Make use of get_full_path_helper() instead of sprintf.

Signed-off-by: G. Campana <gcampana+kvm@quarkslab.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

The check on the return value of snprintf should reuse the size parameter,
rather than take sizeof(full_path) as the bound.

Signed-off-by: G. Campana <gcampana+kvm@quarkslab.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

The code responsible of path verification is identical in several
functions. Move it to a new function.

Signed-off-by: G. Campana <gcampana+kvm@quarkslab.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Use strncpy instead of strcpy to avoid buffer overflow vulnerabilities.

Signed-off-by: G. Campana <gcampana+kvm@quarkslab.com>
[will: keep strcpy when we've verified the size already]
Signed-off-by: Will Deacon <will.deacon@arm.com>

Use snprintf instead of sprintf to avoid buffer overflow
vulnerabilities.

Signed-off-by: G. Campana <gcampana+kvm@quarkslab.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

A path traversal exists because the guest can send "../" sequences to
the host 9p handlers. To fix this vulnerability, we ensure that path
components sent by the guest don't contain "../" sequences.

Signed-off-by: G. Campana <gcampana+kvm@quarkslab.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Latest Debian and Ubuntu GCC default to PIE code. Disable
PIC for bios and PIE for pre_init. Since the flag -no-pie
is not available on older GCC's, make use of flag only if
the option is available. -fno-pic is more widely available
and should be safe to enable uncondionally.

Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>

The madvise behavior is not a bit field and hence can not be or'ed.
Also madvise_behavior_valid checks the flag using a case statement
hence only one behavior is supposed to be supplied. Call madvise
twice, once for MERGEABLE and once for HUGEPAGE.

Acked-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Will Deacon <will.deacon@arm.com>

open() sets the file osset to the beginning of the file, so there's no
need for an explicit lseek when called in kvm__arch_load_kernel_image.

Signed-off-by: Will Deacon <will.deacon@arm.com>

When walking the devices rbtree to insert a node, we must keep track of the
parent node when we descend. If we skip this step, we always insert new
nodes with a NULL parent, bypassing __rb_insert()s rebalance code.

Things get worse when we come to walk the tree, as we can't move up a
level. This isn't a problem in practice, as all devices appear to be
inserted in-order, so our rbtree is actually a monochrome linked list.

Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

KVM exposes a level triggered timer to the guest, and yet kvmtool
presents it as being edge-triggered in the DT. Let's fix it and
match what the kernel exposes.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

From time to time (when new KVM kernel features get enabled in kvmtool),
we need to update the public kernel headers from a recent Linux tree.
Provide a script that makes sure we get the right files and that also
covers every architecture.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Update our copy of the KVM header files to match the kernel's v4.6.0.
This fixes the ARM PMU support, where the feature identifier was
changed during the merge window due to a merge conflict.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

readdir_r is deprecated[1] and usage of readdir is recommended.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=7584a3f96de88d5eefe5d6c634515278cbfbf052



Signed-off-by: Michal Rostecki <michal.rostecki@gmail.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Our exit/reboot code is a bit of a mess:

  - Both kvm__reboot and kvm_cpu_exit send SIGKVMEXIT to running vcpus
  - When vcpu0 exits, the main thread starts executing destructors
    (exitcalls) whilst other vcpus may be running
  - The pause_lock isn't always held when inspecting is_running for
    a vcpu

This patch attempts to fix these issues by restricting the exit/reboot
path to vcpu0 and the main thread. In particular, a KVM_SYSTEM_EVENT
will signal SIGKVMEXIT to vcpu0, which will join with the main thread
and then tear down the other vcpus before invoking any destructor code.

Acked-by: Balbir Singh <bsingharora@gmail.com>
Tested-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Port the spapr_pci implementation for ppc64le.
Based on suggestions by Alexey Kardashevskiy <aik@ozlabs.ru>
We should have always used phys_hi and 64 bit addr and size.

Cc: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Balbir Singh <bsingharora@gmail.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Use the infrastructure for queuing a task to a specific vCPU and
sett ILE (Little Endian Interrupt Handling) on power via h_set_mode
hypercall

Signed-off-by: Balbir Singh <bsingharora@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Will Deacon <will.deacon@arm.com>

This patch adds kvm_cpu__run_on_all_cpus() to run a task on each vCPU.
This infrastructure uses signals to signal the vCPU to allow a task
to be added to each vCPU's task. The vCPU executes any pending tasks
in the cpu run loop

Signed-off-by: Balbir Singh <bsingharora@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Currently kvmtool works well/was designed for big endian ppc64 systems.
This patch adds support for little endian systems

The system does not yet boot as support for h_set_mode is required to help
with exceptions in big endian mode -- first page fault. The support comes in
the next patch of the series

Signed-off-by: Balbir Singh <bsingharora@gmail.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Debian and some other distro's don't provide mkisofs due to
licensing concerns. xorrisofs from package xorriso provides
a command-line compatible command in this case. Update the
makefile of tests to pick xorrisofs if mkisofs is not available.

Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>

We don't have PMU support on 32bit ARM just yet, so let's work
around this the ugly way for now.

Cc: Will Deacon <will.deacon@arm.com>
Reported-by: Riku Voipio <riku.voipio@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Now that we have a manpage in place, we can remove the manpage-style
text files from the Documentation directory.
This allows us also to get rid of the crude common-cmds.h generation,
which relied on these files and on a command-list.txt file.
Instead include the version of that header file generated with the
current HEAD into the source tree.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

The kvmtool documentation is somewhat lacking, also it is not easily
accessible when living in the source tree only.
Add a good ol' manpage to document at least the basic commands and
their options.
This level of documentation matches the one that is already there in
the Documentation directory and should be subject to extension.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

In order to enable the in-kernel PMU emulation code, add a tiny bit
of setup code that initializes the PMU on each CPU and populates
the DT. The IRQ is harcoded to PPI7 (INTID23) in order to match
what QEMU does.

