linux-kernel - Re: [PATCH v3] KVM: VMX: fix lockdep warning on posted intr wakeup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZDRHsyM00sJ1j4qX@google.com>
Date:   Mon, 10 Apr 2023 10:30:27 -0700
From:   Sean Christopherson <seanjc@...gle.com>
To:     Yan Zhao <yan.y.zhao@...el.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] KVM: VMX: fix lockdep warning on posted intr wakeup

On Fri, Mar 31, 2023, Yan Zhao wrote:
> On Thu, Mar 30, 2023 at 11:14:27AM -0700, Sean Christopherson wrote:
> > On Thu, Mar 30, 2023, Yan Zhao wrote:
> > > While with v3 of this patch (sched_in path holds both out_lock and in_lock),
> > > lockdep is still able to warn about this issue.
> > 
> > Couldn't we just add a manual assertion?  That'd also be a good location for a
> > comment to document all of this, and to clarify that current->pi_lock is a
> > completely different lock that has nothing to do with posted interrupts.
> > 
> > It's not foolproof, but any patches that substantially touch this code need a
> > ton of scrutiny as the scheduling interactions are gnarly, i.e. IMO a deadlock
> > bug sneaking in is highly unlikely.
> > 
> > diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
> > index 94c38bea60e7..19325a10e42f 100644
> > --- a/arch/x86/kvm/vmx/posted_intr.c
> > +++ b/arch/x86/kvm/vmx/posted_intr.c
> > @@ -90,6 +90,7 @@ void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
> >          */
> >         if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR) {
> >                 raw_spin_lock(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu));
> > +               lockdep_assert_not_held(&current->pi_lock);
> >                 list_del(&vmx->pi_wakeup_list);
> >                 raw_spin_unlock(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu));
> >         }
> Hmm...No. It's not about "current->pi_lock" cannot be held, it's about
> the lock ordering.
> In sched_out thread, the lock ordering is
> "current->pi_lock" --> "rq->__lock" --> "per_cpu(wakeup_vcpus_on_cpu_lock, cpu)",
> then in sched_in thread, if the lock ordering is
> "per_cpu(wakeup_vcpus_on_cpu_lock, cpu)" --> "current->pi_lock",
> circular locking dependency will happen.
> while if the lock ordering in sched_in thread is
> "current->pi_lock" --> "per_cpu(wakeup_vcpus_on_cpu_lock, cpu)",
> it's fine!

Right, but IIUC, neither ordering happens today.  In other words, the lockdep
assertion isn't defining a hard rule, rather it's enforcing an assumption that KVM
relies on to avoid a potential deadlock.

> If sched_out thread and sched_in thread actually should hold the same
> subclass of lock, we can't fool the lockdep just to let it shut up.
> And, we may not be able to list or document out all potential locks that cannot
> be held inside the "per_cpu(wakeup_vcpus_on_cpu_lock, cpu)", right?

Eh, IMO this is a non-issue.  It's a raw_spin_lock() in an IRQs disabled section
that wraps a single line of benign code.  If it's really concerning, we could add
a scary comment like this.

diff --git a/arch/x86/kvm/vmx/posted_intr.c b/arch/x86/kvm/vmx/posted_intr.c
index 94c38bea60e7..a7ec0371aeca 100644
--- a/arch/x86/kvm/vmx/posted_intr.c
+++ b/arch/x86/kvm/vmx/posted_intr.c
@@ -87,6 +87,12 @@ void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
         * If the vCPU was waiting for wakeup, remove the vCPU from the wakeup
         * list of the _previous_ pCPU, which will not be the same as the
         * current pCPU if the task was migrated.
+        *
+        * Stating the obvious, do not under any circumstance let this path
+        * acquire a different lock while holding the per-CPU lock.  To avoid
+        * false postives in lockdep, KVM uses different lockdep subclasses for
+        * vmx_vcpu_pi_put() vs vmx_vcpu_pi_load(), i.e. lockdep may not be
+        * to detect circular dependencies and other issues.
         */
        if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR) {
                raw_spin_lock(&per_cpu(wakeup_vcpus_on_cpu_lock, vcpu->cpu));
 
> BTW, could you tell me why you think v3 complicates KVM's functionality?
> It just splits a single lock into two sub locks, and let irq path only

Heh, "just".  

> takes in_lock, sched_out path only takes out_lock, while sched_in path takes
> both in_lock and out_lock.
> IMHO, it does not make any functional change to KVM code.
> Maybe it's because the commit message is not well written and gave people a wrong
> impression that the logic changes a lot?

No, this is not a problem that can be solved by any changelog.  My very strong
objection to having two separate locks is that when reading the code, it's not
remotely obvious why two locks are needed, or that the code is correct.  Adding
copious amounts of documentation/comments can help, but it'll never fully solve
the problem that having two locks simply isn't intuitive/straightforward.