All of lore.kernel.org
 help / color / mirror / Atom feed
From: mtosatti@redhat.com
To: kvm@vger.kernel.org
Cc: avi@redhat.com, sheng.yang@intel.com,
	Marcelo Tosatti <mtosatti@redhat.com>
Subject: [patch 4/4] KVM: protect assigned dev workqueue, int handler and irq acker
Date: Thu, 07 May 2009 17:55:13 -0300	[thread overview]
Message-ID: <20090507205536.909542377@amt.cnet> (raw)
In-Reply-To: <20090507205509.522421993@amt.cnet>

[-- Attachment #1: dev-ass-protect-irq-ack --]
[-- Type: text/plain, Size: 3763 bytes --]

kvm_assigned_dev_ack_irq is vulnerable to a race condition with the
interrupt handler function. It does:

        if (dev->host_irq_disabled) {
                enable_irq(dev->host_irq);
                dev->host_irq_disabled = false;
        }

If an interrupt triggers before the host->dev_irq_disabled assignment,
it will disable the interrupt and set dev->host_irq_disabled to true.

On return to kvm_assigned_dev_ack_irq, dev->host_irq_disabled is set to
false, and the next kvm_assigned_dev_ack_irq call will fail to reenable
it.

Other than that, having the interrupt handler and work handlers run in
parallel sounds like asking for trouble (could not spot any obvious
problem, but better not have to, its fragile).

CC: sheng.yang@intel.com
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Index: kvm-pending/include/linux/kvm_host.h
===================================================================
--- kvm-pending.orig/include/linux/kvm_host.h
+++ kvm-pending/include/linux/kvm_host.h
@@ -346,6 +346,7 @@ struct kvm_assigned_dev_kernel {
 	int flags;
 	struct pci_dev *dev;
 	struct kvm *kvm;
+	spinlock_t assigned_dev_lock;
 };
 
 struct kvm_irq_mask_notifier {
Index: kvm-pending/virt/kvm/kvm_main.c
===================================================================
--- kvm-pending.orig/virt/kvm/kvm_main.c
+++ kvm-pending/virt/kvm/kvm_main.c
@@ -42,6 +42,7 @@
 #include <linux/mman.h>
 #include <linux/swap.h>
 #include <linux/bitops.h>
+#include <linux/spinlock.h>
 
 #include <asm/processor.h>
 #include <asm/io.h>
@@ -130,6 +131,7 @@ static void kvm_assigned_dev_interrupt_w
 	 * finer-grained lock, update this
 	 */
 	mutex_lock(&kvm->lock);
+	spin_lock_irq(&assigned_dev->assigned_dev_lock);
 	if (assigned_dev->irq_requested_type & KVM_DEV_IRQ_HOST_MSIX) {
 		struct kvm_guest_msix_entry *guest_entries =
 			assigned_dev->guest_msix_entries;
@@ -156,18 +158,21 @@ static void kvm_assigned_dev_interrupt_w
 		}
 	}
 
+	spin_unlock_irq(&assigned_dev->assigned_dev_lock);
 	mutex_unlock(&assigned_dev->kvm->lock);
 }
 
 static irqreturn_t kvm_assigned_dev_intr(int irq, void *dev_id)
 {
+	unsigned long flags;
 	struct kvm_assigned_dev_kernel *assigned_dev =
 		(struct kvm_assigned_dev_kernel *) dev_id;
 
+	spin_lock_irqsave(&assigned_dev->assigned_dev_lock, flags);
 	if (assigned_dev->irq_requested_type & KVM_DEV_IRQ_HOST_MSIX) {
 		int index = find_index_from_host_irq(assigned_dev, irq);
 		if (index < 0)
-			return IRQ_HANDLED;
+			goto out;
 		assigned_dev->guest_msix_entries[index].flags |=
 			KVM_ASSIGNED_MSIX_PENDING;
 	}
@@ -177,6 +182,8 @@ static irqreturn_t kvm_assigned_dev_intr
 	disable_irq_nosync(irq);
 	assigned_dev->host_irq_disabled = true;
 
