From: Christoffer Dall <cdall@linaro.org>

Date: Tue, 16 May 2017 12:41:18 +0200

Subject: KVM: arm/arm64: Disallow userspace control of in-kernel IRQ lines

Patch-mainline: v4.13-rc1

Git-commit: cb3f0ad881a6cee39c6a652b4aa4f12f341d98f0

References: bsc#1077761

When injecting an IRQ to the VGIC, you now have to present an owner

token for that IRQ line to show that you are the owner of that line.

IRQ lines driven from userspace or via an irqfd do not have an owner and

will simply pass a NULL pointer.

Also get rid of the unused kvm_vgic_inject_mapped_irq prototype.

Signed-off-by: Christoffer Dall <cdall@linaro.org>

Acked-by: Marc Zyngier <marc.zyngier@arm.com>

Acked-by: Alexander Graf <agraf@suse.de>

---

 include/kvm/arm_vgic.h         |    4 +---

 virt/kvm/arm/arch_timer.c      |    3 ++-

 virt/kvm/arm/arm.c             |    4 ++--

 virt/kvm/arm/pmu.c             |    3 ++-

 virt/kvm/arm/vgic/vgic-irqfd.c |    2 +-

 virt/kvm/arm/vgic/vgic.c       |   15 +++++++++++----

 6 files changed, 19 insertions(+), 12 deletions(-)

--- a/include/kvm/arm_vgic.h

+++ b/include/kvm/arm_vgic.h

@@ -303,9 +303,7 @@

 void kvm_vgic_init_cpu_hardware(void);

 int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int intid,

-			bool level);

-int kvm_vgic_inject_mapped_irq(struct kvm *kvm, int cpuid, unsigned int intid,

-			       bool level);

+			bool level, void *owner);

 int kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu, u32 virt_irq, u32 phys_irq);

 int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, unsigned int virt_irq);

 bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, unsigned int virt_irq);

--- a/virt/kvm/arm/arch_timer.c

+++ b/virt/kvm/arm/arch_timer.c

@@ -226,7 +226,8 @@

 	if (likely(irqchip_in_kernel(vcpu->kvm))) {

 		ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,

 					  timer_ctx->irq.irq,

-					  timer_ctx->irq.level);

+					  timer_ctx->irq.level,

+					  timer_ctx);

 		WARN_ON(ret);

 	}

 }

--- a/virt/kvm/arm/arm.c

+++ b/virt/kvm/arm/arm.c

@@ -832,7 +832,7 @@

 		if (irq_num < VGIC_NR_SGIS || irq_num >= VGIC_NR_PRIVATE_IRQS)

 			return -EINVAL;

-		return kvm_vgic_inject_irq(kvm, vcpu->vcpu_id, irq_num, level);

+		return kvm_vgic_inject_irq(kvm, vcpu->vcpu_id, irq_num, level, NULL);

 	case KVM_ARM_IRQ_TYPE_SPI:

 		if (!irqchip_in_kernel(kvm))

 			return -ENXIO;

@@ -840,7 +840,7 @@

 		if (irq_num < VGIC_NR_PRIVATE_IRQS)

 			return -EINVAL;

-		return kvm_vgic_inject_irq(kvm, 0, irq_num, level);

+		return kvm_vgic_inject_irq(kvm, 0, irq_num, level, NULL);

 	}

 	return -EINVAL;

--- a/virt/kvm/arm/pmu.c

+++ b/virt/kvm/arm/pmu.c

@@ -215,7 +215,8 @@

 	if (likely(irqchip_in_kernel(vcpu->kvm))) {

 		int ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,

-					      pmu->irq_num, overflow);

+					      pmu->irq_num, overflow,

+					      &vcpu->arch.pmu);

 		WARN_ON(ret);

 	}

 }

--- a/virt/kvm/arm/vgic/vgic-irqfd.c

+++ b/virt/kvm/arm/vgic/vgic-irqfd.c

@@ -34,7 +34,7 @@

 	if (!vgic_valid_spi(kvm, spi_id))

 		return -EINVAL;

-	return kvm_vgic_inject_irq(kvm, 0, spi_id, level);

+	return kvm_vgic_inject_irq(kvm, 0, spi_id, level, NULL);

 }

 /**

--- a/virt/kvm/arm/vgic/vgic.c

+++ b/virt/kvm/arm/vgic/vgic.c

@@ -235,10 +235,14 @@

 /*

  * Only valid injection if changing level for level-triggered IRQs or for a

- * rising edge.

+ * rising edge, and in-kernel connected IRQ lines can only be controlled by

+ * their owner.

  */

-static bool vgic_validate_injection(struct vgic_irq *irq, bool level)

+static bool vgic_validate_injection(struct vgic_irq *irq, bool level, void *owner)

 {

+	if (irq->owner != owner)

+		return false;

+

 	switch (irq->config) {

 	case VGIC_CONFIG_LEVEL:

 		return irq->line_level != level;

@@ -350,13 +354,16 @@

  *			      false: to ignore the call

  *	     Level-sensitive  true:  raise the input signal

  *			      false: lower the input signal

+ * @owner:   The opaque pointer to the owner of the IRQ being raised to verify

+ *           that the caller is allowed to inject this IRQ.  Userspace

+ *           injections will have owner == NULL.

  *

  * The VGIC is not concerned with devices being active-LOW or active-HIGH for

  * level-sensitive interrupts.  You can think of the level parameter as 1

  * being HIGH and 0 being LOW and all devices being active-HIGH.

  */

 int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int intid,

-			bool level)

+			bool level, void *owner)

 {

 	struct kvm_vcpu *vcpu;

 	struct vgic_irq *irq;

@@ -378,7 +385,7 @@

 	spin_lock(&irq->irq_lock);

-	if (!vgic_validate_injection(irq, level)) {

+	if (!vgic_validate_injection(irq, level, owner)) {

 		/* Nothing to see here, move along... */

 		spin_unlock(&irq->irq_lock);

 		vgic_put_irq(kvm, irq);