mirror of
https://github.com/torvalds/linux.git
synced 2026-11-07 06:17:02 +01:00
v7.4-rc1
807 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
9c7e3d5910 |
hyperv-next for v7.4-rc1
-----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmri3mgTHHdlaS5saXVA a2VybmVsLm9yZwAKCRB2FHBfkEGgXpRSB/49w0SPLd5RYa+fdq3qdvwr6+UJbkxp +F0n4keD03UCEcKljMsUBKdhD3qJnj1IB0/NR34Pr7YR4Yhv0YxodQK40nWBCFLd nsc99jw+d7TbepxsVwGqiwIzaWtidJwLw7DoBbagGUYFAFVkxlj6W+7S2e6hKcJH pDx92x5myMpUyEKuA8DNTWyMLNk9iysPxvQq/WSjY36roxkdvA5pwDhzi3hLoZw4 kfLuT+yKtKGwL+1dhn4gz0aYsuIq1wu36GlPMRfDU+cl96KGHEnUW861JrnqHpaU ccTRX7O2yKUSjPaYZZaqPa1ZW8R5L9DEpQxJA1Ilaw4Z9rXaQUmqC3OR =A5Bb -----END PGP SIGNATURE----- Merge tag 'hyperv-next-signed-20261028' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Update to documents and code comments (Michael Kelley) - Harden Vmbus (Kameron Carr) - Rework MSHV driver page deposit logic (Mukesh Rathor) - Vmbus kexec bug fix (Shradha Gupta) - Miscellaneous bug fixes (Daehyeon Ko, Jiale Yao, Sasha Levin) * tag 'hyperv-next-signed-20261028' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: Remove leftover support for old Hyper-V versions mshv: Remove unused *_old memory deposit functions mshv: Redesign hypervisor memory deposit logic mshv: Rename memory deposit memory functions to _old mshv_vtl: reject poll files with multiple waitqueues mshv_vtl: detach poll waiter on POLLFREE mshv_vtl: initialize poll file mutex before device registration Documentation: hyperv: Update information on guest CPU offlining Documentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2 Drivers: hv: Run VMBus kexec cleanup from syscore shutdown kexec: Add helper to report an active kexec reboot tools: hv: remove unused rte_smp_mb() Documentation: hyperv: Update documentation for sending VMBus packets Drivers: hv: vmbus: Check ACPI companion before use Documentation: hyperv: Describe validation of the ring buffer indices Drivers: hv: vmbus: Keep the ring byte counts sane for a bad index Drivers: hv: vmbus: Compute ring byte counts from a caller-held snapshot Drivers: hv: vmbus: Use *_ONCE() to access shared ring buffer indices Drivers: hv: vmbus: Bounds check the shared ring buffer indices |
||
|
Linus Torvalds
|
56070f00d0 |
ARM:
- pKVM state isolation: years after pKVM started being enabled upstream,
we finally get the basics in the form of state isolation. The vcpu state
is now off-limit for the host for protected VMs.
- pKVM also grows a hypervisor-private memory allocator, allowing it to
deal with sub-page allocation, much like everywhere else.
- pKVM also lands a trace_printk() equivalent, which hopefully will make
debugging a bit easier.
- First shot at annotating portions of the KVM/arm64 code to be extracted
and built on s390. The real fun is yet to come.
- Allow pre-faulting of stage-2 canonical mappings from userspace, joining
x86 and s390 in implementing this feature.
- Add a reverse mapping infrastructure for shadow stage-2, significantly
improving performance when MMU notifiers kick in, and avoiding full unmap
of all shadow tables for this VM.
- Next step of GICv5 enablement, adding support for the IRS block, and
providing both SPI and LPI support. This is the first point where
KVM/arm64 can support an SMP GICv5 guest.
- As a preliminary to eventually enabling CCA, add a bunch of
infrastructure to KVM/arm64, splitting some of the basic operations into
individual backends (normal VM, normal pKVM VM, protected pKVM VM). This
allows CCA to later slot in without polluting the rest of KVM with its
firmware-driven nonsense.
- Make ID registers immutable from the point where a vcpu is able to run,
even if it fails to run. This prevents KVM from sampling untrusted values.
- Restore some type checking to the EL2 object. KVM/arm64 originally had
some strong type checking between the kernel and the EL2 object, but
lost it along the way when the private hypercall interface was (somewhat
pointlessly) converted to SMCCC. Type checking is back, syscall style,
and with added sparse goodies.
- Expand the FFA support to FFA_NOTIFICATION_*, and add some sanitisation
of the protocol that pKVM relays to the "trusted" runtime.
- Make GICv3 RD assignment more robust to userspace nonsense
- Convert the remaining MMU fault handler backends to kvm_s2_fault_vma_info
and co., fixing a number of bugs in the process.
- Fix the SError/SEA selftests to be both more robust and less braindead.
- Fix a smattering of documentation bugs, some of them as a result of our
AI friends spitting out credible assertions based on non-existing symbols.
- The usual collection of low impact bug fixes (SMCCC, timers, PMU).
Loongarch:
- Add separate vmid support.
- Simplify MSI interrupt injection.
- Add crash hypercall support.
- Allow to set pv_feature until vCPU run.
- Enable HW page table walk automatically in selftests.
s390:
- rework page allocation for secure guest variable storage
- Selftests and documentation improvements.
- Replace get_zeroed_page with kzalloc.
- Fix corner cases of floating interrupt injection.
- Initial arm64 on s390 support.
x86:
- Clean up the handling of vcpu->arch.xen.long_mode to be consistent and
correctly handle 32-bit/64-bit alignment, and various other bug fixes have
accumulated over the months since v1.
- Grab KVM's SRCU "lock" in kvm_zap_gfn_range() to fix a recurring bug where
callers fail to do so.
- Fix a variety of issues in the pre-fault code that are mostly benign in the
current code base, but will show up in big ways if/when the pre-faulting
logic is used to implementing prefetch-on-fault for the TDP MMU.
- For PREEMPT_RT=y kernels, drop the rmaps' individual bit-spinlock and just
walk the rmaps' with mmu_lock taken. On the write side (which always uses
mmu_lock), the bit-spinlock was assuming that preemption was disabled, but
that is *not* true when rwlocks become sleepable.
- Prepare a memory_fault exit (paired with -EFAULT) when KVM hits an error
PFN, e.g. so that userspace can resolve transient issues instead of killing
the guest. Convert a variety of WARN()+EFAULT paths into KVM_BUG_ON()+EIO
so that KVM can hard commit to filling memory_fault on -EFAULTs that occur
in the page fault path.
- Fix a NX hugepage un-accounting bug where KVM would always uncharge the
shadow MMU, even when handling TDP MMU pages.
- Mask off the address space ID when checking for illegal usage of
kvm_set_internal_memslot() to prevent false negatives on the sanity check.
- Explicitly zero reserved flags when delivering a SynIC message to avoid
leaking a byte of stack information to the guest.
- Rework TDX's handling of the canonical MMU root level to not rely on
userspace to fill CPUID correctly, as doing so lets userspace trivially
trigger a KVM_BUG_ON().
- Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 &&
EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU
without PAE.
- Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when
preparing L2 state, to fix another way to confuse KVM's MMU (and because
real hardware also ignores EFER.LMA).
- Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect
all of the ways KVM can botch EFER.LMA vs. CR4.PAE.
- Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param
is only used to avoid what effectively amounts to a single memory write.
- Fix a mostly-benign bug where KVM can write through a guest's read-only
mapping due to not checking the error code when expediting emulated MMIO
page faults.
- Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that
userspace can provide migration compatibility between Rome and Milan+.
- Pend a KVM_REQ_EVENT request when an exception is morphed into a nested
VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit,
e.g. when injecting a page fault.
- Add support for PML on SVM.
- Add support for virtualizing Bus Lock Detect on SVM, and fix a number of
DR6 bugs and warts along the way.
- Fix a variety of warts in KVM's handling of guest TSC, kvmclock, and
timekeeping in general, as a (big) first step towards addressing several
longstanding problems with the kvmclock implementation. Most notably,
fix a precision issue where get_kvmclock_ns() computed the clock from
the *host* TSC without applying guest TSC scaling, causing systemic
drift from the values the guest computes from its own TSC.
- Rip out KVM's shadow timekeeping structures, now that ktime snapshots
are powerful enough to replace it.
- Misc fixes and cleanups.
x86 (AMD):
- Fix a benign-in-practice bug where KVM unintentionally sets a non-zero
error code when delivering exceptions to SEV-ES+ guests.
- Force a new ASID in both VMCBs on pCPU migration to fix a bug where KVM
can run a VMCB with a stale ASID due to the tracking being per-CPU, not
per-VMCB.
- Return INVALID_INPUT to the guest instead of exiting to userspace with
-EIO if KVM can't access "guest request" buffer, i.e. try to keep the
guest alive if the guest or userspace goofs.
x86 (Intel):
- Enable Notify VM-Exits (now called Instruction Timeout in the SDM) and Bus
Lock VM-Exits for TDX guests when they're enabled by userspace (KVM forgot
to wire up the TDX Module knobs).
- Move all common (between VMX and TDX) APIs/helpers to common.h/main.c, and
change all namespace prefixes from "vmx" to "vt".
- Fix a thankfully benign bug (due to other areas of KVM being hardened) where
userspace can bypass INIT_MEM_REGION's address wrap check by providing a
nr_pages that will overflow a u64 when converted to bytes, and fix an also-
benign off-by-one bug in the check (inclusive vs. exclusive).
- Set the vmcs.GUEST_ACTIVITY_STATE back to ACTIVE when userspace sets KVM's
mp_state to anything other than HALTED, e.g. so that a vCPU doesn't get
stuck in HLT if userspace emulates RESET.
guest_memfd:
- Take the invalidate lock when unbinding a dying file to fix a race with
kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation
count elevated. Not taking the lock in the first place was pure misguided
paranoid.
- When binding a memslot, purge the bindings if storing the new memslot fails,
as Xarray's "store range" API can subtly fail partway through.
- Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as
the memslot becomes reachable the instant the binding is installed.
- Don't grab a page refcount when reloading an SNP VMSA and stop returning a
"struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM
doesn't hold any unnecessary refcounts (the lifetime of the page is ensured
by MMU notifiers and similar hooks). Preventing unnecessary refcounts
greatly simplifies supporting in-place SHARED=>PRIVATE conversions.
- Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single
guest_memfd instance to be used for both PRIVATE and SHARED variations of
CoCo guests' memory (though not at the same time). This eliminates the need
to double allocate guest memory for TDX and SNP, and is basically a hard
requirement for pKVM, which relies on being able to preserve memory contents
on conversions.
- Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if
the filemap invalidate lock is contended. Punt on a proper fix for the
moment, as a proper fix likely involves reworking truncate_error_folio().
- Add a pile of selftests for in-place conversions.
