mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
81cdb259fb
KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be
bigger that the maximal number of VCPUs, resulting in out-of-bounds
access.
Found by syzkaller:
BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr [...]
Write of size 1 by task a.out/27101
CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[...]
Call Trace:
[...] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905
[...] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495
[...] kvm_irq_delivery_to_apic+0x732/0xc10 arch/x86/kvm/irq_comm.c:86
[...] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360
[...] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222
[...] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235
[...] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670
[...] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668
[...] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999
[...] kvm_vm_ioctl+0x1fa/0x1a70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: stable@vger.kernel.org
Fixes: af1bae5497
("KVM: x86: bump KVM_MAX_VCPU_ID to 1023")
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
672 lines
17 KiB
C
672 lines
17 KiB
C
/*
|
|
* Copyright (C) 2001 MandrakeSoft S.A.
|
|
* Copyright 2010 Red Hat, Inc. and/or its affiliates.
|
|
*
|
|
* MandrakeSoft S.A.
|
|
* 43, rue d'Aboukir
|
|
* 75002 Paris - France
|
|
* http://www.linux-mandrake.com/
|
|
* http://www.mandrakesoft.com/
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*
|
|
* Yunhong Jiang <yunhong.jiang@intel.com>
|
|
* Yaozu (Eddie) Dong <eddie.dong@intel.com>
|
|
* Based on Xen 3.1 code.
|
|
*/
|
|
|
|
#include <linux/kvm_host.h>
|
|
#include <linux/kvm.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/highmem.h>
|
|
#include <linux/smp.h>
|
|
#include <linux/hrtimer.h>
|
|
#include <linux/io.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/export.h>
|
|
#include <asm/processor.h>
|
|
#include <asm/page.h>
|
|
#include <asm/current.h>
|
|
#include <trace/events/kvm.h>
|
|
|
|
#include "ioapic.h"
|
|
#include "lapic.h"
|
|
#include "irq.h"
|
|
|
|
#if 0
|
|
#define ioapic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg)
|
|
#else
|
|
#define ioapic_debug(fmt, arg...)
|
|
#endif
|
|
static int ioapic_service(struct kvm_ioapic *vioapic, int irq,
|
|
bool line_status);
|
|
|
|
static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
|
|
unsigned long addr,
|
|
unsigned long length)
|
|
{
|
|
unsigned long result = 0;
|
|
|
|
switch (ioapic->ioregsel) {
|
|
case IOAPIC_REG_VERSION:
|
|
result = ((((IOAPIC_NUM_PINS - 1) & 0xff) << 16)
|
|
| (IOAPIC_VERSION_ID & 0xff));
|
|
break;
|
|
|
|
case IOAPIC_REG_APIC_ID:
|
|
case IOAPIC_REG_ARB_ID:
|
|
result = ((ioapic->id & 0xf) << 24);
|
|
break;
|
|
|
|
default:
|
|
{
|
|
u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
|
|
u64 redir_content;
|
|
|
|
if (redir_index < IOAPIC_NUM_PINS)
|
|
redir_content =
|
|
ioapic->redirtbl[redir_index].bits;
|
|
else
|
|
redir_content = ~0ULL;
|
|
|
|
result = (ioapic->ioregsel & 0x1) ?
