<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/virt, branch v2.6.26-rc9</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>KVM: ioapic: fix lost interrupt when changing a device's irq</title>
<updated>2008-06-24T09:23:55+00:00</updated>
<author>
<name>Avi Kivity</name>
<email>avi@qumranet.com</email>
</author>
<published>2008-06-17T22:36:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=4fa6b9c5dc4134bdeac341d731a87783cc11ca10'/>
<id>4fa6b9c5dc4134bdeac341d731a87783cc11ca10</id>
<content type='text'>
The ioapic acknowledge path translates interrupt vectors to irqs.  It
currently uses a first match algorithm, stopping when it finds the first
redirection table entry containing the vector.  That fails however if the
guest changes the irq to a different line, leaving the old redirection table
entry in place (though masked).  Result is interrupts not making it to the
guest.

Fix by always scanning the entire redirection table.

Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The ioapic acknowledge path translates interrupt vectors to irqs.  It
currently uses a first match algorithm, stopping when it finds the first
redirection table entry containing the vector.  That fails however if the
guest changes the irq to a different line, leaving the old redirection table
entry in place (though masked).  Result is interrupts not making it to the
guest.

Fix by always scanning the entire redirection table.

Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: IOAPIC: only set remote_irr if interrupt was injected</title>
<updated>2008-06-06T18:32:39+00:00</updated>
<author>
<name>Marcelo Tosatti</name>
<email>mtosatti@redhat.com</email>
</author>
<published>2008-06-05T03:08:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ff4b9df877b30b8a371d706d3552999dee450738'/>
<id>ff4b9df877b30b8a371d706d3552999dee450738</id>
<content type='text'>
There's a bug in the IOAPIC code for level-triggered interrupts. Its
relatively easy to trigger by sharing (virtio-blk + usbtablet was the
testcase, initially reported by Gerd von Egidy).

The "remote_irr" variable is used to indicate accepted but not yet acked
interrupts. Its cleared from the EOI handler.

Problem is that the EOI handler clears remote_irr unconditionally, even
if it reinjected another pending interrupt.

In that case, kvm_ioapic_set_irq() proceeds to ioapic_service() which
sets remote_irr even if it failed to inject (since the IRR was high due
to EOI reinjection).

Since the TMR bit has been cleared by the first EOI, the second one
fails to clear remote_irr.

End result is interrupt line dead.

Fix it by setting remote_irr only if a new pending interrupt has been
generated (and the TMR bit for vector in question set).

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There's a bug in the IOAPIC code for level-triggered interrupts. Its
relatively easy to trigger by sharing (virtio-blk + usbtablet was the
testcase, initially reported by Gerd von Egidy).

The "remote_irr" variable is used to indicate accepted but not yet acked
interrupts. Its cleared from the EOI handler.

Problem is that the EOI handler clears remote_irr unconditionally, even
if it reinjected another pending interrupt.

In that case, kvm_ioapic_set_irq() proceeds to ioapic_service() which
sets remote_irr even if it failed to inject (since the IRR was high due
to EOI reinjection).

Since the TMR bit has been cleared by the first EOI, the second one
fails to clear remote_irr.

End result is interrupt line dead.

Fix it by setting remote_irr only if a new pending interrupt has been
generated (and the TMR bit for vector in question set).

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: Fix kvm_vcpu_block() task state race</title>
<updated>2008-05-18T11:37:12+00:00</updated>
<author>
<name>Marcelo Tosatti</name>
<email>mtosatti@redhat.com</email>
</author>
<published>2008-05-08T22:47:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e5c239cfd5b0ec22751c099dbf4d91f3c504a64f'/>
<id>e5c239cfd5b0ec22751c099dbf4d91f3c504a64f</id>
<content type='text'>
There's still a race in kvm_vcpu_block(), if a wake_up_interruptible()
call happens before the task state is set to TASK_INTERRUPTIBLE:

CPU0                            CPU1

kvm_vcpu_block

add_wait_queue

kvm_cpu_has_interrupt = 0
                                set interrupt
                                if (waitqueue_active())
                                        wake_up_interruptible()

kvm_cpu_has_pending_timer
kvm_arch_vcpu_runnable
signal_pending

set_current_state(TASK_INTERRUPTIBLE)
schedule()

Can be fixed by using prepare_to_wait() which sets the task state before
testing for the wait condition.

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There's still a race in kvm_vcpu_block(), if a wake_up_interruptible()
call happens before the task state is set to TASK_INTERRUPTIBLE:

CPU0                            CPU1

kvm_vcpu_block

add_wait_queue

kvm_cpu_has_interrupt = 0
                                set interrupt
                                if (waitqueue_active())
                                        wake_up_interruptible()

kvm_cpu_has_pending_timer
kvm_arch_vcpu_runnable
signal_pending

set_current_state(TASK_INTERRUPTIBLE)
schedule()

Can be fixed by using prepare_to_wait() which sets the task state before
testing for the wait condition.

