Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm into next

Pull KVM updates from Paolo Bonzini:
 "At over 200 commits, covering almost all supported architectures, this
  was a pretty active cycle for KVM.  Changes include:

   - a lot of s390 changes: optimizations, support for migration, GDB
     support and more

   - ARM changes are pretty small: support for the PSCI 0.2 hypercall
     interface on both the guest and the host (the latter acked by
     Catalin)

   - initial POWER8 and little-endian host support

   - support for running u-boot on embedded POWER targets

   - pretty large changes to MIPS too, completing the userspace
     interface and improving the handling of virtualized timer hardware

   - for x86, a larger set of changes is scheduled for 3.17.  Still, we
     have a few emulator bugfixes and support for running nested
     fully-virtualized Xen guests (para-virtualized Xen guests have
     always worked).  And some optimizations too.

  The only missing architecture here is ia64.  It's not a coincidence
  that support for KVM on ia64 is scheduled for removal in 3.17"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (203 commits)
  KVM: add missing cleanup_srcu_struct
  KVM: PPC: Book3S PR: Rework SLB switching code
  KVM: PPC: Book3S PR: Use SLB entry 0
  KVM: PPC: Book3S HV: Fix machine check delivery to guest
  KVM: PPC: Book3S HV: Work around POWER8 performance monitor bugs
  KVM: PPC: Book3S HV: Make sure we don't miss dirty pages
  KVM: PPC: Book3S HV: Fix dirty map for hugepages
  KVM: PPC: Book3S HV: Put huge-page HPTEs in rmap chain for base address
  KVM: PPC: Book3S HV: Fix check for running inside guest in global_invalidates()
  KVM: PPC: Book3S: Move KVM_REG_PPC_WORT to an unused register number
  KVM: PPC: Book3S: Add ONE_REG register names that were missed
  KVM: PPC: Add CAP to indicate hcall fixes
  KVM: PPC: MPIC: Reset IRQ source private members
  KVM: PPC: Graciously fail broken LE hypercalls
  PPC: ePAPR: Fix hypercall on LE guest
  KVM: PPC: BOOK3S: Remove open coded make_dsisr in alignment handler
  KVM: PPC: BOOK3S: Always use the saved DAR value
  PPC: KVM: Make NX bit available with magic page
  KVM: PPC: Disable NX for old magic page using guests
  KVM: PPC: BOOK3S: HV: Add mixed page-size support for guest
  ...

5 files changed, 95 insertions, 50 deletions

diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 06e6401d6ef4..d6a3d0993d88 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -80,12 +80,10 @@ static void async_pf_execute(struct work_struct *work)
 
         might_sleep();
 
-        use_mm(mm);
         down_read(&mm->mmap_sem);
-        get_user_pages(current, mm, addr, 1, 1, 0, NULL, NULL);
+        get_user_pages(NULL, mm, addr, 1, 1, 0, NULL, NULL);
         up_read(&mm->mmap_sem);
         kvm_async_page_present_sync(vcpu, apf);
-        unuse_mm(mm);
 
         spin_lock(&vcpu->async_pf.lock);
         list_add_tail(&apf->link, &vcpu->async_pf.done);
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 29c2a04e036e..20c3af7692c5 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -31,6 +31,7 @@
 #include <linux/list.h>
 #include <linux/eventfd.h>
 #include <linux/kernel.h>
+#include <linux/srcu.h>
 #include <linux/slab.h>
 
 #include "iodev.h"
@@ -118,19 +119,22 @@ static void
 irqfd_resampler_ack(struct kvm_irq_ack_notifier *kian)
 {
         struct _irqfd_resampler *resampler;
+        struct kvm *kvm;
         struct _irqfd *irqfd;
+        int idx;
 
         resampler = container_of(kian, struct _irqfd_resampler, notifier);
+        kvm = resampler->kvm;
 
-        kvm_set_irq(resampler->kvm, KVM_IRQFD_RESAMPLE_IRQ_SOURCE_ID,
+        kvm_set_irq(kvm, KVM_IRQFD_RESAMPLE_IRQ_SOURCE_ID,
                     resampler->notifier.gsi, 0, false);
 
-        rcu_read_lock();
+        idx = srcu_read_lock(&kvm->irq_srcu);
 
         list_for_each_entry_rcu(irqfd, &resampler->list, resampler_link)
                 eventfd_signal(irqfd->resamplefd, 1);
 
