| Message ID | 20150225194140.GA9777@potion.brq.redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Wed, Feb 25, 2015 at 08:41:41PM +0100, Radim Kr?má? wrote: > this patch should fix it. Yap, seems so :-) > ---8<--- > In commit b4eef9b36db4, we started to use hwapic_isr_update() != NULL > instead of kvm_apic_vid_enabled(vcpu->kvm). This didn't work because > SVM had it defined and "apicv" path in apic_{set,clear}_isr() does not > change apic->isr_count, because it should always be 1. The initial > value of apic->isr_count was based on kvm_apic_vid_enabled(vcpu->kvm), > which is always 0 for SVM, so KVM could have injected interrupts when it > shouldn't. > > Fix it by setting SVM's hwapic_isr_update to NULL and make the initial > isr_count depend on hwapic_isr_update() for good measure. > > Fixes: b4eef9b36db4 ("kvm: x86: vmx: NULL out hwapic_isr_update() in case of !enable_apicv") > Reported-by: Borislav Petkov <bp@alien8.de> Reported-and-tested-by: Borislav Petkov <bp@suse.de> > Signed-off-by: Radim Kr?má? <rkrcmar@redhat.com> Thanks.
On 25/02/2015 20:41, Radim Kr?má? wrote: > 2015-02-25 17:00+0100, Borislav Petkov: >> Hi, >> >> commit in $Subject breaks my kvm guest on AMD host, causing it to do the >> following below. Mouse doesn't work anymore in the guest, network is >> gone too. >> >> Reverting it fixes the issue. > > Thanks, > > this patch should fix it. > > ---8<--- > In commit b4eef9b36db4, we started to use hwapic_isr_update() != NULL > instead of kvm_apic_vid_enabled(vcpu->kvm). This didn't work because > SVM had it defined and "apicv" path in apic_{set,clear}_isr() does not > change apic->isr_count, because it should always be 1. The initial > value of apic->isr_count was based on kvm_apic_vid_enabled(vcpu->kvm), > which is always 0 for SVM, so KVM could have injected interrupts when it > shouldn't. > > Fix it by setting SVM's hwapic_isr_update to NULL and make the initial > isr_count depend on hwapic_isr_update() for good measure. > > Fixes: b4eef9b36db4 ("kvm: x86: vmx: NULL out hwapic_isr_update() in case of !enable_apicv") > Reported-by: Borislav Petkov <bp@alien8.de> > Signed-off-by: Radim Kr?má? <rkrcmar@redhat.com> > --- > arch/x86/kvm/lapic.c | 4 ++-- > arch/x86/kvm/svm.c | 7 +------ > 2 files changed, 3 insertions(+), 8 deletions(-) > > diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c > index e55b5fc344eb..bd4e34de24c7 100644 > --- a/arch/x86/kvm/lapic.c > +++ b/arch/x86/kvm/lapic.c > @@ -1572,7 +1572,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu) > apic_set_reg(apic, APIC_TMR + 0x10 * i, 0); > } > apic->irr_pending = kvm_apic_vid_enabled(vcpu->kvm); > - apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm); > + apic->isr_count = kvm_x86_ops->hwapic_isr_update ? 1 : 0; > apic->highest_isr_cache = -1; > update_divide_count(apic); > atomic_set(&apic->lapic_timer.pending, 0); > @@ -1782,7 +1782,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu, > update_divide_count(apic); > start_apic_timer(apic); > apic->irr_pending = true; > - apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm) ? > + apic->isr_count = kvm_x86_ops->hwapic_isr_update ? > 1 : count_vectors(apic->regs + APIC_ISR); > apic->highest_isr_cache = -1; > if (kvm_x86_ops->hwapic_irr_update) > diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c > index d319e0c24758..54c7b36ad12d 100644 > --- a/arch/x86/kvm/svm.c > +++ b/arch/x86/kvm/svm.c > @@ -3649,11 +3649,6 @@ static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap) > return; > } > > -static void svm_hwapic_isr_update(struct kvm *kvm, int isr) > -{ > - return; > -} > - > static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu) > { > return; > @@ -4403,7 +4398,7 @@ static struct kvm_x86_ops svm_x86_ops = { > .set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode, > .vm_has_apicv = svm_vm_has_apicv, > .load_eoi_exitmap = svm_load_eoi_exitmap, > - .hwapic_isr_update = svm_hwapic_isr_update, > + .hwapic_isr_update = NULL, Please remove the line altogether. Paolo -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index e55b5fc344eb..bd4e34de24c7 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1572,7 +1572,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu) apic_set_reg(apic, APIC_TMR + 0x10 * i, 0); } apic->irr_pending = kvm_apic_vid_enabled(vcpu->kvm); - apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm); + apic->isr_count = kvm_x86_ops->hwapic_isr_update ? 1 : 0; apic->highest_isr_cache = -1; update_divide_count(apic); atomic_set(&apic->lapic_timer.pending, 0); @@ -1782,7 +1782,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu, update_divide_count(apic); start_apic_timer(apic); apic->irr_pending = true; - apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm) ? + apic->isr_count = kvm_x86_ops->hwapic_isr_update ? 1 : count_vectors(apic->regs + APIC_ISR); apic->highest_isr_cache = -1; if (kvm_x86_ops->hwapic_irr_update) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index d319e0c24758..54c7b36ad12d 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -3649,11 +3649,6 @@ static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap) return; } -static void svm_hwapic_isr_update(struct kvm *kvm, int isr) -{ - return; -} - static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu) { return; @@ -4403,7 +4398,7 @@ static struct kvm_x86_ops svm_x86_ops = { .set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode, .vm_has_apicv = svm_vm_has_apicv, .load_eoi_exitmap = svm_load_eoi_exitmap, - .hwapic_isr_update = svm_hwapic_isr_update, + .hwapic_isr_update = NULL, .sync_pir_to_irr = svm_sync_pir_to_irr, .set_tss_addr = svm_set_tss_addr,