|
|
(redir_content >> 32) & 0xffffffff :
|
|
redir_content & 0xffffffff;
|
|
break;
|
|
}
|
|
}
|
|
|
|
return result;
|
|
}
|
|
|
|
static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
|
|
{
|
|
ioapic->rtc_status.pending_eoi = 0;
|
|
bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
|
|
}
|
|
|
|
static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
|
|
|
|
static void rtc_status_pending_eoi_check_valid(struct kvm_ioapic *ioapic)
|
|
{
|
|
if (WARN_ON(ioapic->rtc_status.pending_eoi < 0))
|
|
kvm_rtc_eoi_tracking_restore_all(ioapic);
|
|
}
|
|
|
|
static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
|
|
{
|
|
bool new_val, old_val;
|
|
struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
|
|
struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
|
|
union kvm_ioapic_redirect_entry *e;
|
|
|
|
e = &ioapic->redirtbl[RTC_GSI];
|
|
if (!kvm_apic_match_dest(vcpu, NULL, 0, e->fields.dest_id,
|
|
e->fields.dest_mode))
|
|
return;
|
|
|
|
new_val = kvm_apic_pending_eoi(vcpu, e->fields.vector);
|
|
old_val = test_bit(vcpu->vcpu_id, dest_map->map);
|
|
|
|
if (new_val == old_val)
|
|
return;
|
|
|
|
if (new_val) {
|
|
__set_bit(vcpu->vcpu_id, dest_map->map);
|
|
dest_map->vectors[vcpu->vcpu_id] = e->fields.vector;
|
|
ioapic->rtc_status.pending_eoi++;
|
|
} else {
|
|
__clear_bit(vcpu->vcpu_id, dest_map->map);
|
|
ioapic->rtc_status.pending_eoi--;
|
|
rtc_status_pending_eoi_check_valid(ioapic);
|
|
}
|
|
}
|
|
|
|
void kvm_rtc_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
|
|
{
|
|
struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
|
|
|
|
spin_lock(&ioapic->lock);
|
|
__rtc_irq_eoi_tracking_restore_one(vcpu);
|
|
spin_unlock(&ioapic->lock);
|
|
}
|
|
|
|
static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic)
|
|
{
|
|
struct kvm_vcpu *vcpu;
|
|
int i;
|
|
|
|
if (RTC_GSI >= IOAPIC_NUM_PINS)
|
|
return;
|
|
|
|
rtc_irq_eoi_tracking_reset(ioapic);
|
|
kvm_for_each_vcpu(i, vcpu, ioapic->kvm)
|
|
__rtc_irq_eoi_tracking_restore_one(vcpu);
|
|
}
|
|
|
|
static void rtc_irq_eoi(struct kvm_ioapic *ioapic, struct kvm_vcpu *vcpu)
|
|
{
|
|
if (test_and_clear_bit(vcpu->vcpu_id,
|
|
ioapic->rtc_status.dest_map.map)) {
|
|
--ioapic->rtc_status.pending_eoi;
|
|
rtc_status_pending_eoi_check_valid(ioapic);
|
|
}
|
|
}
|
|
|
|
static bool rtc_irq_check_coalesced(struct kvm_ioapic *ioapic)
|
|
{
|
|
if (ioapic->rtc_status.pending_eoi > 0)
|
|
return true; /* coalesced */
|
|
|
|
return false;
|
|
}
|
|
|
|
static int ioapic_set_irq(struct kvm_ioapic *ioapic, unsigned int irq,
|
|
int irq_level, bool line_status)
|
|
{
|
|
union kvm_ioapic_redirect_entry entry;
|
|
u32 mask = 1 << irq;
|
|
u32 old_irr;
|
|
int edge, ret;
|
|
|
|
entry = ioapic->redirtbl[irq];
|
|
edge = (entry.fields.trig_mode == IOAPIC_EDGE_TRIG);
|
|
|
|
if (!irq_level) {
|
|
ioapic->irr &= ~mask;
|
|
ret = 1;
|
|
goto out;
|
|
}
|
|
|
|
/*
|
|
* Return 0 for coalesced interrupts; for edge-triggered interrupts,
|
|
* this only happens if a previous edge has not been delivered due
|
|
* do masking. For level interrupts, the remote_irr field tells
|
|
* us if the interrupt is waiting for an EOI.
|
|
*
|
|
* RTC is special: it is edge-triggered, but userspace likes to know
|
|
* if it has been already ack-ed via EOI because coalesced RTC
|
|
* interrupts lead to time drift in Windows guests. So we track
|
|
* EOI manually for the RTC interrupt.
