powerpc/oprofile: fix potential buffer overrun in op_model_cell.c
[safe/jmp/linux-2.6] / virt / kvm / irq_comm.c
index 59cf8da..a0e8880 100644 (file)
@@ -20,6 +20,7 @@
  */
 
 #include <linux/kvm_host.h>
+#include <linux/slab.h>
 #include <trace/events/kvm.h>
 
 #include <asm/msidef.h>
@@ -82,8 +83,6 @@ int kvm_irq_delivery_to_apic(struct kvm *kvm, struct kvm_lapic *src,
        int i, r = -1;
        struct kvm_vcpu *vcpu, *lowest = NULL;
 
-       WARN_ON(!mutex_is_locked(&kvm->irq_lock));
-
        if (irq->dest_mode == 0 && irq->dest_id == 0xff &&
                        kvm_is_dm_lowest_prio(irq))
                printk(KERN_INFO "kvm: apic: phys broadcast and lowest prio\n");
@@ -138,7 +137,7 @@ static int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e,
        return kvm_irq_delivery_to_apic(kvm, NULL, &irq);
 }
 
-/* This should be called with the kvm->irq_lock mutex held
+/*
  * Return value:
  *  < 0   Interrupt was ignored (masked or not delivered for other reasons)
  *  = 0   Interrupt was coalesced (previous irq is still pending)
@@ -146,28 +145,33 @@ static int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e,
  */
 int kvm_set_irq(struct kvm *kvm, int irq_source_id, u32 irq, int level)
 {
-       struct kvm_kernel_irq_routing_entry *e;
-       int ret = -1;
+       struct kvm_kernel_irq_routing_entry *e, irq_set[KVM_NR_IRQCHIPS];
+       int ret = -1, i = 0;
        struct kvm_irq_routing_table *irq_rt;
        struct hlist_node *n;
 
        trace_kvm_set_irq(irq, level, irq_source_id);
 
-       WARN_ON(!mutex_is_locked(&kvm->irq_lock));
-
        /* Not possible to detect if the guest uses the PIC or the
         * IOAPIC.  So set the bit in both. The guest will ignore
         * writes to the unused one.
         */
-       irq_rt = kvm->irq_routing;
+       rcu_read_lock();
+       irq_rt = rcu_dereference(kvm->irq_routing);
        if (irq < irq_rt->nr_rt_entries)
-               hlist_for_each_entry(e, n, &irq_rt->map[irq], link) {
-                       int r = e->set(e, kvm, irq_source_id, level);
-                       if (r < 0)
-                               continue;
+               hlist_for_each_entry(e, n, &irq_rt->map[irq], link)
+                       irq_set[i++] = *e;
+       rcu_read_unlock();
+
+       while(i--) {
+               int r;
+               r = irq_set[i].set(&irq_set[i], kvm, irq_source_id, level);
+               if (r < 0)
+                       continue;
+
+               ret = r + ((ret < 0) ? 0 : ret);
+       }
 
-                       ret = r + ((ret < 0) ? 0 : ret);
-               }
        return ret;
 }
 
@@ -179,19 +183,21 @@ void kvm_notify_acked_irq(struct kvm *kvm, unsigned irqchip, unsigned pin)
 
        trace_kvm_ack_irq(irqchip, pin);
 
-       gsi = kvm->irq_routing->chip[irqchip][pin];
+       rcu_read_lock();
+       gsi = rcu_dereference(kvm->irq_routing)->chip[irqchip][pin];
        if (gsi != -1)
-               hlist_for_each_entry(kian, n, &kvm->arch.irq_ack_notifier_list,
-                                    link)
+               hlist_for_each_entry_rcu(kian, n, &kvm->irq_ack_notifier_list,
+                                        link)
                        if (kian->gsi == gsi)
                                kian->irq_acked(kian);
+       rcu_read_unlock();
 }
 
 void kvm_register_irq_ack_notifier(struct kvm *kvm,
                                   struct kvm_irq_ack_notifier *kian)
 {
        mutex_lock(&kvm->irq_lock);
-       hlist_add_head(&kian->link, &kvm->arch.irq_ack_notifier_list);
+       hlist_add_head_rcu(&kian->link, &kvm->irq_ack_notifier_list);
        mutex_unlock(&kvm->irq_lock);
 }
 
@@ -199,8 +205,9 @@ void kvm_unregister_irq_ack_notifier(struct kvm *kvm,
                                    struct kvm_irq_ack_notifier *kian)
 {
        mutex_lock(&kvm->irq_lock);
-       hlist_del_init(&kian->link);
+       hlist_del_init_rcu(&kian->link);
        mutex_unlock(&kvm->irq_lock);
+       synchronize_rcu();
 }
 
 int kvm_request_irq_source_id(struct kvm *kvm)
@@ -209,16 +216,17 @@ int kvm_request_irq_source_id(struct kvm *kvm)
        int irq_source_id;
 
        mutex_lock(&kvm->irq_lock);
-       irq_source_id = find_first_zero_bit(bitmap,
-                               sizeof(kvm->arch.irq_sources_bitmap));
+       irq_source_id = find_first_zero_bit(bitmap, BITS_PER_LONG);
 
