Re: [PATCH 6/9] virtio_pci: harden MSI-X interrupts

On Mon, Sep 13, 2021 at 09:38:30PM +0200, Thomas Gleixner wrote:

On Mon, Sep 13 2021 at 15:07, Jason Wang wrote:

quoted

On Mon, Sep 13, 2021 at 2:50 PM Michael S. Tsirkin [off-list ref] wrote:

quoted

quoted

But doen't "irq is disabled" basically mean "we told the hypervisor
to disable the irq"?  What extractly prevents hypervisor from
sending the irq even if guest thinks it disabled it?

More generally, can't we for example blow away the
indir_desc array that we use to keep the ctx pointers?
Won't that be enough?

I'm not sure how it is related to the indirect descriptor but an
example is that all the current driver will assume:

1) the interrupt won't be raised before virtio_device_ready()
2) the interrupt won't be raised after reset()

If that assumption exists, then you better keep the interrupt line
disabled until virtio_device_ready() has completed

started not completed. device is allowed to send
config interrupts right after DRIVER_OK status is set by
virtio_device_ready.

and disable it again
before reset() is invoked. That's a question of general robustness and
not really a question of trusted hypervisors and encrypted guests.

We can do this for some MSIX interrupts, sure. Not for shared interrupts though.

quoted

quoted

quoted

quoted

quoted

quoted

quoted

quoted

+void vp_disable_vectors(struct virtio_device *vdev)
 {
      struct virtio_pci_device *vp_dev = to_vp_device(vdev);
      int i;

@@ -34,7 +34,20 @@ void vp_synchronize_vectors(struct virtio_device *vdev)
              synchronize_irq(vp_dev->pci_dev->irq);

Don't you want the same change for non-MSI interrupts?

We can't disable them - these are shared.

Thanks,

        tglx

_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization