mirror of
https://github.com/torvalds/linux.git
synced 2026-10-15 20:30:02 +02:00
master
12036 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Amirmohammad Eftekhar
|
c8f4cfe1cf |
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KVM_SET_NESTED_STATE. Failure to unwind the MMU pointer results in KVM trying to run L1 with a nested MMU, and is especially problematic if the vCPU manages to free its nested state before the VM crashes. Constructing the root for a nested EPT MMU goes through vmcs12, which is dynamically allocated/freed when nVMX is enabled/disabled. And so if the nested state is freed with the MMU still pointing at the nested MMU, KVM will hit a NULL pointer deref when attempting to get L1=>L2 EPTP. BUG: kernel NULL pointer dereference, address: 0000000000000078 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel] Call Trace: <TASK> kvm_mmu_load+0xcd/0x870 [kvm] kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm] kvm_vcpu_ioctl+0x2c7/0x970 [kvm] __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x9c/0x4d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47491b </TASK> Modules linked in: kvm_intel kvm irqbypass CR2: 0000000000000078 ---[ end trace 0000000000000000 ]--- RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel] Cc: David Woodhouse <dwmw2@infradead.org> Fixes: |
||
|
Paolo Bonzini
|
e90ab36691 |
KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS is set, including whether it can be set when SupervisorShadowStackEn (bit 6) is not set in the MISC_CTL field of the VMCB. Nevertheless, the unexpected SS bit causes out of bounds accesses in permission_fault(), seen as either WARNs or UBSAN reports: kernel: UBSAN: array-index-out-of-bounds in arch/x86/kvm/mmu.h:225:27 kernel: index 34 is out of range for type 'u16 [16]' (in this case, the page fault error code is 34*2=0x44, i.e. SS|U; the report shows SS|U|W happening as well). Fix the handling of unknown error codes by dropping SS and (with a WARN) any bits not among those that permission_fault() expects to receive. At the same time, given the uncertainty about when hardware sets SS, follow the processor's behavior when constructing the fault's error code, and preserve the SS bit as passed to FNAME(walk_addr_generic). While the behavior is surprising, there's a possibility that Hyper-V expects it (Hyper-V does not even enable CET unless it finds MBEC/GMET!), so retain the information when reflecting the fault to L1 instead of unconditionally discarding it. Bisection shows that this started happening with commit |
||
|
Jinu Kim
|
b3e6212dea |
KVM: x86: Use active memslots for the per-vCPU MMIO cache
KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm_memslots(), which unconditionally selects address space 0, even when the vCPU is running in SMM and using address space 1. Commit |
||
|
Jann Horn
|
97818b2fa7 |
KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
set_page_dirty() requires that the caller holds some kind of lock to
ensure that the page's mapping does not concurrently go away.
That is not the case for a random page we got from get_user_pages_fast(),
so use set_page_dirty_lock().
Fixes:
|
||
|
Naveen N Rao (AMD)
|
88c15bbd43 |
KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails
If vCPU creation fails after kvm_arch_vcpu_create(), the AVIC Physical ID table entry corresponding to that vCPU continues to point to the freed APIC backing page which can result in UAF. Address this by clearing out the corresponding AVIC Physical ID table entry in the vcpu_free() callback, similar to the VMX commit |
||
|
Sean Christopherson
|
12e0d427c3 |
KVM: SVM: Use "is AVIC-addressable" helper to sanity check load()/put()
Use avic_is_addressable_vcpu() instead of open coding a check on the bounds of the allocated table for the sanity checks when loading/putting AVIC state for a vCPU. If KVM botches the allocation, then KVM will already have performed an OOB write in avic_init_backing_page(), i.e. being super paranoid in load()/put() doesn't provide meaningful protection in practice. Cc: Naveen N Rao (AMD) <naveen@kernel.org> Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org> Link: https://patch.msgid.link/20260923155108.1550622-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Sean Christopherson
|
86a24feec1 |
KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable
Add a helper to check if a vCPU is addressable by AVIC hardware, i.e. has an APIC ID that fits in the physical ID table, and use the more paranoid helper when determining if a vCPU is compatible with AVIC when initializing the vCPU. KVM is supposed to reject vCPU creation if the vCPU's ID is greater than or equal to max_vcpu_ids, i.e. simply checking the architectural maximum *should* suffice. But piecing together why this is safe is unnecessarily difficult, and there is no meaningful downside to being extra cautious. Suggested-by: Naveen N Rao (AMD) <naveen@kernel.org> Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org> Link: https://patch.msgid.link/20260923155108.1550622-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Sean Christopherson
|
973ea70393 |
KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
Explicitly flush caches after intra-host migration before clearing "SEV
active" on the source VM, as doing cache maintenance afterwards creates a
tiny window where memory reclaim could return memory to the host without
performing a cache flush, e.g. as pointed out by Sashiko:
CPU1 in sev_migrate_from():
src->active = false;
CPU2 running concurrent unmap:
Since active is false, the automatic cache flush in
sev_guest_memory_reclaimed is skipped.
The host frees and reallocates the page.
CPU1 in sev_migrate_from():
sev_writeback_caches(src_kvm);
Executes a hardware cache flush (wbnoinvd), which writes the guest's old
dirty ciphertext over the new page owner's data.
Fixes:
|
||
|
Sean Christopherson
|
8abbc76120 |
KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
Nullify have_run_cpus when freeing the mask, particularly in the error path
of __sev_guest_init(), so that KVM doesn't have to subtly use sev->active
to track whether or not the mask has been freed. As pointed out by Sashiko,
blindly freeing the mask in sev_vm_destroy() results in a double-free if
the mask is freed if __sev_guest_init() fails.
Throw the logic in a helper as nullifying the pointer is frustratingly
difficult and weird due to have_run_cpus being a single-entry array when
CPUMASK_OFFSTACK=n. Deliberately don't use CPUMASK_VAR_NULL, as it's not
directly assignable when the cpumask is on-stack, e.g. requires using a
local variable and a memcpy(), which is beyond ridiculous. Furthermore,
while clearing the on-stack bitmask is an unnecessary and arguably unwanted
side effect, KVM absolutely relies on '0' being the "null" value given that
the struct is zero-allocated.
Opportunistically add an alloc() helper to pair with free(); there are just
enough call sites to make doing so worthwhile.
Fixes:
|
||
|
Sean Christopherson
|
2abb25273c |
KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the
runtime eVMCS controls (pin, primary, secondary, etc.) are being updated.
If L1 isn't intercepting TPR writes, runs L2 with TPR virtualization, and
then runs the same L2 with TPR virtualization disabled, KVM will fail to
refresh msr_bitmap02 and leave TPR in passthrough mode even though TPR
virtualization is disabled. I.e. failure to refresh the bitmap lets L2 (or
L1 by proxy) read and write L0's TPR.
Fixes:
|
||
|
Sean Christopherson
|
9e06bbb9ad |
KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
Use the MSR permission bitmap of the active VMCB instead of assuming that
KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02
if and only if L1 wants to intercept MSR accesses, i.e. if and only if KVM
needs to merge msprm01 with msrpm12.
Don't bother tracking the virtual address of the bitmap that's being used,
as __va() is cheap on x86, and caching the virtual address would introduce
yet another source of potentially stale information.
Fixes:
|
||
|
Sean Christopherson
|
73392706d0 |
KVM: SVM: Sync guest's PERF_CNTR_GLOBAL_CTL from h/w only on successful VMRUN
Don't (re)read PERF_CNTR_GLOBAL_CTL from hardware on a failed VMRUN, as the purpose of the read is to synchronize KVM's cache with any writes done by the guest, and the guest can't possibly have modified the MSR if it never got a chance to run. Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260904170642.3291466-5-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|
Sean Christopherson
|
64c5b15af7 |
KVM: SVM: Don't mark ASID fields as dirty when setting control.tlb_ctl
Don't mark the ASID as dirty in the VMCB when requesting a TLB flush via
control.tlb_ctl. Per "15.15.3 VMCB Clean Field" of the July 2026, Revision
3.45 version of the APM:
The following are explicitly not cached and not represented by Clean bits:
* TLB_Control
Fixes:
|
||
|
Sean Christopherson
|
e27fc915c8 |
KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior in the presence of VMRUN failures. So the best thing to do would be to assume that if VMRUN fails, the actions requested in the control fields may not have been performed. Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260904170642.3291466-3-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|
Sean Christopherson
|
60d93c2785 |
KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN,
as empirical testing shows that the CPU performs the requested TLB flush if
and only if VMRUN is successful, i.e. clearing TLB control on a failed
VMRUN effectively drops a TLB flush.
Explicitly track the need to flush all ASIDs on a per-CPU basis, as the
ASID reuse condition is tied to the pCPU, not to the vCPU. As a bonus,
this also obviates the need to avoid clobbering FLUSH_ALL_ASID with
TLB_CONTROL_FLUSH_ASID, e.g. in svm_flush_tlb_asid().
Deliberately don't bother saving/restoring the "old" tlb_ctl on failure,
in quotes because it's not exactly the old tlb_ctl, it's the tlb_ctl from
after pre_svm_run(), but before updating tlb_ctl for flush_all_asids. If
VMRUN fails and TLB_CONTROL_FLUSH_ALL_ASID is forced, then the next
successful run of the VMCB *may* unnecessarily flush all ASIDs, which
strictly speaking could result in noisy neighbor issues. However, the
fact that new_asid() is already guest-triggerable, because of KVM's flawed
behavior of clearing the ASID on emulated INIT, means that a guest can
already trigger a flush of all ASIDs at roughly the same rate. And once
KVM stops clobbering the ASID on emulated INIT, *or* assigns a static ASID
to each vCPU, this flaw goes away.
Fixes:
|
||
|
Sean Christopherson
|
b6249c1d56 |
KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
When walking shadow page tables, immediately terminate the walk if the root
is a "dummy" root, i.e. a root whose top-level page table is backed by the
zero page, but otherwise doesn't exist. If memslot creation races with a
stage-2 page fault (EPT violation or #NPF) from L2, then if the stars align,
KVM will attempt to walk shadow page tables using the zero page and hit a
NULL pointer deref.
BUG: kernel NULL pointer dereference, address: 0000000000000021
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP
CPU: 30 UID: 1000 PID: 941 Comm: qemu Not tainted 7.2.0-rc2-1b731e5ded48-next-vm #1741 PREEMPTLAZY
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:__kvm_mmu_invalidate_addr+0xea/0x210 [kvm]
Call Trace:
<TASK>
kvm_mmu_invalidate_addr+0x92/0xe0 [kvm]
__kvm_inject_emulated_page_fault+0x67/0x80 [kvm]
ept_page_fault+0x160/0x850 [kvm]
kvm_mmu_do_page_fault+0x102/0x1f0 [kvm]
kvm_mmu_page_fault+0x8e/0x6b0 [kvm]
vmx_handle_exit+0x163/0x640 [kvm_intel]
kvm_arch_vcpu_ioctl_run+0x960/0x2120 [kvm]
kvm_vcpu_ioctl+0x2c7/0x970 [kvm]
__x64_sys_ioctl+0x90/0xd0
do_syscall_64+0x67/0x5f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f606d0b53bb
Opportunistically harden the shadow walks against fully invalid roots, but
WARN, as all callers are expected/required to pre-check for a valid root.
Don't WARN in the dummy root case as the whole point of using a dummy root
is to provide a root that's valid enough to enter the guest, i.e. it should
Just Work for all flows except those that *need* to know about dummy roots.
Alternatively, KVM could allocate a dedicated page and associated shadow
page structure for the dummy root, which is very tempting as it such an
approach should be more resilient against unexpected behavior. But that
would be a much larger and thus riskier change than simply terminating
walks of dummy roots.
Fixes:
|
||
|
Sean Christopherson
|
8264c0d73f |
KVM: Reject attempts to lock all vCPUs if vCPU creation is in-progress
Reject locking of all vCPUs if vCPU creation is in-progress, i.e. if the number of "created" vCPUs doesn't match the number of "onlined" vCPUs. It's simply not possible to guarantee that KVM has truly locked all vCPUs if one or more vCPUs are actively being created. Holding kvm->lock does prevent in-flight vCPUs from being fully onlined, but it's infeasible for common KVM to know whether or not that provides sufficient protection. In practice, this is likely a minor bug fix for the ARM and RISC-V usage of kvm_trylock_all_vcpus(), and a glorified nop for everything else. E.g. ARM's kvm_timer_vcpu_init() can race kvm_vm_ioctl_set_counter_offset() with respect to observing KVM_ARCH_FLAG_VM_COUNTER_OFFSET. Opportunistically drop x86's existing manual checks on vCPU creation being in-progress as all of x86's checks immediately precede or follow locking of all vCPUs. Leave arm64 and RISC-V alone for the moment, as their checks aren't as obviously redundant/equivalent. Signed-off-by: Sean Christopherson <seanjc@google.com> Tested-by: Jean-Christophe Guillain <jean-christophe@guillain.net> Tested-by: Naveen N Rao (AMD) <naveen@kernel.org> Message-ID: <20260921174445.911676-2-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|
Paolo Bonzini
|
c2f24f140c |
KVM fixes for 7.3-rcN
- Fix a brown paper bag bug where KVM would incorrectly treat Intel PMU MSRs
as valid on AMD.
- Fix a regression in the hardware disable selftest where it checked the wrong
macro when detecting glibc support (breaks at least musl).
- Never clear KVM_REQ_VM_DEAD so that dead VMs stay dead, which is especially
important for KVM_BUG_ON() flows, which often guard more dangerous bugs.
- Re-pend GET_NESTED_STATE_PAGES if getting the pages fails, to fix a bug
where KVM would let userspace run a broken setup with stale vmcs12 pages.
- Fix a class of bugs where KVM would fail to fill kvm_run exit fields if
getting nested pages failed.
- Treat reserved entries in the memory attributes xarray as "no attributes",
to fix false positives when checking for mixed attributes.
- Fix memcg accounting for the memory attributes xarray (the xarray library
subtly requires the xarray to be configured for accounting upfront; the gfp
flags taken at runtime are used only rarely).
- Don't pre-reserve xarray entries when storing empty attributes, as storing
NULL must not require memory allocation (KVM and other subsystems heavily
rely on this behavior).
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmq3A78ACgkQOlYIJqCj
N/1uVA//TVDznH49htPNV4dh7vfiE8oF9ka4e9KTPA2eMdDeNVInNXBz0ZbJCdNN
Hm7iZZfk8yx0JCCGXdp8EoYg66iwulBr0KZXRP2U2LoyiRELA1VtGGOLUVP3PXjF
hElXD56+RrkJJSucINlFU7kSfl2hY/Jbaq87HVBLpXp8iY3stBbLdgMT1ReLdorO
s9i2uJRqHKjtSG330qDYEG1TtRAdUehgRbxbbJVuOEYtU37tCvX6ai8dEjZAvxYo
1VZOD05ITo12HUXPiZjIMoNTujQnZKmGYlBYczWlfOmkY/tN6SV8M41srV3ZcK0k
XGOQM6tOzbVTWaSH/pW1krklnOFAbnL6QzHzb3enHZfUN8AikHPDyfsJWzt/s0f/
ATTQk03OYL4fJMQSQ778EI6S4PcOzY9HiBxDXM5ySpUv1uyXw8ZFsQSdH/TYTMhi
Dce42r5rlGa1vAKHwI1Xya2su3REhWzxYxGpUOg/PtRRqWvL2RMrHArzEd6zu+Ti
jPinuQuXYcT1FTCa5S39NWhU4gWpjw8Pvs9VuUYSCDYxZCaqQ2YheYgsAcgPqgfE
hS43XVmmOB/tXGsvu+/YuEfbzNV/mHOuJBcjBnnsBP3d6EFB02FPKg4/LYiXujYo
OocUbSB7bKd87W3B+Ys3QmgOtZh4qX/aLYusa2vQ4Dp9ujXqcWs=
=LG0B
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-fixes-7.3-rc5' of https://github.com/kvm-x86/linux into HEAD
KVM fixes for 7.3-rcN
- Fix a brown paper bag bug where KVM would incorrectly treat Intel PMU MSRs
as valid on AMD.
- Fix a regression in the hardware disable selftest where it checked the wrong
macro when detecting glibc support (breaks at least musl).
- Never clear KVM_REQ_VM_DEAD so that dead VMs stay dead, which is especially
important for KVM_BUG_ON() flows, which often guard more dangerous bugs.
- Re-pend GET_NESTED_STATE_PAGES if getting the pages fails, to fix a bug
where KVM would let userspace run a broken setup with stale vmcs12 pages.
- Fix a class of bugs where KVM would fail to fill kvm_run exit fields if
getting nested pages failed.
- Treat reserved entries in the memory attributes xarray as "no attributes",
to fix false positives when checking for mixed attributes.
- Fix memcg accounting for the memory attributes xarray (the xarray library
subtly requires the xarray to be configured for accounting upfront; the gfp
flags taken at runtime are used only rarely).
- Don't pre-reserve xarray entries when storing empty attributes, as storing
NULL must not require memory allocation (KVM and other subsystems heavily
rely on this behavior).
|
||
|
Sean Christopherson
|
93de2a6a4b |
KVM: SEV: Do cache maintenance on the source VM during intra-host migration
Manually perform cache maintenance on the source VM during intra-host
migration to ensure no stale data is left in CPU caches after the VM is
destroyed. Because the source VM is "converted" to a non-SEV VM, KVM's
memory reclaim flows won't trigger cache maintenance, e.g. when all guest
memory is reclaimed in response to detaching from the mmu_notifier.
Note, relying on the destination VM to do cache maintenance isn't an option
as KVM doesn't require identical guest memory configurations, i.e. the
source VM may have access to memory that the destination VM does not.
Enforcing equivalent memory configurations is infeasible, as it would
require a *deep* comparison of memslots, e.g. to verify that not only are
the memslot identical, but what the memslots point at is also identical.
Fixes:
|
||
|
Sean Christopherson
|
12c1f6e03f |
KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path,
i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV
VM if its state is intra-host migrated. Alternatively, the mask could be
freed in sev_migrate_from() when "converting" the source VM, but that gets
annoying because ideally KVM would nullify the mask to guard against UAF,
and nullifying the mask would need be conditioned on CPUMASK_OFFSTACK=y.
Freeing the mask during sev_migrate_from() is also not robust against other
KVM bugs, though that's kind of a moot point since any such bugs would show
up even if sev->active is never set. I.e. KVM must get that side of things
correct. But, that's not a great reason to add more code just to make
things marginally less robust.
Fixes:
|
||
|
Sean Christopherson
|
c1214f293d |
KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths
Fill kvm_run with "internal error, emulation" in the common error handling paths for getting nested state pages, as requiring each check to manually fill kvm_run is error prone and requires a non-trivial amount of copy+paste. Specifically, both SVM and VMX fail to fill kvm_run if load_pdptrs() fails, and SVM fails to fill kvm_run if kvm_hv_verify_vp_assist() fails. If those flows fail, the *best* case scenario is that KVM will exit to userspace with KVM_EXIT_UNKNOWN. The worst case scenario is that KVM exits with a stale exit_reason and confuses userspace. Note, SVM never exits to userspace if something goes sideways when dealing with vmcb12 assets while emulating VMRUN, i.e. lack of SVM-specific code is not a bug. Fixes: |
||
|
Sean Christopherson
|
10180a2775 |
KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the nested pages fails in the KVM_RUN path. If userspace re-runs the vCPU, and vmcs02 holds valid PFNs from the *previous* run of L2, then KVM could re-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page. Note, both SVM and VMX (as of commit |
||
|
Sean Christopherson
|
8cd280282d |
KVM: Never clear KVM_REQ_VM_DEAD from a vCPU's requests
Use kvm_test_request() instead of kvm_check_request() when querying KVM_REQ_VM_DEAD, i.e. don't clear KVM_REQ_VM_DEAD, as the entire purpose of KVM_REQ_VM_DEAD is to prevent the vCPU from enterring the guest ever again, even if userspace insists on redoing KVM_RUN. Ensuring KVM_REQ_VM_DEAD is never cleared will allow relaxing KVM's rule that ioctls can't be invoked on dead VMs, to only disallow ioctls if the VM is bugged, i.e. if KVM hit a KVM_BUG_ON(). Opportunistically add compile-time assertions to guard against clearing KVM_REQ_VM_DEAD through the standard APIs. Reviewed-by: Kai Huang <kai.huang@intel.com> Acked-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260806214618.82180-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Jim Mattson
|
79a71cc256 |
KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
Commit |
||
|
Linus Torvalds
|
7bb6284aa7 |
Arm:
* Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
* Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
* Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
* Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
* Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
* Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
* Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
LoongArch:
* Advertise already-supported capabilities.
* Some bug fixes about timer and MMIO.
* Some hardening about interrupt injection.
* Replace kvm_err() with kvm_pr_unimpl().
* Add FPU/LSX/LASX test cases for selftests.
RISC-V:
* Svadu/Zicfiss/Zicfilp FWFT support for Guest
* Use try_cmpxchg for IMSIC MRIF RMW
* More arch-specific tracepoints in KVM RISC-V
* Eager page splitting when enabling dirty logging
* Optimize hfence request handling for SMP Guests
* Improve dirty log clearing by skipping zero bits in mask
* Guard HFENCE range loops against overflow
* CPU PM notifiers in KVM RISC-V for non-retentive idle states
* Fix kernel-mode vector context save/restore for Guest
s390:
* Fixes for vfio-ap
* Fixes for the gmap rework
* Fixes for vsie
* AI triggered fixes all over
* diag9c tracing
* code move preparation for the additional arm64 support
* enable CONTEXT_ANALYSIS
x86:
* Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c
(the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving
relevant code out of x86.c.
* Split kvm_mmu in three parts, respectively to describe the format of page
tables, walking the guest page tables and building the page tables. Always
use the same page table walker kvm->arch.gva_walk as the entry point to
convert a guest's virtual address, where the previous code used two
different kvm_mmu structs depending on whether the walk included nested
EPT/NPT or not. Make page fault vmexits reuse the permission checking
machinery that is used for guest page faults. This is both a cleanup
and a baby step towards supporting XS/XU memory permissions.
* Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
* Remove a defunct masterclock update from kvm_xen_shared_info_init(). It
could result in incorrect kvmclock due to triggering an unnecessary
switch to/from masterclock mode.
* Skip Xen runstate time updates if time has effectively gone backwards, so
that the guest doesn't report 100% steal time for a very, very long time.
* Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
updating the wrong sub-leaf, and upstream KVM will soon provide all the
information needed by userspace to populate the CPUID field itself.
* Fix a bug where KVM would walk a newly created rmap without holding the rmap
lock (or mmu_lock) during aging.
* Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
* Fix a variety of #DB priority bugs.
* Fix a class of races related to enabling Hyper-V emulation on a vCPU after
the vCPU is visible to the rest of KVM.
* Use static calls for nested virtualization ops.
* Move more KVM-internal code out of x86's kvm_host.h.
* Enumerate support for a variety of Zhaoxin instructions that don't require
explicit virtualization.
* Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
* Harden kvm_vcpu_map() against double-mapping and thus leaking references.
* Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
x86 (Intel):
* Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed, to fix a use-after-free where hardware
will write to a freed vCPU's PID.
* Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
* Cap the maximum value shoved into the VMX Preemption Timer to workaround an
erratum that affects all existing Intel CPUs that support CPUID 0x15.
* Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
* Harden the TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion.
x86 (AMD):
* Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
Change request.
* Remove a dying VM from the GA Log notifier list before the VM is actually
destroyed, to fix a potential use-after-free.
* While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays
FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact,
get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM.
So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins.
(This was reviewed by mm maintainers; for more information, see commit
|
||
|
Linus Torvalds
|
ed3b875bea |
mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
Total patches: 501
Reviews/patch: 1.66
Reviewed rate: 70%
Excluding DAMON:
Total patches: 356
Reviews/patch: 2.26
Reviewed rate: 90%
Excluding DAMON and selftests:
Total patches: 329
Reviews/patch: 2.31
Reviewed rate: 92%
Excluding DAMON, selftests and maple_tree:
Total patches: 328
Reviews/patch: 2.31
Reviewed rate: 92%
Summary of patch series in this merge:
- The 2 patch series "mm: drop "sub" prefix from various places" from
Dev Jain implements some page->folio conversion and a naming cleanup.
- The 2 patch series "mm/kasan: remove redundant initialization for
kasan_flag_write_only" from Igor Putko provides some KASAN cleanup work.
- The 2 patch series "mm/filemap: reduce unnecessary xarray lookups"
from Chi Zhiling provides a small speedup in the pagecaache read code.
