• Wanpeng Li's avatar
    KVM: Fix leak vCPU's VMCS value into other pCPU · 17e433b5
    Wanpeng Li authored
    After commit d73eb57b (KVM: Boost vCPUs that are delivering interrupts), a
    five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs
    on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning splatting
    in the VMs after stress testing:
    
     INFO: rcu_sched detected stalls on CPUs/tasks: { 4 41 57 62 77} (detected by 15, t=60004 jiffies, g=899, c=898, q=15073)
     Call Trace:
       flush_tlb_mm_range+0x68/0x140
       tlb_flush_mmu.part.75+0x37/0xe0
       tlb_finish_mmu+0x55/0x60
       zap_page_range+0x142/0x190
       SyS_madvise+0x3cd/0x9c0
       system_call_fastpath+0x1c/0x21
    
    swait_active() sustains to be true before finish_swait() is called in
    kvm_vcpu_block(), voluntarily preempted vCPUs are taken into account
    by kvm_vcpu_on_spin() loop greatly increases the probability condition
    kvm_arch_vcpu_runnable(vcpu) is checked and can be true, when APICv
    is enabled the yield-candidate vCPU's VMCS RVI field leaks(by
    vmx_sync_pir_to_irr()) into spinning-on-a-taken-lock vCPU's current
    VMCS.
    
    This patch fixes it by checking conservatively a subset of events.
    
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Radim Krčmář <rkrcmar@redhat.com>
    Cc: Christian Borntraeger <borntraeger@de.ibm.com>
    Cc: Marc Zyngier <Marc.Zyngier@arm.com>
    Cc: stable@vger.kernel.org
    Fixes: 98f4a146 (KVM: add kvm_arch_vcpu_runnable() test to kvm_vcpu_on_spin() loop)
    Signed-off-by: default avatarWanpeng Li <wanpengli@tencent.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    17e433b5
vmx.c 216 KB