| Age | Commit message (Collapse) | Author |
|---|
|
|
|
* selftests: (83 commits)
KVM: selftests: Spell out UCALL in nested TSC scaling test's enums
KVM: selftests: Use GUEST_SYNC2() in nested TSC scaling test
KVM: selftests: Randomize L2's TSC offset in the nested TSC scaling test
KVM: selftests: Test non-zero TSC offset on SVM in nested TSC scaling test
KVM: selftests: Verify that KVM saturates L2 TSC freq on {under,over}flow
KVM: selftests: Test L1 "up" and L2 "down" in nested TSC scaling test
KVM: selftests: Sanity check KVM's default TSC freq in nested TSC scaling test
KVM: selftests: Explicitly pass TSC frequencies to guts of TSC scaling test
KVM: selftests: Use KVM's reported TSC KHz as L0's frequency (sanity checked)
KVM: selftests: Allow +/- 1 tolerance if expected TSC frequency is <100
KVM: selftests: Print out the failing L{0,1,2} level in nested TSC scaling test
KVM: selftests: Track L2 multiplier, not scale-up factor, in nested TSC test
KVM: selftests: Extract guts of nested TSC scaling test to helper function
KVM: selftests: Rename TSC freq checkers in nested TSC scaling test
KVM: selftests: Randomize L2's scale factor in nested TSC scaling test
KVM: selftests: Drop unnecessary use of PRIu64 in nested TSC scaling test
KVM: selftests: Drop redundant VMWRITE of TSC_MULTIPLIER_HIGH
KVM: selftests: Use KVM's pRNG to randomize L1's TSC ratio in TSC scaling test
KVM: x86: Allow userspace to set KVM's max supported guest TSC frequency
KVM: SVM: Fallback to the default TSC ratio if KVM tries to use a bad multiplier
...
|
|
Delete guest_snprintf() as it isn't used, has never been used, and in all
likelihood will never be used. Because variadic functions can't pass along
va_args verbatim, guest_snprintf() can't be used as-is by things like
ucall_fmt(). guest_snprintf() could be used to dedup the ucall code by
turning it into a macro, but that would still require implicitly consuming
the caller's variadic arguments and would risk creating variable shadows,
i.e. introduces fragility for very little benefit.
No functional change intended.
Link: https://lore.kernel.org/all/20260930002238.649421F000FF@smtp.kernel.org
Signed-off-by: Gokul K <gokul02k@gmail.com>
Closes: https://lore.kernel.org/all/20260918113631.634233-4-gokul02k@gmail.com
Link: https://patch.msgid.link/20260918113631.634233-4-gokul02k@gmail.com
[sean: massage changelog]
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
lib/io.c has outlived its purpose. test_read() has exactly one caller,
lib/elf.c; test_write() has none at all; and test_seq_read() is a
declaration in test_util.h with no definition anywhere in the tree.
Both surviving helpers open with
TEST_ASSERT(count >= 0, "Unexpected count, count: %li", count);
which can never fire, because @count is a size_t. Building with -Wextra
points this out:
lib/io.c:51:27: warning: comparison of unsigned expression in '>= 0'
is always true [-Wtype-limits]
lib/io.c:128:27: warning: comparison of unsigned expression in '>= 0'
is always true [-Wtype-limits]
The comment above each assertion is worse than the assertion itself: it
cites the read(2) and write(2) manpages to claim that a count of zero is
allowed, but a zero count lands in "case 0" and fails the test outright.
The helper has never accepted what the comment promises.
Move test_read() into elf.c as a static elf_read(), named for what it
does rather than reading as "test the read() syscall", and assert that
@count is non-zero, which is what the code has always required and what
every caller already passes. Drop the commentary describing retry
behaviour that the code makes obvious. Nothing is then left in
lib/io.c, so remove the file along with test_write() and the stale
test_seq_read() declaration.
No functional change intended.
