413 100644 > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > if (intid >= VGIC_MIN_LPI) > > > return vgic_get_lpi(kvm, intid); > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > Was thinking about that, until I found this in bug.h: > > /* > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > * significant kernel issues that need prompt attention if they should ever > * appear at runtime. > * > * Do not use these macros when checking for invalid external inputs > * (e.g. invalid system call arguments, or invalid data coming from > * network/devices), > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > 1020). I think it's more appropriate for the vmm to log it. What do you > think? vgic_get_irq() is called in a bunch of other places though, right? IOW, intid doesn't necessarily come from userspace. In fact, I believe KVM_IRQ_LINE is the only place we pass a value from userspace to vgic_get_irq() (don't quote me on that). Perhaps instead the fix could be to explicitly check that the intid from userspace is valid and exit early rather than count on vgic_get_irq() to do the right thing. -- Thanks, Oliver > > > return NULL; > > > } > > > > > > -- > > > 2.33.0.rc2.250.ged5fa647cd-goog > > > ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-19 7:41 ` Oliver Upton 0 siblings, 0 replies; 14+ messages in thread From: Oliver Upton @ 2021-08-19 7:41 UTC (permalink / raw) To: Ricardo Koller; +Cc: kvm, maz, rananta, pshier, catalin.marinas, kvmarm On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller <ricarkol@google.com> wrote: > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > Hi Ricardo, > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > reference to a struct irq. It warns whenever intid is not a valid number > > > (like when it's a reserved IRQ number). The issue is that this warning > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > > --- > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > 1 file changed, 1 deletion(-) > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > index 111bff47e471..81cec508d413 100644 > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > if (intid >= VGIC_MIN_LPI) > > > return vgic_get_lpi(kvm, intid); > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > Was thinking about that, until I found this in bug.h: > > /* > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > * significant kernel issues that need prompt attention if they should ever > * appear at runtime. > * > * Do not use these macros when checking for invalid external inputs > * (e.g. invalid system call arguments, or invalid data coming from > * network/devices), > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > 1020). I think it's more appropriate for the vmm to log it. What do you > think? vgic_get_irq() is called in a bunch of other places though, right? IOW, intid doesn't necessarily come from userspace. In fact, I believe KVM_IRQ_LINE is the only place we pass a value from userspace to vgic_get_irq() (don't quote me on that). Perhaps instead the fix could be to explicitly check that the intid from userspace is valid and exit early rather than count on vgic_get_irq() to do the right thing. -- Thanks, Oliver > > > return NULL; > > > } > > > > > > -- > > > 2.33.0.rc2.250.ged5fa647cd-goog > > > _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq 2021-08-19 7:41 ` Oliver Upton @ 2021-08-19 8:04 ` Marc Zyngier -1 siblings, 0 replies; 14+ messages in thread From: Marc Zyngier @ 2021-08-19 8:04 UTC (permalink / raw) To: Oliver Upton; +Cc: kvm, catalin.marinas, pshier, rananta, kvmarm On Thu, 19 Aug 2021 08:41:19 +0100, Oliver Upton <oupton@google.com> wrote: > > On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > > Hi Ricardo, > > > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > > reference to a struct irq. It warns whenever intid is not a valid number > > > > (like when it's a reserved IRQ number). The issue is that this warning > > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > > > --- > > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > > 1 file changed, 1 deletion(-) > > > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > > index 111bff47e471..81cec508d413 100644 > > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > > if (intid >= VGIC_MIN_LPI) > > > > return vgic_get_lpi(kvm, intid); > > > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > > > > Was thinking about that, until I found this in bug.h: > > > > /* > > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > > * significant