Current vfio-pci implementation disallows to mmap the page
containing MSI-X table in case that users can write directly
to MSI-X table and generate an incorrect MSIs.
However, this will cause some performance issue when there
are some critical device registers in the same page as the
MSI-X table. We have to handle the mmio access to these
registers in QEMU emulation rather than in guest.
To solve this issue, this series allows to expose MSI-X table
to userspace when hardware enables the capability of interrupt
remapping which can ensure that a given PCI device can only
shoot the MSIs assigned for it. And we introduce a new bus_flags
PCI_BUS_FLAGS_MSI_REMAP to test this capability on PCI side
for different archs.
The patch 3 are based on the proposed patchset[1].
Changelog v2:
- Make the commit log more clear
- Replace pci_bus_check_msi_remapping() with pci_bus_msi_isolated()
so that we could clearly know what the function does
- Set PCI_BUS_FLAGS_MSI_REMAP in pci_create_root_bus() instead
of iommu_bus_notifier()
- Reserve VFIO_REGION_INFO_FLAG_CAPS when we allow to mmap MSI-X
table so that we can know whether we allow to mmap MSI-X table
in QEMU
[1] https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1138820.html
Yongji Xie (6):
PCI: Add a new PCI_BUS_FLAGS_MSI_REMAP flag
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if MSI controller enables IRQ remapping
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if IOMMU have capability of IRQ remapping
iommu: Set PCI_BUS_FLAGS_MSI_REMAP on iommu driver initialization
pci-ioda: Set PCI_BUS_FLAGS_MSI_REMAP for IODA host bridge
vfio-pci: Allow to expose MSI-X table to userspace if interrupt remapping is enabled
arch/powerpc/platforms/powernv/pci-ioda.c | 8 ++++++++
drivers/iommu/iommu.c | 8 ++++++++
drivers/pci/msi.c | 15 +++++++++++++++
drivers/pci/probe.c | 7 +++++++
drivers/vfio/pci/vfio_pci.c | 17 ++++++++++++++---
drivers/vfio/pci/vfio_pci_rdwr.c | 3 ++-
include/linux/msi.h | 5 ++++-
include/linux/pci.h | 1 +
8 files changed, 59 insertions(+), 5 deletions(-)
--
1.7.9.5
The capability of IRQ remapping is abstracted on IOMMU side on
some archs. There is a existing flag IOMMU_CAP_INTR_REMAP for this.
To have a universal flag to test this capability for different
archs on PCI side, we set PCI_BUS_FLAGS_MSI_REMAP for PCI buses
when IOMMU_CAP_INTR_REMAP is set.
Signed-off-by: Yongji Xie <redacted>
---
drivers/pci/probe.c | 4 ++++
1 file changed, 4 insertions(+)
On ARM HW the capability of IRQ remapping is abstracted on
MSI controller side. MSI_FLAG_IRQ_REMAPPING is used to advertise
this [1].
To have a universal flag to test this capability for different
archs on PCI side, we set PCI_BUS_FLAGS_MSI_REMAP for PCI buses
when MSI_FLAG_IRQ_REMAPPING is set.
[1] https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1138820.html
Signed-off-by: Yongji Xie <redacted>
---
drivers/pci/msi.c | 15 +++++++++++++++
drivers/pci/probe.c | 3 +++
include/linux/msi.h | 5 ++++-
3 files changed, 22 insertions(+), 1 deletion(-)
Any IODA host bridge have the capability of IRQ remapping.
So we set PCI_BUS_FLAGS_MSI_REMAP when this kind of host birdge
is detected.
Signed-off-by: Yongji Xie <redacted>
Reviewed-by: Alexey Kardashevskiy <redacted>
---
arch/powerpc/platforms/powernv/pci-ioda.c | 8 ++++++++
1 file changed, 8 insertions(+)
Some iommu drivers would be initialized after PCI device
enumeration. So PCI_BUS_FLAGS_MSI_REMAP would not be set
when probing PCI devices although IOMMU enables capability
of IRQ remapping. This patch tests this capability and
set the flag when iommu driver is initialized.