Suggested-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/all/aqxNbR9u5F1sqB3p@google.com
Signed-off-by: Gokul K <gokul02k@gmail.com>
Link: https://patch.msgid.link/20260918054420.338842-1-gokul02k@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Currently, vm_mem_add derives the backing source page size, alignment
padding, and mmap size from the backing source type upfront before checking
if guest_memfd is being mmapped.
With shared memory also mmap()-ed from guest_memfd, the alignment of the
mmap-ed address needs to respect guest_memfd's backing page size.
Refactor the backing store setup to configure the backing source page
size, alignment, mmap flags, and mmap offset directly for guest_memfd
when it is mmapped, ignoring the backing source type.
Skip hugepage validation and anonymous memory madvise calls when mmapping
from guest_memfd, since those are not applicable when mmapping guest_memfd.
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-42-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
The TEST_EXPECT_SIGBUS macro is not thread-safe as it uses a global
sigjmp_buf and installs a global SIGBUS signal handler. If multiple threads
execute the macro concurrently, they will race on installing the signal
handler and stomp on other threads' jump buffers, leading to incorrect test
behavior.
Make TEST_EXPECT_SIGBUS thread-safe with the following changes:
Share the KVM tests' global signal handler. sigaction() applies to all
threads; without sharing a global signal handler, one thread may have
removed the signal handler that another thread added, hence leading to
unexpected signals.
The alternative of layering signal handlers was considered, but calling
sigaction() within TEST_EXPECT_SIGBUS() necessarily creates a race. To
avoid adding new setup and teardown routines to do sigaction() and keep
usage of TEST_EXPECT_SIGBUS() simple, share the KVM tests' global signal
handler.
Opportunistically rename report_unexpected_signal to
catchall_signal_handler.
To continue to only expect SIGBUS within specific regions of code, use a
thread-specific variable, expecting_sigbus, to replace installing and
removing signal handlers.
Make the execution environment for the thread, sigjmp_buf, a
thread-specific variable.
As part of TEST_EXPECT_SIGBUS(), assert the prerequisite for this setup,
that the current signal handler is the catchall_signal_handler.
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-41-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Introduce a new helper, kvm_gpa_to_guest_memfd(), to find the
guest_memfd-related details of a memory region that contains a given guest
physical address (GPA).
The function returns the file descriptor for the memfd, the offset into
the file that corresponds to the GPA, and the number of bytes remaining
in the region from that GPA.
kvm_gpa_to_guest_memfd() was factored out from vm_guest_mem_fallocate();
refactor vm_guest_mem_fallocate() to use the new helper.
Co-developed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-39-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add helper functions to allow KVM selftests to pin memory using
CONFIG_GUP_TEST. This is useful for creating test scenarios where some page
has an increased refcount, such as when testing guest_memfd in-place
conversion.
The helpers open /sys/kernel/debug/gup_test and invoke the
PIN_LONGTERM_TEST_START and PIN_LONGTERM_TEST_STOP ioctls. Since this
functionality depends on the kernel being built with CONFIG_GUP_TEST,
provide stub implementations that trigger a test failure if the
configuration is missing.
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-36-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add a global variable, kvm_has_gmem_attributes, to make the result of
checking for KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES available to all tests.
kvm_has_gmem_attributes is true if guest_memfd tracks memory attributes, as
opposed to VM-level tracking.
This global variable is synced to the guest for testing convenience, to
avoid introducing subtle bugs when host/guest state is desynced.
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-27-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Accept gmem_flags in vm_mem_add() to be able to create a guest_memfd within
vm_mem_add().
When vm_mem_add() is used to set up a guest_memfd for a memslot, set up the
provided (or created) gmem_fd as the fd for the user memory region. This
makes it available to be mmap()-ed from just like fds from other memory
sources.
For guest_memfds, mmap() using gmem_offset instead of 0 all the time.
Always use MAP_SHARED if mmap-ing from guest_memfd instead of reading flag
from the configured src_type, which doesn't include guest_memfd.
Add a kvm_slot_to_fd() helper to provide convenient access to the file
descriptor of a memslot.