|
|
*/
|
|
if (irq == RTC_GSI && line_status &&
|
|
rtc_irq_check_coalesced(ioapic)) {
|
|
ret = 0;
|
|
goto out;
|
|
}
|
|
|
|
old_irr = ioapic->irr;
|
|
ioapic->irr |= mask;
|
|
if (edge)
|
|
ioapic->irr_delivered &= ~mask;
|
|
if ((edge && old_irr == ioapic->irr) ||
|
|
(!edge && entry.fields.remote_irr)) {
|
|
ret = 0;
|
|
goto out;
|
|
}
|
|
|
|
ret = ioapic_service(ioapic, irq, line_status);
|
|
|
|
out:
|
|
trace_kvm_ioapic_set_irq(entry.bits, irq, ret == 0);
|
|
return ret;
|
|
}
|
|
|
|
static void kvm_ioapic_inject_all(struct kvm_ioapic *ioapic, unsigned long irr)
|
|
{
|
|
u32 idx;
|
|
|
|
rtc_irq_eoi_tracking_reset(ioapic);
|
|
for_each_set_bit(idx, &irr, IOAPIC_NUM_PINS)
|
|
ioapic_set_irq(ioapic, idx, 1, true);
|
|
|
|
kvm_rtc_eoi_tracking_restore_all(ioapic);
|
|
}
|
|
|
|
|
|
void kvm_ioapic_scan_entry(struct kvm_vcpu *vcpu, ulong *ioapic_handled_vectors)
|
|
{
|
|
struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
|
|
struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
|
|
union kvm_ioapic_redirect_entry *e;
|
|
int index;
|
|
|
|
spin_lock(&ioapic->lock);
|
|
|
|
/* Make sure we see any missing RTC EOI */
|
|
if (test_bit(vcpu->vcpu_id, dest_map->map))
|
|
__set_bit(dest_map->vectors[vcpu->vcpu_id],
|
|
ioapic_handled_vectors);
|
|
|
|
for (index = 0; index < IOAPIC_NUM_PINS; index++) {
|
|
e = &ioapic->redirtbl[index];
|
|
if (e->fields.trig_mode == IOAPIC_LEVEL_TRIG ||
|
|
kvm_irq_has_notifier(ioapic->kvm, KVM_IRQCHIP_IOAPIC, index) ||
|
|
index == RTC_GSI) {
|
|
if (kvm_apic_match_dest(vcpu, NULL, 0,
|
|
e->fields.dest_id, e->fields.dest_mode) ||
|
|
(e->fields.trig_mode == IOAPIC_EDGE_TRIG &&
|
|
kvm_apic_pending_eoi(vcpu, e->fields.vector)))
|
|
__set_bit(e->fields.vector,
|
|
ioapic_handled_vectors);
|
|
}
|
|
}
|
|
spin_unlock(&ioapic->lock);
|
|
}
|
|
|
|
void kvm_vcpu_request_scan_ioapic(struct kvm *kvm)
|
|
{
|
|
struct kvm_ioapic *ioapic = kvm->arch.vioapic;
|
|
|
|
if (!ioapic)
|
|
return;
|
|
kvm_make_scan_ioapic_request(kvm);
|
|
}
|
|
|
|
static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
|
|
{
|
|
unsigned index;
|
|
bool mask_before, mask_after;
|
|
union kvm_ioapic_redirect_entry *e;
|
|
|
|
switch (ioapic->ioregsel) {
|
|
case IOAPIC_REG_VERSION:
|
|
/* Writes are ignored. */
|
|
break;
|
|
|
|
case IOAPIC_REG_APIC_ID:
|
|
ioapic->id = (val >> 24) & 0xf;
|
|
break;
|
|
|
|
case IOAPIC_REG_ARB_ID:
|
|
break;
|
|
|
|
default:
|
|
index = (ioapic->ioregsel - 0x10) >> 1;
|
|
|
|
ioapic_debug("change redir index %x val %x\n", index, val);
|
|
if (index >= IOAPIC_NUM_PINS)
|
|
return;
|
|
e = &ioapic->redirtbl[index];
|
|
mask_before = e->fields.mask;
|
|
if (ioapic->ioregsel & 1) {
|
|
e->bits &= 0xffffffff;
|
|
e->bits |= (u64) val << 32;
|
|
} else {
|
|
e->bits &= ~0xffffffffULL;
|
|
e->bits |= (u32) val;
|
|
e->fields.remote_irr = 0;
|
|
}
|
|
mask_after = e->fields.mask;
|
|
if (mask_before != mask_after)
|
|
kvm_fire_mask_notifiers(ioapic->kvm, KVM_IRQCHIP_IOAPIC, index, mask_after);
|
|
if (e->fields.trig_mode == IOAPIC_LEVEL_TRIG
|
|
&& ioapic->irr & (1 << index))
|
|
ioapic_service(ioapic, index, false);
|
|
kvm_vcpu_request_scan_ioapic(ioapic->kvm);
|
|
break;
|
|
}
|
|
}
|
|
|
|
static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
|
|
{
|
|
union kvm_ioapic_redirect_entry *entry = &ioapic->redirtbl[irq];
|
|
struct kvm_lapic_irq irqe;
|
|
int ret;
|
|
|
|
if (entry->fields.mask)
|
|
return -1;
|
|
|
|
ioapic_debug("dest=%x dest_mode=%x delivery_mode=%x "
|
|
"vector=%x trig_mode=%x\n",
|
|
entry->fields.dest_id, entry->fields.dest_mode,
|
|
entry->fields.delivery_mode, entry->fields.vector,
|
|
entry->fields.trig_mode);
|
|
|
|
irqe.dest_id = entry->fields.dest_id;
|
|
irqe.vector = entry->fields.vector;
|
|
irqe.dest_mode = entry->fields.dest_mode;
|
|
irqe.trig_mode = entry->fields.trig_mode;
|
|
irqe.delivery_mode = entry->fields.delivery_mode << 8;
|
|
irqe.level = 1;
|
|
irqe.shorthand = 0;
|
|
irqe.msi_redir_hint = false;
|
|
|
|
if (irqe.trig_mode == IOAPIC_EDGE_TRIG)
|
|
ioapic->irr_delivered |= 1 << irq;
|
|
|
|
if (irq == RTC_GSI && line_status) {
|
|
/*
|
|
* pending_eoi cannot ever become negative (see
|
|
* rtc_status_pending_eoi_check_valid) and the caller
|
|
* ensures that it is only called if it is >= zero, namely
|
|
* if rtc_irq_check_coalesced returns false).