kernel issues that need prompt attention if they should ever > > * appear at runtime. > > * > > * Do not use these macros when checking for invalid external inputs > > * (e.g. invalid system call arguments, or invalid data coming from > > * network/devices), > > > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > > 1020). I think it's more appropriate for the vmm to log it. What do you > > think? > > vgic_get_irq() is called in a bunch of other places though, right? > IOW, intid doesn't necessarily come from userspace. In fact, I believe > KVM_IRQ_LINE is the only place we pass a value from userspace to > vgic_get_irq() (don't quote me on that). > > Perhaps instead the fix could be to explicitly check that the intid > from userspace is valid and exit early rather than count on > vgic_get_irq() to do the right thing. vgic_get_irq() is designed to do the right thing. Returning NULL is the way it reports an error, and this NULL value is already checked at when directly provided either by the VMM or the guest. If we missed any of those, that would be what needs addressing. Obtaining a NULL pointer is a good way to catch those. In general, the kernel log is not how we report userspace errors (we have been there before...). It is slow, noisy, unclear and ultimately leaks information. If you really want something, then a pr_debug is a potential tool as it can be dynamically enabled with the right configuration. Thanks, M. -- Without deviation from the norm, progress is not possible. _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-19 8:04 ` Marc Zyngier 0 siblings, 0 replies; 14+ messages in thread From: Marc Zyngier @ 2021-08-19 8:04 UTC (permalink / raw) To: Oliver Upton Cc: Ricardo Koller, kvmarm, kvm, james.morse, Alexandru.Elisei, drjones, catalin.marinas, suzuki.poulose, jingzhangos, pshier, rananta, reijiw On Thu, 19 Aug 2021 08:41:19 +0100, Oliver Upton <oupton@google.com> wrote: > > On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > > Hi Ricardo, > > > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > > reference to a struct irq. It warns whenever intid is not a valid number > > > > (like when it's a reserved IRQ number). The issue is that this warning > > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > > > --- > > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > > 1 file changed, 1 deletion(-) > > > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > > index 111bff47e471..81cec508d413 100644 > > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > > if (intid >= VGIC_MIN_LPI) > > > > return vgic_get_lpi(kvm, intid); > > > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > > > > Was thinking about that, until I found this in bug.h: > > > > /* > > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > > * significant kernel issues that need prompt attention if they should ever > > * appear at runtime. > > * > > * Do not use these macros when checking for invalid external inputs > > * (e.g. invalid system call arguments, or invalid data coming from > > * network/devices), > > > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > > 1020). I think it's more appropriate for the vmm to log it. What do you > > think? > > vgic_get_irq() is called in a bunch of other places though, right? > IOW, intid doesn't necessarily come from userspace. In fact, I believe > KVM_IRQ_LINE is the only place we pass a value from userspace to > vgic_get_irq() (don't quote me on that). > > Perhaps instead the fix could be to explicitly check that the intid > from userspace is valid and exit early rather than count on > vgic_get_irq() to do the right thing. vgic_get_irq() is designed to do the right thing. Returning NULL is the way it reports an error, and this NULL value is already checked at when directly provided either by the VMM or the guest. If we missed any of those, that would be what needs addressing. Obtaining a NULL pointer is a good way to catch those. In general, the kernel log is not how we report userspace errors (we have been there before...). It is slow, noisy, unclear and ultimately leaks information. If you really want something, then a pr_debug is a potential tool as it can be dynamically enabled with the right configuration. Thanks, M. -- Without deviation from the norm, progress is not possible. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq 2021-08-19 8:04 ` Marc Zyngier @ 2021-08-19 8:16 ` Oliver Upton -1 siblings, 0 replies; 14+ messages in thread From: Oliver Upton @ 2021-08-19 8:16 UTC (permalink / raw) To: Marc Zyngier Cc: Ricardo Koller, kvmarm, kvm, james.morse, Alexandru.Elisei, drjones, catalin.marinas, suzuki.poulose, jingzhangos, pshier, rananta, reijiw On Thu, Aug 19, 2021 at 1:04 AM Marc Zyngier <maz@kernel.org> wrote: > > On Thu, 19 Aug 2021 08:41:19 +0100, > Oliver Upton <oupton@google.com> wrote: > > > > On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > > > Hi Ricardo, > > > > > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > > > reference to a struct irq. It warns whenever intid is not a valid number > > > > > (like when it's a reserved IRQ number). The issue is that this warning > > > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > > > > --- > > > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > > > 1 file changed, 1 deletion(-) > > > > > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > > > index 111bff47e471..81cec508d413 100644 > > > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > > > if (intid >= VGIC_MIN_LPI) > > > > > return vgic_get_lpi(kvm, intid); > > > > > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > > > > > > > Was thinking about that, until I found this in bug.h: > > > > > > /* > > > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > > > * significant kernel issues that need prompt attention if they should ever > > > * appear at runtime. > > > * > > > * Do not use these macros when checking for invalid external inputs > > > * (e.g. invalid system call arguments, or invalid data coming from > > > * network/devices), > > > > > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > > > 1020). I think it's more appropriate for the vmm to log it. What do you > > > think? > > > > vgic_get_irq() is called in a bunch of other places though, right? > > IOW, intid doesn't necessarily come from userspace. In fact, I believe > > KVM_IRQ_LINE is the only place we pass a value from userspace to > > vgic_get_irq() (don't quote me on that). > > > > Perhaps instead the fix could be to explicitly check that the intid > > from userspace is valid and exit early rather than count on > > vgic_get_irq() to do the right thing. > > vgic_get_irq() is designed to do the right thing. Returning NULL is > the way it reports an error, and this NULL value is already checked at > when directly provided either by the VMM or the guest. If we missed > any of those, that would be what needs addressing. Obtaining a NULL > pointer is a good way to catch those. > > In general, the kernel log is not how we report userspace errors (we > have been there before...). It is slow, noisy, unclear and ultimately > leaks information. Absolutely. My comments were aimed at calls to vgic_get_irq() where intid is coming from the kernel, not userspace. That being said, probably no good reason to buy a full fat WARN() in a function such as this one. I'm done waffling on this one liner now :) Reviewed-by: Oliver Upton <oupton@google.com> > If you really want something, then a pr_debug is a > potential tool as it can be dynamically enabled with the right > configuration. > > Thanks, > > M. > > -- > Without deviation from the norm, progress is not possible. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-19 8:16 ` Oliver Upton 0 siblings, 0 replies; 14+ messages in thread From: Oliver Upton @ 2021-08-19 8:16 UTC (permalink / raw) To: Marc Zyngier; +Cc: kvm, catalin.marinas, pshier, rananta, kvmarm On Thu, Aug 19, 2021 at 1:04 AM Marc Zyngier <maz@kernel.org> wrote: > > On Thu, 19 Aug 2021 08:41:19 +0100, > Oliver Upton <oupton@google.com> wrote: > > > > On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > > > Hi Ricardo, > > > > > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller <ricarkol@google.com> wrote: > > > > > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > > > reference to a struct irq. It warns whenever intid is not a valid number > > > > > (like when it's a reserved IRQ number). The issue is that this warning > > > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > > > > > Signed-off-by: Ricardo Koller <ricarkol@google.com> > > > > > --- > > > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > > > 1 file changed, 1 deletion(-) > > > > > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > > > index 111bff47e471..81cec508d413 100644 > > > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > > > if (intid >= VGIC_MIN_LPI) > > > > > return vgic_get_lpi(kvm, intid); > > > > > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > > > > > > > Was