- The 4 patch series "mm/percpu: Fix possible NOFS/NOIO reclaim
recursion" from Kaitao Cheng improves a few things in the vmalloc code -
mainly the avoidance of GFP_KERNEL allocations when the caller asked for
GFP_NOFS or GFP_NOIO.
- The 3 patch series "mm/kmemleak: avoid soft lockup when scanning task
stacks" from Breno Leitao avoids a soft lockup watchdog trigger from the
kmemleak scanning code in extreme situations.
- The 6 patch series "mm/page_owner: misc cleanups" from Ye Liu is a
collection of unrelated cleanups to the page_owner code. For some
reason lots of people have been working on the page_owner code this
cycle.
- The 4 patch series "mm: convert to walk_page_range_vma() to eliminate
find_vma()" from Kefeng Wang simplifies and accelerates the page walking
library function.
- The 3 patch series "mm/migrate: preparatory cleanups for batch copy
and offload" from Shivank Garg implements cleanups in the migration
code.
- The 4 patch series "mm/page_owner: add per-fd filter infrastructure
for print_mode and NUMA filtering" from Zhen Ni provides per-fd
filtering to page_owner in order to reduce the sometimes vast amount of
output it can produce.
- The 19 patch series "mm: Refactor bootmem gigantic hugepage
allocation" from Muchun Song is a "set of fixes and preparatory cleanups
around bootmem HugeTLB handling, sparse initialization ordering, and
related vmemmap setup".
- The 4 patch series "mm/zsmalloc: reduce lock contention in zs_free()"
from Wenchao Hao reduces lock contention in zs_free(), which dominates
the unmap path under memory pressure on Android (LMK kills) and on x86
servers running zswap-heavy workloads. Up to 1.83x improvement in
microbenchmarking.
- The 2 patch series "move alloc_tag.c file under mm/" from Suren
Baghdasaryan does that.
- The 6 patch series "samples/damon: handle damon_{start,stop}()
failures" from SJ Park fixes improper handling of damon_start(),
damon_stop(), and damon_call() failures across DAMON sample modules to
prevent potential memory leaks, operation disruptions and use-after-free
bugs.
- The 11 patch series "mm/damon/sysfs: kobject_del() directories that
users can create/remove" from SJ Park resolves an issue where delayed
sysfs directory removal under CONFIG_DEBUG_KOBJECT_RELEASE causes
creation failures due to duplicate directory names by adding missing
kobject_del() calls before creating new directories.
- The 3 patch series "mm: cleanup clear_not_present_full_ptes()" from
David Hildenbrand cleans up the core pte handling code.
- The 3 patch series "selftests/damon: misc fixes for test bugs" from
Kunwu Chan fixes several bugs in the DAMON selftests.
- The 2 patch series "selftests/damon: fix memcg_path staging handling"
from Cheng Nie fixes a bug in _damon_sysfs.py for damos_filter
memcg_path setup, and adds a test case for it in sysfs.py.
- The 2 patch series "selftests/damon: test kdamond refresh_ms" from
Ruslan Valiyev introduces selftest coverage for DAMON's refresh_ms sysfs
feature by updating the test control module and verifying that scheme
stats update automatically without manual intervention.
- The 5 patch series "mm/damon: five misc fixups" from Akinobu Mita
contains miscellaneous DAMON fixups.
- The 2 patch series "mm/damon/core: detect internal variation above
max_nr_regions/2" from Jiayuan Chen fixes DAMON's region splitting
behavior when region counts exceed half the maximum budget by
dynamically scaling down the split fraction as the limit approaches,
preventing large regions from staying un-split, and adds corresponding
KUnit test coverage.
- The 6 patch series "mm: preparatory patches for PMD level swap
entries" from Usama Arif refactors and cleans up PMD softleaf helpers,
call sites, and architecture flags to lay the groundwork for a follow-up
series that introduces PMD page table swap entries.
- The 11 patch series "mm/damon: update, optimize, and clean up doc,
tests, and code" from SJ Park updates DAMON design and ABI
documentation, expands unit and selftest coverage, optimizes
damon_commit_target_regions(), and cleans up recently added sysfs
interface code for better readability.
- The 2 patch series "mm/vmpressure: reduce CPU, memory and code
overhead on cgroup v2" from Usama Arif optimizes vmpressure() by
skipping unnecessary work on cgroup v2 for userspace event notifications
and refactors v1-only eventfd handling into mm/memcontrol-v1.c to reduce
memory overhead and code complexity.
- The 10 patch series "selftests/mm: refactor pkey helpers and fix mmap
error handling" from Hongfu Li refactors pkeys shared tracing and
assertion helpers into a common file, unifies protection key selftests
to use consistent diagnostic logging and assertions, and enforces
standardized MAP_FAILED return checks for mmap() calls across the tests.
- The 18 patch series "mm/damon: optimize out nr_accesses_bp" from SJ
Park replaces the error-prone, continuously updated nr_accesses_bp field
in damon_region with an on-demand moving sum function
(damon_nr_accesses_mvsum()), reducing structure memory overhead and
avoiding state corruption bugs.
- The 6 patch series "Open HugeTLB allocation routine for more generic
use" from Ackerley Tng decouples HugeTLB folio allocation from VMA
dependencies by introducing hugetlb_alloc_folio(), enabling subsystems
like guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs.
- The 3 patch series "mm/damon: provide pseudo moving sum probe_hits"
from SJ Park integrates DAMON's probe_hits attribute counter into the
pseudo moving sum infrastructure, enabling real-time, online monitoring
without waiting for full aggregation intervals.
- The 18 patch series "mm: Some cleanups for page allocator APIs" from
Brendan Jackman simplifies and refactors the page allocator entry points
and flags by unifying allocation paths, adding internal alloc_flags
arguments, and eliminating redundant __ prefixed alloc_pages variants.
- The 5 patch series "Fix incorrect access of hugetlb pte entries" from
Dev Jain enforces the consistent use of huge_ptep_get() instead of
ptep_get() for HugeTLB entries and fixes an unaligned address issue in
arm64's huge_ptep_get() implementation.
- The 8 patch series "mm/damon: validate all parameters in the core"
from SJ Park consolidates parameter validation into the DAMON core
specifically within damon_start() and damon_commit_ctx() to centralize
error checking, eliminate caller-side redundant checks and to improve
maintenance efficiency.
- The 3 patch series "tools/mm/page_owner_sort: fix filtering and
cleanup issues" from Yichong Chen renames is_need() to filter_record()
for clearer return semantics, fixes per-record allocation memory leaks
and bounds output copies in search_pattern() to address an existing
buffer issue.
- The 4 patch series "memcg: bail out reclaim when memcg is dying" from
Jiayuan Chen mitigates a system-wide stall which occurs when a cgroup is
removed while one of its memory control files is doing synchronous
reclaim.
- The 5 patch series "mm/memory-failure: add panic option for
unrecoverable pages" from Breno Leitao introduces an opt-in
vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics
the kernel on unrecoverable memory errors in kernel-owned pages to
preserve error context and prevent delayed, silent data corruption.
- The 11 patch series "mm/damon: refactor damon_{start,stop,commit}()
for simple error handling" from SJ Park refactors the DAMON core API
functions to guarantee that all contexts are fully stopped when
damon_start(), damon_stop(), or damon_commit() fail, eliminating the
need for complex and error-prone caller-side cleanup code.
- The 5 patch series "Keep tail page private zero at free and folio
split" from Zi Yan adds checks to ensure tail_page->private is zero when
freeing compound or high-order pages and when promoting tail pages
during large folio splits. By validating these fields at free and split
time, it allows the removal of redundant private field clearing inside
prep_compound_tail().
- The 4 patch series "mm: drop redundant lru_add_drain in anon folio
reuse paths" from Barry Song eliminates redundant lru_add_drain() calls
in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead.
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads.
- The 3 patch series "mm: clean up folio LRU and swap declarations" from
Jianyue Wu reorganizes folio LRU and swap code by relocating
page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c,
and moving MM-internal reclaim declarations into mm/internal.h.
- The 15 patch series "userfaultfd: working set tracking for VM guest
memory" from Kiryl Shutsemau adds userfaultfd support for tracking the
working set of VM guest memory, so a VMM can identify hot pages and
reclaim cold ones to tiered or remote storage.
- The 10 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part
2)" from David Hildenbrand removes the remaining pieces of
CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around
freeing of reserved vmemmap pages on the way.
- The 7 patch series "mm/damon: update probe hits for runtime parameter
commits" from SJ Park ensures that DAMON's probe_hits attribute counter
is properly updated when monitoring intervals are changed at runtime,
matching the behavior of nr_accesses. To achieve this, it refactors and
renames existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- The 3 patch series "KSM: performance optimizations for rmap_walk_ksm"
from xu xin resolves a severe KSM reverse-mapping performance bottleneck
where thousands of split VMAs sharing a single anon_vma cause extended
lock contention. By adding an interval-filtering check during the rmap
walk, it reduces worst-case anon_vma lock hold times from over 500ms
down to under 2ms, preventing application freezes and latency spikes
under memory pressure.
- The 3 patch series "mm: split a couple of headers from internal.h"
from Mike Rapoport splits declarations related to mm_init, memblock,
vmalloc and sparse into new headers.
- The 2 patch series "KSM: use linear_page_index in collect_procs_ksm()"
from xu xin applies the interval tree optimization from rmap_walk_ksm()
to collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling. It hoists loop-invariant address
initialization and restricts the anon_vma_interval_tree_foreach walk to
a targeted page offset range, reducing redundant checks and improving
lookup efficiency.
- The 3 patch series "selftests/mm: avoid false failures in hugetlb and
KSM tests" from Sayali Patil fixes issues in the hugetlb and KSM MM
selftest categories that can report failures when the prerequisites for
the tests are not satisfied.
- The 19 patch series "mm/damon: introduce data attributes only
monitoring" from SJ Park introduces attribute-weighted region management
in DAMON, allowing users to prioritize specific data attributes (such as
page sizes or cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely disable
access tracking and adjust monitoring regions based on weighted
probe-hit counters to optimize monitoring quality for attribute-focused
workloads.
- The 8 patch series "mm/hmm: Add mmap lock-drop support for
userfaultfd-backed mappings" from Stanislav Kinsburskii extends
hmm_range_fault() to support userfaultfd-backed regions by allowing the
mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd regions
while preserving backward compatibility for existing callers.
- The 33 patch series "mm: make VMA page offset handling more
consistent" from Lorenzo Stoakes cleans up and standardizes how
vma->vm_pgoff is accessed and manipulated across file-backed and
anonymous mappings in the kernel.
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming
rmap interval tree helpers to better reflect their functionality.
These changes establish a cleaner foundation for future work that will
unify virtual page offset indexing for all anonymous and CoW'd folios.
- The 3 patch series "mm: handle device-private PMDs in walk callbacks"
from Usama Arif addresses kernel panics and state corruption caused by
MM walk callbacks reaching non-present device-private PMD swap entries
created during HMM migrations.
It ensures that functions which acquire pmd_trans_huge_lock() properly
recognize device-private PMDs instead of assuming a present THP or a
standard migration entry.
- The 5 patch series "mm/rmap: Refactor try_to_unmap_one" from Dev Jain
refactors try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree,
and anonymous-swapbacked logic into dedicated functions, laying the
structural groundwork for batched anonymous large folio unmapping.
- The 4 patch series "Docs/ABI/damon: sysfs ABI document fixes and
additions" from Song Hu fixes typos and fills in missing entries in the
DAMON sysfs ABI document.
- The 10 patch series "dax/kmem: atomic whole-device hotplug via sysfs"
from Gregory Price introduces an atomic sysfs state attribute and
supporting DAX/MM infrastructure to prevent userland races when
offlining and removing entire memory regions.
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- The 13 patch series "mm: convert more vm_flags_t users to vma_flags_t"
from Lorenzo Stoakes continues transitioning the kernel from the
deprecated vm_flags_t type to vma_flags_t across core memory management
infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- The 2 patch series "Two small patches to clean up mm/mm_slot.h" from
xu xin refactors mm_slot.h by introducing mm_slot_remove() to unify
duplicate slot deletion sequences in khugepaged and KSM. It also adds
code documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- The 10 patch series "mm/damon/core: hide core-private struct fields"
from SJ Park cleans up DAMON core structures by consistently marking
internal-only fields with private: comment tags to prevent improper
direct access from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- The 6 patch series "mm/damon: unurgent fixes for infinite loop, NULL
de-ref and races" from SJ Park addresses potential infinite loops, NULL
dereferences, and race conditions identified in DAMON.
