1. 08 Dec, 2016 11 commits
    • Ladi Prosek's avatar
      KVM: nVMX: fix CR3 load if L2 uses PAE paging and EPT · 7ca29de2
      Ladi Prosek authored
      KVM does not correctly handle L1 hypervisors that emulate L2 real mode with
      PAE and EPT, such as Hyper-V. In this mode, the L1 hypervisor populates guest
      PDPTE VMCS fields and leaves guest CR3 uninitialized because it is not used
      (see 26.3.2.4 Loading Page-Directory-Pointer-Table Entries). KVM always
      dereferences CR3 and tries to load PDPTEs if PAE is on. This leads to two
      related issues:
      
      1) On the first nested vmentry, the guest PDPTEs, as populated by L1, are
      overwritten in ept_load_pdptrs because the registers are believed to have
      been loaded in load_pdptrs as part of kvm_set_cr3. This is incorrect. L2 is
      running with PAE enabled but PDPTRs have been set up by L1.
      
      2) When L2 is about to enable paging and loads its CR3, we, again, attempt
      to load PDPTEs in load_pdptrs called from kvm_set_cr3. There are no guarantees
      that this will succeed (it's just a CR3 load, paging is not enabled yet) and
      if it doesn't, kvm_set_cr3 returns early without persisting the CR3 which is
      then lost and L2 crashes right after it enables paging.
      
      This patch replaces the kvm_set_cr3 call with a simple register write if PAE
      and EPT are both on. CR3 is not to be interpreted in this case.
      Signed-off-by: default avatarLadi Prosek <lprosek@redhat.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      7ca29de2
    • David Matlack's avatar
      KVM: nVMX: load GUEST_EFER after GUEST_CR0 during emulated VM-entry · 5a6a9748
      David Matlack authored
      vmx_set_cr0() modifies GUEST_EFER and "IA-32e mode guest" in the current
      VMCS. Call vmx_set_efer() after vmx_set_cr0() so that emulated VM-entry
      is more faithful to VMCS12.
      
      This patch correctly causes VM-entry to fail when "IA-32e mode guest" is
      1 and GUEST_CR0.PG is 0. Previously this configuration would succeed and
      "IA-32e mode guest" would silently be disabled by KVM.
      Signed-off-by: default avatarDavid Matlack <dmatlack@google.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      5a6a9748
    • David Matlack's avatar
      KVM: nVMX: generate MSR_IA32_CR{0,4}_FIXED1 from guest CPUID · 8322ebbb
      David Matlack authored
      MSR_IA32_CR{0,4}_FIXED1 define which bits in CR0 and CR4 are allowed to
      be 1 during VMX operation. Since the set of allowed-1 bits is the same
      in and out of VMX operation, we can generate these MSRs entirely from
      the guest's CPUID. This lets userspace avoiding having to save/restore
      these MSRs.
      
      This patch also initializes MSR_IA32_CR{0,4}_FIXED1 from the CPU's MSRs
      by default. This is a saner than the current default of -1ull, which
      includes bits that the host CPU does not support.
      Signed-off-by: default avatarDavid Matlack <dmatlack@google.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      8322ebbb
    • David Matlack's avatar
      KVM: nVMX: fix checks on CR{0,4} during virtual VMX operation · 3899152c
      David Matlack authored
      KVM emulates MSR_IA32_VMX_CR{0,4}_FIXED1 with the value -1ULL, meaning
      all CR0 and CR4 bits are allowed to be 1 during VMX operation.
      
      This does not match real hardware, which disallows the high 32 bits of
      CR0 to be 1, and disallows reserved bits of CR4 to be 1 (including bits
      which are defined in the SDM but missing according to CPUID). A guest
      can induce a VM-entry failure by setting these bits in GUEST_CR0 and
      GUEST_CR4, despite MSR_IA32_VMX_CR{0,4}_FIXED1 indicating they are
      valid.
      
      Since KVM has allowed all bits to be 1 in CR0 and CR4, the existing
      checks on these registers do not verify must-be-0 bits. Fix these checks
      to identify must-be-0 bits according to MSR_IA32_VMX_CR{0,4}_FIXED1.
      
