A failed REDIST_REGION write can unregister redistributor iodevs while
leaving their assignments cached. A retry then skips those vCPUs and leaves
their iodevs missing.
Patch 1 fixes the accounting when an individual MMIO-bus registration
fails. It reserves the selected region slot before registration and undoes
that assignment on failure.
Patch 2 limits rollback to assignments from the new region. Resetting
assignments from an older region can miss one held by a vCPU that is not
yet visible to kvm_for_each_vcpu() and move free_index behind that live
assignment.
slots_lock prevents a concurrent vCPU from acquiring an assignment from the
new region before a failed write removes it.
Patches 3 and 4 add regression coverage for an overlapping region, retry,
and final GICR_TYPER accesses to all four redistributors.
Testing:
- Built the modified arm64 KVM objects with W=1 and the arm64 vgic_init
selftest using GCC 13.3.0.
- On an Arm Base RevC AEMvA FVP with GICv3, vgic_init passed with nVHE,
VHE and protected hVHE. A VHE kernel with PROVE_LOCKING and KASAN also
passed without lockdep or KASAN reports. A control kernel containing
only patches 3 and 4 failed at the first GICR_TYPER access, 0x8030008.
- Under QEMU 11.0.2 TCG, test-only instrumentation paused vCPU creation
after assigning a redistributor but before kvm_for_each_vcpu() could see
it. An MMIO-bus registration failure was injected after one vCPU was
assigned to the new region.
Rollback preserved the old assignment before and after the vCPU became
visible. A valid retry succeeded and guest GICR_TYPER accesses found all
four redistributors.
- An adapted Linux 5.10.268 backport of patches 1 and 2, on top of
8542a8f95a67 ("KVM: arm64: vgic-v3: Fix error handling in
vgic_v3_set_redist_base()"), passed the isolated retry test. The
prerequisite-only control failed at the same GICR_TYPER access.
---
Changes since v3:
- Dropped the REDIST/REDIST_REGION serialization and VGIC init/destroy
rework, keeping the fix close to v2. (Marc)
- Limited rollback to assignments from the new region so an older-region
assignment cannot be missed during concurrent vCPU creation.
- Added Fuad's Reviewed-by tags to patches 1, 3 and 4. These are otherwise
unchanged from v3 (formerly patches 1, 4 and 5).
Previous version:
v3: https://lore.kernel.org/r/[email protected]
Karl Mehltretter (4):
KVM: arm64: vgic-v3: Undo assignment on iodev registration failure
KVM: arm64: vgic-v3: Roll back assignments from the new region
KVM: arm64: selftests: Pass guest code to vm_gic_create_with_vcpus()
KVM: arm64: selftests: Test VGICv3 redistributor region retry
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 54 ++++++--
tools/testing/selftests/kvm/arm64/vgic_init.c | 116 ++++++++++++++++--
2 files changed, 151 insertions(+), 19 deletions(-)
base-commit: cf72cbb39da84b6f02f90c07f33b102fc10b16f0
--
2.39.5 (Apple Git-154)
