From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB2C5C001B2 for ; Thu, 8 Dec 2022 21:54:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229957AbiLHVyw (ORCPT ); Thu, 8 Dec 2022 16:54:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54692 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229763AbiLHVyj (ORCPT ); Thu, 8 Dec 2022 16:54:39 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4AF8C5E9CE for ; Thu, 8 Dec 2022 13:53:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1670536417; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZBcgK9VV/d10fUxDLy8U04mKJvxJMTTu6G7jiNs4zZo=; b=ESrn+rPwRD5dCJzQFw39Xog+yV6VY1eUWZ7327Ncnup3hL247aUwhHd68o1gk4O1+H5uTj 6zVEKHmJKXcrWM2l5Z7S9eyCdPM22sG2F/TEV9INL9SSXaAXwFVSWJaPG75YVkprGtYKjo wRJuwBR+s9SbOSBhpHDdpTyiPFIJbWw= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-103-pQRAInqUNWqPC4SgPupWBA-1; Thu, 08 Dec 2022 16:53:28 -0500 X-MC-Unique: pQRAInqUNWqPC4SgPupWBA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 44975802E5D; Thu, 8 Dec 2022 21:53:28 +0000 (UTC) Received: from starship (unknown [10.35.206.46]) by smtp.corp.redhat.com (Postfix) with ESMTP id D0D9840C6EC2; Thu, 8 Dec 2022 21:53:26 +0000 (UTC) Message-ID: Subject: Re: [PATCH v4 06/32] KVM: x86: Track xAPIC ID only on userspace SET, _after_ vAPIC is updated From: Maxim Levitsky To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Alejandro Jimenez , Suravee Suthikulpanit , Li RongQing Date: Thu, 08 Dec 2022 23:53:25 +0200 In-Reply-To: <20221001005915.2041642-7-seanjc@google.com> References: <20221001005915.2041642-1-seanjc@google.com> <20221001005915.2041642-7-seanjc@google.com> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 2022-10-01 at 00:58 +0000, Sean Christopherson wrote: > Track potential changes to a vCPU's xAPIC ID only for KVM_SET_LAPIC, i.e. > not for KVM_GET_LAPIC, and process the update after the incoming state > provided by userspace is copied to KVM's in-kernel vAPIC. The latter bug > is the most problematic issue, as processing the update before KVM's > vAPIC is actually updated can result in false positives, e.g. due to the > APIC holding an x2APIC ID (wrong format), and false negatives, e.g. due > to KVM failing to detect an xAPIC ID "mismatch". > > Processing an "update" in KVM_GET_LAPIC is likely a benign bug now that > the update helper ignores mismatches, but prior to that fix, invoking > KVM_GET_LAPIC while the APIC is disabled could effectively cause KVM to > consume stale state, e.g. if the APIC were in x2APIC mode before being > hardware disabled. > > Fixes: 3743c2f02517 ("KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base") > Reported-by: Alejandro Jimenez > Cc: stable@vger.kernel.org > Signed-off-by: Sean Christopherson > --- > arch/x86/kvm/lapic.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c > index 67260f7ce43a..251856ba0750 100644 > --- a/arch/x86/kvm/lapic.c > +++ b/arch/x86/kvm/lapic.c > @@ -2720,8 +2720,6 @@ static int kvm_apic_state_fixup(struct kvm_vcpu *vcpu, > icr = __kvm_lapic_get_reg64(s->regs, APIC_ICR); > __kvm_lapic_set_reg(s->regs, APIC_ICR2, icr >> 32); > } > - } else { > - kvm_lapic_xapic_id_updated(vcpu->arch.apic); > } > > return 0; > @@ -2757,6 +2755,9 @@ int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s) > } > memcpy(vcpu->arch.apic->regs, s->regs, sizeof(*s)); > > + if (!apic_x2apic_mode(vcpu->arch.apic)) > + kvm_lapic_xapic_id_updated(vcpu->arch.apic); > + > atomic_set_release(&apic->vcpu->kvm->arch.apic_map_dirty, DIRTY); > kvm_recalculate_apic_map(vcpu->kvm); > kvm_apic_set_version(vcpu); Reviewed-by: Maxim Levitsky Best regards, Maxim Levitsky