From e462755cae2bf8297a663278935ad4d59812d2f3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= Date: Thu, 30 Oct 2014 15:06:45 +0100 Subject: [PATCH] KVM: x86: detect SPIV changes under APICv MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit APIC-write VM exits are "trap-like": they save CS:RIP values for the instruction after the write, and more importantly, the handler will already see the new value in the virtual-APIC page. This caused a bug if you used KVM_SET_IRQCHIP to set the SW-enabled bit in the SPIV register. The chain of events is as follows: * When the irqchip is added to the destination VM, the apic_sw_disabled static key is incremented (1) * When the KVM_SET_IRQCHIP ioctl is invoked, it is decremented (0) * When the guest disables the bit in the SPIV register, e.g. as part of shutdown, apic_set_spiv does not notice the change and the static key is _not_ incremented. * When the guest is destroyed, the static key is decremented (-1), resulting in this trace: WARNING: at kernel/jump_label.c:81 __static_key_slow_dec+0xa6/0xb0() jump label: negative count! [] dump_stack+0x19/0x1b [] warn_slowpath_common+0x61/0x80 [] warn_slowpath_fmt+0x5c/0x80 [] __static_key_slow_dec+0xa6/0xb0 [] static_key_slow_dec_deferred+0x16/0x20 [] kvm_free_lapic+0x88/0xa0 [kvm] [] kvm_arch_vcpu_uninit+0x2e/0xe0 [kvm] [] kvm_vcpu_uninit+0x21/0x40 [kvm] [] vmx_free_vcpu+0x47/0x70 [kvm_intel] [] kvm_arch_vcpu_free+0x50/0x60 [kvm] [] kvm_arch_destroy_vm+0x102/0x260 [kvm] [] ? synchronize_srcu+0x1d/0x20 [] kvm_put_kvm+0xe1/0x1c0 [kvm] [] kvm_vcpu_release+0x18/0x20 [kvm] [] __fput+0x102/0x310 [] ____fput+0xe/0x10 [] task_work_run+0xb4/0xe0 [] do_exit+0x304/0xc60 [] ? _raw_spin_unlock_irq+0x2c/0x50 [] ? trace_hardirqs_on_caller+0xfd/0x1c0 [] do_group_exit+0x4c/0xc0 [] SyS_exit_group+0x14/0x20 [] system_call_fastpath+0x16/0x1b Signed-off-by: Radim Krčmář Signed-off-by: Paolo Bonzini --- arch/x86/kvm/lapic.c | 10 ++++++---- arch/x86/kvm/lapic.h | 1 + 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 66dd1731ab99..80df439d4086 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -206,11 +206,13 @@ out: static inline void apic_set_spiv(struct kvm_lapic *apic, u32 val) { - u32 prev = kvm_apic_get_reg(apic, APIC_SPIV); + bool enabled = val & APIC_SPIV_APIC_ENABLED; apic_set_reg(apic, APIC_SPIV, val); - if ((prev ^ val) & APIC_SPIV_APIC_ENABLED) { - if (val & APIC_SPIV_APIC_ENABLED) { + + if (enabled != apic->sw_enabled) { + apic->sw_enabled = enabled; + if (enabled) { static_key_slow_dec_deferred(&apic_sw_disabled); recalculate_apic_map(apic->vcpu->kvm); } else @@ -1357,7 +1359,7 @@ void kvm_free_lapic(struct kvm_vcpu *vcpu) if (!(vcpu->arch.apic_base & MSR_IA32_APICBASE_ENABLE)) static_key_slow_dec_deferred(&apic_hw_disabled); - if (!(kvm_apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_APIC_ENABLED)) + if (!apic->sw_enabled) static_key_slow_dec_deferred(&apic_sw_disabled); if (apic->regs) diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h index 3fd6c22d187d..87e0fae1f4c6 100644 --- a/arch/x86/kvm/lapic.h +++ b/arch/x86/kvm/lapic.h @@ -22,6 +22,7 @@ struct kvm_lapic { struct kvm_timer lapic_timer; u32 divide_count; struct kvm_vcpu *vcpu; + bool sw_enabled; bool irr_pending; /* Number of bits set in ISR. */ s16 isr_count; -- 2.20.1