- 06 Jan, 2007 40 commits
-
-
Avi Kivity authored
If we reduce permissions on a pte, we must flush the cached copy of the pte from the guest's tlb. This is implemented at the moment by flushing the entire guest tlb, and can be improved by flushing just the relevant virtual address, if it is known. Signed-off-by:
Avi Kivity <avi@qumranet.com> Acked-by:
Ingo Molnar <mingo@elte.hu> Signed-off-by:
Andrew Morton <akpm@osdl.org> Signed-off-by:
Linus Torvalds <torvalds@osdl.org>
-
Avi Kivity authored
Signed-off-by:
-
Avi Kivity authored
The mmu sometimes needs memory for reverse mapping and parent pte chains. however, we can't allocate from within the mmu because of the atomic context. So, move the allocations to a central place that can be executed before the main mmu machinery, where we can bail out on failure before any damage is done. (error handling is deffered for now, but the basic structure is there) Signed-off-by:
-
Avi Kivity authored
Because mmu pages have attached rmap and parent pte chain structures, we need to zap them before freeing so the attached structures are freed. Signed-off-by:
-
Avi Kivity authored
Signed-off-by:
-
Avi Kivity authored
cmpxchg8b uses edx:eax as the compare operand, not edi:eax. cmpxchg8b is used by 32-bit pae guests to set page table entries atomically, and this is emulated touching shadowed guest page tables. Also, implement it for 32-bit hosts. Signed-off-by:
-
Avi Kivity authored
We always need cr3 to point to something valid, so if we detect that we're freeing a root page, simply push it back to the top of the active list. Signed-off-by:
-
Avi Kivity authored
In fork() (or when we protect a page that is no longer a page table), we can experience floods of writes to a page, which have to be emulated. This is expensive. So, if we detect such a flood, zap the page so subsequent writes can proceed natively. Signed-off-by:
-
Avi Kivity authored
Signed-off-by:
-
Avi Kivity authored
Signed-off-by:
-
Avi Kivity authored
Signed-off-by:
-
Avi Kivity authored
A misaligned access affects two shadow ptes instead of just one. Since a misaligned access is unlikely to occur on a real page table, just zap the page out of existence, avoiding further trouble. Signed-off-by:
-
Avi Kivity authored
Unused. Signed-off-by:
-
Avi Kivity authored
Since we write protect shadowed guest page tables, there is no need to trap page invalidations (the guest will always change the mapping before issuing the invlpg instruction). Signed-off-by:
-
Avi Kivity authored
When beginning to process a page fault, make sure we have enough shadow pages available to service the fault. If not, free some pages. Signed-off-by:
-
Avi Kivity authored
... and so must not free it unconditionally. Move the freeing to kvm_mmu_zap_page(). Signed-off-by:
-
Avi Kivity authored
When removing a page table, we must maintain the parent_pte field all child shadow page tables. Signed-off-by:
-
Avi Kivity authored
A page table may have been recycled into a regular page, and so any instruction can be executed on it. Unprotect the page and let the cpu do its thing. Signed-off-by:
-
Avi Kivity authored
Iterate over all shadow pages which correspond to a the given guest page table and remove the mappings. A subsequent page fault will reestablish the new mapping. Signed-off-by:
-
Avi Kivity authored
As the mmu write protects guest page table, we emulate those writes. Since they are not mmio, there is no need to go to userspace to perform them. So, perform the writes in the kernel if possible, and notify the mmu about them so it can take the approriate action. Signed-off-by:
-
Avi Kivity authored
This fixes a problem where set_pte_common() looked for shadowed pages based on the page directory gfn (a huge page) instead of the actual gfn being mapped. Signed-off-by:
-
Avi Kivity authored
When we cache a guest page table into a shadow page table, we need to prevent further access to that page by the guest, as that would render the cache incoherent. Signed-off-by:
-
Avi Kivity authored