Update existing callers of vm_mem_add() to pass 0 for gmem_flags to
preserve existing behavior.
Co-developed-by: Ackerley Tng <ackerleytng@google.com>
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-26-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Rename local variables and function parameters for the guest memory file
descriptor and its offset to use a "gmem_" prefix instead of
"guest_memfd_".
No functional change intended.
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-25-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
When adding a memslot associated with a guest_memfd instance, create/dup
the guest_memfd before creating the "normal" backing file. This will allow
dup'ing the gmem fd as the normal fd when guest_memfd supports mmap(),
i.e. to make guest_memfd the _only_ backing source for the memslot.
Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Shivank Garg <shivankg@amd.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Tested-by: Yan Zhao <yan.y.zhao@intel.com>
Link: https://patch.msgid.link/20260910-gmem-inplace-conversion-v13-24-dd6fbf94f4e1@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
sea_to_user backs guest memory with 1GB hugepages but never checks that
any are reserved. On a host with an empty pool it aborts instead of
skipping:
kvm_syscalls.h:68: mem != MAP_FAILED, errno=12 (ENOMEM)
not ok 1 selftests: kvm: sea_to_user # exit=254
The mmap() of the hugetlb region fails with -ENOMEM because no 1GB pages
are available, and the test treats that as a hard failure even though it
simply cannot run without the backing pages. Check the free 1GB hugepage
count up front and skip cleanly when the host cannot satisfy the region.
Signed-off-by: Like Xu <likexu@tencent.com>
Reviewed-by: Jiaqi Yan <jiaqiyan@google.com>
Link: https://patch.msgid.link/20260818112920.26252-3-likexu@tencent.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
|
|
Not all CPUs that support VMX necessarily support the "virtualize APIC
accesses" secondary processor-based VM-execution control. For example,
some Zhaoxin CPUs lack this feature. Add a capability check before
running the test to properly skip on unsupported hardware instead of
failing.
Carve out the guts of kvm_cpu_has_ept() into a generic helper and use said
helper to provide kvm_cpu_has_vmx_apic_access_virt().
Signed-off-by: Frank Zhu <frankzhu@zhaoxin.com>
Link: https://patch.msgid.link/20260910115414.3015260-10-ewanhai-oc@zhaoxin.com
[sean: add a helper instead of copy+pasting kvm_cpu_has_ept()]
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Update the kvm_is_tdp_enabled() function to include Zhaoxin CPUs by
querying checking "Intel compatible" when checking for EPT (Extended
Page Tables) support. This ensures that Zhaoxin CPUs use the
appropriate TDP (Two-Dimensional Paging) parameter check, similar to
Intel CPUs.
Signed-off-by: Frank Zhu <frankzhu@zhaoxin.com>
Link: https://patch.msgid.link/20260910115414.3015260-4-ewanhai-oc@zhaoxin.com
[sean: massage changelog]
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add helpers to detect Zhaoxin CPUs using the "CentaurHauls" and
" Shanghai " vendor strings.
KVM handles Zhaoxin CPUs with its VMX backend. Add
host_cpu_is_intel_compatible for selftests that exercise behavior shared
by Intel and Zhaoxin CPUs, while retaining host_cpu_is_zhaoxin for
Zhaoxin-specific behavior.
Signed-off-by: Frank Zhu <frankzhu@zhaoxin.com>
Link: https://patch.msgid.link/20260910115414.3015260-2-ewanhai-oc@zhaoxin.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
vcpu_get_reg_list() allocates reg_list with calloc() and immediately
dereferences it via reg_list->n without checking for allocation failure,
unlike every other allocation in this file which is guarded by
TEST_ASSERT(). If calloc() returns NULL the test crashes with a NULL
pointer dereference instead of a clean failure message.
Add the missing TEST_ASSERT() check.