      This patch should introduce no change in behavior in KVM, since these
      MSRs are still -1ULL.
      Signed-off-by: default avatarDavid Matlack <dmatlack@google.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      3899152c
    • David Matlack's avatar
      KVM: nVMX: support restore of VMX capability MSRs · 62cc6b9d
      David Matlack authored
      The VMX capability MSRs advertise the set of features the KVM virtual
      CPU can support. This set of features varies across different host CPUs
      and KVM versions. This patch aims to addresses both sources of
      differences, allowing VMs to be migrated across CPUs and KVM versions
      without guest-visible changes to these MSRs. Note that cross-KVM-
      version migration is only supported from this point forward.
      
      When the VMX capability MSRs are restored, they are audited to check
      that the set of features advertised are a subset of what KVM and the
      CPU support.
      
      Since the VMX capability MSRs are read-only, they do not need to be on
      the default MSR save/restore lists. The userspace hypervisor can set
      the values of these MSRs or read them from KVM at VCPU creation time,
      and restore the same value after every save/restore.
      Signed-off-by: default avatarDavid Matlack <dmatlack@google.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      62cc6b9d
    • David Matlack's avatar
      KVM: nVMX: generate non-true VMX MSRs based on true versions · 0115f9cb
      David Matlack authored
      The "non-true" VMX capability MSRs can be generated from their "true"
      counterparts, by OR-ing the default1 bits. The default1 bits are fixed
      and defined in the SDM.
      
      Since we can generate the non-true VMX MSRs from the true versions,
      there's no need to store both in struct nested_vmx. This also lets
      userspace avoid having to restore the non-true MSRs.
      
      Note this does not preclude emulating MSR_IA32_VMX_BASIC[55]=0. To do so,
      we simply need to set all the default1 bits in the true MSRs (such that
      the true MSRs and the generated non-true MSRs are equal).
      Signed-off-by: default avatarDavid Matlack <dmatlack@google.com>
      Suggested-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      0115f9cb
    • Kyle Huey's avatar
      KVM: x86: Do not clear RFLAGS.TF when a singlestep trap occurs. · ea07e42d
      Kyle Huey authored
      The trap flag stays set until software clears it.
      Signed-off-by: default avatarKyle Huey <khuey@kylehuey.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      ea07e42d
    • Kyle Huey's avatar
      KVM: x86: Add kvm_skip_emulated_instruction and use it. · 6affcbed
      Kyle Huey authored
      kvm_skip_emulated_instruction calls both
      kvm_x86_ops->skip_emulated_instruction and kvm_vcpu_check_singlestep,
      skipping the emulated instruction and generating a trap if necessary.
      
      Replacing skip_emulated_instruction calls with
      kvm_skip_emulated_instruction is straightforward, except for:
      
      - ICEBP, which is already inside a trap, so avoid triggering another trap.
      - Instructions that can trigger exits to userspace, such as the IO insns,
        MOVs to CR8, and HALT. If kvm_skip_emulated_instruction does trigger a
        KVM_GUESTDBG_SINGLESTEP exit, and the handling code for
        IN/OUT/MOV CR8/HALT also triggers an exit to userspace, the latter will
        take precedence. The singlestep will be triggered again on the next
        instruction, which is the current behavior.
      - Task switch instructions which would require additional handling (e.g.
        the task switch bit) and are instead left alone.
      - Cases where VMLAUNCH/VMRESUME do not proceed to the next instruction,
        which do not trigger singlestep traps as mentioned previously.
      Signed-off-by: default avatarKyle Huey <khuey@kylehuey.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      6affcbed
    • Kyle Huey's avatar
      KVM: VMX: Move skip_emulated_instruction out of nested_vmx_check_vmcs12 · eb277562
      Kyle Huey authored
      We can't return both the pass/fail boolean for the vmcs and the upcoming
      continue/exit-to-userspace boolean for skip_emulated_instruction out of
      nested_vmx_check_vmcs, so move skip_emulated_instruction out of it instead.
      
