]> git.karo-electronics.de Git - karo-tx-linux.git/log
karo-tx-linux.git
11 years agoKVM: X86 emulator: fix source operand decoding for 8bit mov[zs]x instructions
Gleb Natapov [Wed, 24 Apr 2013 10:38:36 +0000 (13:38 +0300)]
KVM: X86 emulator: fix source operand decoding for 8bit mov[zs]x instructions

Source operand for one byte mov[zs]x is decoded incorrectly if it is in
high byte register. Fix that.

Cc: stable@vger.kernel.org
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: VM_ENTRY/EXIT_LOAD_IA32_EFER overrides EFER.LMA settings
Jan Kiszka [Sun, 14 Apr 2013 10:44:54 +0000 (12:44 +0200)]
KVM: nVMX: VM_ENTRY/EXIT_LOAD_IA32_EFER overrides EFER.LMA settings

If we load the complete EFER MSR on entry or exit, EFER.LMA (and LME)
loading is skipped. Their consistency is already checked now before
starting the transition.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Validate EFER values for VM_ENTRY/EXIT_LOAD_IA32_EFER
Jan Kiszka [Sat, 20 Apr 2013 08:52:36 +0000 (10:52 +0200)]
KVM: nVMX: Validate EFER values for VM_ENTRY/EXIT_LOAD_IA32_EFER

As we may emulate the loading of EFER on VM-entry and VM-exit, implement
the checks that VMX performs on the guest and host values on vmlaunch/
vmresume. Factor out kvm_valid_efer for this purpose which checks for
set reserved bits.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Fix conditions for NMI injection
Jan Kiszka [Sun, 14 Apr 2013 19:04:26 +0000 (21:04 +0200)]
KVM: nVMX: Fix conditions for NMI injection

The logic for checking if interrupts can be injected has to be applied
also on NMIs. The difference is that if NMI interception is on these
events are consumed and blocked by the VM exit.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: VMX: Move vmx_nmi_allowed after vmx_set_nmi_mask
Jan Kiszka [Sun, 14 Apr 2013 10:12:47 +0000 (12:12 +0200)]
KVM: VMX: Move vmx_nmi_allowed after vmx_set_nmi_mask

vmx_set_nmi_mask will soon be used by vmx_nmi_allowed. No functional
changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: x86: Fix memory leak in vmx.c
Andrew Honig [Thu, 18 Apr 2013 16:38:14 +0000 (09:38 -0700)]
KVM: x86: Fix memory leak in vmx.c

If userspace creates and destroys multiple VMs within the same process
we leak 20k of memory in the userspace process context per VM.  This
patch frees the memory in kvm_arch_destroy_vm.  If the process exits
without closing the VM file descriptor or the file descriptor has been
shared with another process then we don't free the memory.

It's still possible for a user space process to leak memory if the last
process to close the fd for the VM is not the process that created it.
However, this is an unexpected case that's only caused by a user space
process that's misbehaving.

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: x86: fix error return code in kvm_arch_vcpu_init()
Wei Yongjun [Wed, 17 Apr 2013 23:41:00 +0000 (07:41 +0800)]
KVM: x86: fix error return code in kvm_arch_vcpu_init()

Fix to return a negative error code from the error handling
case instead of 0, as returned elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Enable and disable shadow vmcs functionality
Abel Gordon [Thu, 18 Apr 2013 11:39:55 +0000 (14:39 +0300)]
KVM: nVMX: Enable and disable shadow vmcs functionality

Once L1 loads VMCS12 we enable shadow-vmcs capability and copy all the VMCS12
shadowed fields to the shadow vmcs.  When we release the VMCS12, we also
disable shadow-vmcs capability.

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Synchronize VMCS12 content with the shadow vmcs
Abel Gordon [Thu, 18 Apr 2013 11:39:25 +0000 (14:39 +0300)]
KVM: nVMX: Synchronize VMCS12 content with the shadow vmcs

Synchronize between the VMCS12 software controlled structure and the
processor-specific shadow vmcs

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Copy VMCS12 to processor-specific shadow vmcs
Abel Gordon [Thu, 18 Apr 2013 11:38:55 +0000 (14:38 +0300)]
KVM: nVMX: Copy VMCS12 to processor-specific shadow vmcs

Introduce a function used to copy fields from the software controlled VMCS12
to the processor-specific shadow vmcs

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Copy processor-specific shadow-vmcs to VMCS12
Abel Gordon [Thu, 18 Apr 2013 11:38:25 +0000 (14:38 +0300)]
KVM: nVMX: Copy processor-specific shadow-vmcs to VMCS12

Introduce a function used to copy fields from the processor-specific shadow
vmcs to the software controlled VMCS12

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Release shadow vmcs
Abel Gordon [Thu, 18 Apr 2013 11:37:55 +0000 (14:37 +0300)]
KVM: nVMX: Release shadow vmcs

Unmap vmcs12 and release the corresponding shadow vmcs

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Allocate shadow vmcs
Abel Gordon [Thu, 18 Apr 2013 11:37:25 +0000 (14:37 +0300)]
KVM: nVMX: Allocate shadow vmcs

Allocate a shadow vmcs used by the processor to shadow part of the fields
stored in the software defined VMCS12 (let L1 access fields without causing
exits). Note we keep a shadow vmcs only for the current vmcs12.  Once a vmcs12
becomes non-current, its shadow vmcs is released.

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Fix VMXON emulation
Abel Gordon [Thu, 18 Apr 2013 11:36:55 +0000 (14:36 +0300)]
KVM: nVMX: Fix VMXON emulation

handle_vmon doesn't check if L1 is already in root mode (VMXON
was previously called). This patch adds this missing check and calls
nested_vmx_failValid if VMX is already ON.
We need this check because L0 will allocate the shadow vmcs when L1
executes VMXON and we want to avoid host leaks (due to shadow vmcs
allocation) if L1 executes VMXON repeatedly.

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Refactor handle_vmwrite
Abel Gordon [Thu, 18 Apr 2013 11:36:25 +0000 (14:36 +0300)]
KVM: nVMX: Refactor handle_vmwrite

Refactor existent code so we re-use vmcs12_write_any to copy fields from the
shadow vmcs specified by the link pointer (used by the processor,
implementation-specific) to the VMCS12 software format used by L0 to hold
the fields in L1 memory address space.

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Introduce vmread and vmwrite bitmaps
Abel Gordon [Thu, 18 Apr 2013 11:35:55 +0000 (14:35 +0300)]
KVM: nVMX: Introduce vmread and vmwrite bitmaps

Prepare vmread and vmwrite bitmaps according to a pre-specified list of fields.
These lists are intended to specifiy most frequent accessed fields so we can
minimize the number of fields that are copied from/to the software controlled
VMCS12 format to/from to processor-specific shadow vmcs. The lists were built
measuring the VMCS fields access rate after L2 Ubuntu 12.04 booted when it was
running on top of L1 KVM, also Ubuntu 12.04. Note that during boot there were
additional fields which were frequently modified but they were not added to
these lists because after boot these fields were not longer accessed by L1.

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Detect shadow-vmcs capability
Abel Gordon [Thu, 18 Apr 2013 11:35:25 +0000 (14:35 +0300)]
KVM: nVMX: Detect shadow-vmcs capability

Add logic required to detect if shadow-vmcs is supported by the
processor. Introduce a new kernel module parameter to specify if L0 should use
shadow vmcs (or not) to run L1.

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Shadow-vmcs control fields/bits
Abel Gordon [Thu, 18 Apr 2013 11:34:55 +0000 (14:34 +0300)]
KVM: nVMX: Shadow-vmcs control fields/bits

Add definitions for all the vmcs control fields/bits
required to enable vmcs-shadowing

Signed-off-by: Abel Gordon <abelg@il.ibm.com>
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoMerge git://github.com/agraf/linux-2.6.git kvm-ppc-next into queue
Gleb Natapov [Mon, 22 Apr 2013 07:38:15 +0000 (10:38 +0300)]
Merge git://github.com/agraf/linux-2.6.git kvm-ppc-next into queue

11 years agoKVM: ia64: Fix kvm_vm_ioctl_irq_line
Yang Zhang [Wed, 17 Apr 2013 00:46:41 +0000 (08:46 +0800)]
KVM: ia64: Fix kvm_vm_ioctl_irq_line

Fix the compile error with kvm_vm_ioctl_irq_line.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: x86: Fix posted interrupt with CONFIG_SMP=n
Zhang, Yang Z [Thu, 18 Apr 2013 02:11:54 +0000 (23:11 -0300)]
KVM: x86: Fix posted interrupt with CONFIG_SMP=n

->send_IPI_mask is not defined on UP.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agokvm/ppc: don't call complete_mmio_load when it's a store
Scott Wood [Mon, 15 Apr 2013 15:07:11 +0000 (15:07 +0000)]
kvm/ppc: don't call complete_mmio_load when it's a store

complete_mmio_load writes back the mmio result into the
destination register.  Doing this on a store results in
register corruption.

Signed-off-by: Scott Wood <scottwood@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agoKVM: PPC: emulate dcbst
Stuart Yoder [Tue, 9 Apr 2013 10:36:23 +0000 (10:36 +0000)]
KVM: PPC: emulate dcbst

Signed-off-by: Stuart Yoder <stuart.yoder@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agoAdded ONE_REG interface for debug instruction
Bharat Bhushan [Wed, 20 Mar 2013 20:24:58 +0000 (20:24 +0000)]
Added ONE_REG interface for debug instruction

This patch adds the one_reg interface to get the special instruction
to be used for setting software breakpoint from userspace.

Signed-off-by: Bharat Bhushan <bharat.bhushan@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agoMerge commit 'origin/next' into kvm-ppc-next
Alexander Graf [Wed, 17 Apr 2013 13:20:38 +0000 (15:20 +0200)]
Merge commit 'origin/next' into kvm-ppc-next

11 years agoKVM: VMX: Fix check guest state validity if a guest is in VM86 mode
Gleb Natapov [Sun, 14 Apr 2013 13:07:37 +0000 (16:07 +0300)]
KVM: VMX: Fix check guest state validity if a guest is in VM86 mode

If guest vcpu is in VM86 mode the vcpu state should be checked as if in
real mode.

Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: nVMX: check vmcs12 for valid activity state
Paolo Bonzini [Mon, 15 Apr 2013 13:00:27 +0000 (15:00 +0200)]
KVM: nVMX: check vmcs12 for valid activity state

KVM does not use the activity state VMCS field, and does not support
it in nested VMX either (the corresponding bits in the misc VMX feature
MSR are zero).  Fail entry if the activity state is set to anything but
"active".

Since the value will always be the same for L1 and L2, we do not need
to read and write the corresponding VMCS field on L1/L2 transitions,
either.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: ARM: Fix kvm_vm_ioctl_irq_line
Alexander Graf [Tue, 16 Apr 2013 17:21:41 +0000 (19:21 +0200)]
KVM: ARM: Fix kvm_vm_ioctl_irq_line

Commit aa2fbe6d broke the ARM KVM target by introducing a new parameter
to irq handling functions.

Fix the function prototype to get things compiling again and ignore the
parameter just like we did before

Signed-off-by: Alexander Graf <agraf@suse.de>
Acked-by: Christoffer Dall <cdall@cs.columbia.edu>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: VMX: Use posted interrupt to deliver virtual interrupt
Yang Zhang [Thu, 11 Apr 2013 11:25:16 +0000 (19:25 +0800)]
KVM: VMX: Use posted interrupt to deliver virtual interrupt

If posted interrupt is avaliable, then uses it to inject virtual
interrupt to guest.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: VMX: Add the deliver posted interrupt algorithm
Yang Zhang [Thu, 11 Apr 2013 11:25:15 +0000 (19:25 +0800)]
KVM: VMX: Add the deliver posted interrupt algorithm

Only deliver the posted interrupt when target vcpu is running
and there is no previous interrupt pending in pir.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Set TMR when programming ioapic entry
Yang Zhang [Thu, 11 Apr 2013 11:25:14 +0000 (19:25 +0800)]
KVM: Set TMR when programming ioapic entry

We already know the trigger mode of a given interrupt when programming
the ioapice entry. So it's not necessary to set it in each interrupt
delivery.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Call common update function when ioapic entry changed.
Yang Zhang [Thu, 11 Apr 2013 11:25:13 +0000 (19:25 +0800)]
KVM: Call common update function when ioapic entry changed.

Both TMR and EOI exit bitmap need to be updated when ioapic changed
or vcpu's id/ldr/dfr changed. So use common function instead eoi exit
bitmap specific function.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: VMX: Check the posted interrupt capability
Yang Zhang [Thu, 11 Apr 2013 11:25:12 +0000 (19:25 +0800)]
KVM: VMX: Check the posted interrupt capability

Detect the posted interrupt feature. If it exists, then set it in vmcs_config.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: VMX: Register a new IPI for posted interrupt
Yang Zhang [Thu, 11 Apr 2013 11:25:11 +0000 (19:25 +0800)]
KVM: VMX: Register a new IPI for posted interrupt

Posted Interrupt feature requires a special IPI to deliver posted interrupt
to guest. And it should has a high priority so the interrupt will not be
blocked by others.
Normally, the posted interrupt will be consumed by vcpu if target vcpu is
running and transparent to OS. But in some cases, the interrupt will arrive
when target vcpu is scheduled out. And host will see it. So we need to
register a dump handler to handle it.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Acked-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: VMX: Enable acknowledge interupt on vmexit
Yang Zhang [Thu, 11 Apr 2013 11:25:10 +0000 (19:25 +0800)]
KVM: VMX: Enable acknowledge interupt on vmexit

The "acknowledge interrupt on exit" feature controls processor behavior
for external interrupt acknowledgement. When this control is set, the
processor acknowledges the interrupt controller to acquire the
interrupt vector on VM exit.

After enabling this feature, an interrupt which arrived when target cpu is
running in vmx non-root mode will be handled by vmx handler instead of handler
in idt. Currently, vmx handler only fakes an interrupt stack and jump to idt
table to let real handler to handle it. Further, we will recognize the interrupt
and only delivery the interrupt which not belong to current vcpu through idt table.
The interrupt which belonged to current vcpu will be handled inside vmx handler.
This will reduce the interrupt handle cost of KVM.

Also, interrupt enable logic is changed if this feature is turnning on:
Before this patch, hypervior call local_irq_enable() to enable it directly.
Now IF bit is set on interrupt stack frame, and will be enabled on a return from
interrupt handler if exterrupt interrupt exists. If no external interrupt, still
call local_irq_enable() to enable it.

Refer to Intel SDM volum 3, chapter 33.2.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Use eoi to track RTC interrupt delivery status
Yang Zhang [Thu, 11 Apr 2013 11:21:41 +0000 (19:21 +0800)]
KVM: Use eoi to track RTC interrupt delivery status

Current interrupt coalescing logci which only used by RTC has conflict
with Posted Interrupt.
This patch introduces a new mechinism to use eoi to track interrupt:
When delivering an interrupt to vcpu, the pending_eoi set to number of
vcpu that received the interrupt. And decrease it when each vcpu writing
eoi. No subsequent RTC interrupt can deliver to vcpu until all vcpus
write eoi.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Let ioapic know the irq line status
Yang Zhang [Thu, 11 Apr 2013 11:21:40 +0000 (19:21 +0800)]
KVM: Let ioapic know the irq line status

Userspace may deliver RTC interrupt without query the status. So we
want to track RTC EOI for this case.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Force vmexit with virtual interrupt delivery
Yang Zhang [Thu, 11 Apr 2013 11:21:39 +0000 (19:21 +0800)]
KVM: Force vmexit with virtual interrupt delivery

Need the EOI to track interrupt deliver status, so force vmexit
on EOI for rtc interrupt when enabling virtual interrupt delivery.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Add reset/restore rtc_status support
Yang Zhang [Thu, 11 Apr 2013 11:21:38 +0000 (19:21 +0800)]
KVM: Add reset/restore rtc_status support

restore rtc_status from migration or save/restore

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Return destination vcpu on interrupt injection
Yang Zhang [Thu, 11 Apr 2013 11:21:37 +0000 (19:21 +0800)]
KVM: Return destination vcpu on interrupt injection

Add a new parameter to know vcpus who received the interrupt.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Introduce struct rtc_status
Yang Zhang [Thu, 11 Apr 2013 11:21:36 +0000 (19:21 +0800)]
KVM: Introduce struct rtc_status

rtc_status is used to track RTC interrupt delivery status. The pending_eoi
will be increased by vcpu who received RTC interrupt and will be decreased
when EOI to this interrupt.
Also, we use dest_map to record the destination vcpu to avoid the case that
vcpu who didn't get the RTC interupt, but issued EOI with same vector of RTC
and descreased pending_eoi by mistake.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: Add vcpu info to ioapic_update_eoi()
Yang Zhang [Thu, 11 Apr 2013 11:21:35 +0000 (19:21 +0800)]
KVM: Add vcpu info to ioapic_update_eoi()

Add vcpu info to ioapic_update_eoi, so we can know which vcpu
issued this EOI.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: nVMX: Avoid reading VM_EXIT_INTR_ERROR_CODE needlessly on nested exits
Jan Kiszka [Sun, 14 Apr 2013 10:12:50 +0000 (12:12 +0200)]
KVM: nVMX: Avoid reading VM_EXIT_INTR_ERROR_CODE needlessly on nested exits

We only need to update vm_exit_intr_error_code if there is a valid exit
interruption information and it comes with a valid error code.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Fix conditions for interrupt injection
Jan Kiszka [Sun, 14 Apr 2013 10:12:48 +0000 (12:12 +0200)]
KVM: nVMX: Fix conditions for interrupt injection

If we are entering guest mode, we do not want L0 to interrupt this
vmentry with all its side effects on the vmcs. Therefore, injection
shall be disallowed during L1->L2 transitions, as in the previous
version. However, this check is conceptually independent of
nested_exit_on_intr, so decouple it.

If L1 traps external interrupts, we can kick the guest from L2 to L1,
also just like the previous code worked. But we no longer need to
consider L1's idt_vectoring_info_field. It will always be empty at this
point. Instead, if L2 has pending events, those are now found in the
architectural queues and will, thus, prevent vmx_interrupt_allowed from
being called at all.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Rework event injection and recovery
Jan Kiszka [Sun, 14 Apr 2013 10:12:46 +0000 (12:12 +0200)]
KVM: nVMX: Rework event injection and recovery

The basic idea is to always transfer the pending event injection on
vmexit into the architectural state of the VCPU and then drop it from
there if it turns out that we left L2 to enter L1, i.e. if we enter
prepare_vmcs12.

vmcs12_save_pending_events takes care to transfer pending L0 events into
the queue of L1. That is mandatory as L1 may decide to switch the guest
state completely, invalidating or preserving the pending events for
later injection (including on a different node, once we support
migration).

This concept is based on the rule that a pending vmlaunch/vmresume is
not canceled. Otherwise, we would risk to lose injected events or leak
them into the wrong queues. Encode this rule via a WARN_ON_ONCE at the
entry of nested_vmx_vmexit.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Fix injection of PENDING_INTERRUPT and NMI_WINDOW exits to L1
Jan Kiszka [Sun, 14 Apr 2013 10:12:45 +0000 (12:12 +0200)]
KVM: nVMX: Fix injection of PENDING_INTERRUPT and NMI_WINDOW exits to L1

Check if the interrupt or NMI window exit is for L1 by testing if it has
the corresponding controls enabled. This is required when we allow
direct injection from L0 to L2

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: emulator: mark 0xff 0x7d opcode as undefined.
Gleb Natapov [Thu, 11 Apr 2013 09:32:14 +0000 (12:32 +0300)]
KVM: emulator: mark 0xff 0x7d opcode as undefined.

Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: emulator: Do not fail on emulation of undefined opcode
Gleb Natapov [Thu, 11 Apr 2013 09:30:01 +0000 (12:30 +0300)]
KVM: emulator: Do not fail on emulation of undefined opcode

Emulation of undefined opcode should inject #UD instead of causing
emulation failure. Do that by moving Undefined flag check to emulation
stage and injection #UD there.

Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: VMX: do not try to reexecute failed instruction while emulating invalid guest...
Gleb Natapov [Thu, 11 Apr 2013 09:10:51 +0000 (12:10 +0300)]
KVM: VMX: do not try to reexecute failed instruction while emulating invalid guest state

During invalid guest state emulation vcpu cannot enter guest mode to try
to reexecute instruction that emulator failed to emulate, so emulation
will happen again and again.  Prevent that by telling the emulator that
instruction reexecution should not be attempted.

Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: emulator: fix unimplemented instruction detection
Gleb Natapov [Thu, 11 Apr 2013 08:59:55 +0000 (11:59 +0300)]
KVM: emulator: fix unimplemented instruction detection

Unimplemented instruction detection is broken for group instructions
since it relies on "flags" field of opcode to be zero, but all
instructions in a group inherit flags from a group encoding. Fix that by
having a separate flag for unimplemented instructions.

Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: x86 emulator: Fix segment loading in VM86
Kevin Wolf [Thu, 11 Apr 2013 12:06:03 +0000 (14:06 +0200)]
KVM: x86 emulator: Fix segment loading in VM86

This fixes a regression introduced in commit 03ebebeb1 ("KVM: x86
emulator: Leave segment limit and attributs alone in real mode").

The mentioned commit changed the segment descriptors for both real mode
and VM86 to only update the segment base instead of creating a
completely new descriptor with limit 0xffff so that unreal mode keeps
working across a segment register reload.

This leads to an invalid segment descriptor in the eyes of VMX, which
seems to be okay for real mode because KVM will fix it up before the
next VM entry or emulate the state, but it doesn't do this if the guest
is in VM86, so we end up with:

  KVM: entry failed, hardware error 0x80000021

Fix this by effectively reverting commit 03ebebeb1 for VM86 and leaving
it only in place for real mode, which is where it's really needed.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: Move kvm_rebooting declaration out of x86
Geoff Levand [Fri, 5 Apr 2013 19:20:30 +0000 (19:20 +0000)]
KVM: Move kvm_rebooting declaration out of x86

The variable kvm_rebooting is a common kvm variable, so move its
declaration from arch/x86/include/asm/kvm_host.h to
include/asm/kvm_host.h.

Fixes this sparse warning when building on arm64:

  virt/kvm/kvm_main.c:warning: symbol 'kvm_rebooting' was not declared. Should it be static?

Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: Move kvm_spurious_fault to x86.c
Geoff Levand [Fri, 5 Apr 2013 19:20:30 +0000 (19:20 +0000)]
KVM: Move kvm_spurious_fault to x86.c

The routine kvm_spurious_fault() is an x86 specific routine, so
move it from virt/kvm/kvm_main.c to arch/x86/kvm/x86.c.

Fixes this sparse warning when building on arm64:

  virt/kvm/kvm_main.c:warning: symbol 'kvm_spurious_fault' was not declared. Should it be static?

Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: Make local routines static
Geoff Levand [Fri, 5 Apr 2013 19:20:30 +0000 (19:20 +0000)]
KVM: Make local routines static

The routines get_user_page_nowait(), kvm_io_bus_sort_cmp(), kvm_io_bus_insert_dev()
and kvm_io_bus_get_first_dev() are only referenced within kvm_main.c, so give them
static linkage.

Fixes sparse warnings like these:

  virt/kvm/kvm_main.c: warning: symbol 'get_user_page_nowait' was not declared. Should it be static?

Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: Move vm_list kvm_lock declarations out of x86
Geoff Levand [Fri, 5 Apr 2013 19:20:30 +0000 (19:20 +0000)]
KVM: Move vm_list kvm_lock declarations out of x86

The variables vm_list and kvm_lock are common to all architectures, so
move the declarations from arch/x86/include/asm/kvm_host.h to
include/linux/kvm_host.h.

Fixes sparse warnings like these when building for arm64:

  virt/kvm/kvm_main.c: warning: symbol 'kvm_lock' was not declared. Should it be static?
  virt/kvm/kvm_main.c: warning: symbol 'vm_list' was not declared. Should it be static?

Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: VMX: Add missing braces to avoid redundant error check
Jan Kiszka [Mon, 8 Apr 2013 09:07:46 +0000 (11:07 +0200)]
KVM: VMX: Add missing braces to avoid redundant error check

The code was already properly aligned, now also add the braces to avoid
that err is checked even if alloc_apic_access_page didn't run and change
it. Found via Coccinelle by Fengguang Wu.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: x86: fix memory leak in vmx_init
Yang Zhang [Mon, 8 Apr 2013 07:26:33 +0000 (15:26 +0800)]
KVM: x86: fix memory leak in vmx_init

Free vmx_msr_bitmap_longmode_x2apic and vmx_msr_bitmap_longmode if
kvm_init() fails.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agokvm: fix MMIO/PIO collision misdetection
Michael S. Tsirkin [Thu, 4 Apr 2013 10:27:21 +0000 (13:27 +0300)]
kvm: fix MMIO/PIO collision misdetection

PIO and MMIO are separate address spaces, but
ioeventfd registration code mistakenly detected
two eventfds as duplicate if they use the same address,
even if one is PIO and another one MMIO.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: nVMX: Check exit control for VM_EXIT_SAVE_IA32_PAT, not entry controls
Jan Kiszka [Sat, 6 Apr 2013 11:51:21 +0000 (13:51 +0200)]
KVM: nVMX: Check exit control for VM_EXIT_SAVE_IA32_PAT, not entry controls

Obviously a copy&paste mistake: prepare_vmcs12 has to check L1's exit
controls for VM_EXIT_SAVE_IA32_PAT.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: Call kvm_apic_match_dest() to check destination vcpu
Yang Zhang [Sun, 7 Apr 2013 00:25:18 +0000 (08:25 +0800)]
KVM: Call kvm_apic_match_dest() to check destination vcpu

For a given vcpu, kvm_apic_match_dest() will tell you whether
the vcpu in the destination list quickly. Drop kvm_calculate_eoi_exitmap()
and use kvm_apic_match_dest() instead.

Signed-off-by: Yang Zhang <yang.z.zhang@Intel.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: virtio_ccw: reset errors for new I/O.
Cornelia Huck [Thu, 4 Apr 2013 08:25:06 +0000 (10:25 +0200)]
KVM: s390: virtio_ccw: reset errors for new I/O.

ccw_io_helper neglected to reset vcdev->err after a new channel
program had been successfully started, resulting in stale errors
delivered after one I/O failed. Reset the error after a new
channel program has been successfully started with no old I/O
pending.

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoRevert "KVM: MMU: Move kvm_mmu_free_some_pages() into kvm_mmu_alloc_page()"
Takuya Yoshikawa [Fri, 29 Mar 2013 05:05:26 +0000 (14:05 +0900)]
Revert "KVM: MMU: Move kvm_mmu_free_some_pages() into kvm_mmu_alloc_page()"

With the following commit, shadow pages can be zapped at random during
a shadow page talbe walk:
  KVM: MMU: Move kvm_mmu_free_some_pages() into kvm_mmu_alloc_page()
  7ddca7e43c8f28f9419da81a0e7730b66aa60fe9

This patch reverts it and fixes __direct_map() and FNAME(fetch)().

Signed-off-by: Takuya Yoshikawa <yoshikawa_takuya_b1@lab.ntt.co.jp>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agopmu: prepare for migration support
Paolo Bonzini [Thu, 28 Mar 2013 16:18:35 +0000 (17:18 +0100)]
pmu: prepare for migration support

In order to migrate the PMU state correctly, we need to restore the
values of MSR_CORE_PERF_GLOBAL_STATUS (a read-only register) and
MSR_CORE_PERF_GLOBAL_OVF_CTRL (which has side effects when written).
We also need to write the full 40-bit value of the performance counter,
which would only be possible with a v3 architectural PMU's full-width
counter MSRs.

To distinguish host-initiated writes from the guest's, pass the
full struct msr_data to kvm_pmu_set_msr.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: Enable KVM_CAP_NR_MEMSLOTS on s390
Nick Wang [Mon, 25 Mar 2013 16:22:58 +0000 (17:22 +0100)]
KVM: s390: Enable KVM_CAP_NR_MEMSLOTS on s390

Return KVM_USER_MEM_SLOTS in kvm_dev_ioctl_check_extension().

Signed-off-by: Nick Wang <jfwang@us.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: Remove the sanity checks for kvm memory slot
Nick Wang [Mon, 25 Mar 2013 16:22:57 +0000 (17:22 +0100)]
KVM: s390: Remove the sanity checks for kvm memory slot

To model the standby memory with memory_region_add_subregion
and friends, the guest would have one or more regions of ram.
Remove the check allowing only one memory slot and the check
requiring the real address of memory slot starts at zero.

Signed-off-by: Nick Wang <jfwang@us.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: Change the virtual memory mapping location for virtio devices
Nick Wang [Mon, 25 Mar 2013 16:22:56 +0000 (17:22 +0100)]
KVM: s390: Change the virtual memory mapping location for virtio devices

The current location for mapping virtio devices does not take
into consideration the standby memory. This causes the failure
of mapping standby memory since the location for the mapping is
already taken by the virtio devices. To fix the problem, we move
the location to beyond the end of standby memory.

Signed-off-by: Nick Wang <jfwang@us.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: fix compile with !CONFIG_COMPAT
Heiko Carstens [Mon, 25 Mar 2013 16:22:55 +0000 (17:22 +0100)]
KVM: s390: fix compile with !CONFIG_COMPAT

arch/s390/kvm/priv.c should include both
linux/compat.h and asm/compat.h.
Fixes this one:

In file included from arch/s390/kvm/priv.c:23:0:
arch/s390/include/asm/compat.h: In function ‘arch_compat_alloc_user_space’:
arch/s390/include/asm/compat.h:258:2: error: implicit declaration of function ‘is_compat_task’

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: fix stsi exception handling
Heiko Carstens [Mon, 25 Mar 2013 16:22:54 +0000 (17:22 +0100)]
KVM: s390: fix stsi exception handling

In case of an exception the guest psw condition code should be left alone.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-By: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: fix and enforce return code handling for irq injections
Heiko Carstens [Mon, 25 Mar 2013 16:22:53 +0000 (17:22 +0100)]
KVM: s390: fix and enforce return code handling for irq injections

kvm_s390_inject_program_int() and friends may fail if no memory is available.
This must be reported to the calling functions, so that this gets passed
down to user space which should fix the situation.
Alternatively we end up with guest state corruption.

So fix this and enforce return value checking by adding a __must_check
annotation to all of these function prototypes.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: make if statements in lpsw/lpswe handlers readable
Heiko Carstens [Mon, 25 Mar 2013 16:22:52 +0000 (17:22 +0100)]
KVM: s390: make if statements in lpsw/lpswe handlers readable

Being unable to parse the 5- and 8-line if statements I had to split them
to be able to make any sense of them and verify that they match the
architecture.
So change the code since I guess that other people will also have a hard
time parsing such long conditional statements with line breaks.

Introduce a common is_valid_psw() function which does all the checks needed.
In case of lpsw (64 bit psw -> 128 bit psw conversion) it will do some not
needed additional checks, since a couple of bits can't be set anyway, but
that doesn't hurt.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: fix return code handling in lpsw/lpswe handlers
Heiko Carstens [Mon, 25 Mar 2013 16:22:51 +0000 (17:22 +0100)]
KVM: s390: fix return code handling in lpsw/lpswe handlers

kvm_s390_inject_program_int() may return with a non-zero return value, in
case of an error (out of memory). Report that to the calling functions
instead of ignoring the error case.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: fix psw conversion in lpsw handler
Heiko Carstens [Mon, 25 Mar 2013 16:22:50 +0000 (17:22 +0100)]
KVM: s390: fix psw conversion in lpsw handler

When converting a 64 bit psw to a 128 bit psw the addressing mode bit of
the "addr" part of the 64 bit psw must be moved to the basic addressing
mode bit of the "mask" part of the 128 bit psw.
In addition the addressing mode bit must be cleared when moved to the "addr"
part of the 128 bit psw.
Otherwise an invalid psw would be generated if the orginal psw was in the
31 bit addressing mode.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: fix 24 bit psw handling in lpsw/lpswe handler
Heiko Carstens [Mon, 25 Mar 2013 16:22:49 +0000 (17:22 +0100)]
KVM: s390: fix 24 bit psw handling in lpsw/lpswe handler

When checking for validity the lpsw/lpswe handler check that only
the lower 20 bits instead of 24 bits have a non-zero value.
There handling valid psws as invalid ones.
Fix the 24 bit psw mask.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoKVM: s390: Dont do a gmap update on minor memslot changes
Christian Borntraeger [Mon, 25 Mar 2013 16:22:48 +0000 (17:22 +0100)]
KVM: s390: Dont do a gmap update on minor memslot changes

Some memslot updates dont affect the gmap implementation,
e.g. setting/unsetting dirty tracking. Since a gmap update
will cause tlb flushes and segment table invalidations we
want to avoid that.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
11 years agoMerge commit 'origin/next' into kvm-ppc-next
Alexander Graf [Wed, 27 Mar 2013 12:41:35 +0000 (13:41 +0100)]
Merge commit 'origin/next' into kvm-ppc-next

11 years agoMerge 'git://github.com/agraf/linux-2.6.git kvm-ppc-next' into queue
Gleb Natapov [Sun, 24 Mar 2013 09:43:09 +0000 (11:43 +0200)]
Merge  'git://github.com/agraf/linux-2.6.git kvm-ppc-next' into queue

11 years agoKVM: PPC: Remove unused argument to kvmppc_core_dequeue_external
Paul Mackerras [Thu, 14 Feb 2013 14:00:25 +0000 (14:00 +0000)]
KVM: PPC: Remove unused argument to kvmppc_core_dequeue_external

Currently kvmppc_core_dequeue_external() takes a struct kvm_interrupt *
argument and does nothing with it, in any of its implementations.
This removes it in order to make things easier for forthcoming
in-kernel interrupt controller emulation code.

Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agokvm/ppc/e500: eliminate tlb_refs
Scott Wood [Wed, 6 Mar 2013 16:02:49 +0000 (16:02 +0000)]
kvm/ppc/e500: eliminate tlb_refs

Commit 523f0e5421c12610527c620b983b443f329e3a32 ("KVM: PPC: E500:
Explicitly mark shadow maps invalid") began using E500_TLB_VALID
for guest TLB1 entries, and skipping invalidations if it's not set.

However, when E500_TLB_VALID was set for such entries, it was on a
fake local ref, and so the invalidations never happen.  gtlb_privs
is documented as being only for guest TLB0, though we already violate
that with E500_TLB_BITMAP.

Now that we have MMU notifiers, and thus don't need to actually
retain a reference to the mapped pages, get rid of tlb_refs, and
use gtlb_privs for E500_TLB_VALID in TLB1.

Since we can have more than one host TLB entry for a given tlbe_ref,
be careful not to clear existing flags that are relevant to other
host TLB entries when preparing a new host TLB entry.

Signed-off-by: Scott Wood <scottwood@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agokvm/ppc/e500: g2h_tlb1_map: clear old bit before setting new bit
Scott Wood [Wed, 13 Feb 2013 19:37:49 +0000 (19:37 +0000)]
kvm/ppc/e500: g2h_tlb1_map: clear old bit before setting new bit

It's possible that we're using the same host TLB1 slot to map (a
presumably different portion of) the same guest TLB1 entry.  Clear
the bit in the map before setting it, so that if the esels are the same
the bit will remain set.

Signed-off-by: Scott Wood <scottwood@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agokvm/ppc/e500: h2g_tlb1_rmap: esel 0 is valid
Scott Wood [Wed, 13 Feb 2013 19:37:48 +0000 (19:37 +0000)]
kvm/ppc/e500: h2g_tlb1_rmap: esel 0 is valid

Add one to esel values in h2g_tlb1_rmap, so that "no mapping" can be
distinguished from "esel 0".  Note that we're not saved by the fact
that host esel 0 is reserved for non-KVM use, because KVM host esel
numbering is not the raw host numbering (see to_htlb1_esel).

Signed-off-by: Scott Wood <scottwood@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agoKVM: PPC: booke: Added debug handler
Bharat Bhushan [Wed, 27 Feb 2013 18:13:10 +0000 (18:13 +0000)]
KVM: PPC: booke: Added debug handler

Installed debug handler will be used for guest debug support
and debug facility emulation features (patches for these
features will follow this patch).

Signed-off-by: Liu Yu <yu.liu@freescale.com>
[bharat.bhushan@freescale.com: Substantial changes]
Signed-off-by: Bharat Bhushan <bharat.bhushan@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agoKVM: PPC: Added one_reg interface for timer registers
Bharat Bhushan [Sun, 24 Feb 2013 18:57:12 +0000 (18:57 +0000)]
KVM: PPC: Added one_reg interface for timer registers

If userspace wants to change some specific bits of TSR
(timer status register) then it uses GET/SET_SREGS ioctl interface.
So the steps will be:
      i)   user-space will make get ioctl,
      ii)  change TSR in userspace
      iii) then make set ioctl.
It can happen that TSR gets changed by kernel after step i) and
before step iii).

To avoid this we have added below one_reg ioctls for oring and clearing
specific bits in TSR. This patch adds one registerface for:
     1) setting specific bit in TSR (timer status register)
     2) clearing specific bit in TSR (timer status register)
     3) setting/getting the TCR register. There are cases where we want to only
        change TCR and not TSR. Although we can uses SREGS without
        KVM_SREGS_E_UPDATE_TSR flag but I think one reg is better. I am open
        if someone feels we should use SREGS only here.
     4) getting/setting TSR register

Signed-off-by: Bharat Bhushan <bharat.bhushan@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agoKVM: PPC: move tsr update in a separate function
Bharat Bhushan [Sun, 24 Feb 2013 18:57:11 +0000 (18:57 +0000)]
KVM: PPC: move tsr update in a separate function

This is done so that same function can be called from SREGS and
ONE_REG interface (follow up patch).

Signed-off-by: Bharat Bhushan <bharat.bhushan@freescale.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
11 years agoKVM: MMU: Rename kvm_mmu_free_some_pages() to make_mmu_pages_available()
Takuya Yoshikawa [Thu, 21 Mar 2013 10:34:27 +0000 (19:34 +0900)]
KVM: MMU: Rename kvm_mmu_free_some_pages() to make_mmu_pages_available()

The current name "kvm_mmu_free_some_pages" should be used for something
that actually frees some shadow pages, as we expect from the name, but
what the function is doing is to make some, KVM_MIN_FREE_MMU_PAGES,
shadow pages available: it does nothing when there are enough.

This patch changes the name to reflect this meaning better; while doing
this renaming, the code in the wrapper function is inlined into the main
body since the whole function will be inlined into the only caller now.

Signed-off-by: Takuya Yoshikawa <yoshikawa_takuya_b1@lab.ntt.co.jp>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: MMU: Move kvm_mmu_free_some_pages() into kvm_mmu_alloc_page()
Takuya Yoshikawa [Thu, 21 Mar 2013 10:33:43 +0000 (19:33 +0900)]
KVM: MMU: Move kvm_mmu_free_some_pages() into kvm_mmu_alloc_page()

What this function is doing is to ensure that the number of shadow pages
does not exceed the maximum limit stored in n_max_mmu_pages: so this is
placed at every code path that can reach kvm_mmu_alloc_page().

Although it might have some sense to spread this function in each such
code path when it could be called before taking mmu_lock, the rule was
changed not to do so.

Taking this background into account, this patch moves it into
kvm_mmu_alloc_page() and simplifies the code.

Note: the unlikely hint in kvm_mmu_free_some_pages() guarantees that the
overhead of this function is almost zero except when we actually need to
allocate some shadow pages, so we do not need to care about calling it
multiple times in one path by doing kvm_mmu_get_page() a few times.