|
|
*/
|
|
BUG_ON(ioapic->rtc_status.pending_eoi != 0);
|
|
ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe,
|
|
&ioapic->rtc_status.dest_map);
|
|
ioapic->rtc_status.pending_eoi = (ret < 0 ? 0 : ret);
|
|
} else
|
|
ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe, NULL);
|
|
|
|
if (ret && irqe.trig_mode == IOAPIC_LEVEL_TRIG)
|
|
entry->fields.remote_irr = 1;
|
|
|
|
return ret;
|
|
}
|
|
|
|
int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int irq_source_id,
|
|
int level, bool line_status)
|
|
{
|
|
int ret, irq_level;
|
|
|
|
BUG_ON(irq < 0 || irq >= IOAPIC_NUM_PINS);
|
|
|
|
spin_lock(&ioapic->lock);
|
|
irq_level = __kvm_irq_line_state(&ioapic->irq_states[irq],
|
|
irq_source_id, level);
|
|
ret = ioapic_set_irq(ioapic, irq, irq_level, line_status);
|
|
|
|
spin_unlock(&ioapic->lock);
|
|
|
|
return ret;
|
|
}
|
|
|
|
void kvm_ioapic_clear_all(struct kvm_ioapic *ioapic, int irq_source_id)
|
|
{
|
|
int i;
|
|
|
|
spin_lock(&ioapic->lock);
|
|
for (i = 0; i < KVM_IOAPIC_NUM_PINS; i++)
|
|
__clear_bit(irq_source_id, &ioapic->irq_states[i]);
|
|
spin_unlock(&ioapic->lock);
|
|
}
|
|
|
|
static void kvm_ioapic_eoi_inject_work(struct work_struct *work)
|
|
{
|
|
int i;
|
|
struct kvm_ioapic *ioapic = container_of(work, struct kvm_ioapic,
|
|
eoi_inject.work);
|
|
spin_lock(&ioapic->lock);
|
|
for (i = 0; i < IOAPIC_NUM_PINS; i++) {
|
|
union kvm_ioapic_redirect_entry *ent = &ioapic->redirtbl[i];
|
|
|
|
if (ent->fields.trig_mode != IOAPIC_LEVEL_TRIG)
|
|
continue;
|
|
|
|
if (ioapic->irr & (1 << i) && !ent->fields.remote_irr)
|
|
ioapic_service(ioapic, i, false);
|
|
}
|
|
spin_unlock(&ioapic->lock);
|
|
}
|
|
|
|
#define IOAPIC_SUCCESSIVE_IRQ_MAX_COUNT 10000
|
|
|
|
static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
|
|
struct kvm_ioapic *ioapic, int vector, int trigger_mode)
|
|
{
|
|
struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
|
|
struct kvm_lapic *apic = vcpu->arch.apic;
|
|
int i;
|
|
|
|
/* RTC special handling */
|
|
if (test_bit(vcpu->vcpu_id, dest_map->map) &&
|
|
vector == dest_map->vectors[vcpu->vcpu_id])
|
|
rtc_irq_eoi(ioapic, vcpu);
|
|
|
|
for (i = 0; i < IOAPIC_NUM_PINS; i++) {
|
|
union kvm_ioapic_redirect_entry *ent = &ioapic->redirtbl[i];
|
|
|
|
if (ent->fields.vector != vector)
|
|
continue;
|
|
|
|
/*
|
|
* We are dropping lock while calling ack notifiers because ack
|
|
* notifier callbacks for assigned devices call into IOAPIC
|
|
* recursively. Since remote_irr is cleared only after call
|
|
* to notifiers if the same vector will be delivered while lock
|
|
* is dropped it will be put into irr and will be delivered
|
|
* after ack notifier returns.