thinking about that, until I found this in bug.h: > > > > > > /* > > > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > > > * significant kernel issues that need prompt attention if they should ever > > > * appear at runtime. > > > * > > > * Do not use these macros when checking for invalid external inputs > > > * (e.g. invalid system call arguments, or invalid data coming from > > > * network/devices), > > > > > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > > > 1020). I think it's more appropriate for the vmm to log it. What do you > > > think? > > > > vgic_get_irq() is called in a bunch of other places though, right? > > IOW, intid doesn't necessarily come from userspace. In fact, I believe > > KVM_IRQ_LINE is the only place we pass a value from userspace to > > vgic_get_irq() (don't quote me on that). > > > > Perhaps instead the fix could be to explicitly check that the intid > > from userspace is valid and exit early rather than count on > > vgic_get_irq() to do the right thing. > > vgic_get_irq() is designed to do the right thing. Returning NULL is > the way it reports an error, and this NULL value is already checked at > when directly provided either by the VMM or the guest. If we missed > any of those, that would be what needs addressing. Obtaining a NULL > pointer is a good way to catch those. > > In general, the kernel log is not how we report userspace errors (we > have been there before...). It is slow, noisy, unclear and ultimately > leaks information. Absolutely. My comments were aimed at calls to vgic_get_irq() where intid is coming from the kernel, not userspace. That being said, probably no good reason to buy a full fat WARN() in a function such as this one. I'm done waffling on this one liner now :) Reviewed-by: Oliver Upton <oupton@google.com> > If you really want something, then a pr_debug is a > potential tool as it can be dynamically enabled with the right > configuration. > > Thanks, > > M. > > -- > Without deviation from the norm, progress is not possible. _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq 2021-08-18 21:32 ` Ricardo Koller @ 2021-08-19 10:47 ` Marc Zyngier -1 siblings, 0 replies; 14+ messages in thread From: Marc Zyngier @ 2021-08-19 10:47 UTC (permalink / raw) To: kvm, Ricardo Koller, kvmarm Cc: jingzhangos, pshier, oupton, james.morse, rananta, suzuki.poulose, catalin.marinas, drjones, reijiw, alexandru.elisei On Wed, 18 Aug 2021 14:32:05 -0700, Ricardo Koller wrote: > vgic_get_irq(intid) is used all over the vgic code in order to get a > reference to a struct irq. It warns whenever intid is not a valid number > (like when it's a reserved IRQ number). The issue is that this warning > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > Drop the WARN call from vgic_get_irq. Applied to next, thanks! [1/1] KVM: arm64: vgic: drop WARN from vgic_get_irq commit: b9a51949cebcd57bfb9385d9da62ace52564898c Cheers, M. -- Without deviation from the norm, progress is not possible. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq @ 2021-08-19 10:47 ` Marc Zyngier 0 siblings, 0 replies; 14+ messages in thread From: Marc Zyngier @ 2021-08-19 10:47 UTC (permalink / raw) To: kvm, Ricardo Koller, kvmarm; +Cc: catalin.marinas, pshier, rananta On Wed, 18 Aug 2021 14:32:05 -0700, Ricardo Koller wrote: > vgic_get_irq(intid) is used all over the vgic code in order to get a > reference to a struct irq. It warns whenever intid is not a valid number > (like when it's a reserved IRQ number). The issue is that this warning > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > Drop the WARN call from vgic_get_irq. Applied to next, thanks! [1/1] KVM: arm64: vgic: drop WARN from vgic_get_irq commit: b9a51949cebcd57bfb9385d9da62ace52564898c Cheers, M. -- Without deviation from the norm, progress is not possible. _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2021-08-19 10:47 UTC | newest] Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-08-18 21:32 [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq Ricardo Koller 2021-08-18 21:32 ` Ricardo Koller 2021-08-18 21:34 ` Oliver Upton 2021-08-18 21:34 ` Oliver Upton 2021-08-18 21:45 ` Ricardo Koller 2021-08-18 21:45 ` Ricardo Koller 2021-08-19 7:41 ` Oliver Upton 2021-08-19 7:41 ` Oliver Upton 2021-08-19 8:04 ` Marc Zyngier 2021-08-19 8:04 ` Marc Zyngier 2021-08-19 8:16 ` Oliver Upton 2021-08-19 8:16 ` Oliver Upton 2021-08-19 10:47 ` Marc Zyngier 2021-08-19 10:47 ` Marc Zyngier
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.