Signed-off-by: Takuya Yoshikawa <yoshikawa_takuya_b1@lab.ntt.co.jp>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoMerge remote-tracking branch 'upstream/master' into queue
Marcelo Tosatti [Thu, 21 Mar 2013 14:11:52 +0000 (11:11 -0300)]
Merge remote-tracking branch 'upstream/master' into queue

Merge reason:

From: Alexander Graf <agraf@suse.de>

"Just recently this really important patch got pulled into Linus' tree for 3.9:

commit 1674400aaee5b466c595a8fc310488263ce888c7
Author: Anton Blanchard <anton <at> samba.org>
Date:   Tue Mar 12 01:51:51 2013 +0000

Without that commit, I can not boot my G5, thus I can't run automated tests on it against my queue.

Could you please merge kvm/next against linus/master, so that I can base my trees against that?"

* upstream/master: (653 commits)
  PCI: Use ROM images from firmware only if no other ROM source available
  sparc: remove unused "config BITS"
  sparc: delete "if !ULTRA_HAS_POPULATION_COUNT"
  KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
  KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)
  KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)
  arm64: Kconfig.debug: Remove unused CONFIG_DEBUG_ERRORS
  arm64: Do not select GENERIC_HARDIRQS_NO_DEPRECATED
  inet: limit length of fragment queue hash table bucket lists
  qeth: Fix scatter-gather regression
  qeth: Fix invalid router settings handling
  qeth: delay feature trace
  sgy-cts1000: Remove __dev* attributes
  KVM: x86: fix deadlock in clock-in-progress request handling
  KVM: allow host header to be included even for !CONFIG_KVM
  hwmon: (lm75) Fix tcn75 prefix
  hwmon: (lm75.h) Update header inclusion
  MAINTAINERS: Remove Mark M. Hoffman
  xfs: ensure we capture IO errors correctly
  xfs: fix xfs_iomap_eof_prealloc_initial_size type
  ...

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: x86: correctly initialize the CS base on reset
Paolo Bonzini [Tue, 19 Mar 2013 15:30:26 +0000 (16:30 +0100)]
KVM: x86: correctly initialize the CS base on reset

The CS base was initialized to 0 on VMX (wrong, but usually overridden
by userspace before starting) or 0xf0000 on SVM.  The correct value is
0xffff0000, and VMX is able to emulate it now, so use it.

Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoMerge tag 'vfio-v3.9-rc4' of git://github.com/awilliam/linux-vfio
Linus Torvalds [Wed, 20 Mar 2013 01:25:20 +0000 (18:25 -0700)]
Merge tag 'vfio-v3.9-rc4' of git://github.com/awilliam/linux-vfio

Pull vfio fix from Alex Williamson.

* tag 'vfio-v3.9-rc4' of git://github.com/awilliam/linux-vfio:
  vfio: include <linux/slab.h> for kmalloc

11 years agoMerge git://git.kernel.org/pub/scm/virt/kvm/kvm
Linus Torvalds [Wed, 20 Mar 2013 01:24:12 +0000 (18:24 -0700)]
Merge git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Marcelo Tosatti.

* git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
  KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)
  KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)
  KVM: x86: fix deadlock in clock-in-progress request handling
  KVM: allow host header to be included even for !CONFIG_KVM

11 years agoMerge tag 'for-linus-v3.9-rc4' of git://oss.sgi.com/xfs/xfs
Linus Torvalds [Tue, 19 Mar 2013 22:17:40 +0000 (15:17 -0700)]
Merge tag 'for-linus-v3.9-rc4' of git://oss.sgi.com/xfs/xfs

Pull XFS fixes from Ben Myers:

 - Fix for a potential infinite loop which was introduced in commit
   4d559a3bcb73 ("xfs: limit speculative prealloc near ENOSPC
   thresholds")

 - Fix for the return type of xfs_iomap_eof_prealloc_initial_size from
   commit a1e16c26660b ("xfs: limit speculative prealloc size on sparse
   files")

 - Fix for a failed buffer readahead causing subsequent callers to fail
   incorrectly

* tag 'for-linus-v3.9-rc4' of git://oss.sgi.com/xfs/xfs:
  xfs: ensure we capture IO errors correctly
  xfs: fix xfs_iomap_eof_prealloc_initial_size type
  xfs: fix potential infinite loop in xfs_iomap_prealloc_size()

11 years agoPCI: Use ROM images from firmware only if no other ROM source available
Matthew Garrett [Tue, 19 Mar 2013 21:26:57 +0000 (17:26 -0400)]
PCI: Use ROM images from firmware only if no other ROM source available

Mantas Mikulėnas reported that his graphics hardware failed to
initialise after commit f9a37be0f02a ("x86: Use PCI setup data").

The aim of this commit was to ensure that ROM images were available on
some Apple systems that don't expose the GPU ROM via any other source.
In this case, UEFI appears to have provided a broken ROM image that we
were using even though there was a perfectly valid ROM available via
other sources.  The simplest way to handle this seems to be to just
re-order pci_map_rom() and leave any firmare-supplied ROM to last.

Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
Tested-by: Mantas Mikulėnas <grawity@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
11 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
Linus Torvalds [Tue, 19 Mar 2013 21:47:11 +0000 (14:47 -0700)]
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc

Pull sparc fixes from David Miller:
 "Just some minor fixups, a sunsu console setup panic cure, and
  recognition of a Fujitsu sun4v cpu."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  sparc: remove unused "config BITS"
  sparc: delete "if !ULTRA_HAS_POPULATION_COUNT"
  sparc64: correctly recognize SPARC64-X chips
  sparc,leon: fix GRPCI2 device0 PCI config space access
  sunsu: Fix panic in case of nonexistent port at "console=ttySY" cmdline option

11 years agoMerge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas...
Linus Torvalds [Tue, 19 Mar 2013 20:56:18 +0000 (13:56 -0700)]
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64

Pull arm64 fixes from Catalin Marinas:

 - Fix !SMP build error.

 - Fix padding computation in struct ucontext (no ABI change).

 - Minor clean-up after the signal patches (unused var).

 - Two old Kconfig options clean-up.

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64:
  arm64: Kconfig.debug: Remove unused CONFIG_DEBUG_ERRORS
  arm64: Do not select GENERIC_HARDIRQS_NO_DEPRECATED
  arm64: fix padding computation in struct ucontext
  arm64: Fix build error with !SMP
  arm64: Removed unused variable in compat_setup_rt_frame()

11 years agosparc: remove unused "config BITS"
Paul Bolle [Tue, 19 Mar 2013 05:58:47 +0000 (05:58 +0000)]
sparc: remove unused "config BITS"

sparc's asm/module.h got removed in commit
786d35d45cc40b2a51a18f73e14e135d47fdced7 ("Make most arch asm/module.h
files use asm-generic/module.h"). That removed the only two uses of this
Kconfig symbol. So we can remove its entry too.

