From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mm01.cs.columbia.edu (mm01.cs.columbia.edu [128.59.11.253]) by smtp.lore.kernel.org (Postfix) with ESMTP id 234DEC433F5 for ; Mon, 29 Nov 2021 17:53:59 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id A69564B1AC; Mon, 29 Nov 2021 12:53:58 -0500 (EST) X-Virus-Scanned: at lists.cs.columbia.edu Authentication-Results: mm01.cs.columbia.edu (amavisd-new); dkim=softfail (fail, message has been altered) header.i=@gmail.com Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EzLazPudFK5a; Mon, 29 Nov 2021 12:53:57 -0500 (EST) Received: from mm01.cs.columbia.edu (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 570194B1B0; Mon, 29 Nov 2021 12:53:57 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by mm01.cs.columbia.edu (Postfix) with ESMTP id 86B6E4B1AC for ; Mon, 29 Nov 2021 12:53:56 -0500 (EST) X-Virus-Scanned: at lists.cs.columbia.edu Received: from mm01.cs.columbia.edu ([127.0.0.1]) by localhost (mm01.cs.columbia.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sGXJKVMDn-ul for ; Mon, 29 Nov 2021 12:53:55 -0500 (EST) Received: from mail-ed1-f48.google.com (mail-ed1-f48.google.com [209.85.208.48]) by mm01.cs.columbia.edu (Postfix) with ESMTPS id 3B15F4B1A3 for ; Mon, 29 Nov 2021 12:53:55 -0500 (EST) Received: by mail-ed1-f48.google.com with SMTP id o20so75036859eds.10 for ; Mon, 29 Nov 2021 09:53:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=sender:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=E58dL1Cy0ML/Fq7U+4vMD/XpyhySESNFxGtsJEr0iGA5QuLlhcOX/A4/jdDRZEzDIQ fPsLvJxXz3PX63V9su/FgauAMqwxco+y+olI1dCd3mpfxLlYlBPlhWOjrxeLq9guNxSM eEfi9IneXptokJh8diXl/ugbj5GCH/6ELhKn4aofNdddGLZ+OqUWg1z9TxLUnKXffmNg lUaqpY0k7AwGkJ3OL2ZtKNoHyBmTZ4KtwmtpxoPlTCt2JnQOPjXQ7vH4M7rfgBjlRgND uViwUXN3LorpSW+ON86lkQL5g7/VvacQD/GzeWK08eJHfKwJKQfnwt7i4lLeeVe5Mvw/ ad3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:sender:message-id:date:mime-version:user-agent :subject:content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=oH7kh9dlrYcUzIA5GUPYXzKFsX4W9utF1vbCEqBit4G8aOeNxCYED7fW4l9cbxp2CU t+L+bQzTsoUIg4vhYTFbQv2Rd/egV456swwzqVPige6xBi7CuQa+WtPb1ummsoL+5gma 8rL7HauwBwKC7ioCeG5XTuMAfwluSWVl5UVqV11cHZ6OdjMfMSMhHqbduYy0vqT8FssI CkYQa6LkFPckiXOJhECaFN5tp9pfggOgmTvPKyjRaYPYWFBZt5izVoRAjD7pwmJhO8du G58teghM7g5sJIPSNaovNc0PrBnV1OIFdkFmqoHQjqrk5N6Ltq5lS6mgSCnKMHrK/JBa kuzQ== X-Gm-Message-State: AOAM532GBl1CfkgFEVz7xOAFE1XexRfYclamY1BcG/txAQ3x3Kqj3OVI rvgHU5ethXXQcPkAQKV3B+o= X-Google-Smtp-Source: ABdhPJyEFZTCnn35jIBM5GkhncH3CSPbL5gmVmWsUh9Tr+ztH5c8bc9QO9Acd3UAKwaA5P3qYhybfg== X-Received: by 2002:a05:6402:2744:: with SMTP id z4mr77472004edd.310.1638208434290; Mon, 29 Nov 2021 09:53:54 -0800 (PST) Received: from ?IPV6:2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e? ([2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e]) by smtp.googlemail.com with ESMTPSA id gt18sm7974997ejc.46.2021.11.29.09.53.