- Misc guest_memfd cleanups
Generic:
- Move some configuration items to preprocessor symbols, to help with
arm-on-s390's need to compile the same code twice with different values.
- Allow KVM implementations to choose alternative device names, also for
s390's support of ARM virtualmachines.
- Switch the KVM-VFIO interface and external consumers over to standard
file-based reference counting, eliminating all external KVM symbol exports.
Selftests:
- Rework KVM selftest's handling of memory regions all so that PPC can force its
page table allocations to be naturally aligned.
- PPC support.
- Fix emulation of VMPTRST and VMPTRLD when eVMCS is in-use to match real
Hyper-V's behavior.
- Saturate L2's TSC frequency if stacking L1 and L2 scaling multipliers
exceeds what hardware supports, as attempting to run L2 with an illegal
multiplier will either cause VM-Entry to fail (VMX) or trigger a #GP when
writing MSR_AMD64_TSC_RATIO (SVM). The #GP is thankfully benign in the
grand scheme as even "unsafe" WRMSRs have exception fixup.
- Rework KVM selftest's handling of memory regions so that PPC can force its
page table allocations to be naturally aligned.
- Clean up selftest's VMX instruction helpers, and drop an absurd number of
completely useless return values, e.g. functions that unconditionally
return %true and then have every caller assert success.
- Add selftests support for Zhaoxin CPUs.
- Overhaul the TSC scaling test to add a regression test for the saturation
behavior, and to increase its coverage in general.
- Fix selftests usage various NUMA syscalls to account for an undocumented,
but known since 2007, off-by-one kernel bug. Add helpers to try and avoid
re-introducing the same flaws in the future.
- Automatically run xAPIC IPI migration test (between NUMA nodes) when
possible, as the entire point of the test is verify KVM's handling of page
migration of the APIC backing page.
- Misc cleanups.
-----BEGIN PGP SIGNATURE-----
iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmrYaaAUHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroMaqAf+ND/WF6yDd0wjfrIE7DUk+kiczU9b
W2WhnleqrXmakRN52o71KTfl1LL7FHPp0AC6d5Q08uoFt2RRqVo1NqBu/aE8JwcW
wMU+4llin7o+W5eRIoNyNjIPO5HZHDeGDtDqTcXPk5D23VkWJH6n59f4GbNESc08
DP1XvbQF8LuTJ4Kyby9Th+G18mWjSw9AGtSrxdzVzwHVWh6xyPIzm7+MhpV70Jfv
vGFijxbWD6Uq79lciVXi4tGVLRL6aQsxHpaWltY++I9tnMysbEZhfJGiY/Rr7fvi
XmbgFkPAHNVQafhYvcUH5KhYp+XEggQlJF8fgEDjTx3BBRBoZ0aWhpHlwA==
=E6+0
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM updates from Paolo Bonzini:
"ARM:
- pKVM state isolation: years after pKVM started being enabled
upstream, we finally get the basics in the form of state isolation.
The vcpu state is now off-limit for the host for protected VMs
- pKVM also grows a hypervisor-private memory allocator, allowing it
to deal with sub-page allocation, much like everywhere else
- pKVM also lands a trace_printk() equivalent, which hopefully will
make debugging a bit easier
- First shot at annotating portions of the KVM/arm64 code to be
extracted and built on s390. The real fun is yet to come
- Allow pre-faulting of stage-2 canonical mappings from userspace,
joining x86 and s390 in implementing this feature
- Add a reverse mapping infrastructure for shadow stage-2,
significantly improving performance when MMU notifiers kick in, and
avoiding full unmap of all shadow tables for this VM
- Next step of GICv5 enablement, adding support for the IRS block,
and providing both SPI and LPI support. This is the first point
where KVM/arm64 can support an SMP GICv5 guest
- As a preliminary to eventually enabling CCA, add a bunch of
infrastructure to KVM/arm64, splitting some of the basic operations
into individual backends (normal VM, normal pKVM VM, protected pKVM
VM). This allows CCA to later slot in without polluting the rest of
KVM with its firmware-driven nonsense
- Make ID registers immutable from the point where a vcpu is able to
run, even if it fails to run. This prevents KVM from sampling
untrusted values
- Restore some type checking to the EL2 object. KVM/arm64 originally
had some strong type checking between the kernel and the EL2
object, but lost it along the way when the private hypercall
interface was (somewhat pointlessly) converted to SMCCC. Type
checking is back, syscall style, and with added sparse goodies
- Expand the FFA support to FFA_NOTIFICATION_*, and add some
sanitisation of the protocol that pKVM relays to the "trusted"
runtime
- Make GICv3 RD assignment more robust to userspace nonsense
- Convert the remaining MMU fault handler backends to
kvm_s2_fault_vma_info and co., fixing a number of bugs in the
process
- Fix the SError/SEA selftests to be both more robust and less
braindead
- Fix a smattering of documentation bugs, some of them as a result of
our AI friends spitting out credible assertions based on
non-existing symbols
- The usual collection of low impact bug fixes (SMCCC, timers, PMU)
Loongarch:
- Add separate vmid support
- Simplify MSI interrupt injection
- Add crash hypercall support
- Allow to set pv_feature until vCPU run
- Enable HW page table walk automatically in selftests
s390:
- rework page allocation for secure guest variable storage
- Selftests and documentation improvements
- Replace get_zeroed_page with kzalloc
- Fix corner cases of floating interrupt injection
- Initial arm64 on s390 support
x86:
- Clean up the handling of vcpu->arch.xen.long_mode to be consistent
and correctly handle 32-bit/64-bit alignment, and various other bug
fixes have accumulated over the months since v1
- Grab KVM's SRCU "lock" in kvm_zap_gfn_range() to fix a recurring
bug where callers fail to do so
- Fix a variety of issues in the pre-fault code that are mostly
benign in the current code base, but will show up in big ways
if/when the pre-faulting logic is used to implementing
prefetch-on-fault for the TDP MMU
- For PREEMPT_RT=y kernels, drop the rmaps' individual bit-spinlock
and just walk the rmaps' with mmu_lock taken. On the write side
(which always uses mmu_lock), the bit-spinlock was assuming that
preemption was disabled, but that is *not* true when rwlocks become
sleepable
- Prepare a memory_fault exit (paired with -EFAULT) when KVM hits an
error PFN, e.g. so that userspace can resolve transient issues
instead of killing the guest. Convert a variety of WARN()+EFAULT
paths into KVM_BUG_ON()+EIO so that KVM can hard commit to filling
memory_fault on -EFAULTs that occur in the page fault path
- Fix a NX hugepage un-accounting bug where KVM would always uncharge
the shadow MMU, even when handling TDP MMU pages
- Mask off the address space ID when checking for illegal usage of
kvm_set_internal_memslot() to prevent false negatives on the sanity
check
- Explicitly zero reserved flags when delivering a SynIC message to
avoid leaking a byte of stack information to the guest
- Rework TDX's handling of the canonical MMU root level to not rely
on userspace to fill CPUID correctly, as doing so lets userspace
trivially trigger a KVM_BUG_ON()
- Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with
EFER.LMA=1 && EFER.LME=0, which confuses KVM into trying to
configure an 64-bit MMU without PAE
- Ignore EFER.LMA (clear it from KVM's cached save state) if
EFER.LME=0 when preparing L2 state, to fix another way to confuse
KVM's MMU (and because real hardware also ignores EFER.LMA)
- Improve KVM's sanity checks for a misconfigured MMU to (hopefully)
detect all of the ways KVM can botch EFER.LMA vs. CR4.PAE
- Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the
param is only used to avoid what effectively amounts to a single
memory write
- Fix a mostly-benign bug where KVM can write through a guest's
read-only mapping due to not checking the error code when
expediting emulated MMIO page faults
- Honor the guest's view of the "EFER.LMSLE must be zero" defeature
so that userspace can provide migration compatibility between Rome
and Milan+
- Pend a KVM_REQ_EVENT request when an exception is morphed into a
nested VM-Exit, otherwise KVM can fail to actually deliver the
nested VM-Exit, e.g. when injecting a page fault
- Add support for PML on SVM
- Add support for virtualizing Bus Lock Detect on SVM, and fix a
number of DR6 bugs and warts along the way
- Fix a variety of warts in KVM's handling of guest TSC, kvmclock,
and timekeeping in general, as a (big) first step towards
addressing several longstanding problems with the kvmclock
implementation. Most notably, fix a precision issue where
get_kvmclock_ns() computed the clock from the *host* TSC without
applying guest TSC scaling, causing systemic drift from the values
the guest computes from its own TSC
- Rip out KVM's shadow timekeeping structures, now that ktime
snapshots are powerful enough to replace it
- Misc fixes and cleanups
x86 (AMD):
- Fix a benign-in-practice bug where KVM unintentionally sets a
non-zero error code when delivering exceptions to SEV-ES+ guests
- Force a new ASID in both VMCBs on pCPU migration to fix a bug where
KVM can run a VMCB with a stale ASID due to the tracking being
per-CPU, not per-VMCB
- Return INVALID_INPUT to the guest instead of exiting to userspace
with -EIO if KVM can't access "guest request" buffer, i.e. try to
keep the guest alive if the guest or userspace goofs
x86 (Intel):
- Enable Notify VM-Exits (now called Instruction Timeout in the SDM)
and Bus Lock VM-Exits for TDX guests when they're enabled by
userspace (KVM forgot to wire up the TDX Module knobs)
- Move all common (between VMX and TDX) APIs/helpers to
common.h/main.c, and change all namespace prefixes from "vmx" to
"vt"
- Fix a thankfully benign bug (due to other areas of KVM being
hardened) where userspace can bypass INIT_MEM_REGION's address wrap
check by providing a nr_pages that will overflow a u64 when
converted to bytes, and fix an also- benign off-by-one bug in the
check (inclusive vs. exclusive)
- Set the vmcs.GUEST_ACTIVITY_STATE back to ACTIVE when userspace
sets KVM's mp_state to anything other than HALTED, e.g. so that a
vCPU doesn't get stuck in HLT if userspace emulates RESET
guest_memfd:
- Take the invalidate lock when unbinding a dying file to fix a race
with kvm_gmem_invalidate_end() that results in KVM leaving the MMU
invalidation count elevated. Not taking the lock in the first place
was pure misguided paranoid
- When binding a memslot, purge the bindings if storing the new
memslot fails, as Xarray's "store range" API can subtly fail
partway through
- Establish memslot<=>guest_memfd bindings *after* the memslot is
ready, as the memslot becomes reachable the instant the binding is
installed
- Don't grab a page refcount when reloading an SNP VMSA and stop
returning a "struct page" from guest_memfd's PFN lookup altogether,
to ensure that KVM doesn't hold any unnecessary refcounts (the
lifetime of the page is ensured by MMU notifiers and similar
hooks). Preventing unnecessary refcounts greatly simplifies
supporting in-place SHARED=>PRIVATE conversions
- Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a
single guest_memfd instance to be used for both PRIVATE and SHARED
variations of CoCo guests' memory (though not at the same time).
