2008-01-28 05:10:22 +08:00
|
|
|
/*
|
|
|
|
* 8253/8254 interval timer emulation
|
|
|
|
*
|
|
|
|
* Copyright (c) 2003-2004 Fabrice Bellard
|
|
|
|
* Copyright (c) 2006 Intel Corporation
|
|
|
|
* Copyright (c) 2007 Keir Fraser, XenSource Inc
|
|
|
|
* Copyright (c) 2008 Intel Corporation
|
2010-10-06 20:23:22 +08:00
|
|
|
* Copyright 2009 Red Hat, Inc. and/or its affiliates.
|
2008-01-28 05:10:22 +08:00
|
|
|
*
|
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
|
|
* in the Software without restriction, including without limitation the rights
|
|
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
|
|
* furnished to do so, subject to the following conditions:
|
|
|
|
*
|
|
|
|
* The above copyright notice and this permission notice shall be included in
|
|
|
|
* all copies or substantial portions of the Software.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
|
|
* THE SOFTWARE.
|
|
|
|
*
|
|
|
|
* Authors:
|
|
|
|
* Sheng Yang <sheng.yang@intel.com>
|
|
|
|
* Based on QEMU and Xen.
|
|
|
|
*/
|
|
|
|
|
2009-12-10 02:45:35 +08:00
|
|
|
#define pr_fmt(fmt) "pit: " fmt
|
|
|
|
|
2008-01-28 05:10:22 +08:00
|
|
|
#include <linux/kvm_host.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 16:04:11 +08:00
|
|
|
#include <linux/slab.h>
|
2008-01-28 05:10:22 +08:00
|
|
|
|
2015-07-30 14:21:40 +08:00
|
|
|
#include "ioapic.h"
|
2008-01-28 05:10:22 +08:00
|
|
|
#include "irq.h"
|
|
|
|
#include "i8254.h"
|
2014-01-06 22:00:02 +08:00
|
|
|
#include "x86.h"
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
#ifndef CONFIG_X86_64
|
2008-05-01 19:34:28 +08:00
|
|
|
#define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
|
2008-01-28 05:10:22 +08:00
|
|
|
#else
|
|
|
|
#define mod_64(x, y) ((x) % (y))
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#define RW_STATE_LSB 1
|
|
|
|
#define RW_STATE_MSB 2
|
|
|
|
#define RW_STATE_WORD0 3
|
|
|
|
#define RW_STATE_WORD1 4
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static void pit_set_gate(struct kvm_pit *pit, int channel, u32 val)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_channel_state *c = &pit->pit_state.channels[channel];
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
switch (c->mode) {
|
|
|
|
default:
|
|
|
|
case 0:
|
|
|
|
case 4:
|
|
|
|
/* XXX: just disable/enable counting */
|
|
|
|
break;
|
|
|
|
case 1:
|
|
|
|
case 2:
|
|
|
|
case 3:
|
|
|
|
case 5:
|
|
|
|
/* Restart counting on rising edge. */
|
|
|
|
if (c->gate < val)
|
|
|
|
c->count_load_time = ktime_get();
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
c->gate = val;
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static int pit_get_gate(struct kvm_pit *pit, int channel)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
return pit->pit_state.channels[channel].gate;
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static s64 __kpit_elapsed(struct kvm_pit *pit)
|
2009-02-23 21:57:40 +08:00
|
|
|
{
|
|
|
|
s64 elapsed;
|
|
|
|
ktime_t remaining;
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_state *ps = &pit->pit_state;
|
2009-02-23 21:57:40 +08:00
|
|
|
|
2012-07-26 23:01:53 +08:00
|
|
|
if (!ps->period)
|
2009-07-03 07:02:15 +08:00
|
|
|
return 0;
|
|
|
|
|
2009-04-09 00:14:19 +08:00
|
|
|
/*
|
|
|
|
* The Counter does not stop when it reaches zero. In
|
|
|
|
* Modes 0, 1, 4, and 5 the Counter ``wraps around'' to
|
|
|
|
* the highest count, either FFFF hex for binary counting
|
|
|
|
* or 9999 for BCD counting, and continues counting.
|
|
|
|
* Modes 2 and 3 are periodic; the Counter reloads
|
|
|
|
* itself with the initial count and continues counting
|
|
|
|
* from there.
|
|
|
|
*/
|
2012-07-26 23:01:53 +08:00
|
|
|
remaining = hrtimer_get_remaining(&ps->timer);
|
|
|
|
elapsed = ps->period - ktime_to_ns(remaining);
|
2009-02-23 21:57:40 +08:00
|
|
|
|
|
|
|
return elapsed;
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static s64 kpit_elapsed(struct kvm_pit *pit, struct kvm_kpit_channel_state *c,
|
2009-02-23 21:57:40 +08:00
|
|
|
int channel)
|
|
|
|
{
|
|
|
|
if (channel == 0)
|
2016-03-03 05:56:43 +08:00
|
|
|
return __kpit_elapsed(pit);
|
2009-02-23 21:57:40 +08:00
|
|
|
|
|
|
|
return ktime_to_ns(ktime_sub(ktime_get(), c->count_load_time));
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static int pit_get_count(struct kvm_pit *pit, int channel)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_channel_state *c = &pit->pit_state.channels[channel];
|
2008-01-28 05:10:22 +08:00
|
|
|
s64 d, t;
|
|
|
|
int counter;
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
t = kpit_elapsed(pit, c, channel);
|
2016-03-04 16:28:41 +08:00
|
|
|
d = mul_u64_u32_div(t, KVM_PIT_FREQ, NSEC_PER_SEC);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
switch (c->mode) {
|
|
|
|
case 0:
|
|
|
|
case 1:
|
|
|
|
case 4:
|
|
|
|
case 5:
|
|
|
|
counter = (c->count - d) & 0xffff;
|
|
|
|
break;
|
|
|
|
case 3:
|
|
|
|
/* XXX: may be incorrect for odd counts */
|
|
|
|
counter = c->count - (mod_64((2 * d), c->count));
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
counter = c->count - mod_64(d, c->count);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
return counter;
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static int pit_get_out(struct kvm_pit *pit, int channel)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_channel_state *c = &pit->pit_state.channels[channel];
|
2008-01-28 05:10:22 +08:00
|
|
|
s64 d, t;
|
|
|
|
int out;
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
t = kpit_elapsed(pit, c, channel);
|
2016-03-04 16:28:41 +08:00
|
|
|
d = mul_u64_u32_div(t, KVM_PIT_FREQ, NSEC_PER_SEC);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
