Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 10bd6b3f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'linus' of git://kvm.qumranet.com/home/avi/kvm 

* 'linus' of git://kvm.qumranet.com/home/avi/kvm:
  KVM: MMU: Fix host memory corruption on i386 with >= 4GB ram
  KVM: MMU: Fix guest writes to nonpae pde
  KVM: Fix guest sysenter on vmx
  KVM: Unset kvm_arch_ops if arch module loading failed
parents 98ae6878 27aba766

drivers/kvm/kvm_main.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -2464,7 +2464,7 @@ int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module) 




	r = kvm_arch_ops->hardware_setup();

	r = kvm_arch_ops->hardware_setup();

	if (r < 0)

	if (r < 0)

	    return r;

		goto out;





	on_each_cpu(kvm_arch_ops->hardware_enable, NULL, 0, 1);

	on_each_cpu(kvm_arch_ops->hardware_enable, NULL, 0, 1);

	r = register_cpu_notifier(&kvm_cpu_notifier);

	r = register_cpu_notifier(&kvm_cpu_notifier);
@@ -2500,6 +2500,8 @@ int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module) 
out_free_1:

out_free_1:

	on_each_cpu(kvm_arch_ops->hardware_disable, NULL, 0, 1);

	on_each_cpu(kvm_arch_ops->hardware_disable, NULL, 0, 1);

	kvm_arch_ops->hardware_unsetup();

	kvm_arch_ops->hardware_unsetup();

out:

	kvm_arch_ops = NULL;

	return r;

	return r;

}

}

drivers/kvm/mmu.c

+37 −15
Original line number Original line Diff line number Diff line
@@ -131,7 +131,7 @@ static int dbg = 1; 
	(((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))

	(((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))









#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & PAGE_MASK)

#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1))

#define PT64_DIR_BASE_ADDR_MASK \

#define PT64_DIR_BASE_ADDR_MASK \

	(PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))

	(PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))
@@ -406,8 +406,8 @@ static void rmap_write_protect(struct kvm_vcpu *vcpu, u64 gfn) 
			spte = desc->shadow_ptes[0];

			spte = desc->shadow_ptes[0];

		}

		}

		BUG_ON(!spte);

		BUG_ON(!spte);

		BUG_ON((*spte & PT64_BASE_ADDR_MASK) !=

		BUG_ON((*spte & PT64_BASE_ADDR_MASK) >> PAGE_SHIFT

		       page_to_pfn(page) << PAGE_SHIFT);

		       != page_to_pfn(page));

		BUG_ON(!(*spte & PT_PRESENT_MASK));

		BUG_ON(!(*spte & PT_PRESENT_MASK));

		BUG_ON(!(*spte & PT_WRITABLE_MASK));

		BUG_ON(!(*spte & PT_WRITABLE_MASK));

		rmap_printk("rmap_write_protect: spte %p %llx\n", spte, *spte);

		rmap_printk("rmap_write_protect: spte %p %llx\n", spte, *spte);
@@ -1093,22 +1093,40 @@ int kvm_mmu_reset_context(struct kvm_vcpu *vcpu) 
	return r;

	return r;

}

}





static void mmu_pre_write_zap_pte(struct kvm_vcpu *vcpu,

				  struct kvm_mmu_page *page,

				  u64 *spte)

{

	u64 pte;

	struct kvm_mmu_page *child;



	pte = *spte;

	if (is_present_pte(pte)) {

		if (page->role.level == PT_PAGE_TABLE_LEVEL)

			rmap_remove(vcpu, spte);

		else {

			child = page_header(pte & PT64_BASE_ADDR_MASK);

			mmu_page_remove_parent_pte(vcpu, child, spte);

		}

	}

	*spte = 0;

}



void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes)

void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes)

{

{

	gfn_t gfn = gpa >> PAGE_SHIFT;

	gfn_t gfn = gpa >> PAGE_SHIFT;

	struct kvm_mmu_page *page;

	struct kvm_mmu_page *page;

	struct kvm_mmu_page *child;

	struct hlist_node *node, *n;

	struct hlist_node *node, *n;

	struct hlist_head *bucket;

	struct hlist_head *bucket;

	unsigned index;

	unsigned index;

	u64 *spte;

	u64 *spte;

	u64 pte;

	unsigned offset = offset_in_page(gpa);

	unsigned offset = offset_in_page(gpa);

	unsigned pte_size;

	unsigned pte_size;

	unsigned page_offset;

	unsigned page_offset;

	unsigned misaligned;

	unsigned misaligned;

	int level;

	int level;

	int flooded = 0;

	int flooded = 0;

	int npte;





	pgprintk("%s: gpa %llx bytes %d\n", __FUNCTION__, gpa, bytes);

	pgprintk("%s: gpa %llx bytes %d\n", __FUNCTION__, gpa, bytes);

	if (gfn == vcpu->last_pt_write_gfn) {

	if (gfn == vcpu->last_pt_write_gfn) {
@@ -1144,22 +1162,26 @@ void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes) 
		}

		}

		page_offset = offset;

		page_offset = offset;

		level = page->role.level;

		level = page->role.level;

		npte = 1;

		if (page->role.glevels == PT32_ROOT_LEVEL) {

		if (page->role.glevels == PT32_ROOT_LEVEL) {

			page_offset <<= 1;	/* 32->64 */

			page_offset <<= 1;	/* 32->64 */

			/*

			 * A 32-bit pde maps 4MB while the shadow pdes map

			 * only 2MB.  So we need to double the offset again

			 * and zap two pdes instead of one.

			 */

			if (level == PT32_ROOT_LEVEL) {

				page_offset <<= 1;

				npte = 2;

			}

			page_offset &= ~PAGE_MASK;

			page_offset &= ~PAGE_MASK;

		}

		}

		spte = __va(page->page_hpa);

		spte = __va(page->page_hpa);

		spte += page_offset / sizeof(*spte);

		spte += page_offset / sizeof(*spte);

		pte = *spte;

		while (npte--) {

		if (is_present_pte(pte)) {

			mmu_pre_write_zap_pte(vcpu, page, spte);

			if (level == PT_PAGE_TABLE_LEVEL)

			++spte;

				rmap_remove(vcpu, spte);

			else {

				child = page_header(pte & PT64_BASE_ADDR_MASK);

				mmu_page_remove_parent_pte(vcpu, child, spte);

			}

		}

		}

		*spte = 0;

	}

	}

}

}

drivers/kvm/vmx.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -371,10 +371,10 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata) 
		data = vmcs_read32(GUEST_SYSENTER_CS);

		data = vmcs_read32(GUEST_SYSENTER_CS);

		break;

		break;

	case MSR_IA32_SYSENTER_EIP:

	case MSR_IA32_SYSENTER_EIP:

		data = vmcs_read32(GUEST_SYSENTER_EIP);

		data = vmcs_readl(GUEST_SYSENTER_EIP);

		break;

		break;

	case MSR_IA32_SYSENTER_ESP:

	case MSR_IA32_SYSENTER_ESP:

		data = vmcs_read32(GUEST_SYSENTER_ESP);

		data = vmcs_readl(GUEST_SYSENTER_ESP);

		break;

		break;

	default:

	default:

		msr = find_msr_entry(vcpu, msr_index);

		msr = find_msr_entry(vcpu, msr_index);
@@ -412,10 +412,10 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data) 
		vmcs_write32(GUEST_SYSENTER_CS, data);

		vmcs_write32(GUEST_SYSENTER_CS, data);

		break;

		break;

	case MSR_IA32_SYSENTER_EIP:

	case MSR_IA32_SYSENTER_EIP:

		vmcs_write32(GUEST_SYSENTER_EIP, data);

		vmcs_writel(GUEST_SYSENTER_EIP, data);

		break;

		break;

	case MSR_IA32_SYSENTER_ESP:

	case MSR_IA32_SYSENTER_ESP:

		vmcs_write32(GUEST_SYSENTER_ESP, data);

		vmcs_writel(GUEST_SYSENTER_ESP, data);

		break;

		break;

	case MSR_IA32_TIME_STAMP_COUNTER:

	case MSR_IA32_TIME_STAMP_COUNTER:

		guest_write_tsc(data);

		guest_write_tsc(data);