-       if (irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
+       if (irq_source_id >= BITS_PER_LONG) {
                printk(KERN_WARNING "kvm: exhaust allocatable IRQ sources!\n");
-               return -EFAULT;
+               irq_source_id = -EFAULT;
+               goto unlock;
        }
 
        ASSERT(irq_source_id != KVM_USERSPACE_IRQ_SOURCE_ID);
        set_bit(irq_source_id, bitmap);
+unlock:
        mutex_unlock(&kvm->irq_lock);
 
        return irq_source_id;
@@ -232,10 +240,14 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id)
 
        mutex_lock(&kvm->irq_lock);
        if (irq_source_id < 0 ||
-           irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
+           irq_source_id >= BITS_PER_LONG) {
                printk(KERN_ERR "kvm: IRQ source ID out of range!\n");
-               return;
+               goto unlock;
        }
+       clear_bit(irq_source_id, &kvm->arch.irq_sources_bitmap);
+       if (!irqchip_in_kernel(kvm))
+               goto unlock;
+
        for (i = 0; i < KVM_IOAPIC_NUM_PINS; i++) {
                clear_bit(irq_source_id, &kvm->arch.vioapic->irq_states[i]);
                if (i >= 16)
@@ -244,7 +256,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id)
                clear_bit(irq_source_id, &pic_irqchip(kvm)->irq_states[i]);
 #endif
        }
-       clear_bit(irq_source_id, &kvm->arch.irq_sources_bitmap);
+unlock:
        mutex_unlock(&kvm->irq_lock);
 }
 
@@ -253,7 +265,7 @@ void kvm_register_irq_mask_notifier(struct kvm *kvm, int irq,
 {
        mutex_lock(&kvm->irq_lock);
        kimn->irq = irq;
-       hlist_add_head(&kimn->link, &kvm->mask_notifier_list);
+       hlist_add_head_rcu(&kimn->link, &kvm->mask_notifier_list);
        mutex_unlock(&kvm->irq_lock);
 }
 
@@ -261,8 +273,9 @@ void kvm_unregister_irq_mask_notifier(struct kvm *kvm, int irq,
                                      struct kvm_irq_mask_notifier *kimn)
 {
        mutex_lock(&kvm->irq_lock);
-       hlist_del(&kimn->link);
+       hlist_del_rcu(&kimn->link);
        mutex_unlock(&kvm->irq_lock);
+       synchronize_rcu();
 }
 
 void kvm_fire_mask_notifiers(struct kvm *kvm, int irq, bool mask)
@@ -270,18 +283,18 @@ void kvm_fire_mask_notifiers(struct kvm *kvm, int irq, bool mask)
        struct kvm_irq_mask_notifier *kimn;
        struct hlist_node *n;
 
-       WARN_ON(!mutex_is_locked(&kvm->irq_lock));
-
-       hlist_for_each_entry(kimn, n, &kvm->mask_notifier_list, link)
+       rcu_read_lock();
+       hlist_for_each_entry_rcu(kimn, n, &kvm->mask_notifier_list, link)
                if (kimn->irq == irq)
                        kimn->func(kimn, mask);
+       rcu_read_unlock();
 }
 
 void kvm_free_irq_routing(struct kvm *kvm)
 {
-       mutex_lock(&kvm->irq_lock);
+       /* Called only during vm destruction. Nobody can use the pointer
+          at this stage */
        kfree(kvm->irq_routing);
-       mutex_unlock(&kvm->irq_lock);
 }
 
 static int setup_routing_entry(struct kvm_irq_routing_table *rt,
@@ -290,6 +303,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
 {
        int r = -EINVAL;
        int delta;
+       unsigned max_pin;
        struct kvm_kernel_irq_routing_entry *ei;
        struct hlist_node *n;
 
@@ -310,12 +324,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
                switch (ue->u.irqchip.irqchip) {
                case KVM_IRQCHIP_PIC_MASTER:
                        e->set = kvm_set_pic_irq;
+                       max_pin = 16;
                        break;
                case KVM_IRQCHIP_PIC_SLAVE:
                        e->set = kvm_set_pic_irq;
+                       max_pin = 16;
                        delta = 8;
                        break;
                case KVM_IRQCHIP_IOAPIC:
+                       max_pin = KVM_IOAPIC_NUM_PINS;
                        e->set = kvm_set_ioapic_irq;
                        break;
                default:
@@ -323,7 +340,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
                }
                e->irqchip.irqchip = ue->u.irqchip.irqchip;
                e->irqchip.pin = ue->u.irqchip.pin + delta;
-               if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS)
+               if (e->irqchip.pin >= max_pin)
                        goto out;
                rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi;
                break;
@@ -387,8 +404,9 @@ int kvm_set_irq_routing(struct kvm *kvm,
 
        mutex_lock(&kvm->irq_lock);
        old = kvm->irq_routing;
-       kvm->irq_routing = new;
+       rcu_assign_pointer(kvm->irq_routing, new);
        mutex_unlock(&kvm->irq_lock);
+       synchronize_rcu();
 
        new = old;
        r = 0;