      Additionally, VMENTER/VMRESUME only trigger singlestep exceptions when
      they advance the IP to the following instruction, not when they a) succeed,
      b) fail MSR validation or c) throw an exception. Add a separate call to
      skip_emulated_instruction that will later not be converted to the variant
      that checks the singlestep flag.
      Signed-off-by: default avatarKyle Huey <khuey@kylehuey.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      eb277562
    • Kyle Huey's avatar
      KVM: VMX: Reorder some skip_emulated_instruction calls · 09ca3f20
      Kyle Huey authored
      The functions being moved ahead of skip_emulated_instruction here don't
      need updated IPs, and skipping the emulated instruction at the end will
      make it easier to return its value.
      Signed-off-by: default avatarKyle Huey <khuey@kylehuey.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      09ca3f20
    • Kyle Huey's avatar
      KVM: x86: Add a return value to kvm_emulate_cpuid · 6a908b62
      Kyle Huey authored
      Once skipping the emulated instruction can potentially trigger an exit to
      userspace (via KVM_GUESTDBG_SINGLESTEP) kvm_emulate_cpuid will need to
      propagate a return value.
      Signed-off-by: default avatarKyle Huey <khuey@kylehuey.com>
      Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
      6a908b62
  2. 06 Dec, 2016 1 commit
  3. 01 Dec, 2016 1 commit
  4. 29 Nov, 2016 2 commits
  5. 28 Nov, 2016 6 commits
  6. 24 Nov, 2016 5 commits
  7. 23 Nov, 2016 13 commits
    • Suraj Jitindar Singh's avatar
      KVM: PPC: Book3S HV: Update kvmppc_set_arch_compat() for ISA v3.00 · 2ee13be3
      Suraj Jitindar Singh authored
      The function kvmppc_set_arch_compat() is used to determine the value of the
      processor compatibility register (PCR) for a guest running in a given
      compatibility mode. There is currently no support for v3.00 of the ISA.
      
      Add support for v3.00 of the ISA which adds an ISA v2.07 compatilibity mode
      to the PCR.
      
      We also add a check to ensure the processor we are running on is capable of
      emulating the chosen processor (for example a POWER7 cannot emulate a
      POWER8, similarly with a POWER8 and a POWER9).
      
      Based on work by: Paul Mackerras <paulus@ozlabs.org>
      
      [paulus@ozlabs.org - moved dummy PCR_ARCH_300 definition here; set
       guest_pcr_bit when arch_compat == 0, added comment.]
      Signed-off-by: default avatarSuraj Jitindar Singh <sjitindarsingh@gmail.com>
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      2ee13be3
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Treat POWER9 CPU threads as independent subcores · 45c940ba
      Paul Mackerras authored
      With POWER9, each CPU thread has its own MMU context and can be
      in the host or a guest independently of the other threads; there is
      still however a restriction that all threads must use the same type
      of address translation, either radix tree or hashed page table (HPT).
      
      Since we only support HPT guests on a HPT host at this point, we
      can treat the threads as being independent, and avoid all of the
      work of coordinating the CPU threads.  To make this simpler, we
      introduce a new threads_per_vcore() function that returns 1 on
      POWER9 and threads_per_subcore on POWER7/8, and use that instead
      of threads_per_subcore or threads_per_core in various places.
      
      This also changes the value of the KVM_CAP_PPC_SMT capability on
      POWER9 systems from 4 to 1, so that userspace will not try to
      create VMs with multiple vcpus per vcore.  (If userspace did create
      a VM that thought it was in an SMT mode, the VM might try to use
      the msgsndp instruction, which will not work as expected.  In
      future it may be possible to trap and emulate msgsndp in order to
      allow VMs to think they are in an SMT mode, if only for the purpose
      of allowing migration from POWER8 systems.)
      
