Re: [Xen-devel] [PATCH v11 6/7] microcode: rendezvous CPUs in NMI handler and load ucode

From: Jan Beulich <jbeulich@suse.com>
To: Chao Gao <chao.gao@intel.com>
Cc: "Sergey Dyasli" <sergey.dyasli@citrix.com>,
	"Stefano Stabellini" <sstabellini@kernel.org>,
	"Ashok Raj" <ashok.raj@intel.com>, "Wei Liu" <wl@xen.org>,
	"Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
	"George Dunlap" <George.Dunlap@eu.citrix.com>,
	"Andrew Cooper" <andrew.cooper3@citrix.com>,
	"Ian Jackson" <ian.jackson@eu.citrix.com>,
	"Tim Deegan" <tim@xen.org>, "Julien Grall" <julien.grall@arm.com>,
	xen-devel@lists.xenproject.org,
	"Roger Pau Monné" <roger.pau@citrix.com>
Subject: Re: [Xen-devel] [PATCH v11 6/7] microcode: rendezvous CPUs in NMI handler and load ucode
Date: Fri, 27 Sep 2019 15:55:00 +0200	[thread overview]
Message-ID: <1cc3a02b-c73a-d2bd-e96a-3bfa28ddc925@suse.com> (raw)
In-Reply-To: <20190927135330.GA5570@gao-cwp>

On 27.09.2019 15:53, Chao Gao wrote:
> On Fri, Sep 27, 2019 at 12:19:22PM +0200, Jan Beulich wrote:
>> On 26.09.2019 15:53, Chao Gao wrote:
>>> @@ -420,14 +498,23 @@ static int control_thread_fn(const struct microcode_patch *patch)
>>>          return ret;
>>>      }
>>>  
>>> -    /* Let primary threads load the given ucode update */
>>> -    set_state(LOADING_ENTER);
>>> -
>>> +    /* Control thread loads ucode first while others are in NMI handler. */
>>>      ret = microcode_ops->apply_microcode(patch);
>>>      if ( !ret )
>>>          atomic_inc(&cpu_updated);
>>>      atomic_inc(&cpu_out);
>>>  
>>> +    if ( ret == -EIO )
>>> +    {
>>> +        printk(XENLOG_ERR
>>> +               "Late loading aborted: CPU%u failed to update ucode\n", cpu);
>>> +        set_state(LOADING_EXIT);
>>> +        return ret;
>>> +    }
>>> +
>>> +    /* Let primary threads load the given ucode update */
>>> +    set_state(LOADING_ENTER);
>>
>> While the description goes to some lengths to explain this ordering of
>> updates, I still don't really see the point: How is it better for the
>> control CPU to have updated its ucode early and then hit an NMI before
>> the other CPUs have even started updating, than the other way around
>> in the opposite case?
> 
> We want to be conservative here. If an ucode is to update something
> shared by a whole socket, for the latter case, control thread may
> be accessing things that are being updating by the ucode loading on
> other cores. It is not safe, just like sibling thread isn't expected
> to access features exposed by the old ucode when primary thread is
> loading ucode.

Ah yes, considering a socket-wide effect didn't occur to me (although
it should have). So if you mention this aspect in the description, I
think I'm going to be fine with the change in this regard. Yet (as so
often) this raises another question: What about "secondary" sockets?
Shouldn't we entertain a similar two-step approach there then?

Jan

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel