From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6EF5442B2E; Thu, 20 Aug 2026 16:48:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787244482; cv=none; b=oMbjsQOHS3uNU8ujFm5XaDc9eAVYRD5zSEwgz592UtmC3naXt3IWp+O8Xq3nJSliJ1OCs4DJjpL7td0QX7RaVwFk2s/EuU4jySCyAzkurmR7HboF6Ru46G5hQKkK4lHs2YgSqnY/rmF/7Tbdc/ARsbjGWiC5bnF0LiIbWLzldeg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787244482; c=relaxed/simple; bh=9GJigR2iMTmOUVEYEo42tWLW42ISBcjv4cQf1nbLphk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mRVaTo3TqYiXBL6wBC8JZLmWn/a05AmtUGt3F6B8eqeyqHfmCrHKLq8FxBlqoryyxEkzAjs+tKywKeAfSFJodgvyy1cuQvN8IGNcGWpTJGW/wEPvmPXb0Vl8DT/IQ7HON4Gdy95vw/AXPrco6ETRpBrNBu0C80IiAmxdpM+IyT8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=klLcmQFJ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="klLcmQFJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2E851F000E9; Thu, 20 Aug 2026 16:48:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787244481; bh=k0qHqXfJHuDhvu6oPLIIJ0X2BuL3RyHtIe5bTGZBV6E=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=klLcmQFJKKuY/7njBVxd5CCs0bwzB5K5e5iDN2s1c6eTtkcSPXOh0G91Flr3yxm9V BdXwMWRRRvs9mQebPINjJ6LIqr/g+OKxFWN+SwTbglPQ7rsMTh5RFeqfb6lgWasQBu TtcNaXNJxTEiRiEvxYth/h1X9cKhBamM1gKQ7SF0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Venkatesh Srinivas , James Houghton , Chao Gao , Paolo Bonzini , Sasha Levin , David Matlack , Sean Christopherson , Jim Mattson Subject: [PATCH 5.10 145/235] KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN Date: Thu, 20 Aug 2026 16:56:21 +0200 Message-ID: <20260820145220.838934051@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820145216.426568665@linuxfoundation.org> References: <20260820145216.426568665@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Venkatesh Srinivas [ Upstream commit e800decd9c0ac4349bcd8f8f9b29fd21fe93165e ] On Intel platforms with a VMX preemption timer and APICv, if a VMM calls KVM_GET_LAPIC before KVM_GET_MSRS to save the vCPU state, it is possible to lose a pending timer interrupt. If the thread running these ioctls is migrated to another core after calling KVM_GET_LAPIC but before KVM_GET_MSRS and the guest is using their LAPIC timer in TSC-deadline mode, not only does the save LAPIC state not carry the pending interrupt, the TSCDEADLINE MSR will be zeroed. After migration across CPUs, KVM_GET_MSRS calls vcpu_load, posting the interrupt and clearing the MSR: vcpu_load() -> kvm_arch_vcpu_load() -> kvm_lapic_restart_hv_timer() -> start_hv_timer() -> apic_timer_expired() -> kvm_apic_inject_pending_timer_irqs() . post interrupt into the LAPIC state . clear IA32_TSCDEADLINE The saved LAPIC state will be missing the pending interrupt and the saved MSR will be zero. Oops. Fix by only posting an interrupt when we're attempting to enter the guest (vcpu->wants_to_run == true), not for vcpu_load from other paths. Assisted-by: gemini:gemini-3.1-pro-preview Debugged-by: David Matlack Debugged-by: Sean Christopherson Debugged-by: Jim Mattson Debugged-by: James Houghton Signed-off-by: Venkatesh Srinivas Message-ID: <20260715234234.15382-2-venkateshs@chromium.org> Reviewed-by: James Houghton Reviewed-by: Chao Gao Cc: stable@vger.kernel.org Fixes: ae95f566b3d2 ("KVM: X86: TSCDEADLINE MSR emulation fastpath", 2020-05-15) Signed-off-by: Paolo Bonzini Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/lapic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -1636,7 +1636,7 @@ static void apic_timer_expired(struct kv if (apic_lvtt_tscdeadline(apic) || ktimer->hv_timer_in_use) ktimer->expired_tscdeadline = ktimer->tscdeadline; - if (!from_timer_fn && apic->apicv_active) { + if (!from_timer_fn && apic->apicv_active && vcpu->wants_to_run) { WARN_ON(kvm_get_running_vcpu() != vcpu); kvm_apic_inject_pending_timer_irqs(apic); return;