5 files changed, 37 insertions, 13 deletions

diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 930126698a0f..2c9948379469 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -1930,6 +1930,23 @@ The "pte_enc" field provides a value that can OR'ed into the hash
 PTE's RPN field (ie, it needs to be shifted left by 12 to OR it
 into the hash PTE second double word).
 
+4.75 KVM_IRQFD
+
+Capability: KVM_CAP_IRQFD
+Architectures: x86
+Type: vm ioctl
+Parameters: struct kvm_irqfd (in)
+Returns: 0 on success, -1 on error
+
+Allows setting an eventfd to directly trigger a guest interrupt.
+kvm_irqfd.fd specifies the file descriptor to use as the eventfd and
+kvm_irqfd.gsi specifies the irqchip pin toggled by this event.  When
+an event is tiggered on the eventfd, an interrupt is injected into
+the guest using the specified gsi pin.  The irqfd is removed using
+the KVM_IRQFD_FLAG_DEASSIGN flag, specifying both kvm_irqfd.fd
+and kvm_irqfd.gsi.
+
+
 5. The kvm_run structure
 ------------------------
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index be3cea4407ff..57e168e27b5b 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3934,6 +3934,9 @@ static void kvm_mmu_remove_some_alloc_mmu_pages(struct kvm *kvm,
 {
         struct kvm_mmu_page *page;
 
+        if (list_empty(&kvm->arch.active_mmu_pages))
+                return;
+
         page = container_of(kvm->arch.active_mmu_pages.prev,
                             struct kvm_mmu_page, link);
         kvm_mmu_prepare_zap_page(kvm, page, invalid_list);
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index c4464356b35b..96c158a37d3e 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -815,7 +815,7 @@ static inline void kvm_free_irq_routing(struct kvm *kvm) {}
 #ifdef CONFIG_HAVE_KVM_EVENTFD
 
 void kvm_eventfd_init(struct kvm *kvm);
-int kvm_irqfd(struct kvm *kvm, int fd, int gsi, int flags);
+int kvm_irqfd(struct kvm *kvm, struct kvm_irqfd *args);
 void kvm_irqfd_release(struct kvm *kvm);
 void kvm_irq_routing_update(struct kvm *, struct kvm_irq_routing_table *);
 int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args);
@@ -824,7 +824,7 @@ int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args);
 
 static inline void kvm_eventfd_init(struct kvm *kvm) {}
 
-static inline int kvm_irqfd(struct kvm *kvm, int fd, int gsi, int flags)
+static inline int kvm_irqfd(struct kvm *kvm, struct kvm_irqfd *args)
 {
         return -EINVAL;
 }
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index f59c1e8de7a2..7d7e2aaffece 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -198,7 +198,7 @@ static void irqfd_update(struct kvm *kvm, struct _irqfd *irqfd,
 }
 
 static int
-kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
+kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
 {
         struct kvm_irq_routing_table *irq_rt;
         struct _irqfd *irqfd, *tmp;
@@ -212,12 +212,12 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
                 return -ENOMEM;
 
         irqfd->kvm = kvm;
-        irqfd->gsi = gsi;
+        irqfd->gsi = args->gsi;
         INIT_LIST_HEAD(&irqfd->list);
         INIT_WORK(&irqfd->inject, irqfd_inject);
         INIT_WORK(&irqfd->shutdown, irqfd_shutdown);
 
-        file = eventfd_fget(fd);
+        file = eventfd_fget(args->fd);
         if (IS_ERR(file)) {
                 ret = PTR_ERR(file);
                 goto fail;
@@ -298,19 +298,19 @@ kvm_eventfd_init(struct kvm *kvm)
  * shutdown any irqfd's that match fd+gsi
  */
 static int
-kvm_irqfd_deassign(struct kvm *kvm, int fd, int gsi)
+kvm_irqfd_deassign(struct kvm *kvm, struct kvm_irqfd *args)
 {
         struct _irqfd *irqfd, *tmp;
         struct eventfd_ctx *eventfd;
 
-        eventfd = eventfd_ctx_fdget(fd);
+        eventfd = eventfd_ctx_fdget(args->fd);
         if (IS_ERR(eventfd))
                 return PTR_ERR(eventfd);
 
         spin_lock_irq(&kvm->irqfds.lock);
 
         list_for_each_entry_safe(irqfd, tmp, &kvm->irqfds.items, list) {
-                if (irqfd->eventfd == eventfd && irqfd->gsi == gsi) {
+                if (irqfd->eventfd == eventfd && irqfd->gsi == args->gsi) {
                         /*
                          * This rcu_assign_pointer is needed for when
                          * another thread calls kvm_irq_routing_update before
@@ -338,12 +338,15 @@ kvm_irqfd_deassign(struct kvm *kvm, int fd, int gsi)
 }
 
 int
-kvm_irqfd(struct kvm *kvm, int fd, int gsi, int flags)
+kvm_irqfd(struct kvm *kvm, struct kvm_irqfd *args)
 {
-        if (flags & KVM_IRQFD_FLAG_DEASSIGN)
-                return kvm_irqfd_deassign(kvm, fd, gsi);
+        if (args->flags & ~KVM_IRQFD_FLAG_DEASSIGN)
+                return -EINVAL;
+
+        if (args->flags & KVM_IRQFD_FLAG_DEASSIGN)
+                return kvm_irqfd_deassign(kvm, args);
 
-        return kvm_irqfd_assign(kvm, fd, gsi);
+        return kvm_irqfd_assign(kvm, args);
 }
 
 /*
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 7e140683ff14..44ee7124b16d 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2047,7 +2047,7 @@ static long kvm_vm_ioctl(struct file *filp,
                 r = -EFAULT;
                 if (copy_from_user(&data, argp, sizeof data))
                         goto out;
-                r = kvm_irqfd(kvm, data.fd, data.gsi, data.flags);
+                r = kvm_irqfd(kvm, &data);
                 break;
         }
         case KVM_IOEVENTFD: {
@@ -2845,6 +2845,7 @@ void kvm_exit(void)
         kvm_arch_hardware_unsetup();
         kvm_arch_exit();
         free_cpumask_var(cpus_hardware_enabled);
+        __free_page(fault_page);
         __free_page(hwpoison_page);
         __free_page(bad_page);
 }