switch (c->mode) {
|
|
|
|
default:
|
|
|
|
case 0:
|
|
|
|
out = (d >= c->count);
|
|
|
|
break;
|
|
|
|
case 1:
|
|
|
|
out = (d < c->count);
|
|
|
|
break;
|
|
|
|
case 2:
|
|
|
|
out = ((mod_64(d, c->count) == 0) && (d != 0));
|
|
|
|
break;
|
|
|
|
case 3:
|
|
|
|
out = (mod_64(d, c->count) < ((c->count + 1) >> 1));
|
|
|
|
break;
|
|
|
|
case 4:
|
|
|
|
case 5:
|
|
|
|
out = (d == c->count);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return out;
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static void pit_latch_count(struct kvm_pit *pit, int channel)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_channel_state *c = &pit->pit_state.channels[channel];
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
if (!c->count_latched) {
|
2016-03-03 05:56:43 +08:00
|
|
|
c->latched_count = pit_get_count(pit, channel);
|
2008-01-28 05:10:22 +08:00
|
|
|
c->count_latched = c->rw_mode;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static void pit_latch_status(struct kvm_pit *pit, int channel)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_channel_state *c = &pit->pit_state.channels[channel];
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
if (!c->status_latched) {
|
|
|
|
/* TODO: Return NULL COUNT (bit 6). */
|
2016-03-03 05:56:43 +08:00
|
|
|
c->status = ((pit_get_out(pit, channel) << 7) |
|
2008-01-28 05:10:22 +08:00
|
|
|
(c->rw_mode << 4) |
|
|
|
|
(c->mode << 1) |
|
|
|
|
c->bcd);
|
|
|
|
c->status_latched = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:48 +08:00
|
|
|
static inline struct kvm_pit *pit_state_to_pit(struct kvm_kpit_state *ps)
|
|
|
|
{
|
|
|
|
return container_of(ps, struct kvm_pit, pit_state);
|
|
|
|
}
|
|
|
|
|
2008-08-12 07:54:20 +08:00
|
|
|
static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier *kian)
|
2008-07-27 04:01:01 +08:00
|
|
|
{
|
|
|
|
struct kvm_kpit_state *ps = container_of(kian, struct kvm_kpit_state,
|
|
|
|
irq_ack_notifier);
|
2016-03-03 05:56:48 +08:00
|
|
|
struct kvm_pit *pit = pit_state_to_pit(ps);
|
2010-06-17 05:11:11 +08:00
|
|
|
|
KVM: i8254: use atomic_t instead of pit.inject_lock
The lock was an overkill, the same can be done with atomics.
A mb() was added in kvm_pit_ack_irq, to pair with implicit barrier
between pit_timer_fn and pit_do_work. The mb() prevents a race that
could happen if pending == 0 and irq_ack == 0:
kvm_pit_ack_irq: | pit_timer_fn:
p = atomic_read(&ps->pending); |
| atomic_inc(&ps->pending);
| queue_work(pit_do_work);
| pit_do_work:
| atomic_xchg(&ps->irq_ack, 0);
| return;
atomic_set(&ps->irq_ack, 1); |
if (p == 0) return; |
where the interrupt would not be delivered in this tick of pit_timer_fn.
PIT would have eventually delivered the interrupt, but we sacrifice
perofmance to make sure that interrupts are not needlessly delayed.
sfence isn't enough: atomic_dec_if_positive does atomic_read first and
x86 can reorder loads before stores. lfence isn't enough: store can
pass lfence, turning it into a nop. A compiler barrier would be more
than enough as CPU needs to stall for unbelievably long to use fences.
This patch doesn't do anything in kvm_pit_reset_reinject, because any
order of resets can race, but the result differs by at most one
interrupt, which is ok, because it's the same result as if the reset
happened at a slightly different time. (Original code didn't protect
the reset path with a proper lock, so users have to be robust.)
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-03 05:56:41 +08:00
|
|
|
atomic_set(&ps->irq_ack, 1);
|
|
|
|
/* irq_ack should be set before pending is read. Order accesses with
|
|
|
|
* inc(pending) in pit_timer_fn and xchg(irq_ack, 0) in pit_do_work.
|
|
|
|
*/
|
|
|
|
smp_mb();
|
2016-03-03 05:56:45 +08:00
|
|
|
if (atomic_dec_if_positive(&ps->pending) > 0)
|
2016-10-19 19:50:47 +08:00
|
|
|
kthread_queue_work(pit->worker, &pit->expired);
|
2008-07-27 04:01:01 +08:00
|
|
|
}
|
|
|
|
|
2008-05-27 23:10:20 +08:00
|
|
|
void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
|
|
|
|
{
|
|
|
|
struct kvm_pit *pit = vcpu->kvm->arch.vpit;
|
|
|
|
struct hrtimer *timer;
|
|
|
|
|
2021-07-14 00:32:51 +08:00
|
|
|
/* Somewhat arbitrarily make vcpu0 the owner of the PIT. */
|
|
|
|
if (vcpu->vcpu_id || !pit)
|
2008-05-27 23:10:20 +08:00
|
|
|
return;
|
|
|
|
|
2012-07-26 23:01:53 +08:00
|
|
|
timer = &pit->pit_state.timer;
|
2014-08-28 05:42:54 +08:00
|
|
|
mutex_lock(&pit->pit_state.lock);
|
2008-05-27 23:10:20 +08:00
|
|
|
if (hrtimer_cancel(timer))
|
2008-09-02 05:55:57 +08:00
|
|
|
hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
|
2014-08-28 05:42:54 +08:00
|
|
|
mutex_unlock(&pit->pit_state.lock);
|
2008-05-27 23:10:20 +08:00
|
|
|
}
|
|
|
|
|
2010-06-17 05:11:11 +08:00
|
|
|
static void destroy_pit_timer(struct kvm_pit *pit)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2012-07-26 23:01:53 +08:00
|
|
|
hrtimer_cancel(&pit->pit_state.timer);
|
2016-10-12 04:55:20 +08:00
|
|
|
kthread_flush_work(&pit->expired);
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
|
2012-04-24 22:40:17 +08:00
|
|
|
static void pit_do_work(struct kthread_work *work)
|
2010-06-17 05:11:11 +08:00
|
|
|
{
|
|
|
|
struct kvm_pit *pit = container_of(work, struct kvm_pit, expired);
|
|
|
|
struct kvm *kvm = pit->kvm;
|
|
|
|
struct kvm_vcpu *vcpu;
|
|
|
|
int i;
|
|
|
|
struct kvm_kpit_state *ps = &pit->pit_state;
|
|
|
|
|
2016-03-03 05:56:52 +08:00
|
|
|
if (atomic_read(&ps->reinject) && !atomic_xchg(&ps->irq_ack, 0))
|
KVM: i8254: use atomic_t instead of pit.inject_lock
The lock was an overkill, the same can be done with atomics.
