diff mbox

KVM: SVM: fix interrupt injection (apic->isr_count always 0)

Message ID 20150225194140.GA9777@potion.brq.redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Radim Krčmář Feb. 25, 2015, 7:41 p.m. UTC
2015-02-25 17:00+0100, Borislav Petkov:
> Hi,
> 
> commit in $Subject breaks my kvm guest on AMD host, causing it to do the
> following below. Mouse doesn't work anymore in the guest, network is
> gone too.
> 
> Reverting it fixes the issue.

Thanks,

this patch should fix it.

---8<---
In commit b4eef9b36db4, we started to use hwapic_isr_update() != NULL
instead of kvm_apic_vid_enabled(vcpu->kvm).  This didn't work because
SVM had it defined and "apicv" path in apic_{set,clear}_isr() does not
change apic->isr_count, because it should always be 1.  The initial
value of apic->isr_count was based on kvm_apic_vid_enabled(vcpu->kvm),
which is always 0 for SVM, so KVM could have injected interrupts when it
shouldn't.

Fix it by setting SVM's hwapic_isr_update to NULL and make the initial
isr_count depend on hwapic_isr_update() for good measure.

Fixes: b4eef9b36db4 ("kvm: x86: vmx: NULL out hwapic_isr_update() in case of !enable_apicv")
Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Radim Kr?má? <rkrcmar@redhat.com>
---
 arch/x86/kvm/lapic.c | 4 ++--
 arch/x86/kvm/svm.c   | 7 +------
 2 files changed, 3 insertions(+), 8 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Borislav Petkov Feb. 26, 2015, 12:04 p.m. UTC | #1
On Wed, Feb 25, 2015 at 08:41:41PM +0100, Radim Kr?má? wrote:
> this patch should fix it.

Yap, seems so :-)

> ---8<---
> In commit b4eef9b36db4, we started to use hwapic_isr_update() != NULL
> instead of kvm_apic_vid_enabled(vcpu->kvm).  This didn't work because
> SVM had it defined and "apicv" path in apic_{set,clear}_isr() does not
> change apic->isr_count, because it should always be 1.  The initial
> value of apic->isr_count was based on kvm_apic_vid_enabled(vcpu->kvm),
> which is always 0 for SVM, so KVM could have injected interrupts when it
> shouldn't.
> 
> Fix it by setting SVM's hwapic_isr_update to NULL and make the initial
> isr_count depend on hwapic_isr_update() for good measure.
> 
> Fixes: b4eef9b36db4 ("kvm: x86: vmx: NULL out hwapic_isr_update() in case of !enable_apicv")
> Reported-by: Borislav Petkov <bp@alien8.de>

