Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754735AbbBBQYR (ORCPT ); Mon, 2 Feb 2015 11:24:17 -0500 Received: from foss-mx-na.foss.arm.com ([217.140.108.86]:40646 "EHLO foss-mx-na.foss.arm.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1754363AbbBBQYO (ORCPT ); Mon, 2 Feb 2015 11:24:14 -0500 Message-ID: <54CFA49C.50404@arm.com> Date: Mon, 02 Feb 2015 16:23:56 +0000 From: Marc Zyngier User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.3.0 MIME-Version: 1.0 To: Bjorn Helgaas CC: Thomas Gleixner , Jiang Liu , Lorenzo Pieralisi , Andre Przywara , "linux-pci@vger.kernel.org" , linux-arm , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] PCI: Fix pcibios_update_irq misuse of irq number References: <1422456683-797-1-git-send-email-marc.zyngier@arm.com> In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2181 Lines: 50 On 02/02/15 15:57, Bjorn Helgaas wrote: > On Wed, Jan 28, 2015 at 8:51 AM, Marc Zyngier wrote: >> pcibios_update_irq writes an irq number into the config space >> of a given PCI device, but ignores the fact that this number >> is a virtual interrupt number, which might be a very different >> value from what the underlying hardware is using. >> >> The obvious fix is to fetch the HW interrupt number from the >> corresponding irq_data structure. This is slightly complicated >> by the fact that this interrupt might be services by a stacked >> domain. >> >> This has been tested on KVM with kvmtool. >> >> Reported-by: Lorenzo Pieralisi >> Tested-by: Andre Przywara >> Signed-off-by: Marc Zyngier > > Jiang, are you OK with this patch as-is now, since it isn't used on x86? > > Marc, Lorenzo, I assume this actually fixes a bug. Can we get any > more details about what happens when you hit the bug, and how you > reproduced it (what platform, driver, etc.)? It definitely fixes a bug. This has been found by running a KVM guest using kvmtool PCI emulation, where the following things happen: - Guest programs a virtual (bogus) interrupt number in the PCI device config space (virtio disk in this case) - kvmtool uses that interrupt number as is, without any other form of validation - Either the injection fails (because the interrupt is out of the range of the virtual interrupt controller) -> virtio PCI device goes dead - or the injection succeeds because this is a valid interrupt number, but signals an unrelated peripheral -> virtio PCI device goes dead. This can be trivially reproduced on any ARM PCI system that requires legacy interrupts (i.e. no MSI support), and that uses a GIC interrupt controller. Doing it in a VM is just much more convenient. Hope this helps, M. -- Jazz is not dead. It just smells funny... -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/