Fixes: fd02029a9e01 ("KVM: selftests: Add aarch64 get-reg-list test")
Signed-off-by: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
Link: https://patch.msgid.link/20260901090839.3338955-1-nagachaithanya9911@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
uffd_setup_demand_paging() passes the element size as the first argument
to calloc() and the element count as the second:
uffd_desc->pipefds = calloc(sizeof(int), num_readers);
calloc() expects the number of elements first and the size of each element
second. The product, and therefore the allocation size, is the same either
way, so this is not a functional change, but the arguments are misleading
and GCC 14 diagnoses them with -Wcalloc-transposed-args, which is enabled
by -Wextra.
Swap the arguments to match the calloc() prototype.
Signed-off-by: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>
Reviewed-by: Gautam Menghani <gautam@linux.ibm.com>
Link: https://patch.msgid.link/20260904052033.3648259-1-nagachaithanya9911@gmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Rename vmreadz() => vmread() (and vmread() => __vmread()) and have it
assert success instead of returning garbage on failure. While the eVMCS
path avoids clobbering *value on failure, the VMREAD path unconditionally
stores tmp to *value, without ever zeroing tmp. I.e. if VMREAD did fail,
*value would be loaded with random stack data, not '0'.
An audit of the code confirms that nothing is actually relying on vmreadz()
to zero the result on failure, as all paths either check for a non-zero
value, propagate the result into vmwrite(), or guard the vmread() with a
pre-check that the field exists.
Opportunistically fix the bug in what is now __vmread(), so that the code
isn't consuming uninitialized stack data. Begrudgingly keep zeroing
value in vmread(), as gcc-15 at least isn't smart enough to figure out
that value won't be used uninitialized (though to be fair, strictly
speaking it isn't actually unreachable code).
Link: https://patch.msgid.link/20260904002423.3154436-18-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add __vmwrite() in anticipation of having vmwrite() assert success, and use
the "failure allowed" version in the common VMCS setup code, which is the
only code that wants to write fields that may or may not exist (although
arguably the code should check if the field exists instead of blindly
writing).
E.g. When doing initial configuration of a VMCS, the core library doesn't
want to assume secondary controls are supported, and so blindly does a
VMWRITE and pivots on success/failure.
All usage of vmwrite() outside of common setup already asserts success, or
100% relies on VMWRITE succeeding in order for the test to function
correctly.
No functional change intended.
Link: https://patch.msgid.link/20260904002423.3154436-16-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Assert success in the "outer" APIs for VMLAUNCH and VMRESUME to dedup a
pile of code, and switch to the double-underscores versions as necessary,
to make it more obvious which paths expect VM-Enter *failure*.
Link: https://patch.msgid.link/20260904002423.3154436-15-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Dedup the assembly code for VMLAUNCH vs. VMRESUME, for both architectural
VMCS and eVMCS, as the difference is literally only the actual VM-Enter
instruction for VMLAUNCH vs. VMRESUME, and VMWRITE vs. MOV for VMCS vs.
eVMCS.
Opportunistically place the implementations in vmx.c so that the lengthy
sequence (~580 bytes of code) aren't inlined for every single VM-Enter.
000000000041b910 <__vmlaunch>:
41b910: 80 3d 61 5e 10 00 00 cmpb $0x0,0x105e61(%rip) # 521778 <enable_evmcs>
41b917: 0f 85 13 01 00 00 jne 41ba30 <__vmlaunch+0x120>
41b91d: ba 14 6c 00 00 mov $0x6c14,%edx
41b922: b9 16 6c 00 00 mov $0x6c16,%ecx
41b927: 6a 00 push $0x0
41b929: 0f 79 d4 vmwrite %rsp,%rdx
41b92c: 48 8d 05 82 00 00 00 lea 0x82(%rip),%rax # 41b9b5 <__vmlaunch+0xa5>
41b933: 0f 79 c8 vmwrite %rax,%rcx
<xchg GPRs>
41b9ae: 0f 01 c2 vmlaunch
41b9b1: 48 ff 04 24 incq (%rsp)
<xchg GPRs>
41ba2d: 58 pop %rax
41ba2e: c3 ret
41ba2f: 90 nop
41ba30: 48 8b 35 39 5d 10 00 mov 0x105d39(%rip),%rsi # 521770 <current_evmcs>
41ba37: c7 86 38 03 00 00 00 00 00 00 movl $0x0,0x338(%rsi)
41ba41: 6a 00 push $0x0
41ba43: 48 89 a6 68 02 00 00 mov %rsp,0x268(%rsi)
41ba4a: 48 8d 05 83 00 00 00 lea 0x83(%rip),%rax # 41bad4 <__vmlaunch+0x1c4>
41ba51: 48 89 46 50 mov %rax,0x50(%rsi)
<xchg GPRs>
41bacd: 0f 01 c2 vmlaunch
41bad0: 48 ff 04 24 incq (%rsp)
<xchg GPRs>
41bb4c: 58 pop %rax
41bb4d: c3 ret
No functional change intended (though the code generation will be quite
different).