Signed-off-by: Yongji Xie <redacted>
---
drivers/iommu/iommu.c | 8 ++++++++
1 file changed, 8 insertions(+)
This patch tries to expose MSI-X tables to userspace if hardware
enables interrupt remapping. This capability can ensure that a
given PCI device can only shoot the MSIs assigned for it. That
means a userspace driver could never hurt other devices or system
by writing to the exposed MSI-X table directly.
Signed-off-by: Yongji Xie <redacted>
---
drivers/vfio/pci/vfio_pci.c | 17 ++++++++++++++---
drivers/vfio/pci/vfio_pci_rdwr.c | 3 ++-
2 files changed, 16 insertions(+), 4 deletions(-)
@@ -487,8 +487,12 @@ static int msix_sparse_mmap_cap(struct vfio_pci_device *vdev,end=pci_resource_len(vdev->pdev,vdev->msix_bar);-/* If MSI-X table is aligned to the start or end, only one area */-if(((vdev->msix_offset&PAGE_MASK)==0)||+/*+*IfMSI-Xtableisallowedtommapbecauseofthecapability+*ofIRQremappingoralignedtothestartorend,onlyonearea+*/+if((vdev->pdev->bus->bus_flags&PCI_BUS_FLAGS_MSI_REMAP)||+((vdev->msix_offset&PAGE_MASK)==0)||(PAGE_ALIGN(vdev->msix_offset+vdev->msix_size)>=end))nr_areas=1;
@@ -503,6 +507,12 @@ static int msix_sparse_mmap_cap(struct vfio_pci_device *vdev,structvfio_region_info_cap_sparse_mmap,header);sparse->nr_areas=nr_areas;+if(vdev->pdev->bus->bus_flags&PCI_BUS_FLAGS_MSI_REMAP){+sparse->areas[i].offset=0;+sparse->areas[i].size=end;+return0;+}+if(vdev->msix_offset&PAGE_MASK){sparse->areas[i].offset=0;sparse->areas[i].size=vdev->msix_offset&PAGE_MASK;
We introduce a new pci_bus_flags, PCI_BUS_FLAGS_MSI_REMAP
which indicates interrupts of all devices on the bus are
managed by the hardware enabling IRQ remapping(intel naming).
When the capability is enabled, a given PCI device can only
shoot the MSIs assigned for it. In other words, the hardware
can protect system from invalid MSIs of the device by checking
the target address and data when there is something wrong
with MSI part in device or device driver.
There is a existing flag for this capability in the IOMMU space:
enum iommu_cap {
IOMMU_CAP_CACHE_COHERENCY,
---> IOMMU_CAP_INTR_REMAP,
IOMMU_CAP_NOEXEC,
};
and Eric also posted a patchset [1] to abstract it on MSI
controller side for ARM. But it would make sense to have a
more common flag like PCI_BUS_FLAGS_MSI_REMAP so that we can
use a universal flag to test this capability on PCI side for
different archs.
With this flag enabled, we can easily know whether it's safe
to expose MSI-X tables of PCI BARs to userspace. Some usespace
drivers such as VFIO may benefit from this.
[1] https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1138820.html
Signed-off-by: Yongji Xie <redacted>
---
include/linux/pci.h | 1 +
1 file changed, 1 insertion(+)
@@ -187,6 +187,7 @@ typedef unsigned short __bitwise pci_bus_flags_t;enumpci_bus_flags{PCI_BUS_FLAGS_NO_MSI=(__forcepci_bus_flags_t)1,PCI_BUS_FLAGS_NO_MMRBC=(__forcepci_bus_flags_t)2,+PCI_BUS_FLAGS_MSI_REMAP=(__forcepci_bus_flags_t)4,};/* These values come from the PCI Express Spec */
From: Alex Williamson <hidden> Date: 2016-06-02 13:11:40
AFAICT, you posted this *3* days ago, has something changed here or is
this just expedited nagging for review? This also depends on a
non-upstream series and crosses multiple functional areas, all of which
make it difficult for maintainers to actually do anything with this
series. Thanks,
Alex
On Thu, 2 Jun 2016 14:09:57 +0800
Yongji Xie [off-list ref] wrote:
Current vfio-pci implementation disallows to mmap the page
containing MSI-X table in case that users can write directly
to MSI-X table and generate an incorrect MSIs.