A mb() was added in kvm_pit_ack_irq, to pair with implicit barrier
between pit_timer_fn and pit_do_work. The mb() prevents a race that
could happen if pending == 0 and irq_ack == 0:
kvm_pit_ack_irq: | pit_timer_fn:
p = atomic_read(&ps->pending); |
| atomic_inc(&ps->pending);
| queue_work(pit_do_work);
| pit_do_work:
| atomic_xchg(&ps->irq_ack, 0);
| return;
atomic_set(&ps->irq_ack, 1); |
if (p == 0) return; |
where the interrupt would not be delivered in this tick of pit_timer_fn.
PIT would have eventually delivered the interrupt, but we sacrifice
perofmance to make sure that interrupts are not needlessly delayed.
sfence isn't enough: atomic_dec_if_positive does atomic_read first and
x86 can reorder loads before stores. lfence isn't enough: store can
pass lfence, turning it into a nop. A compiler barrier would be more
than enough as CPU needs to stall for unbelievably long to use fences.
This patch doesn't do anything in kvm_pit_reset_reinject, because any
order of resets can race, but the result differs by at most one
interrupt, which is ok, because it's the same result as if the reset
happened at a slightly different time. (Original code didn't protect
the reset path with a proper lock, so users have to be robust.)
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-03 05:56:41 +08:00
|
|
|
return;
|
|
|
|
|
2016-03-03 05:56:49 +08:00
|
|
|
kvm_set_irq(kvm, pit->irq_source_id, 0, 1, false);
|
|
|
|
kvm_set_irq(kvm, pit->irq_source_id, 0, 0, false);
|
KVM: i8254: use atomic_t instead of pit.inject_lock
The lock was an overkill, the same can be done with atomics.
A mb() was added in kvm_pit_ack_irq, to pair with implicit barrier
between pit_timer_fn and pit_do_work. The mb() prevents a race that
could happen if pending == 0 and irq_ack == 0:
kvm_pit_ack_irq: | pit_timer_fn:
p = atomic_read(&ps->pending); |
| atomic_inc(&ps->pending);
| queue_work(pit_do_work);
| pit_do_work:
| atomic_xchg(&ps->irq_ack, 0);
| return;
atomic_set(&ps->irq_ack, 1); |
if (p == 0) return; |
where the interrupt would not be delivered in this tick of pit_timer_fn.
PIT would have eventually delivered the interrupt, but we sacrifice
perofmance to make sure that interrupts are not needlessly delayed.
sfence isn't enough: atomic_dec_if_positive does atomic_read first and
x86 can reorder loads before stores. lfence isn't enough: store can
pass lfence, turning it into a nop. A compiler barrier would be more
than enough as CPU needs to stall for unbelievably long to use fences.
This patch doesn't do anything in kvm_pit_reset_reinject, because any
order of resets can race, but the result differs by at most one
interrupt, which is ok, because it's the same result as if the reset
happened at a slightly different time. (Original code didn't protect
the reset path with a proper lock, so users have to be robust.)
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-03 05:56:41 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Provides NMI watchdog support via Virtual Wire mode.
|
|
|
|
* The route is: PIT -> LVT0 in NMI mode.
|
|
|
|
*
|
|
|
|
* Note: Our Virtual Wire implementation does not follow
|
|
|
|
* the MP specification. We propagate a PIT interrupt to all
|
|
|
|
* VCPUs and only when LVT0 is in NMI mode. The interrupt can
|
|
|
|
* also be simultaneously delivered through PIC and IOAPIC.
|
2010-06-17 05:11:11 +08:00
|
|
|
*/
|
KVM: i8254: use atomic_t instead of pit.inject_lock
The lock was an overkill, the same can be done with atomics.
A mb() was added in kvm_pit_ack_irq, to pair with implicit barrier
between pit_timer_fn and pit_do_work. The mb() prevents a race that
could happen if pending == 0 and irq_ack == 0:
kvm_pit_ack_irq: | pit_timer_fn:
p = atomic_read(&ps->pending); |
| atomic_inc(&ps->pending);
| queue_work(pit_do_work);
| pit_do_work:
| atomic_xchg(&ps->irq_ack, 0);
| return;
atomic_set(&ps->irq_ack, 1); |
if (p == 0) return; |
where the interrupt would not be delivered in this tick of pit_timer_fn.
PIT would have eventually delivered the interrupt, but we sacrifice
perofmance to make sure that interrupts are not needlessly delayed.
sfence isn't enough: atomic_dec_if_positive does atomic_read first and
x86 can reorder loads before stores. lfence isn't enough: store can
pass lfence, turning it into a nop. A compiler barrier would be more
than enough as CPU needs to stall for unbelievably long to use fences.
This patch doesn't do anything in kvm_pit_reset_reinject, because any
order of resets can race, but the result differs by at most one
interrupt, which is ok, because it's the same result as if the reset
happened at a slightly different time. (Original code didn't protect
the reset path with a proper lock, so users have to be robust.)
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-03 05:56:41 +08:00
|
|
|
if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
|
|
|
|
kvm_for_each_vcpu(i, vcpu, kvm)
|
|
|
|
kvm_apic_nmi_wd_deliver(vcpu);
|
2010-06-17 05:11:11 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
static enum hrtimer_restart pit_timer_fn(struct hrtimer *data)
|
|
|
|
{
|
2012-07-26 23:01:53 +08:00
|
|
|
struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, timer);
|
2016-03-03 05:56:48 +08:00
|
|
|
struct kvm_pit *pt = pit_state_to_pit(ps);
|
2010-06-17 05:11:11 +08:00
|
|
|
|
2016-03-03 05:56:52 +08:00
|
|
|
if (atomic_read(&ps->reinject))
|
2012-07-26 23:01:53 +08:00
|
|
|
atomic_inc(&ps->pending);
|
2016-03-03 05:56:38 +08:00
|
|
|
|
2016-10-19 19:50:47 +08:00
|
|
|
kthread_queue_work(pt->worker, &pt->expired);
|
2010-06-17 05:11:11 +08:00
|
|
|
|
2012-07-26 23:01:53 +08:00
|
|
|
if (ps->is_periodic) {
|
|
|
|
hrtimer_add_expires_ns(&ps->timer, ps->period);
|
2010-06-17 05:11:11 +08:00
|
|
|
return HRTIMER_RESTART;
|
|
|
|
} else
|
|
|
|
return HRTIMER_NORESTART;
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:40 +08:00
|
|
|
static inline void kvm_pit_reset_reinject(struct kvm_pit *pit)
|
|
|
|
{
|
|
|
|
atomic_set(&pit->pit_state.pending, 0);
|
KVM: i8254: use atomic_t instead of pit.inject_lock
The lock was an overkill, the same can be done with atomics.