Cc: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260904002423.3154436-14-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Now that load_vmcs() either asserts or returns success, drop the return
code and the many asserts in its callers.
Link: https://patch.msgid.link/20260904002423.3154436-11-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Assert that vmptrld() succeeds instead of forcing all callers to do the
same, and opportunistically provide a macro to print (hopefully) useful
information on VMX instruction failures.
Leave load_vmcs() as-is for the moment to minimize the amount of churn
since the vmptrld() changes aren't completely trivial.
Link: https://patch.msgid.link/20260904002423.3154436-10-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Continue removing dead error "handling", and assert that VMCLEAR
succeeds instead of forcing callers of load_vmcs() to assert success.
For all intents and purposes, no functional change intended.
Link: https://patch.msgid.link/20260904002423.3154436-9-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
succeed
Assert that vmxon() succeeds, and by extension prepare_for_vmx_operation().
Forcing every caller to assert that a core preparation helper succeeds is
absurd and generates hard-to-read code.
For all intents and purposes, no functional change intended.
Link: https://patch.msgid.link/20260904002423.3154436-8-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add an arch hook to communicate to the core physical page allocator that
page table allocations need to be naturally aligned. The hook will be used
for upcoming PowerPC support, which has MMU tables that are larger than the
guest base page size and need to be naturally aligned.
Bury the hook in the physical page allocator to avoid having to plumb a
rarely used param into the main APIs.
Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-21-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Automatically choose the minimum GPA for physical page allocations based on
the region type instead of sprinkling the logic over various wrappers and
tests. All usage falls into three categories: (a) don't care, just use the
bare minimum GPA, (b) page tables, use a slightly higher min to keep low
memory available, (c) custom memslot, use the base of the memslot. I.e.
there isn't a strong need to allow completely custom minimums.
Opportunistically move the vGIC LPI stress test's "gpa_base" variable into
setup_memslot() as the only reason it was a global variable was so that it
could be passed as the minimum GPA for allocations from the extra memslot.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-20-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Take the memory region type instead of the memslot in all page allocator
APIs, except for the innermost quad-underscores function. This will allow
automatically selecting the minimum GPA based on the allocation type, which
can't be done using the memslot due to all regions sharing a single memslot
by default. PowerPC support will also leverage the type to ensure that
page table allocations are naturally aligned.
No functional change intended.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-18-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
And another memory region type to deal with extra, one-off memory regions,
and use the new type to manage x86's SMRAM memslot, as another step towards
taking the region type instead of the raw memslot in the physical page
allocator APIs.
Alternatively, SMRAM setup could simply use the quad-underscore API to
continue passing in the memslot, but a surprising number of tests use an
"extra" memslot for a variety of reasons. I.e. allocating memory from one
(and exactly one) extra memslot isn't all that rare, and so should be
treated as normal behavior, not as something extraordinary, as
quad-underscore functions typically suggest.
Opportunistically add comments to document the intended usage of the types,
as the difference between DATA, TEST_DATA, and TEST_EXTRA in particular
isn't exactly obvious.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-14-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add and use APIs to override memory region types instead of open coding the
logic in tests, partly to dedup test code, but mostly to add some amount of
protection against conflicting overrides. This will allow converting more
tests to override memory regions without taking on too much risk of bugs in
the long term, e.g. due to silently overriding a region multiple times.
