From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752439AbdJ3Gvw (ORCPT ); Mon, 30 Oct 2017 02:51:52 -0400 Received: from mail-lf0-f66.google.com ([209.85.215.66]:46506 "EHLO mail-lf0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751365AbdJ3Gvt (ORCPT ); Mon, 30 Oct 2017 02:51:49 -0400 X-Google-Smtp-Source: ABhQp+SNgvmoTJrKbUwCbwZNpHCg28l4lH/93Q2bkCeehAbGr9IK6ns0O7qvIU3D9PP/0HvatFBDPQ== Date: Mon, 30 Oct 2017 07:51:39 +0100 From: Christoffer Dall To: Marc Zyngier Cc: linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Andre Przywara Subject: Re: [PATCH v5 24/26] KVM: arm/arm64: GICv4: Prevent userspace from changing doorbell affinity Message-ID: <20171030065139.GP2166@lvm> References: <20171027142855.21584-1-marc.zyngier@arm.com> <20171027142855.21584-25-marc.zyngier@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171027142855.21584-25-marc.zyngier@arm.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Oct 27, 2017 at 03:28:53PM +0100, Marc Zyngier wrote: > We so far allocate the doorbell interrupts without taking any > special measure regarding the affinity of these interrupts. We > simply move them around as required when the vcpu gets scheduled > on a different CPU. > > But that's counting without userspace (and the evil irqbalance) that > can try and move the VPE interrupt around, causing the ITS code > to emit VMOVP commands and remap the doorbell to another redistributor. > Worse, this can happen while the vcpu is running, causing all kind > of trouble if the VPE is already resident, and we end-up in UNPRED > territory. > > So let's take a definitive action and prevent userspace from messing > with us. This is just a matter of adding IRQ_NO_BALANCING to the > set of flags we already have, letting the kernel in sole control > of the affinity. > Acked-by: Christoffer Dall > Signed-off-by: Marc Zyngier > --- > virt/kvm/arm/vgic/vgic-v4.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/arm/vgic/vgic-v4.c b/virt/kvm/arm/vgic/vgic-v4.c > index d7fe610bb1f5..d10e18eabd3b 100644 > --- a/virt/kvm/arm/vgic/vgic-v4.c > +++ b/virt/kvm/arm/vgic/vgic-v4.c > @@ -23,6 +23,8 @@ > > #include "vgic.h" > > +#define DB_IRQ_FLAGS (IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY | IRQ_NO_BALANCING) > + > static irqreturn_t vgic_v4_doorbell_handler(int irq, void *info) > { > struct kvm_vcpu *vcpu = info; > @@ -83,7 +85,7 @@ int vgic_v4_init(struct kvm *kvm) > * doorbell could kick us out of the guest too > * early... > */ > - irq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY); > + irq_set_status_flags(irq, DB_IRQ_FLAGS); > ret = request_irq(irq, vgic_v4_doorbell_handler, > 0, "vcpu", vcpu); > if (ret) { > @@ -121,7 +123,7 @@ void vgic_v4_teardown(struct kvm *kvm) > struct kvm_vcpu *vcpu = kvm_get_vcpu(kvm, i); > int irq = its_vm->vpes[i]->irq; > > - irq_clear_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY); > + irq_clear_status_flags(irq, DB_IRQ_FLAGS); > free_irq(irq, vcpu); > } > > -- > 2.11.0 > > _______________________________________________ > kvmarm mailing list > kvmarm@lists.cs.columbia.edu > https://lists.cs.columbia.edu/mailman/listinfo/kvmarm