-        rcu_read_unlock();
+        srcu_read_unlock(&kvm->irq_srcu, idx);
 }
 
 static void
@@ -142,7 +146,7 @@ irqfd_resampler_shutdown(struct _irqfd *irqfd)
         mutex_lock(&kvm->irqfds.resampler_lock);
 
         list_del_rcu(&irqfd->resampler_link);
-        synchronize_rcu();
+        synchronize_srcu(&kvm->irq_srcu);
 
         if (list_empty(&resampler->list)) {
                 list_del(&resampler->link);
@@ -221,17 +225,18 @@ irqfd_wakeup(wait_queue_t *wait, unsigned mode, int sync, void *key)
         unsigned long flags = (unsigned long)key;
         struct kvm_kernel_irq_routing_entry *irq;
         struct kvm *kvm = irqfd->kvm;
+        int idx;
 
         if (flags & POLLIN) {
-                rcu_read_lock();
-                irq = rcu_dereference(irqfd->irq_entry);
+                idx = srcu_read_lock(&kvm->irq_srcu);
+                irq = srcu_dereference(irqfd->irq_entry, &kvm->irq_srcu);
                 /* An event has been signaled, inject an interrupt */
                 if (irq)
                         kvm_set_msi(irq, kvm, KVM_USERSPACE_IRQ_SOURCE_ID, 1,
                                         false);
                 else
                         schedule_work(&irqfd->inject);
-                rcu_read_unlock();
+                srcu_read_unlock(&kvm->irq_srcu, idx);
         }
 
         if (flags & POLLHUP) {
@@ -363,7 +368,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
                 }
 
                 list_add_rcu(&irqfd->resampler_link, &irqfd->resampler->list);
-                synchronize_rcu();
+                synchronize_srcu(&kvm->irq_srcu);
 
                 mutex_unlock(&kvm->irqfds.resampler_lock);
         }
@@ -465,7 +470,7 @@ kvm_irqfd_deassign(struct kvm *kvm, struct kvm_irqfd *args)
                          * another thread calls kvm_irq_routing_update before
                          * we flush workqueue below (we synchronize with
                          * kvm_irq_routing_update using irqfds.lock).
-                         * It is paired with synchronize_rcu done by caller
+                         * It is paired with synchronize_srcu done by caller
                          * of that function.
                          */
                         rcu_assign_pointer(irqfd->irq_entry, NULL);
@@ -524,7 +529,7 @@ kvm_irqfd_release(struct kvm *kvm)
 
 /*
  * Change irq_routing and irqfd.
- * Caller must invoke synchronize_rcu afterwards.
+ * Caller must invoke synchronize_srcu(&kvm->irq_srcu) afterwards.
  */
 void kvm_irq_routing_update(struct kvm *kvm,
                             struct kvm_irq_routing_table *irq_rt)
@@ -600,7 +605,15 @@ ioeventfd_in_range(struct _ioeventfd *p, gpa_t addr, int len, const void *val)
 {
         u64 _val;
 
-        if (!(addr == p->addr && len == p->length))
+        if (addr != p->addr)
+                /* address must be precise for a hit */
+                return false;
+
+        if (!p->length)
+                /* length = 0 means only look at the address, so always a hit */
+                return true;
+
+        if (len != p->length)
                 /* address-range must be precise for a hit */
                 return false;
 
@@ -671,9 +684,11 @@ ioeventfd_check_collision(struct kvm *kvm, struct _ioeventfd *p)
 
         list_for_each_entry(_p, &kvm->ioeventfds, list)
                 if (_p->bus_idx == p->bus_idx &&
-                    _p->addr == p->addr && _p->length == p->length &&
-                    (_p->wildcard || p->wildcard ||
-                     _p->datamatch == p->datamatch))
+                    _p->addr == p->addr &&
+                    (!_p->length || !p->length ||
+                     (_p->length == p->length &&
+                      (_p->wildcard || p->wildcard ||
+                       _p->datamatch == p->datamatch))))
                         return true;
 
         return false;
@@ -697,8 +712,9 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
         int                       ret;
 
         bus_idx = ioeventfd_bus_from_flags(args->flags);
-        /* must be natural-word sized */
+        /* must be natural-word sized, or 0 to ignore length */
         switch (args->len) {