From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C3B32C61DB9 for ; Sun, 30 Aug 2026 08:25:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:MIME-Version: References:In-Reply-To:Subject:Cc:To:From:Message-ID:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=bEUIZ+P1wvBK9wpdoS7CCGcxWQYocPml39xu6l1/88k=; b=D/PkARU13oqKciKzOfPFun0uhu ZaROF7yIvh+fs7VYWPVX2mXvEKQJGY+WXkm0+anyWhSUSCNeejlK3uMXoUJiBD5ufHL5V1xgjrQDb cQkyi1zsT2kWw53/7qmqsG8P+yGmGiX2FCaptkpY30CJCCMMmuCB0wtRpWQq720p2z6/D4k1iJ4SL ihNLP1P/dbfh3XGUKY7oANdLWVIiSyIrpAamLnsqPz/IvB0mw3jJqePWiusi/PTQrYVNAV8ufUCBj tV8kgm5sCtQD++VR/UXedNwyZj9SYEoc+4Lz7dYYOnfh2Id4aSY52aC5KH3g5B6xjLt4ZS7naG5sm DoGJDjrw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x0arD-00000007arb-3ki4; Sun, 30 Aug 2026 08:25:39 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x0arC-00000007arV-0EGL for linux-arm-kernel@lists.infradead.org; Sun, 30 Aug 2026 08:25:38 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id CAEF3600AE; Sun, 30 Aug 2026 08:25:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6500C1F000E9; Sun, 30 Aug 2026 08:25:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788078335; bh=bEUIZ+P1wvBK9wpdoS7CCGcxWQYocPml39xu6l1/88k=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=kERBUMQhAWsGtfPppvbbc5Ow5SVOyx9BzibtFkuYKDdkZKVF/+nExG+oiS5W39jGn TlfpVFuP300bYoB4ZZm29ZvmOcH5mWtDtO3J3Bn1vjM9ab3rbEjZrH59nooShVKn9F K2jZ714m8cA7gkqBfpFRTdPH6mbabr0eCD58aHcicTLKLsa7ND6nQPN3bh7bVoxPjM 0pzmG4noJ1tAbDEuR8Wdbs7lv8y86sqkuhHN1y18TCJ1UrSdvqJyODFjIIpTUvjr9C 0V59nsDrZs0y5ZY9GAwEbv8C5k8DFaTlgBDvI6EVpL54T5PuxzIMd3MqG9I4BF2z1y 91Z8nslq4rg6Q== Received: from sofa.misterjones.org ([185.219.108.64] helo=lobster-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x0ar7-00000002Ri4-09sG; Sun, 30 Aug 2026 08:25:33 +0000 Date: Sun, 30 Aug 2026 09:28:05 +0100 Message-ID: <87zey4m2qy.wl-maz@kernel.org> From: Marc Zyngier To: Karl Mehltretter Cc: Oliver Upton , kvmarm@lists.linux.dev, Fuad Tabba , Joey Gouly , Steffen Eiden , Suzuki K Poulose , Zenghui Yu , Catalin Marinas , Will Deacon , Paolo Bonzini , Shuah Khan , Eric Auger , Christoffer Dall , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH v3 0/5] KVM: arm64: fix VGICv3 redistributor rollback In-Reply-To: <20260822095346.53882-1-kmehltretter@gmail.com> References: <20260822095346.53882-1-kmehltretter@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: kmehltretter@gmail.com, oupton@kernel.org, kvmarm@lists.linux.dev, fuad.tabba@linux.dev, joey.gouly@arm.com, seiden@linux.ibm.com, suzuki.poulose@arm.com, yuzenghui@huawei.com, catalin.marinas@arm.com, will@kernel.org, pbonzini@redhat.com, shuah@kernel.org, eric.auger@redhat.com, christoffer.dall@arm.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-kselftest@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Sat, 22 Aug 2026 10:53:41 +0100, Karl Mehltretter wrote: > > A failed REDIST_REGION write can remove redistributor iodevs from > KVM_MMIO_BUS while leaving their cached vCPU assignments intact. A > corrected retry then skips those redistributors. > > Userspace should instead see a failed region update atomically: no prior > redistributor assignment survives the failure, and the next successful > update rebuilds all possible assignments in region-index order. > > Patch 1 fixes a separate accounting bug when an individual MMIO-bus > registration fails. It reserves the selected region slot before > registration and undoes that known-latest assignment if registration fails. > > Patch 2 implements the atomic failed-region behavior. It unregisters