Defined in 1 files as a function:
Referenced in 7 files:
- arch/loongarch/kvm/main.c, line 256
- arch/powerpc/kvm/booke.c, line 614
- arch/s390/kvm/kvm-s390.c, line 4433
- arch/x86/kvm/svm/nested.c
- arch/x86/kvm/vmx/nested.c
- arch/x86/kvm/x86.c
- include/linux/kvm_host.h, line 2335
Smatch caller information:
arch/x86/kvm/mmu/mmu.c kvm_check_request() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 769,807 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| DATA_SOURCE | 0 | req | $0 |
| DATA_SOURCE | 1 | vcpu | $1 |
| NOSPEC | 1 | vcpu->arch.xen.runstate_cache.uhva | |
| HARD_MAX | 0 | req | 807 |
| NOCHECK_CALL | |||
| HOST_DATA | 1 | vcpu->arch.host_debugctl | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.apic->sipi_vector | 1-255[c] |
| USER_DATA | 1 | vcpu->arch.cr8 | 0-14[c] |
| USER_DATA | 1 | vcpu->arch.exception.payload | 0-u64max |
| USER_DATA | 1 | vcpu->arch.l1_tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.mmio_gfn | 0-4503599627370495[c] |
| USER_DATA | 1 | vcpu->arch.mmio_gva | 0,4096-u64max[c] |
| USER_DATA | 1 | vcpu->arch.tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->run->memory_fault.gpa | 0,4096-18446744073709547520[c] |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.size | |
| USER_PTR | 1 | vcpu->arch.emulate_ctxt->fetch.end | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.intercept_message | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved2 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved3 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved4 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.virtualization_fault_information | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.vtl_ret_actions | |
| HALF_LOCKED2 | 1 | &vcpu->kvm->srcu | |
| HALF_LOCKED2 | 1 | &vcpu->mutex |
arch/x86/kvm/vmx/nested.c free_nested() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 32 |
| DATA_SOURCE | 1 | vcpu | $0 |
| NOCHECK_CALL | |||
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.intercept_message | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved2 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved3 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved4 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.virtualization_fault_information | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.vtl_ret_actions |
arch/x86/kvm/vmx/nested.c kvm_check_request() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 32 |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| DATA_SOURCE | 0 | req | $0 |
| DATA_SOURCE | 1 | vcpu | $1 |
| NOSPEC | 1 | vcpu->arch.mmio_gfn | |
| NOCHECK_CALL | |||
| USER_DATA | 1 | vcpu->arch.exception.payload | 0-u64max |
| USER_DATA | 1 | vcpu->arch.l1_tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.mmio_gfn | 0-4503599627370495[c] |
| USER_DATA | 1 | vcpu->arch.mmio_gva | 0,4096-u64max[c] |
| USER_DATA | 1 | vcpu->arch.mmu->root.pgd | 0-u64max |
| USER_DATA | 1 | vcpu->arch.tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->run->memory_fault.gpa | 0,4096-18446744073709547520[c] |
| USER_DATA | 1 | *vcpu->arch.emulate_ctxt->fetch.end | 0-255 |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->kvm->arch.split_page_header_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->kvm->arch.split_shadow_page_cache.kmem_cache->sheaf_capacity | |
| USER_PTR | 1 | vcpu->arch.emulate_ctxt->fetch.end | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.intercept_message | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved2 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved3 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved4 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.virtualization_fault_information | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.vtl_ret_actions | |
| USER_PTR | 1 | vcpu->arch.pdptrs | |
| USER_PTR | 1 | vcpu->arch.walk_mmu->pdptrs | |
| HALF_LOCKED2 | 1 | &vcpu->kvm->srcu | |