A mb() was added in kvm_pit_ack_irq, to pair with implicit barrier
between pit_timer_fn and pit_do_work. The mb() prevents a race that
could happen if pending == 0 and irq_ack == 0:
kvm_pit_ack_irq: | pit_timer_fn:
p = atomic_read(&ps->pending); |
| atomic_inc(&ps->pending);
| queue_work(pit_do_work);
| pit_do_work:
| atomic_xchg(&ps->irq_ack, 0);
| return;
atomic_set(&ps->irq_ack, 1); |
if (p == 0) return; |
where the interrupt would not be delivered in this tick of pit_timer_fn.
PIT would have eventually delivered the interrupt, but we sacrifice
perofmance to make sure that interrupts are not needlessly delayed.
sfence isn't enough: atomic_dec_if_positive does atomic_read first and
x86 can reorder loads before stores. lfence isn't enough: store can
pass lfence, turning it into a nop. A compiler barrier would be more
than enough as CPU needs to stall for unbelievably long to use fences.
This patch doesn't do anything in kvm_pit_reset_reinject, because any
order of resets can race, but the result differs by at most one
interrupt, which is ok, because it's the same result as if the reset
happened at a slightly different time. (Original code didn't protect
the reset path with a proper lock, so users have to be robust.)
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-03 05:56:41 +08:00
|
|
|
atomic_set(&pit->pit_state.irq_ack, 1);
|
2016-03-03 05:56:40 +08:00
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:45 +08:00
|
|
|
void kvm_pit_set_reinject(struct kvm_pit *pit, bool reinject)
|
|
|
|
{
|
|
|
|
struct kvm_kpit_state *ps = &pit->pit_state;
|
|
|
|
struct kvm *kvm = pit->kvm;
|
|
|
|
|
2016-03-03 05:56:52 +08:00
|
|
|
if (atomic_read(&ps->reinject) == reinject)
|
2016-03-03 05:56:45 +08:00
|
|
|
return;
|
|
|
|
|
2019-11-15 04:15:16 +08:00
|
|
|
/*
|
|
|
|
* AMD SVM AVIC accelerates EOI write and does not trap.
|
|
|
|
* This cause in-kernel PIT re-inject mode to fail
|
|
|
|
* since it checks ps->irq_ack before kvm_set_irq()
|
|
|
|
* and relies on the ack notifier to timely queue
|
|
|
|
* the pt->worker work iterm and reinject the missed tick.
|
|
|
|
* So, deactivate APICv when PIT is in reinject mode.
|
|
|
|
*/
|
2016-03-03 05:56:45 +08:00
|
|
|
if (reinject) {
|
2019-11-15 04:15:16 +08:00
|
|
|
kvm_request_apicv_update(kvm, false,
|
|
|
|
APICV_INHIBIT_REASON_PIT_REINJ);
|
2016-03-03 05:56:45 +08:00
|
|
|
/* The initial state is preserved while ps->reinject == 0. */
|
|
|
|
kvm_pit_reset_reinject(pit);
|
|
|
|
kvm_register_irq_ack_notifier(kvm, &ps->irq_ack_notifier);
|
|
|
|
kvm_register_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
|
|
|
|
} else {
|
2019-11-15 04:15:16 +08:00
|
|
|
kvm_request_apicv_update(kvm, true,
|
|
|
|
APICV_INHIBIT_REASON_PIT_REINJ);
|
2016-03-03 05:56:45 +08:00
|
|
|
kvm_unregister_irq_ack_notifier(kvm, &ps->irq_ack_notifier);
|
|
|
|
kvm_unregister_irq_mask_notifier(kvm, 0, &pit->mask_notifier);
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:52 +08:00
|
|
|
atomic_set(&ps->reinject, reinject);
|
2016-03-03 05:56:45 +08:00
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static void create_pit_timer(struct kvm_pit *pit, u32 val, int is_period)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_state *ps = &pit->pit_state;
|
|
|
|
struct kvm *kvm = pit->kvm;
|
2008-01-28 05:10:22 +08:00
|
|
|
s64 interval;
|
|
|
|
|
2015-07-30 14:21:40 +08:00
|
|
|
if (!ioapic_in_kernel(kvm) ||
|
|
|
|
ps->flags & KVM_PIT_FLAGS_HPET_LEGACY)
|
2011-12-15 02:25:13 +08:00
|
|
|
return;
|
|
|
|
|
2016-03-04 16:28:41 +08:00
|
|
|
interval = mul_u64_u32_div(val, NSEC_PER_SEC, KVM_PIT_FREQ);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
2009-12-10 02:45:35 +08:00
|
|
|
pr_debug("create pit timer, interval is %llu nsec\n", interval);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
/* TODO The new value only affected after the retriggered */
|
2012-07-26 23:01:53 +08:00
|
|
|
hrtimer_cancel(&ps->timer);
|
2016-10-12 04:55:20 +08:00
|
|
|
kthread_flush_work(&pit->expired);
|
2012-07-26 23:01:53 +08:00
|
|
|
ps->period = interval;
|
2009-02-23 21:57:41 +08:00
|
|
|
ps->is_periodic = is_period;
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
kvm_pit_reset_reinject(pit);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
2014-01-06 22:00:02 +08:00
|
|
|
/*
|
|
|
|
* Do not allow the guest to program periodic timers with small
|
|
|
|
* interval, since the hrtimers are not throttled by the host
|
|
|
|
* scheduler.
|
|
|
|
*/
|
|
|
|
if (ps->is_periodic) {
|
|
|
|
s64 min_period = min_timer_period_us * 1000LL;
|
|
|
|
|
|
|
|
if (ps->period < min_period) {
|
|
|
|
pr_info_ratelimited(
|
|
|
|
"kvm: requested %lld ns "
|
|
|
|
"i8254 timer period limited to %lld ns\n",
|
|
|
|
ps->period, min_period);
|
|
|
|
ps->period = min_period;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-07-26 23:01:53 +08:00
|
|
|
hrtimer_start(&ps->timer, ktime_add_ns(ktime_get(), interval),
|
2008-01-28 05:10:22 +08:00
|
|
|
HRTIMER_MODE_ABS);
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
static void pit_load_count(struct kvm_pit *pit, int channel, u32 val)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2016-03-03 05:56:43 +08:00
|
|
|
struct kvm_kpit_state *ps = &pit->pit_state;
|
2008-01-28 05:10:22 +08:00
|
|
|
|
2020-02-15 10:44:22 +08:00
|
|
|
pr_debug("load_count val is %u, channel is %d\n", val, channel);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
/*
|
2009-04-09 00:14:19 +08:00
|
|
|
* The largest possible initial count is 0; this is equivalent
|
|
|
|
* to 216 for binary counting and 104 for BCD counting.
