Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933155AbcDKNsU (ORCPT ); Mon, 11 Apr 2016 09:48:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45397 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932431AbcDKNsQ (ORCPT ); Mon, 11 Apr 2016 09:48:16 -0400 Date: Mon, 11 Apr 2016 16:48:06 +0300 From: "Michael S. Tsirkin" To: "Gabriel L. Somlo" Cc: Greg KH , robh+dt@kernel.org, pawel.moll@arm.com, mark.rutland@arm.com, ijc+devicetree@hellion.org.uk, galak@codeaurora.org, arnd@arndb.de, lersek@redhat.com, ralf@linux-mips.org, rmk+kernel@arm.linux.org.uk, eric@anholt.net, hanjun.guo@linaro.org, zajec5@gmail.com, sudeep.holla@arm.com, agross@codeaurora.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, devicetree@vger.kernel.org, qemu-devel@nongnu.org, imammedo@redhat.com, peter.maydell@linaro.org, leif.lindholm@linaro.org, ard.biesheuvel@linaro.org, pbonzini@redhat.com, kraxel@redhat.com, ehabkost@redhat.com, luto@amacapital.net, stefanha@gmail.com, revol@free.fr, matt@codeblueprint.co.uk, rth@twiddle.net Subject: Re: [PATCH v2] firmware: qemu_fw_cfg.c: hold ACPI global lock during device access Message-ID: <20160411164337-mutt-send-email-mst@redhat.com> References: <20160308183050.GJ2049@HEDWIG.INI.CMU.EDU> <20160316185440-mutt-send-email-mst@redhat.com> <20160317133340.GJ12454@HEDWIG.INI.CMU.EDU> <20160405114156-mutt-send-email-mst@redhat.com> <20160411131300.GW2060@HEDWIG.INI.CMU.EDU> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160411131300.GW2060@HEDWIG.INI.CMU.EDU> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 7766 Lines: 176 On Mon, Apr 11, 2016 at 09:13:00AM -0400, Gabriel L. Somlo wrote: > On Tue, Apr 05, 2016 at 11:54:19AM +0300, Michael S. Tsirkin wrote: > > On Thu, Mar 17, 2016 at 09:33:40AM -0400, Gabriel L. Somlo wrote: > > > On Wed, Mar 16, 2016 at 06:57:01PM +0200, Michael S. Tsirkin wrote: > > > > On Tue, Mar 08, 2016 at 01:30:50PM -0500, Gabriel Somlo wrote: > > > > > Allowing for the future possibility of implementing AML-based > > > > > (i.e., firmware-triggered) access to the QEMU fw_cfg device, > > > > > acquire the global ACPI lock when accessing the device on behalf > > > > > of the guest-side sysfs driver, to prevent any potential race > > > > > conditions. > > > > > > > > > > Suggested-by: Michael S. Tsirkin > > > > > Signed-off-by: Gabriel Somlo > > > > > > > > So this patch makes sense of course. > > > > > > > > > > > > Given the recent discussion on QEMU mailing list, > > > > I think there is an additional patch that we need: > > > > filter the files exposed to userspace by "opt/" prefix. > > > > > > > > This will ensure that we can change all other fw cfg files > > > > at will without breaking guest scripts. > > > > > > > > Gabriel, could you code this up? Or do you see a > > > > pressing need to expose internal QEMU registers to > > > > userspace? > > > > > > I'd be happy to update the docs to (better) emphasisze that: > > > > Well my experience shows people do not read the docs. > > And really, good interfaces should be self-documenting. > > > > > 1 the only way to guarantee any particular item shows up in > > > guest-side fw_cfg sysfs is manually putting it there via the > > > host-side command line > > > > > > - and BTW, unless you prefixed it with "opt/..." you > > > are off the reservation, and it might collide with > > > qemu->firmware communications. > > > > > > 2 anything one didn't place there themselves via the qemu > > > command line is informational only, might change or go away > > > at any time, and developing expectations about it based on > > > past observation is done at the observer's own risk. > > > > > > While I don't *personally* care about items outside of "opt/", I'm a bit > > > uncomfortable actively *hiding* them from userspace -- I could easily > > > imagine the ability to see (read-only) fw_cfg content from userspace > > > being a handy debugging/troubleshooting tool. It's back to separating > > > between mechanism and policy: hiding things from userspace would IMHO > > > fall into the policy enforcement side of things, and I'm still unclear > > > about the failure scenario we'd be trying to prevent, and its likelihood. > > > > > > Thanks, > > > --Gabriel > > > > Mostly, we can change internal qemu/firmware interfaces > > as long as we verify that firmware that ships with QEMU > > does not rely on them. > > > > I'm fine with exposing stuff for debugging purposes > > but I would like a cleaner separation between the two, > > and self-documenting interfaces. > > How about: > > - place everything that is under "opt/" in e.g. "supported" > > directory, or at root > > - place everything that is not under "opt/" in e.g. "unsupported" > > directory > > > > Abstracting hardware is what OS is all about, this is not policy. > > I'm not sure I agree with this last point: > > Arguably, fw_cfg could be viewed as a glorified out-of-band USB stick > with special files prepared by QEMU for the guest VM. > > The sysfs driver is a mechanism to list/access these files, and is > IMHO the only thing one can reasonably construe as "kernel interface". > > What you're suggesting boils down to adding a translation layer between > what QEMU names the files when preparing this magic USB stick, and what > we tell users the names are (by adding additional folders named e.g. > "supported" and "unsupported"). > > That to me looks like injecting policy ("look *here*, NOT there!") by > doing this, instead of sticking with mechanism only ("here's what qemu > wrote to fw_cfg, look at it if you want, or don't..."). It's a mechanism really. We have a mechanism to affect the names of files in guest. What I'm saying is it would be nice to have a mechanism for QEMU to tell guest "hidden file". Consider that ACPI has a "hidden" attribute for devices. This is more of the same. > While I understand your concerns, I'm not sure we should have to go > through this level of convolution to protect people from their own > mistakes (such as assuming certain content on the magic USB stick will > always be there, and writing some sort of script which would break if > said content mysteriously disappears, then reasonably complain about > either the sysfs kernel driver or qemu itself). Presence or absence of > some file on a magic USB stick does NOT (again, IMHO) an interface make... > > I was thinking of maybe adding a module parameter, let's call it > "show-all", off by default, and which would cause the "by-name" folder > to only be populated by things starting with "opt" when off, and > all fw-cfg files when enabled. But I'm not sure I like having to do it > in the first place (particularly hardcoding the string "opt" anywhere > in the driver :) ) so let me think about this a bit more (additional > pro/con thoughs and opinions welcome!)... > > Thanks, > --Gabriel the "opt/" string is part of hardware - you already hardcore e.g. the acpi ID, correct? That's just more of the same IMHO. > > > > > > > --- > > > > > > > > > > Changes since v1: > > > > > - no more "#ifdef CONFIG_ACPI"; instead we proceed if > > > > > acpi_acquire_global_lock() returns either OK or NOT_CONFIGURED, > > > > > and only throw a warning/error message otherwise. > > > > > > > > > > - didn't get any *negative* feedback from the QEMU crowd, so > > > > > this is now a bona-fide "please apply this", rather than just > > > > > an RFC :) > > > > > > > > > > - tested on ACPI-enabled x86_64, and acpi_less ARM (32 and 64 bit) > > > > > QEMU VMs (I don't have handy access to an ACPI-enabled ARM VM) > > > > > > > > > > Thanks much, > > > > > --Gabriel > > > > > > > > > > drivers/firmware/qemu_fw_cfg.c | 16 ++++++++++++++++ > > > > > 1 file changed, 16 insertions(+) > > > > > > > > > > diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c > > > > > index 7bba76c..a44dc32 100644 > > > > > --- a/drivers/firmware/qemu_fw_cfg.c > > > > > +++ b/drivers/firmware/qemu_fw_cfg.c > > > > > @@ -77,12 +77,28 @@ static inline u16 fw_cfg_sel_endianness(u16 key) > > > > > static inline void fw_cfg_read_blob(u16 key, > > > > > void *buf, loff_t pos, size_t count) > > > > > { > > > > > + u32 glk; > > > > > + acpi_status status; > > > > > + > > > > > + /* If we have ACPI, ensure mutual exclusion against any potential > > > > > + * device access by the firmware, e.g. via AML methods: > > > > > + */ > > > > > + status = acpi_acquire_global_lock(ACPI_WAIT_FOREVER, &glk); > > > > > + if (ACPI_FAILURE(status) && status != AE_NOT_CONFIGURED) { > > > > > + /* Should never get here */ > > > > > + WARN(1, "fw_cfg_read_blob: Failed to lock ACPI!\n"); > > > > > + memset(buf, 0, count); > > > > > + return; > > > > > + } > > > > > + > > > > > mutex_lock(&fw_cfg_dev_lock); > > > > > iowrite16(fw_cfg_sel_endianness(key), fw_cfg_reg_ctrl); > > > > > while (pos-- > 0) > > > > > ioread8(fw_cfg_reg_data); > > > > > ioread8_rep(fw_cfg_reg_data, buf, count); > > > > > mutex_unlock(&fw_cfg_dev_lock); > > > > > + > > > > > + acpi_release_global_lock(glk); > > > > > } > > > > > > > > > > /* clean up fw_cfg device i/o */ > > > > > -- > > > > > 2.4.3