| HALF_LOCKED2 | 1 | &vcpu->mutex |
arch/x86/kvm/vmx/nested.c nested_vmx_triple_fault() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 10 |
| DATA_SOURCE | 1 | vcpu | $0 |
| NOCHECK_CALL |
arch/x86/kvm/x86.c kvm_check_request() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 8-21,24,26-32,34,36-37,554,768-769,791,793,801,803,806-809 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| BUF_SIZE | 1 | vcpu->arch.mce_banks | (-1),8 |
| BUF_SIZE | 1 | vcpu->arch.mci_ctl2_banks | (-1),8 |
| CAPPED_DATA | 1 | vcpu | 1 |
| DATA_SOURCE | 0 | req | $0 |
| DATA_SOURCE | 1 | vcpu | $1 |
| NOSPEC | 1 | vcpu->arch.mmio_gfn | |
| NOSPEC | 1 | vcpu->arch.xen.runstate2_cache.pfn | |
| NOSPEC | 1 | vcpu->arch.xen.runstate_cache.pfn | |
| NOSPEC | 1 | vcpu->arch.xen.runstate_cache.uhva | |
| NOSPEC | 1 | vcpu->vcpu_id | |
| HARD_MAX | 0 | req | 809 |
| PREEMPT_ADD | |||
| NOCHECK_CALL | |||
| HOST_DATA | 1 | vcpu->arch.host_debugctl | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.apic->lapic_timer.expired_tscdeadline | 0-u64max |
| USER_DATA | 1 | vcpu->arch.apic->lapic_timer.tscdeadline | 0-u64max |
| USER_DATA | 1 | vcpu->arch.apic->sipi_vector | 0-u32max |
| USER_DATA | 1 | vcpu->arch.cr2 | 0-u64max |
| USER_DATA | 1 | vcpu->arch.cr8 | 0-14[c] |
| USER_DATA | 1 | vcpu->arch.dr6 | 0-u64max[c][u] |
| USER_DATA | 1 | vcpu->arch.exception.error_code | 0-u32max |
| USER_DATA | 1 | vcpu->arch.exception.has_error_code | 0-1 |
| USER_DATA | 1 | vcpu->arch.exception.has_payload | 0 |
| USER_DATA | 1 | vcpu->arch.exception.injected | 0-1 |
| USER_DATA | 1 | vcpu->arch.exception.payload | 0-u64max |
| USER_DATA | 1 | vcpu->arch.exception.pending | 0-1 |
| USER_DATA | 1 | vcpu->arch.exception.vector | 0-255 |
| USER_DATA | 1 | vcpu->arch.exception_from_userspace | 0-1 |
| USER_DATA | 1 | vcpu->arch.guest_supported_xcr0 | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.guest_supported_xss | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.enlightenments_eax | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.enlightenments_ebx | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.features_eax | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.features_ebx | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.features_edx | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.nested_eax | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.nested_ebx | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv->cpuid_cache.syndbg_cap_eax | 0-u32max |
| USER_DATA | 1 | vcpu->arch.hyperv_enabled | 0[c] |
| USER_DATA | 1 | vcpu->arch.interrupt.injected | 0-1 |
| USER_DATA | 1 | vcpu->arch.interrupt.nr | 0-255 |
| USER_DATA | 1 | vcpu->arch.interrupt.soft | 0-1 |
| USER_DATA | 1 | vcpu->arch.is_amd_compatible | 0[c] |
| USER_DATA | 1 | vcpu->arch.l1_tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.maxphyaddr | 1-255[c] |
| USER_DATA | 1 | vcpu->arch.mmio_gfn | 0-4503599627370495[c] |
| USER_DATA | 1 | vcpu->arch.mmio_gva | 0,4096-u64max[c] |
| USER_DATA | 1 | vcpu->arch.mmu->root.pgd | 0-u64max |
| USER_DATA | 1 | vcpu->arch.nmi_injected | 0-1 |
| USER_DATA | 1 | vcpu->arch.nmi_queued.counter | 0 |
| USER_DATA | 1 | vcpu->arch.pv_cpuid.features | 0-u32max |
| USER_DATA | 1 | vcpu->arch.pv_time.kvm->arch.has_private_mem | 0[c] |
| USER_DATA | 1 | vcpu->arch.pv_time.kvm->arch.pre_fault_allowed | 0-1 |
| USER_DATA | 1 | vcpu->arch.pv_time.kvm->arch.vm_type | 0-31 |
| USER_DATA | 1 | vcpu->arch.tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.virtual_tsc_khz | 1-u32max |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.kvm->arch.has_private_mem | 0[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.kvm->arch.pre_fault_allowed | 0-1 |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.kvm->arch.vm_type | 0-31 |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.kvm->arch.has_private_mem | 0[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.kvm->arch.pre_fault_allowed | 0-1 |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.kvm->arch.vm_type | 0-31 |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.xen.vcpu_info_cache.kvm->arch.has_private_mem | 0[c] |