+out:
+	spin_unlock_irqrestore(&assigned_dev->assigned_dev_lock, flags);
 	return IRQ_HANDLED;
 }
 
@@ -184,6 +191,7 @@ static irqreturn_t kvm_assigned_dev_intr
 static void kvm_assigned_dev_ack_irq(struct kvm_irq_ack_notifier *kian)
 {
 	struct kvm_assigned_dev_kernel *dev;
+	unsigned long flags;
 
 	if (kian->gsi == -1)
 		return;
@@ -196,10 +204,12 @@ static void kvm_assigned_dev_ack_irq(str
 	/* The guest irq may be shared so this ack may be
 	 * from another device.
 	 */
+	spin_lock_irqsave(&dev->assigned_dev_lock, flags);
 	if (dev->host_irq_disabled) {
 		enable_irq(dev->host_irq);
 		dev->host_irq_disabled = false;
 	}
+	spin_unlock_irqrestore(&dev->assigned_dev_lock, flags);
 }
 
 static void deassign_guest_irq(struct kvm *kvm,
@@ -615,6 +625,7 @@ static int kvm_vm_ioctl_assign_device(st
 	match->host_devfn = assigned_dev->devfn;
 	match->flags = assigned_dev->flags;
 	match->dev = dev;
+	spin_lock_init(&match->assigned_dev_lock);
 	match->irq_source_id = -1;
 	match->kvm = kvm;
 	match->ack_notifier.irq_acked = kvm_assigned_dev_ack_irq;



  parent reply	other threads:[~2009-05-07 21:09 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-04-27 21:07 [patch 0/4] use smp_send_reschedule in vcpu_kick / assigned dev host intx race fix mtosatti
2009-04-27 21:07 ` [patch 1/4] qemu: external module: smp_send_reschedule compat mtosatti
2009-05-07 13:28   ` Avi Kivity
2009-04-27 21:07 ` [patch 2/4] KVM: x86: wake up waitqueue before calling get_cpu() mtosatti
2009-04-27 21:07 ` [patch 3/4] KVM: use smp_send_reschedule in kvm_vcpu_kick mtosatti
2009-04-27 21:07 ` [patch 4/4] KVM: protect assigned dev workqueue, int handler and irq acker mtosatti
2009-04-28  7:08 ` [patch 0/4] use smp_send_reschedule in vcpu_kick / assigned dev host intx race fix Sheng Yang
2009-04-29 17:47   ` Marcelo Tosatti
2009-04-30  0:56     ` Sheng Yang
2009-04-30  1:59       ` Sheng Yang
2009-05-06  5:07         ` Sheng Yang
2009-05-07 13:21           ` Avi Kivity
2009-05-07 20:55             ` [patch 0/4] smp_send_reschedule / assigned dev host intx race v2 mtosatti
2009-05-07 20:55               ` [patch 1/4] kvm-kmod: nr_cpu_ids compat mtosatti
2009-05-07 20:55               ` [patch 2/4] kvm-kmod: smp_send_reschedule compat mtosatti
2009-05-07 20:55               ` [patch 3/4] KVM: use smp_send_reschedule in kvm_vcpu_kick mtosatti
2009-05-08  7:13                 ` Gleb Natapov
2009-05-07 20:55               ` mtosatti [this message]
2009-05-10 16:31               ` [patch 0/4] smp_send_reschedule / assigned dev host intx race v2 Avi Kivity

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20090507205536.909542377@amt.cnet \
    --to=mtosatti@redhat.com \
    --cc=avi@redhat.com \
    --cc=kvm@vger.kernel.org \
    --cc=sheng.yang@intel.com \
    --subject='Re: [patch 4/4] KVM: protect assigned dev workqueue, int handler and irq acker' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.