linux-kernel - Re: [PATCH v2 12/15] kvm: i8254: Check LAPIC EOI pending when injecting irq on SVM AVIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Fri, 13 Sep 2019 14:50:06 +0000
From:   "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@....com>
To:     Alexander Graf <graf@...zon.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>
CC:     "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "rkrcmar@...hat.com" <rkrcmar@...hat.com>,
        "joro@...tes.org" <joro@...tes.org>,
        "jschoenh@...zon.de" <jschoenh@...zon.de>,
        "karahmed@...zon.de" <karahmed@...zon.de>,
        "rimasluk@...zon.com" <rimasluk@...zon.com>,
        "Grimm, Jon" <Jon.Grimm@....com>
Subject: Re: [PATCH v2 12/15] kvm: i8254: Check LAPIC EOI pending when
 injecting irq on SVM AVIC

Alex,

On 8/27/19 4:10 AM, Alexander Graf wrote:
> 
> On 26.08.19 22:46, Suthikulpanit, Suravee wrote:
>> Alex,
>>
>> On 8/19/2019 5:42 AM, Alexander Graf wrote:
>>>
>>>
>>> On 15.08.19 18:25, Suthikulpanit, Suravee wrote:
>>>> ACK notifiers don't work with AMD SVM w/ AVIC when the PIT interrupt
>>>> is delivered as edge-triggered fixed interrupt since AMD processors
>>>> cannot exit on EOI for these interrupts.
>>>>
>>>> Add code to check LAPIC pending EOI before injecting any pending PIT
>>>> interrupt on AMD SVM when AVIC is activated.
>>>>
>>>> Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@....com>
>>>> ---
>>>>    arch/x86/kvm/i8254.c | 31 +++++++++++++++++++++++++------
>>>>    1 file changed, 25 insertions(+), 6 deletions(-)
>>>>
>>>> diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
>>>> index 4a6dc54..31c4a9b 100644
>>>> --- a/arch/x86/kvm/i8254.c
>>>> +++ b/arch/x86/kvm/i8254.c
>>>> @@ -34,10 +34,12 @@
>>>>    #include <linux/kvm_host.h>
>>>>    #include <linux/slab.h>
>>>> +#include <asm/virtext.h>
>>>>    #include "ioapic.h"
>>>>    #include "irq.h"
>>>>    #include "i8254.h"
>>>> +#include "lapic.h"
>>>>    #include "x86.h"
>>>>    #ifndef CONFIG_X86_64
>>>> @@ -236,6 +238,12 @@ static void destroy_pit_timer(struct kvm_pit *pit)
>>>>        kthread_flush_work(&pit->expired);
>>>>    }
>>>> +static inline void kvm_pit_reset_reinject(struct kvm_pit *pit)
>>>> +{
>>>> +    atomic_set(&pit->pit_state.pending, 0);
>>>> +    atomic_set(&pit->pit_state.irq_ack, 1);
>>>> +}
>>>> +
>>>>    static void pit_do_work(struct kthread_work *work)
>>>>    {
>>>>        struct kvm_pit *pit = container_of(work, struct kvm_pit, expired); 
>>>>
>>>> @@ -244,6 +252,23 @@ static void pit_do_work(struct kthread_work *work)
>>>>        int i;
>>>>        struct kvm_kpit_state *ps = &pit->pit_state;
>>>> +    /*
>>>> +     * Since, AMD SVM AVIC accelerates write access to APIC EOI
>>>> +     * register for edge-trigger interrupts. PIT will not be able
>>>> +     * to receive the IRQ ACK notifier and will always be zero.
>>>> +     * Therefore, we check if any LAPIC EOI pending for vector 0
>>>> +     * and reset irq_ack if no pending.
>>>> +     */
>>>> +    if (cpu_has_svm(NULL) && kvm->arch.apicv_state == APICV_ACTIVATED) { 
>>>>
>>>> +        int eoi = 0;
>>>> +
>>>> +        kvm_for_each_vcpu(i, vcpu, kvm)
>>>> +            if (kvm_apic_pending_eoi(vcpu, 0))
>>>> +                eoi++;
>>>> +        if (!eoi)
>>>> +            kvm_pit_reset_reinject(pit);
>>>
>>> In which case would eoi be != 0 when APIC-V is active?
>>
>> That would be the case when guest has not processed and/or still 
>> processing the interrupt.
>> Once the guest writes to APIC EOI register for edge-triggered 
>> interrupt for vector 0,
>> and the AVIC hardware accelerated the access by clearing the highest 
>> priority ISR bit,
>> then the eoi should be zero.
> 
> Thinking about this a bit more, you're basically saying the irq ack 
> notifier never triggers because we don't see the EOI register write, but 
> we can determine the state asynchronously.

Yes, we should be able to determine this in lazy fashion only when we 
need to inject new interrupts.

> The irqfd code also uses the ack notifier for level irq reinjection. 
> Will that break as well?

IIUC, in case of irqfd, the notifier is only used for the case of 
resampling irqfds, which are special variety of irqfds used to emulate 
level triggered interrupts (see include/linux/kvm_irqfd.h). The AVIC 
workaround is only needed for handling EOI for edge-trigger interrupts.

> Wouldn't it make more sense to try to either maintain the ack notifier 
> API or remove it completely if we can't find a way to make it work with 
> APIC-V?

My understanding is that the ack notifier is needed for KVM to support 
KVM_REINJECT_CONTROL ioctl (mentioned here 
(https://lkml.org/lkml/2019/2/6/133).

> So what if we detect that an IRQ vector we're injecting for has an irq 
> notifier? If it does, we set up / start:
> 
>    * an hrtimer that polls for EOI on that vector
>    * a flag so that every vcpu on exit checks for EOI on that vector
>    * a direct call from pit_do_work to check on it as well
> 
> Each of them would go through a single code path that then calls the 
> ack_notifier.
> 
> That way we should be able to just maintain the old API and not get into 
> unpleasant surprises that only manifest on a tiny faction of systems, 
> right?

Let me send out v3 that will consolidate this into a single code path.

Suravee