| USER_DATA | 1 | vcpu->arch.xen.vcpu_info_cache.kvm->arch.pre_fault_allowed | 0-1 |
| USER_DATA | 1 | vcpu->arch.xen.vcpu_info_cache.kvm->arch.vm_type | 0-31 |
| USER_DATA | 1 | vcpu->arch.xen.vcpu_time_info_cache.kvm->arch.has_private_mem | 0[c] |
| USER_DATA | 1 | vcpu->arch.xen.vcpu_time_info_cache.kvm->arch.pre_fault_allowed | 0-1 |
| USER_DATA | 1 | vcpu->arch.xen.vcpu_time_info_cache.kvm->arch.vm_type | 0-31 |
| USER_DATA | 1 | vcpu->run->debug.arch.pc | 0-u64max |
| USER_DATA | 1 | vcpu->run->memory_fault.gpa | 0,4096-18446744073709547520[c] |
| USER_DATA | 1 | vcpu->run->s.regs.sregs.cr2 | 0-u64max |
| USER_DATA | 1 | vcpu->run->s.regs.sregs.cr8 | 0-15[c] |
| USER_DATA | 1 | vcpu->vcpu_id | 1-16383[c] |
| USER_DATA | 1 | *vcpu->arch.emulate_ctxt->fetch.end | 0-255 |
| USER_DATA | 1 | *vcpu->arch.sev_pio_data | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->kvm->arch.split_desc_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->kvm->arch.split_page_header_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->kvm->arch.split_shadow_page_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.size | |
| USER_PTR | 1 | vcpu->arch.emulate_ctxt->fetch.end | |
| USER_PTR | 1 | vcpu->arch.hyperv->sparse_banks | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.intercept_message | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved2 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved3 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved4 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.virtualization_fault_information | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.vtl_ret_actions | |
| USER_PTR | 1 | vcpu->arch.pdptrs | |
| USER_PTR | 1 | vcpu->arch.walk_mmu->pdptrs | |
| HALF_LOCKED2 | 1 | &vcpu->kvm->srcu | |
| HALF_LOCKED2 | 1 | &vcpu->mutex |
arch/x86/kvm/x86.c kvm_end_pvclock_update() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 790 |
| PARAM_VALUE | 1 | vcpu | 1-u64max |
| NOCHECK_CALL | |||
| LOCK2 | &kvm->arch.tsc_write_lock | ||
| HALF_LOCKED2 | &kvm->srcu | ||
| HALF_LOCKED2 | &vcpu->mutex | ||
| HALF_LOCKED2 | global &kvm_lock |
arch/x86/kvm/x86.c kvm_vcpu_flush_tlb_all() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 34 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| PARAM_VALUE | 1 | vcpu->requests | 1 |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| CAPPED_DATA | 1 | vcpu->kvm->mm | 1 |
| CAPPED_DATA | 1 | vcpu->kvm->srcu.srcu_ctrp | 1 |
| DATA_SOURCE | 1 | vcpu | $0 |
| NOCHECK_CALL | |||
| HOST_DATA | 1 | vcpu->arch.host_debugctl | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.apic->lapic_timer.expired_tscdeadline | 0-u64max |
| USER_DATA | 1 | vcpu->arch.apic->lapic_timer.tscdeadline | 0-u64max |
| USER_DATA | 1 | vcpu->arch.apic->sipi_vector | 1-255[c] |
| USER_DATA | 1 | vcpu->arch.cr8 | 0-14 |
| USER_DATA | 1 | vcpu->arch.exception.payload | 0-u64max |
| USER_DATA | 1 | vcpu->arch.l1_tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | *vcpu->arch.emulate_ctxt->fetch.end | 0-255 |
| USER_DATA | 1 | *vcpu->arch.sev_pio_data | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.size | |
| USER_PTR | 1 | vcpu->arch.emulate_ctxt->fetch.end | |
| USER_PTR | 1 | vcpu->arch.pdptrs | |
| LOCK2 | 1 | &vcpu->kvm->srcu | |
| LOCK2 | 1 | &vcpu->mutex | |
| TYPE_LOCK | (struct kvm)->srcu | ||
| TYPE_LOCK | (struct kvm_vcpu)->mutex |
arch/x86/kvm/x86.c kvm_vcpu_ioctl_x86_set_vcpu_events() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 10 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| CAPPED_DATA | 1 | vcpu | 1 |
| CAPPED_DATA | 1 | vcpu->kvm | 1 |
| CAPPED_DATA | 1 | vcpu->kvm->srcu.srcu_ctrp | 1 |
