kvm/x86: check KVM_REQ_TLB_FLUSH with irqs disabled

PATCH In review Joerg Roedel 3 participants 6 messages Mar 16, 2009

Subsystems (3)

x86 KVM KVM x86

lore

Share & tools

lore

Joerg Roedel

author

2009-03-16 13:04 UTC #0 lore raw

PATCH 1/1 kvm/x86: check KVM_REQ_TLB_FLUSH with irqs disabled

For KVM remote TLB flushes we need to check the KVM_REQ_TLB_FLUSH request flag when the irqs are already disabled. Otherwise there is a small window of time for a race condition where we may enter a guest without doing a requested TLB flush.

Signed-off-by Joerg Roedel <[email protected]>

---
 arch/x86/kvm/x86.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

arch/x86/kvm/x86.c +3 -2

index b556b6a..301660a 100644
@@ -3108,8 +3108,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 			kvm_write_guest_time(vcpu);
 		if (test_and_clear_bit(KVM_REQ_MMU_SYNC, &vcpu->requests))
 			kvm_mmu_sync_roots(vcpu);
-		if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
-			kvm_x86_ops->tlb_flush(vcpu);
 		if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
 				       &vcpu->requests)) {
 			kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;

@@ -3133,6 +3131,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 
 	local_irq_disable();
 
+	if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
+		kvm_x86_ops->tlb_flush(vcpu);
+
 	if (vcpu->requests || need_resched() || signal_pending(current)) {
 		local_irq_enable();
 		preempt_enable();

Signature · 1 line

1.5.6.4

Avi Kivity

2009-03-16 13:13 UTC #1 lore raw

Quoted 16 lines · Joerg Roedel

For KVM remote TLB flushes we need to check the KVM_REQ_TLB_FLUSH request flag when the irqs are already disabled. Otherwise there is a small window of time for a race condition where we may enter a guest without doing a requested TLB flush.
arch/x86/kvm/x86.c +0 -2
@@ -3108,8 +3108,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 			kvm_write_guest_time(vcpu);
 		if (test_and_clear_bit(KVM_REQ_MMU_SYNC, &vcpu->requests))
 			kvm_mmu_sync_roots(vcpu);
-		if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
-			kvm_x86_ops->tlb_flush(vcpu);
 		if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
 				       &vcpu->requests)) {
 			kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;

arch/x86/kvm/x86.c static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) · line 3139

Quoted 9 lines

arch/x86/kvm/x86.c +3 -0

@@ -3133,6 +3131,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 
 	local_irq_disable();
 
+	if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
+		kvm_x86_ops->tlb_flush(vcpu);
+
 	if (vcpu->requests || need_resched() || signal_pending(current)) {
 		local_irq_enable();
 		preempt_enable();

If we lost the race and someone sets a bit after the test, then the test immediately above will pick this up retry the bit tests.

Signature · 1 line

error compiling committee.c: too many arguments to function

Joerg Roedel

author

2009-03-16 14:12 UTC #2 lore raw

Quoted 19 lines · Avi Kivity

Quoted 18 lines · Joerg Roedel

arch/x86/kvm/x86.c +2 -2

@@ -3108,8 +3108,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 			kvm_write_guest_time(vcpu);
 		if (test_and_clear_bit(KVM_REQ_MMU_SYNC, &vcpu->requests))
 			kvm_mmu_sync_roots(vcpu);
-		if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
-			kvm_x86_ops->tlb_flush(vcpu);
 		if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
 				       &vcpu->requests)) {
 			kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;

@@ -3133,6 +3131,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 	local_irq_disable();
+	if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
+		kvm_x86_ops->tlb_flush(vcpu);

Quoted 9 lines

arch/x86/kvm/x86.c static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
Quoted 5 lines
arch/x86/kvm/x86.c +1 -0
+
 	if (vcpu->requests || need_resched() || signal_pending(current)) {
 		local_irq_enable();
 		preempt_enable();
 
If we lost the race and someone sets a bit after the test, then the test immediately above will pick this up retry the bit tests.

Ah true. Sorry for the noise.