This eliminates the need to double allocate guest memory for TDX
and SNP, and is basically a hard requirement for pKVM, which relies
on being able to preserve memory contents on conversions
- Hack-a-fix a deadlock bug in ->error_remove_folio() by returning
-EBUSY if the filemap invalidate lock is contended. Punt on a
proper fix for the moment, as a proper fix likely involves
reworking truncate_error_folio()
- Add a pile of selftests for in-place conversions
- Misc guest_memfd cleanups
Generic:
- Move some configuration items to preprocessor symbols, to help with
arm-on-s390's need to compile the same code twice with different
values
- Allow KVM implementations to choose alternative device names, also
for s390's support of ARM virtualmachines
- Switch the KVM-VFIO interface and external consumers over to
standard file-based reference counting, eliminating all external
KVM symbol exports
Selftests:
- Rework KVM selftest's handling of memory regions all so that PPC
can force its page table allocations to be naturally aligned
- PPC support
- Fix emulation of VMPTRST and VMPTRLD when eVMCS is in-use to match
real Hyper-V's behavior
- Saturate L2's TSC frequency if stacking L1 and L2 scaling
multipliers exceeds what hardware supports, as attempting to run L2
with an illegal multiplier will either cause VM-Entry to fail (VMX)
or trigger a #GP when writing MSR_AMD64_TSC_RATIO (SVM). The #GP is
thankfully benign in the grand scheme as even "unsafe" WRMSRs have
exception fixup
- Rework KVM selftest's handling of memory regions so that PPC can
force its page table allocations to be naturally aligned
- Clean up selftest's VMX instruction helpers, and drop an absurd
number of completely useless return values, e.g. functions that
unconditionally return %true and then have every caller assert
success
- Add selftests support for Zhaoxin CPUs
- Overhaul the TSC scaling test to add a regression test for the
saturation behavior, and to increase its coverage in general
- Fix selftests usage various NUMA syscalls to account for an
undocumented, but known since 2007, off-by-one kernel bug. Add
helpers to try and avoid re-introducing the same flaws in the
future
- Automatically run xAPIC IPI migration test (between NUMA nodes)
when possible, as the entire point of the test is verify KVM's
handling of page migration of the APIC backing page
- Misc cleanups"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (506 commits)
KVM: always make in-place conversion a compile-time constant when possible
KVM: x86: leave the legacy private attribute in for TDX and SEV
KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of KVM_VM_MEMORY_ATTRIBUTES
selftests: kvm: remove useless comma operator
arm64: Use proper include variant
MAINTAINERS: Add entry for ARM on s390 KVM
KVM: s390: arm64: Integrate arm on s390
KVM: s390: arm64: Implement basic page fault handler
KVM: s390: arm64: Implement vCPU IOCTLs
KVM: s390: arm64: Implement vm/vcpu create destroy
KVM: s390: arm64: Implement required functions
KVM: s390: Add basic arm64 kvm module
s390/hwcaps: Report SAE support as hwcap
KVM: s390: arm64: Introduce host definitions
s390: Introduce Start Arm Execution instruction
KVM: s390: Use arm64 code
s390/tools: Use arm64 headers
KVM: s390: Use dedicated function for migration mode
s390/Kconfig: remove PCI dependency from HAS_IOMEM
KVM: s390: Kick PV cpus at the right time for service irqs
...
|
||
|
Linus Torvalds
|
7cd80b8168 |
ARCH=um updates:
- NOMMU support, mostly for mm/ testing
The only bigger change, we added support for building with
!CONFIG_MMU, mostly for testing, e.g. via kunit. Some new
selftests targetted to NOMMU are moving elsewhere, but are
runnable on ARCH=um without MMU.
- Tighter page permissions
Tighten page permissions to catch more bugs (ARCH=um is,
after all, often used for testing), and also mark __init
memory inaccessible for the same reason.
- Various maintenance/cleanups
Fix build on really old hosts, fix leaks, make the code a
bit more robust, header cleanups, typo fixes, the usual.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmrYc78ACgkQ10qiO8sP
aAC06Q/9Fx+5BID0egPcp0FOD/AhK6eWrMIxQ5n1z0g3UUKU/UvZcs/XiApUfn3B
JB9yVT2Knm+JQiP/nWkUVt6IkoMOcMN/TmYLp55wZrJkUMys3FJnHWMs4TDIjlJV
nZ+Z8SDtCEDKXxvoUYDt+TqVIGbnhLAjNJlYzX3GLdrS09f5TwCVz7rda3mTEz0B
WoimFVmwPCLZcTqZOgzRCiv3BdBJlNraMUOrXaLxpJgtrBRRS62YTlUHRt2dI2sw
dBBChRI8ZxKF8kxGznt3+3av2/t3dlaT0BA6erb69X2kMSsDJChkUVZfWitg17d4
GcSRL3XeuybuO03Nda0zRkSRTYPmcK/rWqX4T+ujG2CBw0shfKo8yuTd++oLXpQS
sQPh8aFRvJ09hTHTtJur6oHAfX8klfvdUAffpnuySOpcHPdzjEjcgNtXJtunAPaE
deXqoqv2MMwF4tVyQH+zm0v6exlslls6RkzjaRvLhKT9jf6oo8Kbhew2ut0KheRI
Yts5gdzxr7DGM0w+IhOHGNdJL1AMD1se7N8iAvdg+Md9L7IvOycpJf7xGT2eUubT
my03KEMUfAPkX1IALCSJqi5gBnx9mrxhf/JM44qk0SCp6RSkcbipW/2tbX5bI+He
aa/Tm9KGDRhF3uxLvBGCt3Yuo67CT91WLUExQvs2+kfxKxVYhGg=
=bKwe
-----END PGP SIGNATURE-----
Merge tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux
Pull UML updates from Johannes Berg:
- NOMMU support, mostly for mm/ testing
The only bigger change, we added support for building with
!CONFIG_MMU, mostly for testing, e.g. via kunit. Some new
selftests targetted to NOMMU are moving elsewhere, but are
runnable on ARCH=um without MMU.
- Tighter page permissions
Tighten page permissions to catch more bugs (ARCH=um is,
after all, often used for testing), and also mark __init
memory inaccessible for the same reason.
- Various maintenance/cleanups
Fix build on really old hosts, fix leaks, make the code a
bit more robust, header cleanups, typo fixes, the usual.
* tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits)
um: place large BSS inputs in an output section
um: fix shutdown __inittext access
um: time-travel: fix sched_yield() behaviour
um: require MMU for UML PCI support
um: vector: avoid NULL queue dereference in legacy RX mode
um: use %pB to print functions in stack traces
um: mprotect() __init memory
um: move init text between __init_begin/end
um: improve checking for --no-warn-rwx-segments
um: make stub compilation more robust
um: link .lbss/.ldata/.lrodata correctly
um: add perf-event support
x86/um: remove unused <asm/required-features.h> header
um: fix typo "hander" in comment
um: Add definition of __NR_close_range for older host OSs
um: virtio_uml: switch to dynamic root device
um: Tighten exec permissions on page mappings
Documentation: um: document nommu UML
um: allow deselecting CONFIG_MMU
um: nommu: add userspace runner processes
...
|
||
|
Michael Kelley
|
daa782262e |
Documentation: hyperv: Update information on guest CPU offlining
In Hyper-V Overview documentation, remove the out-of-date reference to explicitly reassigning VMBus channel interrupts before taking a guest CPU offline. Instead, reference the VMBus documentation, which is already up-to-date on this topic. Signed-off-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Reviewed-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> |
||
|
Michael Kelley
|
7b5903dea8 |
Documentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2
Support for running Linux guests on Windows Server 2012/2012 R2 Hyper-V hosts and Windows 8/8.1 hosts has been removed, which includes removing support for operating Hyper-V synthetic timers in other than Direct Mode. Update the documentation to reflect these removals. Signed-off-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Naman Jain <namjain@linux.microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> |
||
|
Shradha Gupta
|
228e21764b |
Drivers: hv: Run VMBus kexec cleanup from syscore shutdown
ARM64 Hyper-V guests do not run the VMBus kexec cleanup before secondary CPUs are stopped. Consequently, the old VMBus connection and SynIC state remain active when the kexec kernel starts. Run the VMBus kexec handler from the existing VMBus syscore shutdown callback. syscore_shutdown() runs after device shutdown and before machine shutdown, while all CPUs needed by the SynIC CPU hotplug teardown are still available. Guard the callback with kexec_is_in_progress() so normal restart, halt, and poweroff paths are unchanged. Use the same path on x86 and remove the architecture-specific handler pointer and the weak setup/remove interfaces. VMBus teardown now precedes hv_stimer_global_cleanup() on x86. The new x86 ordering relies on commit |
||
|
Michael Kelley
|
6a3d77a0a8 |
Documentation: hyperv: Update documentation for sending VMBus packets
The functions for sending VMBus packets have changed.
vmbus_sendpacket_mpb_desc() can target multiple ranges, and
vmbus_sendpacket_pagebuffer() has been removed. vmbus_sendpacket_getid()
has been added. Update the documentation accordingly.
Fixes:
|
||
|
Kameron Carr
|
6eb81a2a06 |
Documentation: hyperv: Describe validation of the ring buffer indices
Document that the guest must snapshot and validate the read and write indices before using them to index into the ring buffer or to compute the available space. Signed-off-by: Kameron Carr <kameroncarr@linux.microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> |
||
|
Paolo Bonzini
|
814607cd40 |
KVM: s390: Changes for 7.4
- rework page allocation for secure guest variable storage - selftests - documentation - replace get_zeroed_page with kzalloc - fix floating interrupt inject for corner cases - initial arm64 on s390 support This also contains the patch "arm64: Use proper include variant" as a build fix. It is also part of the arm tree. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+SKTgaM0CPnbq/vKEXu8gLWmHHwFAmrQw/gACgkQEXu8gLWm HHwfkhAAgTzwSx9QbBPFMyCsHbKZNgK5x4vieL9E04NV8XbvcEBAXE3xgbVadMNK sbqQ6kjuUrJIa9XG4BCjZwfAKqwGh9DGVGAvIbOjtIP17mt2dqVPZeGrimbromaa K6h7uKHTxm5SyQ6Ld/OpzTOJAf/S2uKwuoKcHh05NNNcjC1CFnV0PV8PIHIPVGsw PLUlZ/MfsPjUH6RA1CjstHRRSAv6DajIriCqS6mGCj03VJIph1uGgdEhbA0iiUyy NPHnpikLct9BsyqNL3IVCh0KwYeFzBTzcLOfbZRq4zu3wxbPU/F1Ee+G3AnjNMzW iz6V+xZcmq2c9pN45vIAzsU68UJ+3CWSyh41ivj9rZngoHhTCPy6iywIxwioh6ki 5BCunmZ4wOjXmoirlhaW6bytsFVKeHNxI2uz1FkRAy+AkzFwTHWE401yPZYJI7dd F+7d4toXkVC8sI35diRACcHy2SLtwRjPYxC7MF1dU3cCvpwPNkXJdJc4WYHuSROB syk+JmG3birkvJgcJE+yxyU4ZEzEaQOPX68rVKkWrtYIr7PGReJWKUADhinZc1dn g9zOY3x1E5s6eL3dM/mGbKJF3HYcTNWmaqSTVhniGWD4NKcgpT7s0hEiy39zBjKB mNrrYcUT1HJaa034u15BhgNH5z1IKClzdwjSYK6r/junsAuIZhc= =e48p -----END PGP SIGNATURE----- Merge tag 'kvm-s390-next-7.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Changes for 7.4 - rework page allocation for secure guest variable storage - selftests - documentation - replace get_zeroed_page with kzalloc - fix floating interrupt inject for corner cases - initial arm64 on s390 support This also contains the patch "arm64: Use proper include variant" as a build fix. It is also part of the arm tree. |
||
|
Paolo Bonzini
|
7213f4e515 |
KVM x86 misc changes for 7.4
- Mask off the address space ID when checking for illegal usage of
kvm_set_internal_memslot() to prevent false negatives on the sanity check.