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- The 2 patch series "mm/page_alloc: fixes for free_pages_nolock() on
RT/UP" from Brendan Jackman fixes an NMI safety flaw in
__free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT
kernels can bypass can_spin_trylock() checks via non-PCP or isolated
migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- The 4 patch series "mm/page_alloc: couple of followups for recent
cleanups" from Brendan Jackman cleans up and updates page allocator
nomenclature, documentation, and debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete VM_BUG_ON()
assertions in allocation paths.
- The 3 patch series "mm/mseal: further cleanups" from Lorenzo Stoakes
refactors and simplifies the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates
mm_struct parameters to enforce that sealing applies only to
current->mm, and streamlines overall logic and comments with no
functional changes intended.
- The 4 patch series "mm/vmscan: fix swappiness=max and clean up
per-node proactive reclaim" from Ridong Chen resolves reclaim behavior
bugs and cleans up function parameters across memory reclaim paths.
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead of
collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask
parameter from __node_reclaim().
- The 6 patch series "mm: mincore: misc cleanups" from Kefeng Wang
cleans up and simplifies the mincore code. Most importantly, it removes
the historical special behavior that always reports VM_PFNMAP pages as
non-resident.
- The 2 patch series "mm/huge_memory: drop dead split helper variants"
from Kiryl Shutsemau implements two trivial cleanups in the folio split
API.
- The 7 patch series "mm/damon: fix uninitialized DAMOS field and kunit
exec expectation bugs" from SJ Park resolves minor operational and
testing bugs in DAMON identified by Sashiko. It initializes the
damos->last_applied field to prevent occasional efficiency degradation
and fixes invalid memory accesses in DAMON KUnit tests during test
failure handling.
- The 3 patch series "cleanup for stable_page_flags()" from Jinjiang Tu
cleans up and refactors stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- The 3 patch series "Batch unmap of uffd-wp file folios" from Dev Jain
extends batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities
to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- The 3 patch series "mm/early_ioremap: clarify and clean up
early_ioremap_reset()" from Sang-Heon Jeon clarifies and cleans up the
architecture-specific usage of __late_set_fixmap() and
__late_clear_fixmap() after early_ioremap_reset().
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset calls
in the RISC-V and ARM64 architectures.
- The 4 patch series "mm: fix reclaim storms in defrag_mode" from
Johannes Weiner addresses severe performance regressions, swap storms,
and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure
in Meta production.
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- The 2 patch series "zram: lockmap tweaks" from Sebastian Siewior
optimizes and fixes lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolating lock classes across multiple instances.
It reduces memory overhead by replacing per-entry lockdep_map instances
with a single map per struct zram, and assigns a dynamic lock_class_key
to each instance to prevent false deadlock reports when different zram
devices are backed by distinct filesystems.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoUJbQAKCRDdBJ7gKXxA
jqrzAP9WoPU0hiK4qS/kSjhtoZxhjpS5eLSUCy/utKuEvZbfGgEAu1zA+LH+X9Tm
THK5ex4iUZxiFbXpWfLMxE/Q9PmQYQ8=
=QTyb
-----END PGP SIGNATURE-----
Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:
- "mm: drop "sub" prefix from various places" (Dev Jain)
page->folio conversion and a naming cleanup
- "mm/kasan: remove redundant initialization for kasan_flag_write_only"
(Igor Putko)
KASAN cleanup work
- "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)
Small speedup in the pagecaache read code
- "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)
Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
allocations when the caller asked for GFP_NOFS or GFP_NOIO
- "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
Leitao)
Avoid a soft lockup watchdog trigger from the kmemleak scanning code
in extreme situations
- "mm/page_owner: misc cleanups" (Ye Liu)
Cleanups to the page_owner code. For some reason lots of people have
been working on the page_owner code this cycle.
- "mm: convert to walk_page_range_vma() to eliminate find_vma()"
(Kefeng Wang)
Simplify and accelerate the page walking library function
- "mm/migrate: preparatory cleanups for batch copy and offload"
(Shivank Garg)
Cleanups in the migration code
- "mm/page_owner: add per-fd filter infrastructure for print_mode and
NUMA filtering" (Zhen Ni)
Per-fd filtering to page_owner in order to reduce the sometimes vast
amount of output it can produce
- "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)
Fixes and preparatory cleanups around bootmem HugeTLB handling,
sparse initialization ordering, and related vmemmap setup
- "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)
Reduce lock contention in zs_free(), which dominates the unmap path
under memory pressure on Android (LMK kills) and on x86 servers
running zswap-heavy workloads.
Up to 1.83x improvement in microbenchmarking.
- "move alloc_tag.c file under mm/" (Suren Baghdasaryan)
- "samples/damon: handle damon_{start,stop}() failures" (SJ Park)
Fix improper handling of damon_start(), damon_stop(), and
damon_call() failures across DAMON sample modules to prevent
potential memory leaks, operation disruptions and use-after-free
bugs
- "mm/damon/sysfs: kobject_del() directories that users can
create/remove" (SJ Park)
Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
causeing creation failures due to duplicate directory names by adding
missing kobject_del() calls before creating new directories
- "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)
Clean up the core pte handling code
- "selftests/damon: misc fixes for test bugs" (Kunwu Chan)
Fix several bugs in the DAMON selftests
- "selftests/damon: fix memcg_path staging handling" (Cheng Nie)
Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
add a test case for it in sysfs.py.
- "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)
Selftest coverage for DAMON's refresh_ms sysfs feature by updating
the test control module and verifying that scheme stats update
automatically without manual intervention
- "mm/damon: five misc fixups" (Akinobu Mita)
Miscellaneous DAMON fixups.
- "mm/damon/core: detect internal variation above max_nr_regions/2"
(Jiayuan Chen)
Fix DAMON's region splitting behavior when region counts exceed half
the maximum budget by dynamically scaling down the split fraction as
the limit approaches, preventing large regions from staying un-split,
and add corresponding KUnit test coverage
- "mm: preparatory patches for PMD level swap entries" (Usama Arif)
Refactor and clean up PMD softleaf helpers, call sites, and
architecture flags to lay the groundwork for a follow-up series that
introduces PMD page table swap entries
- "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
Park)
Update DAMON design and ABI documentation, expands unit and selftest
coverage, optimize damon_commit_target_regions(), and clean up
recently added sysfs interface code for better readability
- "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
(Usama Arif)
Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
userspace event notifications and refactor v1-only eventfd handling
into mm/memcontrol-v1.c to reduce memory overhead and code complexity
- "selftests/mm: refactor pkey helpers and fix mmap error handling"
(Hongfu Li)
Refactor pkeys shared tracing and assertion helpers into a common
file, unify protection key selftests to use consistent diagnostic
logging and assertions, and enforce standardized MAP_FAILED return
checks for mmap() calls across the tests
- "mm/damon: optimize out nr_accesses_bp" (SJ Park)
Replace the error-prone, continuously updated nr_accesses_bp field in
damon_region with an on-demand moving sum function, reducing
structure memory overhead and avoiding state corruption bugs
- "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)
Decouple HugeTLB folio allocation from VMA dependencies by
introducing hugetlb_alloc_folio(), enabling subsystems like
guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs
- "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)
Integrate DAMON's probe_hits attribute counter into the pseudo moving
sum infrastructure, enabling real-time, online monitoring without
waiting for full aggregation intervals
- "mm: Some cleanups for page allocator APIs" (Brendan Jackman)
Simplify and refactor the page allocator entry points and flags by
unifying allocation paths, adding internal alloc_flags arguments, and
eliminating redundant __ prefixed alloc_pages variants.
- "Fix incorrect access of hugetlb pte entries" (Dev Jain)
Enforce the consistent use of huge_ptep_get() instead of ptep_get()
for HugeTLB entries and fixes an unaligned address issue in arm64's
huge_ptep_get() implementation
- "mm/damon: validate all parameters in the core" (SJ Park)
Consolidate parameter validation into the DAMON core specifically
within damon_start() and damon_commit_ctx() to centralize error
checking, eliminate caller-side redundant checks and to improve
maintenance efficiency
- "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
Chen)
Rename is_need() to filter_record() for clearer return semantics, fix
per-record allocation memory leaks and bound output copies in
search_pattern() to address an existing buffer issue
- "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)
Mitigate a system-wide stall which occurs when a cgroup is removed
while one of its memory control files is doing synchronous reclaim
- "mm/memory-failure: add panic option for unrecoverable pages" (Breno
Leitao)
Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
that immediately panics the kernel on unrecoverable memory errors in
kernel-owned pages to preserve error context and prevent delayed,
silent data corruption
- "mm/damon: refactor damon_{start,stop,commit}() for simple error
handling" (SJ Park)
Refactor the DAMON core API functions to guarantee that all contexts
are fully stopped when damon_start(), damon_stop(), or damon_commit()
fail, eliminating the need for complex and error-prone caller-side
cleanup code
- "Keep tail page private zero at free and folio split" (Zi Yan)
Add checks to ensure tail_page->private is zero when freeing compound
or high-order pages and when promoting tail pages during large folio
splits. By validating these fields at free and split time, it allows
the removal of redundant private field clearing inside
prep_compound_tail()
- "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
Song)
Eliminate redundant lru_add_drain() calls in
wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads
- "mm: clean up folio LRU and swap declarations" (Jianyue Wu)
Reorganize folio LRU and swap code by relocating page-cluster state
to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
MM-internal reclaim declarations into mm/internal.h.
- "userfaultfd: working set tracking for VM guest memory" (Kiryl
Shutsemau)
Add userfaultfd support for tracking the working set of VM guest
memory, so a VMM can identify hot pages and reclaim cold ones to
tiered or remote storage
- "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
Hildenbrand)
Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
performing some smaller cleanups around freeing of reserved vmemmap
pages on the way.
- "mm/damon: update probe hits for runtime parameter commits" (SJ Park)
Ensure that DAMON's probe_hits attribute counter is properly updated
when monitoring intervals are changed at runtime, matching the
behavior of nr_accesses. To achieve this, it refactors and renames
existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- "KSM: performance optimizations for rmap_walk_ksm" (xu xin)
Resolve a severe KSM reverse-mapping performance bottleneck where
thousands of split VMAs sharing a single anon_vma cause extended lock
contention.
By adding an interval-filtering check during the rmap walk, it
reduces worst-case anon_vma lock hold times from over 500ms down to
under 2ms, preventing application freezes and latency spikes under
memory pressure.
- "mm: split a couple of headers from internal.h" (Mike Rapoport)
Split declarations related to mm_init, memblock, vmalloc and sparse
into new headers
- "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)
Apply the interval tree optimization from rmap_walk_ksm() to
collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling.
It hoists loop-invariant address initialization and restricts the
anon_vma_interval_tree_foreach walk to a targeted page offset range,
reducing redundant checks and improving lookup efficiency.
- "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
Patil)
Fix issues in the hugetlb and KSM MM selftest categories that can
report failures when the prerequisites for the tests are not
satisfied
- "mm/damon: introduce data attributes only monitoring" (SJ Park)
Introduce attribute-weighted region management in DAMON, allowing
users to prioritize specific data attributes (such as page sizes or
cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely
disable access tracking and adjust monitoring regions based on
weighted probe-hit counters to optimize monitoring quality for
attribute-focused workloads.
- "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
(Stanislav Kinsburskii)
Extend hmm_range_fault() to support userfaultfd-backed regions by
allowing the mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd
regions while preserving backward compatibility for existing callers.
- "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)
Clean up and standardize how vma->vm_pgoff is accessed and
manipulated across file-backed and anonymous mappings in the kernel
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
renaming rmap interval tree helpers to better reflect their
functionality.
These changes establish a cleaner foundation for future work that
will unify virtual page offset indexing for all anonymous and CoW'd
folios.
- "mm: handle device-private PMDs in walk callbacks" (Usama Arif)
Address kernel panics and state corruption caused by MM walk
callbacks reaching non-present device-private PMD swap entries
created during HMM migrations
It ensures that functions which acquire pmd_trans_huge_lock()
properly recognize device-private PMDs instead of assuming a present
THP or a standard migration entry.
- "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)
Refactor try_to_unmap_one by modularizing Hugetlb,
anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
functions, laying the structural groundwork for batched anonymous
large folio unmapping.