Define a hashtable for caching shadow page tables. Look up the cache on context switch (cr3 change) or during page faults. The key to the cache is a combination of - the guest page table frame number - the number of paging levels in the guest * we can cache real mode, 32-bit mode, pae, and long mode page tables simultaneously. this is useful for smp bootup. - the guest page table table * some kernels use a page as both a page table and a page directory. this allows multiple shadow pages to exist for that page, one per level - the "quadrant" * 32-bit mode page tables span 4MB, whereas a shadow page table spans 2MB. similarly, a 32-bit page directory spans 4GB, while a shadow page directory spans 1GB. the quadrant allows caching up to 4 shadow page tables for one guest page in one level. - a "metaphysical" bit * for real mode, and for pse pages, there is no guest page table, so set the bit to avoid write protecting the page. Signed-off-by: -
Avi Kivity authored
This allows further manipulation on the shadow page table. Signed-off-by:
-
Avi Kivity authored
Signed-off-by:
-
Avi Kivity authored
This lets us not write protect a partial page, and is anyway what a real processor does. Signed-off-by:
-
Avi Kivity authored
Since we're not going to cache the pae-mode shadow root pages, allocate a single pae shadow that will hold the four lower-level pages, which will act as roots. Signed-off-by:
-
Avi Kivity authored
It is never necessary to fetch a guest entry from an intermediate page table level (except for large pages), so avoid some confusion by always descending into the lowest possible level. Rename init_walker() to walk_addr() as it is no longer restricted to initialization. Signed-off-by:
-
Avi Kivity authored
In pae mode, a load of cr3 loads the four third-level page table entries in addition to cr3 itself. Signed-off-by:
-
Avi Kivity authored
Saving the table gfns removes the need to walk the guest and host page tables in lockstep. Signed-off-by:
-
Avi Kivity authored
Keep in each host page frame's page->private a pointer to the shadow pte which maps it. If there are multiple shadow ptes mapping the page, set bit 0 of page->private, and use the rest as a pointer to a linked list of all such mappings. Reverse mappings are needed because we when we cache shadow page tables, we must protect the guest page tables from being modified by the guest, as that would invalidate the cached ptes. Signed-off-by:
-
Avi Kivity authored
Hardware virtualization implementations allow the guests to freely change some of the bits in cr0 and cr4, but trap when changing the other bits. This is useful to avoid excessive exits due to changing, for example, the ts flag. It also means the kvm's copy of cr0 and cr4 may be stale with respect to these bits. most of the time this doesn't matter as these bits are not very interesting. Other times, however (for example when returning cr0 to userspace), they are, so get the fresh contents of these bits from the guest by means of a new arch operation. Signed-off-by:
-
David Brownell authored
Bugfixes: - Handle RTCs which are configured to use 12-hour mode. - Never report bogus/un-initialized times. - Displaying "raw trim" requires not masking it first! - Fix the sysfs and procfs display of crystal and trim data. Features: - Handle other RTCs in this family, notably rv5c386/rv5c387. - Declare the other registers. - Provide alarm get/set functionality. - Handle AIE and UIE; but no IRQ handling yet. Cleanup: - Shrink object by not including needless sysfs or procfs support - We don't need no steenkin' forward declarations. (Except one.) Until the I2C framework merges "new style" driver support, matching the driver model better, using rv5c chips or alarm IRQs requires a separate board-specific patch. (And an IRQ handler, handing off labor through a work_struct...) This uses the "method 3" register reads, but notes that it's done to work around an evident i2c adapter driver bug. Signed-off-by:
David Brownell <dbrownell@users.sourceforge.net> Acked-by:
Alessandro Zummo <a.zummo@towertech.it> Signed-off-by:
-
Hugh Dickins authored
pdflush hit the BUG_ON(!PageSlab(page)) in kmem_freepages called from fallback_alloc: cache_grow already freed those pages when alloc_slabmgmt failed. But it wouldn't have freed them if __GFP_NO_GROW, so make sure fallback_alloc doesn't waste its time on that case. Signed-off-by:
Hugh Dickins <hugh@veritas.com> Acked-by:
Christoph Lameter <clameter@sgi.com> Acked-by:
Pekka J Enberg <penberg@cs.helsinki.fi> Signed-off-by:
-
Eric Sandeen authored
CVE-2006-5753 is for a case where an inode can be marked bad, switching the ops to bad_inode_ops, which are all connected as: static int return_EIO(void) { return -EIO; } #define EIO_ERROR ((void *) (return_EIO)) static struct inode_operations bad_inode_ops = { .create = bad_inode_create ...etc... The problem here is that the void cast causes return types to not be promoted, and for ops such as listxattr which expect more than 32 bits of return value, the 32-bit -EIO is interpreted as a large positive 64-bit number, i.e. 0x00000000fffffffa instead of 0xfffffffa. This goes particularly badly when the return value is taken as a number of bytes to copy into, say, a user's buffer for example... I originally had coded up the fix by creating a return_EIO_<TYPE> macro for each return type, like this: static int return_EIO_int(void) { return -EIO; } #define EIO_ERROR_INT ((void *) (return_EIO_int)) static struct inode_operations bad_inode_ops = { .create = EIO_ERROR_INT, ...etc... but Al felt that it was probably better to create an EIO-returner for each actual op signature. Since so few ops share a signature, I just went ahead & created an EIO function for each individual file & inode op that returns a value. Signed-off-by:Eric Sandeen <sandeen@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
-
Andrew Morton authored
Make this: drivers/char/ip2/ip2main.c: In function 'ip2_loadmain': drivers/char/ip2/ip2main.c:654: warning: control may reach end of non-void function 'iiSetAddress' being inlined drivers/char/ip2/ip2main.c:808: warning: control may reach end of non-void function 'iiInitialize' being inlined go away. Signed-off-by:
-
Vivek Goyal authored
o Currently synchronize_tsc_ap() is of type __init. It is called by smp_callin() which is of type __cpuinit. So synchronize_tsc_ap() should be of type __cpuinit. o Modpost generates warnings for i386 if CONFIG_RELOCATABLE=y and CONFIG_HOTPLUG_CPU=y WARNING: vmlinux - Section mismatch: reference to .init.data: from .text between 'start_secondary' (at offset 0xc01164dc) and 'initialize_secondary' WARNING: vmlinux - Section mismatch: reference to .init.data: from .text between 'start_secondary' (at offset 0xc01164e8) and 'initialize_secondary' o tsc is of type __initdata. It should be of type __cpuinitdata. Signed-off-by:
Vivek Goyal <vgoyal@in.ibm.com> Cc: Andi Kleen <ak@suse.de> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by:
-
Vivek Goyal authored
o MODPOST generates warning for i386 if kernel is compiled with CONFIG_RELOCATABLE=y WARNING: vmlinux - Section mismatch: reference to .init.data: from .data between 'this_cpu' (at offset 0xc05194d0) and 'cpuinfo_op' o this_cpu pointer should be of type __cpuinitdata. Signed-off-by:
-
Vivek Goyal authored
o MODPOST generates warning for i386 if kernel is compiled with CONFIG_RELOCATABLE=y WARNING: vmlinux - Section mismatch: reference to .init.text:startup_32_smp from .data between 'trampoline_data' (at offset 0xc0519cf8) and 'boot_gdt' o trampoline code/data can go into init section is CPU hotplug is not enabled. Signed-off-by:
-
Paul Mundt authored
At the moment the inode/dentry cache hash tables (common by way of alloc_large_system_hash()) are incorrectly sized by their respective detection logic when we attempt to use large base pages on systems with little memory. This results in odd behaviour when using a 64kB PAGE_SIZE, such as: Dentry cache hash table entries: 8192 (order: -1, 32768 bytes) Inode-cache hash table entries: 4096 (order: -2, 16384 bytes) The mount cache hash table is seemingly the only one that gets this right by directly taking PAGE_SIZE in to account. The following patch attempts to catch the bogus values and round it up to at least 0-order. Signed-off-by:
Paul Mundt <lethal@linux-sh.org> Signed-off-by:
-
