KVM: arm/arm64: vgic: Don't rely on the wrong pending table
commit ca185b260951d3b55108c0b95e188682d8a507b7 upstream.
It's possible that two LPIs locate in the same "byte_offset" but target
two different vcpus, where their pending status are indicated by two
different pending tables. In such a scenario, using last_byte_offset
optimization will lead KVM relying on the wrong pending table entry.
Let us use last_ptr instead, which can be treated as a byte index into
a pending table and also, can be vcpu specific.
Fixes: 280771252c
("KVM: arm64: vgic-v3: KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES")
Cc: stable@vger.kernel.org
Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Eric Auger <eric.auger@redhat.com>
Link: https://lore.kernel.org/r/20191029071919.177-4-yuzenghui@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
e8d9825d55
commit
66f8ca55eb
@ -375,8 +375,8 @@ retry:
|
|||||||
int vgic_v3_save_pending_tables(struct kvm *kvm)
|
int vgic_v3_save_pending_tables(struct kvm *kvm)
|
||||||
{
|
{
|
||||||
struct vgic_dist *dist = &kvm->arch.vgic;
|
struct vgic_dist *dist = &kvm->arch.vgic;
|
||||||
int last_byte_offset = -1;
|
|
||||||
struct vgic_irq *irq;
|
struct vgic_irq *irq;
|
||||||
|
gpa_t last_ptr = ~(gpa_t)0;
|
||||||
int ret;
|
int ret;
|
||||||
u8 val;
|
u8 val;
|
||||||
|
|
||||||
@ -396,11 +396,11 @@ int vgic_v3_save_pending_tables(struct kvm *kvm)
|
|||||||
bit_nr = irq->intid % BITS_PER_BYTE;
|
bit_nr = irq->intid % BITS_PER_BYTE;
|
||||||
ptr = pendbase + byte_offset;
|
ptr = pendbase + byte_offset;
|
||||||
|
|
||||||
if (byte_offset != last_byte_offset) {
|
if (ptr != last_ptr) {
|
||||||
ret = kvm_read_guest_lock(kvm, ptr, &val, 1);
|
ret = kvm_read_guest_lock(kvm, ptr, &val, 1);
|
||||||
if (ret)
|
if (ret)
|
||||||
return ret;
|
return ret;
|
||||||
last_byte_offset = byte_offset;
|
last_ptr = ptr;
|
||||||
}
|
}
|
||||||
|
|
||||||
stored = val & (1U << bit_nr);
|
stored = val & (1U << bit_nr);
|
||||||
|
Loading…
Reference in New Issue
Block a user