From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756863AbdKGWR4 (ORCPT ); Tue, 7 Nov 2017 17:17:56 -0500 Received: from mx1.redhat.com ([209.132.183.28]:38596 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751783AbdKGWRz (ORCPT ); Tue, 7 Nov 2017 17:17:55 -0500 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com DB8B3A58BF Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=eric.auger@redhat.com Subject: Re: [PATCH v5 24/26] KVM: arm/arm64: GICv4: Prevent userspace from changing doorbell affinity To: Marc Zyngier , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, linux-kernel@vger.kernel.org References: <20171027142855.21584-1-marc.zyngier@arm.com> <20171027142855.21584-25-marc.zyngier@arm.com> Cc: Mark Rutland , Andre Przywara , Shameerali Kolothum Thodi , Christoffer Dall , Shanker Donthineni From: Auger Eric Message-ID: <27d2f799-c2de-27a9-8e92-21bbdd583307@redhat.com> Date: Tue, 7 Nov 2017 23:17:51 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <20171027142855.21584-25-marc.zyngier@arm.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Tue, 07 Nov 2017 22:17:55 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, On 27/10/2017 16:28, Marc Zyngier wrote: > We so far allocate the doorbell interrupts without taking any > special measure regarding the affinity of these interrupts. We > simply move them around as required when the vcpu gets scheduled > on a different CPU. > > But that's counting without userspace (and the evil irqbalance) that > can try and move the VPE interrupt around, causing the ITS code > to emit VMOVP commands and remap the doorbell to another redistributor. > Worse, this can happen while the vcpu is running, causing all kind > of trouble if the VPE is already resident, and we end-up in UNPRED > territory. > > So let's take a definitive action and prevent userspace from messing > with us. This is just a matter of adding IRQ_NO_BALANCING to the > set of flags we already have, letting the kernel in sole control > of the affinity. > > Signed-off-by: Marc Zyngier Reviewed-by: Eric Auger Eric > --- > virt/kvm/arm/vgic/vgic-v4.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/arm/vgic/vgic-v4.c b/virt/kvm/arm/vgic/vgic-v4.c > index d7fe610bb1f5..d10e18eabd3b 100644 > --- a/virt/kvm/arm/vgic/vgic-v4.c > +++ b/virt/kvm/arm/vgic/vgic-v4.c > @@ -23,6 +23,8 @@ > > #include "vgic.h" > > +#define DB_IRQ_FLAGS (IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY | IRQ_NO_BALANCING) > + > static irqreturn_t vgic_v4_doorbell_handler(int irq, void *info) > { > struct kvm_vcpu *vcpu = info; > @@ -83,7 +85,7 @@ int vgic_v4_init(struct kvm *kvm) > * doorbell could kick us out of the guest too > * early... > */ > - irq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY); > + irq_set_status_flags(irq, DB_IRQ_FLAGS); > ret = request_irq(irq, vgic_v4_doorbell_handler, > 0, "vcpu", vcpu); > if (ret) { > @@ -121,7 +123,7 @@ void vgic_v4_teardown(struct kvm *kvm) > struct kvm_vcpu *vcpu = kvm_get_vcpu(kvm, i); > int irq = its_vm->vpes[i]->irq; > > - irq_clear_status_flags(irq, IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY); > + irq_clear_status_flags(irq, DB_IRQ_FLAGS); > free_irq(irq, vcpu); > } > >