However, this will cause some performance issue when there
are some critical device registers in the same page as the
MSI-X table. We have to handle the mmio access to these
registers in QEMU emulation rather than in guest.
To solve this issue, this series allows to expose MSI-X table
to userspace when hardware enables the capability of interrupt
remapping which can ensure that a given PCI device can only
shoot the MSIs assigned for it. And we introduce a new bus_flags
PCI_BUS_FLAGS_MSI_REMAP to test this capability on PCI side
for different archs.
The patch 3 are based on the proposed patchset[1].
Changelog v2:
- Make the commit log more clear
- Replace pci_bus_check_msi_remapping() with pci_bus_msi_isolated()
so that we could clearly know what the function does
- Set PCI_BUS_FLAGS_MSI_REMAP in pci_create_root_bus() instead
of iommu_bus_notifier()
- Reserve VFIO_REGION_INFO_FLAG_CAPS when we allow to mmap MSI-X
table so that we can know whether we allow to mmap MSI-X table
in QEMU
[1] https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1138820.html
Yongji Xie (6):
PCI: Add a new PCI_BUS_FLAGS_MSI_REMAP flag
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if MSI controller enables IRQ remapping
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if IOMMU have capability of IRQ remapping
iommu: Set PCI_BUS_FLAGS_MSI_REMAP on iommu driver initialization
pci-ioda: Set PCI_BUS_FLAGS_MSI_REMAP for IODA host bridge
vfio-pci: Allow to expose MSI-X table to userspace if interrupt remapping is enabled
arch/powerpc/platforms/powernv/pci-ioda.c | 8 ++++++++
drivers/iommu/iommu.c | 8 ++++++++
drivers/pci/msi.c | 15 +++++++++++++++
drivers/pci/probe.c | 7 +++++++
drivers/vfio/pci/vfio_pci.c | 17 ++++++++++++++---
drivers/vfio/pci/vfio_pci_rdwr.c | 3 ++-
include/linux/msi.h | 5 ++++-
include/linux/pci.h | 1 +
8 files changed, 59 insertions(+), 5 deletions(-)
Hi, Alex
On 2016/6/2 21:11, Alex Williamson wrote:
AFAICT, you posted this *3* days ago, has something changed here or is
this just expedited nagging for review? This also depends on a
non-upstream series and crosses multiple functional areas, all of which
make it difficult for maintainers to actually do anything with this
series. Thanks,
Alex
I resend this series because I found the message-id of the previous email
is changed unexpectedly. The cover letter is not in the same thread as other
patches. It would be a little hard for people to review.
Thanks,
Yongji
On Thu, 2 Jun 2016 14:09:57 +0800
Yongji Xie [off-list ref] wrote:
quoted
Current vfio-pci implementation disallows to mmap the page
containing MSI-X table in case that users can write directly
to MSI-X table and generate an incorrect MSIs.
However, this will cause some performance issue when there
are some critical device registers in the same page as the
MSI-X table. We have to handle the mmio access to these
registers in QEMU emulation rather than in guest.
To solve this issue, this series allows to expose MSI-X table
to userspace when hardware enables the capability of interrupt
remapping which can ensure that a given PCI device can only
shoot the MSIs assigned for it. And we introduce a new bus_flags
PCI_BUS_FLAGS_MSI_REMAP to test this capability on PCI side
for different archs.
The patch 3 are based on the proposed patchset[1].