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 29 Nov 2021 09:53:53 -0800 (PST) Message-ID: <496c2fc6-26b0-9b5d-32f4-2f9e9dd6a064@redhat.com> Date: Mon, 29 Nov 2021 18:53:48 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 Subject: Re: [PATCH v2 11/43] KVM: Don't block+unblock when halt-polling is successful Content-Language: en-US To: Sean Christopherson , Maxim Levitsky References: <20211009021236.4122790-1-seanjc@google.com> <20211009021236.4122790-12-seanjc@google.com> <4e883728e3e5201a94eb46b56315afca5e95ad9c.camel@redhat.com> From: Paolo Bonzini In-Reply-To: Cc: Cornelia Huck , Wanpeng Li , kvm@vger.kernel.org, David Hildenbrand , linux-kernel@vger.kernel.org, Paul Mackerras , Atish Patra , linux-riscv@lists.infradead.org, Claudio Imbrenda , kvmarm@lists.cs.columbia.edu, Janosch Frank , Marc Zyngier , Joerg Roedel , Huacai Chen , Christian Borntraeger , Aleksandar Markovic , Albert Ou , kvm-ppc@vger.kernel.org, Paul Walmsley , David Matlack , linux-arm-kernel@lists.infradead.org, Jim Mattson , Anup Patel , linux-mips@vger.kernel.org, Palmer Dabbelt , kvm-riscv@lists.infradead.org, Vitaly Kuznetsov X-BeenThere: kvmarm@lists.cs.columbia.edu X-Mailman-Version: 2.1.14 Precedence: list List-Id: Where KVM/ARM decisions are made List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: kvmarm-bounces@lists.cs.columbia.edu Sender: kvmarm-bounces@lists.cs.columbia.edu On 11/29/21 18:25, Sean Christopherson wrote: > If a posted interrupt arrives after KVM has done its final search through the vIRR, > but before avic_update_iommu_vcpu_affinity() is called, the posted interrupt will > be set in the vIRR without triggering a host IRQ to wake the vCPU via the GA log. > > I.e. KVM is missing an equivalent to VMX's posted interrupt check for an outstanding > notification after switching to the wakeup vector. BTW Maxim reported that it can break even without assigned devices. > For now, the least awful approach is sadly to keep the vcpu_(un)blocking() hooks. I agree that the hooks cannot be dropped but the bug is reproducible with this patch, where the hooks are still there. With the hooks in place, you have: kvm_vcpu_blocking(vcpu) avic_set_running(vcpu, false) avic_vcpu_put(vcpu) avic_update_iommu_vcpu_affinity() WRITE_ONCE(...) // clear IS_RUNNING bit set_current_state() smp_mb() kvm_vcpu_check_block() return kvm_arch_vcpu_runnable() || ... return kvm_vcpu_has_events() || ... return kvm_cpu_has_interrupt() || ... return kvm_apic_has_interrupt() || ... return apic_has_interrupt_for_ppr() apic_find_highest_irr() scan vIRR This covers the barrier between the write of is_running and the read of vIRR, and the other side should be correct as well. in particular, reads of is_running always come after an atomic write to vIRR, and hence after an implicit full memory barrier. svm_deliver_avic_intr() has an smp_mb__after_atomic() after writing IRR; avic_kick_target_vcpus() even has an explicit barrier in srcu_read_lock(), between the microcode's write to vIRR and its own call to avic_vcpu_is_running(). Still it does seem to be a race that happens when IS_RUNNING=true but vcpu->mode == OUTSIDE_GUEST_MODE. This patch makes the race easier to trigger because it moves IS_RUNNING=false later. Paolo _______________________________________________ kvmarm mailing list kvmarm@lists.cs.columbia.edu https://lists.cs.columbia.edu/mailman/listinfo/kvmarm