- Explicitly zero reserved flags when delivering a SynIC message to avoid
leaking a byte of stack information to the guest.
- Rework TDX's handling of the canonical MMU root level to not rely on
userspace to fill CPUID correctly, as doing so lets userspace trivially
trigger a KVM_BUG_ON().
- Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 &&
EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU
without PAE.
- Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when
preparing L2 state, to fix another way to confuse KVM's MMU (and because
real hardware also ignores EFER.LMA).
- Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect
all of the ways KVM can botch EFER.LMA vs. CR4.PAE.
- Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param
is only used to avoid what effectively amounts to a single memory write.
- Fix a mostly-benign bug where KVM can write through a guest's read-only
mapping due to not checking the error code when expediting emulated MMIO
page faults.
- Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that
userspace can provide migration compatibility between Rome and Milan+.
- Pend a KVM_REQ_EVENT request when an exception is morphed into a nested
VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit,
e.g. when injecting a page fault.
- Add support for PML on SVM.
- Add support for virtualizating Bus Lock Detect on SVM, and fix a number of
DR6 bugs and warts along the way.
- Misc fixes and cleanups.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmrRkRcACgkQOlYIJqCj
N/2ELw/8Cq0r7Hs0qVP9/IOc9jC5ET/5it1U5FkxYu2Amvzi18fFSUdOJz2cPMRs
UPGEL4fhQVBUqRmpphpxZm5uA2yrWRFaLG6y3EHqsFNMJvviLrX6+exeS8zUYpYz
LRoWhJa6V+QtQ4/1sqD3heL4Xdla/AGcyegVuukasvEFov5+cG2h/MecjB/wY5/I
bgnuBzhcG9uKYZ2ovA1ZCfPheDFdHLlZvRDHAb1H8Wl2GEJzjsQaFJ73PdtOM+8b
bVi1iyXw1Rb5ERYMfoidl4XaP/G7a3jZ/WsHw9iV2NUipChpCN0bzK+98Xe/6jhc
C0drBI/LQlPzsFdHPBCPIRznpGEOorsiYVxT4FOdbF4rVQREC8GdJ+FaHz+l5v0c
UOB9f8SxIiD7L5sS+7JPMlBcqFBiTOwll8wt1bbkQWkEuC4D7gnZL76LX6fftmvD
AgRGQllvDL2/tga+qex1LKFvrdDaRI3jHKafT+zrMUybB8u8enG6hxGogpuUxM1G
zCzc3FeUp9ZM0Ik+1DX2qEuOiwDpu3PaIEJyEPutm+L2MmEi6ujKmhxIlWQJUl79
NbxMjdWzrhqyV9FJMOy4ZZfTzf4yUfT6Unc40A2fNpHzZLOb6HD37LVfV8v7/oeh
fZuVesjNQ4ULhZgHR5qabBoTXiHMRqEQxAJZxlx5e5eKjEEjp2Q=
=W1tV
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-misc-7.4' of https://github.com/kvm-x86/linux into HEAD
KVM x86 misc changes for 7.4
- Mask off the address space ID when checking for illegal usage of
kvm_set_internal_memslot() to prevent false negatives on the sanity check.
- Explicitly zero reserved flags when delivering a SynIC message to avoid
leaking a byte of stack information to the guest.
- Rework TDX's handling of the canonical MMU root level to not rely on
userspace to fill CPUID correctly, as doing so lets userspace trivially
trigger a KVM_BUG_ON().
- Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 &&
EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU
without PAE.
- Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when
preparing L2 state, to fix another way to confuse KVM's MMU (and because
real hardware also ignores EFER.LMA).
- Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect
all of the ways KVM can botch EFER.LMA vs. CR4.PAE.
- Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param
is only used to avoid what effectively amounts to a single memory write.
- Fix a mostly-benign bug where KVM can write through a guest's read-only
mapping due to not checking the error code when expediting emulated MMIO
page faults.
- Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that
userspace can provide migration compatibility between Rome and Milan+.
- Pend a KVM_REQ_EVENT request when an exception is morphed into a nested
VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit,
e.g. when injecting a page fault.
- Add support for PML on SVM.
- Add support for virtualizing Bus Lock Detect on SVM, and fix a number of
DR6 bugs and warts along the way.
- Misc fixes and cleanups.
|
||
|
Paolo Bonzini
|
29c925376d |
KVM guest_memfd and CoCo changes for 7.4
- Take the invalidate lock when unbinding a dying file to fix a race with
kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation
count elevated. Not taking the lock in the first place was pure misguided
paranoid.
- When binding a memslot, purge the bindings if storing the new memslot fails,
as Xarray's "store range" API can subtly fail partway through.
- Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as
the memslot becomes reachable the instant the binding is installed.
- Don't grab a page refcount when reloading an SNP VMSA and stop returning a
"struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM
doesn't hold any unnecessary refcounts (the lifetime of the page is ensured
by MMU notifiers and similar hooks). Preventing unnecessary refcounts
greatly simplifies supporting in-place SHARED=>PRIVATE conversions.
- Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single
guest_memfd instance to be used for both PRIVATE and SHARED variations of
CoCo guests' memory (though not at the same time). This eliminates the need
to double allocate guest memory for TDX and SNP, and is basically a hard
requirement for pKVM, which relies on being able to preserve memory contents
on conversions.
- Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if
the filemap invalidate lock is contended. Punt on a proper fix for the
moment, as a proper fix likely involves reworking truncate_error_folio().
- Add a pile of selftests for in-place conversions.
- Misc guest_memfd cleanups
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmrRipMACgkQOlYIJqCj
N/0gbg/7BgQ72N9KIke30rHHgKcmpyxYBZe1r/yKhWyYPcpGjX+7UxeoGegv2CRS
pbnr0fTAKKlCXRFRVcHrwg2bXY3tLgWMK3i/jGFmh3i6buii3iYRFT0kl63jt1S6
Ai72VKhAp/EmzzAI9RaWnU2BRAVlD2uurrBIy/N28vgWzfgIFWyOEGSXOyyrn3vG
BZBbSDPBqYJ2vYuj6UbHfLRbFmtyNWVM/XL+Lm3i6HKZ2uvfwWZSa7w5kqJZ+2hV
2+P5Ipu0KZkIumxHkndzZuFNtorwIHxbDGwvbyyKrgsREfRnywCGFxTJA8+bxQtm
IzFx/2UK71Bg4eKN+SGkt242SqjI+zaZWF1NahGsgRO3spRikWNS11+jEjtEiYsw
H0N+q1rWr4CM6T063aw0TqqNDrpOrxdFBjY75T2jmhNSmgkwnizhi3NO5bIwfgfi
tioLDXhg6XAPLPOk6xLgaaJnyVFS0aqB1lHVhftDsgtvHpCcpOxXU2g89jf3HZ0q
8smglIn4mDhZYtQoswT4sBad0ZCTNEUncyCNhnWNyBkG3GwJEMGRgE2HMxtiKIAm
6eUSrpMpvVBArSJTyb73GWBMioxaPcuTdWAAmUAgs9RfITGgskxSYv7ZJM2kEh3g
0EGpQe2yK1Ul3hKzI1Ty+rZfCqHNcx6P65pDhKG6tvlxxewfinc=
=Jrvd
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-coco-7.4' of https://github.com/kvm-x86/linux into HEAD
KVM guest_memfd and CoCo changes for 7.4
- Take the invalidate lock when unbinding a dying file to fix a race with
kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation
count elevated. Not taking the lock in the first place was pure misguided
paranoid.
- When binding a memslot, purge the bindings if storing the new memslot fails,
as Xarray's "store range" API can subtly fail partway through.
- Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as
the memslot becomes reachable the instant the binding is installed.
- Don't grab a page refcount when reloading an SNP VMSA and stop returning a
"struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM
doesn't hold any unnecessary refcounts (the lifetime of the page is ensured
by MMU notifiers and similar hooks). Preventing unnecessary refcounts
greatly simplifies supporting in-place SHARED=>PRIVATE conversions.
- Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single
guest_memfd instance to be used for both PRIVATE and SHARED variations of
CoCo guests' memory (though not at the same time). This eliminates the need
to double allocate guest memory for TDX and SNP, and is basically a hard
requirement for pKVM, which relies on being able to preserve memory contents
on conversions.
- Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if
the filemap invalidate lock is contended. Punt on a proper fix for the
moment, as a proper fix likely involves reworking truncate_error_folio().
- Add a pile of selftests for in-place conversions.
- Misc guest_memfd cleanups
Conflicts in arch/arm64/kvm/mmu.c: convert to use s2vi.
|
||
|
Eric Farman
|
bbfbe09b28 |
Documentation: Add missing KVM s390 crypto attributes
Device attributes to enable/disable the AP interpretive execution
support for crypto were added to KVM several years ago, but they
weren't added to the documentation itself.
Fixes:
|
||
|
Marc Zyngier
|
0ff05136bb |
Merge branch kvm-arm64/pkvm-state-7.4 into kvmarm-master/next
* kvm-arm64/pkvm-state-7.4:
: \
: State protection for protected pKVM guests, finally starting to deliver
: on its promises... Patches courtesy of Fuad Tabba.
:
: "Following the vCPU state-sync series, this series completes the
: job for protected VMs: a protected guest's register state stays at
: EL2, and the host sees only what handling each exit requires."