Changelog v2:
- Make the commit log more clear
- Replace pci_bus_check_msi_remapping() with pci_bus_msi_isolated()
so that we could clearly know what the function does
- Set PCI_BUS_FLAGS_MSI_REMAP in pci_create_root_bus() instead
of iommu_bus_notifier()
- Reserve VFIO_REGION_INFO_FLAG_CAPS when we allow to mmap MSI-X
table so that we can know whether we allow to mmap MSI-X table
in QEMU
[1] https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1138820.html
Yongji Xie (6):
PCI: Add a new PCI_BUS_FLAGS_MSI_REMAP flag
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if MSI controller enables IRQ remapping
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if IOMMU have capability of IRQ remapping
iommu: Set PCI_BUS_FLAGS_MSI_REMAP on iommu driver initialization
pci-ioda: Set PCI_BUS_FLAGS_MSI_REMAP for IODA host bridge
vfio-pci: Allow to expose MSI-X table to userspace if interrupt remapping is enabled
arch/powerpc/platforms/powernv/pci-ioda.c | 8 ++++++++
drivers/iommu/iommu.c | 8 ++++++++
drivers/pci/msi.c | 15 +++++++++++++++
drivers/pci/probe.c | 7 +++++++
drivers/vfio/pci/vfio_pci.c | 17 ++++++++++++++---
drivers/vfio/pci/vfio_pci_rdwr.c | 3 ++-
include/linux/msi.h | 5 ++++-
include/linux/pci.h | 1 +
8 files changed, 59 insertions(+), 5 deletions(-)
drivers/pci/msi.c:1146:20: error: 'MSI_FLAG_IRQ_REMAPPING' undeclared (first use in this function)
if (info->flags & MSI_FLAG_IRQ_REMAPPING)
^
drivers/pci/msi.c:1146:20: note: each undeclared identifier is reported only once for each function it appears in
vim +/MSI_FLAG_IRQ_REMAPPING +1146 drivers/pci/msi.c
1140 struct msi_domain_info *info;
1141
1142 if (!domain)
1143 return 0;
1144
1145 info = msi_get_domain_info(domain);
1146 if (info->flags & MSI_FLAG_IRQ_REMAPPING)
1147 return 1;
1148 #endif
1149 return 0;
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
arm_pmu.c:(.text+0x5c58): undefined reference to `pci_bus_msi_isolated'
Sorry for this fault. I will fix it in next version. The
pci_bus_msi_isolated() should not
depend on CONFIG_PCI_MSI, I would move this function from
drivers/pci/msi.c to
drivers/pci/probe.c.
Thanks,
Yongji
drivers/pci/msi.c:1146:20: error: 'MSI_FLAG_IRQ_REMAPPING' undeclared (first use in this function)
if (info->flags & MSI_FLAG_IRQ_REMAPPING)
^
drivers/pci/msi.c:1146:20: note: each undeclared identifier is reported only once for each function it appears in
vim +/MSI_FLAG_IRQ_REMAPPING +1146 drivers/pci/msi.c
1140 struct msi_domain_info *info;
1141
1142 if (!domain)
1143 return 0;
1144
1145 info = msi_get_domain_info(domain);
From: Auger Eric <eric.auger@redhat.com> Date: 2016-06-08 07:41:41
Hi Yongji,
Le 02/06/2016 à 08:09, Yongji Xie a écrit :
Current vfio-pci implementation disallows to mmap the page
containing MSI-X table in case that users can write directly
to MSI-X table and generate an incorrect MSIs.
However, this will cause some performance issue when there
are some critical device registers in the same page as the
MSI-X table. We have to handle the mmio access to these
registers in QEMU emulation rather than in guest.
To solve this issue, this series allows to expose MSI-X table
to userspace when hardware enables the capability of interrupt
remapping which can ensure that a given PCI device can only
shoot the MSIs assigned for it. And we introduce a new bus_flags
PCI_BUS_FLAGS_MSI_REMAP to test this capability on PCI side
for different archs.
The patch 3 are based on the proposed patchset[1].
You may have noticed I sent a respin of [1] yesterday:
http://www.gossamer-threads.com/lists/linux/kernel/2455187.