From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 42539C433F5 for ; Mon, 29 Nov 2021 17:54:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=esqNsUhqT9iMQ+hpOXMdPXJYEQZ3z2BYBKnJDejQ93c=; b=BBs6obEAVVvlaG eCsDbvtwpAIZwjbxZoeBDdl5Pju1Yac79KjdLN+e3/KNNWEeH+6In+ukB/yYesnt5RoUladrDqTah IoTAKezBWMFL+yP6xd6V+ztpBVS20bisnuLXrn4LfZHdho1wNOdWBPbgvkhlSWobJlsJScPd9Jgcb 5TpHbtdfqj29zkEE5Ug7KOWeIxdm2Mq2q5oeww9qLeKhPVagaDMMYm5aJ1Je4a4Fe60SCEudYYRAk 3saP+e5nd6lpETHsN0FGn+p/E+LJ9l3XhUds2zZeTTZ//9mIkzh6gHOuoUDC9lBGWJwZYiFFpw/M+ b+uLrdg+1ILc5eoYIIhA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mrkr3-001euA-Nf; Mon, 29 Nov 2021 17:54:17 +0000 Received: from mail-ed1-x533.google.com ([2a00:1450:4864:20::533]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mrkqj-001enN-Jl; Mon, 29 Nov 2021 17:53:58 +0000 Received: by mail-ed1-x533.google.com with SMTP id r11so75534086edd.9; Mon, 29 Nov 2021 09:53:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=sender:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=E58dL1Cy0ML/Fq7U+4vMD/XpyhySESNFxGtsJEr0iGA5QuLlhcOX/A4/jdDRZEzDIQ fPsLvJxXz3PX63V9su/FgauAMqwxco+y+olI1dCd3mpfxLlYlBPlhWOjrxeLq9guNxSM eEfi9IneXptokJh8diXl/ugbj5GCH/6ELhKn4aofNdddGLZ+OqUWg1z9TxLUnKXffmNg lUaqpY0k7AwGkJ3OL2ZtKNoHyBmTZ4KtwmtpxoPlTCt2JnQOPjXQ7vH4M7rfgBjlRgND uViwUXN3LorpSW+ON86lkQL5g7/VvacQD/GzeWK08eJHfKwJKQfnwt7i4lLeeVe5Mvw/ ad3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:sender:message-id:date:mime-version:user-agent :subject:content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=vfu4Cd9k4+GzLcR8vil0uS88vqzqNb0IhlbcqRNGz47rNIE+IQic4kH7Z8XFNL55XR 4N6y/tmeY45kJwM5gABP7zz0Hsv5V2bf1CLqkXr/cTg8Spznr7zCPBiDVfJ+uzgR94+N hzQSJ9OXD4RiDAvZTiEFYB9rMVPqIr1SQ55RQweT54aSYtLXxK7O10Jqs4ooAhcrLO2P +QGA8ZiXNzEts/i/ia2cHJK1bhsxa09VKjf58yp2CahDShNfts8eDx41OLolo7YEEo66 rhKTiuA7zSO8bOkrb/q2gEFqMXs4d0BYh5QGK0ZhyXIKeifmpzqLvfo+LvfX3apSvXN1 SpAQ== X-Gm-Message-State: AOAM533VGROaEQ3ehp7UPucbAUz4QKE47cBmvHafL0sXg4rT642dAdZN uNPKc2EUV76G6F81JmeRbJs= X-Google-Smtp-Source: ABdhPJyEFZTCnn35jIBM5GkhncH3CSPbL5gmVmWsUh9Tr+ztH5c8bc9QO9Acd3UAKwaA5P3qYhybfg== X-Received: by 2002:a05:6402:2744:: with SMTP id z4mr77472004edd.310.1638208434290; Mon, 29 Nov 2021 09:53:54 -0800 (PST) Received: from ?IPV6:2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e? ([2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e]) by smtp.googlemail.com with ESMTPSA id gt18sm7974997ejc.46.2021.11.29.09.53.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 29 Nov 2021 09:53:53 -0800 (PST) Message-ID: <496c2fc6-26b0-9b5d-32f4-2f9e9dd6a064@redhat.com> Date: Mon, 29 Nov 2021 18:53:48 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 Subject: Re: [PATCH v2 11/43] KVM: Don't block+unblock when halt-polling is successful Content-Language: en-US To: Sean Christopherson , Maxim Levitsky Cc: Marc Zyngier , Huacai Chen , Aleksandar Markovic , Paul Mackerras , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Christian Borntraeger , Janosch Frank , James Morse , Alexandru Elisei , Suzuki K Poulose , Atish Patra , David Hildenbrand , Cornelia Huck , Claudio Imbrenda , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, linux-mips@vger.kernel.org, kvm@vger.kernel.org, kvm-ppc@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, David Matlack , Oliver Upton , Jing Zhang References: <20211009021236.4122790-1-seanjc@google.com> <20211009021236.4122790-12-seanjc@google.com> <4e883728e3e5201a94eb46b56315afca5e95ad9c.camel@redhat.com> From: Paolo Bonzini In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211129_095357_694018_D65BB557 X-CRM114-Status: GOOD ( 13.53 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org On 11/29/21 18:25, Sean Christopherson wrote: > If a posted interrupt arrives after KVM has done its final search through the vIRR, > but before avic_update_iommu_vcpu_affinity() is called, the posted interrupt will > be set in the vIRR without triggering a host IRQ to wake the vCPU via the GA log. > > I.e. KVM is missing an equivalent to VMX's posted interrupt check for an outstanding > notification after switching to the wakeup vector. BTW Maxim reported that it can break even without assigned devices. > For now, the least awful approach is sadly to keep the vcpu_(un)blocking() hooks. I agree that the hooks cannot be dropped but the bug is reproducible with this patch, where the hooks are still there. With the hooks in place, you have: kvm_vcpu_blocking(vcpu) avic_set_running(vcpu, false) avic_vcpu_put(vcpu) avic_update_iommu_vcpu_affinity() WRITE_ONCE(...) // clear IS_RUNNING bit set_current_state() smp_mb() kvm_vcpu_check_block() return kvm_arch_vcpu_runnable() || ... return kvm_vcpu_has_events() || ... return kvm_cpu_has_interrupt() || ... return kvm_apic_has_interrupt() || ... return apic_has_interrupt_for_ppr() apic_find_highest_irr() scan vIRR This covers the barrier between the write of is_running and the read of vIRR, and the other side should be correct as well. in particular, reads of is_running always come after an atomic write to vIRR, and hence after an implicit full memory barrier. svm_deliver_avic_intr() has an smp_mb__after_atomic() after writing IRR; avic_kick_target_vcpus() even has an explicit barrier in srcu_read_lock(), between the microcode's write to vIRR and its own call to avic_vcpu_is_running(). Still it does seem to be a race that happens when IS_RUNNING=true but vcpu->mode == OUTSIDE_GUEST_MODE. This patch makes the race easier to trigger because it moves IS_RUNNING=false later. Paolo _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A2F8EC433FE for ; Mon, 29 Nov 2021 17:55:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=tlfVfR+6wXq1yWc1csCs6MvP8SxkZtmQq1OBD3gpUpM=; b=LxcrcSdSa7n9Jd UbcLs5ljyXj6Y5l4hfcJZhtJCxsmIP8z/brVTg97HDQWvKsec/GWWTa0QNyNv++wGEJhOQK59H37w R6Za8zZDzlFJKfitSRrutEqLUfHNb1aoMqMW2wmeLFP066AAu4kAVIwuN7kFjt5zLMmLO9E78GOm8 APyqHICiIvv7n+9fKnhroaocL0XzXH0+ILPMChoKI90gg86YnJ7vBT9pBgcNLT5NktVYhh6SNiwvO rxF+Aljq4F3z64Do2XnGDYbRT+zDVKmaonVOHMnzFZc+NLBuIQU6AbBAkpXtumWVBeenc0imDTSom w+k24lPikQajWqdX2RIA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mrkqo-001ep0-KP; Mon, 29 Nov 2021 17:54:02 +0000 Received: from mail-ed1-x533.google.com ([2a00:1450:4864:20::533]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mrkqj-001enN-Jl; Mon, 29 Nov 2021 17:53:58 +0000 Received: by mail-ed1-x533.google.com with SMTP id r11so75534086edd.9; Mon, 29 Nov 2021 09:53:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=sender:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=E58dL1Cy0ML/Fq7U+4vMD/XpyhySESNFxGtsJEr0iGA5QuLlhcOX/A4/jdDRZEzDIQ fPsLvJxXz3PX63V9su/FgauAMqwxco+y+olI1dCd3mpfxLlYlBPlhWOjrxeLq9guNxSM eEfi9IneXptokJh8diXl/ugbj5GCH/6ELhKn4aofNdddGLZ+OqUWg1z9TxLUnKXffmNg lUaqpY0k7AwGkJ3OL2ZtKNoHyBmTZ4KtwmtpxoPlTCt2JnQOPjXQ7vH4M7rfgBjlRgND uViwUXN3LorpSW+ON86lkQL5g7/VvacQD/GzeWK08eJHfKwJKQfnwt7i4lLeeVe5Mvw/ ad3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:sender:message-id:date:mime-version:user-agent :subject:content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=vfu4Cd9k4+GzLcR8vil0uS88vqzqNb0IhlbcqRNGz47rNIE+IQic4kH7Z8XFNL55XR 4N6y/tmeY45kJwM5gABP7zz0Hsv5V2bf1CLqkXr/cTg8Spznr7zCPBiDVfJ+uzgR94+N hzQSJ9OXD4RiDAvZTiEFYB9rMVPqIr1SQ55RQweT54aSYtLXxK7O10Jqs4ooAhcrLO2P +QGA8ZiXNzEts/i/ia2cHJK1bhsxa09VKjf58yp2CahDShNfts8eDx41OLolo7YEEo66 rhKTiuA7zSO8bOkrb/q2gEFqMXs4d0BYh5QGK0ZhyXIKeifmpzqLvfo+LvfX3apSvXN1 SpAQ== X-Gm-Message-State: AOAM533VGROaEQ3ehp7UPucbAUz4QKE47cBmvHafL0sXg4rT642dAdZN uNPKc2EUV76G6F81JmeRbJs= X-Google-Smtp-Source: ABdhPJyEFZTCnn35jIBM5GkhncH3CSPbL5gmVmWsUh9Tr+ztH5c8bc9QO9Acd3UAKwaA5P3qYhybfg== X-Received: by 2002:a05:6402:2744:: with SMTP id z4mr77472004edd.310.1638208434290; Mon, 29 Nov 2021 09:53:54 -0800 (PST) Received: from ?IPV6:2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e? ([2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e]) by smtp.googlemail.com with ESMTPSA id gt18sm7974997ejc.46.2021.11.29.09.53.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 29 Nov 2021 09:53:53 -0800 (PST) Message-ID: <496c2fc6-26b0-9b5d-32f4-2f9e9dd6a064@redhat.com> Date: Mon, 29 Nov 2021 18:53:48 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 Subject: Re: [PATCH v2 11/43] KVM: Don't block+unblock when halt-polling is successful Content-Language: en-US To: Sean Christopherson , Maxim Levitsky Cc: Marc Zyngier , Huacai Chen , Aleksandar Markovic , Paul Mackerras , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Christian Borntraeger , Janosch Frank , James Morse , Alexandru Elisei , Suzuki K Poulose , Atish Patra , David Hildenbrand , Cornelia Huck , Claudio Imbrenda , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, linux-mips@vger.kernel.org, kvm@vger.kernel.org, kvm-ppc@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, David Matlack , Oliver Upton , Jing Zhang References: <20211009021236.4122790-1-seanjc@google.com> <20211009021236.4122790-12-seanjc@google.com> <4e883728e3e5201a94eb46b56315afca5e95ad9c.camel@redhat.com> From: Paolo Bonzini In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211129_095357_694018_D65BB557 X-CRM114-Status: GOOD ( 13.53 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 11/29/21 18:25, Sean Christopherson wrote: > If a posted interrupt arrives after KVM has done its final search through the vIRR, > but before avic_update_iommu_vcpu_affinity() is called, the posted interrupt will > be set in the vIRR without triggering a host IRQ to wake the vCPU via the GA log. > > I.e. KVM is missing an equivalent to VMX's posted interrupt check for an outstanding > notification after switching to the wakeup vector. BTW Maxim reported that it can break even without assigned devices. > For now, the least awful approach is sadly to keep the vcpu_(un)blocking() hooks. I agree that the hooks cannot be dropped but the bug is reproducible with this patch, where the hooks are still there. With the hooks in place, you have: kvm_vcpu_blocking(vcpu) avic_set_running(vcpu, false) avic_vcpu_put(vcpu) avic_update_iommu_vcpu_affinity() WRITE_ONCE(...) // clear IS_RUNNING bit set_current_state() smp_mb() kvm_vcpu_check_block() return kvm_arch_vcpu_runnable() || ... return kvm_vcpu_has_events() || ... return kvm_cpu_has_interrupt() || ... return kvm_apic_has_interrupt() || ... return apic_has_interrupt_for_ppr() apic_find_highest_irr() scan vIRR This covers the barrier between the write of is_running and the read of vIRR, and the other side should be correct as well. in particular, reads of is_running always come after an atomic write to vIRR, and hence after an implicit full memory barrier. svm_deliver_avic_intr() has an smp_mb__after_atomic() after writing IRR; avic_kick_target_vcpus() even has an explicit barrier in srcu_read_lock(), between the microcode's write to vIRR and its own call to avic_vcpu_is_running(). Still it does seem to be a race that happens when IS_RUNNING=true but vcpu->mode == OUTSIDE_GUEST_MODE. This patch makes the race easier to trigger because it moves IS_RUNNING=false later. Paolo _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 218EAC433EF for ; Mon, 29 Nov 2021 22:57:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235906AbhK2XAB (ORCPT ); Mon, 29 Nov 2021 18:00:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235933AbhK2W7s (ORCPT ); Mon, 29 Nov 2021 17:59:48 -0500 Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ABED9C08ED82; Mon, 29 Nov 2021 09:53:55 -0800 (PST) Received: by mail-ed1-x52d.google.com with SMTP id y12so75362755eda.12; Mon, 29 Nov 2021 09:53:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=sender:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=E58dL1Cy0ML/Fq7U+4vMD/XpyhySESNFxGtsJEr0iGA5QuLlhcOX/A4/jdDRZEzDIQ fPsLvJxXz3PX63V9su/FgauAMqwxco+y+olI1dCd3mpfxLlYlBPlhWOjrxeLq9guNxSM eEfi9IneXptokJh8diXl/ugbj5GCH/6ELhKn4aofNdddGLZ+OqUWg1z9TxLUnKXffmNg lUaqpY0k7AwGkJ3OL2ZtKNoHyBmTZ4KtwmtpxoPlTCt2JnQOPjXQ7vH4M7rfgBjlRgND uViwUXN3LorpSW+ON86lkQL5g7/VvacQD/GzeWK08eJHfKwJKQfnwt7i4lLeeVe5Mvw/ ad3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:sender:message-id:date:mime-version:user-agent :subject:content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=1y5DEAA90y8cYxRCLd33wqhLVpAEzLmdNKss0/RInBo=; b=x4bbK/cjcMnOoyxtkDp7Z3F+2SdUFuT80avz2Tmcu44Jfj+dh6AzycwELMXJuXzPcQ vLpc+he5hqyOnGi+y5qiJxfLNrR0Px3Wt6aLL7yl7fj2aXHZWueJE0MrCS7ZI/+PoFEe k0n9zKbA2jvYjlGXKpeG363N68FxqZgmcISOMaGOG5G6GZgM4MtFvmn9AkkK1aW2nKuU l4c6HdItYcDeosAS9qSTXFEEArBMqXqsNE2ot/WSimKSPVspAoO/UCVplylraCTuaOa6 hU62QT7UchN8fQtuLGLaSaDqOt1SCvEpurFiyvxFzwTo8KT6cAkFt2omJTbgx3wsZLyC Votg== X-Gm-Message-State: AOAM5310EUJg1Dqp0pxtKg0+W7O6Mn/q6iTwmgRsFiYZdWD+0d+TjoQ9 x4b/oOfmOg2XQw+uGhep+5g= X-Google-Smtp-Source: ABdhPJyEFZTCnn35jIBM5GkhncH3CSPbL5gmVmWsUh9Tr+ztH5c8bc9QO9Acd3UAKwaA5P3qYhybfg== X-Received: by 2002:a05:6402:2744:: with SMTP id z4mr77472004edd.310.1638208434290; Mon, 29 Nov 2021 09:53:54 -0800 (PST) Received: from ?IPV6:2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e? ([2001:b07:6468:f312:5e2c:eb9a:a8b6:fd3e]) by smtp.googlemail.com with ESMTPSA id gt18sm7974997ejc.46.2021.11.29.09.53.