> >From arch/sparc/Makefile:
>     ifeq ($(CONFIG_SPARC32),y)
>     [...]
>
>     [...]
>     export BITS    := 32
>     [...]
>
>     else
>     [...]
>
>     [...]
>     export BITS   := 64
>     [...]
>
> So $(BITS) is set depending on whether CONFIG_SPARC32 is set or not.
> Using $(BITS) in sparc's Makefiles is not using CONFIG_BITS. That
> doesn't count as usage of "config BITS".

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
11 years agoMerge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Linus Torvalds [Tue, 19 Mar 2013 20:20:51 +0000 (13:20 -0700)]
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix ARM BPF JIT handling of negative 'k' values, from Chen Gang.

 2) Insufficient space reserved for bridge netlink values, fix from
    Stephen Hemminger.

 3) Some dst_neigh_lookup*() callers don't interpret error pointer
    correctly, fix from Zhouyi Zhou.

 4) Fix transport match in SCTP active_path loops, from Xugeng Zhang.

 5) Fix qeth driver handling of multi-order SKB frags, from Frank
    Blaschka.

 6) fec driver is missing napi_disable() call, resulting in crashes on
    unload, from Georg Hofmann.

 7) Don't try to handle PMTU events on a listening socket, fix from Eric
    Dumazet.

 8) Fix timestamp location calculations in IP option processing, from
    David Ward.

 9) FIB_TABLE_HASHSZ setting is not controlled by the correct kconfig
    tests, from Denis V Lunev.

10) Fix TX descriptor push handling in SFC driver, from Ben Hutchings.

11) Fix isdn/hisax and tulip/de4x5 kconfig dependencies, from Arnd
    Bergmann.

12) bnx2x statistics don't handle 4GB rollover correctly, fix from
    Maciej Żenczykowski.

13) Openvswitch bug fixes for vport del/new error reporting, missing
    genlmsg_end() call in netlink processing, and mis-parsing of
    LLC/SNAP ethernet types.  From Rich Lane.

14) SKB pfmemalloc state should only be propagated from the head page of
    a compound page, fix from Pavel Emelyanov.

15) Fix link handling in tg3 driver for 5715 chips when autonegotation
    is disabled.  From Nithin Sujir.

16) Fix inverted test of cpdma_check_free_tx_desc return value in
    davinci_emac driver, from Mugunthan V N.

17) vlan_depth is incorrectly calculated in skb_network_protocol(), from
    Li RongQing.

18) Fix probing of Gobi 1K devices in qmi_wwan driver, and fix NCM
    device mode backwards compat in cdc_ncm driver.  From Bjørn Mork.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)
  inet: limit length of fragment queue hash table bucket lists
  qeth: Fix scatter-gather regression
  qeth: Fix invalid router settings handling
  qeth: delay feature trace
  tcp: dont handle MTU reduction on LISTEN socket
  bnx2x: fix occasional statistics off-by-4GB error
  vhost/net: fix heads usage of ubuf_info
  bridge: Add support for setting BR_ROOT_BLOCK flag.
  bnx2x: add missing napi deletion in error path
  drivers: net: ethernet: ti: davinci_emac: fix usage of cpdma_check_free_tx_desc()
  ethernet/tulip: DE4x5 needs VIRT_TO_BUS
  isdn: hisax: netjet requires VIRT_TO_BUS
  net: cdc_ncm, cdc_mbim: allow user to prefer NCM for backwards compatibility
  rtnetlink: Mask the rta_type when range checking
  Revert "ip_gre: make ipgre_tunnel_xmit() not parse network header as IP unconditionally"
  Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug
  smsc75xx: configuration help incorrectly mentions smsc95xx
  net: fec: fix missing napi_disable call
  net: fec: restart the FEC when PHY speed changes
  skb: Propagate pfmemalloc on skb from head page only
  ...

11 years agosparc: delete "if !ULTRA_HAS_POPULATION_COUNT"
Paul Bolle [Tue, 12 Mar 2013 20:35:19 +0000 (21:35 +0100)]
sparc: delete "if !ULTRA_HAS_POPULATION_COUNT"

Commit 2d78d4beb64eb07d50665432867971c481192ebf ("[PATCH] bitops:
sparc64: use generic bitops") made the default of GENERIC_HWEIGHT depend
on !ULTRA_HAS_POPULATION_COUNT. But since there's no Kconfig symbol with
that name, this always evaluates to true. Delete this dependency.

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
11 years agoKVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
Andy Honig [Wed, 20 Feb 2013 22:49:16 +0000 (14:49 -0800)]
KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)

If the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows
that with a read of the IOAPIC_REG_WINDOW KVM does not properly validate
that request.  ioapic_read_indirect contains an
ASSERT(redir_index < IOAPIC_NUM_PINS), but the ASSERT has no effect in
non-debug builds.  In recent kernels this allows a guest to cause a kernel
oops by reading invalid memory.  In older kernels (pre-3.3) this allows a
guest to read from large ranges of host memory.

Tested: tested against apic unit tests.

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013...
Andy Honig [Wed, 20 Feb 2013 22:48:10 +0000 (14:48 -0800)]
KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)

There is a potential use after free issue with the handling of
MSR_KVM_SYSTEM_TIME.  If the guest specifies a GPA in a movable or removable
memory such as frame buffers then KVM might continue to write to that
address even after it's removed via KVM_SET_USER_MEMORY_REGION.  KVM pins
the page in memory so it's unlikely to cause an issue, but if the user
space component re-purposes the memory previously used for the guest, then
the guest will be able to corrupt that memory.

Tested: Tested against kvmclock unit test

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoKVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)
Andy Honig [Mon, 11 Mar 2013 16:34:52 +0000 (09:34 -0700)]
KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796)

If the guest sets the GPA of the time_page so that the request to update the
time straddles a page then KVM will write onto an incorrect page.  The
write is done byusing kmap atomic to get a pointer to the page for the time
structure and then performing a memcpy to that page starting at an offset
that the guest controls.  Well behaved guests always provide a 32-byte aligned
address, however a malicious guest could use this to corrupt host kernel
memory.

Tested: Tested against kvmclock unit test.

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
11 years agoarm64: Kconfig.debug: Remove unused CONFIG_DEBUG_ERRORS
Paul Bolle [Tue, 19 Mar 2013 15:41:37 +0000 (15:41 +0000)]
arm64: Kconfig.debug: Remove unused CONFIG_DEBUG_ERRORS

The Kconfig entry for DEBUG_ERRORS is a verbatim copy of the former arm
entry for that symbol. It got removed in v2.6.39 because it wasn't
actually used anywhere. There are still no users of DEBUG_ERRORS so
remove this entry too.

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
[catalin.marinas@arm.com: removed option from defconfig]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>