: /
KVM: arm64: Only emulate an SError's entry for vCPUs with NV
KVM: arm64: Document the protected VM userspace API
KVM: arm64: Advertise the capabilities that protected VMs support
KVM: arm64: Reject host power-on of a vCPU that EL2 holds powered off
KVM: arm64: Reject host access to protected VM private state
KVM: arm64: Add per-EC entry/exit state marshalling for protected guests
KVM: arm64: Inject an UNDEF at EL2 for unhandled protected guest exits
KVM: arm64: Prevent host PC adjustments for protected vCPUs
KVM: arm64: Restrict KVM_ARM_VCPU_INIT and PSCI version for protected VMs
KVM: arm64: Handle PSCI calls for protected VMs at EL2
KVM: arm64: Implement HVC handling for protected guests at EL2
KVM: arm64: Add system register reset framework for protected VMs
KVM: arm64: Add {flush,sync}_hyp_timer_state() primitives
KVM: arm64: Skip fixed-feature state flush for protected vCPUs
KVM: arm64: Introduce per-EC entry handlers for pKVM
KVM: arm64: Disable steal time for protected VMs
KVM: arm64: Pin the host vCPU before adjusting its PC under pKVM
KVM: arm64: Validate the host vCPU's VM before reading it under pKVM
KVM: arm64: Sync HCR_EL2.VSE back to the host vCPU under pKVM
Signed-off-by: Marc Zyngier <maz@kernel.org>
|
||
|
Marc Zyngier
|
62449bbaef |
Merge branch kvm-arm64/pre-faulting into kvmarm-master/next
* kvm-arm64/pre-faulting: : \ : Enable stage-2 pre-faulting in the canonical IPA space, implementing the : KVM_PRE_FAULT_MEMORY API. Patches courtesy of Lorenzo Stoakes, and based : on an initial work by Jack Thomson. : / KVM: selftests: Add nested pre-fault test for arm64 KVM: selftests: Add option for different backing in pre-fault tests KVM: selftests: Enable pre_fault_memory_test for arm64 Documentation: KVM: document arm64 KVM_PRE_FAULT_MEMORY KVM: arm64: Implement KVM_PRE_FAULT_MEMORY KVM: arm64: Pass walk flags to kvm_pgtable_get_leaf() KVM: arm64: Propagate EHWPOISON in kvm_s2_fault_pin_pfn() KVM: arm64: Size the stage-2 memcache from the fault MMU KVM: arm64: Propagate and use kvm_s2_fault_result on S2 fault KVM: arm64: Propagate and use mmu in s2fd when handling guest aborts KVM: arm64: Propagate and use esr in s2fd when handling guest aborts KVM: arm64: Use ESR helpers in guest abort handling arm64: Add ESR fault helpers KVM: Allow architectures to disallow pre-fault Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Marc Zyngier
|
c439fc9341 |
Merge branch kvm-arm64/gicv5-7.4 into kvmarm-master/next
* kvm-arm64/gicv5-7.4: (52 commits)
: \
: GICv5 IRS support, courtesy of Sascha Bischoff. From the cover letter:
:
: "This series builds on the initial vGICv5 support and adds support
: for the GICv5 IRS, as described by the GICv5 (EAC0) specification.
: With this, a GICv5 guest is no longer restricted to PPIs, and can make
: use of SPIs and LPIs as well."
: /
KVM: arm64: vgic-v5: Correctly handle host ISTE __le32 conversion
KVM: arm64: vgic-v5: Tidy-up programming of vpe descriptor address
KVM: arm64: vgic-v5: Correctly reset h_lpi_ist to NULL
KVM: arm64: vgic-v5: Drop __iomem attribute from {vmd,vpet}_base
KVM: selftests: Add VGICv5 sparse vCPU IDs test
KVM: selftests: Add VGICv5 IST save/restore coverage
KVM: selftests: Add VGICv5 LPI delivery tests
KVM: selftests: Add VGICv5 SPI injection tests
KVM: selftests: Add VGICv5 CPU sysreg attribute tests
KVM: selftests: Add VGICv5 USERSPACE_PPIS tests
KVM: selftests: Add VGICv5 IST attribute tests
KVM: selftests: Add VGICv5 IRS_REGS attribute tests
KVM: selftests: Add VGICv5 NR_IRQS attribute tests
KVM: selftests: Add VGICv5 IRS address attribute tests
Documentation: KVM: Add the VGICv5 IRS save/restore sequences
Documentation: KVM: Add docs for KVM_DEV_ARM_VGIC_GRP_IST
Documentation: KVM: Add KVM_DEV_ARM_VGIC_GRP_IRS_REGS to VGICv5 docs
Documentation: KVM: Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for VGICv5
KVM: arm64: gic-v5: Implement save/restore mechanisms for ISTs
KVM: arm64: gic-v5: Add VGICv5 IST save/restore UAPI
...
Signed-off-by: Marc Zyngier <maz@kernel.org>
|
||
|
Fuad Tabba
|
0ab1034969 |
KVM: arm64: Fix references to the non-existent VCPU_RUN ioctl
There is no VCPU_RUN ioctl. The one that enters the guest is KVM_RUN, so refer to it by that name. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260915084441.3846947-3-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Fuad Tabba
|
61ace86519 |
KVM: arm64: Document the protected VM userspace API
EL2 owns a protected vCPU's state once it has run, and the ioctls that would reach it fail rather than operate on the host copy, which holds the boot state the VMM wrote plus what the exit handlers copy out. Describe the resulting API in pkvm.rst, point api.rst at it from each ioctl that behaves differently, and say beside the PVTIME attribute in devices/vcpu.rst and the PSCI version register in fw-pseudo-registers.rst how protected VMs differ. The overview also states the GIC support pKVM enforces: GICv2 is not supported in protected mode (vgic-v2.c) and GICv5-based guests aren't registered under pKVM (vgic-v5.c). Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20261001135711.1640520-19-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Jim Mattson
|
7358d13e1f |
KVM: x86: Honor the guest's EFER_LMSLE_MBZ
Reject guest attempts to set EFER.LMSLE if userspace enumerates
EFER_LMSLE_MBZ, CPUID.80000008H:EBX[bit 20], in guest CPUID, so that userspace
can hide long mode segment limits from the guest even on CPUs that support
LMSLE, e.g. for migration compatibility between Rome and Milan.
Enumerate the defeature as *partially* emulated, i.e. as supported by KVM but
never advertised, so that kvm_vcpu_after_set_cpuid() propagates userspace's bit
into vcpu->arch.cpu_caps. Checking guest_cpu_cap_has() in __kvm_valid_efer()
doesn't suffice on its own, because KVM clears the defeature in kvm_cpu_caps
precisely on the CPUs where it needs to be emulated, i.e. cpu_caps would never
hold the bit no matter what userspace puts in guest CPUID. Don't advertise the
defeature in KVM_GET_SUPPORTED_CPUID, as that would take EFER.LMSLE away from
userspace that blindly stuffs KVM's supported CPUID into KVM_SET_CPUID2.
MONITOR/MWAIT gets the same treatment.
Enforce the defeature only for guest-initiated writes, as it's a guest CPUID
consistency check, not a host capability. See commit
|
||
|
Jim Mattson
|
192dbad1bc |
KVM: x86: Advertise EFER_LMSLE_MBZ when KVM disallows EFER.LMSLE
Set EFER_LMSLE_MBZ, CPUID.80000008H:EBX[bit 20], in KVM's supported CPUID
whenever KVM refuses to set EFER.LMSLE, not just when hardware enumerates the
defeature. KVM allows EFER.LMSLE if and only if nested SVM is supported, but
passes through hardware's EFER_LMSLE_MBZ as-is, i.e. KVM tells userspace that
long mode segment limits are available on an Intel CPU, and on an AMD CPU with
kvm_amd.nested=0, and then rejects WRMSR(EFER) with EFER.LMSLE=1. The bit
means precisely "EFER.LMSLE must be zero."
Note, this is purely an enumeration change. EFER.LMSLE is already gated on
nested SVM: kvm_setup_efer_caps() adds EFER_LMSLE to supported_efer_bits only
if X86_FEATURE_SVM is supported, and svm_set_cpu_caps() sets X86_FEATURE_SVM
if and only if "nested" is true. KVM's handling of EFER is unchanged; only
what KVM tells userspace changes.
Note #2, KVM now sets the defeature on Intel CPUs as well. That is no
different than KVM setting NullSelectorClearsBase, another AMD-defined bit, on
CPUs that don't have the errata. And LMSLE's dependency on nested SVM is a
historical artifact of commit
|
||
|
Fuad Tabba
|
681f3b68f4 |
KVM: guest_memfd: Fix the in-place conversion documentation
Commit |
||
|
Karl Mehltretter
|
07de87723b |
Documentation: KVM: x86: Use struct kvm_clock_pairing in hypercalls.rst
struct kvm_clock_offset does not exist; the name is struct
kvm_clock_pairing.
Use struct kvm_clock_pairing.