| DATA_SOURCE | 1 | vcpu | $0 |
| NOCHECK_CALL | |||
| USER_DATA | 1 | vcpu->arch.apic->sipi_vector | 0-u32max |
| USER_DATA | 1 | vcpu->arch.exception.error_code | 0-u32max |
| USER_DATA | 1 | vcpu->arch.exception.has_error_code | 0-1 |
| USER_DATA | 1 | vcpu->arch.exception.has_payload | 0 |
| USER_DATA | 1 | vcpu->arch.exception.injected | 0-1 |
| USER_DATA | 1 | vcpu->arch.exception.payload | 0-u64max |
| USER_DATA | 1 | vcpu->arch.exception.pending | 0-1 |
| USER_DATA | 1 | vcpu->arch.exception.vector | 0-255 |
| USER_DATA | 1 | vcpu->arch.exception_from_userspace | 0-1 |
| USER_DATA | 1 | vcpu->arch.interrupt.injected | 0-1 |
| USER_DATA | 1 | vcpu->arch.interrupt.nr | 0-255 |
| USER_DATA | 1 | vcpu->arch.interrupt.soft | 0-1 |
| USER_DATA | 1 | vcpu->arch.nmi_injected | 0-1 |
| USER_DATA | 1 | vcpu->arch.smi_pending | 0-1 |
| USER_PTR | 1 | vcpu->arch.pdptrs | |
| LOCK2 | 1 | &vcpu->kvm->srcu | |
| HALF_LOCKED2 | &vcpu->mutex | ||
| HALF_LOCKED2 | 1 | &vcpu->mutex | |
| TYPE_LOCK | (struct kvm)->srcu | ||
| TYPE_LOCK | (struct kvm_vcpu)->mutex |
arch/x86/kvm/x86.c vcpu_run() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 2 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| CAPPED_DATA | 1 | vcpu | 1 |
| DATA_SOURCE | 1 | vcpu | $0 |
| NOCHECK_CALL | |||
| USER_DATA | 1 | vcpu->arch.cr8 | 0-14 |
| USER_DATA | 1 | vcpu->arch.exception.payload | 0 |
| USER_DATA | 1 | *vcpu->arch.emulate_ctxt->fetch.end | 0-255 |
| USER_DATA | 1 | *vcpu->arch.sev_pio_data | s64min-s64max |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.size | |
| USER_PTR | 1 | vcpu->arch.emulate_ctxt->fetch.end | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.intercept_message | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved2 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved3 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved4 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.virtualization_fault_information | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.vtl_ret_actions | |
| USER_PTR | 1 | vcpu->arch.pdptrs | |
| LOCK2 | 1 | &vcpu->kvm->srcu | |
| LOCK2 | 1 | &vcpu->mutex | |
| TYPE_LOCK | (struct kvm)->srcu | ||
| TYPE_LOCK | (struct kvm_vcpu)->mutex |
arch/x86/kvm/../../../virt/kvm/dirty_ring.c kvm_check_request() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 3 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| PARAM_VALUE | 1 | vcpu->requests | 1 |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-2),1-s32max |
| CAPPED_DATA | 1 | vcpu->kvm | 1 |
| CAPPED_DATA | 1 | vcpu->kvm->mm | 1 |
| CAPPED_DATA | 1 | vcpu->kvm->srcu.srcu_ctrp | 1 |
| DATA_SOURCE | 0 | req | $0 |
| DATA_SOURCE | 1 | vcpu | $1 |
| NOSPEC | 1 | vcpu->arch.mmio_gfn | |
| NOCHECK_CALL | |||
| HOST_DATA | 1 | vcpu->arch.host_debugctl | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.cr8 | 0-14 |
| USER_DATA | 1 | vcpu->arch.exception.payload | 0-u64max |
| USER_DATA | 1 | vcpu->arch.l1_tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->arch.mmio_gfn | 0-4503599627370495[c] |
| USER_DATA | 1 | vcpu->arch.nmi_queued.counter | 0 |
| USER_DATA | 1 | vcpu->arch.tsc_offset | 0-u64max |
| USER_DATA | 1 | vcpu->run->memory_fault.gpa | 0,4096-18446744073709547520[c] |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.size | |
| USER_PTR | 1 | vcpu->arch.emulate_ctxt->fetch.end | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.intercept_message | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved2 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved3 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved4 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.virtualization_fault_information | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.vtl_ret_actions | |
| USER_PTR | 1 | vcpu->arch.pdptrs | |
| LOCK2 | 1 | &vcpu->kvm->srcu | |
| LOCK2 | 1 | &vcpu->mutex | |
| TYPE_LOCK | (struct kvm)->srcu | ||
