Re: [Qemu-devel] [PATCH] kvm/apic: fix 2.2->2.1 migration

[Markus Armbruster]

Paolo Bonzini <address@hidden> writes:

> The wait_for_sipi field is set back to 1 after an INIT, so it was not
> effective to reset it in kvm_apic_realize.  Introduce a reset callback
> and reset wait_for_sipi there.
>
> Reported-by: Igor Mammedov <address@hidden>
> Signed-off-by: Paolo Bonzini <address@hidden>
> ---
>  hw/i386/kvm/apic.c              | 10 +++++++---
>  hw/intc/apic_common.c           |  5 +++++
>  include/hw/i386/apic_internal.h |  1 +
>  3 files changed, 13 insertions(+), 3 deletions(-)
>
> diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
> index 271e97f..5b47056 100644
> --- a/hw/i386/kvm/apic.c
> +++ b/hw/i386/kvm/apic.c
> @@ -171,12 +171,15 @@ static const MemoryRegionOps kvm_apic_io_ops = {
>      .endianness = DEVICE_NATIVE_ENDIAN,
>  };
>  
> -static void kvm_apic_realize(DeviceState *dev, Error **errp)
> +static void kvm_apic_reset(APICCommonState *s)
>  {
> -    APICCommonState *s = APIC_COMMON(dev);
> -
>      /* Not used by KVM, which uses the CPU mp_state instead.  */
>      s->wait_for_sipi = 0;
> +}
> +
> +static void kvm_apic_realize(DeviceState *dev, Error **errp)
> +{
> +    APICCommonState *s = APIC_COMMON(dev);
>  
>      memory_region_init_io(&s->io_memory, NULL, &kvm_apic_io_ops, s, 
> "kvm-apic-msi",
>                            APIC_SPACE_SIZE);
> @@ -191,6 +194,7 @@ static void kvm_apic_class_init(ObjectClass *klass, void 
> *data)
>      APICCommonClass *k = APIC_COMMON_CLASS(klass);
>  
>      k->realize = kvm_apic_realize;
> +    k->reset = kvm_apic_reset;
>      k->set_base = kvm_apic_set_base;
>      k->set_tpr = kvm_apic_set_tpr;
>      k->get_tpr = kvm_apic_get_tpr;
> diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
> index 4e62f25..d9bb188 100644
> --- a/hw/intc/apic_common.c
> +++ b/hw/intc/apic_common.c
> @@ -178,6 +178,7 @@ bool apic_next_timer(APICCommonState *s, int64_t 
> current_time)
>  void apic_init_reset(DeviceState *dev)
>  {
>      APICCommonState *s = APIC_COMMON(dev);
> +    APICCommonClass *info = APIC_COMMON_GET_CLASS(s);
>      int i;
>  
>      if (!s) {

*** CID 1264327:  Dereference before null check  (REVERSE_INULL)
/hw/intc/apic_common.c: 184 in apic_init_reset()
178     void apic_init_reset(DeviceState *dev)
179     {
180         APICCommonState *s = APIC_COMMON(dev);
181         APICCommonClass *info = APIC_COMMON_GET_CLASS(s);
182         int i;
183     
>>>     CID 1264327:  Dereference before null check  (REVERSE_INULL)
>>>     Null-checking "s" suggests that it may be null, but it has
>>> already been dereferenced on all paths leading to the check.
184         if (!s) {
185             return;
186         }
187         s->tpr = 0;
188         s->spurious_vec = 0xff;
189         s->log_dest = 0;

[...]