Fixes:
|
||
|
Karl Mehltretter
|
fe02f37155 |
Documentation: KVM: SEV: Use the uapi structure names
The document names struct kvm_sev_launch_update, struct kvm_sev_attestation, struct kvm_sev_launch_send_update_data and struct kvm_sev_launch_receive_update_data. None of them exists in arch/x86/include/uapi/asm/kvm.h; the structures are kvm_sev_launch_update_data, kvm_sev_attestation_report, kvm_sev_send_update_data and kvm_sev_receive_update_data. Use the uapi names. Fixes: |
||
|
Lorenzo Stoakes (ARM)
|
28187f51e4 |
Documentation: KVM: document arm64 KVM_PRE_FAULT_MEMORY
Update the KVM API documentation to reflect the fact that arm64 now supports this functionality. Also document error values and arm64-specific behaviour. Reviewed-by: Oliver Upton <oupton@kernel.org> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260923-kvm-arm-prefault-v4-11-d4b0b4dfa8c3@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Johannes Berg
|
92dae5e08d |
Documentation: um: document nommu UML
Add a description of nommu UML, a bit about how it works and some notes on how to use it. Partially based on Hajime's documentation. Link: https://patch.msgid.link/20260723113633.19c6669dc151.Ibd7a532eef856a1ea39699a263dfa8a9ded9dc20@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
||
|
Ackerley Tng
|
af602a96f4 |
KVM: TDX: Make source page optional for KVM_TDX_INIT_MEM_REGION
Update tdx_gmem_post_populate() to handle cases where userspace requests "no source page". To handle "no source page", populate (perform TDH.MEM.PAGE.ADD) using memory in-place at the target PFN. Allow "no source page" only when gmem_in_place_conversion is enabled, because retroactively adding support for out-of-place conversion would mean requiring a userspace update for a feature that's being deprecated. Also, KVM supporting "no source page" without in-place conversion would effectively be an obscure zero-page optimization that relies on the page being zeroed when it is allocated by guest_memfd. Rejecting "no source page" without in-place conversion scenario is valuable for KVM developers since it helps newcomers understand what exactly is and isn't possible. Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: Yan Zhao <yan.y.zhao@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-20-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Michael Roth
|
edcc3f4298 |
KVM: SEV: Make 'uaddr' parameter optional for KVM_SEV_SNP_LAUNCH_UPDATE
Make the source page for populating an SNP guest_memfd instance optional if in-place conversion/population is enabled. If KVM can convert the page in-place, then it's possible for guest memory to be initialized directly from userspace by mmap()'ing the guest_memfd and writing to it while the corresponding GPA ranges are in a 'shared' state, before converting them to the 'private' state expected by KVM_SEV_SNP_LAUNCH_UPDATE. Update the handling/documentation for KVM_SEV_SNP_LAUNCH_UPDATE to allow for 'uaddr' to be set to NULL when in-place conversion is enabled, which SNP_LAUNCH_UPDATE will then use to determine when it should/shouldn't copy in data from a separate memory location. Continue to enforce non-NULL when PRIVATE is tracked per-VM, not per-guest_memfd. [ Sean: Moved condition to snp_launch_update ] Signed-off-by: Michael Roth <michael.roth@amd.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-19-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Ackerley Tng
|
dcde2f853f |
KVM: guest_memfd: Ensure pages are not in use before conversion
When converting memory to private in guest_memfd, it is necessary to ensure that the pages are not currently being accessed by any other part of the kernel or userspace to avoid any current user writing to guest private memory. guest_memfd checks for any outstanding references to determine whether a page is still in use. The only expected references after unmapping the range requested for conversion are those that are held by guest_memfd itself. A folio will have outstanding references if it is present in a per-CPU lru_add fbatch. guest_memfd does not actually participate in LRU, but freshly-allocated folios are still added to the lru_add fbatch for batch LRU statistics processing. A folio may also have extra refcounts if it is on the mlock fbatch. These two known usages of the folio are handled by draining both the lru_add and mlock fbatches for the folio. After draining, if the refcount is still elevated, then there are truly outstanding references. If the page may be DMA-pinned, DMA is using it and hence there are outstanding references. Checking if the page may be DMA-pinned can have false positives, but that is only with a significant number of refcounts, at which point draining LRU is not going to move the needle - it can still be concluded that the folio has outstanding references. If the page is still mapped after guest_memfd tried to unmap it earlier in the conversion process, it also has outstanding references. Exit early to avoid unnecessary draining in these two cases. If an outstanding reference is detected, stop scanning, record the failing offset, and return immediately. Track the drain status to avoid repeatedly draining LRU caches across multiple folios while scanning the requested range. Update the kvm_memory_attributes2 structure to include an error_offset field. This allows KVM to report the exact offset where a conversion failed. If the safety check fails, return -EAGAIN and copy the error_offset back to userspace so that it can potentially retry the operation or handle the failure gracefully. Report error_offset if preallocating memory to track attributes fails with -ENOMEM as well, in which case the start offset of the range is returned. Update documentation to document the error_offset field and the possible -EAGAIN error. Suggested-by: David Hildenbrand <david@kernel.org> Co-developed-by: Vishal Annapurve <vannapurve@google.com> Signed-off-by: Vishal Annapurve <vannapurve@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Reviewed-by: Fuad Tabba <tabba@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-15-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Ackerley Tng
|
799c9fadc6 |
KVM: guest_memfd: Add base support for KVM_SET_MEMORY_ATTRIBUTES2
Add a new ioctl (and matching struct), KVM_SET_MEMORY_ATTRIBUTES2, using the same base ioctl number (0xd2), but with R/W semantics for the kernel instead of just read semantics. "Officially" documenting that KVM writes to the payload will allow KVM to support partial/incremental conversions, instead of all-or-nothing updates (which requires complex unwinding), by recording the failing offset if an error occurs. Opportunistically add a new struct as well, even though KVM could squeeze the error offset into "struct kvm_memory_attributes", as there's no cost to doing so in practice. Pad the struct with a pile of extra space to try and avoid ending up with "struct kvm_memory_attributes3" in the future. Use the same layout for the fields common to version 1 of the struct, e.g. to ease upgrading userspace, and to provide flexibility if KVM ever adds support for KVM_SET_MEMORY_ATTRIBUTES2 at VM scope. Introduce KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES to advertise the availability of the KVM_SET_MEMORY_ATTRIBUTES2 ioctl. Update the KVM API documentation to define the new ioctl and its behavior, and add the necessary UAPI definitions and capability checks. The process of setting memory attributes has a clear point of no return because, for CoCo VMs, zapping stage 2 page tables is a destructive operation. Unlike regular VMs, where re-faulting pages into the stage 2 page tables merely incurs a performance penalty, CoCo guests must (re-):accept pages after every fault. To preserve CoCo security guarantees, guests will not accept pages they did not explicitly request faults for. Consequently, during memory conversions, any operation that could cause the process to abort must be completed before the stage 2 page tables are zapped. Zap only the ranges that are not already in the requested state to avoid inadvertently destroying (CoCo) data. ARM CCA guests will try to mark the entire DRAM as private at boot. If there are no shared pages at all, the to-private conversion can be skipped, but the existence of a single shared page would require the conversion process to proceed, and if it proceeds, zapping both shared and private pages would destroy data and break the guest. Suggested-by: Michael Roth <michael.roth@amd.com> Suggested-by: Suzuki K Poulose <suzuki.poulose@arm.com> Co-developed-by: Vishal Annapurve <vannapurve@google.com> Signed-off-by: Vishal Annapurve <vannapurve@google.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Tested-by: Shivank Garg <shivankg@amd.com> Reviewed-by: Fuad Tabba <tabba@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-14-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Ackerley Tng
|
2e646bcfcf |
KVM: guest_memfd: Always fault from guest_memfd if in-place conversion is enabled
If a guest_memfd memslot is created but the guest_memfd does not have the GUEST_MEMFD_FLAG_MMAP set, KVM still fulfils guest faults by looking up the memslot's userspace_addr. Set KVM_MEMSLOT_GMEM_ONLY if in-place conversion is enabled so that the guest_memfd's memory will be used for both shared and private memory. With in-place conversion, guest_memfd will be the only backing memory for the memslot. No validation is performed to require userspace_addr to be a mapping from the associated guest_memfd because even after validation, userspace is free to remap something else at the provided userspace_addr. userspace_addr will still be used by functions like kvm_read_guest(), and if userspace_addr does not match up with the corresponding memory in the memslot's guest_memfd (whether userspace_addr points to the wrong offset or some non-guest_memfd memory, etc), that is a user error. Requiring both shared and private memory to come from the only associated guest_memfd simplifies invalidation in stage 2 page tables. On a PUNCH_HOLE operation on a guest_memfd, the invalidation is now guaranteed to be invalidating only memory mapped from the given guest_memfd. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-12-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Sean Christopherson
|
ee1168fb73 |
KVM: guest_memfd: Stub in ability to enable in-place shared<=>private conversion
Stub in global variable to enable in-place guest_memfd private<=>shared memory conversion, which will eventually be exposed to userspace via a module param, and wire up the __kvm_is_private_gfn() static call to the guest_memfd version when in-place conversion is enabled, i.e. when gmem is the sole authority on private vs. shared memory. Co-developed-by: Ackerley Tng <ackerleytng@google.com> Signed-off-by: Ackerley Tng <ackerleytng@google.com> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Fuad Tabba <tabba@google.com> Cc: Xiaoyao Li <xiaoyao.li@intel.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-9-dd6fbf94f4e1@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Karl Mehltretter
|
5fa39b00e4 |
Documentation: virt: Fix the struct snp_guest_request_ioctl name in sev-guest.rst
struct snp_user_guest_request does not exist; the name is struct
snp_guest_request_ioctl.
Use the real name.
Fixes:
|
||
|
Fuad Tabba
|
f3435cb7df |
KVM: arm64: Fix the KVM_ARM_PREFERRED_TARGET documentation
KVM_ARM_PREFERRED_TARGET has never set a feature bit: the original arm64 implementation zeroed the bitmap, and kvm_vcpu_preferred_target(), which only ever zeroed it, was removed by commit |
||
|
Karl Mehltretter
|
068df88a7d |
Documentation: KVM: Fix the struct kvm_arm_device_addr name
KVM_ARM_SET_DEVICE_ADDR takes struct kvm_arm_device_addr; the document
names it struct kvm_arm_device_address, which does not exist.
Use the real name.
Fixes:
|
||
|
Karl Mehltretter
|
1e3b8f0af9 |
Documentation: KVM: Fix the event_source sysfs path in the PMU attribute description
The PMU device directories live under /sys/bus/event_source/devices,
the document spells the bus even_source.
Fix the spelling.
Fixes:
|
||
|
Sascha Bischoff
|
53e9639e75 |
Documentation: KVM: Add the VGICv5 IRS save/restore sequences
Document the ordering requirements for saving and restoring the GICv5 IRS state. The IST state is exposed through KVM_DEV_ARM_VGIC_GRP_IST and is copied to or from userspace-provided buffers. Saving the ISTs therefore does not update guest memory, so userspace does not need to serialize guest memory after saving the IST state. On restore, userspace must create the vCPUs, configure the IRS address, restore the number of SPIs, and initialize the VGIC before restoring IRS state. The IRS MMIO registers may be restored in any order, but the final IRS_IDR* state and the IRS_IST_CFGR/IRS_IST_BASER state that describes any LPI IST must be restored before KVM_DEV_ARM_VGIC_GRP_IST. KVM uses that state to validate the userspace IST buffers and allocate any host LPI IST. The IRS_*_STATUSR registers are observational state in KVM. Userspace may save them for validation or debugging, but they are not required as restore input and do not need to be replayed. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-40-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Sascha Bischoff
|
a7f442da92 |
Documentation: KVM: Add docs for KVM_DEV_ARM_VGIC_GRP_IST
Document the IST save/restore userspace interface for the VGICv5 device, KVM_DEV_ARM_VGIC_GRP_IST. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-39-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Sascha Bischoff
|
99055cdfb2 |
Documentation: KVM: Add KVM_DEV_ARM_VGIC_GRP_IRS_REGS to VGICv5 docs
Document the KVM_DEV_ARM_VGIC_GRP_IRS_REGS attribute group used to read and write the virtual IRS's MMIO register state. This provides a GICv5-specific interface for state that is conceptually similar to the VGICv3 ITS register interface, but uses IRS terminology instead of ITS. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-38-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Sascha Bischoff
|
fc3a33a6f3 |
Documentation: KVM: Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for VGICv5
The virtual GICv5 adopts the same mechanism as GICv3 for userspace reads and writes of the system registers, albeit operating on a different set of registers, of course. Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for GICv5 in the VGICv5 documentation, explicitly calling out the registers it operates on. The main body of documentation has been directly copied from the VGICv3 documentation as it has identical operation. One key thing to note is that for two sets of GICv5 registers - those pertaining to Active and Pending state - the operation of the interface is different to how the actual registers operate. Both of these registers have C and S variants (to set and clear bits) in hardware. However for this interface, we ONLY implement the S variant, AND treat it as a raw write. This simplifies the act of reading or writing the state. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-37-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Sascha Bischoff
|
f549eb5349 |
Documentation: KVM: Extend VGICv5 device attribute docs
The VGICv5 documentation still describes the device as supporting PPIs only. Update the overview to cover PPI, SPI, and LPI interrupts. PPIs and SPIs can be injected by in-kernel devices or through KVM_IRQ_LINE, while LPI pending state is driven by the guest and handled in hardware through the LPI IST. Document the GICv5 IRS address attribute and its GPA layout requirements. The IRS region must be 64K aligned and covers a 128K range. Also document the GICv5-specific interpretation of KVM_DEV_ARM_VGIC_GRP_NR_IRQS. Unlike GICv2 and GICv3, the value describes only the number of SPIs exposed by the IRS and does not include SGIs or PPIs. The supported range is 32 through 1024 SPIs in multiples of 32, and defaults to 32 when userspace leaves it unset. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-29-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Sascha Bischoff
|
c9e4010b4b |
KVM: arm64: gic-v5: Support SPI injection
GICv5 SPI lifecycle is handled by the GICv5 hardware once the pending state has been injected. This change adds support for injecting SPIs to the core VGIC code and GICv5 code. First of all, allow GICv5 SPIs to be looked up by ID via vgic_get_irq(). Previously, only PPIs were supported. Two irq_ops are used for GICv5 SPI injection. The set_pending_state() irq_op is used to inject the SPI's pending state into the guest. The queue_irq_unlock() irq_op releases the IRQ lock without queueing the SPI on a per-vCPU AP list, as GICv5 does not track in-flight SPI state in KVM. Tracking the affinity and lifecycle of individual SPIs in software would negate much of the benefit of their lifecycle being hardware managed. Limit injection to the configured per-VM SPI range. Since GICv5 SPI IDs start at zero, KVM_IRQ_LINE accepts IDs from zero through one less than the configured number of SPIs, up to 1023. Update the KVM_IRQ_LINE documentation accordingly. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-28-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Linus Torvalds
|
7bb6284aa7 |
Arm:
* Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
* Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
* Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
* Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
* Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
* Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
* Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
LoongArch:
* Advertise already-supported capabilities.