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 29 Nov 2021 09:53:53 -0800 (PST) Sender: Paolo Bonzini Message-ID: <496c2fc6-26b0-9b5d-32f4-2f9e9dd6a064@redhat.com> Date: Mon, 29 Nov 2021 18:53:48 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 Subject: Re: [PATCH v2 11/43] KVM: Don't block+unblock when halt-polling is successful Content-Language: en-US To: Sean Christopherson , Maxim Levitsky Cc: Marc Zyngier , Huacai Chen , Aleksandar Markovic , Paul Mackerras , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Christian Borntraeger , Janosch Frank , James Morse , Alexandru Elisei , Suzuki K Poulose , Atish Patra , David Hildenbrand , Cornelia Huck , Claudio Imbrenda , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu, linux-mips@vger.kernel.org, kvm@vger.kernel.org, kvm-ppc@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, David Matlack , Oliver Upton , Jing Zhang References: <20211009021236.4122790-1-seanjc@google.com> <20211009021236.4122790-12-seanjc@google.com> <4e883728e3e5201a94eb46b56315afca5e95ad9c.camel@redhat.com> From: Paolo Bonzini In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/29/21 18:25, Sean Christopherson wrote: > If a posted interrupt arrives after KVM has done its final search through the vIRR, > but before avic_update_iommu_vcpu_affinity() is called, the posted interrupt will > be set in the vIRR without triggering a host IRQ to wake the vCPU via the GA log. > > I.e. KVM is missing an equivalent to VMX's posted interrupt check for an outstanding > notification after switching to the wakeup vector. BTW Maxim reported that it can break even without assigned devices. > For now, the least awful approach is sadly to keep the vcpu_(un)blocking() hooks. I agree that the hooks cannot be dropped but the bug is reproducible with this patch, where the hooks are still there. With the hooks in place, you have: kvm_vcpu_blocking(vcpu) avic_set_running(vcpu, false) avic_vcpu_put(vcpu) avic_update_iommu_vcpu_affinity() WRITE_ONCE(...) // clear IS_RUNNING bit set_current_state() smp_mb() kvm_vcpu_check_block() return kvm_arch_vcpu_runnable() || ... return kvm_vcpu_has_events() || ... return kvm_cpu_has_interrupt() || ... return kvm_apic_has_interrupt() || ... return apic_has_interrupt_for_ppr() apic_find_highest_irr() scan vIRR This covers the barrier between the write of is_running and the read of vIRR, and the other side should be correct as well. in particular, reads of is_running always come after an atomic write to vIRR, and hence after an implicit full memory barrier. svm_deliver_avic_intr() has an smp_mb__after_atomic() after writing IRR; avic_kick_target_vcpus() even has an explicit barrier in srcu_read_lock(), between the microcode's write to vIRR and its own call to