Deliberately "unroll" the loops in __vm_create() and the CMMA test's
create_main_memslot() to avoid filling all memslots in anticipation of
adding an "extra" memslot that is for test use and *only* test use, i.e.
shouldn't be configured by core library code.
Converting tests to overriding memory regions will allow taking the region
type instead of the raw memslot in the physical page allocator APIs.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-13-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Initialize vm->memslots[] with an invalid memslots value during very
initial VM creation so that failure to configure the core memory regions
generates an immediate assert instead of potential weirdness, e.g. if slot0
is coincidentally valid. This will also allow hardening the region APIs to
guard overriding a region's memslot multiple times.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Acked-by: Gautam Menghani <gautam@linux.ibm.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-12-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add vm_alloc_page_table_pages() and use it throughout arch code to replace
open coded equivalents.
No functional change intended.
Reviewed-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Anup Patel <anup@brainfault.org>
Acked-by: Gautam Menghani <gautam@linux.ibm.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-11-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Move the single-page allocator APIs to kvm_util.h as inline functions, as
the are trivial wrappers, and unlike __vm_phy_pages_alloc(), are expected
to remain that way for the foreseeable future.
No functional change intended.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-8-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Extend the page allocator to support naturally aligned allocations, as some
flavors of PowerPC page tables require multiple guest pages per table, and
those tables need to be naturally aligned.
Take care to align the potential base address *inside* the retry loop, i.e.
the base needs to be (re)aligned on every attempt.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-7-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
physical pages
Rework the core loop of the physical page allocator to use a goto instead
of do-while loop when retrying with a new base address. The do-while loop
obviously works, but it obfuscates the success vs. failure paths, and in
general is convoluted.
For all intents and purposes, no functional change intended.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
[Rebased to latest mainline tree]
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
[sean: separate from alignment change, use enomem label, write changelog]
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Acked-by: Gautam Menghani <gautam@linux.ibm.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-6-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Rename the "num" param in the physical page allocator APIs to "nr_pages" to
make the unit and role of the param more obvious.
Opportunistically rework the function comment to drop the superfluous
kerneldoc style, and to very explicitly call out that success is guaranteed.
No functional change intended.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Now that LoongArch uses KVM_GUEST_PAGE_TABLE_MIN_PADDR for its page table
page allocations, use the common vm_alloc_page_table() instead of open
coding the same.
Opportunistically drop the assert that the allocation succeeded, as the
allocator itself guarantees success.
No functional change intended.
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Use the common minimum GPA for page tables (0x180000) on LoongArch instead
of LoongArch's custom minimum of 0x200000, so that LoongArch can use
vm_alloc_page_table() instead of open coding a rough equivalent. There are
no known reasons why LoongArch can't use a lower, less-aligned minimum.
The more-aligned value was originally selected to support huge pages for
the guest, but that only requires the address of the final allocation to be
aligned, the addresses of page table pages is irrelevant on that front.
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
regions/segments
Use MEM_REGION_PT to indirectly specify memslot '0' instead of hardcoding
the memslot in s390's virtual memory allocator, as a first step towards
taking the allocation type instead of the exact, raw memslot in the
physical memory allocator.
Note, the only tests that set MEM_REGION_PT to a memslot other than '0' are
arm64-only, i.e. s390 always uses memslot '0' for page tables.
No functional change intended.
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20260902164123.2546762-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
KVM selftests changes for 7.3, part 2
- Fix several issues with seeding KVM's pRNG, and rework the pRNG APIs to that
the pRNG can be sanely used in host code, not just guest code.
- Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via
KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs
via writes to an assigned VFIO device.
- Add syscall wrappers to assert success on a variety of pthreads and CPU
affinity APIs.
- Set vCPU pthread affinity as early as possible to reduce contention issues
that were surfaced by PREEMPT_LAZY, which result in runtimes of over a
minute on large hosts, versus the expected ~5 seconds.