* Some bug fixes about timer and MMIO.
* Some hardening about interrupt injection.
* Replace kvm_err() with kvm_pr_unimpl().
* Add FPU/LSX/LASX test cases for selftests.
RISC-V:
* Svadu/Zicfiss/Zicfilp FWFT support for Guest
* Use try_cmpxchg for IMSIC MRIF RMW
* More arch-specific tracepoints in KVM RISC-V
* Eager page splitting when enabling dirty logging
* Optimize hfence request handling for SMP Guests
* Improve dirty log clearing by skipping zero bits in mask
* Guard HFENCE range loops against overflow
* CPU PM notifiers in KVM RISC-V for non-retentive idle states
* Fix kernel-mode vector context save/restore for Guest
s390:
* Fixes for vfio-ap
* Fixes for the gmap rework
* Fixes for vsie
* AI triggered fixes all over
* diag9c tracing
* code move preparation for the additional arm64 support
* enable CONTEXT_ANALYSIS
x86:
* Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c
(the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving
relevant code out of x86.c.
* Split kvm_mmu in three parts, respectively to describe the format of page
tables, walking the guest page tables and building the page tables. Always
use the same page table walker kvm->arch.gva_walk as the entry point to
convert a guest's virtual address, where the previous code used two
different kvm_mmu structs depending on whether the walk included nested
EPT/NPT or not. Make page fault vmexits reuse the permission checking
machinery that is used for guest page faults. This is both a cleanup
and a baby step towards supporting XS/XU memory permissions.
* Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
* Remove a defunct masterclock update from kvm_xen_shared_info_init(). It
could result in incorrect kvmclock due to triggering an unnecessary
switch to/from masterclock mode.
* Skip Xen runstate time updates if time has effectively gone backwards, so
that the guest doesn't report 100% steal time for a very, very long time.
* Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
updating the wrong sub-leaf, and upstream KVM will soon provide all the
information needed by userspace to populate the CPUID field itself.
* Fix a bug where KVM would walk a newly created rmap without holding the rmap
lock (or mmu_lock) during aging.
* Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
* Fix a variety of #DB priority bugs.
* Fix a class of races related to enabling Hyper-V emulation on a vCPU after
the vCPU is visible to the rest of KVM.
* Use static calls for nested virtualization ops.
* Move more KVM-internal code out of x86's kvm_host.h.
* Enumerate support for a variety of Zhaoxin instructions that don't require
explicit virtualization.
* Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
* Harden kvm_vcpu_map() against double-mapping and thus leaking references.
* Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
x86 (Intel):
* Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed, to fix a use-after-free where hardware
will write to a freed vCPU's PID.
* Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
* Cap the maximum value shoved into the VMX Preemption Timer to workaround an
erratum that affects all existing Intel CPUs that support CPUID 0x15.
* Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
* Harden the TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion.
x86 (AMD):
* Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
Change request.
* Remove a dying VM from the GA Log notifier list before the VM is actually
destroyed, to fix a potential use-after-free.
* While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays
FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact,
get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM.
So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins.
(This was reviewed by mm maintainers; for more information, see commit
|
||
|
Paolo Bonzini
|
76671054f9 |
KVM/arm64 changes for 7.3
- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
- Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
- Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
-----BEGIN PGP SIGNATURE-----
iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCaoZ/khccb2xpdmVyLnVw
dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFkK7AP9zvAcDf+DVte8+mZjCMDrvNB1n
UWsBnQkdZ1nDDYBJlwD8D1pvurK4ZV3UIl68IgpTqYKhMspCuOWDHrnBt1QyqQU=
=2iPX
-----END PGP SIGNATURE-----
Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
KVM/arm64 changes for 7.3
- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
- Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
- Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
|
||
|
Linus Torvalds
|
1200d84f4c |
powerpc updates for 7.3
- powerpc: Enable Rust for ppc64le - ppc4xx gpio driver updates - Add power12 base enablement support - Validate arch_compat against host compatibility mode - Simplify bootx_scan_dt_build_struct() in powermac platform - powerpc: implement get_direction() in cpm2 - Use cpu_relax() in ps3_create_spu() - Add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - fixes to handle pseries watchdogs in kdump path - powerpc/irq: Fix missing r2 clobber in PCREL inline assembly - ppc44x: Set GPIO chip parent - KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl BY: Amit Machhiwal - KVM: powerpc: Use generic xfer to guest work function - Enable to run posix cpu timers in task context - misc fixes and cleanups Thanks to: Aditya Gupta, Alice Ryhl, Amit Machhiwal, Andrew Morton, Anushree Mathur, Athira Rajeev, Bartosz Golaszewski, Cédric Le Goater, Christian König, Christophe Leroy (CS GROUP), Gary Guo, Gaurav Batra, Gautam Menghani, Gou Hao, Hari Bathini, Harsh Prateek Bora, jiazhenyuan, Jinjie Ruan, Link Mauve, Linus Walleij, Mahesh Kumar G Mahesh Salgaonkar, Michael Walle, Michal Suchánek, Mukesh Kumar Chaurasiya (IBM), Nicholas Piggin, Nikhil Kumar Singh, Praveen K Pandey, Ritesh Harjani (IBM), Rosen Penev, Saket Kumar Bhaskar, Shrikanth Hegde, Sourabh Jain, Thorsten Blum, Vaibhav Jain, Venkat Rao Bagalkote, Vishal Chourasia, Wentao Guan, Yanfei Xu -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmqCj/4ACgkQpnEsdPSH ZJSKNg//VNpbzMKVPrdljgLn3P8/flWUUMvbjT0j2s5OExeFPjM9tvJQucMficJz eQWaEZbaczRPdtBDt96NXXDIoXGpfapS1Tj18OjVjCRtQdKV4DGfNdE5wC2tKwvA 1R6x5FT6pGxCRuNY9o3aAo/qcEJLCWCtOvrgdlT8C9ZV8Zh/GRl5TXBYqB4LFYAd WI1Jc4s97VFNtPSh7HtImd5n8T8vNWqQzi1rUAWTYQPduV8eHKFhnyu9vIh2ISv8 p6dZzE6mLrgn7zU8HW2z5nRyRZFRXtWt3i7/0IGSsJYtBoREsFw2d3LJfwMZXwdU hXNbw9OlwDmPUF8+qFIEVu3czfiFW1naNEXP00NJfM+67acXIpFEiJ/LvuLENzC4 gtX1VKUCQthWxJESnX1WrKnP7BAjUGe691CronRoYIJNctLnrCA7SOfJ2El4i40v v0+oz8KceGE3AU/1SpcKC8WlrHGb7qDBHS1HD8wpdcMsL1LTUWlghAptc/CrpRSb vDbiQAK7RHAEVSx6CsW1pVdFGOk5k7QQgeX6ptyK2aliQhuS4UA5b7zMmE+agPY4 Pro2bQLZYPfIW92OB1Zf+h69bUn4aVyp5ov1U1kTJuFHSEH+9+ZVemZg/f2fN8LV bwgErs0YPL/N5099qolj9mmNvn8RcVwub6nIGrVryGbBLprlV3o= =4Mg5 -----END PGP SIGNATURE----- Merge tag 'powerpc-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Madhavan Srinivasan: - Enable Rust for ppc64le - ppc4xx gpio driver updates - Add power12 base enablement support - Validate arch_compat against host compatibility mode - Simplify bootx_scan_dt_build_struct() in powermac platform - Implement get_direction() in cpm2 - Use cpu_relax() in ps3_create_spu() - Add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - Fixes to handle pseries watchdogs in kdump path - Fix missing r2 clobber in PCREL inline assembly - Set GPIO chip parent on ppc44x - KVM: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl - KVM: Use generic xfer to guest work function - Enable to run posix cpu timers in task context - Misc fixes and cleanups Thanks to Aditya Gupta, Alice Ryhl, Amit Machhiwal, Andrew Morton, Anushree Mathur, Athira Rajeev, Bartosz Golaszewski, Cédric Le Goater, Christian König, Christophe Leroy (CS GROUP), Gary Guo, Gaurav Batra, Gautam Menghani, Gou Hao, Hari Bathini, Harsh Prateek Bora, jiazhenyuan, Jinjie Ruan, Link Mauve, Linus Walleij, Mahesh Kumar G Mahesh Salgaonkar, Michael Walle, Michal Suchánek, Mukesh Kumar Chaurasiya (IBM), Nicholas Piggin, Nikhil Kumar Singh, Praveen K Pandey, Ritesh Harjani (IBM), Rosen Penev, Saket Kumar Bhaskar, Shrikanth Hegde, Sourabh Jain, Thorsten Blum, Vaibhav Jain, Venkat Rao Bagalkote, Vishal Chourasia, Wentao Guan, and Yanfei Xu. * tag 'powerpc-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (62 commits) powerpc/pseries/iommu: switch to Default DMA window during kdump powerpc/configs: enable CONFIG_RAS to fix EDAC support KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl gpio: ppc44x: use dev_name() for chip label gpio: ppc44x: fix undefined behavior in GPIO_MASK2 macro gpio: ppc44x: drop PPC-specific IO helpers gpio: ppc44x: Convert GPIO to generic MMIO gpio: ppc44x: Use platform resource helper for GPIO MMIO gpio: ppc44x: Use module platform driver helper for GPIO gpio: ppc44x: update all 4xx to 44x gpio: move ppc4xx gpio driver from arch/powerpc to drivers/gpio KVM: PPC: Use min() in kvm_vm_ioctl_check_extension() KVM: PPC: booke: Use min() in watchdog_next_timeout() powerpc/perf: Add power12 Base Performance Monitoring support powerpc: Add Power12 architected mode powerpc: Add Power12 raw mode powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation ... |
||
|
Paolo Bonzini
|
9dc54ddece |
KVM arch-neutral and documentation changes for 7.3
- Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.
- Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
- Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
before calling into arch code. This allows arch code to consume vcpu_id
without having to worry about cross-vCPU clobbering (at least s390 and x86
have had related bugs).
- Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed to fix a use-after-free where hardware
will write to a freed vCPU's PID.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmp7v0oACgkQOlYIJqCj
N/0d/Q/+MWjv5Ua3LXBIcdw34zm+ympYVwEs30x/GPM/434DR/JS7iKAL0ZaY/Wc
uQFlNOJ74Nwq59y63VFGhMJeJU3zh/T3aKS/yarlbeUn2kY5Mij856KnY1acKo1n
hVaW+S8xAYhyf4QWOugeheSU/nrQ6df13EA+zJWOcqWyeeWHm2cykpRAoNhglVJr
nu4lPewBqVBfLmNIMtWhV0L9YllFO9nhGA4Ho7mRCTp8McxXNoeqSmlqm5xbwa0U
iNgpyzEaZwXHBkjk/PbTNjmB4uRLIkhn3o+Ol0PRyt/R1OgJScwmlK+R04b+9nQa
wI0C4bh3lE5wyAFE78yIkju1DhTLHe5Vd748hONIyuwQ2fJoh5SCpFoPX59uND39
W4qU6I7DgAX4Oum0yuwBLMUaKTRtupgVHFlsXSIrx4Im95cYllUdfktLArmpdnfK
mFPOMPtD2x2RdFWhLQSGVLO+kG9IjRc06P0UVPwQPUc2CNfQKYgTqYjIPBn6KTef
U5ZQeN7TdZFg3Vchrwmis3PjYKeP/xdQPNOsMG9q7sXSdo8N4fCCsHfBjceEO5I5
s+DUbDJKruQW3MrwGTa6vCqOyLipNVxBXwgeOZQEDGbi+AynBB3QofY54jQSqwfL
SFbhfiTbcfu1JCogaCarZqclzVUp333LESNqqMljWMzDbCS9VwE=
=19dB
-----END PGP SIGNATURE-----
Merge tag 'kvm-x86-generic-7.3' of https://github.com/kvm-x86/linux into HEAD
KVM arch-neutral and documentation changes for 7.3
- Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs.
- Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
- Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for
which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs
before calling into arch code. This allows arch code to consume vcpu_id
without having to worry about cross-vCPU clobbering (at least s390 and x86
have had related bugs).
- Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed to fix a use-after-free where hardware
will write to a freed vCPU's PID.
|
||
|
Amit Machhiwal
|
c1721e5842 |
KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl
Add documentation for the KVM_PPC_GET_COMPAT_CAPS ioctl to the KVM API documentation. The ioctl exposes host processor compatibility modes supported for nested KVM guests on PowerPC systems. The documentation covers error code descriptions including E2BIG for forward compatibility, KVM_PPC_COMPAT_CAPS_SIZE_VER0 as the minimum size floor, the rationale for rejecting non-zero reserved fields to prevent ABI ambiguity, bit numbering clarification for IBM MSB-0 convention, and KVM-specific capability bit constants. Tested-by: Gautam Menghani <gautam@linux.ibm.com> Reviewed-by: Gautam Menghani <gautam@linux.ibm.com> Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260808161148.66673-5-amachhiw@linux.ibm.com |
||
|
Tim Wiederhake
|
99607da19b |
KVM: x86: Document APIC base address constraint for in-kernel irqchip
When virtual APIC access acceleration is enabled (APICv on Intel, AVIC on AMD), vcpu creation installs a private memory slot at the default APIC base address (0xfee00000). If a user memory region overlaps this address, vcpu creation fails with EEXIST. The same error occurs when installing an overlapping user memory region after vcpu creation. This also applies when using KVM_CAP_SPLIT_IRQCHIP. This constraint is not documented anywhere. Add a note to the KVM_CREATE_IRQCHIP and KVM_CAP_SPLIT_IRQCHIP documentation. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Link: https://patch.msgid.link/20260708133856.302151-3-twiederh@redhat.com [sean: call out "subsequent vcpu creation"] Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Tim Wiederhake
|
d82d77c643 |
KVM: x86: Document that KVM_CREATE_IRQCHIP must precede vCPU creation
The kernel rejects KVM_CREATE_IRQCHIP with -EINVAL if any vCPUs have already been created, but the API documentation does not mention this constraint. Add a note. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Link: https://patch.msgid.link/20260708133856.302151-2-twiederh@redhat.com Signed-off-by: Sean Christopherson <seanjc@google.com> |
||
|
Congkai Tan
|
ad220e275c |
KVM: arm64: Add KVM_ARM_VCPU_PMU_V3_STRICT vCPU feature
Introduce a new vCPU feature KVM_ARM_VCPU_PMU_V3_STRICT. When set, KVM does not create a default PMU when initializing the vCPU, and userspace must select one explicitly via KVM_ARM_VCPU_PMU_V3_SET_PMU before the first KVM_RUN. The flag forces the VMM to be aware of the PMU implementation of the guest to be created, so that certain information about the PMU becomes deterministic (if on a heterogeneous system) and becomes safe to be exposed to the guest. It can be used as an umbrella flag to gate future PMUv3 UAPI changes. When no default PMU is created, kvm->arch.arm_pmu stays NULL until SET_PMU runs, so kvm_arm_pmu_v3_init() now refuses to run if kvm->arch.arm_pmu is NULL. Signed-off-by: Congkai Tan <congkai@amazon.com> Reviewed-by: Geoff Blake <blakgeof@amazon.com> Reviewed-by: Haris Okanovic <harisokn@amazon.com> Reviewed-by: Stanislav Spassov <stanspas@amazon.de> Co-developed-by: Oliver Upton <oupton@kernel.org> Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260722202702.4165917-5-congkai@amazon.com Signed-off-by: Oliver Upton <oupton@kernel.org> |
||
|
Paolo Bonzini
|
a7fe52b5ab |
KVM/arm64 fixes for 7.2, take #3
- Fix a tiny buglet when propagating the deactivation of an interrupt from a nested guest, which happened to trigger a gold plated CPU bug on a particular implementation - Fix a race between LPI unmapping and mapping, resulting in leaked LPIs - Make LPI mapping more robust on memory allocation failure - Fix the handling of the EL2 tracing clock being disabled - A couple of Sashiko-driven fixes for corner cases in the EL2 tracing code - Add missing sysreg tracepoint for the EL2 code - Tidy-up the mutual exclusion of guest-memfd and MTE - Update Fuad's email address to point to @linux.dev -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmpiPKIACgkQI9DQutE9 ekNhIA//SQCC53RVQjg5XjW/pfHLanEnQycyyYU7mY8Aw8+TstztgAL7TRTITuUY wPldTBIuBS/f49KP4FIqynUNznFrtsBEYNxpK6PaLzCAvszcc1SAHzkWbK7j8SRn cWm1Zq+0RIkH4pluLiqZZjsBb6gKz8dGJCD7k+qoYPrsPMccltMZtzn2db4zWfb7 b5PRUNm2KncuHt/gHfPxCHo9RFe/71ll6V4XKNe3H5UY064OnCwVZ6ju8zKJu+MD 5MLuyKy1lLbKHZEJibAI/Bn6GNU3q1V50GbpWmnAB66Kh4Vlj6ST+2qaxAmSxSho GqAA1Ba5NTSA8C7fh/+o9vFf13UJ5lAQRV9xOwH3lXnlHzGhtsd8+4H/bSte1uP8 tMSzODn2QzTAO9V1ooIhbpQvlG085hjA1onzCs5F8Z+FVlkDOTV5ZTZb1wq2CP66 1QKlcBDO5LaBu3zJBC0DugoB7bpeaeVeOf6U/a4+W4WzX3En0va0oMSmTZbpEhdu z97ttdadLIqL6a7oKwvZbXdQz4TtfExKFYVWxVrhydBpPR4AT6zNPFEJcEzt2zYb Gf9OzgwKbuJxgtz9dvMWVWEwB6awSfIv6spaSBHMrhWPbaeCt1vS8slA2aMnGQ9o UkcgIRULU7TKv/iilnEcXRuqnQkM94Rfz7rc3Ycp9sHweTXjRP0= =a3wu -----END PGP SIGNATURE----- Merge tag 'kvmarm-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.2, take #3 - Fix a tiny buglet when propagating the deactivation of an interrupt from a nested guest, which happened to trigger a gold plated CPU bug on a particular implementation - Fix a race between LPI unmapping and mapping, resulting in leaked LPIs - Make LPI mapping more robust on memory allocation failure - Fix the handling of the EL2 tracing clock being disabled - A couple of Sashiko-driven fixes for corner cases in the EL2 tracing code - Add missing sysreg tracepoint for the EL2 code - Tidy-up the mutual exclusion of guest-memfd and MTE - Update Fuad's email address to point to @linux.dev |
||
|
Jaehoon Kim
|
9972befc3e |
KVM: s390: Fall back to short-term pinning in MAP ioctl
FOLL_LONGTERM pinning fails for some memory types, such as file-backed
guest memory. As a result, kvm_s390_adapter_map() returns -EINVAL and
irqfd adapter registration fails even though interrupt delivery could
still work via the existing non-atomic path.
When FOLL_LONGTERM pinning fails, verify that the page is accessible
using a short-term pin instead. If the short-term pin succeeds, unpin
the page and add a map entry with pinned=false to preserve MAP/UNMAP
symmetry. The non-atomic irqfd path already performs short-term pinning
for interrupt delivery, so this restores the previous behavior for
memory that cannot be pinned long-term.
get_map_info() is updated to return NULL for unpinned entries so that
the atomic irqfd fast path falls back to the non-atomic path.
kvm_s390_adapter_unmap() and kvm_s390_unmap_all_adapters() skip dirty
marking and unpin for unpinned entries.
Update Documentation/virt/kvm/devices/s390_flic.rst to reflect the
new MAP/UNMAP behavior.
Fixes:
|