avic_vcpu_is_running(). Still it does seem to be a race that happens when IS_RUNNING=true but vcpu->mode == OUTSIDE_GUEST_MODE. This patch makes the race easier to trigger because it moves IS_RUNNING=false later. Paolo From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paolo Bonzini Date: Mon, 29 Nov 2021 17:53:48 +0000 Subject: Re: [PATCH v2 11/43] KVM: Don't block+unblock when halt-polling is successful Message-Id: <496c2fc6-26b0-9b5d-32f4-2f9e9dd6a064@redhat.com> List-Id: References: <20211009021236.4122790-1-seanjc@google.com> <20211009021236.4122790-12-seanjc@google.com> <4e883728e3e5201a94eb46b56315afca5e95ad9c.camel@redhat.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable To: Sean Christopherson , Maxim Levitsky Cc: Cornelia Huck , Wanpeng Li , kvm@vger.kernel.org, David Hildenbrand , linux-kernel@vger.kernel.org, Paul Mackerras , Atish Patra , linux-riscv@lists.infradead.org, Claudio Imbrenda , kvmarm@lists.cs.columbia.edu, Janosch Frank , Marc Zyngier , Joerg Roedel , Huacai Chen , Christian Borntraeger , Aleksandar Markovic , Albert Ou , kvm-ppc@vger.kernel.org, Paul Walmsley , David Matlack , linux-arm-kernel@lists.infradead.org, Jim Mattson , Anup Patel , linux-mips@vger.kernel.org, Palmer Dabbelt , kvm-riscv@lists.infradead.org, Vitaly Kuznetsov On 11/29/21 18:25, Sean Christopherson wrote: > If a posted interrupt arrives after KVM has done its final search through= the vIRR, > but before avic_update_iommu_vcpu_affinity() is called, the posted interr= upt will > be set in the vIRR without triggering a host IRQ to wake the vCPU via the= GA log. >=20 > I.e. KVM is missing an equivalent to VMX's posted interrupt check for an = outstanding > notification after switching to the wakeup vector. BTW Maxim reported that it can break even without assigned devices. > For now, the least awful approach is sadly to keep the vcpu_(un)blocking(= ) hooks. I agree that the hooks cannot be dropped but the bug is reproducible=20 with this patch, where the hooks are still there. With the hooks in place, you have: kvm_vcpu_blocking(vcpu) avic_set_running(vcpu, false) avic_vcpu_put(vcpu) avic_update_iommu_vcpu_affinity() WRITE_ONCE(...) // clear IS_RUNNING bit set_current_state() smp_mb() kvm_vcpu_check_block() return kvm_arch_vcpu_runnable() || ... return kvm_vcpu_has_events() || ... return kvm_cpu_has_interrupt() || ... return kvm_apic_has_interrupt() || ... return apic_has_interrupt_for_ppr() apic_find_highest_irr() scan vIRR This covers the barrier between the write of is_running and the read of=20 vIRR, and the other side should be correct as well. in particular,=20 reads of is_running always come after an atomic write to vIRR, and hence=20 after an implicit full memory barrier. svm_deliver_avic_intr() has an=20 smp_mb__after_atomic() after writing IRR; avic_kick_target_vcpus() even=20 has an explicit barrier in srcu_read_lock(), between the microcode's=20 write to vIRR and its own call to avic_vcpu_is_running(). Still it does seem to be a race that happens when IS_RUNNING=3Dtrue but=20 vcpu->mode =3D OUTSIDE_GUEST_MODE. This patch makes the race easier to=20 trigger because it moves IS_RUNNING=FAlse later. Paolo