|
2008-01-28 05:10:22 +08:00
|
|
|
*/
|
|
|
|
if (val == 0)
|
|
|
|
val = 0x10000;
|
|
|
|
|
|
|
|
ps->channels[channel].count = val;
|
|
|
|
|
2009-02-23 21:57:40 +08:00
|
|
|
if (channel != 0) {
|
|
|
|
ps->channels[channel].count_load_time = ktime_get();
|
2008-01-28 05:10:22 +08:00
|
|
|
return;
|
2009-02-23 21:57:40 +08:00
|
|
|
}
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
/* Two types of timer
|
|
|
|
* mode 1 is one shot, mode 2 is period, otherwise del timer */
|
|
|
|
switch (ps->channels[0].mode) {
|
2009-04-09 00:14:19 +08:00
|
|
|
case 0:
|
2008-01-28 05:10:22 +08:00
|
|
|
case 1:
|
2008-05-01 00:23:54 +08:00
|
|
|
/* FIXME: enhance mode 4 precision */
|
|
|
|
case 4:
|
2016-03-03 05:56:43 +08:00
|
|
|
create_pit_timer(pit, val, 0);
|
2008-01-28 05:10:22 +08:00
|
|
|
break;
|
|
|
|
case 2:
|
2008-05-02 23:02:23 +08:00
|
|
|
case 3:
|
2016-03-03 05:56:43 +08:00
|
|
|
create_pit_timer(pit, val, 1);
|
2008-01-28 05:10:22 +08:00
|
|
|
break;
|
|
|
|
default:
|
2016-03-03 05:56:43 +08:00
|
|
|
destroy_pit_timer(pit);
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
void kvm_pit_load_count(struct kvm_pit *pit, int channel, u32 val,
|
|
|
|
int hpet_legacy_start)
|
2008-03-04 00:50:59 +08:00
|
|
|
{
|
2009-07-07 23:50:38 +08:00
|
|
|
u8 saved_mode;
|
2016-03-03 05:56:42 +08:00
|
|
|
|
2016-03-03 05:56:43 +08:00
|
|
|
WARN_ON_ONCE(!mutex_is_locked(&pit->pit_state.lock));
|
2016-03-03 05:56:42 +08:00
|
|
|
|
2009-07-07 23:50:38 +08:00
|
|
|
if (hpet_legacy_start) {
|
|
|
|
/* save existing mode for later reenablement */
|
2016-01-07 20:50:38 +08:00
|
|
|
WARN_ON(channel != 0);
|
2016-03-03 05:56:43 +08:00
|
|
|
saved_mode = pit->pit_state.channels[0].mode;
|
|
|
|
pit->pit_state.channels[0].mode = 0xff; /* disable timer */
|
|
|
|
pit_load_count(pit, channel, val);
|
|
|
|
pit->pit_state.channels[0].mode = saved_mode;
|
2009-07-07 23:50:38 +08:00
|
|
|
} else {
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_load_count(pit, channel, val);
|
2009-07-07 23:50:38 +08:00
|
|
|
}
|
2008-03-04 00:50:59 +08:00
|
|
|
}
|
|
|
|
|
2009-06-02 00:54:50 +08:00
|
|
|
static inline struct kvm_pit *dev_to_pit(struct kvm_io_device *dev)
|
|
|
|
{
|
|
|
|
return container_of(dev, struct kvm_pit, dev);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline struct kvm_pit *speaker_to_pit(struct kvm_io_device *dev)
|
|
|
|
{
|
|
|
|
return container_of(dev, struct kvm_pit, speaker_dev);
|
|
|
|
}
|
|
|
|
|
2009-06-30 03:24:32 +08:00
|
|
|
static inline int pit_in_range(gpa_t addr)
|
|
|
|
{
|
|
|
|
return ((addr >= KVM_PIT_BASE_ADDRESS) &&
|
|
|
|
(addr < KVM_PIT_BASE_ADDRESS + KVM_PIT_MEM_LENGTH));
|
|
|
|
}
|
|
|
|
|
2015-03-26 22:39:28 +08:00
|
|
|
static int pit_ioport_write(struct kvm_vcpu *vcpu,
|
|
|
|
struct kvm_io_device *this,
|
2009-06-30 03:24:32 +08:00
|
|
|
gpa_t addr, int len, const void *data)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2009-06-02 00:54:50 +08:00
|
|
|
struct kvm_pit *pit = dev_to_pit(this);
|
2008-01-28 05:10:22 +08:00
|
|
|
struct kvm_kpit_state *pit_state = &pit->pit_state;
|
|
|
|
int channel, access;
|
|
|
|
struct kvm_kpit_channel_state *s;
|
|
|
|
u32 val = *(u32 *) data;
|
2009-06-30 03:24:32 +08:00
|
|
|
if (!pit_in_range(addr))
|
|
|
|
return -EOPNOTSUPP;
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
val &= 0xff;
|
|
|
|
addr &= KVM_PIT_CHANNEL_MASK;
|
|
|
|
|
|
|
|
mutex_lock(&pit_state->lock);
|
|
|
|
|
|
|
|
if (val != 0)
|
2009-12-10 02:45:35 +08:00
|
|
|
pr_debug("write addr is 0x%x, len is %d, val is 0x%x\n",
|
|
|
|
(unsigned int)addr, len, val);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
if (addr == 3) {
|
|
|
|
channel = val >> 6;
|
|
|
|
if (channel == 3) {
|
|
|
|
/* Read-Back Command. */
|
|
|
|
for (channel = 0; channel < 3; channel++) {
|
|
|
|
if (val & (2 << channel)) {
|
|
|
|
if (!(val & 0x20))
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_latch_count(pit, channel);
|
2008-01-28 05:10:22 +08:00
|
|
|
if (!(val & 0x10))
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_latch_status(pit, channel);
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/* Select Counter <channel>. */
|
|
|
|
s = &pit_state->channels[channel];
|
|
|
|
access = (val >> 4) & KVM_PIT_CHANNEL_MASK;
|
|
|
|
if (access == 0) {
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_latch_count(pit, channel);
|
2008-01-28 05:10:22 +08:00
|
|
|
} else {
|
|
|
|
s->rw_mode = access;
|
|
|
|
s->read_state = access;
|
|
|
|
s->write_state = access;
|
|
|
|
s->mode = (val >> 1) & 7;
|
|
|
|
if (s->mode > 5)
|
|
|
|
s->mode -= 4;
|
|
|
|