Unfortunately you will see I removed the patch defining the new
msi_domain_info MSI_FLAG_IRQ_REMAPPING flag you rely on in this series.
I did so because I was not using it anymore. At the beginning this was
used to detect whether the MSI assignment was safe but this
method was covering cases where the MSI controller was
upstream to the IOMMU. So now I rely on a mechanism where MSI controller
are supposed to register their MSI doorbells and tag whether it is safe.
I don't know yet how this change will be welcomed though. Depending
on reviews/discussions, might happen we revert to the previous flag.
If you need the feature you can embed the used patches in your series and
follow the review process separately. Sorry for the setback.
Best Regards
Eric
Changelog v2:
- Make the commit log more clear
- Replace pci_bus_check_msi_remapping() with pci_bus_msi_isolated()
so that we could clearly know what the function does
- Set PCI_BUS_FLAGS_MSI_REMAP in pci_create_root_bus() instead
of iommu_bus_notifier()
- Reserve VFIO_REGION_INFO_FLAG_CAPS when we allow to mmap MSI-X
table so that we can know whether we allow to mmap MSI-X table
in QEMU
[1] https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1138820.html
Yongji Xie (6):
PCI: Add a new PCI_BUS_FLAGS_MSI_REMAP flag
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if MSI controller enables IRQ remapping
PCI: Set PCI_BUS_FLAGS_MSI_REMAP if IOMMU have capability of IRQ remapping
iommu: Set PCI_BUS_FLAGS_MSI_REMAP on iommu driver initialization
pci-ioda: Set PCI_BUS_FLAGS_MSI_REMAP for IODA host bridge
vfio-pci: Allow to expose MSI-X table to userspace if interrupt remapping is enabled
arch/powerpc/platforms/powernv/pci-ioda.c | 8 ++++++++
drivers/iommu/iommu.c | 8 ++++++++
drivers/pci/msi.c | 15 +++++++++++++++
drivers/pci/probe.c | 7 +++++++
drivers/vfio/pci/vfio_pci.c | 17 ++++++++++++++---
drivers/vfio/pci/vfio_pci_rdwr.c | 3 ++-
include/linux/msi.h | 5 ++++-
include/linux/pci.h | 1 +
8 files changed, 59 insertions(+), 5 deletions(-)
Hi Yongji,
Le 02/06/2016 à 08:09, Yongji Xie a écrit :
quoted
Current vfio-pci implementation disallows to mmap the page
containing MSI-X table in case that users can write directly
to MSI-X table and generate an incorrect MSIs.
However, this will cause some performance issue when there
are some critical device registers in the same page as the
MSI-X table. We have to handle the mmio access to these
registers in QEMU emulation rather than in guest.
To solve this issue, this series allows to expose MSI-X table
to userspace when hardware enables the capability of interrupt
remapping which can ensure that a given PCI device can only
shoot the MSIs assigned for it. And we introduce a new bus_flags
PCI_BUS_FLAGS_MSI_REMAP to test this capability on PCI side
for different archs.
The patch 3 are based on the proposed patchset[1].
You may have noticed I sent a respin of [1] yesterday:
http://www.gossamer-threads.com/lists/linux/kernel/2455187.
Unfortunately you will see I removed the patch defining the new
msi_domain_info MSI_FLAG_IRQ_REMAPPING flag you rely on in this series.
I did so because I was not using it anymore. At the beginning this was
used to detect whether the MSI assignment was safe but this
method was covering cases where the MSI controller was
upstream to the IOMMU. So now I rely on a mechanism where MSI controller
are supposed to register their MSI doorbells and tag whether it is safe.
I don't know yet how this change will be welcomed though. Depending
on reviews/discussions, might happen we revert to the previous flag.
If you need the feature you can embed the used patches in your series and
follow the review process separately. Sorry for the setback.
Thanks for your notification. I'd better wait until your patches get
settled. Then I could exactly know which way we should use to test the
capability of interrupt remapping on ARM in my series.
Thanks,
Yongji