- "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)
Fix typos and fills in missing entries in the DAMON sysfs ABI
document
- "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)
Introduce an atomic sysfs state attribute and supporting DAX/MM
infrastructure to prevent userland races when offlining and removing
entire memory regions
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)
Continue transitioning the kernel from the deprecated vm_flags_t type
to vma_flags_t across core memory management infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- "Two small patches to clean up mm/mm_slot.h" (xu xin)
Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
slot deletion sequences in khugepaged and KSM. It also adds code
documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- "mm/damon/core: hide core-private struct fields" (SJ Park)
Clean up DAMON core structures by consistently marking internal-only
fields with private: comment tags to prevent improper direct access
from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
(SJ Park)
Address potential infinite loops, NULL dereferences, and race
conditions identified in DAMON
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
Jackman)
Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
via non-PCP or isolated migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- "mm/page_alloc: couple of followups for recent cleanups" (Brendan
Jackman)
Clean up and update page allocator nomenclature, documentation, and
debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete
VM_BUG_ON() assertions in allocation paths.
- "mm/mseal: further cleanups" (Lorenzo Stoakes)
Refactor and simplify the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
eliminates mm_struct parameters to enforce that sealing applies only
to current->mm, and streamlines overall logic and comments with no
functional changes intended.
- "mm/vmscan: fix swappiness=max and clean up per-node proactive
reclaim" (Ridong Chen)
Resolve reclaim behavior bugs and clean up function parameters across
memory reclaim paths
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead
of collapsing all failures into -EAGAIN, and removes the obsolete
gfp_mask parameter from __node_reclaim().
- "mm: mincore: misc cleanups" (Kefeng Wang)
Clean up and simplifies the mincore code. Most importantly, it
removes the historical special behavior that always reports VM_PFNMAP
pages as non-resident.
- "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)
Two trivial cleanups in the folio split API
- "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
bugs" (SJ Park)
Resolve minor operational and testing bugs in DAMON identified by
Sashiko. It initializes the damos->last_applied field to prevent
occasional efficiency degradation and fixes invalid memory accesses
in DAMON KUnit tests during test failure handling.
- "cleanup for stable_page_flags()" (Jinjiang Tu)
Clean up and refactor stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- "Batch unmap of uffd-wp file folios" (Dev Jain)
Extend batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching
capabilities to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
(Sang-Heon Jeon)
Clarify and clean up the architecture-specific usage of
__late_set_fixmap() and __late_clear_fixmap() after
early_ioremap_reset()
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset
calls in the RISC-V and ARM64 architectures.
- "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)
Address severe performance regressions, swap storms, and spurious
OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
production
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- "zram: lockmap tweaks" (Sebastian Siewior)
Optimize and fix lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolate lock classes across multiple instances
This reduces memory overhead by replacing per-entry lockdep_map
instances with a single map per struct zram, and assigns a dynamic
lock_class_key to each instance to prevent false deadlock reports
when different zram devices are backed by distinct filesystems.
* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
selftests/mm: unpoison pages in memory-failure teardown
mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
mm/zsmalloc: fix release order of locks in zs_page_migrate()
Documentation: zram: remove sections numbering
ksm: stop iterating VMAs when ksm_test_exit returns true
mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
zram: use a custom key for each zram object
zram: move lockmap to be per-zram instead per table
selftests/mm: fix gup_longterm EINVAL error message
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
mm: page_alloc: move capture_control to the page allocator
mm: compaction: support non-movable compaction for pageblock requests
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
hugetlb: evaluate subpool free state while locked
mm/damon: remove trailing semicolons after function definitions
mm/damon/ops-common: prevent migration fallback to non-target nodes
mm/damon: update outdated comment about DAMOS filter handling
...
|
||
|
Linus Torvalds
|
5808ac1889 |
- Get rid of static_cpu_has() - one less API to care about testing CPU
features - Unify the handling of CPU core types (performance, efficient, etc) by mapping the vendor-specific types to Linux ones - Continuation of the work of Ahmed Darwish to centralize CPUID leafs representation -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqEomYACgkQEsHwGGHe VUqrVhAAmN1E0HRaRm2zUcJqDS2TVz9a//LTWI/i9pNtlhPrdGrPtaHfps89TGj3 1TBiFPE6I4xbuTlumFBToqfPbJ8mw41s3ZnlAUk/QVkf0J7Qkra/tZ9dRsWpjwqJ y/PqzgW7qTtpye881VX0fNaOlV4CRAQiGv6StALRo9fXn1lWRfwCfFBjYeuMHS0H e8r0shF0petS7JdHyTWmzS3E50ETrGI6XNbkKjWFyMjolaeP3r4YP1ucj/B5KY1E CFjdBkgXM3PQ0K4Nax96PA15VoMorIuGhpjiv0phiA9itBay3x6EQfOhXoMWtgiE 9gbgUfWUCx/n+U5tXwOaZnFBd8gnyT0QOENmojEf8GCIBoGgeff0g6djNAm36QlF Zyfq7EOMBCfkooddWEz6qhZdeP7SwKz0i0dHyJ6OroQKXVjnCXAUveyA3/1venYb HT/xP/BNDQc4+GpO1ZPCuottpC6CVPclWsVOrcnU4jBtZJRhvNTWQMbDpZUFUefO FIJi40u1cnHw1hk7t5dVACJAME5p4hUz9hlfZFMETbkxjFH7cJEKaGFO2JXhSsui NaLkCJQWgnJynnhNhdycRsdbC6+pAiayoajGe80hiwYrr3j0YhG5UKSrgUwD6uiq CxuFt7C8jLEsAcWBILVB5+S6vh+3peHRAm9m9LtgiDpRAM4vGGI= =IKxX -----END PGP SIGNATURE----- Merge tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpuid updates from Borislav Petkov: - Get rid of static_cpu_has() - one less API to care about testing CPU features - Unify the handling of CPU core types (performance, efficient, etc) by mapping the vendor-specific types to Linux ones - Continuation of the work of Ahmed Darwish to centralize CPUID leaf representation * tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU: Rename struct cpuid_read_output to struct cpuid_output x86/cpu/scattered: Sort it properly x86/cpu: Use parsed CPUID(0x1) x86/lib: Add CPUID(0x1) family and model calculation x86/cpu: Use parsed CPUID(0x0) x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities x86/topology: Add TOPO_CPU_TYPE_LOW_POWER x86/topology: Name the AMD core-type values x86/topo: Map vendor CPU types to generic Linux such types x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist x86/cpu: Hide and rename static_cpu_has() |
||
|
Linus Torvalds
|
2385c8b47b |
* Fix TDX port I/O bugs
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmqEdMcACgkQaDWVMHDJ krBa6BAAuDNE9VuX+ctu/H5dQUhnIrUWAiqWRPAeCRU4slW1j64Y/77VTrLxPrdq YbhsaMaDXOPU8sRfdJ5fDyLT9jFnIfxi0qNXxCJXYljK1jAqGx7C1+cQY5PjNE2F avZSDQ3lUvGVg4jjeZtFRZJC5UMUFyIG7dXbp2KR5fvPdRfO9YaWrXmSVEw2zSPT j/utLS3I3hx/MYgrRzqRDdpqh0rghych3sCGsQlJ2+YX9NYmviHCCwy10D7OTXsl uRDQfEl5IOhPDJwIiM/FuY5vmoB3UCSWrMQMkE2RxZR01HS7u0Pw4Q3MdY4BlCTb 6Bzq24W4KUvF1RBFF2wth4RqcERtw48ONhuzdHEF8SCwroDiydeX/vzVfxvN0+1Y EKm3APx4SfWpmPaNlYkct5OPmXoUqQItKDtJGqZfnR68HLiRi2rhHmwLujlnPiSV tuChn01RyTtUVHiF6dcrnRxOXAaLn7AQ5QK7mW7JhmuNi9yEaf1xR1BMF5W8nseq VZSUWRyK3L0HgdZyeW1bTBbjaTcrdBaPv8a20Xsj7CvQP5NCTnue487LaKXWclt9 BCQuUPofJnVHddrEU7mJvAHAemR+Rca9wS83TV2d6e/5doaujt6+deJVGELkQpBL lioc+xI+dIQkJ5OLkdmm8fU76kQAEhthS+KzBmlqjHhVZnzDKuk= =rzxt -----END PGP SIGNATURE----- Merge tag 'x86_tdx_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 TDX updates from Dave Hansen: "TDX guests cause #VE exceptions whenever they do port I/O. The guest then does some instruction decoding and makes a call up to the host for help. That decoding had a couple of bugs. Fix those bugs. Use an existing and now shared KVM helper for one of them" * tag 'x86_tdx_for_7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tdx: Fix zero-extension for 32-bit port I/O x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() x86/tdx: Fix off-by-one in port I/O handling |
||
|
Linus Torvalds
|
8dcef8882a |
x86/msr updates for v7.3:
- Streamline the x86 MSR handling APIs along the 64-bit
variants, simplifying the interfaces. Removal of the
old APIs is planned for the next cycle, to reduce
churn & integration pain. (Juergen Gross)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC3qYRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1jSOA//cTRslNJ4t3g2cR8iPDFXsjMmwsvpDJn1
OVqOlyFcQpJCliC37JmRA94B6RufVdoFikOuyshn4SaPix8+lUKZDt+c5N6wfZsI
NJ4zuCHD4k0tDhHCYXihEISBAGUJrHk+6eiNTxDTlCUhCxqLvX1W1L0fiB4R2w0h
/Z1ZfL0Om6QV/V8u7lC8Vio0Uxp12Zjm60I43QBsUTOoD+4poaGGORV+03lnGnaZ
eaq9VRZKrrx6h3K5hS1Ja6j6mWehQzWabn3v5cM15IwYNuVA4g38OKR8ofqk0Shz
DvCILEtjoT7mXfvGoxYTSuEEa5aJoTSplMVbsrRuXHtcwDplnCGxCnYE0pYCfpFD
4xzvBBm15X20M0CFFW3lvJKqyN43M+Wfh/aOG0AT8BmIPKuyzZgc9yJ/QxmS4dYY
5atebSCK+caKr8IXshTTvssEWGF1A6un/0lOfuS2BmdIZuREYxzKWF3sqp3f10Gx
hSm1xB5HRhoQCIFP3PGER8bwwea0UmjI9VWHEkBKfNadqz3OPEZf4PQNiWJ3Q6x0
T7EGOWJlZTzCH2iqGrzPY0g56pPoDwGzjIruAmhc5NMFEOIHy0MKyPw4huWKSSzB
WVpqi8Gnn0HS3dECOnvkDpNM0JXDp9XYSaL5mLs/ZgWPIwJ6fFHbY34xm3A+Cjdp
hGYmT3Mtx1A=
=QBg3
-----END PGP SIGNATURE-----
Merge tag 'x86-msr-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 MSR updates from Ingo Molnar:
- Streamline the x86 MSR handling APIs along the 64-bit variants,
simplifying the interfaces.
Removal of the old APIs is planned for the next cycle, to reduce
churn & integration pain (Juergen Gross)
* tag 'x86-msr-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)
x86/mce: Work around build warning after MSR-interface switch
cpufreq: Stop using 32-bit MSR interfaces
x86/featctl: Stop using 32-bit MSR interfaces
KVM/x86: Stop using 32-bit MSR interfaces
x86/mtrr: Stop using 32-bit MSR interfaces
acpi: Stop using 32-bit MSR interfaces
powercap: Stop using 32-bit MSR interfaces
thermal/intel: Stop using 32-bit MSR interfaces
x86/olpc: Stop using 32-bit MSR interfaces
x86/hyperv: Stop using 32-bit MSR interfaces
hwmon: Stop using 32-bit MSR interfaces
EDAC: Stop using 32-bit MSR interfaces
x86/cpu: Stop using 32-bit MSR interfaces
x86/apic: Stop using 32-bit MSR interfaces
x86/resctrl: Stop using 32-bit MSR interfaces
x86/tsc: Stop using 32-bit MSR interfaces
x86/amd: Stop using 32-bit MSR interfaces
x86/pci: Stop using 32-bit MSR interfaces
x86/hygon: Stop using 32-bit MSR interfaces
x86/mce: Stop using 32-bit MSR interfaces
...
|
||
|
Paolo Bonzini
|
d75b484605 |
KVM x86 misc changes for 7.3
- Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
- Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion.
