- 02 Aug, 2010 40 commits
-
-
Avi Kivity authored
vmx does not restore GDT.LIMIT to the host value, instead it sets it to 64KB. This means host userspace can learn a few bits of host memory. Fix by reloading GDTR when we load other host state. Signed-off-by:
Avi Kivity <avi@redhat.com> Signed-off-by:
Marcelo Tosatti <mtosatti@redhat.com>
-
Xiao Guangrong authored
Sometimes, atomically set spte is not needed, this patch call __xchg_spte() more smartly Note: if the old mapping's access bit is already set, we no need atomic operation since the access bit is not lost Signed-off-by:
Xiao Guangrong <xiaoguangrong@cn.fujitsu.com> Signed-off-by:
-
Xiao Guangrong authored
Introduce set_spte_track_bits() to cleanup current code Signed-off-by:
-
Xiao Guangrong authored
If the old mapping is not present, the spte.a is not lost, so no need atomic operation to set it Signed-off-by:
-
Xiao Guangrong authored
In sync-page path, if spte.writable is changed, it will lose page dirty tracking, for example: assume spte.writable = 0 in a unsync-page, when it's synced, it map spte to writable(that is spte.writable = 1), later guest write spte.gfn, it means spte.gfn is dirty, then guest changed this mapping to read-only, after it's synced, spte.writable = 0 So, when host release the spte, it detect spte.writable = 0 and not mark page dirty Signed-off-by:
-
Xiao Guangrong authored
In current code, if ept is enabled(shadow_accessed_mask = 0), the page accessed tracking is lost. Signed-off-by:
-
Xiao Guangrong authored
In the speculative path, we should check guest pte's reserved bits just as the real processor does Reported-by:
-
Andrea Arcangeli authored
The index wasn't calculated correctly (off by one) for huge spte so KVM guest was unstable with transparent hugepages. Signed-off-by:
Andrea Arcangeli <aarcange@redhat.com> Reviewed-by:
Reviewed-by: Rik van Riel <riel@redhat.com> Signed-off-by:
-
Wei Yongjun authored
If the destination is a memory operand and the memory cannot map to a valid page, the xchg instruction emulation and locked instruction will not work on io regions and stuck in endless loop. We should emulate exchange as write to fix it. Signed-off-by:
Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by:
Gleb Natapov <gleb@redhat.com> Signed-off-by:
-
Gleb Natapov authored
If pit delivers interrupt while pic is masking it OS will never do EOI and ack notifier will not be called so when pit will be unmasked no pit interrupts will be delivered any more. Calling mask notifiers solves this issue. Signed-off-by:
-
Gleb Natapov authored
With tdp enabled we should get into emulator only when emulating io, so reexecution will always bring us back into emulator. Signed-off-by:
-
Avi Kivity authored
Signed-off-by:
-
Gleb Natapov authored
Mark inc (0xfe/0 0xff/0) and dec (0xfe/1 0xff/1) as lock prefix capable. Signed-off-by:
-
Avi Kivity authored
'level' and 'sptep' are aliases for 'interator.level' and 'iterator.sptep', no need for them. Signed-off-by:
-
Avi Kivity authored
Currently, when we fetch an spte, we only verify that gptes match those that the walker saw if we build new shadow pages for them. However, this misses the following race: vcpu1 vcpu2 walk change gpte walk instantiate sp fetch existing sp Fix by validating every gpte, regardless of whether it is used for building a new sp or not. Signed-off-by: -
Avi Kivity authored
Partition the function into three sections: - fetching indirect shadow pages (host_level > guest_level) - fetching direct shadow pages (page_level < host_level <= guest_level) - the final spte (page_level == host_level) Instead of the current spaghetti. A slight change from the original code is that we call validate_direct_spte() more often: previously we called it only for gw->level, now we also call it for lower levels. The change should have no effect. [xiao: fix regression caused by validate_direct_spte() called too late] Signed-off-by:
-
Avi Kivity authored
Move the code to check whether a gpte has changed since we fetched it into a helper. Signed-off-by:
-
Avi Kivity authored
Add a helper to verify that a direct shadow page is valid wrt the required access permissions; drop the page if it is not valid. Reviewed-by:
-
Avi Kivity authored
To clarify spte fetching code, move large spte handling into a helper. Signed-off-by:
-
Avi Kivity authored
To avoid split accesses to 64 bit sptes on i386, use __set_spte() to link shadow pages together. (not technically required since shadow pages are __GFP_KERNEL, so upper 32 bits are always clear) Reviewed-by:
-
Avi Kivity authored
To simplify the process of fetching an spte, add a helper that links a shadow page to an spte. Reviewed-by:
-
Gleb Natapov authored
Devices register mask notifier using gsi, but irqchip knows about irqchip/pin, so conversion from irqchip/pin to gsi should be done before looking for mask notifier to call. Signed-off-by:
-
Avi Kivity authored
Signed-off-by:
-
Avi Kivity authored
Userspace needs to reset and save/restore these MSRs. The MCE banks are not exposed since their number varies from vcpu to vcpu. Signed-off-by:
-
Xiao Guangrong authored
Fix: general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC ...... Call Trace: [<ffffffffa0159bd1>] ? kvm_set_irq+0xdd/0x24b [kvm] [<ffffffff8106ea8b>] ? trace_hardirqs_off_caller+0x1f/0x10e [<ffffffff813ad17f>] ? sub_preempt_count+0xe/0xb6 [<ffffffff8106d273>] ? put_lock_stats+0xe/0x27 ... RIP [<ffffffffa0159c72>] kvm_set_irq+0x17e/0x24b [kvm] This bug is triggered when guest is shutdown, is because we freed irq_routing before pit thread stopped Signed-off-by:
-
Gleb Natapov authored
When shadow pages are in use sometimes KVM try to emulate an instruction when it accesses a shadowed page. If emulation fails KVM un-shadows the page and reenter guest to allow vcpu to execute the instruction. If page is not in shadow page hash KVM assumes that this was attempt to do MMIO and reports emulation failure to userspace since there is no way to fix the situation. This logic has a race though. If two vcpus tries to write to the same shadowed page simultaneously both will enter emulator, but only one of them will find the page in shadow page hash since the one who founds it also removes it from there, so another cpu will report failure to userspace and will abort the guest. Fix this by checking (in addition to checking shadowed page hash) that page that caused the emulation belongs to valid memory slot. If it is then reenter the guest to allow vcpu to reexecute the instruction. Signed-off-by:
-
Gleb Natapov authored
Currently if guest access address that belongs to memory slot but is not backed up by page or page is read only KVM treats it like MMIO access. Remove that capability. It was never part of the interface and should not be relied upon. Signed-off-by:
-
Gleb Natapov authored
They are not used outside of the file. Signed-off-by:
-
Jiri Slaby authored
Stanse found that there is an omitted unlock in kvm_create_pit in one fail path. Add proper unlock there. Signed-off-by:
Jiri Slaby <jirislaby@gmail.com> Cc: Avi Kivity <avi@redhat.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: x86@kernel.org Cc: Gleb Natapov <gleb@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Gregory Haskins <ghaskins@novell.com> Cc: kvm@vger.kernel.org Signed-off-by:
-
Avi Kivity authored
Real hardware disregards permission errors when computing page fault error code bit 0 (page present). Do the same. Reviewed-by:
-
Avi Kivity authored
Bit 4 of the page fault error code is set only if EFER.NX is set. Reviewed-by:
-
Wei Yongjun authored
This patch change to use DstAcc for decoding 'mov AL, moffs' and introduced SrcAcc for decoding 'mov moffs, AL'. Signed-off-by:
-
Wei Yongjun authored
If IOPL check fail, the cli/sti emulate GP and then we should skip writeback since the default write OP is OP_REG. Signed-off-by:
-
Wei Yongjun authored
The source operand of 'mov rm,sreg' is segment register, not general-purpose register, so remove SrcReg from decoding. Signed-off-by:
-
Wei Yongjun authored
'and AL,imm8' should be mask as ByteOp, otherwise the dest operand length will no correct and we may fill the full EAX when writeback. Signed-off-by:
-
Wei Yongjun authored
Fix the comment of out instruction, using the same style as the other instructions. Signed-off-by:
-
Wei Yongjun authored
Memory reads for 'mov sreg,rm16' should be 16 bits only. Signed-off-by:
-
Avi Kivity authored
__set_spte() will happily replace an spte with the accessed bit set with one that has the accessed bit clear. Add a helper update_spte() which checks for this condition and updates the page flag if needed. Signed-off-by: -
Avi Kivity authored
Currently, in the window between the check for the accessed bit, and actually dropping the spte, a vcpu can access the page through the spte and set the bit, which will be ignored by the mmu. Fix by using an exchange operation to atmoically fetch the spte and drop it. Signed-off-by: -
Avi Kivity authored
Since we need to make the check atomic, move it to the place that will set the new spte. Signed-off-by:
-
