From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7753C4338F for ; Thu, 19 Aug 2021 08:04:50 +0000 (UTC) Received: from mm01.cs.columbia.edu (mm01.cs.columbia.edu [128.59.11.253]) by mail.kernel.org (Postfix) with ESMTP id 43B076113B for ; Thu, 19 Aug 2021 08:04:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 43B076113B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.cs.columbia.edu Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id D76954B0F9; Thu, 19 Aug 2021 04:04:49 -0400 (EDT) X-Virus-Scanned: at lists.cs.columbia.edu Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iJefLIAQVziH; Thu, 19 Aug 2021 04:04:45 -0400 (EDT) Received: from mm01.cs.columbia.edu (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 29F574B0FB; Thu, 19 Aug 2021 04:04:45 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 578EA4B0F9 for ; Thu, 19 Aug 2021 04:04:44 -0400 (EDT) X-Virus-Scanned: at lists.cs.columbia.edu Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yHyVlTFN55sn for ; Thu, 19 Aug 2021 04:04:43 -0400 (EDT) Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by mm01.cs.columbia.edu (Postfix) with ESMTPS id 289174B0F7 for ; Thu, 19 Aug 2021 04:04:43 -0400 (EDT) Received: from disco-boy.misterjones.org (disco-boy.misterjones.org [51.254.78.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9A0B86113A; Thu, 19 Aug 2021 08:04:40 +0000 (UTC) Received: from sofa.misterjones.org ([185.219.108.64] helo=why.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1mGd2U-005vFh-HF; Thu, 19 Aug 2021 09:04:38 +0100 Date: Thu, 19 Aug 2021 09:04:38 +0100 Message-ID: <877dghsvvt.wl-maz@kernel.org> From: Marc Zyngier To: Oliver Upton Subject: Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq In-Reply-To: References: <20210818213205.598471-1-ricarkol@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/27.1 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: oupton@google.com, ricarkol@google.com, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, james.morse@arm.com, Alexandru.Elisei@arm.com, drjones@redhat.com, catalin.marinas@arm.com, suzuki.poulose@arm.com, jingzhangos@google.com, pshier@google.com, rananta@google.com, reijiw@google.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false Cc: kvm@vger.kernel.org, catalin.marinas@arm.com, pshier@google.com, rananta@google.com, kvmarm@lists.cs.columbia.edu X-BeenThere: kvmarm@lists.cs.columbia.edu X-Mailman-Version: 2.1.14 Precedence: list List-Id: Where KVM/ARM decisions are made List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu On Thu, 19 Aug 2021 08:41:19 +0100, Oliver Upton wrote: > > On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller wrote: > > > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > > Hi Ricardo, > > > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller wrote: > > > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > > reference to a struct irq. It warns whenever intid is not a valid number > > > > (like when it's a reserved IRQ number). The issue is that this warning > > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > > > Signed-off-by: Ricardo Koller > > > > --- > > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > > 1 file changed, 1 deletion(-) > > > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > > index 111bff47e471..81cec508d413 100644 > > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > > if (intid >= VGIC_MIN_LPI) > > > > return vgic_get_lpi(kvm, intid); > > > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > > > > Was thinking about that, until I found this in bug.h: > > > > /* > > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > > * significant kernel issues that need prompt attention if they should ever > > * appear at runtime. > > * > > * Do not use these macros when checking for invalid external inputs > > * (e.g. invalid system call arguments, or invalid data coming from > > * network/devices), > > > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > > 1020). I think it's more appropriate for the vmm to log it. What do you > > think? > > vgic_get_irq() is called in a bunch of other places though, right? > IOW, intid doesn't necessarily come from userspace. In fact, I believe > KVM_IRQ_LINE is the only place we pass a value from userspace to > vgic_get_irq() (don't quote me on that). > > Perhaps instead the fix could be to explicitly check that the intid > from userspace is valid and exit early rather than count on > vgic_get_irq() to do the right thing. vgic_get_irq() is designed to do the right thing. Returning NULL is the way it reports an error, and this NULL value is already checked at when directly provided either by the VMM or the guest. If we missed any of those, that would be what needs addressing. Obtaining a NULL pointer is a good way to catch those. In general, the kernel log is not how we report userspace errors (we have been there before...). It is slow, noisy, unclear and ultimately leaks information. If you really want something, then a pr_debug is a potential tool as it can be dynamically enabled with the right configuration. Thanks, M. -- Without deviation from the norm, progress is not possible. _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21181C4320E for ; Thu, 19 Aug 2021 08:05:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0D9F161154 for ; Thu, 19 Aug 2021 08:05:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237131AbhHSIF7 (ORCPT ); Thu, 19 Aug 2021 04:05:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:42734 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237290AbhHSIFa (ORCPT ); Thu, 19 Aug 2021 04:05:30 -0400 Received: from disco-boy.misterjones.org (disco-boy.misterjones.org [51.254.78.