Reported-and-tested-by: Borislav Petkov <bp@suse.de>

> Signed-off-by: Radim Kr?má? <rkrcmar@redhat.com>

Thanks.
Paolo Bonzini Feb. 26, 2015, 2:46 p.m. UTC | #2
On 25/02/2015 20:41, Radim Kr?má? wrote:
> 2015-02-25 17:00+0100, Borislav Petkov:
>> Hi,
>>
>> commit in $Subject breaks my kvm guest on AMD host, causing it to do the
>> following below. Mouse doesn't work anymore in the guest, network is
>> gone too.
>>
>> Reverting it fixes the issue.
> 
> Thanks,
> 
> this patch should fix it.
> 
> ---8<---
> In commit b4eef9b36db4, we started to use hwapic_isr_update() != NULL
> instead of kvm_apic_vid_enabled(vcpu->kvm).  This didn't work because
> SVM had it defined and "apicv" path in apic_{set,clear}_isr() does not
> change apic->isr_count, because it should always be 1.  The initial
> value of apic->isr_count was based on kvm_apic_vid_enabled(vcpu->kvm),
> which is always 0 for SVM, so KVM could have injected interrupts when it
> shouldn't.
> 
> Fix it by setting SVM's hwapic_isr_update to NULL and make the initial
> isr_count depend on hwapic_isr_update() for good measure.
> 
> Fixes: b4eef9b36db4 ("kvm: x86: vmx: NULL out hwapic_isr_update() in case of !enable_apicv")
> Reported-by: Borislav Petkov <bp@alien8.de>
> Signed-off-by: Radim Kr?má? <rkrcmar@redhat.com>
> ---
>  arch/x86/kvm/lapic.c | 4 ++--
>  arch/x86/kvm/svm.c   | 7 +------
>  2 files changed, 3 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index e55b5fc344eb..bd4e34de24c7 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -1572,7 +1572,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu)
>  		apic_set_reg(apic, APIC_TMR + 0x10 * i, 0);
>  	}
>  	apic->irr_pending = kvm_apic_vid_enabled(vcpu->kvm);
> -	apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm);
> +	apic->isr_count = kvm_x86_ops->hwapic_isr_update ? 1 : 0;
>  	apic->highest_isr_cache = -1;
>  	update_divide_count(apic);
>  	atomic_set(&apic->lapic_timer.pending, 0);
> @@ -1782,7 +1782,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu,
>  	update_divide_count(apic);
>  	start_apic_timer(apic);
>  	apic->irr_pending = true;
> -	apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm) ?
> +	apic->isr_count = kvm_x86_ops->hwapic_isr_update ?
>  				1 : count_vectors(apic->regs + APIC_ISR);
>  	apic->highest_isr_cache = -1;
>  	if (kvm_x86_ops->hwapic_irr_update)
> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
> index d319e0c24758..54c7b36ad12d 100644
> --- a/arch/x86/kvm/svm.c
> +++ b/arch/x86/kvm/svm.c
> @@ -3649,11 +3649,6 @@ static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
>  	return;
>  }
>  
> -static void svm_hwapic_isr_update(struct kvm *kvm, int isr)
> -{
> -	return;
> -}
> -
>  static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu)
>  {
>  	return;
> @@ -4403,7 +4398,7 @@ static struct kvm_x86_ops svm_x86_ops = {
>  	.set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode,
>  	.vm_has_apicv = svm_vm_has_apicv,
>  	.load_eoi_exitmap = svm_load_eoi_exitmap,
> -	.hwapic_isr_update = svm_hwapic_isr_update,
> +	.hwapic_isr_update = NULL,

Please remove the line altogether.

Paolo
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index e55b5fc344eb..bd4e34de24c7 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1572,7 +1572,7 @@  void kvm_lapic_reset(struct kvm_vcpu *vcpu)
 		apic_set_reg(apic, APIC_TMR + 0x10 * i, 0);
 	}
 	apic->irr_pending = kvm_apic_vid_enabled(vcpu->kvm);
-	apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm);
+	apic->isr_count = kvm_x86_ops->hwapic_isr_update ? 1 : 0;
 	apic->highest_isr_cache = -1;
 	update_divide_count(apic);
 	atomic_set(&apic->lapic_timer.pending, 0);
@@ -1782,7 +1782,7 @@  void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu,
 	update_divide_count(apic);
 	start_apic_timer(apic);
 	apic->irr_pending = true;
-	apic->isr_count = kvm_apic_vid_enabled(vcpu->kvm) ?
+	apic->isr_count = kvm_x86_ops->hwapic_isr_update ?
 				1 : count_vectors(apic->regs + APIC_ISR);
 	apic->highest_isr_cache = -1;
 	if (kvm_x86_ops->hwapic_irr_update)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d319e0c24758..54c7b36ad12d 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3649,11 +3649,6 @@  static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
 	return;
 }
 
-static void svm_hwapic_isr_update(struct kvm *kvm, int isr)
-{
-	return;
-}
-
 static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu)
 {
 	return;
@@ -4403,7 +4398,7 @@  static struct kvm_x86_ops svm_x86_ops = {
 	.set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode,
 	.vm_has_apicv = svm_vm_has_apicv,
 	.load_eoi_exitmap = svm_load_eoi_exitmap,
-	.hwapic_isr_update = svm_hwapic_isr_update,
+	.hwapic_isr_update = NULL,
 	.sync_pir_to_irr = svm_sync_pir_to_irr,
 
 	.set_tss_addr = svm_set_tss_addr,