- Fix a variety of #DB priority bugs.
- Fix a class of races related to enabling Hyper-V emulation on a vCPU after
the vCPU is visible to the rest of KVM.
- Use static calls for nested virtualization ops.
- Move more KVM-internal code out of x86's kvm_host.h.
- Enumerate support for a variety of Zhaoxin instructions that don't require
explicit virtualization.
- Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
- Harden kvm_vcpu_map() against double-mapping and thus leaking references.
- Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp8uZQACgkQOlYIJqCj
N/2Pgw//ZmY9QZSvbSS69yYporgRhlTCMq1k3siLYfT19XShCpjO0KK9QTggs57L
0JXgbv4kwzvWWliwlRVK3e2nw027GI0j0kDRdcI3RAsaufZCjVT300cfUJBy/T4C
EQLULA8J3Q5pXStuW7SS2bMjI/D6J0+h80co1gfN4yeBDuKXUhtpmW9G/frCQyqI
3DduI57IBWO+pHImMWVx5jFc6WeDokQPxVASWE4zAU5PobXZSQ2K7KCbcx/rHxLt
3JZRw9sECF4Rn5DHm9Xag4bfZH0IR1jQ4P5fIzlvvYcW8yhj4CcTK648fVivBCL5
cpVQRCUVM6DyAX7l6tchP44XHv8a+D/bB2qZUlKvrMiSYA3usW7olKEDNUPI0dsm
vviat3br/XBu3msNkMZcYoP2WS+ka9zDAkSw7MkNWg1m62UfzvI70AQC0r7Fs/UG
+bUwMpJ11C/TOjwVL8DNMu0RT2uPgZ2xgtyD/IeVrqlm867xtlGxit+Uqs9V0vro
LC2YhNR2LYk8NhKO/IZsHI/9eTD4xQyPBn13U6dsZy19fqcPftSJM7avZfQNiA+l
nPN3v/FZmM22k32hc4NmGCx1/pBU1QtnTcZ0Z91pVzD5+DrvpYnMJpdhazrLL18j
IN2OK+Vy/WiP2xnAvCjOFcHCVgAe3SCorqIrjRlY2nMbnRmc03E=
=bQJe
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-misc-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM x86 misc changes for 7.3
- Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
- Harden the SNP and TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion.
- Fix a variety of #DB priority bugs.
- Fix a class of races related to enabling Hyper-V emulation on a vCPU after
the vCPU is visible to the rest of KVM.
- Use static calls for nested virtualization ops.
- Move more KVM-internal code out of x86's kvm_host.h.
- Enumerate support for a variety of Zhaoxin instructions that don't require
explicit virtualization.
- Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
- Harden kvm_vcpu_map() against double-mapping and thus leaking references.
- Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
|
||
|
Paolo Bonzini
|
967872e4f3 |
KVM SVM changes for 7.3
- Remove a dying VM from the GA Log notifier list before the VM is actually
destroyed, to fix a potential use-after-free.
- Don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins.
- Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled hosts to
fix a data corruption issue due to the PSP driver assigning to-be-written
pages to firmware (as required by the SNP specs).
- Unconditionally intercept ICBEP so that KVM generates the correct guest RIP
when handling an ICEBP-induced TASK_SWITCH #VMEXIT.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp80WUACgkQOlYIJqCj
N/3JuhAAv0zwXVVCQbE8Ni3CT/Wl03MEXGDsqlv1mBbsI5WkOte4CshCK8oHAYs4
LDhO6Y4BlIRJ78itpzk+FF5pvx0MPLi535PNx71o2IGKRZ2T/0u9GVFvHjXdM61F
OdMFSbRYTg4EHPhqskYN4vIy11Qd3vhaklwcDXxnxlZeTq2wtuVwa1GM7rkmiyRs
w3dtNrjSTM2axc4+H+gIN/WN5wM5jxsMVxhPdhPzK2isl4+btD9PG7BG64+aZVqJ
qW9CVTEz81yXdR04sTYutV0Hf56TzGE1RC75MH5nMi7AT9Lfq9L8eVSqPpCZBG/z
YTO8oSQtD9SrIabE8YQ/pBf+LH4DpDCnxjA5IDeiP/6BW54Via6PXpDQQGGrgqWF
pWs2jlc1nUxlrUPrPsQxx1yiFk0xDb/ketgwCHvVilyT5CV33ZO3w995FA3Lvjgy
KY12jxl1jwb8SgZfEkVhUQBNSIsfhj6Wb+jJdbvgcA5M7iUbKk7bBGaokhTbGsev
e63JCVFRydidINyk+LsvUfgjm1ua18x97A7ihcNMIsJY9CCALK8B/HtyPena2phM
F+EZ+IydI/JIrXU4C/o0tWm+mlKbGsxAoCcVx/OkIsckEQYhBgcYPlKr5hZvzy1S
deEmOEXB9cUIO11AOELYnRwEJl6xNuxa226It7WUtmuYQ9t5z48=
=MkIK
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-svm-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM SVM changes for 7.3
- Remove a dying VM from the GA Log notifier list before the VM is actually
destroyed, to fix a potential use-after-free.
- Don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins.
[This is correct because, while FOLL_WRITE was needed in the past to trigger
CoW unsharing, nowadays FOLL_LONGTERM does that already even without
FOLL_WRITE. And in fact, get_user_pages() actually disallows FOLL_WRITE
together with FOLL_LONGTERM. This change was acked by the MM maintainers.
For more inforamtion see commit
|
||
|
Paolo Bonzini
|
634c347df1 |
KVM VMX changes for 7.3
- Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
- Cap the maximum value shoved into the VMX Preemption Timer to workaround an
erratum that affects all existing Intel CPUs that support CPUID 0x15.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp82CwACgkQOlYIJqCj
N/1ekg//Z3ulUOnxKhywPtJ9T2bGlGoqJwslTygFy2JQfR4eNdnNYvtLU2A6Gsa2
1IaB/xJqMtSb+XxpgghYuGvU29J/i25QOJRM0RyJhaXxYvDkZPP4P1gwm9/qniFn
OTITTM37twD98uIYMjOXP6UsK7MPg2Kogv74hYwTpHVj/ti9weLwRX+x+bmlA2Aj
lPFUqPqQkLWFvhoSLV5uYW1rZfLtq/UdlV13DCF+vtp1u6IXaW6mFG5RMFog9kSt
arIW2ZG9Gx7SwrLrpRUSpQyRZugzTcNyl/lK+/sGzONfJO1Gw2QZ7bJFckhXoRt1
ktR5ZAXc8Zy7It7gsNozvQD1NsnT2+FTDzygv7h15IIOwWi+quWF63BCNz+in5RA
ivmFrUnRwmbGgoshpD+JjwR5qW7TK0lOLudWMWnH6ctIH3PvgJrNiIuTbKNGxtkI
D0WuDLrLcSqiR9M8q5eLTKiRjykYugG81KIHIMoTBszpO8/qIhdXyPUr3TPUkoHR
SeDL0m4KdURZR2cOTOvy6DIPTY2qn+rpxRFkqXJCUx/98kajsF0/0RDMBwUeaGF8
Y9e9bgR7YW8hMd6z64ODFTLUSMYXavC0AJpQq3spWg0bo15CcAFTAAnyAQOpTgyo
IGENMWREkCa62RrveZLhN3rFkYBbGMZSuBa0UQM+NvvJXDwdJ90=
=BvM6
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-vmx-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM VMX changes for 7.3
- Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
- Cap the maximum value shoved into the VMX Preemption Timer to workaround an
erratum that affects all existing Intel CPUs that support CPUID 0x15.
|
||
|
Paolo Bonzini
|
abad8c4cb9 |
KVM x86 MMU changes for 7.3
- Fix a bug where KVM would walk a newly created rmap without holding the rmap
lock (or mmu_lock) during aging.
- Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp8wS8ACgkQOlYIJqCj
N/2SmQ//ecBzKzw5uQVwigrVGwWNZS1I00d4DZsYQpD/cAfSuKCYG4YGfG5IBtUy
tvMmoPswmTbullysJxB2bW0JOPjmGGEE6lsNhCH7CmgpKXdeBgqUo2x+KHVV8hFv
YlXXBA2rkbtObMjQgfaByIjv2M3d0trSkOfe39WvPEcfqjOBp3GK22km9eHw4qN2
PqidjSHtAzwcsd+id1cmw5uoel9RKOpux7FPM5mfVIWHJByDrY5sUU+u9Ug0p4F1
2wWbG6ghdnO0LsFFrGD2K2Ummux1KaBuFny/q4cqv3dg3IsMrLcX5xpmC9Z+N1Ey
mmq0D87VXzxEaYXDiLB7hWp6ZM+5dFXunSyhoX/Qu8ALUrUKyXY7MLOdLPXvsYpx
YEy5OTsZCdlebvziu2w8+aNOTxsctYF9cj8yraz8PtmKqgJ2Wg1seNLl7rfGwCWP
DGtvaPrS20cm+OIVD26or4zfR+6DGhilfz1BItoQejzA4ryVo3XEcYn9U11ph6mn
9Mu0W/XVl9AX44lliENPbcNmLDB5X65twv+1eIZkbevFRpSFsJYFg4Fdg6/0JK8g
B2zPyKmsTi+PgAx6dnEZeVNDhYY6P7E1OaGbXqIvNSdzGM6Ps3gbfIYiIOPD515B
kGi8y9kDKnNZ7PQrACTWU+u6stB8f4BoXBE7Au1+GNPbSRlqu9M=
=axEq
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-mmu-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM x86 MMU changes for 7.3
- Fix a bug where KVM would walk a newly created rmap without holding the rmap
lock (or mmu_lock) during aging.
- Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
|
||
|
Paolo Bonzini
|
c4a6ae0ea9 |
KVM x86 PV clocks and timekeeping related changes for 7.3
- Remove a defunct masterclock update from kvm_xen_shared_info_init() that
could result in corrupting kvmclock, for a lose definition or "corrupting",
due to triggering an unnecessary switch to/from masterclock mode.
- Skip Xen runstate time updates if time has effectively gone backwards, so
that the guest doesn't report 100% steal time for a very, very long time.
- Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
updating the wrong sub-leaf, and upstream KVM will soon provide all the
information needed by userspace to populate the CPUID field itself.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp7vSIACgkQOlYIJqCj
N/1FzRAAhtEbAmo1wQAfwCfC1zCGxxfNS45+KOUoa9qbBkmhqou0Vn648O4BxamK
7MJ2J9OZ25X5O+kkx0YTTqiRhPZ+z8NfAQeCAd2XhwqmLtKaY8PLea+Ei132ztLV
1UDHjxTjgrDrwZvV5V2q7IzHHWFxWm4HVX1BrArcsB2hndiq7Re+eYGF12IL2DEJ
nmL1Atc4xAVQYpeLqt9hT3mmbv09mifjEHGrzyP0xmCs6V8HKtpdM0tv9mdSvuRn
gTpnAmD9akfk4iT8xLW/1Di86a7KkWPqMU3te9GP5XBXeRld+iLZCPG1f5zq9wmT
I7wdScR8TPeEsawDIfwgW+SqbBE/452fbLk6spoIAJYysR8k5sXY5QMbmADznpBE
6MtDQgQ8IbevMZsb6NnfmYz2AFdBQcJN50/Zdk2SEXwXZJD6gZdNIVovlZURl0I5
9ApfHl7tSxW+Wz5aRL/iDCxQeoh+0cRXNbi4WRb6am3wgn8LVBvOgkZZNoTI1qE2
MN/Oc6WVavbMlOBC1mz9LuuiFugJnprWkxBjzvpzrlUBjt5m6lIni+9SctEArMuD
7tZbr1w8XGBwJU4xrMn16KC53+HAltuBgN0BK1umKtIGasn5K6cmGADpONclJ6RN
IKhcqIGwF+eqtYfthYIrGGsvMjrw9h1MGMMnLS3mt/J1GjX1VOo=
=oKIz
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-clocks-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM x86 PV clocks and timekeeping related changes for 7.3
- Remove a defunct masterclock update from kvm_xen_shared_info_init() that
could result in corrupting kvmclock, for a lose definition or "corrupting",
due to triggering an unnecessary switch to/from masterclock mode.
- Skip Xen runstate time updates if time has effectively gone backwards, so
that the guest doesn't report 100% steal time for a very, very long time.
- Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
updating the wrong sub-leaf, and upstream KVM will soon provide all the
information needed by userspace to populate the CPUID field itself.
|
||
|
Paolo Bonzini
|
159ed1ae35 |
KVM guest_memfd and x86 CoCo changes for 7.3
- Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
Change request.
- Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare
for in-place private<=>shared conversion, and clean up a few warts along the
way.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp7vdQACgkQOlYIJqCj
N/00vA/+NmxB+Zsr7+TZo4NFiFcs/FK7rBb6psvlLuJN1oNLPw7dzdmPclSyv7li
RDWRF6SmuujxCO2W4LMc1Fz5IjN8/iYPHsEHnYCCxjDgFdEl7x1MOJ0xuXQOWgQw
icpWdYgWh9EoaKepn0EFVeF7WZFK7KhxmpJNz5HZEx3p110HfrSHbjl0LikySDst
19Jck5ZzTCVrbF58e5k6phzvvR6mRNeLS7BKvOM+u5U70+7P9AcTbihd8qz7vy0k
LlJUBZbp7NywjgIcqMTZGmBvsWoOAcvykBX9hNgjDdobVhh3Ft+hsmOxNt7yOoAl
llJznwRQvZItWGfGO8o9l+/pJI7bvGzQ6isXqdg3TbxWH7/d6HOdWoGiC8ya2x+k
UBDvlRgAH9KZuuE7E2m/ggM0hoLbWyNDV2qVo2WnmqbGG4SQRSA5hyq/pIov0hRY
kr0anBd/Pw8ZoO02RtlrSQkKODbdR7l3/lQDzHzSWKidJ8Eh+iqA30/oIQzQMCOw
3s/SIB19Jab4UEgS3aqvFNbsj+zXN2tT6NLiiSoodSp+sSP5OMJ46U4Sb/txn9EP
L035UIyLRAGFsIybvutSckT/Guv9aVeeK0F2CNRvzKrPUhaj3Vi2a7RvQtZZWeVd
EJLzM07Rx8msGZYq8Eg+9QkrDe5IgVjJvsZ5RrKeS7VJKivpFRU=
=yUfX
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-coco-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM guest_memfd and x86 CoCo changes for 7.3
- Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
Change request.
- Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare
for in-place private<=>shared conversion, and clean up a few warts along the
way.
|
||
|
Paolo Bonzini
|
9dc54ddece |
KVM arch-neutral and documentation changes for 7.3
- Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.
- Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
- Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
before calling into arch code. This allows arch code to consume vcpu_id
without having to worry about cross-vCPU clobbering (at least s390 and x86
have had related bugs).
- Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed to fix a use-after-free where hardware
will write to a freed vCPU's PID.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp7v0oACgkQOlYIJqCj
N/0d/Q/+MWjv5Ua3LXBIcdw34zm+ympYVwEs30x/GPM/434DR/JS7iKAL0ZaY/Wc
uQFlNOJ74Nwq59y63VFGhMJeJU3zh/T3aKS/yarlbeUn2kY5Mij856KnY1acKo1n
hVaW+S8xAYhyf4QWOugeheSU/nrQ6df13EA+zJWOcqWyeeWHm2cykpRAoNhglVJr
nu4lPewBqVBfLmNIMtWhV0L9YllFO9nhGA4Ho7mRCTp8McxXNoeqSmlqm5xbwa0U
iNgpyzEaZwXHBkjk/PbTNjmB4uRLIkhn3o+Ol0PRyt/R1OgJScwmlK+R04b+9nQa
wI0C4bh3lE5wyAFE78yIkju1DhTLHe5Vd748hONIyuwQ2fJoh5SCpFoPX59uND39
W4qU6I7DgAX4Oum0yuwBLMUaKTRtupgVHFlsXSIrx4Im95cYllUdfktLArmpdnfK
mFPOMPtD2x2RdFWhLQSGVLO+kG9IjRc06P0UVPwQPUc2CNfQKYgTqYjIPBn6KTef
U5ZQeN7TdZFg3Vchrwmis3PjYKeP/xdQPNOsMG9q7sXSdo8N4fCCsHfBjceEO5I5
s+DUbDJKruQW3MrwGTa6vCqOyLipNVxBXwgeOZQEDGbi+AynBB3QofY54jQSqwfL
SFbhfiTbcfu1JCogaCarZqclzVUp333LESNqqMljWMzDbCS9VwE=
=19dB
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-generic-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM arch-neutral and documentation changes for 7.3
- Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.
- Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
- Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
before calling into arch code. This allows arch code to consume vcpu_id
without having to worry about cross-vCPU clobbering (at least s390 and x86
have had related bugs).
- Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed to fix a use-after-free where hardware
will write to a freed vCPU's PID.
|
||
|
Paolo Bonzini
|
4136288688 |
LoongArch KVM changes for v7.3
1. Advertise already-supported capabilities. 2. Some bug fixes about timer and MMIO. 3. Some hardening about interrupt injection. 4. Replace kvm_err() with kvm_pr_unimpl(). 5. Add FPU/LSX/LASX test cases for selftests. -----BEGIN PGP SIGNATURE----- iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmp9ca4WHGNoZW5odWFj YWlAa2VybmVsLm9yZwAKCRAChivD8uImelAuD/4jhprQWR9b8RMQ9bGYaBDml+98 fCRW8NPyicnct+97U/E9EXJrrMyyDOqJtOSnNQOVmTjz3IGQtzLoHULaJPqUv0Dh 7xUbpmb7qkqxrykUEUa81tDnClpISfLcgUBWKsg0VGLyF7MIEnbtECTadbzQEd10 hNXy/Pv8OiAIZe4rtlGWxOU5JxU6OVf0zEmXiS6cbqXrwxVl4STbF97/5ULqjU+D 4KMMs1IcOdf4klQeoE1oKvWsCiedZQBkKbtsv2hpDMmY4lUdheJg9+0atr8Oh7VS TtlO6Fmt7ilK9eFOCapDcs4gf5WQgs8WXKAyVUYSoteyEXQ9kSF2bHMYiC+WaKhb kMRR9ZyJa086FwDvW9/TyMrP8HLR4ORa7ksOeBnGt4Uv9A92ZbGqvEqLILPoKsIR LBJUM17XuLlR9J56sYNtid3Rdq88VLo84Wfc0hW966b+6oNdOVQBPI2YRpk4wDT1 Mtra60dtzwQ3jCW/GTjJThueEC4lqOFKHpYPIP3rd4aL8oCvfgLYlYZ4TiXHUjpX MgQ9rm8nDZAWipsjvt2yADFnv3YW4kD6hrn1S0EaDJXsTtT7pB6Mr0jlxQE/ZJdA ibXSubO5cakIdpMnAylL78ZyGZOWn6YOSG1pEjHjkI+in73sZ5a89k4s5ErxKxtB Hnc/FXwVWbylUdJkKw== =eMRy -----END PGP SIGNATURE----- Merge tag 'loongarch-kvm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v7.3 1. Advertise already-supported capabilities. 2. Some bug fixes about timer and MMIO. 3. Some hardening about interrupt injection. 4. Replace kvm_err() with kvm_pr_unimpl(). 5. Add FPU/LSX/LASX test cases for selftests. |
||
|
Paolo Bonzini
|
637315cb40 |
Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD
KVM/riscv changes for 7.3 - Svadu/Zicfiss/Zicfilp FWFT support for Guest - Use try_cmpxchg for IMSIC MRIF RMW - More arch-specific tracepoints in KVM RISC-V - Eager Page Splitting for KVM RISC-V - Optimize hfence request handling for SMP Guests - Improve dirty log clearing by skipping zero bits in mask - Guard HFENCE range loops against overflow - CPU PM notifiers in KVM RISC-V for non-retentive idle states - Fix kernel-mode vector context save/restore for Guest |
||
|
David Woodhouse
|
7d3bd21e45 |
KVM: x86: Remove runtime Xen TSC frequency CPUID update
Remove the code in kvm_cpuid() that dynamically updates the Xen TSC info CPUID leaf at runtime, as KVM is updating the wrong sub-leaf anyway (0x40000x03/2 EAX is the *host* TSC frequency per the Xen ABI, not the guest frequency which belongs in 0x40000x03/0 ECX). Simply drop the code instead of fixing it to fill the correct sub-leaf, as modifying guest CPUID entries/output at runtime is generally undesirable, and providing userspace the necessary data to fill the sub-leaf itself is useful for other reasons, e.g. to fill the generic 0x40000010 timing leaf and to provide exact scaling information to aid save/restore. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Link: https://patch.msgid.link/20260728144954.355376-23-dwmw2@infradead.org [sean: tweak changelog to take this patch before the new uAPI] Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
David Woodhouse
|
36a8520064 |
KVM: x86/xen: Prevent runstate times from becoming negative
When kvm_xen_update_runstate() is invoked to set a vCPU's runstate, the time spent in the previous runstate is accounted. This is based on the delta between the current KVM clock time, and the previous value stored in vcpu->arch.xen.runstate_entry_time. If the KVM clock goes backwards, that delta will be negative. Or, since it's an unsigned 64-bit integer, very *large*. Linux guests deal with that particularly badly, reporting 100% steal time for ever more (well, for *centuries* at least, until the delta has been consumed). So when a negative delta is detected, just refrain from updating the runstate times until the KVM clock catches up with runstate_entry_time again. Also clamp steal_ns to delta_ns to prevent steal time from exceeding the total elapsed time, and handle negative steal_ns (which can happen if run_delay goes backwards across a scheduler update). The userspace APIs for setting the runstate times do not allow them to be set past the current KVM clock, but userspace can still adjust the KVM clock *after* setting the runstate times, which would cause this situation to occur. Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Paul Durrant <paul@xen.org> Link: https://patch.msgid.link/20260728144954.355376-21-dwmw2@infradead.org Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Sean Christopherson
|
5ec42d5765 |
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Explicitly clear role.invalid when deriving a child shadow page's role from
its parent to harden against bugs elsewhere in KVM, as violating KVM's
invariant that invalid pages are NOT on the list of active MMU pages leads
to use-after-free due to __kvm_mmu_prepare_zap_page() using list_add()
instead of list_move() when processing an invalid shadow page, i.e. makes a
bad situation far worse.
Yell loudly if the parent is invalid, as it means KVM has missed a validity
check, i.e. KVM is attempting to map memory using an invalid/obsolete root,
but continue on as the child is otherwise still a valid shadow page.
==================================================================
BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]
Write of size 8 at addr ff11000153dd1368 by task repro/853
CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
Call Trace:
<TASK>
dump_stack_lvl+0x4b/0x70
print_report+0x153/0x49c
kasan_report+0xbc/0xf0
__kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]
mmu_alloc_root+0x141/0x320 [kvm]
kvm_mmu_load+0x612/0x20f0 [kvm]
kvm_arch_vcpu_ioctl_run+0x3dd5/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0
do_syscall_64+0x67/0x5f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
Allocated by task 853:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
__kasan_slab_alloc+0x5f/0x70
kmem_cache_alloc_noprof+0xfe/0x2e0
__kvm_mmu_topup_memory_cache+0x135/0x530 [kvm]
paging64_page_fault+0x318/0x1e30 [kvm]
kvm_mmu_do_page_fault+0x21d/0x630 [kvm]
kvm_mmu_page_fault+0x18c/0x17b0 [kvm]
kvm_arch_vcpu_ioctl_run+0x1f35/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0
do_syscall_64+0x67/0x5f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Freed by task 853:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kmem_cache_free+0xe2/0x400
kvm_mmu_commit_zap_page.part.0+0x1e2/0x310 [kvm]
kvm_mmu_free_roots+0x283/0x560 [kvm]
kvm_arch_vcpu_ioctl_run+0x33c8/0x6150 [kvm]
kvm_vcpu_ioctl+0x5e4/0x10d0 [kvm]
__x64_sys_ioctl+0x131/0x1b0
do_syscall_64+0x67/0x5f0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Fixes:
|
||
|
Paolo Bonzini
|
1d78d33275 |
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and
KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues:
- in sev_migrate_from(), when the destination KVM is a mirror, the mirror
entry is moved from the source's list to the owner's mirror_vms list,
without holding the owner's lock unlike other writers of the owner's
mirror list (sev_vm_copy_enc_context_from(), sev_vm_destroy()).
A concurrent COPY or destroy can race with sev_migrate_from() and
corrupt the list.
- In sev_vm_destroy(), the *owner* is still active and could receive
concurrently a KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM that causes
sev->enc_context_owner to change. In this case the incorrect VM
receives kvm_put_kvm().
