linux-kernel - Re: [PATCH v2 12/15] kvm: i8254: Check LAPIC EOI pending when injecting irq on SVM AVIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Aug 2019 11:10:51 +0200
From:   Alexander Graf <graf@...zon.com>
To:     "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@....com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>
CC:     "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "rkrcmar@...hat.com" <rkrcmar@...hat.com>,
        "joro@...tes.org" <joro@...tes.org>,
        "jschoenh@...zon.de" <jschoenh@...zon.de>,
        "karahmed@...zon.de" <karahmed@...zon.de>,
        "rimasluk@...zon.com" <rimasluk@...zon.com>,
        "Grimm, Jon" <Jon.Grimm@....com>
Subject: Re: [PATCH v2 12/15] kvm: i8254: Check LAPIC EOI pending when
 injecting irq on SVM AVIC



On 26.08.19 22:46, Suthikulpanit, Suravee wrote:
> Alex,
> 
> On 8/19/2019 5:42 AM, Alexander Graf wrote:
>>
>>
>> On 15.08.19 18:25, Suthikulpanit, Suravee wrote:
>>> ACK notifiers don't work with AMD SVM w/ AVIC when the PIT interrupt
>>> is delivered as edge-triggered fixed interrupt since AMD processors
>>> cannot exit on EOI for these interrupts.
>>>
>>> Add code to check LAPIC pending EOI before injecting any pending PIT
>>> interrupt on AMD SVM when AVIC is activated.
>>>
>>> Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@....com>
>>> ---
>>>    arch/x86/kvm/i8254.c | 31 +++++++++++++++++++++++++------
>>>    1 file changed, 25 insertions(+), 6 deletions(-)
>>>
>>> diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
>>> index 4a6dc54..31c4a9b 100644
>>> --- a/arch/x86/kvm/i8254.c
>>> +++ b/arch/x86/kvm/i8254.c
>>> @@ -34,10 +34,12 @@
>>>    #include <linux/kvm_host.h>
>>>    #include <linux/slab.h>
>>> +#include <asm/virtext.h>
>>>    #include "ioapic.h"
>>>    #include "irq.h"
>>>    #include "i8254.h"
>>> +#include "lapic.h"
>>>    #include "x86.h"
>>>    #ifndef CONFIG_X86_64
>>> @@ -236,6 +238,12 @@ static void destroy_pit_timer(struct kvm_pit *pit)
>>>        kthread_flush_work(&pit->expired);
>>>    }
>>> +static inline void kvm_pit_reset_reinject(struct kvm_pit *pit)
>>> +{
>>> +    atomic_set(&pit->pit_state.pending, 0);
>>> +    atomic_set(&pit->pit_state.irq_ack, 1);
>>> +}
>>> +
>>>    static void pit_do_work(struct kthread_work *work)
>>>    {
>>>        struct kvm_pit *pit = container_of(work, struct kvm_pit, expired);
>>> @@ -244,6 +252,23 @@ static void pit_do_work(struct kthread_work *work)
>>>        int i;
>>>        struct kvm_kpit_state *ps = &pit->pit_state;
>>> +    /*
>>> +     * Since, AMD SVM AVIC accelerates write access to APIC EOI
>>> +     * register for edge-trigger interrupts. PIT will not be able
>>> +     * to receive the IRQ ACK notifier and will always be zero.
>>> +     * Therefore, we check if any LAPIC EOI pending for vector 0
>>> +     * and reset irq_ack if no pending.
>>> +     */
>>> +    if (cpu_has_svm(NULL) && kvm->arch.apicv_state == APICV_ACTIVATED) {
>>> +        int eoi = 0;
>>> +
>>> +        kvm_for_each_vcpu(i, vcpu, kvm)
>>> +            if (kvm_apic_pending_eoi(vcpu, 0))
>>> +                eoi++;
>>> +        if (!eoi)
>>> +            kvm_pit_reset_reinject(pit);
>>
>> In which case would eoi be != 0 when APIC-V is active?
> 
> That would be the case when guest has not processed and/or still processing the interrupt.
> Once the guest writes to APIC EOI register for edge-triggered interrupt for vector 0,
> and the AVIC hardware accelerated the access by clearing the highest priority ISR bit,
> then the eoi should be zero.

Thinking about this a bit more, you're basically saying the irq ack 
notifier never triggers because we don't see the EOI register write, but 
we can determine the state asynchronously.

The irqfd code also uses the ack notifier for level irq reinjection. 
Will that break as well?

Wouldn't it make more sense to try to either maintain the ack notifier 
API or remove it completely if we can't find a way to make it work with 
APIC-V?

So what if we detect that an IRQ vector we're injecting for has an irq 
notifier? If it does, we set up / start:

   * an hrtimer that polls for EOI on that vector
   * a flag so that every vcpu on exit checks for EOI on that vector
   * a direct call from pit_do_work to check on it as well

Each of them would go through a single code path that then calls the 
ack_notifier.

That way we should be able to just maintain the old API and not get into 
unpleasant surprises that only manifest on a tiny faction of systems, right?


Alternatively, feel free to remove the ack logic altogether and move all 
users of it to different mechanisms (check in do_work here, additional 
timer in irqfd probably).


Let's try to be as consistent as possible across different host 
platforms. Otherwise the test matrix just explodes.


Alex



Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Ralf Herbrich
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879