diff mbox

KVM: X86: Fix loss of pending INIT due to race

Message ID 1501407777-2504-1-git-send-email-wanpeng.li@hotmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Wanpeng Li July 30, 2017, 9:42 a.m. UTC
From: Wanpeng Li <wanpeng.li@hotmail.com>

When SMP VM start, AP may lost INIT because of receiving INIT between
kvm_vcpu_ioctl_x86_get/set_vcpu_events.

       vcpu 0                             vcpu 1
                                   kvm_vcpu_ioctl_x86_get_vcpu_events
                                     events->smi.latched_init = 0
  send INIT to vcpu1
    set vcpu1's pending_events
                                   kvm_vcpu_ioctl_x86_set_vcpu_events
                                      if (events->smi.latched_init == 0)
                                        clear INIT in pending_events

This patch fixes it by not touching INIT pending if INIT is not latched 
which in SMM and just restoring the latched INIT after SET_VCPU_EVENTS.

Thanks Peng Hao for the report and original commit message.

Reported-by: Peng Hao <peng.hao2@zte.com.cn>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
---
 arch/x86/kvm/x86.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

Comments

Paolo Bonzini Aug. 1, 2017, 4:27 p.m. UTC | #1
On 30/07/2017 11:42, Wanpeng Li wrote:
> From: Wanpeng Li <wanpeng.li@hotmail.com>
> 
> When SMP VM start, AP may lost INIT because of receiving INIT between
> kvm_vcpu_ioctl_x86_get/set_vcpu_events.
> 
>        vcpu 0                             vcpu 1
>                                    kvm_vcpu_ioctl_x86_get_vcpu_events
>                                      events->smi.latched_init = 0
>   send INIT to vcpu1
>     set vcpu1's pending_events
>                                    kvm_vcpu_ioctl_x86_set_vcpu_events
>                                       if (events->smi.latched_init == 0)
>                                         clear INIT in pending_events
> 
> This patch fixes it by not touching INIT pending if INIT is not latched 
> which in SMM and just restoring the latched INIT after SET_VCPU_EVENTS.
> 
> Thanks Peng Hao for the report and original commit message.
> 
> Reported-by: Peng Hao <peng.hao2@zte.com.cn>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Radim Krčmář <rkrcmar@redhat.com>
> Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
> ---
>  arch/x86/kvm/x86.c | 8 ++------
>  1 file changed, 2 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 1a4c84d..eaca86d 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -3164,12 +3164,8 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
>  			vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
>  		else
>  			vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
> -		if (lapic_in_kernel(vcpu)) {
> -			if (events->smi.latched_init)
> -				set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
> -			else
> -				clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
> -		}
> +		if (events->smi.latched_init && lapic_in_kernel(vcpu))
> +			set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);

All this block:

                if (events->smi.smm_inside_nmi)
                        vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
                else
                        vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
                if (lapic_in_kernel(vcpu)) {
                        if (events->smi.latched_init)
                                set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
                        else
                                clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
                }

only applies if you're in SMM, so perhaps you can move it under

	if (events->smi.smm)

?

Paolo

>  	}
>  
>  	kvm_make_request(KVM_REQ_EVENT, vcpu);
>
Wanpeng Li Aug. 1, 2017, 10:43 p.m. UTC | #2
2017-08-02 0:27 GMT+08:00 Paolo Bonzini <pbonzini@redhat.com>:
> On 30/07/2017 11:42, Wanpeng Li wrote:
>> From: Wanpeng Li <wanpeng.li@hotmail.com>
>>
>> When SMP VM start, AP may lost INIT because of receiving INIT between
>> kvm_vcpu_ioctl_x86_get/set_vcpu_events.
>>
>>        vcpu 0                             vcpu 1
>>                                    kvm_vcpu_ioctl_x86_get_vcpu_events
>>                                      events->smi.latched_init = 0
>>   send INIT to vcpu1
>>     set vcpu1's pending_events
>>                                    kvm_vcpu_ioctl_x86_set_vcpu_events
>>                                       if (events->smi.latched_init == 0)
>>                                         clear INIT in pending_events
>>
>> This patch fixes it by not touching INIT pending if INIT is not latched
>> which in SMM and just restoring the latched INIT after SET_VCPU_EVENTS.
>>
>> Thanks Peng Hao for the report and original commit message.
>>
>> Reported-by: Peng Hao <peng.hao2@zte.com.cn>
>> Cc: Paolo Bonzini <pbonzini@redhat.com>
>> Cc: Radim Krčmář <rkrcmar@redhat.com>
>> Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
>> ---
>>  arch/x86/kvm/x86.c | 8 ++------
>>  1 file changed, 2 insertions(+), 6 deletions(-)
>>
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 1a4c84d..eaca86d 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -3164,12 +3164,8 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
>>                       vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
>>               else
>>                       vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
>> -             if (lapic_in_kernel(vcpu)) {
>> -                     if (events->smi.latched_init)
>> -                             set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>> -                     else
>> -                             clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>> -             }
>> +             if (events->smi.latched_init && lapic_in_kernel(vcpu))
>> +                     set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>
> All this block:
>
>                 if (events->smi.smm_inside_nmi)
>                         vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
>                 else
>                         vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
>                 if (lapic_in_kernel(vcpu)) {
>                         if (events->smi.latched_init)
>                                 set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>                         else
>                                 clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>                 }
>
> only applies if you're in SMM, so perhaps you can move it under
>
>         if (events->smi.smm)
>
> ?

Good point, I will do it in v2.

Regards,
Wanpeng Li

>
> Paolo
>
>>       }
>>
>>       kvm_make_request(KVM_REQ_EVENT, vcpu);
>>
>
diff mbox

Patch

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1a4c84d..eaca86d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3164,12 +3164,8 @@  static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
 			vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
 		else
 			vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
-		if (lapic_in_kernel(vcpu)) {
-			if (events->smi.latched_init)
-				set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
-			else
-				clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
-		}
+		if (events->smi.latched_init && lapic_in_kernel(vcpu))
+			set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
 	}
 
 	kvm_make_request(KVM_REQ_EVENT, vcpu);