The second issue needs particular care because the owner could disappear
altogether (even though the race window is impossibly small) between
reading it and locking it. There is thus no way to perform the checks
under the owner lock without putting struct kvm under SLAB_TYPESAFE_BY_RCU
(which would allow kvm_get_kvm_safe() under RCU critical section).
It is much simpler to just use a global lock, since the critical
sections are so small and the new lock is always a leaf lock.
Fixes:
|
||
|
Paolo Bonzini
|
26505e1b5b |
KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled
Red Hat is seeing multiple reports of Windows memory corruptions (and consequent BSODs) with hv-tlbflush=on, on AMD processors only. The crashes, while extremely rare, happen even with a stock configuration, but with Driver Verifier enabled they can be detected after approximately 200 VM hours. In particular, Alexander Lougovski measured the following: - on AMD Turin, 15 crashes in 3300 VM hours - on AMD Milan, 2 crashes in 500 VM hours (there are fewer hours here due to the host being smaller) - on Intel Sapphire Rapids, 0 crashes in 8000 VM hours - on AMD Turin with full TLB flush (not exactly this patch but similar), no crashes in ~2 weeks of run time which should also be ~7000 VM hours For Turin, the microcode version was 0x0b002162, which (assuming this is the same issue) should not be affected by the problem listed in https://knowledge.broadcom.com/external/article/419026/bsod-on-virtual-machines-running-on-amd.html; on the other hand that problem should not apply to earlier processors. AMD has not provided any information or analysis yet, and when we asked we didn't know yet that it reproduced on Milan as well. As to the workload, Alexander threw more or less everything at the same time at the VM: - a full Windows Defender scan every 30 minutes - a disk I/O job - a loop doing repeated mmap of system files (mostly to hope that it triggers some consistency check in the Windows memory manager) - SQL Express 2022 + StressDB (1.6M rows), with the host doing queries (75% write/25% read) via sqlcmd Driver Verifier is able to detect BSODs more or less at the same time as the pages are freed. They mostly happen in the Windows Defender filter driver, but occasionally also in the networking stack (e.g., afd.sys) or elsewhere in the filesystem stack (e.g., fltmgr.sys). The flush is issued from kvm_hv_vcpu_flush_tlb(), which receives the cross-CPU requests from the Hyper-V TLB flush hypercalls via a kfifo and is invoked by the KVM_REQ_HV_TLB_FLUSH request. The mechanism is the same for both Intel and AMD, and the handler for both vendors is a simple INVVPID(ADDR)/INVLPGA instruction. Because the request is handled on the destination CPU, there is a question of what happens if the VM is migrated across physical CPUs. In that case, the INVLPGA instruction would use a stale svm->vmcb->control.asid; but if anything that might do an *unnecessary* flush (on an asid that's being used for another VM) and then pre_svm_run() would force a full TLB rebuild. So, for lack of better ideas, this patch forces a full ASID bump in svm_flush_tlb_gva(). To avoid paying the price on Intel and also to avoid unnecessary loops on AMD, the flush_tlb_gva op now returns whether it did a full flush or not; kvm_hv_vcpu_flush_tlb() takes note and exits its loops immediately. While there is an obvious performance impact, about half of the benefit from Hyper-V tlbflush is preserved (10% vs. 20% on the SQL Server workload). kvm_mmu_invalidate_addr() is the only other caller of the flush_tlb_gva op. The change would have a performance impact on every intercepted INVLPG and, for nested SVM, on every L1 INVLPGA. For INVLPGA specifically, this covers the same suspected issue but for nested hypervisors, so it is correct to apply the workaround; for INVLPG on shadow paging, instead, the impact would be stronger and, due to lack of data, for now the use of INVLPGA is left in place in svm_flush_tlb_gva(). Analyzed-by: Vitaly Kuznetsov <vkuznets@redhat.com> Analyzed-by: Alexander Lougovski <alougovs@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|
Like Xu
|
66ee8f1556 |
KVM: x86/pmu: Clean up vPMU comments and stray blank lines
Tidy up the x86 vPMU emulation code and its selftests by fixing comments that no longer reflect the code along with assorted spelling and grammar mistakes, and by dropping redundant blank lines reported by checkpatch. No functional change intended. Signed-off-by: Like Xu <likexu@tencent.com> Link: https://patch.msgid.link/20260625090155.6326-1-likexu@tencent.com [sean: keep quotes around "hit", shove sequences fix into separate patch] Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
David Woodhouse
|
633d7652f8 |
KVM: x86/xen: Do not corrupt KVM clock in kvm_xen_shared_info_init()
The KVM clock is an interesting thing. It is defined as "nanoseconds since the guest was created", but in practice it runs at two *different* rates — or three different rates, if you count implementation bugs. Definition A is that it runs synchronously with the CLOCK_MONOTONIC_RAW of the host, with a delta of kvm->arch.kvmclock_offset. But that version doesn't actually get used in the common case, where the host has a reliable TSC and the guest TSCs are all running at the same rate and in sync with each other, and kvm->arch.use_master_clock is set. In that common case, definition B is used: There is a reference point in time at kvm->arch.master_kernel_ns (again a CLOCK_MONOTONIC_RAW time), and a corresponding host TSC value kvm->arch.master_cycle_now. This fixed point in time is converted to guest units (the time offset by kvmclock_offset and the TSC Value scaled and offset to be a guest TSC value) and advertised to the guest in the pvclock structure. While in this 'use_master_clock' mode, the fixed point in time never needs to be changed, and the clock runs precisely in time with the guest TSC, at the rate advertised in the pvclock structure. The third definition C is implemented in kvm_get_wall_clock_epoch() and __get_kvmclock(), using the master_cycle_now and master_kernel_ns fields but converting the *host* TSC cycles directly to a value in nanoseconds instead of scaling via the guest TSC. One might naïvely think that all three definitions are identical, since CLOCK_MONOTONIC_RAW is not skewed by NTP frequency corrections; all three are just the result of counting the host TSC at a known frequency, or the scaled guest TSC at a known precise fraction of the host's frequency. The problem is with arithmetic precision, and the way that frequency scaling is done in a division-free way by multiplying by a scale factor, then shifting right. In practice, all three ways of calculating the KVM clock will suffer a systemic drift from each other. Eventually, definition C should just be eliminated. Commit |
||
|
Dmytro Maluka
|
b41f2ca6c0 |
KVM: VMX: Fix stale PID-pointer table entry left after vCPU free
vCPU creation in kvm_vm_ioctl_create_vcpu() may fail after
kvm_arch_vcpu_create() -> vmx_vcpu_create() already succeeded. In such
case kvm_vm_ioctl_create_vcpu() destroys the newly created vCPU in the
failure path. However, that leaves a side effect: the IPIv pid_table
entry remains configured with this vCPU's pi_desc address. As a result,
when another vCPU sends an IPI to the APIC ID of this failed-to-create
vCPU, it will cause HW to write to this (freed!) pi_desc memory. [*]
Fix this by clearing the pid_table entry when destroying the vCPU.
Note that the same issue exists for SVM AVIC as well [1], to be fixed.
[*] Although, since this memory is freed into the kvm_vcpu_cache kmem
cache which is only used for allocating kvm_vcpus, _maybe_ this
memory will only be reused for pi_desc of another vCPU, not for
anything else. So _maybe_ this will only result in delivering the
IPI to a wrong vCPU (possibly of another VM) in the worst case, not
in a random corruption of kernel memory.
Link: https://lore.kernel.org/kvm/al4rNqpBYy8FGKPw@blrnaveerao1 [1]
Signed-off-by: Dmytro Maluka <dmaluka@chromium.org>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Link: https://patch.msgid.link/20260729170621.308809-3-dmaluka@chromium.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
||
|
Sean Christopherson
|
9fd7a4433d |
KVM: x86: Rework kvm_x86_ops.vcpu_pre_run() into .vcpu_needs_initialization()
Rework .vcpu_pre_run() into a more specific .vcpu_needs_initialization() to consolidate the SNP and TDX control flows, and to eliminate the potentially confusing almost-collision between svm_vcpu_pre_run() and pre_sev_run(): the former is SEV specific, but is pre-KVM_RUN, whereas the latter is pre-VMRUN. Link: https://patch.msgid.link/20260731173340.2644656-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Sean Christopherson
|
281a4e5f10 |
KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation
Synthesize SHUTDOWN (for L1) if L2 requires unhandleable emulation after
loading guest state from SMRAM during RSM to prevent a misbehaving L1 (or
userspace via L1) from tripping the sanity check that KVM doesn't try to
cancel a pending nested VM-Enter. If SMRAM is modified such that RSM will
load what should be impossible state for L2, then KVM will detect that it
needs to emulate the current code stream and will abort VM-Entry to L2.
And because KVM (rightly) expects such a scenario to be impossible, KVM
WARNs and bugs the VM.
__ret && !(vcpu->kvm)->vm_bugged
WARNING: arch/x86/kvm/vmx/vmx.c:6741 at vmx_handle_exit+0x65/0x790 [kvm_intel], CPU#13: vmx_invalid_nes/2902
Modules linked in: kvm_intel kvm irqbypass [last unloaded: kvm]
CPU: 13 UID: 1000 PID: 2902 Comm: vmx_invalid_nes Tainted: G W 7.2.0-rc2 #124 PREEMPT
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:vmx_handle_exit+0x65/0x790 [kvm_intel]
Call Trace:
<TASK>
kvm_arch_vcpu_ioctl_run+0xdf8/0x1d00 [kvm]
kvm_vcpu_ioctl+0x2d5/0x960 [kvm]
__x64_sys_ioctl+0x8a/0xd0
do_syscall_64+0xb7/0x570
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
Alternatively, KVM could suppress the WARN for the RSM case, but that would
still leave the vCPU in a "bad" state that KVM doesn't know how to handle
(which is also why KVM rejects attempts to do KVM_RUN when the vCPU is
loaded with invalid state). And architecturally, the Intel SDM explicitly
states that RSM leads to shutdown if the CPU detects invalid state.
Fixes:
|
||
|
Sean Christopherson
|
a40764607e |
KVM: x86: Extract VMX's unhandleable emulation check to common x86
Expose VMX's check for unhandleable emulation as its own kvm_x86_ops hook, and move the actual pre-KVM_RUN check into common x86. This will allow sharing the core logic with KVM's RSM emulation without needed to add a post-RSM hook, and is a step towards removing the .vcpu_pre_run() hook entirely. Alternatively, KVM could provide a post-RSM hook as mentioned, but pre/post hooks tend to be unwieldy as the exact "timing" of the call often matters greatly. E.g. in this case, the call must slot in exactly between loading guest state from SMRAM and the hack to force the vCPU out of L2 on SHUTDOWN. Link: https://patch.msgid.link/20260731173340.2644656-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Jim Mattson
|
0aaedada60 |
KVM: VMX: Cap VMX preemption timer to work around Intel erratum
Due to a widespread Intel erratum (e.g. EMR158), programming the VMX-preemption timer with certain large values may cause the timer to expire earlier than expected. The recommended workaround is to cap the VMX-preemption timer value to strictly less than: 2^25 * CPUID.15H:EBX[31:0] / CPUID.15H:EAX[31:0]. Calculate the maximum "safe" preemption timer value during hardware setup based on CPUID 15H when available, and use the adjusted max value in all locations where KVM currently hardcodes the max architectural value, including in the subtle case where KVM soft-disables the timer. Don't apply the workaround when running as a VM, because absent explicit enumeration to state the bug is present (or not), it's L0's responsibility to faithfully emulate/virtualize the VMX preemption timer. WARN if the above logic would result in a max value of zero and fall back to the maximum architectural value, as the expectation is that real hardware will never provide problematic EAX/EBX values (which is another reason to ignore the erratum when running as a VM; there's less chance of a false positive on the WARN due to L0 providing an unanticipated ratio). Reported-by: Sean Christopherson <seanjc@google.com> Closes: https://lore.kernel.org/all/Zn9X0yFxZi_Mrlnt@google.com/ Suggested-by: Chao Gao <chao.gao@intel.com> Assisted-by: Gemini:Gemini-Next Reviewed-by: Chao Gao <chao.gao@intel.com> Signed-off-by: Jim Mattson <jmattson@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> [sean: track inclusive max instead of exclusive limit, massage changelog] Link: https://patch.msgid.link/20260731171926.2629627-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |