From nobody Sun Jun 28 09:58:22 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B15E4C433FE for ; Sat, 19 Feb 2022 09:34:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241196AbiBSJea (ORCPT ); Sat, 19 Feb 2022 04:34:30 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:57136 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231517AbiBSJe3 (ORCPT ); Sat, 19 Feb 2022 04:34:29 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 8C6D94F472 for ; Sat, 19 Feb 2022 01:34:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1645263250; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=/eT1aTzLbHhei4jVP2A2obc4oMSZLheYvq0FaqENuG8=; b=NFQgAQ+JflBYGOUzuZFWhJlGlg4IcOOp6lg/b5n3Aim3y0WtgT7Yh3K1MbUDqoslRkg/p4 QOLb0gBZjvu9W4RM67EHeipZqW9inHzpNVihUa39TZpo5HMc9hTdPAtzzK4yW7OneRml6B 5eLYqtuO8JyeM/Blb8yXU2QJe4cfRrg= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-489-SQr6FPP4OhW-A8FLK-_r-A-1; Sat, 19 Feb 2022 04:34:07 -0500 X-MC-Unique: SQr6FPP4OhW-A8FLK-_r-A-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id D457D2F45; Sat, 19 Feb 2022 09:34:05 +0000 (UTC) Received: from virtlab701.virt.lab.eng.bos.redhat.com (virtlab701.virt.lab.eng.bos.redhat.com [10.19.152.228]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4BBE42A18F; Sat, 19 Feb 2022 09:34:05 +0000 (UTC) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: seanjc@google.com, Like Xu Subject: [PATCH v2] KVM: x86: pull kvm->srcu read-side to kvm_arch_vcpu_ioctl_run Date: Sat, 19 Feb 2022 04:34:04 -0500 Message-Id: <20220219093404.367207-1-pbonzini@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" kvm_arch_vcpu_ioctl_run is already doing srcu_read_lock/unlock in two places, namely vcpu_run and post_kvm_run_save, and a third is actually needed around the call to vcpu->arch.complete_userspace_io to avoid the following splat: WARNING: suspicious RCU usage arch/x86/kvm/pmu.c:190 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active =3D 2, debug_locks =3D 1 1 lock held by CPU 28/KVM/370841: #0: ff11004089f280b8 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x87/= 0x730 [kvm] Call Trace: dump_stack_lvl+0x59/0x73 reprogram_fixed_counter+0x15d/0x1a0 [kvm] kvm_pmu_trigger_event+0x1a3/0x260 [kvm] ? free_moved_vector+0x1b4/0x1e0 complete_fast_pio_in+0x8a/0xd0 [kvm] This splat is not at all unexpected, since complete_userspace_io callbacks can execute similar code to vmexits. For example, SVM with nrips=3Dfalse will call into the emulator from svm_skip_emulated_instruction(). Reported-by: Like Xu Signed-off-by: Paolo Bonzini Reported-by: kernel test robot --- v2: actually commit what I tested... srcu_read_lock must be before all "goto out"s. arch/x86/kvm/x86.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 82a9dcd8c67f..e55de9b48d1a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -9180,6 +9180,7 @@ static int dm_request_for_irq_injection(struct kvm_vc= pu *vcpu) likely(!pic_in_kernel(vcpu->kvm)); } =20 +/* Called within kvm->srcu read side. */ static void post_kvm_run_save(struct kvm_vcpu *vcpu) { struct kvm_run *kvm_run =3D vcpu->run; @@ -9188,16 +9189,9 @@ static void post_kvm_run_save(struct kvm_vcpu *vcpu) kvm_run->cr8 =3D kvm_get_cr8(vcpu); kvm_run->apic_base =3D kvm_get_apic_base(vcpu); =20 - /* - * The call to kvm_ready_for_interrupt_injection() may end up in - * kvm_xen_has_interrupt() which may require the srcu lock to be - * held, to protect against changes in the vcpu_info address. - */ - vcpu->srcu_idx =3D srcu_read_lock(&vcpu->kvm->srcu); kvm_run->ready_for_interrupt_injection =3D pic_in_kernel(vcpu->kvm) || kvm_vcpu_ready_for_interrupt_injection(vcpu); - srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx); =20 if (is_smm(vcpu)) kvm_run->flags |=3D KVM_RUN_X86_SMM; @@ -9815,6 +9809,7 @@ void __kvm_request_immediate_exit(struct kvm_vcpu *vc= pu) EXPORT_SYMBOL_GPL(__kvm_request_immediate_exit); =20 /* + * Called within kvm->srcu read side. * Returns 1 to let vcpu_run() continue the guest execution loop without * exiting to the userspace. Otherwise, the value will be returned to the * userspace. @@ -10193,6 +10188,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) return r; } =20 +/* Called within kvm->srcu read side. */ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu) { bool hv_timer; @@ -10252,12 +10248,12 @@ static inline bool kvm_vcpu_running(struct kvm_vc= pu *vcpu) !vcpu->arch.apf.halted); } =20 +/* Called within kvm->srcu read side. */ static int vcpu_run(struct kvm_vcpu *vcpu) { int r; struct kvm *kvm =3D vcpu->kvm; =20 - vcpu->srcu_idx =3D srcu_read_lock(&kvm->srcu); vcpu->arch.l1tf_flush_l1d =3D true; =20 for (;;) { @@ -10291,8 +10287,6 @@ static int vcpu_run(struct kvm_vcpu *vcpu) } } =20 - srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx); - return r; } =20 @@ -10398,6 +10392,7 @@ static void kvm_put_guest_fpu(struct kvm_vcpu *vcpu) int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) { struct kvm_run *kvm_run =3D vcpu->run; + struct kvm *kvm =3D vcpu->kvm; int r; =20 vcpu_load(vcpu); @@ -10405,6 +10400,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) kvm_run->flags =3D 0; kvm_load_guest_fpu(vcpu); =20 + vcpu->srcu_idx =3D srcu_read_lock(&vcpu->kvm->srcu); if (unlikely(vcpu->arch.mp_state =3D=3D KVM_MP_STATE_UNINITIALIZED)) { if (kvm_run->immediate_exit) { r =3D -EINTR; @@ -10475,8 +10471,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) if (kvm_run->kvm_valid_regs) store_regs(vcpu); post_kvm_run_save(vcpu); - kvm_sigset_deactivate(vcpu); + srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx); =20 + kvm_sigset_deactivate(vcpu); vcpu_put(vcpu); return r; } --=20 2.31.1