1. 15 2月, 2017 1 次提交
  2. 12 1月, 2017 1 次提交
  3. 09 1月, 2017 7 次提交
  4. 26 12月, 2016 1 次提交
    • T
      ktime: Cleanup ktime_set() usage · 8b0e1953
      Thomas Gleixner 提交于
      ktime_set(S,N) was required for the timespec storage type and is still
      useful for situations where a Seconds and Nanoseconds part of a time value
      needs to be converted. For anything where the Seconds argument is 0, this
      is pointless and can be replaced with a simple assignment.
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      Cc: Peter Zijlstra <peterz@infradead.org>
      8b0e1953
  5. 25 11月, 2016 1 次提交
    • R
      KVM: x86: fix out-of-bounds access in lapic · 444fdad8
      Radim Krčmář 提交于
      Cluster xAPIC delivery incorrectly assumed that dest_id <= 0xff.
      With enabled KVM_X2APIC_API_USE_32BIT_IDS in KVM_CAP_X2APIC_API, a
      userspace can send an interrupt with dest_id that results in
      out-of-bounds access.
      
      Found by syzkaller:
      
        BUG: KASAN: slab-out-of-bounds in kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 at addr ffff88003d9ca750
        Read of size 8 by task syz-executor/22923
        CPU: 0 PID: 22923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
         [...]
        Call Trace:
         [...] __dump_stack lib/dump_stack.c:15
         [...] dump_stack+0xb3/0x118 lib/dump_stack.c:51
         [...] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
         [...] print_address_description mm/kasan/report.c:194
         [...] kasan_report_error mm/kasan/report.c:283
         [...] kasan_report+0x231/0x500 mm/kasan/report.c:303
         [...] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:329
         [...] kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 arch/x86/kvm/lapic.c:824
         [...] kvm_irq_delivery_to_apic+0x132/0x9a0 arch/x86/kvm/irq_comm.c:72
         [...] kvm_set_msi+0x111/0x160 arch/x86/kvm/irq_comm.c:157
         [...] kvm_send_userspace_msi+0x201/0x280 arch/x86/kvm/../../../virt/kvm/irqchip.c:74
         [...] kvm_vm_ioctl+0xba5/0x1670 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3015
         [...] vfs_ioctl fs/ioctl.c:43
         [...] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
         [...] SYSC_ioctl fs/ioctl.c:694
         [...] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
         [...] entry_SYSCALL_64_fastpath+0x1f/0xc2
      Reported-by: NDmitry Vyukov <dvyukov@google.com>
      Cc: stable@vger.kernel.org
      Fixes: e45115b6 ("KVM: x86: use physical LAPIC array for logical x2APIC")
      Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: NRadim Krčmář <rkrcmar@redhat.com>
      444fdad8
  6. 22 11月, 2016 1 次提交
  7. 03 11月, 2016 7 次提交
  8. 19 8月, 2016 1 次提交
  9. 04 8月, 2016 1 次提交
    • W
      KVM: lapic: fix access preemption timer stuff even if kernel_irqchip=off · 91005300
      Wanpeng Li 提交于
      BUG: unable to handle kernel NULL pointer dereference at 000000000000008c
      IP: [<ffffffffc04e0180>] kvm_lapic_hv_timer_in_use+0x10/0x20 [kvm]
      PGD 0
      Oops: 0000 [#1] SMP
      Call Trace:
       kvm_arch_vcpu_load+0x86/0x260 [kvm]
       vcpu_load+0x46/0x60 [kvm]
       kvm_vcpu_ioctl+0x79/0x7c0 [kvm]
       ? __lock_is_held+0x54/0x70
       do_vfs_ioctl+0x96/0x6a0
       ? __fget_light+0x2a/0x90
       SyS_ioctl+0x79/0x90
       do_syscall_64+0x7c/0x1e0
       entry_SYSCALL64_slow_path+0x25/0x25
      RIP  [<ffffffffc04e0180>] kvm_lapic_hv_timer_in_use+0x10/0x20 [kvm]
       RSP <ffff8800db1f3d70>
      CR2: 000000000000008c
      ---[ end trace a55fb79d2b3b4ee8 ]---
      
      This can be reproduced steadily by kernel_irqchip=off.
      
      We should not access preemption timer stuff if lapic is emulated in userspace.
      This patch fix it by avoiding access preemption timer stuff when kernel_irqchip=off.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: Yunhong Jiang <yunhong.jiang@intel.com>
      Signed-off-by: NWanpeng Li <wanpeng.li@hotmail.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      91005300
  10. 14 7月, 2016 10 次提交
  11. 01 7月, 2016 2 次提交
    • W
      KVM: vmx: fix missed cancellation of TSC deadline timer · 196f20ca
      Wanpeng Li 提交于
      INFO: rcu_sched detected stalls on CPUs/tasks:
       1-...: (11800 GPs behind) idle=45d/140000000000000/0 softirq=0/0 fqs=21663
       (detected by 0, t=65016 jiffies, g=11500, c=11499, q=719)
      Task dump for CPU 1:
      qemu-system-x86 R  running task        0  3529   3525 0x00080808
       ffff8802021791a0 ffff880212895040 0000000000000001 00007f1c2c00db40
       ffff8801dd20fcd3 ffffc90002b98000 ffff8801dd20fc88 ffff8801dd20fcf8
       0000000000000286 ffff8801dd2ac538 ffff8801dd20fcc0 ffffffffc06949c9
      Call Trace:
      ? kvm_write_guest_cached+0xb9/0x160 [kvm]
      ? __delay+0xf/0x20
      ? wait_lapic_expire+0x14a/0x200 [kvm]
      ? kvm_arch_vcpu_ioctl_run+0xcbe/0x1b00 [kvm]
      ? kvm_arch_vcpu_ioctl_run+0xe34/0x1b00 [kvm]
      ? kvm_vcpu_ioctl+0x2d3/0x7c0 [kvm]
      ? __fget+0x5/0x210
      ? do_vfs_ioctl+0x96/0x6a0
      ? __fget_light+0x2a/0x90
      ? SyS_ioctl+0x79/0x90
      ? do_syscall_64+0x7c/0x1e0
      ? entry_SYSCALL64_slow_path+0x25/0x25
      
      This can be reproduced readily by running a full dynticks guest(since hrtimer
      in guest is heavily used) w/ lapic_timer_advance disabled.
      
      If fail to program hardware preemption timer, we will fallback to hrtimer based
      method, however, a previous programmed preemption timer miss to cancel in this
      scenario which results in one hardware preemption timer and one hrtimer emulated
      tsc deadline timer run simultaneously. So sometimes the target guest deadline
      tsc is earlier than guest tsc, which leads to the computation in vmx_set_hv_timer
      can underflow and cause delta_tsc to be set a huge value, then host soft lockup
      as above.
      
      This patch fix it by cancelling the previous programmed preemption timer if there
      is once we failed to program the new preemption timer and fallback to hrtimer
      based method.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: Yunhong Jiang <yunhong.jiang@intel.com>
      Signed-off-by: NWanpeng Li <wanpeng.li@hotmail.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      196f20ca
    • W
      KVM: x86: introduce cancel_hv_tscdeadline · bd97ad0e
      Wanpeng Li 提交于
      Introduce cancel_hv_tscdeadline() to encapsulate preemption
      timer cancel stuff.
      
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Radim Krčmář <rkrcmar@redhat.com>
      Cc: Yunhong Jiang <yunhong.jiang@intel.com>
      Signed-off-by: NWanpeng Li <wanpeng.li@hotmail.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      bd97ad0e
  12. 27 6月, 2016 1 次提交
  13. 16 6月, 2016 2 次提交
    • Y
      KVM: x86: support using the vmx preemption timer for tsc deadline timer · ce7a058a
      Yunhong Jiang 提交于
      The VMX preemption timer can be used to virtualize the TSC deadline timer.
      The VMX preemption timer is armed when the vCPU is running, and a VMExit
      will happen if the virtual TSC deadline timer expires.
      
      When the vCPU thread is blocked because of HLT, KVM will switch to use
      an hrtimer, and then go back to the VMX preemption timer when the vCPU
      thread is unblocked.
      
      This solution avoids the complex OS's hrtimer system, and the host
      timer interrupt handling cost, replacing them with a little math
      (for guest->host TSC and host TSC->preemption timer conversion)
      and a cheaper VMexit.  This benefits latency for isolated pCPUs.
      
      [A word about performance... Yunhong reported a 30% reduction in average
       latency from cyclictest.  I made a similar test with tscdeadline_latency
       from kvm-unit-tests, and measured
      
       - ~20 clock cycles loss (out of ~3200, so less than 1% but still
         statistically significant) in the worst case where the test halts
         just after programming the TSC deadline timer
      
       - ~800 clock cycles gain (25% reduction in latency) in the best case
         where the test busy waits.
      
       I removed the VMX bits from Yunhong's patch, to concentrate them in the
       next patch - Paolo]
      Signed-off-by: NYunhong Jiang <yunhong.jiang@intel.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      ce7a058a
    • Y
      kvm: lapic: separate start_sw_tscdeadline from start_apic_timer · 53f9eedf
      Yunhong Jiang 提交于
      The function to start the tsc deadline timer virtualization will be used
      also by the pre_block hook when we use the preemption timer; change it
      to a separate function. No logic changes.
      Signed-off-by: NYunhong Jiang <yunhong.jiang@intel.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      53f9eedf
  14. 19 5月, 2016 4 次提交