From ed48c59875b603058366490f472490f0fb9c30f3 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Thu, 14 Feb 2019 15:39:16 +1100 Subject: virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size The virtio-balloon always works in units of 4kiB (BALLOON_PAGE_SIZE), but we can only actually discard memory in units of the host page size. Now, we handle this very badly: we silently ignore balloon requests that aren't host page aligned, and for requests that are host page aligned we discard the entire host page. The latter can corrupt guest memory if its page size is smaller than the host's. The obvious choice would be to disable the balloon if the host page size is not 4kiB. However, that would break the special case where host and guest have the same page size, but that's larger than 4kiB. That case currently works by accident[1] - and is used in practice on many production POWER systems where 64kiB has long been the Linux default page size on both host and guest. To make the balloon safe, without breaking that useful special case, we need to accumulate 4kiB balloon requests until we have a whole contiguous host page to discard. We could in principle do that across all guest memory, but it would require a large bitmap to track. This patch represents a compromise: we track ballooned subpages for a single contiguous host page at a time. This means that if the guest discards all 4kiB chunks of a host page in succession, we will discard it. This is the expected behaviour in the (host page) == (guest page) != 4kiB case we want to support. If the guest scatters 4kiB requests across different host pages, we don't discard anything, and issue a warning. Not ideal, but at least we don't corrupt guest memory as the previous version could. Warning reporting is kind of a compromise here. Determining whether we're in a problematic state at realize() time is tricky, because we'd have to look at the host pagesizes of all memory backends, but we can't really know if some of those backends could be for special purpose memory that's not subject to ballooning. Reporting only when the guest tries to balloon a partial page also isn't great because if the guest page size happens to line up it won't indicate that we're in a non ideal situation. It could also cause alarming repeated warnings whenever a migration is attempted. So, what we do is warn the first time the guest attempts balloon a partial host page, whether or not it will end up ballooning the rest of the page immediately afterwards. [1] Because when the guest attempts to balloon a page, it will submit requests for each 4kiB subpage. Most will be ignored, but the one which happens to be host page aligned will discard the whole lot. Signed-off-by: David Gibson Message-Id: <20190214043916.22128-6-david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- include/hw/virtio/virtio-balloon.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include/hw') diff --git a/include/hw/virtio/virtio-balloon.h b/include/hw/virtio/virtio-balloon.h index e0df352..99dcd6d 100644 --- a/include/hw/virtio/virtio-balloon.h +++ b/include/hw/virtio/virtio-balloon.h @@ -30,6 +30,8 @@ typedef struct virtio_balloon_stat_modern { uint64_t val; } VirtIOBalloonStatModern; +typedef struct PartiallyBalloonedPage PartiallyBalloonedPage; + typedef struct VirtIOBalloon { VirtIODevice parent_obj; VirtQueue *ivq, *dvq, *svq; @@ -42,6 +44,7 @@ typedef struct VirtIOBalloon { int64_t stats_last_update; int64_t stats_poll_interval; uint32_t host_features; + PartiallyBalloonedPage *pbp; } VirtIOBalloon; #endif -- cgit v1.1 From ee1cd0099ab04f748c6d839e4f4d9a41b21e7399 Mon Sep 17 00:00:00 2001 From: Alexey Kardashevskiy Date: Thu, 14 Feb 2019 16:14:40 +1100 Subject: pci: Move NVIDIA vendor id to the rest of ids sPAPR code will use it too so move it from VFIO to the common code. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Reviewed-by: Alistair Francis Message-Id: <20190214051440.59167-1-aik@ozlabs.ru> Acked-by: Alex Williamson Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- include/hw/pci/pci_ids.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include/hw') diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h index eeb3301..0abe27a 100644 --- a/include/hw/pci/pci_ids.h +++ b/include/hw/pci/pci_ids.h @@ -271,4 +271,6 @@ #define PCI_VENDOR_ID_SYNOPSYS 0x16C3 +#define PCI_VENDOR_ID_NVIDIA 0x10de + #endif -- cgit v1.1 From b81a5f9427270133c27ab660c0054b277b2728d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 15 Feb 2019 15:36:00 +0000 Subject: hw/smbios: fix offset of type 3 sku field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The type 3 SMBIOS structure[1] ends with fields ... 0x14 - contained element count 0x15 - contained element record length 0x16 - sku number The smbios_type_3 struct missed the contained element record length field, causing sku number to be reported at the wrong offset. [1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.1.1.pdf Signed-off-by: Daniel P. Berrangé Message-Id: <20190215153600.1770727-1-berrange@redhat.com> Reviewed-by: Igor Mammedov Fixes: e41fca3da72 Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- include/hw/firmware/smbios.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/hw') diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h index eeb5a4d..6fef32a 100644 --- a/include/hw/firmware/smbios.h +++ b/include/hw/firmware/smbios.h @@ -162,6 +162,7 @@ struct smbios_type_3 { uint8_t height; uint8_t number_of_power_cords; uint8_t contained_element_count; + uint8_t contained_element_record_length; uint8_t sku_number_str; /* contained elements follow */ } QEMU_PACKED; -- cgit v1.1