every > redistributor iodev, clears every cached assignment, resets the region > counters, and frees the newly inserted region. An in-flight vCPU can have > an RD iodev before kvm_for_each_vcpu() can see it, so REDIST and > REDIST_REGION writes are serialized with vCPU creation and return -EBUSY > while the created_vcpus/online_vcpus counts differ. > > Patch 3 is independent teardown cleanup. It separates MMIO-bus teardown > from config-locked assignment cleanup, preserves the cleanup required > before a late failed vCPU creation frees the vCPU, and removes the special > conditional from the common vCPU destructor. > > Patch 4 keeps the selftest helper aligned with vm_create_with_vcpus(), and > patch 5 adds regression coverage for an overlapping region, retry, and > final GICR_TYPER accesses to all four redistributors. The test exercises > patch 2's final-state behavior; patch 1's MMIO-bus allocation failure is > not fault-injected. > > Testing: built the patched kernel and the arm64 vgic_init selftest with > GCC 13.3.0 in an arm64 Linux container. The selftest passed under QEMU > 11.0.2 TCG with -machine virt,virtualization=on,gic-version=3 and -cpu max. > > --- > Changes since v2: > - Patch 1: limit free_index rollback to the immediate registration failure > under slots_lock instead of generic unregistration. (Sashiko) > - Patch 2: reset all assignments and region counters after a failed region > update (Marc), and serialize REDIST and REDIST_REGION writes with vCPU > creation so rollback cannot miss an unpublished assignment. > - Patch 3: add an already-locked unassignment primitive, move failed-vCPU > cleanup to kvm_vgic_vcpu_destroy(), and remove the redundant base_addr > reset. (Marc) > - Patch 4: match vm_create_with_vcpus() by using void * for the guest-code > argument. (Sashiko) > - Patch 5: document how the first three redistributors span regions 0 > and 1; no functional change. I really don't understand why this is such a massive departure from v2, which was pretty close to what I wanted to see. Honestly, you are making things harder for everyone by over-designing (or more probably under-filtering) things that should be *fixes*, and just that. If you want to rework all of the vgic init/destroy, fine by me. Do that as a separate series. But for fixes that carry a Cc stable and require backporting to 6 year old kernels, that's not on. The hack below is what I have against your v2 to make it acceptable. M. diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c index 84e67c23bedc0..85b00849e6154 100644 --- a/arch/arm64/kvm/vgic/vgic-init.c +++ b/arch/arm64/kvm/vgic/vgic-init.c @@ -539,8 +539,6 @@ static void __kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) */ if (kvm_get_vcpu_by_id(vcpu->kvm, vcpu->vcpu_id) != vcpu) vgic_unregister_redist_iodev(vcpu); - - vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF; } } @@ -563,14 +561,13 @@ void kvm_vgic_destroy(struct kvm *kvm) vgic_debug_destroy(kvm); - kvm_for_each_vcpu(i, vcpu, kvm) + kvm_for_each_vcpu(i, vcpu, kvm) { __kvm_vgic_vcpu_destroy(vcpu); - - if (kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) { - mutex_unlock(&kvm->arch.config_lock); - kvm_for_each_vcpu(i, vcpu, kvm) - vgic_unregister_redist_iodev(vcpu); - mutex_lock(&kvm->arch.config_lock); + if (kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) { + kvm_io_bus_unregister_dev(vcpu->kvm, KVM_MMIO_BUS, + &vcpu->arch.vgic_cpu.rd_iodev.dev); + __vgic_unassign_redist_iodev(vcpu); + } } kvm_vgic_dist_destroy(kvm); -- Jazz isn't dead. It just smells funny.