      With all this, we can now run guests on POWER9 as long as the host
      is running with HPT translation.  Since userspace currently has no
      way to request radix tree translation for the guest, the guest has
      no choice but to use HPT translation.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      45c940ba
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Enable hypervisor virtualization interrupts while in guest · 84f7139c
      Paul Mackerras authored
      The new XIVE interrupt controller on POWER9 can direct external
      interrupts to the hypervisor or the guest.  The interrupts directed to
      the hypervisor are controlled by an LPCR bit called LPCR_HVICE, and
      come in as a "hypervisor virtualization interrupt".  This sets the
      LPCR bit so that hypervisor virtualization interrupts can occur while
      we are in the guest.  We then also need to cope with exiting the guest
      because of a hypervisor virtualization interrupt.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      84f7139c
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Use stop instruction rather than nap on POWER9 · bf53c88e
      Paul Mackerras authored
      POWER9 replaces the various power-saving mode instructions on POWER8
      (doze, nap, sleep and rvwinkle) with a single "stop" instruction, plus
      a register, PSSCR, which controls the depth of the power-saving mode.
      This replaces the use of the nap instruction when threads are idle
      during guest execution with the stop instruction, and adds code to
      set PSSCR to a value which will allow an SMT mode switch while the
      thread is idle (given that the core as a whole won't be idle in these
      cases).
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      bf53c88e
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Use OPAL XICS emulation on POWER9 · f725758b
      Paul Mackerras authored
      POWER9 includes a new interrupt controller, called XIVE, which is
      quite different from the XICS interrupt controller on POWER7 and
      POWER8 machines.  KVM-HV accesses the XICS directly in several places
      in order to send and clear IPIs and handle interrupts from PCI
      devices being passed through to the guest.
      
      In order to make the transition to XIVE easier, OPAL firmware will
      include an emulation of XICS on top of XIVE.  Access to the emulated
      XICS is via OPAL calls.  The one complication is that the EOI
      (end-of-interrupt) function can now return a value indicating that
      another interrupt is pending; in this case, the XIVE will not signal
      an interrupt in hardware to the CPU, and software is supposed to
      acknowledge the new interrupt without waiting for another interrupt
      to be delivered in hardware.
      
      This adapts KVM-HV to use the OPAL calls on machines where there is
      no XICS hardware.  When there is no XICS, we look for a device-tree
      node with "ibm,opal-intc" in its compatible property, which is how
      OPAL indicates that it provides XICS emulation.
      
      In order to handle the EOI return value, kvmppc_read_intr() has
      become kvmppc_read_one_intr(), with a boolean variable passed by
      reference which can be set by the EOI functions to indicate that
      another interrupt is pending.  The new kvmppc_read_intr() keeps
      calling kvmppc_read_one_intr() until there are no more interrupts
      to process.  The return value from kvmppc_read_intr() is the
      largest non-zero value of the returns from kvmppc_read_one_intr().
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      f725758b
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Use msgsnd for IPIs to other cores on POWER9 · 1704a81c
      Paul Mackerras authored
      On POWER9, the msgsnd instruction is able to send interrupts to
      other cores, as well as other threads on the local core.  Since
      msgsnd is generally simpler and faster than sending an IPI via the
      XICS, we use msgsnd for all IPIs sent by KVM on POWER9.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      1704a81c
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Adapt TLB invalidations to work on POWER9 · 7c5b06ca
      Paul Mackerras authored
      POWER9 adds new capabilities to the tlbie (TLB invalidate entry)
      and tlbiel (local tlbie) instructions.  Both instructions get a
      set of new parameters (RIC, PRS and R) which appear as bits in the
      instruction word.  The tlbiel instruction now has a second register
      operand, which contains a PID and/or LPID value if needed, and
      should otherwise contain 0.
      
      This adapts KVM-HV's usage of tlbie and tlbiel to work on POWER9
      as well as older processors.  Since we only handle HPT guests so
      far, we need RIC=0 PRS=0 R=0, which ends up with the same instruction
      word as on previous processors, so we don't need to conditionally
      execute different instructions depending on the processor.
      