| TYPE_LOCK | (struct kvm_vcpu)->mutex |
arch/x86/kvm/svm/svm.c kvm_check_request() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 808 |
| DATA_SOURCE | 0 | req | $0 |
| DATA_SOURCE | 1 | vcpu | $1 |
| NOCHECK_CALL |
arch/x86/kvm/vmx/tdx.c kvm_check_request() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 769 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| CAPPED_DATA | 1 | vcpu->arch.mmu | 1 |
| CAPPED_DATA | 1 | vcpu->async_pf.done.next | 1 |
| DATA_SOURCE | 0 | req | $0 |
| DATA_SOURCE | 1 | vcpu | $1 |
| NOCHECK_CALL | |||
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.kmem_cache->object_size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.kmem_cache->object_size |
arch/x86/kvm/../../../virt/kvm/kvm_main.c kvm_check_request() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 2 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| BUF_SIZE | 1 | vcpu | s32min-(-1),1-s32max |
| CAPPED_DATA | 1 | vcpu->async_pf.done.next | 1 |
| CAPPED_DATA | 1 | vcpu->kvm | 1 |
| CAPPED_DATA | 1 | vcpu->kvm->srcu.srcu_ctrp | 1 |
| DATA_SOURCE | 0 | req | $0 |
| DATA_SOURCE | 1 | vcpu | $1 |
| NOSPEC | 1 | vcpu->arch.mmio_gfn | |
| NOSPEC | 1 | vcpu->arch.xen.runstate_cache.uhva | |
| PREEMPT_ADD | |||
| NOCHECK_CALL | |||
| HOST_DATA | 1 | vcpu->arch.host_debugctl | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.cr8 | 0-14[c] |
| USER_DATA | 1 | vcpu->arch.exception.payload | 0-u64max |
| USER_DATA | 1 | vcpu->arch.mmio_gfn | 0-4503599627370495[c] |
| USER_DATA | 1 | vcpu->arch.mmio_gva | 0,4096-u64max[c] |
| USER_DATA | 1 | vcpu->arch.nmi_queued.counter | 0 |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate2_cache.uhva | 0-u64max[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.gpa | 0-18446744073709551614[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.pfn | 0-4503599627370494[c] |
| USER_DATA | 1 | vcpu->arch.xen.runstate_cache.uhva | 0-u64max[c] |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_external_spt_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_page_header_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_pte_list_desc_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.kmem_cache->sheaf_capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadow_page_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.capacity | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.mmu_shadowed_info_cache.nobjs | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->arch.pio.size | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.count | |
| NO_OVERFLOW_SIMPLE | 1 | vcpu->run->io.size | |
| USER_PTR | 1 | vcpu->arch.emulate_ctxt->fetch.end | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.intercept_message | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved2 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved3 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.reserved4 | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.virtualization_fault_information | |
| USER_PTR | 1 | vcpu->arch.hyperv->vp_assist_page.vtl_ret_actions | |
| USER_PTR | 1 | vcpu->arch.pdptrs | |
| LOCK2 | 1 | &vcpu->kvm->srcu | |
| HALF_LOCKED2 | 1 | &vcpu->mutex | |
| TYPE_LOCK | (struct kvm)->srcu |
arch/x86/kvm/svm/nested.c nested_svm_triple_fault() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 10 |
| DATA_SOURCE | 1 | vcpu | $0 |
| NOCHECK_CALL |
arch/x86/kvm/svm/nested.c nested_svm_vmexit() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 32 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| BUF_SIZE | 1 | vcpu | 7720 |
| NOCHECK_CALL |
arch/x86/kvm/svm/nested.c svm_leave_nested() -> kvm_clear_request()
| Type | Parameter | Key | Value |
|---|---|---|---|
| PARAM_VALUE | 0 | req | 32 |
| PARAM_VALUE | 1 | vcpu | 4096-ptr_max |
| BUF_SIZE | 1 | vcpu | (-1),7720 |
| BUF_SIZE | 1 | vcpu | (-1),7720 |
| DATA_SOURCE | 1 | vcpu | $0 |
| NOCHECK_CALL |