|
|
*/
|
|
spin_unlock(&ioapic->lock);
|
|
kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
|
|
spin_lock(&ioapic->lock);
|
|
|
|
if (trigger_mode != IOAPIC_LEVEL_TRIG ||
|
|
kvm_lapic_get_reg(apic, APIC_SPIV) & APIC_SPIV_DIRECTED_EOI)
|
|
continue;
|
|
|
|
ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
|
|
ent->fields.remote_irr = 0;
|
|
if (!ent->fields.mask && (ioapic->irr & (1 << i))) {
|
|
++ioapic->irq_eoi[i];
|
|
if (ioapic->irq_eoi[i] == IOAPIC_SUCCESSIVE_IRQ_MAX_COUNT) {
|
|
/*
|
|
* Real hardware does not deliver the interrupt
|
|
* immediately during eoi broadcast, and this
|
|
* lets a buggy guest make slow progress
|
|
* even if it does not correctly handle a
|
|
* level-triggered interrupt. Emulate this
|
|
* behavior if we detect an interrupt storm.
|
|
*/
|
|
schedule_delayed_work(&ioapic->eoi_inject, HZ / 100);
|
|
ioapic->irq_eoi[i] = 0;
|
|
trace_kvm_ioapic_delayed_eoi_inj(ent->bits);
|
|
} else {
|
|
ioapic_service(ioapic, i, false);
|
|
}
|
|
} else {
|
|
ioapic->irq_eoi[i] = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
void kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu, int vector, int trigger_mode)
|
|
{
|
|
struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
|
|
|
|
spin_lock(&ioapic->lock);
|
|
__kvm_ioapic_update_eoi(vcpu, ioapic, vector, trigger_mode);
|
|
spin_unlock(&ioapic->lock);
|
|
}
|
|
|
|
static inline struct kvm_ioapic *to_ioapic(struct kvm_io_device *dev)
|
|
{
|
|
return container_of(dev, struct kvm_ioapic, dev);
|
|
}
|
|
|
|
static inline int ioapic_in_range(struct kvm_ioapic *ioapic, gpa_t addr)
|
|
{
|
|
return ((addr >= ioapic->base_address &&
|
|
(addr < ioapic->base_address + IOAPIC_MEM_LENGTH)));
|
|
}
|
|
|
|
static int ioapic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
|
|
gpa_t addr, int len, void *val)
|
|
{
|
|
struct kvm_ioapic *ioapic = to_ioapic(this);
|
|
u32 result;
|
|
if (!ioapic_in_range(ioapic, addr))
|
|
return -EOPNOTSUPP;
|
|
|
|
ioapic_debug("addr %lx\n", (unsigned long)addr);
|
|
ASSERT(!(addr & 0xf)); /* check alignment */
|
|
|
|
addr &= 0xff;
|
|
spin_lock(&ioapic->lock);
|
|
switch (addr) {
|
|
case IOAPIC_REG_SELECT:
|
|
result = ioapic->ioregsel;
|
|
break;
|
|
|
|
case IOAPIC_REG_WINDOW:
|
|
result = ioapic_read_indirect(ioapic, addr, len);
|
|
break;
|
|
|
|
default:
|
|
result = 0;
|
|
break;
|
|
}
|
|
spin_unlock(&ioapic->lock);
|
|
|
|
switch (len) {
|
|
case 8:
|
|
*(u64 *) val = result;
|
|
break;
|
|
case 1:
|
|
case 2:
|
|
case 4:
|
|
memcpy(val, (char *)&result, len);
|
|
break;
|
|
default:
|
|
printk(KERN_WARNING "ioapic: wrong length %d\n", len);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int ioapic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
|
|
gpa_t addr, int len, const void *val)
|
|
{
|
|
struct kvm_ioapic *ioapic = to_ioapic(this);
|
|
u32 data;
|
|
if (!ioapic_in_range(ioapic, addr))
|
|
return -EOPNOTSUPP;
|
|
|
|
ioapic_debug("ioapic_mmio_write addr=%p len=%d val=%p\n",
|
|
(void*)addr, len, val);
|
|
ASSERT(!(addr & 0xf)); /* check alignment */
|
|
|
|
switch (len) {
|
|
case 8:
|
|
case 4:
|
|
data = *(u32 *) val;
|
|
break;
|
|
case 2:
|
|
data = *(u16 *) val;
|
|
break;
|
|
case 1:
|
|
data = *(u8 *) val;
|
|
break;
|
|
default:
|
|
printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
|
|
return 0;
|
|
}
|
|
|
|
addr &= 0xff;
|
|
spin_lock(&ioapic->lock);
|
|
switch (addr) {
|
|
case IOAPIC_REG_SELECT:
|
|
ioapic->ioregsel = data & 0xFF; /* 8-bit register */
|
|
break;
|
|
|
|
case IOAPIC_REG_WINDOW:
|
|
ioapic_write_indirect(ioapic, data);
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
spin_unlock(&ioapic->lock);
|
|
return 0;
|
|
}
|
|
|
|
static void kvm_ioapic_reset(struct kvm_ioapic *ioapic)
|
|
{
|
|
int i;
|
|
|
|
cancel_delayed_work_sync(&ioapic->eoi_inject);
|
|
for (i = 0; i < IOAPIC_NUM_PINS; i++)
|
|
ioapic->redirtbl[i].fields.mask = 1;
|
|
ioapic->base_address = IOAPIC_DEFAULT_BASE_ADDRESS;
|
|
ioapic->ioregsel = 0;
|
|
ioapic->irr = 0;
|
|
ioapic->irr_delivered = 0;
|
|
ioapic->id = 0;
|
|
memset(ioapic->irq_eoi, 0x00, sizeof(ioapic->irq_eoi));
|
|
rtc_irq_eoi_tracking_reset(ioapic);
|
|
}
|
|
|
|
static const struct kvm_io_device_ops ioapic_mmio_ops = {
|
|
.read = ioapic_mmio_read,
|
|
.write = ioapic_mmio_write,
|
|
};
|
|
|
|
int kvm_ioapic_init(struct kvm *kvm)
|
|
{
|
|
struct kvm_ioapic *ioapic;
|
|
int ret;
|
|
|
|
ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
|
|
if (!ioapic)
|
|
return -ENOMEM;
|
|
spin_lock_init(&ioapic->lock);
|
|
INIT_DELAYED_WORK(&ioapic->eoi_inject, kvm_ioapic_eoi_inject_work);
|
|
kvm->arch.vioapic = ioapic;
|
|
kvm_ioapic_reset(ioapic);
|
|
kvm_iodevice_init(&ioapic->dev, &ioapic_mmio_ops);
|
|
ioapic->kvm = kvm;
|
|
mutex_lock(&kvm->slots_lock);
|
|
ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, ioapic->base_address,
|
|
IOAPIC_MEM_LENGTH, &ioapic->dev);
|
|
mutex_unlock(&kvm->slots_lock);
|
|
if (ret < 0) {
|
|
kvm->arch.vioapic = NULL;
|
|
kfree(ioapic);
|
|
return ret;
|
|
}
|
|
|
|
kvm_vcpu_request_scan_ioapic(kvm);
|
|
return ret;
|
|
}
|
|
|
|
void kvm_ioapic_destroy(struct kvm *kvm)
|
|
{
|
|
struct kvm_ioapic *ioapic = kvm->arch.vioapic;
|
|
|
|
cancel_delayed_work_sync(&ioapic->eoi_inject);
|
|
kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &ioapic->dev);
|
|
kvm->arch.vioapic = NULL;
|
|
kfree(ioapic);
|
|
}
|
|
|
|
int kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
|
|
{
|
|
struct kvm_ioapic *ioapic = ioapic_irqchip(kvm);
|
|
if (!ioapic)
|
|
return -EINVAL;
|
|
|
|
spin_lock(&ioapic->lock);
|
|
memcpy(state, ioapic, sizeof(struct kvm_ioapic_state));
|
|
state->irr &= ~ioapic->irr_delivered;
|
|
spin_unlock(&ioapic->lock);
|
|
return 0;
|
|
}
|
|
|
|
int kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
|
|
{
|
|
struct kvm_ioapic *ioapic = ioapic_irqchip(kvm);
|
|
if (!ioapic)
|
|
return -EINVAL;
|
|
|
|
spin_lock(&ioapic->lock);
|
|
memcpy(ioapic, state, sizeof(struct kvm_ioapic_state));
|
|
ioapic->irr = 0;
|
|
ioapic->irr_delivered = 0;
|
|
kvm_vcpu_request_scan_ioapic(kvm);
|
|
kvm_ioapic_inject_all(ioapic, state->irr);
|
|
spin_unlock(&ioapic->lock);
|
|
return 0;
|
|
}
|