- Rework the PMU counters test to run each testcase using a single VM with
many vCPUs for each sub-testcase, instead of using a unique VM for each
sub-testcase. This cuts the runtime by ~20x.
|
|
KVM selftests changes for 7.3, part 1
- Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the
functionality for nested VMX, and drop the ucall hack that was fudging
around the lack of GPR switching on nVMX.
- Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2,
across save/restore, including when L2 is active.
- Add a test to verify KVM_CREATE_VM accepts exactly what is reported by
KVM_CAP_VM_TYPES.
- Misc selftests fixes and cleanups
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD
LoongArch KVM changes for v7.3
1. Advertise already-supported capabilities.
2. Some bug fixes about timer and MMIO.
3. Some hardening about interrupt injection.
4. Replace kvm_err() with kvm_pr_unimpl().
5. Add FPU/LSX/LASX test cases for selftests.
|
|
Add LSX and LASX features when VM is created. These features are detected
firstly, enable it if it is available on host machine.
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
|
|
To significantly reduce the PMU counter test's runtime, without sacrificing
test coverage in the aggregate, test a random GP counter in the arch events
testcase instead of testing every possible GP counter. Testing every PMC
in every run of the test significantly increases the runtime of the test,
without providing an equivalent increase in validation coverage, as the
odds of a KVM having a bug that only affected a subset of counters and only
when testing all other counters are extremely low.
Opportunistically clean up kvm_random_u64_in_range() to eliminate
unnecessary newlines.
Link: https://patch.msgid.link/20260804210046.3413149-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add and use KVM wrappers for pthread_{cancel,join}() so that selftests
don't need to manually assert that the syscalls succeeded.
Note, the vast majority tests don't actually assert success, but they all
obviously rely on the syscall to succeed.
Other than explicitly failing if a syscall fails, no functional change
intended.
Link: https://patch.msgid.link/20260731195612.2697986-10-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Add and use a KVM wrapper for pthread_create() syscall so that selftests
don't need to manually assert that the syscall succeeded.
Note, most tests don't actually assert success, but they all obviously
rely on the syscall to succeed.
Other than explicitly failing if pthread_create() fails, no functional
change intended.
Link: https://patch.msgid.link/20260731195612.2697986-9-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
Extract kvm_pick_random_cpu() out of pin_task_to_random_cpu() so that tests
can choose a random CPU without having to immediately pin a task to that
CPU.
No functional change intended.
Link: https://patch.msgid.link/20260731195612.2697986-6-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
When pinning a task to a random CPU, return which CPU the task was pinned
to so that the caller can do things like avoid running other tasks on the
target CPU.
Link: https://patch.msgid.link/20260731195612.2697986-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
|
init_vmcs_control_fields() sets PFEC_MASK and PFEC_MATCH so that they
never match, which reverses the meaning of the PF_VECTOR bit in
EXCEPTION_BITMAP (which is zeroed), effectively enabling #PF
interception by default.
The relevant part of the SDM describes this:
When a page fault occurs, a processor consults (1) bit 14 of the
exception bitmap; (2) the error code produced with the page fault [PFEC];
(3) the page-fault error-code mask field [PFEC_MASK]; and (4) the
page-fault error-code match field [PFEC_MATCH].
It checks if PFEC & PFEC_MASK = PFEC_MATCH. If there is equality, the
specification of bit 14 in the exception bitmap is followed (for example,
a VM exit occurs if that bit is set). If there is inequality, the meaning
of that bit is reversed (for example, a VM exit occurs if that bit is
clear).
Clear PFEC_MATCH such that there is equality, and the #PF bit in the
exception bitmap is followed, so that #PFs are not intercepted by default,
same as every other exception. This also allows tests to set the #PF bit
in the exception bitmap if they want to intercept #PFs, without having to
muck with the PFEC_{MASK,MATCH} fields.
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Link: https://patch.msgid.link/20260728174232.2423257-10-yosry@kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
|
