Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/469444/?format=api
{ "id": 469444, "url": "http://patchwork.ozlabs.org/api/patches/469444/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/1430991989-23170-6-git-send-email-luis.henriques@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<1430991989-23170-6-git-send-email-luis.henriques@canonical.com>", "list_archive_url": null, "date": "2015-05-07T09:43:34", "name": "[3.16.y-ckt,005/180] KVM: x86: Fix lost interrupt on irr_pending race", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "e03b7a1fe5007070b0f2e1af4a510ade31a8b26c", "submitter": { "id": 12551, "url": "http://patchwork.ozlabs.org/api/people/12551/?format=api", "name": "Luis Henriques", "email": "luis.henriques@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/1430991989-23170-6-git-send-email-luis.henriques@canonical.com/mbox/", "series": [], "comments": "http://patchwork.ozlabs.org/api/patches/469444/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/469444/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@bilbo.ozlabs.org", "Received": [ "from huckleberry.canonical.com (huckleberry.canonical.com\n\t[91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 0A0D2140283;\n\tThu, 7 May 2015 19:50:57 +1000 (AEST)", "from localhost ([127.0.0.1] helo=huckleberry.canonical.com)\n\tby huckleberry.canonical.com with esmtp (Exim 4.76)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1YqISC-0000Vw-GA; Thu, 07 May 2015 09:50:52 +0000", "from youngberry.canonical.com ([91.189.89.112])\n\tby huckleberry.canonical.com with esmtp (Exim 4.76)\n\t(envelope-from <luis.henriques@canonical.com>) id 1YqIOC-0006Hp-ER\n\tfor kernel-team@lists.ubuntu.com; Thu, 07 May 2015 09:46:44 +0000", "from av-217-129-142-138.netvisao.pt ([217.129.142.138]\n\thelo=localhost) by youngberry.canonical.com with esmtpsa\n\t(TLS1.0:RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.71) (envelope-from <luis.henriques@canonical.com>)\n\tid 1YqIOC-00022M-09; Thu, 07 May 2015 09:46:44 +0000" ], "From": "Luis Henriques <luis.henriques@canonical.com>", "To": "linux-kernel@vger.kernel.org, stable@vger.kernel.org,\n\tkernel-team@lists.ubuntu.com", "Subject": "[PATCH 3.16.y-ckt 005/180] KVM: x86: Fix lost interrupt on\n\tirr_pending race", "Date": "Thu, 7 May 2015 10:43:34 +0100", "Message-Id": "<1430991989-23170-6-git-send-email-luis.henriques@canonical.com>", "X-Mailer": "git-send-email 2.1.4", "In-Reply-To": "<1430991989-23170-1-git-send-email-luis.henriques@canonical.com>", "References": "<1430991989-23170-1-git-send-email-luis.henriques@canonical.com>", "X-Extended-Stable": "3.16", "Cc": "Paolo Bonzini <pbonzini@redhat.com>, Nadav Amit <namit@cs.technion.ac.il>", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.14", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n\t<mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n\t<mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "kernel-team-bounces@lists.ubuntu.com" }, "content": "3.16.7-ckt11 -stable review patch. If anyone has any objections, please let me know.\n\n------------------\n\nFrom: Nadav Amit <namit@cs.technion.ac.il>\n\ncommit f210f7572bedf3320599e8b2d8e8ec2d96270d0b upstream.\n\napic_find_highest_irr assumes irr_pending is set if any vector in APIC_IRR is\nset. If this assumption is broken and apicv is disabled, the injection of\ninterrupts may be deferred until another interrupt is delivered to the guest.\nUltimately, if no other interrupt should be injected to that vCPU, the pending\ninterrupt may be lost.\n\ncommit 56cc2406d68c (\"KVM: nVMX: fix \"acknowledge interrupt on exit\" when APICv\nis in use\") changed the behavior of apic_clear_irr so irr_pending is cleared\nafter setting APIC_IRR vector. After this commit, if apic_set_irr and\napic_clear_irr run simultaneously, a race may occur, resulting in APIC_IRR\nvector set, and irr_pending cleared. In the following example, assume a single\nvector is set in IRR prior to calling apic_clear_irr:\n\napic_set_irr\t\t\t\tapic_clear_irr\n------------\t\t\t\t--------------\napic->irr_pending = true;\n\t\t\t\t\tapic_clear_vector(...);\n\t\t\t\t\tvec = apic_search_irr(apic);\n\t\t\t\t\t// => vec == -1\napic_set_vector(...);\n\t\t\t\t\tapic->irr_pending = (vec != -1);\n\t\t\t\t\t// => apic->irr_pending == false\n\nNonetheless, it appears the race might even occur prior to this commit:\n\napic_set_irr\t\t\t\tapic_clear_irr\n------------\t\t\t\t--------------\napic->irr_pending = true;\n\t\t\t\t\tapic->irr_pending = false;\n\t\t\t\t\tapic_clear_vector(...);\n\t\t\t\t\tif (apic_search_irr(apic) != -1)\n\t\t\t\t\t\tapic->irr_pending = true;\n\t\t\t\t\t// => apic->irr_pending == false\napic_set_vector(...);\n\nFixing this issue by:\n1. Restoring the previous behavior of apic_clear_irr: clear irr_pending, call\n apic_clear_vector, and then if APIC_IRR is non-zero, set irr_pending.\n2. On apic_set_irr: first call apic_set_vector, then set irr_pending.\n\nSigned-off-by: Nadav Amit <namit@cs.technion.ac.il>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Luis Henriques <luis.henriques@canonical.com>\n---\n arch/x86/kvm/lapic.c | 18 ++++++++++++------\n 1 file changed, 12 insertions(+), 6 deletions(-)", "diff": "diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c\nindex 453e5fbbb7ae..f96b8a4d3fed 100644\n--- a/arch/x86/kvm/lapic.c\n+++ b/arch/x86/kvm/lapic.c\n@@ -323,8 +323,12 @@ EXPORT_SYMBOL_GPL(kvm_apic_update_irr);\n \n static inline void apic_set_irr(int vec, struct kvm_lapic *apic)\n {\n-\tapic->irr_pending = true;\n \tapic_set_vector(vec, apic->regs + APIC_IRR);\n+\t/*\n+\t * irr_pending must be true if any interrupt is pending; set it after\n+\t * APIC_IRR to avoid race with apic_clear_irr\n+\t */\n+\tapic->irr_pending = true;\n }\n \n static inline int apic_search_irr(struct kvm_lapic *apic)\n@@ -356,13 +360,15 @@ static inline void apic_clear_irr(int vec, struct kvm_lapic *apic)\n \n \tvcpu = apic->vcpu;\n \n-\tapic_clear_vector(vec, apic->regs + APIC_IRR);\n-\tif (unlikely(kvm_apic_vid_enabled(vcpu->kvm)))\n+\tif (unlikely(kvm_apic_vid_enabled(vcpu->kvm))) {\n \t\t/* try to update RVI */\n+\t\tapic_clear_vector(vec, apic->regs + APIC_IRR);\n \t\tkvm_make_request(KVM_REQ_EVENT, vcpu);\n-\telse {\n-\t\tvec = apic_search_irr(apic);\n-\t\tapic->irr_pending = (vec != -1);\n+\t} else {\n+\t\tapic->irr_pending = false;\n+\t\tapic_clear_vector(vec, apic->regs + APIC_IRR);\n+\t\tif (apic_search_irr(apic) != -1)\n+\t\t\tapic->irr_pending = true;\n \t}\n }\n \n", "prefixes": [ "3.16.y-ckt", "005/180" ] }