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: Export necessary function for EPT</title>
<updated>2008-05-04T11:44:40+00:00</updated>
<author>
<name>Sheng Yang</name>
<email>sheng.yang@intel.com</email>
</author>
<published>2008-04-25T13:44:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0d15029895051904e31925ec63525cc3a637f7de'/>
<id>0d15029895051904e31925ec63525cc3a637f7de</id>
<content type='text'>
Signed-off-by: Sheng Yang &lt;sheng.yang@intel.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Sheng Yang &lt;sheng.yang@intel.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PATCH] sanitize anon_inode_getfd()</title>
<updated>2008-05-01T17:08:50+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2008-02-23T11:46:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2030a42cecd4dd1985a2ab03e25f3cd6106a5ca8'/>
<id>2030a42cecd4dd1985a2ab03e25f3cd6106a5ca8</id>
<content type='text'>
a) none of the callers even looks at inode or file returned by anon_inode_getfd()
b) any caller that would try to look at those would be racy, since by the time
it returns we might have raced with close() from another thread and that
file would be pining for fjords.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
a) none of the callers even looks at inode or file returned by anon_inode_getfd()
b) any caller that would try to look at those would be racy, since by the time
it returns we might have raced with close() from another thread and that
file would be pining for fjords.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: kill file-&gt;f_count abuse in kvm</title>
<updated>2008-04-27T15:21:46+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@ZenIV.linux.org.uk</email>
</author>
<published>2008-04-19T19:33:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=66c0b394f08fd89236515c1c84485ea712a157be'/>
<id>66c0b394f08fd89236515c1c84485ea712a157be</id>
<content type='text'>
Use kvm own refcounting instead of playing with -&gt;filp-&gt;f_count.
That will allow to get rid of a lot of crap in anon_inode_getfd() and
kill a race in kvm_dev_ioctl_create_vm() (file might have been closed
immediately by another thread, so -&gt;filp might point to already freed
struct file when we get around to setting it).

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use kvm own refcounting instead of playing with -&gt;filp-&gt;f_count.
That will allow to get rid of a lot of crap in anon_inode_getfd() and
kill a race in kvm_dev_ioctl_create_vm() (file might have been closed
immediately by another thread, so -&gt;filp might point to already freed
struct file when we get around to setting it).

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: Rename debugfs_dir to kvm_debugfs_dir</title>
<updated>2008-04-27T15:21:36+00:00</updated>
<author>
<name>Hollis Blanchard</name>
<email>hollisb@us.ibm.com</email>
</author>
<published>2008-04-15T21:05:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=76f7c87902fd2c2de9eb57168adbf9bc5ec2047d'/>
<id>76f7c87902fd2c2de9eb57168adbf9bc5ec2047d</id>
<content type='text'>
It's a globally exported symbol now.

Signed-off-by: Hollis Blanchard &lt;hollisb@us.ibm.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
It's a globally exported symbol now.

Signed-off-by: Hollis Blanchard &lt;hollisb@us.ibm.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: add ioctls to save/store mpstate</title>
<updated>2008-04-27T15:21:16+00:00</updated>
<author>
<name>Marcelo Tosatti</name>
<email>mtosatti@redhat.com</email>
</author>
<published>2008-04-11T16:24:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=62d9f0dbc92d7e398fde53fc6021338393522e68'/>
<id>62d9f0dbc92d7e398fde53fc6021338393522e68</id>
<content type='text'>
So userspace can save/restore the mpstate during migration.

[avi: export the #define constants describing the value]
[christian: add s390 stubs]
[avi: ditto for ia64]

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Christian Borntraeger &lt;borntraeger@de.ibm.com&gt;
Signed-off-by: Carsten Otte &lt;cotte@de.ibm.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
So userspace can save/restore the mpstate during migration.

[avi: export the #define constants describing the value]
[christian: add s390 stubs]
[avi: ditto for ia64]

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Christian Borntraeger &lt;borntraeger@de.ibm.com&gt;
Signed-off-by: Carsten Otte &lt;cotte@de.ibm.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: hlt emulation should take in-kernel APIC/PIT timers into account</title>
<updated>2008-04-27T09:04:11+00:00</updated>
<author>
<name>Marcelo Tosatti</name>
<email>mtosatti@redhat.com</email>
</author>
<published>2008-04-11T17:53:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3d80840d96127401ba6aeadd813c3a15b84e70fe'/>
<id>3d80840d96127401ba6aeadd813c3a15b84e70fe</id>
<content type='text'>
Timers that fire between guest hlt and vcpu_block's add_wait_queue() are
ignored, possibly resulting in hangs.

Also make sure that atomic_inc and waitqueue_active tests happen in the
specified order, otherwise the following race is open:

CPU0                                        CPU1
                                            if (waitqueue_active(wq))
add_wait_queue()
if (!atomic_read(pit_timer-&gt;pending))
    schedule()
                                            atomic_inc(pit_timer-&gt;pending)

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Timers that fire between guest hlt and vcpu_block's add_wait_queue() are
ignored, possibly resulting in hangs.

Also make sure that atomic_inc and waitqueue_active tests happen in the
specified order, otherwise the following race is open:

CPU0                                        CPU1
                                            if (waitqueue_active(wq))
add_wait_queue()
if (!atomic_read(pit_timer-&gt;pending))
    schedule()
                                            atomic_inc(pit_timer-&gt;pending)

Signed-off-by: Marcelo Tosatti &lt;mtosatti@redhat.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>KVM: Add kvm trace userspace interface</title>
<updated>2008-04-27T09:01:22+00:00</updated>
<author>
<name>Feng(Eric) Liu</name>
<email>eric.e.liu@intel.com</email>
</author>
<published>2008-04-10T12:47:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d4c9ff2d1b78e385471b3f4d80c0596909926ef7'/>
<id>d4c9ff2d1b78e385471b3f4d80c0596909926ef7</id>
<content type='text'>
This interface allows user a space application to read the trace of kvm
related events through relayfs.

Signed-off-by: Feng (Eric) Liu &lt;eric.e.liu@intel.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This interface allows user a space application to read the trace of kvm
related events through relayfs.

Signed-off-by: Feng (Eric) Liu &lt;eric.e.liu@intel.com&gt;
Signed-off-by: Avi Kivity &lt;avi@qumranet.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