s->bcd = val & 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/* Write Count. */
|
|
|
|
s = &pit_state->channels[addr];
|
|
|
|
switch (s->write_state) {
|
|
|
|
default:
|
|
|
|
case RW_STATE_LSB:
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_load_count(pit, addr, val);
|
2008-01-28 05:10:22 +08:00
|
|
|
break;
|
|
|
|
case RW_STATE_MSB:
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_load_count(pit, addr, val << 8);
|
2008-01-28 05:10:22 +08:00
|
|
|
break;
|
|
|
|
case RW_STATE_WORD0:
|
|
|
|
s->write_latch = val;
|
|
|
|
s->write_state = RW_STATE_WORD1;
|
|
|
|
break;
|
|
|
|
case RW_STATE_WORD1:
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_load_count(pit, addr, s->write_latch | (val << 8));
|
2008-01-28 05:10:22 +08:00
|
|
|
s->write_state = RW_STATE_WORD0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
mutex_unlock(&pit_state->lock);
|
2009-06-30 03:24:32 +08:00
|
|
|
return 0;
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
|
2015-03-26 22:39:28 +08:00
|
|
|
static int pit_ioport_read(struct kvm_vcpu *vcpu,
|
|
|
|
struct kvm_io_device *this,
|
2009-06-30 03:24:32 +08:00
|
|
|
gpa_t addr, int len, void *data)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2009-06-02 00:54:50 +08:00
|
|
|
struct kvm_pit *pit = dev_to_pit(this);
|
2008-01-28 05:10:22 +08:00
|
|
|
struct kvm_kpit_state *pit_state = &pit->pit_state;
|
|
|
|
int ret, count;
|
|
|
|
struct kvm_kpit_channel_state *s;
|
2009-06-30 03:24:32 +08:00
|
|
|
if (!pit_in_range(addr))
|
|
|
|
return -EOPNOTSUPP;
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
addr &= KVM_PIT_CHANNEL_MASK;
|
2010-01-30 03:28:41 +08:00
|
|
|
if (addr == 3)
|
|
|
|
return 0;
|
|
|
|
|
2008-01-28 05:10:22 +08:00
|
|
|
s = &pit_state->channels[addr];
|
|
|
|
|
|
|
|
mutex_lock(&pit_state->lock);
|
|
|
|
|
|
|
|
if (s->status_latched) {
|
|
|
|
s->status_latched = 0;
|
|
|
|
ret = s->status;
|
|
|
|
} else if (s->count_latched) {
|
|
|
|
switch (s->count_latched) {
|
|
|
|
default:
|
|
|
|
case RW_STATE_LSB:
|
|
|
|
ret = s->latched_count & 0xff;
|
|
|
|
s->count_latched = 0;
|
|
|
|
break;
|
|
|
|
case RW_STATE_MSB:
|
|
|
|
ret = s->latched_count >> 8;
|
|
|
|
s->count_latched = 0;
|
|
|
|
break;
|
|
|
|
case RW_STATE_WORD0:
|
|
|
|
ret = s->latched_count & 0xff;
|
|
|
|
s->count_latched = RW_STATE_MSB;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
switch (s->read_state) {
|
|
|
|
default:
|
|
|
|
case RW_STATE_LSB:
|
2016-03-03 05:56:43 +08:00
|
|
|
count = pit_get_count(pit, addr);
|
2008-01-28 05:10:22 +08:00
|
|
|
ret = count & 0xff;
|
|
|
|
break;
|
|
|
|
case RW_STATE_MSB:
|
2016-03-03 05:56:43 +08:00
|
|
|
count = pit_get_count(pit, addr);
|
2008-01-28 05:10:22 +08:00
|
|
|
ret = (count >> 8) & 0xff;
|
|
|
|
break;
|
|
|
|
case RW_STATE_WORD0:
|
2016-03-03 05:56:43 +08:00
|
|
|
count = pit_get_count(pit, addr);
|
2008-01-28 05:10:22 +08:00
|
|
|
ret = count & 0xff;
|
|
|
|
s->read_state = RW_STATE_WORD1;
|
|
|
|
break;
|
|
|
|
case RW_STATE_WORD1:
|
2016-03-03 05:56:43 +08:00
|
|
|
count = pit_get_count(pit, addr);
|
2008-01-28 05:10:22 +08:00
|
|
|
ret = (count >> 8) & 0xff;
|
|
|
|
s->read_state = RW_STATE_WORD0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (len > sizeof(ret))
|
|
|
|
len = sizeof(ret);
|
|
|
|
memcpy(data, (char *)&ret, len);
|
|
|
|
|
|
|
|
mutex_unlock(&pit_state->lock);
|
2009-06-30 03:24:32 +08:00
|
|
|
return 0;
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
|
2015-03-26 22:39:28 +08:00
|
|
|
static int speaker_ioport_write(struct kvm_vcpu *vcpu,
|
|
|
|
struct kvm_io_device *this,
|
2009-06-30 03:24:32 +08:00
|
|
|
gpa_t addr, int len, const void *data)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2009-06-02 00:54:50 +08:00
|
|
|
struct kvm_pit *pit = speaker_to_pit(this);
|
2008-01-28 05:10:22 +08:00
|
|
|
struct kvm_kpit_state *pit_state = &pit->pit_state;
|
|
|
|
u32 val = *(u32 *) data;
|
2009-06-30 03:24:32 +08:00
|
|
|
if (addr != KVM_SPEAKER_BASE_ADDRESS)
|
|
|
|
return -EOPNOTSUPP;
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
mutex_lock(&pit_state->lock);
|
|
|
|
pit_state->speaker_data_on = (val >> 1) & 1;
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_set_gate(pit, 2, val & 1);
|
2008-01-28 05:10:22 +08:00
|
|
|
mutex_unlock(&pit_state->lock);
|
2009-06-30 03:24:32 +08:00
|
|
|
return 0;
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
|
2015-03-26 22:39:28 +08:00
|
|
|
static int speaker_ioport_read(struct kvm_vcpu *vcpu,
|
|
|
|
struct kvm_io_device *this,
|
|
|
|
gpa_t addr, int len, void *data)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
2009-06-02 00:54:50 +08:00
|
|
|
