From nobody Thu Apr 25 19:10:48 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1669165944; cv=none; d=zohomail.com; s=zohoarc; b=UPlE5zJfxHjbWyiElC5j/2sSAS6DZcPkKpXASOr/PnAyclTLZreKE9Wg4LNMDn65FNJ7kvSNnv1IJv/1nWKREp2NiYHucIYl21BmrRbWx4O4ClpOGUzrP6pY55X6slTNvBFZABKEwaZ8sOT6kiX9xDT8gFAbm4vwNCYwLNueRsQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1669165944; h=Content-Type:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Sender:Subject:To; bh=xpt/mZULwXvmoRq+gYUoqg4ygrXBwnXvtEI1+tHXJFU=; b=OOTAofDE/A59Qvp/fUwqiHyf/Q0LdYnRjotu0j+LoW9mA7reTt0tP40tJwqf6kn5BMWBE8LoDxBn6eJdgZF+iH3LCoA2RVHAj+sN6YxpGfbS0WDhXGXdZ0cwgT20Tns5fLji0fORJUvyawtBpdhP9FhAuv6lJGTkxBafDQ2PxM0= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1669165944305243.259125332292; Tue, 22 Nov 2022 17:12:24 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oxeJ6-0000B8-FZ; Tue, 22 Nov 2022 20:12:09 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oxeJ5-0000At-1W for qemu-devel@nongnu.org; Tue, 22 Nov 2022 20:12:07 -0500 Received: from szxga01-in.huawei.com ([45.249.212.187]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oxeJ1-0002jp-T9 for qemu-devel@nongnu.org; Tue, 22 Nov 2022 20:12:06 -0500 Received: from kwepemi500016.china.huawei.com (unknown [172.30.72.56]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4NH2zv1c38zqScm; Wed, 23 Nov 2022 09:07:55 +0800 (CST) Received: from localhost.localdomain (10.69.192.58) by kwepemi500016.china.huawei.com (7.221.188.220) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Wed, 23 Nov 2022 09:11:49 +0800 To: , CC: , , , Xiang Chen Subject: [PATCH v2] vfio/pci: Verify each MSI vector to avoid invalid MSI vectors Date: Wed, 23 Nov 2022 09:42:36 +0800 Message-ID: <1669167756-196788-1-git-send-email-chenxiang66@hisilicon.com> X-Mailer: git-send-email 2.8.1 MIME-Version: 1.0 X-Originating-IP: [10.69.192.58] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemi500016.china.huawei.com (7.221.188.220) X-CFilter-Loop: Reflected Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=45.249.212.187; envelope-from=chenxiang66@hisilicon.com; helo=szxga01-in.huawei.com X-Spam_score_int: -41 X-Spam_score: -4.2 X-Spam_bar: ---- X-Spam_report: (-4.2 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: chenxiang From: chenxiang via Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1669165945544100001 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xiang Chen Currently the number of MSI vectors comes from register PCI_MSI_FLAGS which should be power-of-2 in qemu, in some scenaries it is not the same as the number that driver requires in guest, for example, a PCI driver wants to allocate 6 MSI vecotrs in guest, but as the limitation, it will allocate 8 MSI vectors. So it requires 8 MSI vectors in qemu while the driver in guest only wants to allocate 6 MSI vectors. When GICv4.1 is enabled, it iterates over all possible MSIs and enable the forwarding while the guest has only created some of mappings in the virtual ITS, so some calls fail. The exception print is as following: vfio-pci 0000:3a:00.1: irq bypass producer (token 000000008f08224d) registr= ation fails:66311 To avoid the issue, verify each MSI vector, skip some operations such as request_irq() and irq_bypass_register_producer() for those invalid MSI vect= ors. Signed-off-by: Xiang Chen --- I reported the issue at the link: https://lkml.kernel.org/lkml/87cze9lcut.wl-maz@kernel.org/T/ Change Log: v1 -> v2: Verify each MSI vector in kernel instead of adding systemcall according to Mar's suggestion --- arch/arm64/kvm/vgic/vgic-irqfd.c | 13 +++++++++++++ arch/arm64/kvm/vgic/vgic-its.c | 36 ++++++++++++++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic.h | 1 + drivers/vfio/pci/vfio_pci_intrs.c | 33 +++++++++++++++++++++++++++++++++ include/linux/kvm_host.h | 2 ++ 5 files changed, 85 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-irqfd.c b/arch/arm64/kvm/vgic/vgic-ir= qfd.c index 475059b..71f6af57 100644 --- a/arch/arm64/kvm/vgic/vgic-irqfd.c +++ b/arch/arm64/kvm/vgic/vgic-irqfd.c @@ -98,6 +98,19 @@ int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e, return