The code is enabled when the --pmu option is passed to lkvm.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

In order to enable the PMU support on arm64, update the copy of the
kernel include files.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

If a static libc is not present in the system the build will fail with
make complaining about commands starting before the first target. The
patch fixes indentation of a warning about missing static libc, thus
fixing the build.

Signed-off-by: Maciek Borzecki <maciek.borzecki@gmail.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

For some reasons (probably to have easy access to the command line)
the kernel loading for arm and arm64 was located in arm/fdt.c.
Move the routines to kvm.c (where other architectures put it) to
only have real device tree code in fdt.c. We use the pointer in
struct kvm to access the command line string.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Use the new read_file() wrapper in our arm/arm64 kernel image loading
function instead of the private implementation.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Replace the unsafe read-loops in the x86 kernel image loading
functions with our safe read_file() and read_in_full() wrappers.
This should fix random fails in kernel image loading, especially
from pipes and sockets.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Replace the unsafe read-loops used in the MIPS kernel image loading
with our safe read_file() and read_in_full() wrappers.
This should fix random fails in kernel image loading, especially
from pipes and sockets.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Replace the unsafe read-loops in the powerpc kernel image loading
function with our new and safe read_file() wrapper.
This should fix random fails in kernel image loading, especially
from pipes and sockets.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

In various parts of kvmtool we simply try to read files into memory,
but fail to do so in a safe way. The read(2) syscall can return early
having only parts of the file read, or it may return -1 due to being
interrupted by a signal (in which case we should simply retry).
The ARM code seems to provide the only safe implementation, so take
that as an inspiration to provide a generic read_file() function
usable by every part of kvmtool.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Let's face it: Kernel loading is quite architecture specific. Don't
claim otherwise and move the loading routines into each
architecture's responsibility.
This introduces kvm__arch_load_kernel(), which each architecture can
implement accordingly.
Provide bzImage loading for x86 and ELF loading for MIPS as special
cases for those architectures (removing the arch specific code from
the generic kvm.c file on the way) and rename the existing "flat binary"
loader functions for the other architectures to the new name.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

After make lkvm-static & make clean, the dependency files for static
objects (.xxx.static.o.d) are not removed.

Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
Signed-off-by: Dimitri John Ledkov <dimitri.j.ledkov@intel.com>
Signed-off-by: James Hunt <james.o.hunt@intel.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

Looking back at the HEAD from a few commits ago, it's obvious that
using the LDFLAGS variable for linking the guest_init binary was
rather pointless, as it was zeroed in the beginning and then never
set.

As guest_init is a rather special binary that does not cope well with
arbitrary linker flags, let's reinstantiate the previous state by
removing the LDFLAGS variable from those linking steps. This allows
LDFLAGS to be used for linking the actual kvmtool binary only and
helps to re-merge commit d0e2772b ("Makefile: allow overriding
CFLAGS on the command line").

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

lkvm currently suffers from a Segmentation Fault when exiting, which can
also lead to the console not being cleaned up correctly after a VM exits.

The issue is that (the misnamed) kvm_cpu__reboot function sends a
SIGKVMEXIT to each vcpu thread, which causes those vcpu threads to exit
once their main loops (kvm_cpu__start) detect that cpu->is_running is
now false. The lack of synchronisation in this exit path means that a
concurrent pause event (due to the br_write_lock in ioport__unregister)
ends up sending SIGKVMPAUSE to an exited thread, resulting in a SEGV.

This patch fixes the issue by moving kvm_cpu__reboot into kvm.c
(renaming it in the process) where it can hold the pause_lock mutex
across the reboot operation. This in turn makes it safe for the pause
code to check the is_running field of each CPU before attempting to
send a SIGKVMPAUSE signal.

Signed-off-by: Will Deacon <will.deacon@arm.com>

Riku Voipio reports a regression introduced by d0e2772b ("Makefile:
allow overriding CFLAGS on the command line"):

| This breaks builds of debian packages as dpkg-buildpackage sets LDFLAGS
| to something unsuitable for guest init.

Revert the problematic patch for the moment, while we rethink how we'd
like to support user-provided toolchain flags.

This reverts commit d0e2772b.

Conflicts:
	Makefile

Signed-off-by: Will Deacon <will.deacon@arm.com>

While we have an LDFLAGS variable in kvmtool's Makefile, it's not
really used when both doing the feature tests and when finally linking
the lkvm executable.
Add that variable to all the linking steps to allow the user to
specify custom library directories or linker options on the command
line.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>

When a Makefile variable is set on the make command line, all
Makefile-internal assignments to that very variable are _ignored_.
Since we add quite some essential values to CFLAGS internally,
specifying some CFLAGS on the command line will usually break the
build (and not fix any include file problems you hoped to overcome
with that).
Somewhat against intuition GNU make provides the "override" directive
to change this behavior; with that assignments in the Makefile get
_appended_ to the value given on the command line. [1]

Change any internal assignments to use that directive, so that a user
can use:
$ make CFLAGS=/path/to/my/include/dir
to teach kvmtool about non-standard header file locations (helpful
for cross-compilation) or to tweak other compiler options.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>

[1] https://www.gnu.org/software/make/manual/html_node/Override-Directive.html


Signed-off-by: Will Deacon <will.deacon@arm.com>