struct kvm_pit *pit = speaker_to_pit(this);
|
2008-01-28 05:10:22 +08:00
|
|
|
struct kvm_kpit_state *pit_state = &pit->pit_state;
|
|
|
|
unsigned int refresh_clock;
|
|
|
|
int ret;
|
2009-06-30 03:24:32 +08:00
|
|
|
if (addr != KVM_SPEAKER_BASE_ADDRESS)
|
|
|
|
return -EOPNOTSUPP;
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
/* Refresh clock toggles at about 15us. We approximate as 2^14ns. */
|
|
|
|
refresh_clock = ((unsigned int)ktime_to_ns(ktime_get()) >> 14) & 1;
|
|
|
|
|
|
|
|
mutex_lock(&pit_state->lock);
|
2016-03-03 05:56:43 +08:00
|
|
|
ret = ((pit_state->speaker_data_on << 1) | pit_get_gate(pit, 2) |
|
|
|
|
(pit_get_out(pit, 2) << 5) | (refresh_clock << 4));
|
2008-01-28 05:10:22 +08:00
|
|
|
if (len > sizeof(ret))
|
|
|
|
len = sizeof(ret);
|
|
|
|
memcpy(data, (char *)&ret, len);
|
|
|
|
mutex_unlock(&pit_state->lock);
|
2009-06-30 03:24:32 +08:00
|
|
|
return 0;
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:44 +08:00
|
|
|
static void kvm_pit_reset(struct kvm_pit *pit)
|
2008-01-28 05:10:22 +08:00
|
|
|
{
|
|
|
|
int i;
|
2008-03-13 10:22:26 +08:00
|
|
|
struct kvm_kpit_channel_state *c;
|
|
|
|
|
2009-07-07 23:50:38 +08:00
|
|
|
pit->pit_state.flags = 0;
|
2008-03-13 10:22:26 +08:00
|
|
|
for (i = 0; i < 3; i++) {
|
|
|
|
c = &pit->pit_state.channels[i];
|
|
|
|
c->mode = 0xff;
|
|
|
|
c->gate = (i != 2);
|
2016-03-03 05:56:43 +08:00
|
|
|
pit_load_count(pit, i, 0);
|
2008-03-13 10:22:26 +08:00
|
|
|
}
|
|
|
|
|
2016-03-03 05:56:40 +08:00
|
|
|
kvm_pit_reset_reinject(pit);
|
2008-03-13 10:22:26 +08:00
|
|
|
}
|
|
|
|
|
2009-01-05 00:06:06 +08:00
|
|
|
static void pit_mask_notifer(struct kvm_irq_mask_notifier *kimn, bool mask)
|
|
|
|
{
|
|
|
|
struct kvm_pit *pit = container_of(kimn, struct kvm_pit, mask_notifier);
|
|
|
|
|
2016-03-03 05:56:40 +08:00
|
|
|
if (!mask)
|
|
|
|
kvm_pit_reset_reinject(pit);
|
2009-01-05 00:06:06 +08:00
|
|
|
}
|
|
|
|
|
2009-06-02 00:54:50 +08:00
|
|
|
static const struct kvm_io_device_ops pit_dev_ops = {
|
|
|
|
.read = pit_ioport_read,
|
|
|
|
.write = pit_ioport_write,
|
|
|
|
};
|
|
|
|
|
|
|
|
static const struct kvm_io_device_ops speaker_dev_ops = {
|
|
|
|
.read = speaker_ioport_read,
|
|
|
|
.write = speaker_ioport_write,
|
|
|
|
};
|
|
|
|
|
2009-05-15 04:42:53 +08:00
|
|
|
struct kvm_pit *kvm_create_pit(struct kvm *kvm, u32 flags)
|
2008-03-13 10:22:26 +08:00
|
|
|
{
|
2008-01-28 05:10:22 +08:00
|
|
|
struct kvm_pit *pit;
|
|
|
|
struct kvm_kpit_state *pit_state;
|
2012-04-24 22:40:17 +08:00
|
|
|
struct pid *pid;
|
|
|
|
pid_t pid_nr;
|
2009-07-08 05:08:44 +08:00
|
|
|
int ret;
|
2008-01-28 05:10:22 +08:00
|
|
|
|
2019-02-12 03:02:50 +08:00
|
|
|
pit = kzalloc(sizeof(struct kvm_pit), GFP_KERNEL_ACCOUNT);
|
2008-01-28 05:10:22 +08:00
|
|
|
if (!pit)
|
|
|
|
return NULL;
|
|
|
|
|
2008-10-15 20:15:06 +08:00
|
|
|
pit->irq_source_id = kvm_request_irq_source_id(kvm);
|
2016-03-03 05:56:46 +08:00
|
|
|
if (pit->irq_source_id < 0)
|
|
|
|
goto fail_request;
|
2008-10-15 20:15:06 +08:00
|
|
|
|
2008-01-28 05:10:22 +08:00
|
|
|
mutex_init(&pit->pit_state.lock);
|
2010-06-17 05:11:11 +08:00
|
|
|
|
2012-04-24 22:40:17 +08:00
|
|
|
pid = get_pid(task_tgid(current));
|
|
|
|
pid_nr = pid_vnr(pid);
|
|
|
|
put_pid(pid);
|
|
|
|
|
2016-10-19 19:50:47 +08:00
|
|
|
pit->worker = kthread_create_worker(0, "kvm-pit/%d", pid_nr);
|
|
|
|
if (IS_ERR(pit->worker))
|
2016-03-03 05:56:46 +08:00
|
|
|
goto fail_kthread;
|
|
|
|
|
2016-10-12 04:55:20 +08:00
|
|
|
kthread_init_work(&pit->expired, pit_do_work);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
|
|
|
pit->kvm = kvm;
|
|
|
|
|
|
|
|
pit_state = &pit->pit_state;
|
2012-07-26 23:01:53 +08:00
|
|
|
hrtimer_init(&pit_state->timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
|
2016-03-03 05:56:51 +08:00
|
|
|
pit_state->timer.function = pit_timer_fn;
|
2016-03-03 05:56:45 +08:00
|
|
|
|
2008-07-27 04:01:01 +08:00
|
|
|
pit_state->irq_ack_notifier.gsi = 0;
|
|
|
|
pit_state->irq_ack_notifier.irq_acked = kvm_pit_ack_irq;
|
2016-03-03 05:56:45 +08:00
|
|
|
pit->mask_notifier.func = pit_mask_notifer;
|
2008-01-28 05:10:22 +08:00
|
|
|
|
2008-03-13 10:22:26 +08:00
|
|
|
kvm_pit_reset(pit);
|
2008-01-28 05:10:22 +08:00
|
|
|
|
2016-03-03 05:56:45 +08:00
|
|
|
kvm_pit_set_reinject(pit, true);
|
2009-01-05 00:06:06 +08:00
|
|
|
|
KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
The syzkaller folks reported a NULL pointer dereference that seems
to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
The former takes kvm->lock (except when registering the devices,
which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.
