Skip to contentSkip to conversation

KVM: x86: fix vcpu initialization with userspace lapic

PATCH In review Radim Krčmář 3 participants 3 messages Mar 1, 2018

Subsystems (4)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 KVM: x86: fix vcpu initialization with userspace lapic

Moving the code around broke this rare configuration. Use this opportunity to finally call lapic reset from vcpu reset.

Fixes 0b2e9904c159 ("KVM: x86: move LAPIC initialization after VMCS creation")
---
 arch/x86/kvm/lapic.c | 10 ++++------
 arch/x86/kvm/x86.c   |  3 ++-
 2 files changed, 6 insertions(+), 7 deletions(-)
arch/x86/kvm/lapic.c +4 -6
index cc5fe7a50dde..391dda8d43b7 100644
@@ -2002,14 +2002,13 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
 
 void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
-	struct kvm_lapic *apic;
+	struct kvm_lapic *apic = vcpu->arch.apic;
 	int i;
 
-	apic_debug("%s\n", __func__);
+	if (!apic)
+		return;
 
-	ASSERT(vcpu);
-	apic = vcpu->arch.apic;
-	ASSERT(apic != NULL);
+	apic_debug("%s\n", __func__);
 
 	/* Stop the timer in case it's a reset to an active apic */
 	hrtimer_cancel(&apic->lapic_timer.timer);
@@ -2568,7 +2567,6 @@ void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
 
 	pe = xchg(&apic->pending_events, 0);
 	if (test_bit(KVM_APIC_INIT, &pe)) {
-		kvm_lapic_reset(vcpu, true);
 		kvm_vcpu_reset(vcpu, true);
 		if (kvm_vcpu_is_bsp(apic->vcpu))
 			vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
arch/x86/kvm/x86.c +2 -1
index 1a3ed81031f1..3f96b51d0495 100644
@@ -8123,7 +8123,6 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
 	kvm_vcpu_mtrr_init(vcpu);
 	vcpu_load(vcpu);
 	kvm_vcpu_reset(vcpu, false);
-	kvm_lapic_reset(vcpu, false);
 	kvm_mmu_setup(vcpu);
 	vcpu_put(vcpu);
 	return 0;
@@ -8166,6 +8165,8 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 
 void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
+	kvm_lapic_reset(vcpu, init_event);
+
 	vcpu->arch.hflags = 0;
 
 	vcpu->arch.smi_pending = 0;
Signature · 1 line
2.15.1
#1 lore raw
Quoted 4 lines · Radim Krčmář

Moving the code around broke this rare configuration. Use this opportunity to finally call lapic reset from vcpu reset.

This was reported by syzbot:
https://groups.google.com/d/msg/syzkaller-bugs/QrDXoM_mQRk/mT2cebykBQAJ

Please add the

Reported-by [email protected]

tag so that syzbot will know when it's fixed.

Quoted 64 lines
Fixes 0b2e9904c159 ("KVM: x86: move LAPIC initialization after VMCS creation")
---
 arch/x86/kvm/lapic.c | 10 ++++------
 arch/x86/kvm/x86.c   |  3 ++-
 2 files changed, 6 insertions(+), 7 deletions(-)
arch/x86/kvm/lapic.c +4 -6
index cc5fe7a50dde..391dda8d43b7 100644
@@ -2002,14 +2002,13 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
 
 void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
-       struct kvm_lapic *apic;
+       struct kvm_lapic *apic = vcpu->arch.apic;
        int i;
 
-       apic_debug("%s\n", __func__);
+       if (!apic)
+               return;
 
-       ASSERT(vcpu);
-       apic = vcpu->arch.apic;
-       ASSERT(apic != NULL);
+       apic_debug("%s\n", __func__);
 
        /* Stop the timer in case it's a reset to an active apic */
        hrtimer_cancel(&apic->lapic_timer.timer);
@@ -2568,7 +2567,6 @@ void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
 
        pe = xchg(&apic->pending_events, 0);
        if (test_bit(KVM_APIC_INIT, &pe)) {
-               kvm_lapic_reset(vcpu, true);
                kvm_vcpu_reset(vcpu, true);
                if (kvm_vcpu_is_bsp(apic->vcpu))
                        vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
arch/x86/kvm/x86.c +2 -2
index 1a3ed81031f1..3f96b51d0495 100644
@@ -8123,7 +8123,6 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
        kvm_vcpu_mtrr_init(vcpu);
        vcpu_load(vcpu);
        kvm_vcpu_reset(vcpu, false);
-       kvm_lapic_reset(vcpu, false);
        kvm_mmu_setup(vcpu);
        vcpu_put(vcpu);
        return 0;
@@ -8166,6 +8165,8 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 
 void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
+       kvm_lapic_reset(vcpu, init_event);
+
        vcpu->arch.hflags = 0;
 
        vcpu->arch.smi_pending = 0;
--

2.15.1

maintainer
#2 lore raw
In reply to Radim Krčmář
Quoted 58 lines · Radim Krčmář

Moving the code around broke this rare configuration. Use this opportunity to finally call lapic reset from vcpu reset.

Fixes 0b2e9904c159 ("KVM: x86: move LAPIC initialization after VMCS creation")
---
 arch/x86/kvm/lapic.c | 10 ++++------
 arch/x86/kvm/x86.c   |  3 ++-
 2 files changed, 6 insertions(+), 7 deletions(-)
arch/x86/kvm/lapic.c +4 -6
index cc5fe7a50dde..391dda8d43b7 100644
@@ -2002,14 +2002,13 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
 
 void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
-	struct kvm_lapic *apic;
+	struct kvm_lapic *apic = vcpu->arch.apic;
 	int i;
 
-	apic_debug("%s\n", __func__);
+	if (!apic)
+		return;
 
-	ASSERT(vcpu);
-	apic = vcpu->arch.apic;
-	ASSERT(apic != NULL);
+	apic_debug("%s\n", __func__);
 
 	/* Stop the timer in case it's a reset to an active apic */
 	hrtimer_cancel(&apic->lapic_timer.timer);
@@ -2568,7 +2567,6 @@ void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
 
 	pe = xchg(&apic->pending_events, 0);
 	if (test_bit(KVM_APIC_INIT, &pe)) {
-		kvm_lapic_reset(vcpu, true);
 		kvm_vcpu_reset(vcpu, true);
 		if (kvm_vcpu_is_bsp(apic->vcpu))
 			vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
arch/x86/kvm/x86.c +0 -1
index 1a3ed81031f1..3f96b51d0495 100644
@@ -8123,7 +8123,6 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
 	kvm_vcpu_mtrr_init(vcpu);
 	vcpu_load(vcpu);
 	kvm_vcpu_reset(vcpu, false);
-	kvm_lapic_reset(vcpu, false);
 	kvm_mmu_setup(vcpu);
 	vcpu_put(vcpu);
 	return 0;

arch/x86/kvm/x86.c void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) · line 8172

Quoted 8 lines
arch/x86/kvm/x86.c +2 -0
@@ -8166,6 +8165,8 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
 
 void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
 {
+	kvm_lapic_reset(vcpu, init_event);
+
 	vcpu->arch.hflags = 0;
 
 	vcpu->arch.smi_pending = 0;

Much better indeed, thanks.

Paolo