      The local flush on first entry to a guest in book3s_hv_rmhandlers.S
      is a loop which depends on the number of TLB sets.  Rather than
      using feature sections to set the number of iterations based on
      which CPU we're on, we now work out this number at VM creation time
      and store it in the kvm_arch struct.  That will make it possible to
      get the number from the device tree in future, which will help with
      compatibility with future processors.
      
      Since mmu_partition_table_set_entry() does a global flush of the
      whole LPID, we don't need to do the TLB flush on first entry to the
      guest on each processor.  Therefore we don't set all bits in the
      tlb_need_flush bitmap on VM startup on POWER9.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      7c5b06ca
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Add new POWER9 guest-accessible SPRs · e9cf1e08
      Paul Mackerras authored
      This adds code to handle two new guest-accessible special-purpose
      registers on POWER9: TIDR (thread ID register) and PSSCR (processor
      stop status and control register).  They are context-switched
      between host and guest, and the guest values can be read and set
      via the one_reg interface.
      
      The PSSCR contains some fields which are guest-accessible and some
      which are only accessible in hypervisor mode.  We only allow the
      guest-accessible fields to be read or set by userspace.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      e9cf1e08
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Adjust host/guest context switch for POWER9 · 83677f55
      Paul Mackerras authored
      Some special-purpose registers that were present and accessible
      by guests on POWER8 no longer exist on POWER9, so this adds
      feature sections to ensure that we don't try to context-switch
      them when going into or out of a guest on POWER9.  These are
      all relatively obscure, rarely-used registers, but we had to
      context-switch them on POWER8 to avoid creating a covert channel.
      They are: SPMC1, SPMC2, MMCRS, CSIGR, TACR, TCSCR, and ACOP.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      83677f55
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Set partition table rather than SDR1 on POWER9 · 7a84084c
      Paul Mackerras authored
      On POWER9, the SDR1 register (hashed page table base address) is no
      longer used, and instead the hardware reads the HPT base address
      and size from the partition table.  The partition table entry also
      contains the bits that specify the page size for the VRMA mapping,
      which were previously in the LPCR.  The VPM0 bit of the LPCR is
      now reserved; the processor now always uses the VRMA (virtual
      real-mode area) mechanism for guest real-mode accesses in HPT mode,
      and the RMO (real-mode offset) mechanism has been dropped.
      
      When entering or exiting the guest, we now only have to set the
      LPIDR (logical partition ID register), not the SDR1 register.
      There is also no requirement now to transition via a reserved
      LPID value.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      7a84084c
    • Paul Mackerras's avatar
      KVM: PPC: Book3S HV: Adapt to new HPTE format on POWER9 · abb7c7dd
      Paul Mackerras authored
      This adapts the KVM-HV hashed page table (HPT) code to read and write
      HPT entries in the new format defined in Power ISA v3.00 on POWER9
      machines.  The new format moves the B (segment size) field from the
      first doubleword to the second, and trims some bits from the AVA
      (abbreviated virtual address) and ARPN (abbreviated real page number)
      fields.  As far as possible, the conversion is done when reading or
      writing the HPT entries, and the rest of the code continues to use
      the old format.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      abb7c7dd
    • Paul Mackerras's avatar
      Merge remote-tracking branch 'remotes/powerpc/topic/ppc-kvm' into kvm-ppc-next · bc33b1fc
      Paul Mackerras authored
      This merges in the ppc-kvm topic branch to get changes to
      arch/powerpc code that are necessary for adding POWER9 KVM support.
      Signed-off-by: default avatarPaul Mackerras <paulus@ozlabs.org>
      bc33b1fc
    • Michael Neuling's avatar
      powerpc/powernv: Define and set POWER9 HFSCR doorbell bit · 02ed21ae
      Michael Neuling authored
      Define and set the POWER9 HFSCR doorbell bit so that guests can use
      msgsndp.
      
      ISA 3.0 calls this MSGP, so name it accordingly in the code.
      Signed-off-by: default avatarMichael Neuling <mikey@neuling.org>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      02ed21ae
  8. 22 Nov, 2016 1 commit