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9A0B86113A; Thu, 19 Aug 2021 08:04:40 +0000 (UTC) Received: from sofa.misterjones.org ([185.219.108.64] helo=why.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1mGd2U-005vFh-HF; Thu, 19 Aug 2021 09:04:38 +0100 Date: Thu, 19 Aug 2021 09:04:38 +0100 Message-ID: <877dghsvvt.wl-maz@kernel.org> From: Marc Zyngier To: Oliver Upton Cc: Ricardo Koller , kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, james.morse@arm.com, Alexandru.Elisei@arm.com, drjones@redhat.com, catalin.marinas@arm.com, suzuki.poulose@arm.com, jingzhangos@google.com, pshier@google.com, rananta@google.com, reijiw@google.com Subject: Re: [PATCH] KVM: arm64: vgic: drop WARN from vgic_get_irq In-Reply-To: References: <20210818213205.598471-1-ricarkol@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/27.1 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: oupton@google.com, ricarkol@google.com, kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org, james.morse@arm.com, Alexandru.Elisei@arm.com, drjones@redhat.com, catalin.marinas@arm.com, suzuki.poulose@arm.com, jingzhangos@google.com, pshier@google.com, rananta@google.com, reijiw@google.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org On Thu, 19 Aug 2021 08:41:19 +0100, Oliver Upton wrote: > > On Wed, Aug 18, 2021 at 2:45 PM Ricardo Koller wrote: > > > > On Wed, Aug 18, 2021 at 02:34:03PM -0700, Oliver Upton wrote: > > > Hi Ricardo, > > > > > > On Wed, Aug 18, 2021 at 2:32 PM Ricardo Koller wrote: > > > > > > > > vgic_get_irq(intid) is used all over the vgic code in order to get a > > > > reference to a struct irq. It warns whenever intid is not a valid number > > > > (like when it's a reserved IRQ number). The issue is that this warning > > > > can be triggered from userspace (e.g., KVM_IRQ_LINE for intid 1020). > > > > > > > > Drop the WARN call from vgic_get_irq. > > > > > > > > Signed-off-by: Ricardo Koller > > > > --- > > > > arch/arm64/kvm/vgic/vgic.c | 1 - > > > > 1 file changed, 1 deletion(-) > > > > > > > > diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c > > > > index 111bff47e471..81cec508d413 100644 > > > > --- a/arch/arm64/kvm/vgic/vgic.c > > > > +++ b/arch/arm64/kvm/vgic/vgic.c > > > > @@ -106,7 +106,6 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, > > > > if (intid >= VGIC_MIN_LPI) > > > > return vgic_get_lpi(kvm, intid); > > > > > > > > - WARN(1, "Looking up struct vgic_irq for reserved INTID"); > > > > > > Could we maybe downgrade the message to WARN_ONCE() (to get a stack) > > > or pr_warn_ratelimited()? I agree it is problematic that userspace can > > > cause this WARN to fire, but it'd be helpful for debugging too. > > > > > > > Was thinking about that, until I found this in bug.h: > > > > /* > > * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report > > * significant kernel issues that need prompt attention if they should ever > > * appear at runtime. > > * > > * Do not use these macros when checking for invalid external inputs > > * (e.g. invalid system call arguments, or invalid data coming from > > * network/devices), > > > > Just in case, KVM_IRQ_LINE returns -EINVAL for an invalid intid (like > > 1020). I think it's more appropriate for the vmm to log it. What do you > > think? > > vgic_get_irq() is called in a bunch of other places though, right? > IOW, intid doesn't necessarily come from userspace. In fact, I believe > KVM_IRQ_LINE is the only place we pass a value from userspace to > vgic_get_irq() (don't quote me on that). > > Perhaps instead the fix could be to explicitly check that the intid > from userspace is valid and exit early rather than count on > vgic_get_irq() to do the right thing. vgic_get_irq() is designed to do the right thing. Returning NULL is the way it reports an error, and this NULL value is already checked at when directly provided either by the VMM or the guest. If we missed any of those, that would be what needs addressing. Obtaining a NULL pointer is a good way to catch those. In general, the kernel log is not how we report userspace errors (we have been there before...). It is slow, noisy, unclear and ultimately leaks information. If you really want something, then a pr_debug is a potential tool as it can be dynamically enabled with the right configuration. Thanks, M. -- Without deviation from the norm, progress is not possible.