Signature · 6 lines

           | Advanced Micro Devices GmbH
 Operating | Karl-Hammerschmidt-Str. 34, 85609 Dornach bei München
 System    | 
 Research  | Geschäftsführer: Jochen Polster, Thomas M. McCoy, Giuliano Meroni
 Center    | Sitz: Dornach, Gemeinde Aschheim, Landkreis München
           | Registergericht München, HRB Nr. 43632

Marcelo Tosatti

2009-03-16 18:31 UTC #3 lore raw

In reply to Avi Kivity

Quoted 19 lines · Avi Kivity

Quoted 18 lines · Joerg Roedel

arch/x86/kvm/x86.c +1 -2

@@ -3108,8 +3108,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 			kvm_write_guest_time(vcpu);
 		if (test_and_clear_bit(KVM_REQ_MMU_SYNC, &vcpu->requests))
 			kvm_mmu_sync_roots(vcpu);
-		if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
-			kvm_x86_ops->tlb_flush(vcpu);
 		if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
 				       &vcpu->requests)) {
 			kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;

@@ -3133,6 +3131,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
  	local_irq_disable();
 +	if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
+		kvm_x86_ops->tlb_flush(vcpu);

Quoted 8 lines

arch/x86/kvm/x86.c static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
Quoted 5 lines
arch/x86/kvm/x86.c +1 -0
+
 	if (vcpu->requests || need_resched() || signal_pending(current)) {
 		local_irq_enable();
 		preempt_enable();
 
If we lost the race and someone sets a bit after the test, then the test immediately above will pick this up retry the bit tests.

BTW, I've wondered if the local_irq_enable in svm_vcpu_run is safe:

        clgi();

        local_irq_enable();

There is no way that an interrupt can be handled there without an exit, right?

Avi Kivity

2009-03-16 18:32 UTC #4 lore raw

Quoted 8 lines · Marcelo Tosatti

BTW, I've wondered if the local_irq_enable in svm_vcpu_run is safe:
        clgi();

        local_irq_enable();
There is no way that an interrupt can be handled there without an exit, right?

clgi trumps sti, so all interrupts will be deferred until the guest is entered (which will cause an immediate vmexit).

Signature · 1 line

Do not meddle in the internals of kernels, for they are subtle and quick to panic.

Joerg Roedel

author

2009-03-16 18:45 UTC #5 lore raw

In reply to Marcelo Tosatti

Quoted 29 lines · Marcelo Tosatti

Quoted 19 lines · Avi Kivity
Quoted 18 lines · Joerg Roedel
For KVM remote TLB flushes we need to check the KVM_REQ_TLB_FLUSH request flag when the irqs are already disabled. Otherwise there is a small window of time for a race condition where we may enter a guest without doing a requested TLB flush.
arch/x86/kvm/x86.c +1 -2
@@ -3108,8 +3108,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 			kvm_write_guest_time(vcpu);
 		if (test_and_clear_bit(KVM_REQ_MMU_SYNC, &vcpu->requests))
 			kvm_mmu_sync_roots(vcpu);
-		if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
-			kvm_x86_ops->tlb_flush(vcpu);
 		if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
 				       &vcpu->requests)) {
 			kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;
@@ -3133,6 +3131,9 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
  	local_irq_disable();
 +	if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
+		kvm_x86_ops->tlb_flush(vcpu);
Quoted 8 lines
arch/x86/kvm/x86.c static int vcpu_enter_guest(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
Quoted 5 lines
arch/x86/kvm/x86.c +1 -0
+
 	if (vcpu->requests || need_resched() || signal_pending(current)) {
 		local_irq_enable();
 		preempt_enable();
 
If we lost the race and someone sets a bit after the test, then the test immediately above will pick this up retry the bit tests.

Quoted 5 lines

BTW, I've wondered if the local_irq_enable in svm_vcpu_run is safe:
        clgi();

        local_irq_enable();

The reason behind this is that we have to allow the host to accept interrupts. Interrupts are still blocked by clgi (together with NMI, INIT, debug traps and SMI) until the global interrupt flag is reenabled as a final step of VMRUN. If we don't enable interrupts here they would be blocked and an external interrupt would not cause an #VMEXIT.

Joerg

Signature · 6 lines

           | Advanced Micro Devices GmbH
 Operating | Karl-Hammerschmidt-Str. 34, 85609 Dornach bei München
 System    | 
 Research  | Geschäftsführer: Jochen Polster, Thomas M. McCoy, Giuliano Meroni
 Center    | Sitz: Dornach, Gemeinde Aschheim, Landkreis München
           | Registergericht München, HRB Nr. 43632