From cccf748b810832cfab4dbb3ed4c7cf1a1ee35ad2 Mon Sep 17 00:00:00 2001 From: Avi Kivity Date: Mon, 22 Jan 2007 20:40:39 -0800 Subject: [PATCH] KVM: fix race between mmio reads and injected interrupts The kvm mmio read path looks like: 1. guest read faults 2. kvm emulates read, calls emulator_read_emulated() 3. fails as a read requires userspace help 4. exit to userspace 5. userspace emulates read, kvm sets vcpu->mmio_read_completed 6. re-enter guest, fault again 7. kvm emulates read, calls emulator_read_emulated() 8. succeeds as vcpu->mmio_read_emulated is set 9. instruction completes and guest is resumed A problem surfaces if the userspace exit (step 5) also requests an interrupt injection. In that case, the guest does not re-execute the original instruction, but the interrupt handler. The next time an mmio read is exectued (likely for a different address), step 3 will find vcpu->mmio_read_completed set and return the value read for the original instruction. The problem manifested itself in a few annoying ways: - little squares appear randomly on console when switching virtual terminals - ne2000 fails under nfs read load - rtl8139 complains about "pci errors" even though the device model is incapable of issuing them. Fix by skipping interrupt injection if an mmio read is pending. A better fix is to avoid re-entry into the guest, and re-emulating immediately instead. However that's a bit more complex. Signed-off-by: Avi Kivity Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/kvm/svm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/kvm/svm.c') diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c index 714f6a7841c..7397bfbbcb1 100644 --- a/drivers/kvm/svm.c +++ b/drivers/kvm/svm.c @@ -1407,7 +1407,8 @@ static int svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) int r; again: - do_interrupt_requests(vcpu, kvm_run); + if (!vcpu->mmio_read_completed) + do_interrupt_requests(vcpu, kvm_run); clgi(); -- cgit v1.2.3 From bce66ca4a2f695509e1b021311eb4de1e4fdf3e4 Mon Sep 17 00:00:00 2001 From: Leonard Norrgard Date: Fri, 26 Jan 2007 00:56:38 -0800 Subject: [PATCH] KVM: SVM: Fix SVM idt confusion There's an obvious typo in svm_{get,set}_idt, causing it to access the ldt instead. Because these functions are only called for save/load on AMD, the bug does not impact normal operation. With the fix, save/load works as expected on AMD hosts. Signed-off-by: Uri Lublin Signed-off-by: Avi Kivity Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/kvm/svm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/kvm/svm.c') diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c index 7397bfbbcb1..717aabb012c 100644 --- a/drivers/kvm/svm.c +++ b/drivers/kvm/svm.c @@ -680,14 +680,14 @@ static void svm_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l) static void svm_get_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt) { - dt->limit = vcpu->svm->vmcb->save.ldtr.limit; - dt->base = vcpu->svm->vmcb->save.ldtr.base; + dt->limit = vcpu->svm->vmcb->save.idtr.limit; + dt->base = vcpu->svm->vmcb->save.idtr.base; } static void svm_set_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt) { - vcpu->svm->vmcb->save.ldtr.limit = dt->limit; - vcpu->svm->vmcb->save.ldtr.base = dt->base ; + vcpu->svm->vmcb->save.idtr.limit = dt->limit; + vcpu->svm->vmcb->save.idtr.base = dt->base ; } static void svm_get_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt) -- cgit v1.2.3 From 46fe4ddd9dbb15305ab9b458e6cfa4dd47ac3e47 Mon Sep 17 00:00:00 2001 From: Joerg Roedel Date: Fri, 26 Jan 2007 00:56:42 -0800 Subject: [PATCH] KVM: SVM: Propagate cpu shutdown events to userspace This patch implements forwarding of SHUTDOWN intercepts from the guest on to userspace on AMD SVM. A SHUTDOWN event occurs when the guest produces a triple fault (e.g. on reboot). This also fixes the bug that a guest reboot actually causes a host reboot under some circumstances. Signed-off-by: Joerg Roedel Signed-off-by: Avi Kivity Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/kvm/svm.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'drivers/kvm/svm.c') diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c index 717aabb012c..9c70ff65e6b 100644 --- a/drivers/kvm/svm.c +++ b/drivers/kvm/svm.c @@ -502,6 +502,7 @@ static void init_vmcb(struct vmcb *vmcb) (1ULL << INTERCEPT_IOIO_PROT) | (1ULL << INTERCEPT_MSR_PROT) | (1ULL << INTERCEPT_TASK_SWITCH) | + (1ULL << INTERCEPT_SHUTDOWN) | (1ULL << INTERCEPT_VMRUN) | (1ULL << INTERCEPT_VMMCALL) | (1ULL << INTERCEPT_VMLOAD) | @@ -892,6 +893,19 @@ static int pf_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) return 0; } +static int shutdown_interception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) +{ + /* + * VMCB is undefined after a SHUTDOWN intercept + * so reinitialize it. + */ + memset(vcpu->svm->vmcb, 0, PAGE_SIZE); + init_vmcb(vcpu->svm->vmcb); + + kvm_run->exit_reason = KVM_EXIT_SHUTDOWN; + return 0; +} + static int io_get_override(struct kvm_vcpu *vcpu, struct vmcb_seg **seg, int *addr_override) @@ -1249,6 +1263,7 @@ static int (*svm_exit_handlers[])(struct kvm_vcpu *vcpu, [SVM_EXIT_IOIO] = io_interception, [SVM_EXIT_MSR] = msr_interception, [SVM_EXIT_TASK_SWITCH] = task_switch_interception, + [SVM_EXIT_SHUTDOWN] = shutdown_interception, [SVM_EXIT_VMRUN] = invalid_op_interception, [SVM_EXIT_VMMCALL] = invalid_op_interception, [SVM_EXIT_VMLOAD] = invalid_op_interception, -- cgit v1.2.3 From 49b14f24cc5aa962446515c9df501192eda99bd4 Mon Sep 17 00:00:00 2001 From: "Robert P. J. Day" Date: Mon, 29 Jan 2007 13:19:50 -0800 Subject: [PATCH] Fix "CONFIG_X86_64_" typo in drivers/kvm/svm.c Fix what looks like an obvious typo in the file drivers/kvm/svm.c. Signed-off-by: Robert P. J. Day Acked-by: Avi Kivity Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/kvm/svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/kvm/svm.c') diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c index 9c70ff65e6b..c79df79307e 100644 --- a/drivers/kvm/svm.c +++ b/drivers/kvm/svm.c @@ -1163,7 +1163,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 data) case MSR_K6_STAR: vcpu->svm->vmcb->save.star = data; break; -#ifdef CONFIG_X86_64_ +#ifdef CONFIG_X86_64 case MSR_LSTAR: vcpu->svm->vmcb->save.lstar = data; break; -- cgit v1.2.3