Testcase:
#include <pthread.h>
#include <linux/kvm.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdint.h>
#include <string.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>
long r[23];
void* thr1(void* arg)
{
struct kvm_pit_config pitcfg = { .flags = 4 };
switch ((long)arg) {
case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break;
case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break;
case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break;
case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
}
return 0;
}
int main(int argc, char **argv)
{
long i;
pthread_t th[4];
memset(r, -1, sizeof(r));
for (i = 0; i < 4; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
if (argc > 1 && rand()%2) usleep(rand()%1000);
}
usleep(20000);
return 0;
}
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
2016-06-01 20:09:24 +08:00
|
|
|
mutex_lock(&kvm->slots_lock);
|
2009-06-02 00:54:56 +08:00
|
|
|
kvm_iodevice_init(&pit->dev, &pit_dev_ops);
|
2011-07-27 21:00:48 +08:00
|
|
|
ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS, KVM_PIT_BASE_ADDRESS,
|
|
|
|
KVM_PIT_MEM_LENGTH, &pit->dev);
|
2009-07-08 05:08:44 +08:00
|
|
|
if (ret < 0)
|
2016-03-03 05:56:46 +08:00
|
|
|
goto fail_register_pit;
|
2009-06-02 00:54:56 +08:00
|
|
|
|
|
|
|
if (flags & KVM_PIT_SPEAKER_DUMMY) {
|
|
|
|
kvm_iodevice_init(&pit->speaker_dev, &speaker_dev_ops);
|
2009-12-24 00:35:24 +08:00
|
|
|
ret = kvm_io_bus_register_dev(kvm, KVM_PIO_BUS,
|
2011-07-27 21:00:48 +08:00
|
|
|
KVM_SPEAKER_BASE_ADDRESS, 4,
|
|
|
|
&pit->speaker_dev);
|
2009-07-08 05:08:44 +08:00
|
|
|
if (ret < 0)
|
2016-03-03 05:56:46 +08:00
|
|
|
goto fail_register_speaker;
|
2009-06-02 00:54:56 +08:00
|
|
|
}
|
KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
The syzkaller folks reported a NULL pointer dereference that seems
to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
The former takes kvm->lock (except when registering the devices,
which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.
Testcase:
#include <pthread.h>
#include <linux/kvm.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdint.h>
#include <string.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>
long r[23];
void* thr1(void* arg)
{
struct kvm_pit_config pitcfg = { .flags = 4 };
switch ((long)arg) {
case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break;
case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break;
case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break;
case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
}
return 0;
}
int main(int argc, char **argv)
{
long i;
pthread_t th[4];
memset(r, -1, sizeof(r));
for (i = 0; i < 4; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
if (argc > 1 && rand()%2) usleep(rand()%1000);
}
usleep(20000);
return 0;
}
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
2016-06-01 20:09:24 +08:00
|
|
|
mutex_unlock(&kvm->slots_lock);
|
2009-06-02 00:54:56 +08:00
|
|
|
|
2008-01-28 05:10:22 +08:00
|
|
|
return pit;
|
2009-07-08 05:08:44 +08:00
|
|
|
|
2016-03-03 05:56:46 +08:00
|
|
|
fail_register_speaker:
|
2009-12-24 00:35:24 +08:00
|
|
|
kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev);
|
2016-03-03 05:56:46 +08:00
|
|
|
fail_register_pit:
|
KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
The syzkaller folks reported a NULL pointer dereference that seems
to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
The former takes kvm->lock (except when registering the devices,
which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.
Testcase:
#include <pthread.h>
#include <linux/kvm.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdint.h>
#include <string.h>
#include <stdlib.h>
#include <sys/syscall.h>
#include <unistd.h>
long r[23];
void* thr1(void* arg)
{
struct kvm_pit_config pitcfg = { .flags = 4 };
switch ((long)arg) {
case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break;
case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break;
case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break;
case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
}
return 0;
}
int main(int argc, char **argv)
{
long i;
pthread_t th[4];
memset(r, -1, sizeof(r));
for (i = 0; i < 4; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
if (argc > 1 && rand()%2) usleep(rand()%1000);
}
usleep(20000);
return 0;
}
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
2016-06-01 20:09:24 +08:00
|
|
|
mutex_unlock(&kvm->slots_lock);
|
2016-03-03 05:56:45 +08:00
|
|
|
kvm_pit_set_reinject(pit, false);
|
2016-10-19 19:50:47 +08:00
|
|
|
kthread_destroy_worker(pit->worker);
|
2016-03-03 05:56:46 +08:00
|
|
|
fail_kthread:
|
|
|
|
kvm_free_irq_source_id(kvm, pit->irq_source_id);
|
|
|
|
fail_request:
|
2009-07-08 05:08:44 +08:00
|
|
|
kfree(pit);
|
|
|
|
return NULL;
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void kvm_free_pit(struct kvm *kvm)
|
|
|
|
{
|
2016-03-03 05:56:47 +08:00
|
|
|
struct kvm_pit *pit = kvm->arch.vpit;
|
|
|
|
|
|
|
|
if (pit) {
|
2017-07-11 02:53:28 +08:00
|
|
|
mutex_lock(&kvm->slots_lock);
|
2016-03-03 05:56:47 +08:00
|
|
|
kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->dev);
|
|
|
|
kvm_io_bus_unregister_dev(kvm, KVM_PIO_BUS, &pit->speaker_dev);
|
2017-07-11 02:53:28 +08:00
|
|
|
mutex_unlock(&kvm->slots_lock);
|
2016-03-03 05:56:47 +08:00
|
|
|
kvm_pit_set_reinject(pit, false);
|
|
|
|
hrtimer_cancel(&pit->pit_state.timer);
|
2016-10-19 19:50:47 +08:00
|
|
|
kthread_destroy_worker(pit->worker);
|
2016-03-03 05:56:47 +08:00
|
|
|
kvm_free_irq_source_id(kvm, pit->irq_source_id);
|
|
|
|
kfree(pit);
|
2008-01-28 05:10:22 +08:00
|
|
|
}
|
|
|
|
}
|