vgic_its_inject_msi(kvm, &msi); } =20 +int kvm_verify_msi(struct kvm *kvm, + struct kvm_kernel_irq_routing_entry *irq_entry) +{ + struct kvm_msi msi; + + if (!vgic_has_its(kvm)) + return -ENODEV; + + kvm_populate_msi(irq_entry, &msi); + + return vgic_its_verify_msi(kvm, &msi); +} + /** * kvm_arch_set_irq_inatomic: fast-path for irqfd injection */ diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index 94a666d..8312a4a 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -767,6 +767,42 @@ int vgic_its_inject_cached_translation(struct kvm *kvm= , struct kvm_msi *msi) return 0; } =20 +int vgic_its_verify_msi(struct kvm *kvm, struct kvm_msi *msi) +{ + struct vgic_its *its; + struct its_ite *ite; + struct kvm_vcpu *vcpu; + int ret =3D 0; + + if (!irqchip_in_kernel(kvm) || (msi->flags & ~KVM_MSI_VALID_DEVID)) + return -EINVAL; + + if (!vgic_has_its(kvm)) + return -ENODEV; + + its =3D vgic_msi_to_its(kvm, msi); + if (IS_ERR(its)) + return PTR_ERR(its); + + mutex_lock(&its->its_lock); + if (!its->enabled) { + ret =3D -EBUSY; + goto unlock; + } + ite =3D find_ite(its, msi->devid, msi->data); + if (!ite || !its_is_collection_mapped(ite->collection)) { + ret =3D E_ITS_INT_UNMAPPED_INTERRUPT; + goto unlock; + } + + vcpu =3D kvm_get_vcpu(kvm, ite->collection->target_addr); + if (!vcpu) + ret =3D E_ITS_INT_UNMAPPED_INTERRUPT; +unlock: + mutex_unlock(&its->its_lock); + return ret; +} + /* * Queries the KVM IO bus framework to get the ITS pointer from the given * doorbell address. diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h index 0c8da72..d452150 100644 --- a/arch/arm64/kvm/vgic/vgic.h +++ b/arch/arm64/kvm/vgic/vgic.h @@ -240,6 +240,7 @@ int kvm_vgic_register_its_device(void); void vgic_enable_lpis(struct kvm_vcpu *vcpu); void vgic_flush_pending_lpis(struct kvm_vcpu *vcpu); int vgic_its_inject_msi(struct kvm *kvm, struct kvm_msi *msi); +int vgic_its_verify_msi(struct kvm *kvm, struct kvm_msi *msi); int vgic_v3_has_attr_regs(struct kvm_device *dev, struct kvm_device_attr *= attr); int vgic_v3_dist_uaccess(struct kvm_vcpu *vcpu, bool is_write, int offset, u32 *val); diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_= intrs.c index 40c3d7c..3027805 100644 --- a/drivers/vfio/pci/vfio_pci_intrs.c +++ b/drivers/vfio/pci/vfio_pci_intrs.c @@ -19,6 +19,7 @@ #include #include #include +#include =20 #include "vfio_pci_priv.h" =20 @@ -315,6 +316,28 @@ static int vfio_msi_enable(struct vfio_pci_core_device= *vdev, int nvec, bool msi return 0; } =20 +static int vfio_pci_verify_msi_entry(struct vfio_pci_core_device *vdev, + struct eventfd_ctx *trigger) +{ + struct kvm *kvm =3D vdev->vdev.kvm; + struct kvm_kernel_irqfd *tmp; + struct kvm_kernel_irq_routing_entry irq_entry; + int ret =3D -ENODEV; + + spin_lock_irq(&kvm->irqfds.lock); + list_for_each_entry(tmp, &kvm->irqfds.items, list) { + if (trigger =3D=3D tmp->eventfd) { + ret =3D 0; + break; + } + } + spin_unlock_irq(&kvm->irqfds.lock); + if (ret) + return ret; + irq_entry =3D tmp->irq_entry; + return kvm_verify_msi(kvm, &irq_entry); +} + static int vfio_msi_set_vector_signal(struct vfio_pci_core_device *vdev, int vector, int fd, bool msix) { @@ -355,6 +378,16 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_= core_device *vdev, return PTR_ERR(trigger); } =20 + if (!msix) { + ret =3D vfio_pci_verify_msi_entry(vdev, trigger); + if (ret) { + kfree(vdev->ctx[vector].name); + eventfd_ctx_put(trigger); + if (ret > 0) + ret =3D 0; + return ret; + } + } /* * The MSIx vector table resides in device memory which may be cleared * via backdoor resets. We don't allow direct access to the vector diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 1cd9a22..3c8f22a 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -1611,6 +1611,8 @@ void kvm_unregister_irq_ack_notifier(struct kvm *kvm, int kvm_request_irq_source_id(struct kvm *kvm); void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id); bool kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args); +int kvm_verify_msi(struct kvm *kvm, + struct kvm_kernel_irq_routing_entry *irq_entry); =20 /* * Returns a pointer to the memslot if it contains gfn. --=20 2.8.1