Re: [PATCH 6/9] virtio_pci: harden MSI-X interrupts

在 2021/9/14 上午6:31, Thomas Gleixner 写道:

On Mon, Sep 13 2021 at 16:54, Michael S. Tsirkin wrote:

quoted

On Mon, Sep 13, 2021 at 09:38:30PM +0200, Thomas Gleixner wrote:

quoted

On Mon, Sep 13 2021 at 15:07, Jason Wang wrote:

quoted

On Mon, Sep 13, 2021 at 2:50 PM Michael S. Tsirkin [off-list ref] wrote:

quoted

quoted

But doen't "irq is disabled" basically mean "we told the hypervisor
to disable the irq"?  What extractly prevents hypervisor from
sending the irq even if guest thinks it disabled it?

More generally, can't we for example blow away the
indir_desc array that we use to keep the ctx pointers?
Won't that be enough?

I'm not sure how it is related to the indirect descriptor but an
example is that all the current driver will assume:

1) the interrupt won't be raised before virtio_device_ready()
2) the interrupt won't be raised after reset()

If that assumption exists, then you better keep the interrupt line
disabled until virtio_device_ready() has completed

started not completed. device is allowed to send
config interrupts right after DRIVER_OK status is set by
virtio_device_ready.

Whatever:

  * Define the exact point from which on the driver is able to handle the
    interrupt and put the enable after that point

  * Define the exact point from which on the driver is unable to handle
    the interrupt and put the disable before that point

Yes, this is exactly what this patch (and INTX patch) want to achieve. 
The driver should only able to handle the interrupt after 
virtio_device_ready() but before reset().

Thanks

The above is blury.

quoted

quoted

and disable it again
before reset() is invoked. That's a question of general robustness and
not really a question of trusted hypervisors and encrypted guests.

We can do this for some MSIX interrupts, sure. Not for shared interrupts though.

See my reply to the next patch. The problem is the same:

  * Define the exact point from which on the driver is able to handle the
    interrupt and allow the handler to proceed after that point

  * Define the exact point from which on the driver is unable to handle
    the interrupt and ensure that the handler denies to proceed before
    that point

Same story just a different mechanism.

Thanks,

         tglx

_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization