xref: /openbmc/linux/arch/x86/kvm/x86.c (revision b5f184fbdb03b4fcc1141de34dd5ec964ca5d99e)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Kernel-based Virtual Machine driver for Linux
4  *
5  * derived from drivers/kvm/kvm_main.c
6  *
7  * Copyright (C) 2006 Qumranet, Inc.
8  * Copyright (C) 2008 Qumranet, Inc.
9  * Copyright IBM Corporation, 2008
10  * Copyright 2010 Red Hat, Inc. and/or its affiliates.
11  *
12  * Authors:
13  *   Avi Kivity   <avi@qumranet.com>
14  *   Yaniv Kamay  <yaniv@qumranet.com>
15  *   Amit Shah    <amit.shah@qumranet.com>
16  *   Ben-Ami Yassour <benami@il.ibm.com>
17  */
18 
19 #include <linux/kvm_host.h>
20 #include "irq.h"
21 #include "ioapic.h"
22 #include "mmu.h"
23 #include "i8254.h"
24 #include "tss.h"
25 #include "kvm_cache_regs.h"
26 #include "kvm_emulate.h"
27 #include "x86.h"
28 #include "cpuid.h"
29 #include "pmu.h"
30 #include "hyperv.h"
31 #include "lapic.h"
32 #include "xen.h"
33 
34 #include <linux/clocksource.h>
35 #include <linux/interrupt.h>
36 #include <linux/kvm.h>
37 #include <linux/fs.h>
38 #include <linux/vmalloc.h>
39 #include <linux/export.h>
40 #include <linux/moduleparam.h>
41 #include <linux/mman.h>
42 #include <linux/highmem.h>
43 #include <linux/iommu.h>
44 #include <linux/intel-iommu.h>
45 #include <linux/cpufreq.h>
46 #include <linux/user-return-notifier.h>
47 #include <linux/srcu.h>
48 #include <linux/slab.h>
49 #include <linux/perf_event.h>
50 #include <linux/uaccess.h>
51 #include <linux/hash.h>
52 #include <linux/pci.h>
53 #include <linux/timekeeper_internal.h>
54 #include <linux/pvclock_gtod.h>
55 #include <linux/kvm_irqfd.h>
56 #include <linux/irqbypass.h>
57 #include <linux/sched/stat.h>
58 #include <linux/sched/isolation.h>
59 #include <linux/mem_encrypt.h>
60 #include <linux/entry-kvm.h>
61 
62 #include <trace/events/kvm.h>
63 
64 #include <asm/debugreg.h>
65 #include <asm/msr.h>
66 #include <asm/desc.h>
67 #include <asm/mce.h>
68 #include <linux/kernel_stat.h>
69 #include <asm/fpu/internal.h> /* Ugh! */
70 #include <asm/pvclock.h>
71 #include <asm/div64.h>
72 #include <asm/irq_remapping.h>
73 #include <asm/mshyperv.h>
74 #include <asm/hypervisor.h>
75 #include <asm/tlbflush.h>
76 #include <asm/intel_pt.h>
77 #include <asm/emulate_prefix.h>
78 #include <clocksource/hyperv_timer.h>
79 
80 #define CREATE_TRACE_POINTS
81 #include "trace.h"
82 
83 #define MAX_IO_MSRS 256
84 #define KVM_MAX_MCE_BANKS 32
85 u64 __read_mostly kvm_mce_cap_supported = MCG_CTL_P | MCG_SER_P;
86 EXPORT_SYMBOL_GPL(kvm_mce_cap_supported);
87 
88 #define emul_to_vcpu(ctxt) \
89 	((struct kvm_vcpu *)(ctxt)->vcpu)
90 
91 /* EFER defaults:
92  * - enable syscall per default because its emulated by KVM
93  * - enable LME and LMA per default on 64 bit KVM
94  */
95 #ifdef CONFIG_X86_64
96 static
97 u64 __read_mostly efer_reserved_bits = ~((u64)(EFER_SCE | EFER_LME | EFER_LMA));
98 #else
99 static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
100 #endif
101 
102 static u64 __read_mostly cr4_reserved_bits = CR4_RESERVED_BITS;
103 
104 #define KVM_X2APIC_API_VALID_FLAGS (KVM_X2APIC_API_USE_32BIT_IDS | \
105                                     KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK)
106 
107 static void update_cr8_intercept(struct kvm_vcpu *vcpu);
108 static void process_nmi(struct kvm_vcpu *vcpu);
109 static void process_smi(struct kvm_vcpu *vcpu);
110 static void enter_smm(struct kvm_vcpu *vcpu);
111 static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
112 static void store_regs(struct kvm_vcpu *vcpu);
113 static int sync_regs(struct kvm_vcpu *vcpu);
114 
115 struct kvm_x86_ops kvm_x86_ops __read_mostly;
116 EXPORT_SYMBOL_GPL(kvm_x86_ops);
117 
118 #define KVM_X86_OP(func)					     \
119 	DEFINE_STATIC_CALL_NULL(kvm_x86_##func,			     \
120 				*(((struct kvm_x86_ops *)0)->func));
121 #define KVM_X86_OP_NULL KVM_X86_OP
122 #include <asm/kvm-x86-ops.h>
123 EXPORT_STATIC_CALL_GPL(kvm_x86_get_cs_db_l_bits);
124 EXPORT_STATIC_CALL_GPL(kvm_x86_cache_reg);
125 EXPORT_STATIC_CALL_GPL(kvm_x86_tlb_flush_current);
126 
127 static bool __read_mostly ignore_msrs = 0;
128 module_param(ignore_msrs, bool, S_IRUGO | S_IWUSR);
129 
130 bool __read_mostly report_ignored_msrs = true;
131 module_param(report_ignored_msrs, bool, S_IRUGO | S_IWUSR);
132 EXPORT_SYMBOL_GPL(report_ignored_msrs);
133 
134 unsigned int min_timer_period_us = 200;
135 module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
136 
137 static bool __read_mostly kvmclock_periodic_sync = true;
138 module_param(kvmclock_periodic_sync, bool, S_IRUGO);
139 
140 bool __read_mostly kvm_has_tsc_control;
141 EXPORT_SYMBOL_GPL(kvm_has_tsc_control);
142 u32  __read_mostly kvm_max_guest_tsc_khz;
143 EXPORT_SYMBOL_GPL(kvm_max_guest_tsc_khz);
144 u8   __read_mostly kvm_tsc_scaling_ratio_frac_bits;
145 EXPORT_SYMBOL_GPL(kvm_tsc_scaling_ratio_frac_bits);
146 u64  __read_mostly kvm_max_tsc_scaling_ratio;
147 EXPORT_SYMBOL_GPL(kvm_max_tsc_scaling_ratio);
148 u64 __read_mostly kvm_default_tsc_scaling_ratio;
149 EXPORT_SYMBOL_GPL(kvm_default_tsc_scaling_ratio);
150 bool __read_mostly kvm_has_bus_lock_exit;
151 EXPORT_SYMBOL_GPL(kvm_has_bus_lock_exit);
152 
153 /* tsc tolerance in parts per million - default to 1/2 of the NTP threshold */
154 static u32 __read_mostly tsc_tolerance_ppm = 250;
155 module_param(tsc_tolerance_ppm, uint, S_IRUGO | S_IWUSR);
156 
157 /*
158  * lapic timer advance (tscdeadline mode only) in nanoseconds.  '-1' enables
159  * adaptive tuning starting from default advancment of 1000ns.  '0' disables
160  * advancement entirely.  Any other value is used as-is and disables adaptive
161  * tuning, i.e. allows priveleged userspace to set an exact advancement time.
162  */
163 static int __read_mostly lapic_timer_advance_ns = -1;
164 module_param(lapic_timer_advance_ns, int, S_IRUGO | S_IWUSR);
165 
166 static bool __read_mostly vector_hashing = true;
167 module_param(vector_hashing, bool, S_IRUGO);
168 
169 bool __read_mostly enable_vmware_backdoor = false;
170 module_param(enable_vmware_backdoor, bool, S_IRUGO);
171 EXPORT_SYMBOL_GPL(enable_vmware_backdoor);
172 
173 static bool __read_mostly force_emulation_prefix = false;
174 module_param(force_emulation_prefix, bool, S_IRUGO);
175 
176 int __read_mostly pi_inject_timer = -1;
177 module_param(pi_inject_timer, bint, S_IRUGO | S_IWUSR);
178 
179 /*
180  * Restoring the host value for MSRs that are only consumed when running in
181  * usermode, e.g. SYSCALL MSRs and TSC_AUX, can be deferred until the CPU
182  * returns to userspace, i.e. the kernel can run with the guest's value.
183  */
184 #define KVM_MAX_NR_USER_RETURN_MSRS 16
185 
186 struct kvm_user_return_msrs_global {
187 	int nr;
188 	u32 msrs[KVM_MAX_NR_USER_RETURN_MSRS];
189 };
190 
191 struct kvm_user_return_msrs {
192 	struct user_return_notifier urn;
193 	bool registered;
194 	struct kvm_user_return_msr_values {
195 		u64 host;
196 		u64 curr;
197 	} values[KVM_MAX_NR_USER_RETURN_MSRS];
198 };
199 
200 static struct kvm_user_return_msrs_global __read_mostly user_return_msrs_global;
201 static struct kvm_user_return_msrs __percpu *user_return_msrs;
202 
203 #define KVM_SUPPORTED_XCR0     (XFEATURE_MASK_FP | XFEATURE_MASK_SSE \
204 				| XFEATURE_MASK_YMM | XFEATURE_MASK_BNDREGS \
205 				| XFEATURE_MASK_BNDCSR | XFEATURE_MASK_AVX512 \
206 				| XFEATURE_MASK_PKRU)
207 
208 u64 __read_mostly host_efer;
209 EXPORT_SYMBOL_GPL(host_efer);
210 
211 bool __read_mostly allow_smaller_maxphyaddr = 0;
212 EXPORT_SYMBOL_GPL(allow_smaller_maxphyaddr);
213 
214 u64 __read_mostly host_xss;
215 EXPORT_SYMBOL_GPL(host_xss);
216 u64 __read_mostly supported_xss;
217 EXPORT_SYMBOL_GPL(supported_xss);
218 
219 struct kvm_stats_debugfs_item debugfs_entries[] = {
220 	VCPU_STAT("pf_fixed", pf_fixed),
221 	VCPU_STAT("pf_guest", pf_guest),
222 	VCPU_STAT("tlb_flush", tlb_flush),
223 	VCPU_STAT("invlpg", invlpg),
224 	VCPU_STAT("exits", exits),
225 	VCPU_STAT("io_exits", io_exits),
226 	VCPU_STAT("mmio_exits", mmio_exits),
227 	VCPU_STAT("signal_exits", signal_exits),
228 	VCPU_STAT("irq_window", irq_window_exits),
229 	VCPU_STAT("nmi_window", nmi_window_exits),
230 	VCPU_STAT("halt_exits", halt_exits),
231 	VCPU_STAT("halt_successful_poll", halt_successful_poll),
232 	VCPU_STAT("halt_attempted_poll", halt_attempted_poll),
233 	VCPU_STAT("halt_poll_invalid", halt_poll_invalid),
234 	VCPU_STAT("halt_wakeup", halt_wakeup),
235 	VCPU_STAT("hypercalls", hypercalls),
236 	VCPU_STAT("request_irq", request_irq_exits),
237 	VCPU_STAT("irq_exits", irq_exits),
238 	VCPU_STAT("host_state_reload", host_state_reload),
239 	VCPU_STAT("fpu_reload", fpu_reload),
240 	VCPU_STAT("insn_emulation", insn_emulation),
241 	VCPU_STAT("insn_emulation_fail", insn_emulation_fail),
242 	VCPU_STAT("irq_injections", irq_injections),
243 	VCPU_STAT("nmi_injections", nmi_injections),
244 	VCPU_STAT("req_event", req_event),
245 	VCPU_STAT("l1d_flush", l1d_flush),
246 	VCPU_STAT("halt_poll_success_ns", halt_poll_success_ns),
247 	VCPU_STAT("halt_poll_fail_ns", halt_poll_fail_ns),
248 	VM_STAT("mmu_shadow_zapped", mmu_shadow_zapped),
249 	VM_STAT("mmu_pte_write", mmu_pte_write),
250 	VM_STAT("mmu_pde_zapped", mmu_pde_zapped),
251 	VM_STAT("mmu_flooded", mmu_flooded),
252 	VM_STAT("mmu_recycled", mmu_recycled),
253 	VM_STAT("mmu_cache_miss", mmu_cache_miss),
254 	VM_STAT("mmu_unsync", mmu_unsync),
255 	VM_STAT("remote_tlb_flush", remote_tlb_flush),
256 	VM_STAT("largepages", lpages, .mode = 0444),
257 	VM_STAT("nx_largepages_splitted", nx_lpage_splits, .mode = 0444),
258 	VM_STAT("max_mmu_page_hash_collisions", max_mmu_page_hash_collisions),
259 	{ NULL }
260 };
261 
262 u64 __read_mostly host_xcr0;
263 u64 __read_mostly supported_xcr0;
264 EXPORT_SYMBOL_GPL(supported_xcr0);
265 
266 static struct kmem_cache *x86_fpu_cache;
267 
268 static struct kmem_cache *x86_emulator_cache;
269 
270 /*
271  * When called, it means the previous get/set msr reached an invalid msr.
272  * Return true if we want to ignore/silent this failed msr access.
273  */
274 static bool kvm_msr_ignored_check(struct kvm_vcpu *vcpu, u32 msr,
275 				  u64 data, bool write)
276 {
277 	const char *op = write ? "wrmsr" : "rdmsr";
278 
279 	if (ignore_msrs) {
280 		if (report_ignored_msrs)
281 			kvm_pr_unimpl("ignored %s: 0x%x data 0x%llx\n",
282 				      op, msr, data);
283 		/* Mask the error */
284 		return true;
285 	} else {
286 		kvm_debug_ratelimited("unhandled %s: 0x%x data 0x%llx\n",
287 				      op, msr, data);
288 		return false;
289 	}
290 }
291 
292 static struct kmem_cache *kvm_alloc_emulator_cache(void)
293 {
294 	unsigned int useroffset = offsetof(struct x86_emulate_ctxt, src);
295 	unsigned int size = sizeof(struct x86_emulate_ctxt);
296 
297 	return kmem_cache_create_usercopy("x86_emulator", size,
298 					  __alignof__(struct x86_emulate_ctxt),
299 					  SLAB_ACCOUNT, useroffset,
300 					  size - useroffset, NULL);
301 }
302 
303 static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt);
304 
305 static inline void kvm_async_pf_hash_reset(struct kvm_vcpu *vcpu)
306 {
307 	int i;
308 	for (i = 0; i < ASYNC_PF_PER_VCPU; i++)
309 		vcpu->arch.apf.gfns[i] = ~0;
310 }
311 
312 static void kvm_on_user_return(struct user_return_notifier *urn)
313 {
314 	unsigned slot;
315 	struct kvm_user_return_msrs *msrs
316 		= container_of(urn, struct kvm_user_return_msrs, urn);
317 	struct kvm_user_return_msr_values *values;
318 	unsigned long flags;
319 
320 	/*
321 	 * Disabling irqs at this point since the following code could be
322 	 * interrupted and executed through kvm_arch_hardware_disable()
323 	 */
324 	local_irq_save(flags);
325 	if (msrs->registered) {
326 		msrs->registered = false;
327 		user_return_notifier_unregister(urn);
328 	}
329 	local_irq_restore(flags);
330 	for (slot = 0; slot < user_return_msrs_global.nr; ++slot) {
331 		values = &msrs->values[slot];
332 		if (values->host != values->curr) {
333 			wrmsrl(user_return_msrs_global.msrs[slot], values->host);
334 			values->curr = values->host;
335 		}
336 	}
337 }
338 
339 void kvm_define_user_return_msr(unsigned slot, u32 msr)
340 {
341 	BUG_ON(slot >= KVM_MAX_NR_USER_RETURN_MSRS);
342 	user_return_msrs_global.msrs[slot] = msr;
343 	if (slot >= user_return_msrs_global.nr)
344 		user_return_msrs_global.nr = slot + 1;
345 }
346 EXPORT_SYMBOL_GPL(kvm_define_user_return_msr);
347 
348 static void kvm_user_return_msr_cpu_online(void)
349 {
350 	unsigned int cpu = smp_processor_id();
351 	struct kvm_user_return_msrs *msrs = per_cpu_ptr(user_return_msrs, cpu);
352 	u64 value;
353 	int i;
354 
355 	for (i = 0; i < user_return_msrs_global.nr; ++i) {
356 		rdmsrl_safe(user_return_msrs_global.msrs[i], &value);
357 		msrs->values[i].host = value;
358 		msrs->values[i].curr = value;
359 	}
360 }
361 
362 int kvm_set_user_return_msr(unsigned slot, u64 value, u64 mask)
363 {
364 	unsigned int cpu = smp_processor_id();
365 	struct kvm_user_return_msrs *msrs = per_cpu_ptr(user_return_msrs, cpu);
366 	int err;
367 
368 	value = (value & mask) | (msrs->values[slot].host & ~mask);
369 	if (value == msrs->values[slot].curr)
370 		return 0;
371 	err = wrmsrl_safe(user_return_msrs_global.msrs[slot], value);
372 	if (err)
373 		return 1;
374 
375 	msrs->values[slot].curr = value;
376 	if (!msrs->registered) {
377 		msrs->urn.on_user_return = kvm_on_user_return;
378 		user_return_notifier_register(&msrs->urn);
379 		msrs->registered = true;
380 	}
381 	return 0;
382 }
383 EXPORT_SYMBOL_GPL(kvm_set_user_return_msr);
384 
385 static void drop_user_return_notifiers(void)
386 {
387 	unsigned int cpu = smp_processor_id();
388 	struct kvm_user_return_msrs *msrs = per_cpu_ptr(user_return_msrs, cpu);
389 
390 	if (msrs->registered)
391 		kvm_on_user_return(&msrs->urn);
392 }
393 
394 u64 kvm_get_apic_base(struct kvm_vcpu *vcpu)
395 {
396 	return vcpu->arch.apic_base;
397 }
398 EXPORT_SYMBOL_GPL(kvm_get_apic_base);
399 
400 enum lapic_mode kvm_get_apic_mode(struct kvm_vcpu *vcpu)
401 {
402 	return kvm_apic_mode(kvm_get_apic_base(vcpu));
403 }
404 EXPORT_SYMBOL_GPL(kvm_get_apic_mode);
405 
406 int kvm_set_apic_base(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
407 {
408 	enum lapic_mode old_mode = kvm_get_apic_mode(vcpu);
409 	enum lapic_mode new_mode = kvm_apic_mode(msr_info->data);
410 	u64 reserved_bits = kvm_vcpu_reserved_gpa_bits_raw(vcpu) | 0x2ff |
411 		(guest_cpuid_has(vcpu, X86_FEATURE_X2APIC) ? 0 : X2APIC_ENABLE);
412 
413 	if ((msr_info->data & reserved_bits) != 0 || new_mode == LAPIC_MODE_INVALID)
414 		return 1;
415 	if (!msr_info->host_initiated) {
416 		if (old_mode == LAPIC_MODE_X2APIC && new_mode == LAPIC_MODE_XAPIC)
417 			return 1;
418 		if (old_mode == LAPIC_MODE_DISABLED && new_mode == LAPIC_MODE_X2APIC)
419 			return 1;
420 	}
421 
422 	kvm_lapic_set_base(vcpu, msr_info->data);
423 	kvm_recalculate_apic_map(vcpu->kvm);
424 	return 0;
425 }
426 EXPORT_SYMBOL_GPL(kvm_set_apic_base);
427 
428 asmlinkage __visible noinstr void kvm_spurious_fault(void)
429 {
430 	/* Fault while not rebooting.  We want the trace. */
431 	BUG_ON(!kvm_rebooting);
432 }
433 EXPORT_SYMBOL_GPL(kvm_spurious_fault);
434 
435 #define EXCPT_BENIGN		0
436 #define EXCPT_CONTRIBUTORY	1
437 #define EXCPT_PF		2
438 
439 static int exception_class(int vector)
440 {
441 	switch (vector) {
442 	case PF_VECTOR:
443 		return EXCPT_PF;
444 	case DE_VECTOR:
445 	case TS_VECTOR:
446 	case NP_VECTOR:
447 	case SS_VECTOR:
448 	case GP_VECTOR:
449 		return EXCPT_CONTRIBUTORY;
450 	default:
451 		break;
452 	}
453 	return EXCPT_BENIGN;
454 }
455 
456 #define EXCPT_FAULT		0
457 #define EXCPT_TRAP		1
458 #define EXCPT_ABORT		2
459 #define EXCPT_INTERRUPT		3
460 
461 static int exception_type(int vector)
462 {
463 	unsigned int mask;
464 
465 	if (WARN_ON(vector > 31 || vector == NMI_VECTOR))
466 		return EXCPT_INTERRUPT;
467 
468 	mask = 1 << vector;
469 
470 	/* #DB is trap, as instruction watchpoints are handled elsewhere */
471 	if (mask & ((1 << DB_VECTOR) | (1 << BP_VECTOR) | (1 << OF_VECTOR)))
472 		return EXCPT_TRAP;
473 
474 	if (mask & ((1 << DF_VECTOR) | (1 << MC_VECTOR)))
475 		return EXCPT_ABORT;
476 
477 	/* Reserved exceptions will result in fault */
478 	return EXCPT_FAULT;
479 }
480 
481 void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu)
482 {
483 	unsigned nr = vcpu->arch.exception.nr;
484 	bool has_payload = vcpu->arch.exception.has_payload;
485 	unsigned long payload = vcpu->arch.exception.payload;
486 
487 	if (!has_payload)
488 		return;
489 
490 	switch (nr) {
491 	case DB_VECTOR:
492 		/*
493 		 * "Certain debug exceptions may clear bit 0-3.  The
494 		 * remaining contents of the DR6 register are never
495 		 * cleared by the processor".
496 		 */
497 		vcpu->arch.dr6 &= ~DR_TRAP_BITS;
498 		/*
499 		 * In order to reflect the #DB exception payload in guest
500 		 * dr6, three components need to be considered: active low
501 		 * bit, FIXED_1 bits and active high bits (e.g. DR6_BD,
502 		 * DR6_BS and DR6_BT)
503 		 * DR6_ACTIVE_LOW contains the FIXED_1 and active low bits.
504 		 * In the target guest dr6:
505 		 * FIXED_1 bits should always be set.
506 		 * Active low bits should be cleared if 1-setting in payload.
507 		 * Active high bits should be set if 1-setting in payload.
508 		 *
509 		 * Note, the payload is compatible with the pending debug
510 		 * exceptions/exit qualification under VMX, that active_low bits
511 		 * are active high in payload.
512 		 * So they need to be flipped for DR6.
513 		 */
514 		vcpu->arch.dr6 |= DR6_ACTIVE_LOW;
515 		vcpu->arch.dr6 |= payload;
516 		vcpu->arch.dr6 ^= payload & DR6_ACTIVE_LOW;
517 
518 		/*
519 		 * The #DB payload is defined as compatible with the 'pending
520 		 * debug exceptions' field under VMX, not DR6. While bit 12 is
521 		 * defined in the 'pending debug exceptions' field (enabled
522 		 * breakpoint), it is reserved and must be zero in DR6.
523 		 */
524 		vcpu->arch.dr6 &= ~BIT(12);
525 		break;
526 	case PF_VECTOR:
527 		vcpu->arch.cr2 = payload;
528 		break;
529 	}
530 
531 	vcpu->arch.exception.has_payload = false;
532 	vcpu->arch.exception.payload = 0;
533 }
534 EXPORT_SYMBOL_GPL(kvm_deliver_exception_payload);
535 
536 static void kvm_multiple_exception(struct kvm_vcpu *vcpu,
537 		unsigned nr, bool has_error, u32 error_code,
538 	        bool has_payload, unsigned long payload, bool reinject)
539 {
540 	u32 prev_nr;
541 	int class1, class2;
542 
543 	kvm_make_request(KVM_REQ_EVENT, vcpu);
544 
545 	if (!vcpu->arch.exception.pending && !vcpu->arch.exception.injected) {
546 	queue:
547 		if (has_error && !is_protmode(vcpu))
548 			has_error = false;
549 		if (reinject) {
550 			/*
551 			 * On vmentry, vcpu->arch.exception.pending is only
552 			 * true if an event injection was blocked by
553 			 * nested_run_pending.  In that case, however,
554 			 * vcpu_enter_guest requests an immediate exit,
555 			 * and the guest shouldn't proceed far enough to
556 			 * need reinjection.
557 			 */
558 			WARN_ON_ONCE(vcpu->arch.exception.pending);
559 			vcpu->arch.exception.injected = true;
560 			if (WARN_ON_ONCE(has_payload)) {
561 				/*
562 				 * A reinjected event has already
563 				 * delivered its payload.
564 				 */
565 				has_payload = false;
566 				payload = 0;
567 			}
568 		} else {
569 			vcpu->arch.exception.pending = true;
570 			vcpu->arch.exception.injected = false;
571 		}
572 		vcpu->arch.exception.has_error_code = has_error;
573 		vcpu->arch.exception.nr = nr;
574 		vcpu->arch.exception.error_code = error_code;
575 		vcpu->arch.exception.has_payload = has_payload;
576 		vcpu->arch.exception.payload = payload;
577 		if (!is_guest_mode(vcpu))
578 			kvm_deliver_exception_payload(vcpu);
579 		return;
580 	}
581 
582 	/* to check exception */
583 	prev_nr = vcpu->arch.exception.nr;
584 	if (prev_nr == DF_VECTOR) {
585 		/* triple fault -> shutdown */
586 		kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
587 		return;
588 	}
589 	class1 = exception_class(prev_nr);
590 	class2 = exception_class(nr);
591 	if ((class1 == EXCPT_CONTRIBUTORY && class2 == EXCPT_CONTRIBUTORY)
592 		|| (class1 == EXCPT_PF && class2 != EXCPT_BENIGN)) {
593 		/*
594 		 * Generate double fault per SDM Table 5-5.  Set
595 		 * exception.pending = true so that the double fault
596 		 * can trigger a nested vmexit.
597 		 */
598 		vcpu->arch.exception.pending = true;
599 		vcpu->arch.exception.injected = false;
600 		vcpu->arch.exception.has_error_code = true;
601 		vcpu->arch.exception.nr = DF_VECTOR;
602 		vcpu->arch.exception.error_code = 0;
603 		vcpu->arch.exception.has_payload = false;
604 		vcpu->arch.exception.payload = 0;
605 	} else
606 		/* replace previous exception with a new one in a hope
607 		   that instruction re-execution will regenerate lost
608 		   exception */
609 		goto queue;
610 }
611 
612 void kvm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr)
613 {
614 	kvm_multiple_exception(vcpu, nr, false, 0, false, 0, false);
615 }
616 EXPORT_SYMBOL_GPL(kvm_queue_exception);
617 
618 void kvm_requeue_exception(struct kvm_vcpu *vcpu, unsigned nr)
619 {
620 	kvm_multiple_exception(vcpu, nr, false, 0, false, 0, true);
621 }
622 EXPORT_SYMBOL_GPL(kvm_requeue_exception);
623 
624 void kvm_queue_exception_p(struct kvm_vcpu *vcpu, unsigned nr,
625 			   unsigned long payload)
626 {
627 	kvm_multiple_exception(vcpu, nr, false, 0, true, payload, false);
628 }
629 EXPORT_SYMBOL_GPL(kvm_queue_exception_p);
630 
631 static void kvm_queue_exception_e_p(struct kvm_vcpu *vcpu, unsigned nr,
632 				    u32 error_code, unsigned long payload)
633 {
634 	kvm_multiple_exception(vcpu, nr, true, error_code,
635 			       true, payload, false);
636 }
637 
638 int kvm_complete_insn_gp(struct kvm_vcpu *vcpu, int err)
639 {
640 	if (err)
641 		kvm_inject_gp(vcpu, 0);
642 	else
643 		return kvm_skip_emulated_instruction(vcpu);
644 
645 	return 1;
646 }
647 EXPORT_SYMBOL_GPL(kvm_complete_insn_gp);
648 
649 void kvm_inject_page_fault(struct kvm_vcpu *vcpu, struct x86_exception *fault)
650 {
651 	++vcpu->stat.pf_guest;
652 	vcpu->arch.exception.nested_apf =
653 		is_guest_mode(vcpu) && fault->async_page_fault;
654 	if (vcpu->arch.exception.nested_apf) {
655 		vcpu->arch.apf.nested_apf_token = fault->address;
656 		kvm_queue_exception_e(vcpu, PF_VECTOR, fault->error_code);
657 	} else {
658 		kvm_queue_exception_e_p(vcpu, PF_VECTOR, fault->error_code,
659 					fault->address);
660 	}
661 }
662 EXPORT_SYMBOL_GPL(kvm_inject_page_fault);
663 
664 bool kvm_inject_emulated_page_fault(struct kvm_vcpu *vcpu,
665 				    struct x86_exception *fault)
666 {
667 	struct kvm_mmu *fault_mmu;
668 	WARN_ON_ONCE(fault->vector != PF_VECTOR);
669 
670 	fault_mmu = fault->nested_page_fault ? vcpu->arch.mmu :
671 					       vcpu->arch.walk_mmu;
672 
673 	/*
674 	 * Invalidate the TLB entry for the faulting address, if it exists,
675 	 * else the access will fault indefinitely (and to emulate hardware).
676 	 */
677 	if ((fault->error_code & PFERR_PRESENT_MASK) &&
678 	    !(fault->error_code & PFERR_RSVD_MASK))
679 		kvm_mmu_invalidate_gva(vcpu, fault_mmu, fault->address,
680 				       fault_mmu->root_hpa);
681 
682 	fault_mmu->inject_page_fault(vcpu, fault);
683 	return fault->nested_page_fault;
684 }
685 EXPORT_SYMBOL_GPL(kvm_inject_emulated_page_fault);
686 
687 void kvm_inject_nmi(struct kvm_vcpu *vcpu)
688 {
689 	atomic_inc(&vcpu->arch.nmi_queued);
690 	kvm_make_request(KVM_REQ_NMI, vcpu);
691 }
692 EXPORT_SYMBOL_GPL(kvm_inject_nmi);
693 
694 void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code)
695 {
696 	kvm_multiple_exception(vcpu, nr, true, error_code, false, 0, false);
697 }
698 EXPORT_SYMBOL_GPL(kvm_queue_exception_e);
699 
700 void kvm_requeue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code)
701 {
702 	kvm_multiple_exception(vcpu, nr, true, error_code, false, 0, true);
703 }
704 EXPORT_SYMBOL_GPL(kvm_requeue_exception_e);
705 
706 /*
707  * Checks if cpl <= required_cpl; if true, return true.  Otherwise queue
708  * a #GP and return false.
709  */
710 bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl)
711 {
712 	if (static_call(kvm_x86_get_cpl)(vcpu) <= required_cpl)
713 		return true;
714 	kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
715 	return false;
716 }
717 EXPORT_SYMBOL_GPL(kvm_require_cpl);
718 
719 bool kvm_require_dr(struct kvm_vcpu *vcpu, int dr)
720 {
721 	if ((dr != 4 && dr != 5) || !kvm_read_cr4_bits(vcpu, X86_CR4_DE))
722 		return true;
723 
724 	kvm_queue_exception(vcpu, UD_VECTOR);
725 	return false;
726 }
727 EXPORT_SYMBOL_GPL(kvm_require_dr);
728 
729 /*
730  * This function will be used to read from the physical memory of the currently
731  * running guest. The difference to kvm_vcpu_read_guest_page is that this function
732  * can read from guest physical or from the guest's guest physical memory.
733  */
734 int kvm_read_guest_page_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
735 			    gfn_t ngfn, void *data, int offset, int len,
736 			    u32 access)
737 {
738 	struct x86_exception exception;
739 	gfn_t real_gfn;
740 	gpa_t ngpa;
741 
742 	ngpa     = gfn_to_gpa(ngfn);
743 	real_gfn = mmu->translate_gpa(vcpu, ngpa, access, &exception);
744 	if (real_gfn == UNMAPPED_GVA)
745 		return -EFAULT;
746 
747 	real_gfn = gpa_to_gfn(real_gfn);
748 
749 	return kvm_vcpu_read_guest_page(vcpu, real_gfn, data, offset, len);
750 }
751 EXPORT_SYMBOL_GPL(kvm_read_guest_page_mmu);
752 
753 static int kvm_read_nested_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn,
754 			       void *data, int offset, int len, u32 access)
755 {
756 	return kvm_read_guest_page_mmu(vcpu, vcpu->arch.walk_mmu, gfn,
757 				       data, offset, len, access);
758 }
759 
760 static inline u64 pdptr_rsvd_bits(struct kvm_vcpu *vcpu)
761 {
762 	return vcpu->arch.reserved_gpa_bits | rsvd_bits(5, 8) | rsvd_bits(1, 2);
763 }
764 
765 /*
766  * Load the pae pdptrs.  Return 1 if they are all valid, 0 otherwise.
767  */
768 int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3)
769 {
770 	gfn_t pdpt_gfn = cr3 >> PAGE_SHIFT;
771 	unsigned offset = ((cr3 & (PAGE_SIZE-1)) >> 5) << 2;
772 	int i;
773 	int ret;
774 	u64 pdpte[ARRAY_SIZE(mmu->pdptrs)];
775 
776 	ret = kvm_read_guest_page_mmu(vcpu, mmu, pdpt_gfn, pdpte,
777 				      offset * sizeof(u64), sizeof(pdpte),
778 				      PFERR_USER_MASK|PFERR_WRITE_MASK);
779 	if (ret < 0) {
780 		ret = 0;
781 		goto out;
782 	}
783 	for (i = 0; i < ARRAY_SIZE(pdpte); ++i) {
784 		if ((pdpte[i] & PT_PRESENT_MASK) &&
785 		    (pdpte[i] & pdptr_rsvd_bits(vcpu))) {
786 			ret = 0;
787 			goto out;
788 		}
789 	}
790 	ret = 1;
791 
792 	memcpy(mmu->pdptrs, pdpte, sizeof(mmu->pdptrs));
793 	kvm_register_mark_dirty(vcpu, VCPU_EXREG_PDPTR);
794 
795 out:
796 
797 	return ret;
798 }
799 EXPORT_SYMBOL_GPL(load_pdptrs);
800 
801 bool pdptrs_changed(struct kvm_vcpu *vcpu)
802 {
803 	u64 pdpte[ARRAY_SIZE(vcpu->arch.walk_mmu->pdptrs)];
804 	int offset;
805 	gfn_t gfn;
806 	int r;
807 
808 	if (!is_pae_paging(vcpu))
809 		return false;
810 
811 	if (!kvm_register_is_available(vcpu, VCPU_EXREG_PDPTR))
812 		return true;
813 
814 	gfn = (kvm_read_cr3(vcpu) & 0xffffffe0ul) >> PAGE_SHIFT;
815 	offset = (kvm_read_cr3(vcpu) & 0xffffffe0ul) & (PAGE_SIZE - 1);
816 	r = kvm_read_nested_guest_page(vcpu, gfn, pdpte, offset, sizeof(pdpte),
817 				       PFERR_USER_MASK | PFERR_WRITE_MASK);
818 	if (r < 0)
819 		return true;
820 
821 	return memcmp(pdpte, vcpu->arch.walk_mmu->pdptrs, sizeof(pdpte)) != 0;
822 }
823 EXPORT_SYMBOL_GPL(pdptrs_changed);
824 
825 void kvm_post_set_cr0(struct kvm_vcpu *vcpu, unsigned long old_cr0, unsigned long cr0)
826 {
827 	unsigned long update_bits = X86_CR0_PG | X86_CR0_WP;
828 
829 	if ((cr0 ^ old_cr0) & X86_CR0_PG) {
830 		kvm_clear_async_pf_completion_queue(vcpu);
831 		kvm_async_pf_hash_reset(vcpu);
832 	}
833 
834 	if ((cr0 ^ old_cr0) & update_bits)
835 		kvm_mmu_reset_context(vcpu);
836 
837 	if (((cr0 ^ old_cr0) & X86_CR0_CD) &&
838 	    kvm_arch_has_noncoherent_dma(vcpu->kvm) &&
839 	    !kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
840 		kvm_zap_gfn_range(vcpu->kvm, 0, ~0ULL);
841 }
842 EXPORT_SYMBOL_GPL(kvm_post_set_cr0);
843 
844 int kvm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
845 {
846 	unsigned long old_cr0 = kvm_read_cr0(vcpu);
847 	unsigned long pdptr_bits = X86_CR0_CD | X86_CR0_NW | X86_CR0_PG;
848 
849 	cr0 |= X86_CR0_ET;
850 
851 #ifdef CONFIG_X86_64
852 	if (cr0 & 0xffffffff00000000UL)
853 		return 1;
854 #endif
855 
856 	cr0 &= ~CR0_RESERVED_BITS;
857 
858 	if ((cr0 & X86_CR0_NW) && !(cr0 & X86_CR0_CD))
859 		return 1;
860 
861 	if ((cr0 & X86_CR0_PG) && !(cr0 & X86_CR0_PE))
862 		return 1;
863 
864 #ifdef CONFIG_X86_64
865 	if ((vcpu->arch.efer & EFER_LME) && !is_paging(vcpu) &&
866 	    (cr0 & X86_CR0_PG)) {
867 		int cs_db, cs_l;
868 
869 		if (!is_pae(vcpu))
870 			return 1;
871 		static_call(kvm_x86_get_cs_db_l_bits)(vcpu, &cs_db, &cs_l);
872 		if (cs_l)
873 			return 1;
874 	}
875 #endif
876 	if (!(vcpu->arch.efer & EFER_LME) && (cr0 & X86_CR0_PG) &&
877 	    is_pae(vcpu) && ((cr0 ^ old_cr0) & pdptr_bits) &&
878 	    !load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu)))
879 		return 1;
880 
881 	if (!(cr0 & X86_CR0_PG) && kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE))
882 		return 1;
883 
884 	static_call(kvm_x86_set_cr0)(vcpu, cr0);
885 
886 	kvm_post_set_cr0(vcpu, old_cr0, cr0);
887 
888 	return 0;
889 }
890 EXPORT_SYMBOL_GPL(kvm_set_cr0);
891 
892 void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw)
893 {
894 	(void)kvm_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~0x0eul) | (msw & 0x0f));
895 }
896 EXPORT_SYMBOL_GPL(kvm_lmsw);
897 
898 void kvm_load_guest_xsave_state(struct kvm_vcpu *vcpu)
899 {
900 	if (vcpu->arch.guest_state_protected)
901 		return;
902 
903 	if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) {
904 
905 		if (vcpu->arch.xcr0 != host_xcr0)
906 			xsetbv(XCR_XFEATURE_ENABLED_MASK, vcpu->arch.xcr0);
907 
908 		if (vcpu->arch.xsaves_enabled &&
909 		    vcpu->arch.ia32_xss != host_xss)
910 			wrmsrl(MSR_IA32_XSS, vcpu->arch.ia32_xss);
911 	}
912 
913 	if (static_cpu_has(X86_FEATURE_PKU) &&
914 	    (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) ||
915 	     (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU)) &&
916 	    vcpu->arch.pkru != vcpu->arch.host_pkru)
917 		__write_pkru(vcpu->arch.pkru);
918 }
919 EXPORT_SYMBOL_GPL(kvm_load_guest_xsave_state);
920 
921 void kvm_load_host_xsave_state(struct kvm_vcpu *vcpu)
922 {
923 	if (vcpu->arch.guest_state_protected)
924 		return;
925 
926 	if (static_cpu_has(X86_FEATURE_PKU) &&
927 	    (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) ||
928 	     (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU))) {
929 		vcpu->arch.pkru = rdpkru();
930 		if (vcpu->arch.pkru != vcpu->arch.host_pkru)
931 			__write_pkru(vcpu->arch.host_pkru);
932 	}
933 
934 	if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) {
935 
936 		if (vcpu->arch.xcr0 != host_xcr0)
937 			xsetbv(XCR_XFEATURE_ENABLED_MASK, host_xcr0);
938 
939 		if (vcpu->arch.xsaves_enabled &&
940 		    vcpu->arch.ia32_xss != host_xss)
941 			wrmsrl(MSR_IA32_XSS, host_xss);
942 	}
943 
944 }
945 EXPORT_SYMBOL_GPL(kvm_load_host_xsave_state);
946 
947 static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
948 {
949 	u64 xcr0 = xcr;
950 	u64 old_xcr0 = vcpu->arch.xcr0;
951 	u64 valid_bits;
952 
953 	/* Only support XCR_XFEATURE_ENABLED_MASK(xcr0) now  */
954 	if (index != XCR_XFEATURE_ENABLED_MASK)
955 		return 1;
956 	if (!(xcr0 & XFEATURE_MASK_FP))
957 		return 1;
958 	if ((xcr0 & XFEATURE_MASK_YMM) && !(xcr0 & XFEATURE_MASK_SSE))
959 		return 1;
960 
961 	/*
962 	 * Do not allow the guest to set bits that we do not support
963 	 * saving.  However, xcr0 bit 0 is always set, even if the
964 	 * emulated CPU does not support XSAVE (see fx_init).
965 	 */
966 	valid_bits = vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FP;
967 	if (xcr0 & ~valid_bits)
968 		return 1;
969 
970 	if ((!(xcr0 & XFEATURE_MASK_BNDREGS)) !=
971 	    (!(xcr0 & XFEATURE_MASK_BNDCSR)))
972 		return 1;
973 
974 	if (xcr0 & XFEATURE_MASK_AVX512) {
975 		if (!(xcr0 & XFEATURE_MASK_YMM))
976 			return 1;
977 		if ((xcr0 & XFEATURE_MASK_AVX512) != XFEATURE_MASK_AVX512)
978 			return 1;
979 	}
980 	vcpu->arch.xcr0 = xcr0;
981 
982 	if ((xcr0 ^ old_xcr0) & XFEATURE_MASK_EXTEND)
983 		kvm_update_cpuid_runtime(vcpu);
984 	return 0;
985 }
986 
987 int kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
988 {
989 	if (static_call(kvm_x86_get_cpl)(vcpu) == 0)
990 		return __kvm_set_xcr(vcpu, index, xcr);
991 
992 	return 1;
993 }
994 EXPORT_SYMBOL_GPL(kvm_set_xcr);
995 
996 bool kvm_is_valid_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
997 {
998 	if (cr4 & cr4_reserved_bits)
999 		return false;
1000 
1001 	if (cr4 & vcpu->arch.cr4_guest_rsvd_bits)
1002 		return false;
1003 
1004 	return static_call(kvm_x86_is_valid_cr4)(vcpu, cr4);
1005 }
1006 EXPORT_SYMBOL_GPL(kvm_is_valid_cr4);
1007 
1008 void kvm_post_set_cr4(struct kvm_vcpu *vcpu, unsigned long old_cr4, unsigned long cr4)
1009 {
1010 	unsigned long mmu_role_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
1011 				      X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE;
1012 
1013 	if (((cr4 ^ old_cr4) & mmu_role_bits) ||
1014 	    (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE)))
1015 		kvm_mmu_reset_context(vcpu);
1016 }
1017 EXPORT_SYMBOL_GPL(kvm_post_set_cr4);
1018 
1019 int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
1020 {
1021 	unsigned long old_cr4 = kvm_read_cr4(vcpu);
1022 	unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
1023 				   X86_CR4_SMEP;
1024 
1025 	if (!kvm_is_valid_cr4(vcpu, cr4))
1026 		return 1;
1027 
1028 	if (is_long_mode(vcpu)) {
1029 		if (!(cr4 & X86_CR4_PAE))
1030 			return 1;
1031 		if ((cr4 ^ old_cr4) & X86_CR4_LA57)
1032 			return 1;
1033 	} else if (is_paging(vcpu) && (cr4 & X86_CR4_PAE)
1034 		   && ((cr4 ^ old_cr4) & pdptr_bits)
1035 		   && !load_pdptrs(vcpu, vcpu->arch.walk_mmu,
1036 				   kvm_read_cr3(vcpu)))
1037 		return 1;
1038 
1039 	if ((cr4 & X86_CR4_PCIDE) && !(old_cr4 & X86_CR4_PCIDE)) {
1040 		if (!guest_cpuid_has(vcpu, X86_FEATURE_PCID))
1041 			return 1;
1042 
1043 		/* PCID can not be enabled when cr3[11:0]!=000H or EFER.LMA=0 */
1044 		if ((kvm_read_cr3(vcpu) & X86_CR3_PCID_MASK) || !is_long_mode(vcpu))
1045 			return 1;
1046 	}
1047 
1048 	static_call(kvm_x86_set_cr4)(vcpu, cr4);
1049 
1050 	kvm_post_set_cr4(vcpu, old_cr4, cr4);
1051 
1052 	return 0;
1053 }
1054 EXPORT_SYMBOL_GPL(kvm_set_cr4);
1055 
1056 int kvm_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
1057 {
1058 	bool skip_tlb_flush = false;
1059 #ifdef CONFIG_X86_64
1060 	bool pcid_enabled = kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE);
1061 
1062 	if (pcid_enabled) {
1063 		skip_tlb_flush = cr3 & X86_CR3_PCID_NOFLUSH;
1064 		cr3 &= ~X86_CR3_PCID_NOFLUSH;
1065 	}
1066 #endif
1067 
1068 	if (cr3 == kvm_read_cr3(vcpu) && !pdptrs_changed(vcpu)) {
1069 		if (!skip_tlb_flush) {
1070 			kvm_mmu_sync_roots(vcpu);
1071 			kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
1072 		}
1073 		return 0;
1074 	}
1075 
1076 	if (is_long_mode(vcpu) && kvm_vcpu_is_illegal_gpa(vcpu, cr3))
1077 		return 1;
1078 	else if (is_pae_paging(vcpu) &&
1079 		 !load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3))
1080 		return 1;
1081 
1082 	kvm_mmu_new_pgd(vcpu, cr3, skip_tlb_flush, skip_tlb_flush);
1083 	vcpu->arch.cr3 = cr3;
1084 	kvm_register_mark_available(vcpu, VCPU_EXREG_CR3);
1085 
1086 	return 0;
1087 }
1088 EXPORT_SYMBOL_GPL(kvm_set_cr3);
1089 
1090 int kvm_set_cr8(struct kvm_vcpu *vcpu, unsigned long cr8)
1091 {
1092 	if (cr8 & CR8_RESERVED_BITS)
1093 		return 1;
1094 	if (lapic_in_kernel(vcpu))
1095 		kvm_lapic_set_tpr(vcpu, cr8);
1096 	else
1097 		vcpu->arch.cr8 = cr8;
1098 	return 0;
1099 }
1100 EXPORT_SYMBOL_GPL(kvm_set_cr8);
1101 
1102 unsigned long kvm_get_cr8(struct kvm_vcpu *vcpu)
1103 {
1104 	if (lapic_in_kernel(vcpu))
1105 		return kvm_lapic_get_cr8(vcpu);
1106 	else
1107 		return vcpu->arch.cr8;
1108 }
1109 EXPORT_SYMBOL_GPL(kvm_get_cr8);
1110 
1111 static void kvm_update_dr0123(struct kvm_vcpu *vcpu)
1112 {
1113 	int i;
1114 
1115 	if (!(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP)) {
1116 		for (i = 0; i < KVM_NR_DB_REGS; i++)
1117 			vcpu->arch.eff_db[i] = vcpu->arch.db[i];
1118 		vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD;
1119 	}
1120 }
1121 
1122 void kvm_update_dr7(struct kvm_vcpu *vcpu)
1123 {
1124 	unsigned long dr7;
1125 
1126 	if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP)
1127 		dr7 = vcpu->arch.guest_debug_dr7;
1128 	else
1129 		dr7 = vcpu->arch.dr7;
1130 	static_call(kvm_x86_set_dr7)(vcpu, dr7);
1131 	vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_BP_ENABLED;
1132 	if (dr7 & DR7_BP_EN_MASK)
1133 		vcpu->arch.switch_db_regs |= KVM_DEBUGREG_BP_ENABLED;
1134 }
1135 EXPORT_SYMBOL_GPL(kvm_update_dr7);
1136 
1137 static u64 kvm_dr6_fixed(struct kvm_vcpu *vcpu)
1138 {
1139 	u64 fixed = DR6_FIXED_1;
1140 
1141 	if (!guest_cpuid_has(vcpu, X86_FEATURE_RTM))
1142 		fixed |= DR6_RTM;
1143 	return fixed;
1144 }
1145 
1146 int kvm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long val)
1147 {
1148 	size_t size = ARRAY_SIZE(vcpu->arch.db);
1149 
1150 	switch (dr) {
1151 	case 0 ... 3:
1152 		vcpu->arch.db[array_index_nospec(dr, size)] = val;
1153 		if (!(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP))
1154 			vcpu->arch.eff_db[dr] = val;
1155 		break;
1156 	case 4:
1157 	case 6:
1158 		if (!kvm_dr6_valid(val))
1159 			return 1; /* #GP */
1160 		vcpu->arch.dr6 = (val & DR6_VOLATILE) | kvm_dr6_fixed(vcpu);
1161 		break;
1162 	case 5:
1163 	default: /* 7 */
1164 		if (!kvm_dr7_valid(val))
1165 			return 1; /* #GP */
1166 		vcpu->arch.dr7 = (val & DR7_VOLATILE) | DR7_FIXED_1;
1167 		kvm_update_dr7(vcpu);
1168 		break;
1169 	}
1170 
1171 	return 0;
1172 }
1173 EXPORT_SYMBOL_GPL(kvm_set_dr);
1174 
1175 void kvm_get_dr(struct kvm_vcpu *vcpu, int dr, unsigned long *val)
1176 {
1177 	size_t size = ARRAY_SIZE(vcpu->arch.db);
1178 
1179 	switch (dr) {
1180 	case 0 ... 3:
1181 		*val = vcpu->arch.db[array_index_nospec(dr, size)];
1182 		break;
1183 	case 4:
1184 	case 6:
1185 		*val = vcpu->arch.dr6;
1186 		break;
1187 	case 5:
1188 	default: /* 7 */
1189 		*val = vcpu->arch.dr7;
1190 		break;
1191 	}
1192 }
1193 EXPORT_SYMBOL_GPL(kvm_get_dr);
1194 
1195 bool kvm_rdpmc(struct kvm_vcpu *vcpu)
1196 {
1197 	u32 ecx = kvm_rcx_read(vcpu);
1198 	u64 data;
1199 	int err;
1200 
1201 	err = kvm_pmu_rdpmc(vcpu, ecx, &data);
1202 	if (err)
1203 		return err;
1204 	kvm_rax_write(vcpu, (u32)data);
1205 	kvm_rdx_write(vcpu, data >> 32);
1206 	return err;
1207 }
1208 EXPORT_SYMBOL_GPL(kvm_rdpmc);
1209 
1210 /*
1211  * List of msr numbers which we expose to userspace through KVM_GET_MSRS
1212  * and KVM_SET_MSRS, and KVM_GET_MSR_INDEX_LIST.
1213  *
1214  * The three MSR lists(msrs_to_save, emulated_msrs, msr_based_features)
1215  * extract the supported MSRs from the related const lists.
1216  * msrs_to_save is selected from the msrs_to_save_all to reflect the
1217  * capabilities of the host cpu. This capabilities test skips MSRs that are
1218  * kvm-specific. Those are put in emulated_msrs_all; filtering of emulated_msrs
1219  * may depend on host virtualization features rather than host cpu features.
1220  */
1221 
1222 static const u32 msrs_to_save_all[] = {
1223 	MSR_IA32_SYSENTER_CS, MSR_IA32_SYSENTER_ESP, MSR_IA32_SYSENTER_EIP,
1224 	MSR_STAR,
1225 #ifdef CONFIG_X86_64
1226 	MSR_CSTAR, MSR_KERNEL_GS_BASE, MSR_SYSCALL_MASK, MSR_LSTAR,
1227 #endif
1228 	MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA,
1229 	MSR_IA32_FEAT_CTL, MSR_IA32_BNDCFGS, MSR_TSC_AUX,
1230 	MSR_IA32_SPEC_CTRL,
1231 	MSR_IA32_RTIT_CTL, MSR_IA32_RTIT_STATUS, MSR_IA32_RTIT_CR3_MATCH,
1232 	MSR_IA32_RTIT_OUTPUT_BASE, MSR_IA32_RTIT_OUTPUT_MASK,
1233 	MSR_IA32_RTIT_ADDR0_A, MSR_IA32_RTIT_ADDR0_B,
1234 	MSR_IA32_RTIT_ADDR1_A, MSR_IA32_RTIT_ADDR1_B,
1235 	MSR_IA32_RTIT_ADDR2_A, MSR_IA32_RTIT_ADDR2_B,
1236 	MSR_IA32_RTIT_ADDR3_A, MSR_IA32_RTIT_ADDR3_B,
1237 	MSR_IA32_UMWAIT_CONTROL,
1238 
1239 	MSR_ARCH_PERFMON_FIXED_CTR0, MSR_ARCH_PERFMON_FIXED_CTR1,
1240 	MSR_ARCH_PERFMON_FIXED_CTR0 + 2, MSR_ARCH_PERFMON_FIXED_CTR0 + 3,
1241 	MSR_CORE_PERF_FIXED_CTR_CTRL, MSR_CORE_PERF_GLOBAL_STATUS,
1242 	MSR_CORE_PERF_GLOBAL_CTRL, MSR_CORE_PERF_GLOBAL_OVF_CTRL,
1243 	MSR_ARCH_PERFMON_PERFCTR0, MSR_ARCH_PERFMON_PERFCTR1,
1244 	MSR_ARCH_PERFMON_PERFCTR0 + 2, MSR_ARCH_PERFMON_PERFCTR0 + 3,
1245 	MSR_ARCH_PERFMON_PERFCTR0 + 4, MSR_ARCH_PERFMON_PERFCTR0 + 5,
1246 	MSR_ARCH_PERFMON_PERFCTR0 + 6, MSR_ARCH_PERFMON_PERFCTR0 + 7,
1247 	MSR_ARCH_PERFMON_PERFCTR0 + 8, MSR_ARCH_PERFMON_PERFCTR0 + 9,
1248 	MSR_ARCH_PERFMON_PERFCTR0 + 10, MSR_ARCH_PERFMON_PERFCTR0 + 11,
1249 	MSR_ARCH_PERFMON_PERFCTR0 + 12, MSR_ARCH_PERFMON_PERFCTR0 + 13,
1250 	MSR_ARCH_PERFMON_PERFCTR0 + 14, MSR_ARCH_PERFMON_PERFCTR0 + 15,
1251 	MSR_ARCH_PERFMON_PERFCTR0 + 16, MSR_ARCH_PERFMON_PERFCTR0 + 17,
1252 	MSR_ARCH_PERFMON_EVENTSEL0, MSR_ARCH_PERFMON_EVENTSEL1,
1253 	MSR_ARCH_PERFMON_EVENTSEL0 + 2, MSR_ARCH_PERFMON_EVENTSEL0 + 3,
1254 	MSR_ARCH_PERFMON_EVENTSEL0 + 4, MSR_ARCH_PERFMON_EVENTSEL0 + 5,
1255 	MSR_ARCH_PERFMON_EVENTSEL0 + 6, MSR_ARCH_PERFMON_EVENTSEL0 + 7,
1256 	MSR_ARCH_PERFMON_EVENTSEL0 + 8, MSR_ARCH_PERFMON_EVENTSEL0 + 9,
1257 	MSR_ARCH_PERFMON_EVENTSEL0 + 10, MSR_ARCH_PERFMON_EVENTSEL0 + 11,
1258 	MSR_ARCH_PERFMON_EVENTSEL0 + 12, MSR_ARCH_PERFMON_EVENTSEL0 + 13,
1259 	MSR_ARCH_PERFMON_EVENTSEL0 + 14, MSR_ARCH_PERFMON_EVENTSEL0 + 15,
1260 	MSR_ARCH_PERFMON_EVENTSEL0 + 16, MSR_ARCH_PERFMON_EVENTSEL0 + 17,
1261 };
1262 
1263 static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_all)];
1264 static unsigned num_msrs_to_save;
1265 
1266 static const u32 emulated_msrs_all[] = {
1267 	MSR_KVM_SYSTEM_TIME, MSR_KVM_WALL_CLOCK,
1268 	MSR_KVM_SYSTEM_TIME_NEW, MSR_KVM_WALL_CLOCK_NEW,
1269 	HV_X64_MSR_GUEST_OS_ID, HV_X64_MSR_HYPERCALL,
1270 	HV_X64_MSR_TIME_REF_COUNT, HV_X64_MSR_REFERENCE_TSC,
1271 	HV_X64_MSR_TSC_FREQUENCY, HV_X64_MSR_APIC_FREQUENCY,
1272 	HV_X64_MSR_CRASH_P0, HV_X64_MSR_CRASH_P1, HV_X64_MSR_CRASH_P2,
1273 	HV_X64_MSR_CRASH_P3, HV_X64_MSR_CRASH_P4, HV_X64_MSR_CRASH_CTL,
1274 	HV_X64_MSR_RESET,
1275 	HV_X64_MSR_VP_INDEX,
1276 	HV_X64_MSR_VP_RUNTIME,
1277 	HV_X64_MSR_SCONTROL,
1278 	HV_X64_MSR_STIMER0_CONFIG,
1279 	HV_X64_MSR_VP_ASSIST_PAGE,
1280 	HV_X64_MSR_REENLIGHTENMENT_CONTROL, HV_X64_MSR_TSC_EMULATION_CONTROL,
1281 	HV_X64_MSR_TSC_EMULATION_STATUS,
1282 	HV_X64_MSR_SYNDBG_OPTIONS,
1283 	HV_X64_MSR_SYNDBG_CONTROL, HV_X64_MSR_SYNDBG_STATUS,
1284 	HV_X64_MSR_SYNDBG_SEND_BUFFER, HV_X64_MSR_SYNDBG_RECV_BUFFER,
1285 	HV_X64_MSR_SYNDBG_PENDING_BUFFER,
1286 
1287 	MSR_KVM_ASYNC_PF_EN, MSR_KVM_STEAL_TIME,
1288 	MSR_KVM_PV_EOI_EN, MSR_KVM_ASYNC_PF_INT, MSR_KVM_ASYNC_PF_ACK,
1289 
1290 	MSR_IA32_TSC_ADJUST,
1291 	MSR_IA32_TSCDEADLINE,
1292 	MSR_IA32_ARCH_CAPABILITIES,
1293 	MSR_IA32_PERF_CAPABILITIES,
1294 	MSR_IA32_MISC_ENABLE,
1295 	MSR_IA32_MCG_STATUS,
1296 	MSR_IA32_MCG_CTL,
1297 	MSR_IA32_MCG_EXT_CTL,
1298 	MSR_IA32_SMBASE,
1299 	MSR_SMI_COUNT,
1300 	MSR_PLATFORM_INFO,
1301 	MSR_MISC_FEATURES_ENABLES,
1302 	MSR_AMD64_VIRT_SPEC_CTRL,
1303 	MSR_IA32_POWER_CTL,
1304 	MSR_IA32_UCODE_REV,
1305 
1306 	/*
1307 	 * The following list leaves out MSRs whose values are determined
1308 	 * by arch/x86/kvm/vmx/nested.c based on CPUID or other MSRs.
1309 	 * We always support the "true" VMX control MSRs, even if the host
1310 	 * processor does not, so I am putting these registers here rather
1311 	 * than in msrs_to_save_all.
1312 	 */
1313 	MSR_IA32_VMX_BASIC,
1314 	MSR_IA32_VMX_TRUE_PINBASED_CTLS,
1315 	MSR_IA32_VMX_TRUE_PROCBASED_CTLS,
1316 	MSR_IA32_VMX_TRUE_EXIT_CTLS,
1317 	MSR_IA32_VMX_TRUE_ENTRY_CTLS,
1318 	MSR_IA32_VMX_MISC,
1319 	MSR_IA32_VMX_CR0_FIXED0,
1320 	MSR_IA32_VMX_CR4_FIXED0,
1321 	MSR_IA32_VMX_VMCS_ENUM,
1322 	MSR_IA32_VMX_PROCBASED_CTLS2,
1323 	MSR_IA32_VMX_EPT_VPID_CAP,
1324 	MSR_IA32_VMX_VMFUNC,
1325 
1326 	MSR_K7_HWCR,
1327 	MSR_KVM_POLL_CONTROL,
1328 };
1329 
1330 static u32 emulated_msrs[ARRAY_SIZE(emulated_msrs_all)];
1331 static unsigned num_emulated_msrs;
1332 
1333 /*
1334  * List of msr numbers which are used to expose MSR-based features that
1335  * can be used by a hypervisor to validate requested CPU features.
1336  */
1337 static const u32 msr_based_features_all[] = {
1338 	MSR_IA32_VMX_BASIC,
1339 	MSR_IA32_VMX_TRUE_PINBASED_CTLS,
1340 	MSR_IA32_VMX_PINBASED_CTLS,
1341 	MSR_IA32_VMX_TRUE_PROCBASED_CTLS,
1342 	MSR_IA32_VMX_PROCBASED_CTLS,
1343 	MSR_IA32_VMX_TRUE_EXIT_CTLS,
1344 	MSR_IA32_VMX_EXIT_CTLS,
1345 	MSR_IA32_VMX_TRUE_ENTRY_CTLS,
1346 	MSR_IA32_VMX_ENTRY_CTLS,
1347 	MSR_IA32_VMX_MISC,
1348 	MSR_IA32_VMX_CR0_FIXED0,
1349 	MSR_IA32_VMX_CR0_FIXED1,
1350 	MSR_IA32_VMX_CR4_FIXED0,
1351 	MSR_IA32_VMX_CR4_FIXED1,
1352 	MSR_IA32_VMX_VMCS_ENUM,
1353 	MSR_IA32_VMX_PROCBASED_CTLS2,
1354 	MSR_IA32_VMX_EPT_VPID_CAP,
1355 	MSR_IA32_VMX_VMFUNC,
1356 
1357 	MSR_F10H_DECFG,
1358 	MSR_IA32_UCODE_REV,
1359 	MSR_IA32_ARCH_CAPABILITIES,
1360 	MSR_IA32_PERF_CAPABILITIES,
1361 };
1362 
1363 static u32 msr_based_features[ARRAY_SIZE(msr_based_features_all)];
1364 static unsigned int num_msr_based_features;
1365 
1366 static u64 kvm_get_arch_capabilities(void)
1367 {
1368 	u64 data = 0;
1369 
1370 	if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES))
1371 		rdmsrl(MSR_IA32_ARCH_CAPABILITIES, data);
1372 
1373 	/*
1374 	 * If nx_huge_pages is enabled, KVM's shadow paging will ensure that
1375 	 * the nested hypervisor runs with NX huge pages.  If it is not,
1376 	 * L1 is anyway vulnerable to ITLB_MULTIHIT explots from other
1377 	 * L1 guests, so it need not worry about its own (L2) guests.
1378 	 */
1379 	data |= ARCH_CAP_PSCHANGE_MC_NO;
1380 
1381 	/*
1382 	 * If we're doing cache flushes (either "always" or "cond")
1383 	 * we will do one whenever the guest does a vmlaunch/vmresume.
1384 	 * If an outer hypervisor is doing the cache flush for us
1385 	 * (VMENTER_L1D_FLUSH_NESTED_VM), we can safely pass that
1386 	 * capability to the guest too, and if EPT is disabled we're not
1387 	 * vulnerable.  Overall, only VMENTER_L1D_FLUSH_NEVER will
1388 	 * require a nested hypervisor to do a flush of its own.
1389 	 */
1390 	if (l1tf_vmx_mitigation != VMENTER_L1D_FLUSH_NEVER)
1391 		data |= ARCH_CAP_SKIP_VMENTRY_L1DFLUSH;
1392 
1393 	if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
1394 		data |= ARCH_CAP_RDCL_NO;
1395 	if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS))
1396 		data |= ARCH_CAP_SSB_NO;
1397 	if (!boot_cpu_has_bug(X86_BUG_MDS))
1398 		data |= ARCH_CAP_MDS_NO;
1399 
1400 	if (!boot_cpu_has(X86_FEATURE_RTM)) {
1401 		/*
1402 		 * If RTM=0 because the kernel has disabled TSX, the host might
1403 		 * have TAA_NO or TSX_CTRL.  Clear TAA_NO (the guest sees RTM=0
1404 		 * and therefore knows that there cannot be TAA) but keep
1405 		 * TSX_CTRL: some buggy userspaces leave it set on tsx=on hosts,
1406 		 * and we want to allow migrating those guests to tsx=off hosts.
1407 		 */
1408 		data &= ~ARCH_CAP_TAA_NO;
1409 	} else if (!boot_cpu_has_bug(X86_BUG_TAA)) {
1410 		data |= ARCH_CAP_TAA_NO;
1411 	} else {
1412 		/*
1413 		 * Nothing to do here; we emulate TSX_CTRL if present on the
1414 		 * host so the guest can choose between disabling TSX or
1415 		 * using VERW to clear CPU buffers.
1416 		 */
1417 	}
1418 
1419 	return data;
1420 }
1421 
1422 static int kvm_get_msr_feature(struct kvm_msr_entry *msr)
1423 {
1424 	switch (msr->index) {
1425 	case MSR_IA32_ARCH_CAPABILITIES:
1426 		msr->data = kvm_get_arch_capabilities();
1427 		break;
1428 	case MSR_IA32_UCODE_REV:
1429 		rdmsrl_safe(msr->index, &msr->data);
1430 		break;
1431 	default:
1432 		return static_call(kvm_x86_get_msr_feature)(msr);
1433 	}
1434 	return 0;
1435 }
1436 
1437 static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
1438 {
1439 	struct kvm_msr_entry msr;
1440 	int r;
1441 
1442 	msr.index = index;
1443 	r = kvm_get_msr_feature(&msr);
1444 
1445 	if (r == KVM_MSR_RET_INVALID) {
1446 		/* Unconditionally clear the output for simplicity */
1447 		*data = 0;
1448 		if (kvm_msr_ignored_check(vcpu, index, 0, false))
1449 			r = 0;
1450 	}
1451 
1452 	if (r)
1453 		return r;
1454 
1455 	*data = msr.data;
1456 
1457 	return 0;
1458 }
1459 
1460 static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
1461 {
1462 	if (efer & EFER_FFXSR && !guest_cpuid_has(vcpu, X86_FEATURE_FXSR_OPT))
1463 		return false;
1464 
1465 	if (efer & EFER_SVME && !guest_cpuid_has(vcpu, X86_FEATURE_SVM))
1466 		return false;
1467 
1468 	if (efer & (EFER_LME | EFER_LMA) &&
1469 	    !guest_cpuid_has(vcpu, X86_FEATURE_LM))
1470 		return false;
1471 
1472 	if (efer & EFER_NX && !guest_cpuid_has(vcpu, X86_FEATURE_NX))
1473 		return false;
1474 
1475 	return true;
1476 
1477 }
1478 bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
1479 {
1480 	if (efer & efer_reserved_bits)
1481 		return false;
1482 
1483 	return __kvm_valid_efer(vcpu, efer);
1484 }
1485 EXPORT_SYMBOL_GPL(kvm_valid_efer);
1486 
1487 static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
1488 {
1489 	u64 old_efer = vcpu->arch.efer;
1490 	u64 efer = msr_info->data;
1491 	int r;
1492 
1493 	if (efer & efer_reserved_bits)
1494 		return 1;
1495 
1496 	if (!msr_info->host_initiated) {
1497 		if (!__kvm_valid_efer(vcpu, efer))
1498 			return 1;
1499 
1500 		if (is_paging(vcpu) &&
1501 		    (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME))
1502 			return 1;
1503 	}
1504 
1505 	efer &= ~EFER_LMA;
1506 	efer |= vcpu->arch.efer & EFER_LMA;
1507 
1508 	r = static_call(kvm_x86_set_efer)(vcpu, efer);
1509 	if (r) {
1510 		WARN_ON(r > 0);
1511 		return r;
1512 	}
1513 
1514 	/* Update reserved bits */
1515 	if ((efer ^ old_efer) & EFER_NX)
1516 		kvm_mmu_reset_context(vcpu);
1517 
1518 	return 0;
1519 }
1520 
1521 void kvm_enable_efer_bits(u64 mask)
1522 {
1523        efer_reserved_bits &= ~mask;
1524 }
1525 EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
1526 
1527 bool kvm_msr_allowed(struct kvm_vcpu *vcpu, u32 index, u32 type)
1528 {
1529 	struct kvm *kvm = vcpu->kvm;
1530 	struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges;
1531 	u32 count = kvm->arch.msr_filter.count;
1532 	u32 i;
1533 	bool r = kvm->arch.msr_filter.default_allow;
1534 	int idx;
1535 
1536 	/* MSR filtering not set up or x2APIC enabled, allow everything */
1537 	if (!count || (index >= 0x800 && index <= 0x8ff))
1538 		return true;
1539 
1540 	/* Prevent collision with set_msr_filter */
1541 	idx = srcu_read_lock(&kvm->srcu);
1542 
1543 	for (i = 0; i < count; i++) {
1544 		u32 start = ranges[i].base;
1545 		u32 end = start + ranges[i].nmsrs;
1546 		u32 flags = ranges[i].flags;
1547 		unsigned long *bitmap = ranges[i].bitmap;
1548 
1549 		if ((index >= start) && (index < end) && (flags & type)) {
1550 			r = !!test_bit(index - start, bitmap);
1551 			break;
1552 		}
1553 	}
1554 
1555 	srcu_read_unlock(&kvm->srcu, idx);
1556 
1557 	return r;
1558 }
1559 EXPORT_SYMBOL_GPL(kvm_msr_allowed);
1560 
1561 /*
1562  * Write @data into the MSR specified by @index.  Select MSR specific fault
1563  * checks are bypassed if @host_initiated is %true.
1564  * Returns 0 on success, non-0 otherwise.
1565  * Assumes vcpu_load() was already called.
1566  */
1567 static int __kvm_set_msr(struct kvm_vcpu *vcpu, u32 index, u64 data,
1568 			 bool host_initiated)
1569 {
1570 	struct msr_data msr;
1571 
1572 	if (!host_initiated && !kvm_msr_allowed(vcpu, index, KVM_MSR_FILTER_WRITE))
1573 		return KVM_MSR_RET_FILTERED;
1574 
1575 	switch (index) {
1576 	case MSR_FS_BASE:
1577 	case MSR_GS_BASE:
1578 	case MSR_KERNEL_GS_BASE:
1579 	case MSR_CSTAR:
1580 	case MSR_LSTAR:
1581 		if (is_noncanonical_address(data, vcpu))
1582 			return 1;
1583 		break;
1584 	case MSR_IA32_SYSENTER_EIP:
1585 	case MSR_IA32_SYSENTER_ESP:
1586 		/*
1587 		 * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if
1588 		 * non-canonical address is written on Intel but not on
1589 		 * AMD (which ignores the top 32-bits, because it does
1590 		 * not implement 64-bit SYSENTER).
1591 		 *
1592 		 * 64-bit code should hence be able to write a non-canonical
1593 		 * value on AMD.  Making the address canonical ensures that
1594 		 * vmentry does not fail on Intel after writing a non-canonical
1595 		 * value, and that something deterministic happens if the guest
1596 		 * invokes 64-bit SYSENTER.
1597 		 */
1598 		data = get_canonical(data, vcpu_virt_addr_bits(vcpu));
1599 	}
1600 
1601 	msr.data = data;
1602 	msr.index = index;
1603 	msr.host_initiated = host_initiated;
1604 
1605 	return static_call(kvm_x86_set_msr)(vcpu, &msr);
1606 }
1607 
1608 static int kvm_set_msr_ignored_check(struct kvm_vcpu *vcpu,
1609 				     u32 index, u64 data, bool host_initiated)
1610 {
1611 	int ret = __kvm_set_msr(vcpu, index, data, host_initiated);
1612 
1613 	if (ret == KVM_MSR_RET_INVALID)
1614 		if (kvm_msr_ignored_check(vcpu, index, data, true))
1615 			ret = 0;
1616 
1617 	return ret;
1618 }
1619 
1620 /*
1621  * Read the MSR specified by @index into @data.  Select MSR specific fault
1622  * checks are bypassed if @host_initiated is %true.
1623  * Returns 0 on success, non-0 otherwise.
1624  * Assumes vcpu_load() was already called.
1625  */
1626 int __kvm_get_msr(struct kvm_vcpu *vcpu, u32 index, u64 *data,
1627 		  bool host_initiated)
1628 {
1629 	struct msr_data msr;
1630 	int ret;
1631 
1632 	if (!host_initiated && !kvm_msr_allowed(vcpu, index, KVM_MSR_FILTER_READ))
1633 		return KVM_MSR_RET_FILTERED;
1634 
1635 	msr.index = index;
1636 	msr.host_initiated = host_initiated;
1637 
1638 	ret = static_call(kvm_x86_get_msr)(vcpu, &msr);
1639 	if (!ret)
1640 		*data = msr.data;
1641 	return ret;
1642 }
1643 
1644 static int kvm_get_msr_ignored_check(struct kvm_vcpu *vcpu,
1645 				     u32 index, u64 *data, bool host_initiated)
1646 {
1647 	int ret = __kvm_get_msr(vcpu, index, data, host_initiated);
1648 
1649 	if (ret == KVM_MSR_RET_INVALID) {
1650 		/* Unconditionally clear *data for simplicity */
1651 		*data = 0;
1652 		if (kvm_msr_ignored_check(vcpu, index, 0, false))
1653 			ret = 0;
1654 	}
1655 
1656 	return ret;
1657 }
1658 
1659 int kvm_get_msr(struct kvm_vcpu *vcpu, u32 index, u64 *data)
1660 {
1661 	return kvm_get_msr_ignored_check(vcpu, index, data, false);
1662 }
1663 EXPORT_SYMBOL_GPL(kvm_get_msr);
1664 
1665 int kvm_set_msr(struct kvm_vcpu *vcpu, u32 index, u64 data)
1666 {
1667 	return kvm_set_msr_ignored_check(vcpu, index, data, false);
1668 }
1669 EXPORT_SYMBOL_GPL(kvm_set_msr);
1670 
1671 static int complete_emulated_rdmsr(struct kvm_vcpu *vcpu)
1672 {
1673 	int err = vcpu->run->msr.error;
1674 	if (!err) {
1675 		kvm_rax_write(vcpu, (u32)vcpu->run->msr.data);
1676 		kvm_rdx_write(vcpu, vcpu->run->msr.data >> 32);
1677 	}
1678 
1679 	return static_call(kvm_x86_complete_emulated_msr)(vcpu, err);
1680 }
1681 
1682 static int complete_emulated_wrmsr(struct kvm_vcpu *vcpu)
1683 {
1684 	return static_call(kvm_x86_complete_emulated_msr)(vcpu, vcpu->run->msr.error);
1685 }
1686 
1687 static u64 kvm_msr_reason(int r)
1688 {
1689 	switch (r) {
1690 	case KVM_MSR_RET_INVALID:
1691 		return KVM_MSR_EXIT_REASON_UNKNOWN;
1692 	case KVM_MSR_RET_FILTERED:
1693 		return KVM_MSR_EXIT_REASON_FILTER;
1694 	default:
1695 		return KVM_MSR_EXIT_REASON_INVAL;
1696 	}
1697 }
1698 
1699 static int kvm_msr_user_space(struct kvm_vcpu *vcpu, u32 index,
1700 			      u32 exit_reason, u64 data,
1701 			      int (*completion)(struct kvm_vcpu *vcpu),
1702 			      int r)
1703 {
1704 	u64 msr_reason = kvm_msr_reason(r);
1705 
1706 	/* Check if the user wanted to know about this MSR fault */
1707 	if (!(vcpu->kvm->arch.user_space_msr_mask & msr_reason))
1708 		return 0;
1709 
1710 	vcpu->run->exit_reason = exit_reason;
1711 	vcpu->run->msr.error = 0;
1712 	memset(vcpu->run->msr.pad, 0, sizeof(vcpu->run->msr.pad));
1713 	vcpu->run->msr.reason = msr_reason;
1714 	vcpu->run->msr.index = index;
1715 	vcpu->run->msr.data = data;
1716 	vcpu->arch.complete_userspace_io = completion;
1717 
1718 	return 1;
1719 }
1720 
1721 static int kvm_get_msr_user_space(struct kvm_vcpu *vcpu, u32 index, int r)
1722 {
1723 	return kvm_msr_user_space(vcpu, index, KVM_EXIT_X86_RDMSR, 0,
1724 				   complete_emulated_rdmsr, r);
1725 }
1726 
1727 static int kvm_set_msr_user_space(struct kvm_vcpu *vcpu, u32 index, u64 data, int r)
1728 {
1729 	return kvm_msr_user_space(vcpu, index, KVM_EXIT_X86_WRMSR, data,
1730 				   complete_emulated_wrmsr, r);
1731 }
1732 
1733 int kvm_emulate_rdmsr(struct kvm_vcpu *vcpu)
1734 {
1735 	u32 ecx = kvm_rcx_read(vcpu);
1736 	u64 data;
1737 	int r;
1738 
1739 	r = kvm_get_msr(vcpu, ecx, &data);
1740 
1741 	/* MSR read failed? See if we should ask user space */
1742 	if (r && kvm_get_msr_user_space(vcpu, ecx, r)) {
1743 		/* Bounce to user space */
1744 		return 0;
1745 	}
1746 
1747 	if (!r) {
1748 		trace_kvm_msr_read(ecx, data);
1749 
1750 		kvm_rax_write(vcpu, data & -1u);
1751 		kvm_rdx_write(vcpu, (data >> 32) & -1u);
1752 	} else {
1753 		trace_kvm_msr_read_ex(ecx);
1754 	}
1755 
1756 	return static_call(kvm_x86_complete_emulated_msr)(vcpu, r);
1757 }
1758 EXPORT_SYMBOL_GPL(kvm_emulate_rdmsr);
1759 
1760 int kvm_emulate_wrmsr(struct kvm_vcpu *vcpu)
1761 {
1762 	u32 ecx = kvm_rcx_read(vcpu);
1763 	u64 data = kvm_read_edx_eax(vcpu);
1764 	int r;
1765 
1766 	r = kvm_set_msr(vcpu, ecx, data);
1767 
1768 	/* MSR write failed? See if we should ask user space */
1769 	if (r && kvm_set_msr_user_space(vcpu, ecx, data, r))
1770 		/* Bounce to user space */
1771 		return 0;
1772 
1773 	/* Signal all other negative errors to userspace */
1774 	if (r < 0)
1775 		return r;
1776 
1777 	if (!r)
1778 		trace_kvm_msr_write(ecx, data);
1779 	else
1780 		trace_kvm_msr_write_ex(ecx, data);
1781 
1782 	return static_call(kvm_x86_complete_emulated_msr)(vcpu, r);
1783 }
1784 EXPORT_SYMBOL_GPL(kvm_emulate_wrmsr);
1785 
1786 static inline bool kvm_vcpu_exit_request(struct kvm_vcpu *vcpu)
1787 {
1788 	xfer_to_guest_mode_prepare();
1789 	return vcpu->mode == EXITING_GUEST_MODE || kvm_request_pending(vcpu) ||
1790 		xfer_to_guest_mode_work_pending();
1791 }
1792 
1793 /*
1794  * The fast path for frequent and performance sensitive wrmsr emulation,
1795  * i.e. the sending of IPI, sending IPI early in the VM-Exit flow reduces
1796  * the latency of virtual IPI by avoiding the expensive bits of transitioning
1797  * from guest to host, e.g. reacquiring KVM's SRCU lock. In contrast to the
1798  * other cases which must be called after interrupts are enabled on the host.
1799  */
1800 static int handle_fastpath_set_x2apic_icr_irqoff(struct kvm_vcpu *vcpu, u64 data)
1801 {
1802 	if (!lapic_in_kernel(vcpu) || !apic_x2apic_mode(vcpu->arch.apic))
1803 		return 1;
1804 
1805 	if (((data & APIC_SHORT_MASK) == APIC_DEST_NOSHORT) &&
1806 		((data & APIC_DEST_MASK) == APIC_DEST_PHYSICAL) &&
1807 		((data & APIC_MODE_MASK) == APIC_DM_FIXED) &&
1808 		((u32)(data >> 32) != X2APIC_BROADCAST)) {
1809 
1810 		data &= ~(1 << 12);
1811 		kvm_apic_send_ipi(vcpu->arch.apic, (u32)data, (u32)(data >> 32));
1812 		kvm_lapic_set_reg(vcpu->arch.apic, APIC_ICR2, (u32)(data >> 32));
1813 		kvm_lapic_set_reg(vcpu->arch.apic, APIC_ICR, (u32)data);
1814 		trace_kvm_apic_write(APIC_ICR, (u32)data);
1815 		return 0;
1816 	}
1817 
1818 	return 1;
1819 }
1820 
1821 static int handle_fastpath_set_tscdeadline(struct kvm_vcpu *vcpu, u64 data)
1822 {
1823 	if (!kvm_can_use_hv_timer(vcpu))
1824 		return 1;
1825 
1826 	kvm_set_lapic_tscdeadline_msr(vcpu, data);
1827 	return 0;
1828 }
1829 
1830 fastpath_t handle_fastpath_set_msr_irqoff(struct kvm_vcpu *vcpu)
1831 {
1832 	u32 msr = kvm_rcx_read(vcpu);
1833 	u64 data;
1834 	fastpath_t ret = EXIT_FASTPATH_NONE;
1835 
1836 	switch (msr) {
1837 	case APIC_BASE_MSR + (APIC_ICR >> 4):
1838 		data = kvm_read_edx_eax(vcpu);
1839 		if (!handle_fastpath_set_x2apic_icr_irqoff(vcpu, data)) {
1840 			kvm_skip_emulated_instruction(vcpu);
1841 			ret = EXIT_FASTPATH_EXIT_HANDLED;
1842 		}
1843 		break;
1844 	case MSR_IA32_TSCDEADLINE:
1845 		data = kvm_read_edx_eax(vcpu);
1846 		if (!handle_fastpath_set_tscdeadline(vcpu, data)) {
1847 			kvm_skip_emulated_instruction(vcpu);
1848 			ret = EXIT_FASTPATH_REENTER_GUEST;
1849 		}
1850 		break;
1851 	default:
1852 		break;
1853 	}
1854 
1855 	if (ret != EXIT_FASTPATH_NONE)
1856 		trace_kvm_msr_write(msr, data);
1857 
1858 	return ret;
1859 }
1860 EXPORT_SYMBOL_GPL(handle_fastpath_set_msr_irqoff);
1861 
1862 /*
1863  * Adapt set_msr() to msr_io()'s calling convention
1864  */
1865 static int do_get_msr(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
1866 {
1867 	return kvm_get_msr_ignored_check(vcpu, index, data, true);
1868 }
1869 
1870 static int do_set_msr(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
1871 {
1872 	return kvm_set_msr_ignored_check(vcpu, index, *data, true);
1873 }
1874 
1875 #ifdef CONFIG_X86_64
1876 struct pvclock_clock {
1877 	int vclock_mode;
1878 	u64 cycle_last;
1879 	u64 mask;
1880 	u32 mult;
1881 	u32 shift;
1882 	u64 base_cycles;
1883 	u64 offset;
1884 };
1885 
1886 struct pvclock_gtod_data {
1887 	seqcount_t	seq;
1888 
1889 	struct pvclock_clock clock; /* extract of a clocksource struct */
1890 	struct pvclock_clock raw_clock; /* extract of a clocksource struct */
1891 
1892 	ktime_t		offs_boot;
1893 	u64		wall_time_sec;
1894 };
1895 
1896 static struct pvclock_gtod_data pvclock_gtod_data;
1897 
1898 static void update_pvclock_gtod(struct timekeeper *tk)
1899 {
1900 	struct pvclock_gtod_data *vdata = &pvclock_gtod_data;
1901 
1902 	write_seqcount_begin(&vdata->seq);
1903 
1904 	/* copy pvclock gtod data */
1905 	vdata->clock.vclock_mode	= tk->tkr_mono.clock->vdso_clock_mode;
1906 	vdata->clock.cycle_last		= tk->tkr_mono.cycle_last;
1907 	vdata->clock.mask		= tk->tkr_mono.mask;
1908 	vdata->clock.mult		= tk->tkr_mono.mult;
1909 	vdata->clock.shift		= tk->tkr_mono.shift;
1910 	vdata->clock.base_cycles	= tk->tkr_mono.xtime_nsec;
1911 	vdata->clock.offset		= tk->tkr_mono.base;
1912 
1913 	vdata->raw_clock.vclock_mode	= tk->tkr_raw.clock->vdso_clock_mode;
1914 	vdata->raw_clock.cycle_last	= tk->tkr_raw.cycle_last;
1915 	vdata->raw_clock.mask		= tk->tkr_raw.mask;
1916 	vdata->raw_clock.mult		= tk->tkr_raw.mult;
1917 	vdata->raw_clock.shift		= tk->tkr_raw.shift;
1918 	vdata->raw_clock.base_cycles	= tk->tkr_raw.xtime_nsec;
1919 	vdata->raw_clock.offset		= tk->tkr_raw.base;
1920 
1921 	vdata->wall_time_sec            = tk->xtime_sec;
1922 
1923 	vdata->offs_boot		= tk->offs_boot;
1924 
1925 	write_seqcount_end(&vdata->seq);
1926 }
1927 
1928 static s64 get_kvmclock_base_ns(void)
1929 {
1930 	/* Count up from boot time, but with the frequency of the raw clock.  */
1931 	return ktime_to_ns(ktime_add(ktime_get_raw(), pvclock_gtod_data.offs_boot));
1932 }
1933 #else
1934 static s64 get_kvmclock_base_ns(void)
1935 {
1936 	/* Master clock not used, so we can just use CLOCK_BOOTTIME.  */
1937 	return ktime_get_boottime_ns();
1938 }
1939 #endif
1940 
1941 void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock, int sec_hi_ofs)
1942 {
1943 	int version;
1944 	int r;
1945 	struct pvclock_wall_clock wc;
1946 	u32 wc_sec_hi;
1947 	u64 wall_nsec;
1948 
1949 	if (!wall_clock)
1950 		return;
1951 
1952 	r = kvm_read_guest(kvm, wall_clock, &version, sizeof(version));
1953 	if (r)
1954 		return;
1955 
1956 	if (version & 1)
1957 		++version;  /* first time write, random junk */
1958 
1959 	++version;
1960 
1961 	if (kvm_write_guest(kvm, wall_clock, &version, sizeof(version)))
1962 		return;
1963 
1964 	/*
1965 	 * The guest calculates current wall clock time by adding
1966 	 * system time (updated by kvm_guest_time_update below) to the
1967 	 * wall clock specified here.  We do the reverse here.
1968 	 */
1969 	wall_nsec = ktime_get_real_ns() - get_kvmclock_ns(kvm);
1970 
1971 	wc.nsec = do_div(wall_nsec, 1000000000);
1972 	wc.sec = (u32)wall_nsec; /* overflow in 2106 guest time */
1973 	wc.version = version;
1974 
1975 	kvm_write_guest(kvm, wall_clock, &wc, sizeof(wc));
1976 
1977 	if (sec_hi_ofs) {
1978 		wc_sec_hi = wall_nsec >> 32;
1979 		kvm_write_guest(kvm, wall_clock + sec_hi_ofs,
1980 				&wc_sec_hi, sizeof(wc_sec_hi));
1981 	}
1982 
1983 	version++;
1984 	kvm_write_guest(kvm, wall_clock, &version, sizeof(version));
1985 }
1986 
1987 static void kvm_write_system_time(struct kvm_vcpu *vcpu, gpa_t system_time,
1988 				  bool old_msr, bool host_initiated)
1989 {
1990 	struct kvm_arch *ka = &vcpu->kvm->arch;
1991 
1992 	if (vcpu->vcpu_id == 0 && !host_initiated) {
1993 		if (ka->boot_vcpu_runs_old_kvmclock != old_msr)
1994 			kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
1995 
1996 		ka->boot_vcpu_runs_old_kvmclock = old_msr;
1997 	}
1998 
1999 	vcpu->arch.time = system_time;
2000 	kvm_make_request(KVM_REQ_GLOBAL_CLOCK_UPDATE, vcpu);
2001 
2002 	/* we verify if the enable bit is set... */
2003 	vcpu->arch.pv_time_enabled = false;
2004 	if (!(system_time & 1))
2005 		return;
2006 
2007 	if (!kvm_gfn_to_hva_cache_init(vcpu->kvm,
2008 				       &vcpu->arch.pv_time, system_time & ~1ULL,
2009 				       sizeof(struct pvclock_vcpu_time_info)))
2010 		vcpu->arch.pv_time_enabled = true;
2011 
2012 	return;
2013 }
2014 
2015 static uint32_t div_frac(uint32_t dividend, uint32_t divisor)
2016 {
2017 	do_shl32_div32(dividend, divisor);
2018 	return dividend;
2019 }
2020 
2021 static void kvm_get_time_scale(uint64_t scaled_hz, uint64_t base_hz,
2022 			       s8 *pshift, u32 *pmultiplier)
2023 {
2024 	uint64_t scaled64;
2025 	int32_t  shift = 0;
2026 	uint64_t tps64;
2027 	uint32_t tps32;
2028 
2029 	tps64 = base_hz;
2030 	scaled64 = scaled_hz;
2031 	while (tps64 > scaled64*2 || tps64 & 0xffffffff00000000ULL) {
2032 		tps64 >>= 1;
2033 		shift--;
2034 	}
2035 
2036 	tps32 = (uint32_t)tps64;
2037 	while (tps32 <= scaled64 || scaled64 & 0xffffffff00000000ULL) {
2038 		if (scaled64 & 0xffffffff00000000ULL || tps32 & 0x80000000)
2039 			scaled64 >>= 1;
2040 		else
2041 			tps32 <<= 1;
2042 		shift++;
2043 	}
2044 
2045 	*pshift = shift;
2046 	*pmultiplier = div_frac(scaled64, tps32);
2047 }
2048 
2049 #ifdef CONFIG_X86_64
2050 static atomic_t kvm_guest_has_master_clock = ATOMIC_INIT(0);
2051 #endif
2052 
2053 static DEFINE_PER_CPU(unsigned long, cpu_tsc_khz);
2054 static unsigned long max_tsc_khz;
2055 
2056 static u32 adjust_tsc_khz(u32 khz, s32 ppm)
2057 {
2058 	u64 v = (u64)khz * (1000000 + ppm);
2059 	do_div(v, 1000000);
2060 	return v;
2061 }
2062 
2063 static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
2064 {
2065 	u64 ratio;
2066 
2067 	/* Guest TSC same frequency as host TSC? */
2068 	if (!scale) {
2069 		vcpu->arch.tsc_scaling_ratio = kvm_default_tsc_scaling_ratio;
2070 		return 0;
2071 	}
2072 
2073 	/* TSC scaling supported? */
2074 	if (!kvm_has_tsc_control) {
2075 		if (user_tsc_khz > tsc_khz) {
2076 			vcpu->arch.tsc_catchup = 1;
2077 			vcpu->arch.tsc_always_catchup = 1;
2078 			return 0;
2079 		} else {
2080 			pr_warn_ratelimited("user requested TSC rate below hardware speed\n");
2081 			return -1;
2082 		}
2083 	}
2084 
2085 	/* TSC scaling required  - calculate ratio */
2086 	ratio = mul_u64_u32_div(1ULL << kvm_tsc_scaling_ratio_frac_bits,
2087 				user_tsc_khz, tsc_khz);
2088 
2089 	if (ratio == 0 || ratio >= kvm_max_tsc_scaling_ratio) {
2090 		pr_warn_ratelimited("Invalid TSC scaling ratio - virtual-tsc-khz=%u\n",
2091 			            user_tsc_khz);
2092 		return -1;
2093 	}
2094 
2095 	vcpu->arch.tsc_scaling_ratio = ratio;
2096 	return 0;
2097 }
2098 
2099 static int kvm_set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz)
2100 {
2101 	u32 thresh_lo, thresh_hi;
2102 	int use_scaling = 0;
2103 
2104 	/* tsc_khz can be zero if TSC calibration fails */
2105 	if (user_tsc_khz == 0) {
2106 		/* set tsc_scaling_ratio to a safe value */
2107 		vcpu->arch.tsc_scaling_ratio = kvm_default_tsc_scaling_ratio;
2108 		return -1;
2109 	}
2110 
2111 	/* Compute a scale to convert nanoseconds in TSC cycles */
2112 	kvm_get_time_scale(user_tsc_khz * 1000LL, NSEC_PER_SEC,
2113 			   &vcpu->arch.virtual_tsc_shift,
2114 			   &vcpu->arch.virtual_tsc_mult);
2115 	vcpu->arch.virtual_tsc_khz = user_tsc_khz;
2116 
2117 	/*
2118 	 * Compute the variation in TSC rate which is acceptable
2119 	 * within the range of tolerance and decide if the
2120 	 * rate being applied is within that bounds of the hardware
2121 	 * rate.  If so, no scaling or compensation need be done.
2122 	 */
2123 	thresh_lo = adjust_tsc_khz(tsc_khz, -tsc_tolerance_ppm);
2124 	thresh_hi = adjust_tsc_khz(tsc_khz, tsc_tolerance_ppm);
2125 	if (user_tsc_khz < thresh_lo || user_tsc_khz > thresh_hi) {
2126 		pr_debug("kvm: requested TSC rate %u falls outside tolerance [%u,%u]\n", user_tsc_khz, thresh_lo, thresh_hi);
2127 		use_scaling = 1;
2128 	}
2129 	return set_tsc_khz(vcpu, user_tsc_khz, use_scaling);
2130 }
2131 
2132 static u64 compute_guest_tsc(struct kvm_vcpu *vcpu, s64 kernel_ns)
2133 {
2134 	u64 tsc = pvclock_scale_delta(kernel_ns-vcpu->arch.this_tsc_nsec,
2135 				      vcpu->arch.virtual_tsc_mult,
2136 				      vcpu->arch.virtual_tsc_shift);
2137 	tsc += vcpu->arch.this_tsc_write;
2138 	return tsc;
2139 }
2140 
2141 static inline int gtod_is_based_on_tsc(int mode)
2142 {
2143 	return mode == VDSO_CLOCKMODE_TSC || mode == VDSO_CLOCKMODE_HVCLOCK;
2144 }
2145 
2146 static void kvm_track_tsc_matching(struct kvm_vcpu *vcpu)
2147 {
2148 #ifdef CONFIG_X86_64
2149 	bool vcpus_matched;
2150 	struct kvm_arch *ka = &vcpu->kvm->arch;
2151 	struct pvclock_gtod_data *gtod = &pvclock_gtod_data;
2152 
2153 	vcpus_matched = (ka->nr_vcpus_matched_tsc + 1 ==
2154 			 atomic_read(&vcpu->kvm->online_vcpus));
2155 
2156 	/*
2157 	 * Once the masterclock is enabled, always perform request in
2158 	 * order to update it.
2159 	 *
2160 	 * In order to enable masterclock, the host clocksource must be TSC
2161 	 * and the vcpus need to have matched TSCs.  When that happens,
2162 	 * perform request to enable masterclock.
2163 	 */
2164 	if (ka->use_master_clock ||
2165 	    (gtod_is_based_on_tsc(gtod->clock.vclock_mode) && vcpus_matched))
2166 		kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
2167 
2168 	trace_kvm_track_tsc(vcpu->vcpu_id, ka->nr_vcpus_matched_tsc,
2169 			    atomic_read(&vcpu->kvm->online_vcpus),
2170 		            ka->use_master_clock, gtod->clock.vclock_mode);
2171 #endif
2172 }
2173 
2174 /*
2175  * Multiply tsc by a fixed point number represented by ratio.
2176  *
2177  * The most significant 64-N bits (mult) of ratio represent the
2178  * integral part of the fixed point number; the remaining N bits
2179  * (frac) represent the fractional part, ie. ratio represents a fixed
2180  * point number (mult + frac * 2^(-N)).
2181  *
2182  * N equals to kvm_tsc_scaling_ratio_frac_bits.
2183  */
2184 static inline u64 __scale_tsc(u64 ratio, u64 tsc)
2185 {
2186 	return mul_u64_u64_shr(tsc, ratio, kvm_tsc_scaling_ratio_frac_bits);
2187 }
2188 
2189 u64 kvm_scale_tsc(struct kvm_vcpu *vcpu, u64 tsc)
2190 {
2191 	u64 _tsc = tsc;
2192 	u64 ratio = vcpu->arch.tsc_scaling_ratio;
2193 
2194 	if (ratio != kvm_default_tsc_scaling_ratio)
2195 		_tsc = __scale_tsc(ratio, tsc);
2196 
2197 	return _tsc;
2198 }
2199 EXPORT_SYMBOL_GPL(kvm_scale_tsc);
2200 
2201 static u64 kvm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc)
2202 {
2203 	u64 tsc;
2204 
2205 	tsc = kvm_scale_tsc(vcpu, rdtsc());
2206 
2207 	return target_tsc - tsc;
2208 }
2209 
2210 u64 kvm_read_l1_tsc(struct kvm_vcpu *vcpu, u64 host_tsc)
2211 {
2212 	return vcpu->arch.l1_tsc_offset + kvm_scale_tsc(vcpu, host_tsc);
2213 }
2214 EXPORT_SYMBOL_GPL(kvm_read_l1_tsc);
2215 
2216 static void kvm_vcpu_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
2217 {
2218 	vcpu->arch.l1_tsc_offset = offset;
2219 	vcpu->arch.tsc_offset = static_call(kvm_x86_write_l1_tsc_offset)(vcpu, offset);
2220 }
2221 
2222 static inline bool kvm_check_tsc_unstable(void)
2223 {
2224 #ifdef CONFIG_X86_64
2225 	/*
2226 	 * TSC is marked unstable when we're running on Hyper-V,
2227 	 * 'TSC page' clocksource is good.
2228 	 */
2229 	if (pvclock_gtod_data.clock.vclock_mode == VDSO_CLOCKMODE_HVCLOCK)
2230 		return false;
2231 #endif
2232 	return check_tsc_unstable();
2233 }
2234 
2235 static void kvm_synchronize_tsc(struct kvm_vcpu *vcpu, u64 data)
2236 {
2237 	struct kvm *kvm = vcpu->kvm;
2238 	u64 offset, ns, elapsed;
2239 	unsigned long flags;
2240 	bool matched;
2241 	bool already_matched;
2242 	bool synchronizing = false;
2243 
2244 	raw_spin_lock_irqsave(&kvm->arch.tsc_write_lock, flags);
2245 	offset = kvm_compute_tsc_offset(vcpu, data);
2246 	ns = get_kvmclock_base_ns();
2247 	elapsed = ns - kvm->arch.last_tsc_nsec;
2248 
2249 	if (vcpu->arch.virtual_tsc_khz) {
2250 		if (data == 0) {
2251 			/*
2252 			 * detection of vcpu initialization -- need to sync
2253 			 * with other vCPUs. This particularly helps to keep
2254 			 * kvm_clock stable after CPU hotplug
2255 			 */
2256 			synchronizing = true;
2257 		} else {
2258 			u64 tsc_exp = kvm->arch.last_tsc_write +
2259 						nsec_to_cycles(vcpu, elapsed);
2260 			u64 tsc_hz = vcpu->arch.virtual_tsc_khz * 1000LL;
2261 			/*
2262 			 * Special case: TSC write with a small delta (1 second)
2263 			 * of virtual cycle time against real time is
2264 			 * interpreted as an attempt to synchronize the CPU.
2265 			 */
2266 			synchronizing = data < tsc_exp + tsc_hz &&
2267 					data + tsc_hz > tsc_exp;
2268 		}
2269 	}
2270 
2271 	/*
2272 	 * For a reliable TSC, we can match TSC offsets, and for an unstable
2273 	 * TSC, we add elapsed time in this computation.  We could let the
2274 	 * compensation code attempt to catch up if we fall behind, but
2275 	 * it's better to try to match offsets from the beginning.
2276          */
2277 	if (synchronizing &&
2278 	    vcpu->arch.virtual_tsc_khz == kvm->arch.last_tsc_khz) {
2279 		if (!kvm_check_tsc_unstable()) {
2280 			offset = kvm->arch.cur_tsc_offset;
2281 		} else {
2282 			u64 delta = nsec_to_cycles(vcpu, elapsed);
2283 			data += delta;
2284 			offset = kvm_compute_tsc_offset(vcpu, data);
2285 		}
2286 		matched = true;
2287 		already_matched = (vcpu->arch.this_tsc_generation == kvm->arch.cur_tsc_generation);
2288 	} else {
2289 		/*
2290 		 * We split periods of matched TSC writes into generations.
2291 		 * For each generation, we track the original measured
2292 		 * nanosecond time, offset, and write, so if TSCs are in
2293 		 * sync, we can match exact offset, and if not, we can match
2294 		 * exact software computation in compute_guest_tsc()
2295 		 *
2296 		 * These values are tracked in kvm->arch.cur_xxx variables.
2297 		 */
2298 		kvm->arch.cur_tsc_generation++;
2299 		kvm->arch.cur_tsc_nsec = ns;
2300 		kvm->arch.cur_tsc_write = data;
2301 		kvm->arch.cur_tsc_offset = offset;
2302 		matched = false;
2303 	}
2304 
2305 	/*
2306 	 * We also track th most recent recorded KHZ, write and time to
2307 	 * allow the matching interval to be extended at each write.
2308 	 */
2309 	kvm->arch.last_tsc_nsec = ns;
2310 	kvm->arch.last_tsc_write = data;
2311 	kvm->arch.last_tsc_khz = vcpu->arch.virtual_tsc_khz;
2312 
2313 	vcpu->arch.last_guest_tsc = data;
2314 
2315 	/* Keep track of which generation this VCPU has synchronized to */
2316 	vcpu->arch.this_tsc_generation = kvm->arch.cur_tsc_generation;
2317 	vcpu->arch.this_tsc_nsec = kvm->arch.cur_tsc_nsec;
2318 	vcpu->arch.this_tsc_write = kvm->arch.cur_tsc_write;
2319 
2320 	kvm_vcpu_write_tsc_offset(vcpu, offset);
2321 	raw_spin_unlock_irqrestore(&kvm->arch.tsc_write_lock, flags);
2322 
2323 	spin_lock(&kvm->arch.pvclock_gtod_sync_lock);
2324 	if (!matched) {
2325 		kvm->arch.nr_vcpus_matched_tsc = 0;
2326 	} else if (!already_matched) {
2327 		kvm->arch.nr_vcpus_matched_tsc++;
2328 	}
2329 
2330 	kvm_track_tsc_matching(vcpu);
2331 	spin_unlock(&kvm->arch.pvclock_gtod_sync_lock);
2332 }
2333 
2334 static inline void adjust_tsc_offset_guest(struct kvm_vcpu *vcpu,
2335 					   s64 adjustment)
2336 {
2337 	u64 tsc_offset = vcpu->arch.l1_tsc_offset;
2338 	kvm_vcpu_write_tsc_offset(vcpu, tsc_offset + adjustment);
2339 }
2340 
2341 static inline void adjust_tsc_offset_host(struct kvm_vcpu *vcpu, s64 adjustment)
2342 {
2343 	if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio)
2344 		WARN_ON(adjustment < 0);
2345 	adjustment = kvm_scale_tsc(vcpu, (u64) adjustment);
2346 	adjust_tsc_offset_guest(vcpu, adjustment);
2347 }
2348 
2349 #ifdef CONFIG_X86_64
2350 
2351 static u64 read_tsc(void)
2352 {
2353 	u64 ret = (u64)rdtsc_ordered();
2354 	u64 last = pvclock_gtod_data.clock.cycle_last;
2355 
2356 	if (likely(ret >= last))
2357 		return ret;
2358 
2359 	/*
2360 	 * GCC likes to generate cmov here, but this branch is extremely
2361 	 * predictable (it's just a function of time and the likely is
2362 	 * very likely) and there's a data dependence, so force GCC
2363 	 * to generate a branch instead.  I don't barrier() because
2364 	 * we don't actually need a barrier, and if this function
2365 	 * ever gets inlined it will generate worse code.
2366 	 */
2367 	asm volatile ("");
2368 	return last;
2369 }
2370 
2371 static inline u64 vgettsc(struct pvclock_clock *clock, u64 *tsc_timestamp,
2372 			  int *mode)
2373 {
2374 	long v;
2375 	u64 tsc_pg_val;
2376 
2377 	switch (clock->vclock_mode) {
2378 	case VDSO_CLOCKMODE_HVCLOCK:
2379 		tsc_pg_val = hv_read_tsc_page_tsc(hv_get_tsc_page(),
2380 						  tsc_timestamp);
2381 		if (tsc_pg_val != U64_MAX) {
2382 			/* TSC page valid */
2383 			*mode = VDSO_CLOCKMODE_HVCLOCK;
2384 			v = (tsc_pg_val - clock->cycle_last) &
2385 				clock->mask;
2386 		} else {
2387 			/* TSC page invalid */
2388 			*mode = VDSO_CLOCKMODE_NONE;
2389 		}
2390 		break;
2391 	case VDSO_CLOCKMODE_TSC:
2392 		*mode = VDSO_CLOCKMODE_TSC;
2393 		*tsc_timestamp = read_tsc();
2394 		v = (*tsc_timestamp - clock->cycle_last) &
2395 			clock->mask;
2396 		break;
2397 	default:
2398 		*mode = VDSO_CLOCKMODE_NONE;
2399 	}
2400 
2401 	if (*mode == VDSO_CLOCKMODE_NONE)
2402 		*tsc_timestamp = v = 0;
2403 
2404 	return v * clock->mult;
2405 }
2406 
2407 static int do_monotonic_raw(s64 *t, u64 *tsc_timestamp)
2408 {
2409 	struct pvclock_gtod_data *gtod = &pvclock_gtod_data;
2410 	unsigned long seq;
2411 	int mode;
2412 	u64 ns;
2413 
2414 	do {
2415 		seq = read_seqcount_begin(&gtod->seq);
2416 		ns = gtod->raw_clock.base_cycles;
2417 		ns += vgettsc(&gtod->raw_clock, tsc_timestamp, &mode);
2418 		ns >>= gtod->raw_clock.shift;
2419 		ns += ktime_to_ns(ktime_add(gtod->raw_clock.offset, gtod->offs_boot));
2420 	} while (unlikely(read_seqcount_retry(&gtod->seq, seq)));
2421 	*t = ns;
2422 
2423 	return mode;
2424 }
2425 
2426 static int do_realtime(struct timespec64 *ts, u64 *tsc_timestamp)
2427 {
2428 	struct pvclock_gtod_data *gtod = &pvclock_gtod_data;
2429 	unsigned long seq;
2430 	int mode;
2431 	u64 ns;
2432 
2433 	do {
2434 		seq = read_seqcount_begin(&gtod->seq);
2435 		ts->tv_sec = gtod->wall_time_sec;
2436 		ns = gtod->clock.base_cycles;
2437 		ns += vgettsc(&gtod->clock, tsc_timestamp, &mode);
2438 		ns >>= gtod->clock.shift;
2439 	} while (unlikely(read_seqcount_retry(&gtod->seq, seq)));
2440 
2441 	ts->tv_sec += __iter_div_u64_rem(ns, NSEC_PER_SEC, &ns);
2442 	ts->tv_nsec = ns;
2443 
2444 	return mode;
2445 }
2446 
2447 /* returns true if host is using TSC based clocksource */
2448 static bool kvm_get_time_and_clockread(s64 *kernel_ns, u64 *tsc_timestamp)
2449 {
2450 	/* checked again under seqlock below */
2451 	if (!gtod_is_based_on_tsc(pvclock_gtod_data.clock.vclock_mode))
2452 		return false;
2453 
2454 	return gtod_is_based_on_tsc(do_monotonic_raw(kernel_ns,
2455 						      tsc_timestamp));
2456 }
2457 
2458 /* returns true if host is using TSC based clocksource */
2459 static bool kvm_get_walltime_and_clockread(struct timespec64 *ts,
2460 					   u64 *tsc_timestamp)
2461 {
2462 	/* checked again under seqlock below */
2463 	if (!gtod_is_based_on_tsc(pvclock_gtod_data.clock.vclock_mode))
2464 		return false;
2465 
2466 	return gtod_is_based_on_tsc(do_realtime(ts, tsc_timestamp));
2467 }
2468 #endif
2469 
2470 /*
2471  *
2472  * Assuming a stable TSC across physical CPUS, and a stable TSC
2473  * across virtual CPUs, the following condition is possible.
2474  * Each numbered line represents an event visible to both
2475  * CPUs at the next numbered event.
2476  *
2477  * "timespecX" represents host monotonic time. "tscX" represents
2478  * RDTSC value.
2479  *
2480  * 		VCPU0 on CPU0		|	VCPU1 on CPU1
2481  *
2482  * 1.  read timespec0,tsc0
2483  * 2.					| timespec1 = timespec0 + N
2484  * 					| tsc1 = tsc0 + M
2485  * 3. transition to guest		| transition to guest
2486  * 4. ret0 = timespec0 + (rdtsc - tsc0) |
2487  * 5.				        | ret1 = timespec1 + (rdtsc - tsc1)
2488  * 				        | ret1 = timespec0 + N + (rdtsc - (tsc0 + M))
2489  *
2490  * Since ret0 update is visible to VCPU1 at time 5, to obey monotonicity:
2491  *
2492  * 	- ret0 < ret1
2493  *	- timespec0 + (rdtsc - tsc0) < timespec0 + N + (rdtsc - (tsc0 + M))
2494  *		...
2495  *	- 0 < N - M => M < N
2496  *
2497  * That is, when timespec0 != timespec1, M < N. Unfortunately that is not
2498  * always the case (the difference between two distinct xtime instances
2499  * might be smaller then the difference between corresponding TSC reads,
2500  * when updating guest vcpus pvclock areas).
2501  *
2502  * To avoid that problem, do not allow visibility of distinct
2503  * system_timestamp/tsc_timestamp values simultaneously: use a master
2504  * copy of host monotonic time values. Update that master copy
2505  * in lockstep.
2506  *
2507  * Rely on synchronization of host TSCs and guest TSCs for monotonicity.
2508  *
2509  */
2510 
2511 static void pvclock_update_vm_gtod_copy(struct kvm *kvm)
2512 {
2513 #ifdef CONFIG_X86_64
2514 	struct kvm_arch *ka = &kvm->arch;
2515 	int vclock_mode;
2516 	bool host_tsc_clocksource, vcpus_matched;
2517 
2518 	vcpus_matched = (ka->nr_vcpus_matched_tsc + 1 ==
2519 			atomic_read(&kvm->online_vcpus));
2520 
2521 	/*
2522 	 * If the host uses TSC clock, then passthrough TSC as stable
2523 	 * to the guest.
2524 	 */
2525 	host_tsc_clocksource = kvm_get_time_and_clockread(
2526 					&ka->master_kernel_ns,
2527 					&ka->master_cycle_now);
2528 
2529 	ka->use_master_clock = host_tsc_clocksource && vcpus_matched
2530 				&& !ka->backwards_tsc_observed
2531 				&& !ka->boot_vcpu_runs_old_kvmclock;
2532 
2533 	if (ka->use_master_clock)
2534 		atomic_set(&kvm_guest_has_master_clock, 1);
2535 
2536 	vclock_mode = pvclock_gtod_data.clock.vclock_mode;
2537 	trace_kvm_update_master_clock(ka->use_master_clock, vclock_mode,
2538 					vcpus_matched);
2539 #endif
2540 }
2541 
2542 void kvm_make_mclock_inprogress_request(struct kvm *kvm)
2543 {
2544 	kvm_make_all_cpus_request(kvm, KVM_REQ_MCLOCK_INPROGRESS);
2545 }
2546 
2547 static void kvm_gen_update_masterclock(struct kvm *kvm)
2548 {
2549 #ifdef CONFIG_X86_64
2550 	int i;
2551 	struct kvm_vcpu *vcpu;
2552 	struct kvm_arch *ka = &kvm->arch;
2553 
2554 	spin_lock(&ka->pvclock_gtod_sync_lock);
2555 	kvm_make_mclock_inprogress_request(kvm);
2556 	/* no guest entries from this point */
2557 	pvclock_update_vm_gtod_copy(kvm);
2558 
2559 	kvm_for_each_vcpu(i, vcpu, kvm)
2560 		kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
2561 
2562 	/* guest entries allowed */
2563 	kvm_for_each_vcpu(i, vcpu, kvm)
2564 		kvm_clear_request(KVM_REQ_MCLOCK_INPROGRESS, vcpu);
2565 
2566 	spin_unlock(&ka->pvclock_gtod_sync_lock);
2567 #endif
2568 }
2569 
2570 u64 get_kvmclock_ns(struct kvm *kvm)
2571 {
2572 	struct kvm_arch *ka = &kvm->arch;
2573 	struct pvclock_vcpu_time_info hv_clock;
2574 	u64 ret;
2575 
2576 	spin_lock(&ka->pvclock_gtod_sync_lock);
2577 	if (!ka->use_master_clock) {
2578 		spin_unlock(&ka->pvclock_gtod_sync_lock);
2579 		return get_kvmclock_base_ns() + ka->kvmclock_offset;
2580 	}
2581 
2582 	hv_clock.tsc_timestamp = ka->master_cycle_now;
2583 	hv_clock.system_time = ka->master_kernel_ns + ka->kvmclock_offset;
2584 	spin_unlock(&ka->pvclock_gtod_sync_lock);
2585 
2586 	/* both __this_cpu_read() and rdtsc() should be on the same cpu */
2587 	get_cpu();
2588 
2589 	if (__this_cpu_read(cpu_tsc_khz)) {
2590 		kvm_get_time_scale(NSEC_PER_SEC, __this_cpu_read(cpu_tsc_khz) * 1000LL,
2591 				   &hv_clock.tsc_shift,
2592 				   &hv_clock.tsc_to_system_mul);
2593 		ret = __pvclock_read_cycles(&hv_clock, rdtsc());
2594 	} else
2595 		ret = get_kvmclock_base_ns() + ka->kvmclock_offset;
2596 
2597 	put_cpu();
2598 
2599 	return ret;
2600 }
2601 
2602 static void kvm_setup_pvclock_page(struct kvm_vcpu *v,
2603 				   struct gfn_to_hva_cache *cache,
2604 				   unsigned int offset)
2605 {
2606 	struct kvm_vcpu_arch *vcpu = &v->arch;
2607 	struct pvclock_vcpu_time_info guest_hv_clock;
2608 
2609 	if (unlikely(kvm_read_guest_offset_cached(v->kvm, cache,
2610 		&guest_hv_clock, offset, sizeof(guest_hv_clock))))
2611 		return;
2612 
2613 	/* This VCPU is paused, but it's legal for a guest to read another
2614 	 * VCPU's kvmclock, so we really have to follow the specification where
2615 	 * it says that version is odd if data is being modified, and even after
2616 	 * it is consistent.
2617 	 *
2618 	 * Version field updates must be kept separate.  This is because
2619 	 * kvm_write_guest_cached might use a "rep movs" instruction, and
2620 	 * writes within a string instruction are weakly ordered.  So there
2621 	 * are three writes overall.
2622 	 *
2623 	 * As a small optimization, only write the version field in the first
2624 	 * and third write.  The vcpu->pv_time cache is still valid, because the
2625 	 * version field is the first in the struct.
2626 	 */
2627 	BUILD_BUG_ON(offsetof(struct pvclock_vcpu_time_info, version) != 0);
2628 
2629 	if (guest_hv_clock.version & 1)
2630 		++guest_hv_clock.version;  /* first time write, random junk */
2631 
2632 	vcpu->hv_clock.version = guest_hv_clock.version + 1;
2633 	kvm_write_guest_offset_cached(v->kvm, cache,
2634 				      &vcpu->hv_clock, offset,
2635 				      sizeof(vcpu->hv_clock.version));
2636 
2637 	smp_wmb();
2638 
2639 	/* retain PVCLOCK_GUEST_STOPPED if set in guest copy */
2640 	vcpu->hv_clock.flags |= (guest_hv_clock.flags & PVCLOCK_GUEST_STOPPED);
2641 
2642 	if (vcpu->pvclock_set_guest_stopped_request) {
2643 		vcpu->hv_clock.flags |= PVCLOCK_GUEST_STOPPED;
2644 		vcpu->pvclock_set_guest_stopped_request = false;
2645 	}
2646 
2647 	trace_kvm_pvclock_update(v->vcpu_id, &vcpu->hv_clock);
2648 
2649 	kvm_write_guest_offset_cached(v->kvm, cache,
2650 				      &vcpu->hv_clock, offset,
2651 				      sizeof(vcpu->hv_clock));
2652 
2653 	smp_wmb();
2654 
2655 	vcpu->hv_clock.version++;
2656 	kvm_write_guest_offset_cached(v->kvm, cache,
2657 				     &vcpu->hv_clock, offset,
2658 				     sizeof(vcpu->hv_clock.version));
2659 }
2660 
2661 static int kvm_guest_time_update(struct kvm_vcpu *v)
2662 {
2663 	unsigned long flags, tgt_tsc_khz;
2664 	struct kvm_vcpu_arch *vcpu = &v->arch;
2665 	struct kvm_arch *ka = &v->kvm->arch;
2666 	s64 kernel_ns;
2667 	u64 tsc_timestamp, host_tsc;
2668 	u8 pvclock_flags;
2669 	bool use_master_clock;
2670 
2671 	kernel_ns = 0;
2672 	host_tsc = 0;
2673 
2674 	/*
2675 	 * If the host uses TSC clock, then passthrough TSC as stable
2676 	 * to the guest.
2677 	 */
2678 	spin_lock(&ka->pvclock_gtod_sync_lock);
2679 	use_master_clock = ka->use_master_clock;
2680 	if (use_master_clock) {
2681 		host_tsc = ka->master_cycle_now;
2682 		kernel_ns = ka->master_kernel_ns;
2683 	}
2684 	spin_unlock(&ka->pvclock_gtod_sync_lock);
2685 
2686 	/* Keep irq disabled to prevent changes to the clock */
2687 	local_irq_save(flags);
2688 	tgt_tsc_khz = __this_cpu_read(cpu_tsc_khz);
2689 	if (unlikely(tgt_tsc_khz == 0)) {
2690 		local_irq_restore(flags);
2691 		kvm_make_request(KVM_REQ_CLOCK_UPDATE, v);
2692 		return 1;
2693 	}
2694 	if (!use_master_clock) {
2695 		host_tsc = rdtsc();
2696 		kernel_ns = get_kvmclock_base_ns();
2697 	}
2698 
2699 	tsc_timestamp = kvm_read_l1_tsc(v, host_tsc);
2700 
2701 	/*
2702 	 * We may have to catch up the TSC to match elapsed wall clock
2703 	 * time for two reasons, even if kvmclock is used.
2704 	 *   1) CPU could have been running below the maximum TSC rate
2705 	 *   2) Broken TSC compensation resets the base at each VCPU
2706 	 *      entry to avoid unknown leaps of TSC even when running
2707 	 *      again on the same CPU.  This may cause apparent elapsed
2708 	 *      time to disappear, and the guest to stand still or run
2709 	 *	very slowly.
2710 	 */
2711 	if (vcpu->tsc_catchup) {
2712 		u64 tsc = compute_guest_tsc(v, kernel_ns);
2713 		if (tsc > tsc_timestamp) {
2714 			adjust_tsc_offset_guest(v, tsc - tsc_timestamp);
2715 			tsc_timestamp = tsc;
2716 		}
2717 	}
2718 
2719 	local_irq_restore(flags);
2720 
2721 	/* With all the info we got, fill in the values */
2722 
2723 	if (kvm_has_tsc_control)
2724 		tgt_tsc_khz = kvm_scale_tsc(v, tgt_tsc_khz);
2725 
2726 	if (unlikely(vcpu->hw_tsc_khz != tgt_tsc_khz)) {
2727 		kvm_get_time_scale(NSEC_PER_SEC, tgt_tsc_khz * 1000LL,
2728 				   &vcpu->hv_clock.tsc_shift,
2729 				   &vcpu->hv_clock.tsc_to_system_mul);
2730 		vcpu->hw_tsc_khz = tgt_tsc_khz;
2731 	}
2732 
2733 	vcpu->hv_clock.tsc_timestamp = tsc_timestamp;
2734 	vcpu->hv_clock.system_time = kernel_ns + v->kvm->arch.kvmclock_offset;
2735 	vcpu->last_guest_tsc = tsc_timestamp;
2736 
2737 	/* If the host uses TSC clocksource, then it is stable */
2738 	pvclock_flags = 0;
2739 	if (use_master_clock)
2740 		pvclock_flags |= PVCLOCK_TSC_STABLE_BIT;
2741 
2742 	vcpu->hv_clock.flags = pvclock_flags;
2743 
2744 	if (vcpu->pv_time_enabled)
2745 		kvm_setup_pvclock_page(v, &vcpu->pv_time, 0);
2746 	if (vcpu->xen.vcpu_info_set)
2747 		kvm_setup_pvclock_page(v, &vcpu->xen.vcpu_info_cache,
2748 				       offsetof(struct compat_vcpu_info, time));
2749 	if (vcpu->xen.vcpu_time_info_set)
2750 		kvm_setup_pvclock_page(v, &vcpu->xen.vcpu_time_info_cache, 0);
2751 	if (v == kvm_get_vcpu(v->kvm, 0))
2752 		kvm_hv_setup_tsc_page(v->kvm, &vcpu->hv_clock);
2753 	return 0;
2754 }
2755 
2756 /*
2757  * kvmclock updates which are isolated to a given vcpu, such as
2758  * vcpu->cpu migration, should not allow system_timestamp from
2759  * the rest of the vcpus to remain static. Otherwise ntp frequency
2760  * correction applies to one vcpu's system_timestamp but not
2761  * the others.
2762  *
2763  * So in those cases, request a kvmclock update for all vcpus.
2764  * We need to rate-limit these requests though, as they can
2765  * considerably slow guests that have a large number of vcpus.
2766  * The time for a remote vcpu to update its kvmclock is bound
2767  * by the delay we use to rate-limit the updates.
2768  */
2769 
2770 #define KVMCLOCK_UPDATE_DELAY msecs_to_jiffies(100)
2771 
2772 static void kvmclock_update_fn(struct work_struct *work)
2773 {
2774 	int i;
2775 	struct delayed_work *dwork = to_delayed_work(work);
2776 	struct kvm_arch *ka = container_of(dwork, struct kvm_arch,
2777 					   kvmclock_update_work);
2778 	struct kvm *kvm = container_of(ka, struct kvm, arch);
2779 	struct kvm_vcpu *vcpu;
2780 
2781 	kvm_for_each_vcpu(i, vcpu, kvm) {
2782 		kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
2783 		kvm_vcpu_kick(vcpu);
2784 	}
2785 }
2786 
2787 static void kvm_gen_kvmclock_update(struct kvm_vcpu *v)
2788 {
2789 	struct kvm *kvm = v->kvm;
2790 
2791 	kvm_make_request(KVM_REQ_CLOCK_UPDATE, v);
2792 	schedule_delayed_work(&kvm->arch.kvmclock_update_work,
2793 					KVMCLOCK_UPDATE_DELAY);
2794 }
2795 
2796 #define KVMCLOCK_SYNC_PERIOD (300 * HZ)
2797 
2798 static void kvmclock_sync_fn(struct work_struct *work)
2799 {
2800 	struct delayed_work *dwork = to_delayed_work(work);
2801 	struct kvm_arch *ka = container_of(dwork, struct kvm_arch,
2802 					   kvmclock_sync_work);
2803 	struct kvm *kvm = container_of(ka, struct kvm, arch);
2804 
2805 	if (!kvmclock_periodic_sync)
2806 		return;
2807 
2808 	schedule_delayed_work(&kvm->arch.kvmclock_update_work, 0);
2809 	schedule_delayed_work(&kvm->arch.kvmclock_sync_work,
2810 					KVMCLOCK_SYNC_PERIOD);
2811 }
2812 
2813 /*
2814  * On AMD, HWCR[McStatusWrEn] controls whether setting MCi_STATUS results in #GP.
2815  */
2816 static bool can_set_mci_status(struct kvm_vcpu *vcpu)
2817 {
2818 	/* McStatusWrEn enabled? */
2819 	if (guest_cpuid_is_amd_or_hygon(vcpu))
2820 		return !!(vcpu->arch.msr_hwcr & BIT_ULL(18));
2821 
2822 	return false;
2823 }
2824 
2825 static int set_msr_mce(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
2826 {
2827 	u64 mcg_cap = vcpu->arch.mcg_cap;
2828 	unsigned bank_num = mcg_cap & 0xff;
2829 	u32 msr = msr_info->index;
2830 	u64 data = msr_info->data;
2831 
2832 	switch (msr) {
2833 	case MSR_IA32_MCG_STATUS:
2834 		vcpu->arch.mcg_status = data;
2835 		break;
2836 	case MSR_IA32_MCG_CTL:
2837 		if (!(mcg_cap & MCG_CTL_P) &&
2838 		    (data || !msr_info->host_initiated))
2839 			return 1;
2840 		if (data != 0 && data != ~(u64)0)
2841 			return 1;
2842 		vcpu->arch.mcg_ctl = data;
2843 		break;
2844 	default:
2845 		if (msr >= MSR_IA32_MC0_CTL &&
2846 		    msr < MSR_IA32_MCx_CTL(bank_num)) {
2847 			u32 offset = array_index_nospec(
2848 				msr - MSR_IA32_MC0_CTL,
2849 				MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);
2850 
2851 			/* only 0 or all 1s can be written to IA32_MCi_CTL
2852 			 * some Linux kernels though clear bit 10 in bank 4 to
2853 			 * workaround a BIOS/GART TBL issue on AMD K8s, ignore
2854 			 * this to avoid an uncatched #GP in the guest
2855 			 */
2856 			if ((offset & 0x3) == 0 &&
2857 			    data != 0 && (data | (1 << 10)) != ~(u64)0)
2858 				return -1;
2859 
2860 			/* MCi_STATUS */
2861 			if (!msr_info->host_initiated &&
2862 			    (offset & 0x3) == 1 && data != 0) {
2863 				if (!can_set_mci_status(vcpu))
2864 					return -1;
2865 			}
2866 
2867 			vcpu->arch.mce_banks[offset] = data;
2868 			break;
2869 		}
2870 		return 1;
2871 	}
2872 	return 0;
2873 }
2874 
2875 static inline bool kvm_pv_async_pf_enabled(struct kvm_vcpu *vcpu)
2876 {
2877 	u64 mask = KVM_ASYNC_PF_ENABLED | KVM_ASYNC_PF_DELIVERY_AS_INT;
2878 
2879 	return (vcpu->arch.apf.msr_en_val & mask) == mask;
2880 }
2881 
2882 static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
2883 {
2884 	gpa_t gpa = data & ~0x3f;
2885 
2886 	/* Bits 4:5 are reserved, Should be zero */
2887 	if (data & 0x30)
2888 		return 1;
2889 
2890 	if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_VMEXIT) &&
2891 	    (data & KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT))
2892 		return 1;
2893 
2894 	if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT) &&
2895 	    (data & KVM_ASYNC_PF_DELIVERY_AS_INT))
2896 		return 1;
2897 
2898 	if (!lapic_in_kernel(vcpu))
2899 		return data ? 1 : 0;
2900 
2901 	vcpu->arch.apf.msr_en_val = data;
2902 
2903 	if (!kvm_pv_async_pf_enabled(vcpu)) {
2904 		kvm_clear_async_pf_completion_queue(vcpu);
2905 		kvm_async_pf_hash_reset(vcpu);
2906 		return 0;
2907 	}
2908 
2909 	if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
2910 					sizeof(u64)))
2911 		return 1;
2912 
2913 	vcpu->arch.apf.send_user_only = !(data & KVM_ASYNC_PF_SEND_ALWAYS);
2914 	vcpu->arch.apf.delivery_as_pf_vmexit = data & KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT;
2915 
2916 	kvm_async_pf_wakeup_all(vcpu);
2917 
2918 	return 0;
2919 }
2920 
2921 static int kvm_pv_enable_async_pf_int(struct kvm_vcpu *vcpu, u64 data)
2922 {
2923 	/* Bits 8-63 are reserved */
2924 	if (data >> 8)
2925 		return 1;
2926 
2927 	if (!lapic_in_kernel(vcpu))
2928 		return 1;
2929 
2930 	vcpu->arch.apf.msr_int_val = data;
2931 
2932 	vcpu->arch.apf.vec = data & KVM_ASYNC_PF_VEC_MASK;
2933 
2934 	return 0;
2935 }
2936 
2937 static void kvmclock_reset(struct kvm_vcpu *vcpu)
2938 {
2939 	vcpu->arch.pv_time_enabled = false;
2940 	vcpu->arch.time = 0;
2941 }
2942 
2943 static void kvm_vcpu_flush_tlb_all(struct kvm_vcpu *vcpu)
2944 {
2945 	++vcpu->stat.tlb_flush;
2946 	static_call(kvm_x86_tlb_flush_all)(vcpu);
2947 }
2948 
2949 static void kvm_vcpu_flush_tlb_guest(struct kvm_vcpu *vcpu)
2950 {
2951 	++vcpu->stat.tlb_flush;
2952 	static_call(kvm_x86_tlb_flush_guest)(vcpu);
2953 }
2954 
2955 static void record_steal_time(struct kvm_vcpu *vcpu)
2956 {
2957 	struct kvm_host_map map;
2958 	struct kvm_steal_time *st;
2959 
2960 	if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
2961 		return;
2962 
2963 	/* -EAGAIN is returned in atomic context so we can just return. */
2964 	if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT,
2965 			&map, &vcpu->arch.st.cache, false))
2966 		return;
2967 
2968 	st = map.hva +
2969 		offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
2970 
2971 	/*
2972 	 * Doing a TLB flush here, on the guest's behalf, can avoid
2973 	 * expensive IPIs.
2974 	 */
2975 	if (guest_pv_has(vcpu, KVM_FEATURE_PV_TLB_FLUSH)) {
2976 		trace_kvm_pv_tlb_flush(vcpu->vcpu_id,
2977 				       st->preempted & KVM_VCPU_FLUSH_TLB);
2978 		if (xchg(&st->preempted, 0) & KVM_VCPU_FLUSH_TLB)
2979 			kvm_vcpu_flush_tlb_guest(vcpu);
2980 	}
2981 
2982 	vcpu->arch.st.preempted = 0;
2983 
2984 	if (st->version & 1)
2985 		st->version += 1;  /* first time write, random junk */
2986 
2987 	st->version += 1;
2988 
2989 	smp_wmb();
2990 
2991 	st->steal += current->sched_info.run_delay -
2992 		vcpu->arch.st.last_steal;
2993 	vcpu->arch.st.last_steal = current->sched_info.run_delay;
2994 
2995 	smp_wmb();
2996 
2997 	st->version += 1;
2998 
2999 	kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, false);
3000 }
3001 
3002 int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
3003 {
3004 	bool pr = false;
3005 	u32 msr = msr_info->index;
3006 	u64 data = msr_info->data;
3007 
3008 	if (msr && msr == vcpu->kvm->arch.xen_hvm_config.msr)
3009 		return kvm_xen_write_hypercall_page(vcpu, data);
3010 
3011 	switch (msr) {
3012 	case MSR_AMD64_NB_CFG:
3013 	case MSR_IA32_UCODE_WRITE:
3014 	case MSR_VM_HSAVE_PA:
3015 	case MSR_AMD64_PATCH_LOADER:
3016 	case MSR_AMD64_BU_CFG2:
3017 	case MSR_AMD64_DC_CFG:
3018 	case MSR_F15H_EX_CFG:
3019 		break;
3020 
3021 	case MSR_IA32_UCODE_REV:
3022 		if (msr_info->host_initiated)
3023 			vcpu->arch.microcode_version = data;
3024 		break;
3025 	case MSR_IA32_ARCH_CAPABILITIES:
3026 		if (!msr_info->host_initiated)
3027 			return 1;
3028 		vcpu->arch.arch_capabilities = data;
3029 		break;
3030 	case MSR_IA32_PERF_CAPABILITIES: {
3031 		struct kvm_msr_entry msr_ent = {.index = msr, .data = 0};
3032 
3033 		if (!msr_info->host_initiated)
3034 			return 1;
3035 		if (guest_cpuid_has(vcpu, X86_FEATURE_PDCM) && kvm_get_msr_feature(&msr_ent))
3036 			return 1;
3037 		if (data & ~msr_ent.data)
3038 			return 1;
3039 
3040 		vcpu->arch.perf_capabilities = data;
3041 
3042 		return 0;
3043 		}
3044 	case MSR_EFER:
3045 		return set_efer(vcpu, msr_info);
3046 	case MSR_K7_HWCR:
3047 		data &= ~(u64)0x40;	/* ignore flush filter disable */
3048 		data &= ~(u64)0x100;	/* ignore ignne emulation enable */
3049 		data &= ~(u64)0x8;	/* ignore TLB cache disable */
3050 
3051 		/* Handle McStatusWrEn */
3052 		if (data == BIT_ULL(18)) {
3053 			vcpu->arch.msr_hwcr = data;
3054 		} else if (data != 0) {
3055 			vcpu_unimpl(vcpu, "unimplemented HWCR wrmsr: 0x%llx\n",
3056 				    data);
3057 			return 1;
3058 		}
3059 		break;
3060 	case MSR_FAM10H_MMIO_CONF_BASE:
3061 		if (data != 0) {
3062 			vcpu_unimpl(vcpu, "unimplemented MMIO_CONF_BASE wrmsr: "
3063 				    "0x%llx\n", data);
3064 			return 1;
3065 		}
3066 		break;
3067 	case 0x200 ... 0x2ff:
3068 		return kvm_mtrr_set_msr(vcpu, msr, data);
3069 	case MSR_IA32_APICBASE:
3070 		return kvm_set_apic_base(vcpu, msr_info);
3071 	case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
3072 		return kvm_x2apic_msr_write(vcpu, msr, data);
3073 	case MSR_IA32_TSCDEADLINE:
3074 		kvm_set_lapic_tscdeadline_msr(vcpu, data);
3075 		break;
3076 	case MSR_IA32_TSC_ADJUST:
3077 		if (guest_cpuid_has(vcpu, X86_FEATURE_TSC_ADJUST)) {
3078 			if (!msr_info->host_initiated) {
3079 				s64 adj = data - vcpu->arch.ia32_tsc_adjust_msr;
3080 				adjust_tsc_offset_guest(vcpu, adj);
3081 			}
3082 			vcpu->arch.ia32_tsc_adjust_msr = data;
3083 		}
3084 		break;
3085 	case MSR_IA32_MISC_ENABLE:
3086 		if (!kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT) &&
3087 		    ((vcpu->arch.ia32_misc_enable_msr ^ data) & MSR_IA32_MISC_ENABLE_MWAIT)) {
3088 			if (!guest_cpuid_has(vcpu, X86_FEATURE_XMM3))
3089 				return 1;
3090 			vcpu->arch.ia32_misc_enable_msr = data;
3091 			kvm_update_cpuid_runtime(vcpu);
3092 		} else {
3093 			vcpu->arch.ia32_misc_enable_msr = data;
3094 		}
3095 		break;
3096 	case MSR_IA32_SMBASE:
3097 		if (!msr_info->host_initiated)
3098 			return 1;
3099 		vcpu->arch.smbase = data;
3100 		break;
3101 	case MSR_IA32_POWER_CTL:
3102 		vcpu->arch.msr_ia32_power_ctl = data;
3103 		break;
3104 	case MSR_IA32_TSC:
3105 		if (msr_info->host_initiated) {
3106 			kvm_synchronize_tsc(vcpu, data);
3107 		} else {
3108 			u64 adj = kvm_compute_tsc_offset(vcpu, data) - vcpu->arch.l1_tsc_offset;
3109 			adjust_tsc_offset_guest(vcpu, adj);
3110 			vcpu->arch.ia32_tsc_adjust_msr += adj;
3111 		}
3112 		break;
3113 	case MSR_IA32_XSS:
3114 		if (!msr_info->host_initiated &&
3115 		    !guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))
3116 			return 1;
3117 		/*
3118 		 * KVM supports exposing PT to the guest, but does not support
3119 		 * IA32_XSS[bit 8]. Guests have to use RDMSR/WRMSR rather than
3120 		 * XSAVES/XRSTORS to save/restore PT MSRs.
3121 		 */
3122 		if (data & ~supported_xss)
3123 			return 1;
3124 		vcpu->arch.ia32_xss = data;
3125 		break;
3126 	case MSR_SMI_COUNT:
3127 		if (!msr_info->host_initiated)
3128 			return 1;
3129 		vcpu->arch.smi_count = data;
3130 		break;
3131 	case MSR_KVM_WALL_CLOCK_NEW:
3132 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
3133 			return 1;
3134 
3135 		vcpu->kvm->arch.wall_clock = data;
3136 		kvm_write_wall_clock(vcpu->kvm, data, 0);
3137 		break;
3138 	case MSR_KVM_WALL_CLOCK:
3139 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
3140 			return 1;
3141 
3142 		vcpu->kvm->arch.wall_clock = data;
3143 		kvm_write_wall_clock(vcpu->kvm, data, 0);
3144 		break;
3145 	case MSR_KVM_SYSTEM_TIME_NEW:
3146 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
3147 			return 1;
3148 
3149 		kvm_write_system_time(vcpu, data, false, msr_info->host_initiated);
3150 		break;
3151 	case MSR_KVM_SYSTEM_TIME:
3152 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
3153 			return 1;
3154 
3155 		kvm_write_system_time(vcpu, data, true,  msr_info->host_initiated);
3156 		break;
3157 	case MSR_KVM_ASYNC_PF_EN:
3158 		if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
3159 			return 1;
3160 
3161 		if (kvm_pv_enable_async_pf(vcpu, data))
3162 			return 1;
3163 		break;
3164 	case MSR_KVM_ASYNC_PF_INT:
3165 		if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
3166 			return 1;
3167 
3168 		if (kvm_pv_enable_async_pf_int(vcpu, data))
3169 			return 1;
3170 		break;
3171 	case MSR_KVM_ASYNC_PF_ACK:
3172 		if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
3173 			return 1;
3174 		if (data & 0x1) {
3175 			vcpu->arch.apf.pageready_pending = false;
3176 			kvm_check_async_pf_completion(vcpu);
3177 		}
3178 		break;
3179 	case MSR_KVM_STEAL_TIME:
3180 		if (!guest_pv_has(vcpu, KVM_FEATURE_STEAL_TIME))
3181 			return 1;
3182 
3183 		if (unlikely(!sched_info_on()))
3184 			return 1;
3185 
3186 		if (data & KVM_STEAL_RESERVED_MASK)
3187 			return 1;
3188 
3189 		vcpu->arch.st.msr_val = data;
3190 
3191 		if (!(data & KVM_MSR_ENABLED))
3192 			break;
3193 
3194 		kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
3195 
3196 		break;
3197 	case MSR_KVM_PV_EOI_EN:
3198 		if (!guest_pv_has(vcpu, KVM_FEATURE_PV_EOI))
3199 			return 1;
3200 
3201 		if (kvm_lapic_enable_pv_eoi(vcpu, data, sizeof(u8)))
3202 			return 1;
3203 		break;
3204 
3205 	case MSR_KVM_POLL_CONTROL:
3206 		if (!guest_pv_has(vcpu, KVM_FEATURE_POLL_CONTROL))
3207 			return 1;
3208 
3209 		/* only enable bit supported */
3210 		if (data & (-1ULL << 1))
3211 			return 1;
3212 
3213 		vcpu->arch.msr_kvm_poll_control = data;
3214 		break;
3215 
3216 	case MSR_IA32_MCG_CTL:
3217 	case MSR_IA32_MCG_STATUS:
3218 	case MSR_IA32_MC0_CTL ... MSR_IA32_MCx_CTL(KVM_MAX_MCE_BANKS) - 1:
3219 		return set_msr_mce(vcpu, msr_info);
3220 
3221 	case MSR_K7_PERFCTR0 ... MSR_K7_PERFCTR3:
3222 	case MSR_P6_PERFCTR0 ... MSR_P6_PERFCTR1:
3223 		pr = true;
3224 		fallthrough;
3225 	case MSR_K7_EVNTSEL0 ... MSR_K7_EVNTSEL3:
3226 	case MSR_P6_EVNTSEL0 ... MSR_P6_EVNTSEL1:
3227 		if (kvm_pmu_is_valid_msr(vcpu, msr))
3228 			return kvm_pmu_set_msr(vcpu, msr_info);
3229 
3230 		if (pr || data != 0)
3231 			vcpu_unimpl(vcpu, "disabled perfctr wrmsr: "
3232 				    "0x%x data 0x%llx\n", msr, data);
3233 		break;
3234 	case MSR_K7_CLK_CTL:
3235 		/*
3236 		 * Ignore all writes to this no longer documented MSR.
3237 		 * Writes are only relevant for old K7 processors,
3238 		 * all pre-dating SVM, but a recommended workaround from
3239 		 * AMD for these chips. It is possible to specify the
3240 		 * affected processor models on the command line, hence
3241 		 * the need to ignore the workaround.
3242 		 */
3243 		break;
3244 	case HV_X64_MSR_GUEST_OS_ID ... HV_X64_MSR_SINT15:
3245 	case HV_X64_MSR_SYNDBG_CONTROL ... HV_X64_MSR_SYNDBG_PENDING_BUFFER:
3246 	case HV_X64_MSR_SYNDBG_OPTIONS:
3247 	case HV_X64_MSR_CRASH_P0 ... HV_X64_MSR_CRASH_P4:
3248 	case HV_X64_MSR_CRASH_CTL:
3249 	case HV_X64_MSR_STIMER0_CONFIG ... HV_X64_MSR_STIMER3_COUNT:
3250 	case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
3251 	case HV_X64_MSR_TSC_EMULATION_CONTROL:
3252 	case HV_X64_MSR_TSC_EMULATION_STATUS:
3253 		return kvm_hv_set_msr_common(vcpu, msr, data,
3254 					     msr_info->host_initiated);
3255 	case MSR_IA32_BBL_CR_CTL3:
3256 		/* Drop writes to this legacy MSR -- see rdmsr
3257 		 * counterpart for further detail.
3258 		 */
3259 		if (report_ignored_msrs)
3260 			vcpu_unimpl(vcpu, "ignored wrmsr: 0x%x data 0x%llx\n",
3261 				msr, data);
3262 		break;
3263 	case MSR_AMD64_OSVW_ID_LENGTH:
3264 		if (!guest_cpuid_has(vcpu, X86_FEATURE_OSVW))
3265 			return 1;
3266 		vcpu->arch.osvw.length = data;
3267 		break;
3268 	case MSR_AMD64_OSVW_STATUS:
3269 		if (!guest_cpuid_has(vcpu, X86_FEATURE_OSVW))
3270 			return 1;
3271 		vcpu->arch.osvw.status = data;
3272 		break;
3273 	case MSR_PLATFORM_INFO:
3274 		if (!msr_info->host_initiated ||
3275 		    (!(data & MSR_PLATFORM_INFO_CPUID_FAULT) &&
3276 		     cpuid_fault_enabled(vcpu)))
3277 			return 1;
3278 		vcpu->arch.msr_platform_info = data;
3279 		break;
3280 	case MSR_MISC_FEATURES_ENABLES:
3281 		if (data & ~MSR_MISC_FEATURES_ENABLES_CPUID_FAULT ||
3282 		    (data & MSR_MISC_FEATURES_ENABLES_CPUID_FAULT &&
3283 		     !supports_cpuid_fault(vcpu)))
3284 			return 1;
3285 		vcpu->arch.msr_misc_features_enables = data;
3286 		break;
3287 	default:
3288 		if (kvm_pmu_is_valid_msr(vcpu, msr))
3289 			return kvm_pmu_set_msr(vcpu, msr_info);
3290 		return KVM_MSR_RET_INVALID;
3291 	}
3292 	return 0;
3293 }
3294 EXPORT_SYMBOL_GPL(kvm_set_msr_common);
3295 
3296 static int get_msr_mce(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata, bool host)
3297 {
3298 	u64 data;
3299 	u64 mcg_cap = vcpu->arch.mcg_cap;
3300 	unsigned bank_num = mcg_cap & 0xff;
3301 
3302 	switch (msr) {
3303 	case MSR_IA32_P5_MC_ADDR:
3304 	case MSR_IA32_P5_MC_TYPE:
3305 		data = 0;
3306 		break;
3307 	case MSR_IA32_MCG_CAP:
3308 		data = vcpu->arch.mcg_cap;
3309 		break;
3310 	case MSR_IA32_MCG_CTL:
3311 		if (!(mcg_cap & MCG_CTL_P) && !host)
3312 			return 1;
3313 		data = vcpu->arch.mcg_ctl;
3314 		break;
3315 	case MSR_IA32_MCG_STATUS:
3316 		data = vcpu->arch.mcg_status;
3317 		break;
3318 	default:
3319 		if (msr >= MSR_IA32_MC0_CTL &&
3320 		    msr < MSR_IA32_MCx_CTL(bank_num)) {
3321 			u32 offset = array_index_nospec(
3322 				msr - MSR_IA32_MC0_CTL,
3323 				MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);
3324 
3325 			data = vcpu->arch.mce_banks[offset];
3326 			break;
3327 		}
3328 		return 1;
3329 	}
3330 	*pdata = data;
3331 	return 0;
3332 }
3333 
3334 int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
3335 {
3336 	switch (msr_info->index) {
3337 	case MSR_IA32_PLATFORM_ID:
3338 	case MSR_IA32_EBL_CR_POWERON:
3339 	case MSR_IA32_LASTBRANCHFROMIP:
3340 	case MSR_IA32_LASTBRANCHTOIP:
3341 	case MSR_IA32_LASTINTFROMIP:
3342 	case MSR_IA32_LASTINTTOIP:
3343 	case MSR_K8_SYSCFG:
3344 	case MSR_K8_TSEG_ADDR:
3345 	case MSR_K8_TSEG_MASK:
3346 	case MSR_VM_HSAVE_PA:
3347 	case MSR_K8_INT_PENDING_MSG:
3348 	case MSR_AMD64_NB_CFG:
3349 	case MSR_FAM10H_MMIO_CONF_BASE:
3350 	case MSR_AMD64_BU_CFG2:
3351 	case MSR_IA32_PERF_CTL:
3352 	case MSR_AMD64_DC_CFG:
3353 	case MSR_F15H_EX_CFG:
3354 	/*
3355 	 * Intel Sandy Bridge CPUs must support the RAPL (running average power
3356 	 * limit) MSRs. Just return 0, as we do not want to expose the host
3357 	 * data here. Do not conditionalize this on CPUID, as KVM does not do
3358 	 * so for existing CPU-specific MSRs.
3359 	 */
3360 	case MSR_RAPL_POWER_UNIT:
3361 	case MSR_PP0_ENERGY_STATUS:	/* Power plane 0 (core) */
3362 	case MSR_PP1_ENERGY_STATUS:	/* Power plane 1 (graphics uncore) */
3363 	case MSR_PKG_ENERGY_STATUS:	/* Total package */
3364 	case MSR_DRAM_ENERGY_STATUS:	/* DRAM controller */
3365 		msr_info->data = 0;
3366 		break;
3367 	case MSR_F15H_PERF_CTL0 ... MSR_F15H_PERF_CTR5:
3368 	case MSR_K7_EVNTSEL0 ... MSR_K7_EVNTSEL3:
3369 	case MSR_K7_PERFCTR0 ... MSR_K7_PERFCTR3:
3370 	case MSR_P6_PERFCTR0 ... MSR_P6_PERFCTR1:
3371 	case MSR_P6_EVNTSEL0 ... MSR_P6_EVNTSEL1:
3372 		if (kvm_pmu_is_valid_msr(vcpu, msr_info->index))
3373 			return kvm_pmu_get_msr(vcpu, msr_info);
3374 		msr_info->data = 0;
3375 		break;
3376 	case MSR_IA32_UCODE_REV:
3377 		msr_info->data = vcpu->arch.microcode_version;
3378 		break;
3379 	case MSR_IA32_ARCH_CAPABILITIES:
3380 		if (!msr_info->host_initiated &&
3381 		    !guest_cpuid_has(vcpu, X86_FEATURE_ARCH_CAPABILITIES))
3382 			return 1;
3383 		msr_info->data = vcpu->arch.arch_capabilities;
3384 		break;
3385 	case MSR_IA32_PERF_CAPABILITIES:
3386 		if (!msr_info->host_initiated &&
3387 		    !guest_cpuid_has(vcpu, X86_FEATURE_PDCM))
3388 			return 1;
3389 		msr_info->data = vcpu->arch.perf_capabilities;
3390 		break;
3391 	case MSR_IA32_POWER_CTL:
3392 		msr_info->data = vcpu->arch.msr_ia32_power_ctl;
3393 		break;
3394 	case MSR_IA32_TSC: {
3395 		/*
3396 		 * Intel SDM states that MSR_IA32_TSC read adds the TSC offset
3397 		 * even when not intercepted. AMD manual doesn't explicitly
3398 		 * state this but appears to behave the same.
3399 		 *
3400 		 * On userspace reads and writes, however, we unconditionally
3401 		 * return L1's TSC value to ensure backwards-compatible
3402 		 * behavior for migration.
3403 		 */
3404 		u64 tsc_offset = msr_info->host_initiated ? vcpu->arch.l1_tsc_offset :
3405 							    vcpu->arch.tsc_offset;
3406 
3407 		msr_info->data = kvm_scale_tsc(vcpu, rdtsc()) + tsc_offset;
3408 		break;
3409 	}
3410 	case MSR_MTRRcap:
3411 	case 0x200 ... 0x2ff:
3412 		return kvm_mtrr_get_msr(vcpu, msr_info->index, &msr_info->data);
3413 	case 0xcd: /* fsb frequency */
3414 		msr_info->data = 3;
3415 		break;
3416 		/*
3417 		 * MSR_EBC_FREQUENCY_ID
3418 		 * Conservative value valid for even the basic CPU models.
3419 		 * Models 0,1: 000 in bits 23:21 indicating a bus speed of
3420 		 * 100MHz, model 2 000 in bits 18:16 indicating 100MHz,
3421 		 * and 266MHz for model 3, or 4. Set Core Clock
3422 		 * Frequency to System Bus Frequency Ratio to 1 (bits
3423 		 * 31:24) even though these are only valid for CPU
3424 		 * models > 2, however guests may end up dividing or
3425 		 * multiplying by zero otherwise.
3426 		 */
3427 	case MSR_EBC_FREQUENCY_ID:
3428 		msr_info->data = 1 << 24;
3429 		break;
3430 	case MSR_IA32_APICBASE:
3431 		msr_info->data = kvm_get_apic_base(vcpu);
3432 		break;
3433 	case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
3434 		return kvm_x2apic_msr_read(vcpu, msr_info->index, &msr_info->data);
3435 	case MSR_IA32_TSCDEADLINE:
3436 		msr_info->data = kvm_get_lapic_tscdeadline_msr(vcpu);
3437 		break;
3438 	case MSR_IA32_TSC_ADJUST:
3439 		msr_info->data = (u64)vcpu->arch.ia32_tsc_adjust_msr;
3440 		break;
3441 	case MSR_IA32_MISC_ENABLE:
3442 		msr_info->data = vcpu->arch.ia32_misc_enable_msr;
3443 		break;
3444 	case MSR_IA32_SMBASE:
3445 		if (!msr_info->host_initiated)
3446 			return 1;
3447 		msr_info->data = vcpu->arch.smbase;
3448 		break;
3449 	case MSR_SMI_COUNT:
3450 		msr_info->data = vcpu->arch.smi_count;
3451 		break;
3452 	case MSR_IA32_PERF_STATUS:
3453 		/* TSC increment by tick */
3454 		msr_info->data = 1000ULL;
3455 		/* CPU multiplier */
3456 		msr_info->data |= (((uint64_t)4ULL) << 40);
3457 		break;
3458 	case MSR_EFER:
3459 		msr_info->data = vcpu->arch.efer;
3460 		break;
3461 	case MSR_KVM_WALL_CLOCK:
3462 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
3463 			return 1;
3464 
3465 		msr_info->data = vcpu->kvm->arch.wall_clock;
3466 		break;
3467 	case MSR_KVM_WALL_CLOCK_NEW:
3468 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
3469 			return 1;
3470 
3471 		msr_info->data = vcpu->kvm->arch.wall_clock;
3472 		break;
3473 	case MSR_KVM_SYSTEM_TIME:
3474 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
3475 			return 1;
3476 
3477 		msr_info->data = vcpu->arch.time;
3478 		break;
3479 	case MSR_KVM_SYSTEM_TIME_NEW:
3480 		if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
3481 			return 1;
3482 
3483 		msr_info->data = vcpu->arch.time;
3484 		break;
3485 	case MSR_KVM_ASYNC_PF_EN:
3486 		if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
3487 			return 1;
3488 
3489 		msr_info->data = vcpu->arch.apf.msr_en_val;
3490 		break;
3491 	case MSR_KVM_ASYNC_PF_INT:
3492 		if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
3493 			return 1;
3494 
3495 		msr_info->data = vcpu->arch.apf.msr_int_val;
3496 		break;
3497 	case MSR_KVM_ASYNC_PF_ACK:
3498 		if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
3499 			return 1;
3500 
3501 		msr_info->data = 0;
3502 		break;
3503 	case MSR_KVM_STEAL_TIME:
3504 		if (!guest_pv_has(vcpu, KVM_FEATURE_STEAL_TIME))
3505 			return 1;
3506 
3507 		msr_info->data = vcpu->arch.st.msr_val;
3508 		break;
3509 	case MSR_KVM_PV_EOI_EN:
3510 		if (!guest_pv_has(vcpu, KVM_FEATURE_PV_EOI))
3511 			return 1;
3512 
3513 		msr_info->data = vcpu->arch.pv_eoi.msr_val;
3514 		break;
3515 	case MSR_KVM_POLL_CONTROL:
3516 		if (!guest_pv_has(vcpu, KVM_FEATURE_POLL_CONTROL))
3517 			return 1;
3518 
3519 		msr_info->data = vcpu->arch.msr_kvm_poll_control;
3520 		break;
3521 	case MSR_IA32_P5_MC_ADDR:
3522 	case MSR_IA32_P5_MC_TYPE:
3523 	case MSR_IA32_MCG_CAP:
3524 	case MSR_IA32_MCG_CTL:
3525 	case MSR_IA32_MCG_STATUS:
3526 	case MSR_IA32_MC0_CTL ... MSR_IA32_MCx_CTL(KVM_MAX_MCE_BANKS) - 1:
3527 		return get_msr_mce(vcpu, msr_info->index, &msr_info->data,
3528 				   msr_info->host_initiated);
3529 	case MSR_IA32_XSS:
3530 		if (!msr_info->host_initiated &&
3531 		    !guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))
3532 			return 1;
3533 		msr_info->data = vcpu->arch.ia32_xss;
3534 		break;
3535 	case MSR_K7_CLK_CTL:
3536 		/*
3537 		 * Provide expected ramp-up count for K7. All other
3538 		 * are set to zero, indicating minimum divisors for
3539 		 * every field.
3540 		 *
3541 		 * This prevents guest kernels on AMD host with CPU
3542 		 * type 6, model 8 and higher from exploding due to
3543 		 * the rdmsr failing.
3544 		 */
3545 		msr_info->data = 0x20000000;
3546 		break;
3547 	case HV_X64_MSR_GUEST_OS_ID ... HV_X64_MSR_SINT15:
3548 	case HV_X64_MSR_SYNDBG_CONTROL ... HV_X64_MSR_SYNDBG_PENDING_BUFFER:
3549 	case HV_X64_MSR_SYNDBG_OPTIONS:
3550 	case HV_X64_MSR_CRASH_P0 ... HV_X64_MSR_CRASH_P4:
3551 	case HV_X64_MSR_CRASH_CTL:
3552 	case HV_X64_MSR_STIMER0_CONFIG ... HV_X64_MSR_STIMER3_COUNT:
3553 	case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
3554 	case HV_X64_MSR_TSC_EMULATION_CONTROL:
3555 	case HV_X64_MSR_TSC_EMULATION_STATUS:
3556 		return kvm_hv_get_msr_common(vcpu,
3557 					     msr_info->index, &msr_info->data,
3558 					     msr_info->host_initiated);
3559 	case MSR_IA32_BBL_CR_CTL3:
3560 		/* This legacy MSR exists but isn't fully documented in current
3561 		 * silicon.  It is however accessed by winxp in very narrow
3562 		 * scenarios where it sets bit #19, itself documented as
3563 		 * a "reserved" bit.  Best effort attempt to source coherent
3564 		 * read data here should the balance of the register be
3565 		 * interpreted by the guest:
3566 		 *
3567 		 * L2 cache control register 3: 64GB range, 256KB size,
3568 		 * enabled, latency 0x1, configured
3569 		 */
3570 		msr_info->data = 0xbe702111;
3571 		break;
3572 	case MSR_AMD64_OSVW_ID_LENGTH:
3573 		if (!guest_cpuid_has(vcpu, X86_FEATURE_OSVW))
3574 			return 1;
3575 		msr_info->data = vcpu->arch.osvw.length;
3576 		break;
3577 	case MSR_AMD64_OSVW_STATUS:
3578 		if (!guest_cpuid_has(vcpu, X86_FEATURE_OSVW))
3579 			return 1;
3580 		msr_info->data = vcpu->arch.osvw.status;
3581 		break;
3582 	case MSR_PLATFORM_INFO:
3583 		if (!msr_info->host_initiated &&
3584 		    !vcpu->kvm->arch.guest_can_read_msr_platform_info)
3585 			return 1;
3586 		msr_info->data = vcpu->arch.msr_platform_info;
3587 		break;
3588 	case MSR_MISC_FEATURES_ENABLES:
3589 		msr_info->data = vcpu->arch.msr_misc_features_enables;
3590 		break;
3591 	case MSR_K7_HWCR:
3592 		msr_info->data = vcpu->arch.msr_hwcr;
3593 		break;
3594 	default:
3595 		if (kvm_pmu_is_valid_msr(vcpu, msr_info->index))
3596 			return kvm_pmu_get_msr(vcpu, msr_info);
3597 		return KVM_MSR_RET_INVALID;
3598 	}
3599 	return 0;
3600 }
3601 EXPORT_SYMBOL_GPL(kvm_get_msr_common);
3602 
3603 /*
3604  * Read or write a bunch of msrs. All parameters are kernel addresses.
3605  *
3606  * @return number of msrs set successfully.
3607  */
3608 static int __msr_io(struct kvm_vcpu *vcpu, struct kvm_msrs *msrs,
3609 		    struct kvm_msr_entry *entries,
3610 		    int (*do_msr)(struct kvm_vcpu *vcpu,
3611 				  unsigned index, u64 *data))
3612 {
3613 	int i;
3614 
3615 	for (i = 0; i < msrs->nmsrs; ++i)
3616 		if (do_msr(vcpu, entries[i].index, &entries[i].data))
3617 			break;
3618 
3619 	return i;
3620 }
3621 
3622 /*
3623  * Read or write a bunch of msrs. Parameters are user addresses.
3624  *
3625  * @return number of msrs set successfully.
3626  */
3627 static int msr_io(struct kvm_vcpu *vcpu, struct kvm_msrs __user *user_msrs,
3628 		  int (*do_msr)(struct kvm_vcpu *vcpu,
3629 				unsigned index, u64 *data),
3630 		  int writeback)
3631 {
3632 	struct kvm_msrs msrs;
3633 	struct kvm_msr_entry *entries;
3634 	int r, n;
3635 	unsigned size;
3636 
3637 	r = -EFAULT;
3638 	if (copy_from_user(&msrs, user_msrs, sizeof(msrs)))
3639 		goto out;
3640 
3641 	r = -E2BIG;
3642 	if (msrs.nmsrs >= MAX_IO_MSRS)
3643 		goto out;
3644 
3645 	size = sizeof(struct kvm_msr_entry) * msrs.nmsrs;
3646 	entries = memdup_user(user_msrs->entries, size);
3647 	if (IS_ERR(entries)) {
3648 		r = PTR_ERR(entries);
3649 		goto out;
3650 	}
3651 
3652 	r = n = __msr_io(vcpu, &msrs, entries, do_msr);
3653 	if (r < 0)
3654 		goto out_free;
3655 
3656 	r = -EFAULT;
3657 	if (writeback && copy_to_user(user_msrs->entries, entries, size))
3658 		goto out_free;
3659 
3660 	r = n;
3661 
3662 out_free:
3663 	kfree(entries);
3664 out:
3665 	return r;
3666 }
3667 
3668 static inline bool kvm_can_mwait_in_guest(void)
3669 {
3670 	return boot_cpu_has(X86_FEATURE_MWAIT) &&
3671 		!boot_cpu_has_bug(X86_BUG_MONITOR) &&
3672 		boot_cpu_has(X86_FEATURE_ARAT);
3673 }
3674 
3675 static int kvm_ioctl_get_supported_hv_cpuid(struct kvm_vcpu *vcpu,
3676 					    struct kvm_cpuid2 __user *cpuid_arg)
3677 {
3678 	struct kvm_cpuid2 cpuid;
3679 	int r;
3680 
3681 	r = -EFAULT;
3682 	if (copy_from_user(&cpuid, cpuid_arg, sizeof(cpuid)))
3683 		return r;
3684 
3685 	r = kvm_get_hv_cpuid(vcpu, &cpuid, cpuid_arg->entries);
3686 	if (r)
3687 		return r;
3688 
3689 	r = -EFAULT;
3690 	if (copy_to_user(cpuid_arg, &cpuid, sizeof(cpuid)))
3691 		return r;
3692 
3693 	return 0;
3694 }
3695 
3696 int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
3697 {
3698 	int r = 0;
3699 
3700 	switch (ext) {
3701 	case KVM_CAP_IRQCHIP:
3702 	case KVM_CAP_HLT:
3703 	case KVM_CAP_MMU_SHADOW_CACHE_CONTROL:
3704 	case KVM_CAP_SET_TSS_ADDR:
3705 	case KVM_CAP_EXT_CPUID:
3706 	case KVM_CAP_EXT_EMUL_CPUID:
3707 	case KVM_CAP_CLOCKSOURCE:
3708 	case KVM_CAP_PIT:
3709 	case KVM_CAP_NOP_IO_DELAY:
3710 	case KVM_CAP_MP_STATE:
3711 	case KVM_CAP_SYNC_MMU:
3712 	case KVM_CAP_USER_NMI:
3713 	case KVM_CAP_REINJECT_CONTROL:
3714 	case KVM_CAP_IRQ_INJECT_STATUS:
3715 	case KVM_CAP_IOEVENTFD:
3716 	case KVM_CAP_IOEVENTFD_NO_LENGTH:
3717 	case KVM_CAP_PIT2:
3718 	case KVM_CAP_PIT_STATE2:
3719 	case KVM_CAP_SET_IDENTITY_MAP_ADDR:
3720 	case KVM_CAP_VCPU_EVENTS:
3721 	case KVM_CAP_HYPERV:
3722 	case KVM_CAP_HYPERV_VAPIC:
3723 	case KVM_CAP_HYPERV_SPIN:
3724 	case KVM_CAP_HYPERV_SYNIC:
3725 	case KVM_CAP_HYPERV_SYNIC2:
3726 	case KVM_CAP_HYPERV_VP_INDEX:
3727 	case KVM_CAP_HYPERV_EVENTFD:
3728 	case KVM_CAP_HYPERV_TLBFLUSH:
3729 	case KVM_CAP_HYPERV_SEND_IPI:
3730 	case KVM_CAP_HYPERV_CPUID:
3731 	case KVM_CAP_SYS_HYPERV_CPUID:
3732 	case KVM_CAP_PCI_SEGMENT:
3733 	case KVM_CAP_DEBUGREGS:
3734 	case KVM_CAP_X86_ROBUST_SINGLESTEP:
3735 	case KVM_CAP_XSAVE:
3736 	case KVM_CAP_ASYNC_PF:
3737 	case KVM_CAP_ASYNC_PF_INT:
3738 	case KVM_CAP_GET_TSC_KHZ:
3739 	case KVM_CAP_KVMCLOCK_CTRL:
3740 	case KVM_CAP_READONLY_MEM:
3741 	case KVM_CAP_HYPERV_TIME:
3742 	case KVM_CAP_IOAPIC_POLARITY_IGNORED:
3743 	case KVM_CAP_TSC_DEADLINE_TIMER:
3744 	case KVM_CAP_DISABLE_QUIRKS:
3745 	case KVM_CAP_SET_BOOT_CPU_ID:
3746  	case KVM_CAP_SPLIT_IRQCHIP:
3747 	case KVM_CAP_IMMEDIATE_EXIT:
3748 	case KVM_CAP_PMU_EVENT_FILTER:
3749 	case KVM_CAP_GET_MSR_FEATURES:
3750 	case KVM_CAP_MSR_PLATFORM_INFO:
3751 	case KVM_CAP_EXCEPTION_PAYLOAD:
3752 	case KVM_CAP_SET_GUEST_DEBUG:
3753 	case KVM_CAP_LAST_CPU:
3754 	case KVM_CAP_X86_USER_SPACE_MSR:
3755 	case KVM_CAP_X86_MSR_FILTER:
3756 	case KVM_CAP_ENFORCE_PV_FEATURE_CPUID:
3757 		r = 1;
3758 		break;
3759 	case KVM_CAP_XEN_HVM:
3760 		r = KVM_XEN_HVM_CONFIG_HYPERCALL_MSR |
3761 		    KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL |
3762 		    KVM_XEN_HVM_CONFIG_SHARED_INFO;
3763 		break;
3764 	case KVM_CAP_SYNC_REGS:
3765 		r = KVM_SYNC_X86_VALID_FIELDS;
3766 		break;
3767 	case KVM_CAP_ADJUST_CLOCK:
3768 		r = KVM_CLOCK_TSC_STABLE;
3769 		break;
3770 	case KVM_CAP_X86_DISABLE_EXITS:
3771 		r |=  KVM_X86_DISABLE_EXITS_HLT | KVM_X86_DISABLE_EXITS_PAUSE |
3772 		      KVM_X86_DISABLE_EXITS_CSTATE;
3773 		if(kvm_can_mwait_in_guest())
3774 			r |= KVM_X86_DISABLE_EXITS_MWAIT;
3775 		break;
3776 	case KVM_CAP_X86_SMM:
3777 		/* SMBASE is usually relocated above 1M on modern chipsets,
3778 		 * and SMM handlers might indeed rely on 4G segment limits,
3779 		 * so do not report SMM to be available if real mode is
3780 		 * emulated via vm86 mode.  Still, do not go to great lengths
3781 		 * to avoid userspace's usage of the feature, because it is a
3782 		 * fringe case that is not enabled except via specific settings
3783 		 * of the module parameters.
3784 		 */
3785 		r = static_call(kvm_x86_has_emulated_msr)(kvm, MSR_IA32_SMBASE);
3786 		break;
3787 	case KVM_CAP_VAPIC:
3788 		r = !static_call(kvm_x86_cpu_has_accelerated_tpr)();
3789 		break;
3790 	case KVM_CAP_NR_VCPUS:
3791 		r = KVM_SOFT_MAX_VCPUS;
3792 		break;
3793 	case KVM_CAP_MAX_VCPUS:
3794 		r = KVM_MAX_VCPUS;
3795 		break;
3796 	case KVM_CAP_MAX_VCPU_ID:
3797 		r = KVM_MAX_VCPU_ID;
3798 		break;
3799 	case KVM_CAP_PV_MMU:	/* obsolete */
3800 		r = 0;
3801 		break;
3802 	case KVM_CAP_MCE:
3803 		r = KVM_MAX_MCE_BANKS;
3804 		break;
3805 	case KVM_CAP_XCRS:
3806 		r = boot_cpu_has(X86_FEATURE_XSAVE);
3807 		break;
3808 	case KVM_CAP_TSC_CONTROL:
3809 		r = kvm_has_tsc_control;
3810 		break;
3811 	case KVM_CAP_X2APIC_API:
3812 		r = KVM_X2APIC_API_VALID_FLAGS;
3813 		break;
3814 	case KVM_CAP_NESTED_STATE:
3815 		r = kvm_x86_ops.nested_ops->get_state ?
3816 			kvm_x86_ops.nested_ops->get_state(NULL, NULL, 0) : 0;
3817 		break;
3818 	case KVM_CAP_HYPERV_DIRECT_TLBFLUSH:
3819 		r = kvm_x86_ops.enable_direct_tlbflush != NULL;
3820 		break;
3821 	case KVM_CAP_HYPERV_ENLIGHTENED_VMCS:
3822 		r = kvm_x86_ops.nested_ops->enable_evmcs != NULL;
3823 		break;
3824 	case KVM_CAP_SMALLER_MAXPHYADDR:
3825 		r = (int) allow_smaller_maxphyaddr;
3826 		break;
3827 	case KVM_CAP_STEAL_TIME:
3828 		r = sched_info_on();
3829 		break;
3830 	case KVM_CAP_X86_BUS_LOCK_EXIT:
3831 		if (kvm_has_bus_lock_exit)
3832 			r = KVM_BUS_LOCK_DETECTION_OFF |
3833 			    KVM_BUS_LOCK_DETECTION_EXIT;
3834 		else
3835 			r = 0;
3836 		break;
3837 	default:
3838 		break;
3839 	}
3840 	return r;
3841 
3842 }
3843 
3844 long kvm_arch_dev_ioctl(struct file *filp,
3845 			unsigned int ioctl, unsigned long arg)
3846 {
3847 	void __user *argp = (void __user *)arg;
3848 	long r;
3849 
3850 	switch (ioctl) {
3851 	case KVM_GET_MSR_INDEX_LIST: {
3852 		struct kvm_msr_list __user *user_msr_list = argp;
3853 		struct kvm_msr_list msr_list;
3854 		unsigned n;
3855 
3856 		r = -EFAULT;
3857 		if (copy_from_user(&msr_list, user_msr_list, sizeof(msr_list)))
3858 			goto out;
3859 		n = msr_list.nmsrs;
3860 		msr_list.nmsrs = num_msrs_to_save + num_emulated_msrs;
3861 		if (copy_to_user(user_msr_list, &msr_list, sizeof(msr_list)))
3862 			goto out;
3863 		r = -E2BIG;
3864 		if (n < msr_list.nmsrs)
3865 			goto out;
3866 		r = -EFAULT;
3867 		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
3868 				 num_msrs_to_save * sizeof(u32)))
3869 			goto out;
3870 		if (copy_to_user(user_msr_list->indices + num_msrs_to_save,
3871 				 &emulated_msrs,
3872 				 num_emulated_msrs * sizeof(u32)))
3873 			goto out;
3874 		r = 0;
3875 		break;
3876 	}
3877 	case KVM_GET_SUPPORTED_CPUID:
3878 	case KVM_GET_EMULATED_CPUID: {
3879 		struct kvm_cpuid2 __user *cpuid_arg = argp;
3880 		struct kvm_cpuid2 cpuid;
3881 
3882 		r = -EFAULT;
3883 		if (copy_from_user(&cpuid, cpuid_arg, sizeof(cpuid)))
3884 			goto out;
3885 
3886 		r = kvm_dev_ioctl_get_cpuid(&cpuid, cpuid_arg->entries,
3887 					    ioctl);
3888 		if (r)
3889 			goto out;
3890 
3891 		r = -EFAULT;
3892 		if (copy_to_user(cpuid_arg, &cpuid, sizeof(cpuid)))
3893 			goto out;
3894 		r = 0;
3895 		break;
3896 	}
3897 	case KVM_X86_GET_MCE_CAP_SUPPORTED:
3898 		r = -EFAULT;
3899 		if (copy_to_user(argp, &kvm_mce_cap_supported,
3900 				 sizeof(kvm_mce_cap_supported)))
3901 			goto out;
3902 		r = 0;
3903 		break;
3904 	case KVM_GET_MSR_FEATURE_INDEX_LIST: {
3905 		struct kvm_msr_list __user *user_msr_list = argp;
3906 		struct kvm_msr_list msr_list;
3907 		unsigned int n;
3908 
3909 		r = -EFAULT;
3910 		if (copy_from_user(&msr_list, user_msr_list, sizeof(msr_list)))
3911 			goto out;
3912 		n = msr_list.nmsrs;
3913 		msr_list.nmsrs = num_msr_based_features;
3914 		if (copy_to_user(user_msr_list, &msr_list, sizeof(msr_list)))
3915 			goto out;
3916 		r = -E2BIG;
3917 		if (n < msr_list.nmsrs)
3918 			goto out;
3919 		r = -EFAULT;
3920 		if (copy_to_user(user_msr_list->indices, &msr_based_features,
3921 				 num_msr_based_features * sizeof(u32)))
3922 			goto out;
3923 		r = 0;
3924 		break;
3925 	}
3926 	case KVM_GET_MSRS:
3927 		r = msr_io(NULL, argp, do_get_msr_feature, 1);
3928 		break;
3929 	case KVM_GET_SUPPORTED_HV_CPUID:
3930 		r = kvm_ioctl_get_supported_hv_cpuid(NULL, argp);
3931 		break;
3932 	default:
3933 		r = -EINVAL;
3934 		break;
3935 	}
3936 out:
3937 	return r;
3938 }
3939 
3940 static void wbinvd_ipi(void *garbage)
3941 {
3942 	wbinvd();
3943 }
3944 
3945 static bool need_emulate_wbinvd(struct kvm_vcpu *vcpu)
3946 {
3947 	return kvm_arch_has_noncoherent_dma(vcpu->kvm);
3948 }
3949 
3950 void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
3951 {
3952 	/* Address WBINVD may be executed by guest */
3953 	if (need_emulate_wbinvd(vcpu)) {
3954 		if (static_call(kvm_x86_has_wbinvd_exit)())
3955 			cpumask_set_cpu(cpu, vcpu->arch.wbinvd_dirty_mask);
3956 		else if (vcpu->cpu != -1 && vcpu->cpu != cpu)
3957 			smp_call_function_single(vcpu->cpu,
3958 					wbinvd_ipi, NULL, 1);
3959 	}
3960 
3961 	static_call(kvm_x86_vcpu_load)(vcpu, cpu);
3962 
3963 	/* Save host pkru register if supported */
3964 	vcpu->arch.host_pkru = read_pkru();
3965 
3966 	/* Apply any externally detected TSC adjustments (due to suspend) */
3967 	if (unlikely(vcpu->arch.tsc_offset_adjustment)) {
3968 		adjust_tsc_offset_host(vcpu, vcpu->arch.tsc_offset_adjustment);
3969 		vcpu->arch.tsc_offset_adjustment = 0;
3970 		kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
3971 	}
3972 
3973 	if (unlikely(vcpu->cpu != cpu) || kvm_check_tsc_unstable()) {
3974 		s64 tsc_delta = !vcpu->arch.last_host_tsc ? 0 :
3975 				rdtsc() - vcpu->arch.last_host_tsc;
3976 		if (tsc_delta < 0)
3977 			mark_tsc_unstable("KVM discovered backwards TSC");
3978 
3979 		if (kvm_check_tsc_unstable()) {
3980 			u64 offset = kvm_compute_tsc_offset(vcpu,
3981 						vcpu->arch.last_guest_tsc);
3982 			kvm_vcpu_write_tsc_offset(vcpu, offset);
3983 			vcpu->arch.tsc_catchup = 1;
3984 		}
3985 
3986 		if (kvm_lapic_hv_timer_in_use(vcpu))
3987 			kvm_lapic_restart_hv_timer(vcpu);
3988 
3989 		/*
3990 		 * On a host with synchronized TSC, there is no need to update
3991 		 * kvmclock on vcpu->cpu migration
3992 		 */
3993 		if (!vcpu->kvm->arch.use_master_clock || vcpu->cpu == -1)
3994 			kvm_make_request(KVM_REQ_GLOBAL_CLOCK_UPDATE, vcpu);
3995 		if (vcpu->cpu != cpu)
3996 			kvm_make_request(KVM_REQ_MIGRATE_TIMER, vcpu);
3997 		vcpu->cpu = cpu;
3998 	}
3999 
4000 	kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
4001 }
4002 
4003 static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
4004 {
4005 	struct kvm_host_map map;
4006 	struct kvm_steal_time *st;
4007 	int idx;
4008 
4009 	if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
4010 		return;
4011 
4012 	if (vcpu->arch.st.preempted)
4013 		return;
4014 
4015 	/*
4016 	 * Take the srcu lock as memslots will be accessed to check the gfn
4017 	 * cache generation against the memslots generation.
4018 	 */
4019 	idx = srcu_read_lock(&vcpu->kvm->srcu);
4020 
4021 	if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT, &map,
4022 			&vcpu->arch.st.cache, true))
4023 		goto out;
4024 
4025 	st = map.hva +
4026 		offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
4027 
4028 	st->preempted = vcpu->arch.st.preempted = KVM_VCPU_PREEMPTED;
4029 
4030 	kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, true);
4031 
4032 out:
4033 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
4034 }
4035 
4036 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
4037 {
4038 	if (vcpu->preempted && !vcpu->arch.guest_state_protected)
4039 		vcpu->arch.preempted_in_kernel = !static_call(kvm_x86_get_cpl)(vcpu);
4040 
4041 	kvm_steal_time_set_preempted(vcpu);
4042 	static_call(kvm_x86_vcpu_put)(vcpu);
4043 	vcpu->arch.last_host_tsc = rdtsc();
4044 	/*
4045 	 * If userspace has set any breakpoints or watchpoints, dr6 is restored
4046 	 * on every vmexit, but if not, we might have a stale dr6 from the
4047 	 * guest. do_debug expects dr6 to be cleared after it runs, do the same.
4048 	 */
4049 	set_debugreg(0, 6);
4050 }
4051 
4052 static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu,
4053 				    struct kvm_lapic_state *s)
4054 {
4055 	if (vcpu->arch.apicv_active)
4056 		static_call(kvm_x86_sync_pir_to_irr)(vcpu);
4057 
4058 	return kvm_apic_get_state(vcpu, s);
4059 }
4060 
4061 static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
4062 				    struct kvm_lapic_state *s)
4063 {
4064 	int r;
4065 
4066 	r = kvm_apic_set_state(vcpu, s);
4067 	if (r)
4068 		return r;
4069 	update_cr8_intercept(vcpu);
4070 
4071 	return 0;
4072 }
4073 
4074 static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu)
4075 {
4076 	/*
4077 	 * We can accept userspace's request for interrupt injection
4078 	 * as long as we have a place to store the interrupt number.
4079 	 * The actual injection will happen when the CPU is able to
4080 	 * deliver the interrupt.
4081 	 */
4082 	if (kvm_cpu_has_extint(vcpu))
4083 		return false;
4084 
4085 	/* Acknowledging ExtINT does not happen if LINT0 is masked.  */
4086 	return (!lapic_in_kernel(vcpu) ||
4087 		kvm_apic_accept_pic_intr(vcpu));
4088 }
4089 
4090 static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu)
4091 {
4092 	return kvm_arch_interrupt_allowed(vcpu) &&
4093 		kvm_cpu_accept_dm_intr(vcpu);
4094 }
4095 
4096 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
4097 				    struct kvm_interrupt *irq)
4098 {
4099 	if (irq->irq >= KVM_NR_INTERRUPTS)
4100 		return -EINVAL;
4101 
4102 	if (!irqchip_in_kernel(vcpu->kvm)) {
4103 		kvm_queue_interrupt(vcpu, irq->irq, false);
4104 		kvm_make_request(KVM_REQ_EVENT, vcpu);
4105 		return 0;
4106 	}
4107 
4108 	/*
4109 	 * With in-kernel LAPIC, we only use this to inject EXTINT, so
4110 	 * fail for in-kernel 8259.
4111 	 */
4112 	if (pic_in_kernel(vcpu->kvm))
4113 		return -ENXIO;
4114 
4115 	if (vcpu->arch.pending_external_vector != -1)
4116 		return -EEXIST;
4117 
4118 	vcpu->arch.pending_external_vector = irq->irq;
4119 	kvm_make_request(KVM_REQ_EVENT, vcpu);
4120 	return 0;
4121 }
4122 
4123 static int kvm_vcpu_ioctl_nmi(struct kvm_vcpu *vcpu)
4124 {
4125 	kvm_inject_nmi(vcpu);
4126 
4127 	return 0;
4128 }
4129 
4130 static int kvm_vcpu_ioctl_smi(struct kvm_vcpu *vcpu)
4131 {
4132 	kvm_make_request(KVM_REQ_SMI, vcpu);
4133 
4134 	return 0;
4135 }
4136 
4137 static int vcpu_ioctl_tpr_access_reporting(struct kvm_vcpu *vcpu,
4138 					   struct kvm_tpr_access_ctl *tac)
4139 {
4140 	if (tac->flags)
4141 		return -EINVAL;
4142 	vcpu->arch.tpr_access_reporting = !!tac->enabled;
4143 	return 0;
4144 }
4145 
4146 static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
4147 					u64 mcg_cap)
4148 {
4149 	int r;
4150 	unsigned bank_num = mcg_cap & 0xff, bank;
4151 
4152 	r = -EINVAL;
4153 	if (!bank_num || bank_num > KVM_MAX_MCE_BANKS)
4154 		goto out;
4155 	if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000))
4156 		goto out;
4157 	r = 0;
4158 	vcpu->arch.mcg_cap = mcg_cap;
4159 	/* Init IA32_MCG_CTL to all 1s */
4160 	if (mcg_cap & MCG_CTL_P)
4161 		vcpu->arch.mcg_ctl = ~(u64)0;
4162 	/* Init IA32_MCi_CTL to all 1s */
4163 	for (bank = 0; bank < bank_num; bank++)
4164 		vcpu->arch.mce_banks[bank*4] = ~(u64)0;
4165 
4166 	static_call(kvm_x86_setup_mce)(vcpu);
4167 out:
4168 	return r;
4169 }
4170 
4171 static int kvm_vcpu_ioctl_x86_set_mce(struct kvm_vcpu *vcpu,
4172 				      struct kvm_x86_mce *mce)
4173 {
4174 	u64 mcg_cap = vcpu->arch.mcg_cap;
4175 	unsigned bank_num = mcg_cap & 0xff;
4176 	u64 *banks = vcpu->arch.mce_banks;
4177 
4178 	if (mce->bank >= bank_num || !(mce->status & MCI_STATUS_VAL))
4179 		return -EINVAL;
4180 	/*
4181 	 * if IA32_MCG_CTL is not all 1s, the uncorrected error
4182 	 * reporting is disabled
4183 	 */
4184 	if ((mce->status & MCI_STATUS_UC) && (mcg_cap & MCG_CTL_P) &&
4185 	    vcpu->arch.mcg_ctl != ~(u64)0)
4186 		return 0;
4187 	banks += 4 * mce->bank;
4188 	/*
4189 	 * if IA32_MCi_CTL is not all 1s, the uncorrected error
4190 	 * reporting is disabled for the bank
4191 	 */
4192 	if ((mce->status & MCI_STATUS_UC) && banks[0] != ~(u64)0)
4193 		return 0;
4194 	if (mce->status & MCI_STATUS_UC) {
4195 		if ((vcpu->arch.mcg_status & MCG_STATUS_MCIP) ||
4196 		    !kvm_read_cr4_bits(vcpu, X86_CR4_MCE)) {
4197 			kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
4198 			return 0;
4199 		}
4200 		if (banks[1] & MCI_STATUS_VAL)
4201 			mce->status |= MCI_STATUS_OVER;
4202 		banks[2] = mce->addr;
4203 		banks[3] = mce->misc;
4204 		vcpu->arch.mcg_status = mce->mcg_status;
4205 		banks[1] = mce->status;
4206 		kvm_queue_exception(vcpu, MC_VECTOR);
4207 	} else if (!(banks[1] & MCI_STATUS_VAL)
4208 		   || !(banks[1] & MCI_STATUS_UC)) {
4209 		if (banks[1] & MCI_STATUS_VAL)
4210 			mce->status |= MCI_STATUS_OVER;
4211 		banks[2] = mce->addr;
4212 		banks[3] = mce->misc;
4213 		banks[1] = mce->status;
4214 	} else
4215 		banks[1] |= MCI_STATUS_OVER;
4216 	return 0;
4217 }
4218 
4219 static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
4220 					       struct kvm_vcpu_events *events)
4221 {
4222 	process_nmi(vcpu);
4223 
4224 	if (kvm_check_request(KVM_REQ_SMI, vcpu))
4225 		process_smi(vcpu);
4226 
4227 	/*
4228 	 * In guest mode, payload delivery should be deferred,
4229 	 * so that the L1 hypervisor can intercept #PF before
4230 	 * CR2 is modified (or intercept #DB before DR6 is
4231 	 * modified under nVMX). Unless the per-VM capability,
4232 	 * KVM_CAP_EXCEPTION_PAYLOAD, is set, we may not defer the delivery of
4233 	 * an exception payload and handle after a KVM_GET_VCPU_EVENTS. Since we
4234 	 * opportunistically defer the exception payload, deliver it if the
4235 	 * capability hasn't been requested before processing a
4236 	 * KVM_GET_VCPU_EVENTS.
4237 	 */
4238 	if (!vcpu->kvm->arch.exception_payload_enabled &&
4239 	    vcpu->arch.exception.pending && vcpu->arch.exception.has_payload)
4240 		kvm_deliver_exception_payload(vcpu);
4241 
4242 	/*
4243 	 * The API doesn't provide the instruction length for software
4244 	 * exceptions, so don't report them. As long as the guest RIP
4245 	 * isn't advanced, we should expect to encounter the exception
4246 	 * again.
4247 	 */
4248 	if (kvm_exception_is_soft(vcpu->arch.exception.nr)) {
4249 		events->exception.injected = 0;
4250 		events->exception.pending = 0;
4251 	} else {
4252 		events->exception.injected = vcpu->arch.exception.injected;
4253 		events->exception.pending = vcpu->arch.exception.pending;
4254 		/*
4255 		 * For ABI compatibility, deliberately conflate
4256 		 * pending and injected exceptions when
4257 		 * KVM_CAP_EXCEPTION_PAYLOAD isn't enabled.
4258 		 */
4259 		if (!vcpu->kvm->arch.exception_payload_enabled)
4260 			events->exception.injected |=
4261 				vcpu->arch.exception.pending;
4262 	}
4263 	events->exception.nr = vcpu->arch.exception.nr;
4264 	events->exception.has_error_code = vcpu->arch.exception.has_error_code;
4265 	events->exception.error_code = vcpu->arch.exception.error_code;
4266 	events->exception_has_payload = vcpu->arch.exception.has_payload;
4267 	events->exception_payload = vcpu->arch.exception.payload;
4268 
4269 	events->interrupt.injected =
4270 		vcpu->arch.interrupt.injected && !vcpu->arch.interrupt.soft;
4271 	events->interrupt.nr = vcpu->arch.interrupt.nr;
4272 	events->interrupt.soft = 0;
4273 	events->interrupt.shadow = static_call(kvm_x86_get_interrupt_shadow)(vcpu);
4274 
4275 	events->nmi.injected = vcpu->arch.nmi_injected;
4276 	events->nmi.pending = vcpu->arch.nmi_pending != 0;
4277 	events->nmi.masked = static_call(kvm_x86_get_nmi_mask)(vcpu);
4278 	events->nmi.pad = 0;
4279 
4280 	events->sipi_vector = 0; /* never valid when reporting to user space */
4281 
4282 	events->smi.smm = is_smm(vcpu);
4283 	events->smi.pending = vcpu->arch.smi_pending;
4284 	events->smi.smm_inside_nmi =
4285 		!!(vcpu->arch.hflags & HF_SMM_INSIDE_NMI_MASK);
4286 	events->smi.latched_init = kvm_lapic_latched_init(vcpu);
4287 
4288 	events->flags = (KVM_VCPUEVENT_VALID_NMI_PENDING
4289 			 | KVM_VCPUEVENT_VALID_SHADOW
4290 			 | KVM_VCPUEVENT_VALID_SMM);
4291 	if (vcpu->kvm->arch.exception_payload_enabled)
4292 		events->flags |= KVM_VCPUEVENT_VALID_PAYLOAD;
4293 
4294 	memset(&events->reserved, 0, sizeof(events->reserved));
4295 }
4296 
4297 static void kvm_smm_changed(struct kvm_vcpu *vcpu);
4298 
4299 static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
4300 					      struct kvm_vcpu_events *events)
4301 {
4302 	if (events->flags & ~(KVM_VCPUEVENT_VALID_NMI_PENDING
4303 			      | KVM_VCPUEVENT_VALID_SIPI_VECTOR
4304 			      | KVM_VCPUEVENT_VALID_SHADOW
4305 			      | KVM_VCPUEVENT_VALID_SMM
4306 			      | KVM_VCPUEVENT_VALID_PAYLOAD))
4307 		return -EINVAL;
4308 
4309 	if (events->flags & KVM_VCPUEVENT_VALID_PAYLOAD) {
4310 		if (!vcpu->kvm->arch.exception_payload_enabled)
4311 			return -EINVAL;
4312 		if (events->exception.pending)
4313 			events->exception.injected = 0;
4314 		else
4315 			events->exception_has_payload = 0;
4316 	} else {
4317 		events->exception.pending = 0;
4318 		events->exception_has_payload = 0;
4319 	}
4320 
4321 	if ((events->exception.injected || events->exception.pending) &&
4322 	    (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR))
4323 		return -EINVAL;
4324 
4325 	/* INITs are latched while in SMM */
4326 	if (events->flags & KVM_VCPUEVENT_VALID_SMM &&
4327 	    (events->smi.smm || events->smi.pending) &&
4328 	    vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED)
4329 		return -EINVAL;
4330 
4331 	process_nmi(vcpu);
4332 	vcpu->arch.exception.injected = events->exception.injected;
4333 	vcpu->arch.exception.pending = events->exception.pending;
4334 	vcpu->arch.exception.nr = events->exception.nr;
4335 	vcpu->arch.exception.has_error_code = events->exception.has_error_code;
4336 	vcpu->arch.exception.error_code = events->exception.error_code;
4337 	vcpu->arch.exception.has_payload = events->exception_has_payload;
4338 	vcpu->arch.exception.payload = events->exception_payload;
4339 
4340 	vcpu->arch.interrupt.injected = events->interrupt.injected;
4341 	vcpu->arch.interrupt.nr = events->interrupt.nr;
4342 	vcpu->arch.interrupt.soft = events->interrupt.soft;
4343 	if (events->flags & KVM_VCPUEVENT_VALID_SHADOW)
4344 		static_call(kvm_x86_set_interrupt_shadow)(vcpu,
4345 						events->interrupt.shadow);
4346 
4347 	vcpu->arch.nmi_injected = events->nmi.injected;
4348 	if (events->flags & KVM_VCPUEVENT_VALID_NMI_PENDING)
4349 		vcpu->arch.nmi_pending = events->nmi.pending;
4350 	static_call(kvm_x86_set_nmi_mask)(vcpu, events->nmi.masked);
4351 
4352 	if (events->flags & KVM_VCPUEVENT_VALID_SIPI_VECTOR &&
4353 	    lapic_in_kernel(vcpu))
4354 		vcpu->arch.apic->sipi_vector = events->sipi_vector;
4355 
4356 	if (events->flags & KVM_VCPUEVENT_VALID_SMM) {
4357 		if (!!(vcpu->arch.hflags & HF_SMM_MASK) != events->smi.smm) {
4358 			if (events->smi.smm)
4359 				vcpu->arch.hflags |= HF_SMM_MASK;
4360 			else
4361 				vcpu->arch.hflags &= ~HF_SMM_MASK;
4362 			kvm_smm_changed(vcpu);
4363 		}
4364 
4365 		vcpu->arch.smi_pending = events->smi.pending;
4366 
4367 		if (events->smi.smm) {
4368 			if (events->smi.smm_inside_nmi)
4369 				vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
4370 			else
4371 				vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
4372 		}
4373 
4374 		if (lapic_in_kernel(vcpu)) {
4375 			if (events->smi.latched_init)
4376 				set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
4377 			else
4378 				clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
4379 		}
4380 	}
4381 
4382 	kvm_make_request(KVM_REQ_EVENT, vcpu);
4383 
4384 	return 0;
4385 }
4386 
4387 static void kvm_vcpu_ioctl_x86_get_debugregs(struct kvm_vcpu *vcpu,
4388 					     struct kvm_debugregs *dbgregs)
4389 {
4390 	unsigned long val;
4391 
4392 	memcpy(dbgregs->db, vcpu->arch.db, sizeof(vcpu->arch.db));
4393 	kvm_get_dr(vcpu, 6, &val);
4394 	dbgregs->dr6 = val;
4395 	dbgregs->dr7 = vcpu->arch.dr7;
4396 	dbgregs->flags = 0;
4397 	memset(&dbgregs->reserved, 0, sizeof(dbgregs->reserved));
4398 }
4399 
4400 static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
4401 					    struct kvm_debugregs *dbgregs)
4402 {
4403 	if (dbgregs->flags)
4404 		return -EINVAL;
4405 
4406 	if (!kvm_dr6_valid(dbgregs->dr6))
4407 		return -EINVAL;
4408 	if (!kvm_dr7_valid(dbgregs->dr7))
4409 		return -EINVAL;
4410 
4411 	memcpy(vcpu->arch.db, dbgregs->db, sizeof(vcpu->arch.db));
4412 	kvm_update_dr0123(vcpu);
4413 	vcpu->arch.dr6 = dbgregs->dr6;
4414 	vcpu->arch.dr7 = dbgregs->dr7;
4415 	kvm_update_dr7(vcpu);
4416 
4417 	return 0;
4418 }
4419 
4420 #define XSTATE_COMPACTION_ENABLED (1ULL << 63)
4421 
4422 static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
4423 {
4424 	struct xregs_state *xsave = &vcpu->arch.guest_fpu->state.xsave;
4425 	u64 xstate_bv = xsave->header.xfeatures;
4426 	u64 valid;
4427 
4428 	/*
4429 	 * Copy legacy XSAVE area, to avoid complications with CPUID
4430 	 * leaves 0 and 1 in the loop below.
4431 	 */
4432 	memcpy(dest, xsave, XSAVE_HDR_OFFSET);
4433 
4434 	/* Set XSTATE_BV */
4435 	xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;
4436 	*(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
4437 
4438 	/*
4439 	 * Copy each region from the possibly compacted offset to the
4440 	 * non-compacted offset.
4441 	 */
4442 	valid = xstate_bv & ~XFEATURE_MASK_FPSSE;
4443 	while (valid) {
4444 		u64 xfeature_mask = valid & -valid;
4445 		int xfeature_nr = fls64(xfeature_mask) - 1;
4446 		void *src = get_xsave_addr(xsave, xfeature_nr);
4447 
4448 		if (src) {
4449 			u32 size, offset, ecx, edx;
4450 			cpuid_count(XSTATE_CPUID, xfeature_nr,
4451 				    &size, &offset, &ecx, &edx);
4452 			if (xfeature_nr == XFEATURE_PKRU)
4453 				memcpy(dest + offset, &vcpu->arch.pkru,
4454 				       sizeof(vcpu->arch.pkru));
4455 			else
4456 				memcpy(dest + offset, src, size);
4457 
4458 		}
4459 
4460 		valid -= xfeature_mask;
4461 	}
4462 }
4463 
4464 static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
4465 {
4466 	struct xregs_state *xsave = &vcpu->arch.guest_fpu->state.xsave;
4467 	u64 xstate_bv = *(u64 *)(src + XSAVE_HDR_OFFSET);
4468 	u64 valid;
4469 
4470 	/*
4471 	 * Copy legacy XSAVE area, to avoid complications with CPUID
4472 	 * leaves 0 and 1 in the loop below.
4473 	 */
4474 	memcpy(xsave, src, XSAVE_HDR_OFFSET);
4475 
4476 	/* Set XSTATE_BV and possibly XCOMP_BV.  */
4477 	xsave->header.xfeatures = xstate_bv;
4478 	if (boot_cpu_has(X86_FEATURE_XSAVES))
4479 		xsave->header.xcomp_bv = host_xcr0 | XSTATE_COMPACTION_ENABLED;
4480 
4481 	/*
4482 	 * Copy each region from the non-compacted offset to the
4483 	 * possibly compacted offset.
4484 	 */
4485 	valid = xstate_bv & ~XFEATURE_MASK_FPSSE;
4486 	while (valid) {
4487 		u64 xfeature_mask = valid & -valid;
4488 		int xfeature_nr = fls64(xfeature_mask) - 1;
4489 		void *dest = get_xsave_addr(xsave, xfeature_nr);
4490 
4491 		if (dest) {
4492 			u32 size, offset, ecx, edx;
4493 			cpuid_count(XSTATE_CPUID, xfeature_nr,
4494 				    &size, &offset, &ecx, &edx);
4495 			if (xfeature_nr == XFEATURE_PKRU)
4496 				memcpy(&vcpu->arch.pkru, src + offset,
4497 				       sizeof(vcpu->arch.pkru));
4498 			else
4499 				memcpy(dest, src + offset, size);
4500 		}
4501 
4502 		valid -= xfeature_mask;
4503 	}
4504 }
4505 
4506 static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
4507 					 struct kvm_xsave *guest_xsave)
4508 {
4509 	if (!vcpu->arch.guest_fpu)
4510 		return;
4511 
4512 	if (boot_cpu_has(X86_FEATURE_XSAVE)) {
4513 		memset(guest_xsave, 0, sizeof(struct kvm_xsave));
4514 		fill_xsave((u8 *) guest_xsave->region, vcpu);
4515 	} else {
4516 		memcpy(guest_xsave->region,
4517 			&vcpu->arch.guest_fpu->state.fxsave,
4518 			sizeof(struct fxregs_state));
4519 		*(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)] =
4520 			XFEATURE_MASK_FPSSE;
4521 	}
4522 }
4523 
4524 #define XSAVE_MXCSR_OFFSET 24
4525 
4526 static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
4527 					struct kvm_xsave *guest_xsave)
4528 {
4529 	u64 xstate_bv;
4530 	u32 mxcsr;
4531 
4532 	if (!vcpu->arch.guest_fpu)
4533 		return 0;
4534 
4535 	xstate_bv = *(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)];
4536 	mxcsr = *(u32 *)&guest_xsave->region[XSAVE_MXCSR_OFFSET / sizeof(u32)];
4537 
4538 	if (boot_cpu_has(X86_FEATURE_XSAVE)) {
4539 		/*
4540 		 * Here we allow setting states that are not present in
4541 		 * CPUID leaf 0xD, index 0, EDX:EAX.  This is for compatibility
4542 		 * with old userspace.
4543 		 */
4544 		if (xstate_bv & ~supported_xcr0 || mxcsr & ~mxcsr_feature_mask)
4545 			return -EINVAL;
4546 		load_xsave(vcpu, (u8 *)guest_xsave->region);
4547 	} else {
4548 		if (xstate_bv & ~XFEATURE_MASK_FPSSE ||
4549 			mxcsr & ~mxcsr_feature_mask)
4550 			return -EINVAL;
4551 		memcpy(&vcpu->arch.guest_fpu->state.fxsave,
4552 			guest_xsave->region, sizeof(struct fxregs_state));
4553 	}
4554 	return 0;
4555 }
4556 
4557 static void kvm_vcpu_ioctl_x86_get_xcrs(struct kvm_vcpu *vcpu,
4558 					struct kvm_xcrs *guest_xcrs)
4559 {
4560 	if (!boot_cpu_has(X86_FEATURE_XSAVE)) {
4561 		guest_xcrs->nr_xcrs = 0;
4562 		return;
4563 	}
4564 
4565 	guest_xcrs->nr_xcrs = 1;
4566 	guest_xcrs->flags = 0;
4567 	guest_xcrs->xcrs[0].xcr = XCR_XFEATURE_ENABLED_MASK;
4568 	guest_xcrs->xcrs[0].value = vcpu->arch.xcr0;
4569 }
4570 
4571 static int kvm_vcpu_ioctl_x86_set_xcrs(struct kvm_vcpu *vcpu,
4572 				       struct kvm_xcrs *guest_xcrs)
4573 {
4574 	int i, r = 0;
4575 
4576 	if (!boot_cpu_has(X86_FEATURE_XSAVE))
4577 		return -EINVAL;
4578 
4579 	if (guest_xcrs->nr_xcrs > KVM_MAX_XCRS || guest_xcrs->flags)
4580 		return -EINVAL;
4581 
4582 	for (i = 0; i < guest_xcrs->nr_xcrs; i++)
4583 		/* Only support XCR0 currently */
4584 		if (guest_xcrs->xcrs[i].xcr == XCR_XFEATURE_ENABLED_MASK) {
4585 			r = __kvm_set_xcr(vcpu, XCR_XFEATURE_ENABLED_MASK,
4586 				guest_xcrs->xcrs[i].value);
4587 			break;
4588 		}
4589 	if (r)
4590 		r = -EINVAL;
4591 	return r;
4592 }
4593 
4594 /*
4595  * kvm_set_guest_paused() indicates to the guest kernel that it has been
4596  * stopped by the hypervisor.  This function will be called from the host only.
4597  * EINVAL is returned when the host attempts to set the flag for a guest that
4598  * does not support pv clocks.
4599  */
4600 static int kvm_set_guest_paused(struct kvm_vcpu *vcpu)
4601 {
4602 	if (!vcpu->arch.pv_time_enabled)
4603 		return -EINVAL;
4604 	vcpu->arch.pvclock_set_guest_stopped_request = true;
4605 	kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
4606 	return 0;
4607 }
4608 
4609 static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
4610 				     struct kvm_enable_cap *cap)
4611 {
4612 	int r;
4613 	uint16_t vmcs_version;
4614 	void __user *user_ptr;
4615 
4616 	if (cap->flags)
4617 		return -EINVAL;
4618 
4619 	switch (cap->cap) {
4620 	case KVM_CAP_HYPERV_SYNIC2:
4621 		if (cap->args[0])
4622 			return -EINVAL;
4623 		fallthrough;
4624 
4625 	case KVM_CAP_HYPERV_SYNIC:
4626 		if (!irqchip_in_kernel(vcpu->kvm))
4627 			return -EINVAL;
4628 		return kvm_hv_activate_synic(vcpu, cap->cap ==
4629 					     KVM_CAP_HYPERV_SYNIC2);
4630 	case KVM_CAP_HYPERV_ENLIGHTENED_VMCS:
4631 		if (!kvm_x86_ops.nested_ops->enable_evmcs)
4632 			return -ENOTTY;
4633 		r = kvm_x86_ops.nested_ops->enable_evmcs(vcpu, &vmcs_version);
4634 		if (!r) {
4635 			user_ptr = (void __user *)(uintptr_t)cap->args[0];
4636 			if (copy_to_user(user_ptr, &vmcs_version,
4637 					 sizeof(vmcs_version)))
4638 				r = -EFAULT;
4639 		}
4640 		return r;
4641 	case KVM_CAP_HYPERV_DIRECT_TLBFLUSH:
4642 		if (!kvm_x86_ops.enable_direct_tlbflush)
4643 			return -ENOTTY;
4644 
4645 		return static_call(kvm_x86_enable_direct_tlbflush)(vcpu);
4646 
4647 	case KVM_CAP_ENFORCE_PV_FEATURE_CPUID:
4648 		vcpu->arch.pv_cpuid.enforce = cap->args[0];
4649 		if (vcpu->arch.pv_cpuid.enforce)
4650 			kvm_update_pv_runtime(vcpu);
4651 
4652 		return 0;
4653 
4654 	default:
4655 		return -EINVAL;
4656 	}
4657 }
4658 
4659 long kvm_arch_vcpu_ioctl(struct file *filp,
4660 			 unsigned int ioctl, unsigned long arg)
4661 {
4662 	struct kvm_vcpu *vcpu = filp->private_data;
4663 	void __user *argp = (void __user *)arg;
4664 	int r;
4665 	union {
4666 		struct kvm_lapic_state *lapic;
4667 		struct kvm_xsave *xsave;
4668 		struct kvm_xcrs *xcrs;
4669 		void *buffer;
4670 	} u;
4671 
4672 	vcpu_load(vcpu);
4673 
4674 	u.buffer = NULL;
4675 	switch (ioctl) {
4676 	case KVM_GET_LAPIC: {
4677 		r = -EINVAL;
4678 		if (!lapic_in_kernel(vcpu))
4679 			goto out;
4680 		u.lapic = kzalloc(sizeof(struct kvm_lapic_state),
4681 				GFP_KERNEL_ACCOUNT);
4682 
4683 		r = -ENOMEM;
4684 		if (!u.lapic)
4685 			goto out;
4686 		r = kvm_vcpu_ioctl_get_lapic(vcpu, u.lapic);
4687 		if (r)
4688 			goto out;
4689 		r = -EFAULT;
4690 		if (copy_to_user(argp, u.lapic, sizeof(struct kvm_lapic_state)))
4691 			goto out;
4692 		r = 0;
4693 		break;
4694 	}
4695 	case KVM_SET_LAPIC: {
4696 		r = -EINVAL;
4697 		if (!lapic_in_kernel(vcpu))
4698 			goto out;
4699 		u.lapic = memdup_user(argp, sizeof(*u.lapic));
4700 		if (IS_ERR(u.lapic)) {
4701 			r = PTR_ERR(u.lapic);
4702 			goto out_nofree;
4703 		}
4704 
4705 		r = kvm_vcpu_ioctl_set_lapic(vcpu, u.lapic);
4706 		break;
4707 	}
4708 	case KVM_INTERRUPT: {
4709 		struct kvm_interrupt irq;
4710 
4711 		r = -EFAULT;
4712 		if (copy_from_user(&irq, argp, sizeof(irq)))
4713 			goto out;
4714 		r = kvm_vcpu_ioctl_interrupt(vcpu, &irq);
4715 		break;
4716 	}
4717 	case KVM_NMI: {
4718 		r = kvm_vcpu_ioctl_nmi(vcpu);
4719 		break;
4720 	}
4721 	case KVM_SMI: {
4722 		r = kvm_vcpu_ioctl_smi(vcpu);
4723 		break;
4724 	}
4725 	case KVM_SET_CPUID: {
4726 		struct kvm_cpuid __user *cpuid_arg = argp;
4727 		struct kvm_cpuid cpuid;
4728 
4729 		r = -EFAULT;
4730 		if (copy_from_user(&cpuid, cpuid_arg, sizeof(cpuid)))
4731 			goto out;
4732 		r = kvm_vcpu_ioctl_set_cpuid(vcpu, &cpuid, cpuid_arg->entries);
4733 		break;
4734 	}
4735 	case KVM_SET_CPUID2: {
4736 		struct kvm_cpuid2 __user *cpuid_arg = argp;
4737 		struct kvm_cpuid2 cpuid;
4738 
4739 		r = -EFAULT;
4740 		if (copy_from_user(&cpuid, cpuid_arg, sizeof(cpuid)))
4741 			goto out;
4742 		r = kvm_vcpu_ioctl_set_cpuid2(vcpu, &cpuid,
4743 					      cpuid_arg->entries);
4744 		break;
4745 	}
4746 	case KVM_GET_CPUID2: {
4747 		struct kvm_cpuid2 __user *cpuid_arg = argp;
4748 		struct kvm_cpuid2 cpuid;
4749 
4750 		r = -EFAULT;
4751 		if (copy_from_user(&cpuid, cpuid_arg, sizeof(cpuid)))
4752 			goto out;
4753 		r = kvm_vcpu_ioctl_get_cpuid2(vcpu, &cpuid,
4754 					      cpuid_arg->entries);
4755 		if (r)
4756 			goto out;
4757 		r = -EFAULT;
4758 		if (copy_to_user(cpuid_arg, &cpuid, sizeof(cpuid)))
4759 			goto out;
4760 		r = 0;
4761 		break;
4762 	}
4763 	case KVM_GET_MSRS: {
4764 		int idx = srcu_read_lock(&vcpu->kvm->srcu);
4765 		r = msr_io(vcpu, argp, do_get_msr, 1);
4766 		srcu_read_unlock(&vcpu->kvm->srcu, idx);
4767 		break;
4768 	}
4769 	case KVM_SET_MSRS: {
4770 		int idx = srcu_read_lock(&vcpu->kvm->srcu);
4771 		r = msr_io(vcpu, argp, do_set_msr, 0);
4772 		srcu_read_unlock(&vcpu->kvm->srcu, idx);
4773 		break;
4774 	}
4775 	case KVM_TPR_ACCESS_REPORTING: {
4776 		struct kvm_tpr_access_ctl tac;
4777 
4778 		r = -EFAULT;
4779 		if (copy_from_user(&tac, argp, sizeof(tac)))
4780 			goto out;
4781 		r = vcpu_ioctl_tpr_access_reporting(vcpu, &tac);
4782 		if (r)
4783 			goto out;
4784 		r = -EFAULT;
4785 		if (copy_to_user(argp, &tac, sizeof(tac)))
4786 			goto out;
4787 		r = 0;
4788 		break;
4789 	};
4790 	case KVM_SET_VAPIC_ADDR: {
4791 		struct kvm_vapic_addr va;
4792 		int idx;
4793 
4794 		r = -EINVAL;
4795 		if (!lapic_in_kernel(vcpu))
4796 			goto out;
4797 		r = -EFAULT;
4798 		if (copy_from_user(&va, argp, sizeof(va)))
4799 			goto out;
4800 		idx = srcu_read_lock(&vcpu->kvm->srcu);
4801 		r = kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr);
4802 		srcu_read_unlock(&vcpu->kvm->srcu, idx);
4803 		break;
4804 	}
4805 	case KVM_X86_SETUP_MCE: {
4806 		u64 mcg_cap;
4807 
4808 		r = -EFAULT;
4809 		if (copy_from_user(&mcg_cap, argp, sizeof(mcg_cap)))
4810 			goto out;
4811 		r = kvm_vcpu_ioctl_x86_setup_mce(vcpu, mcg_cap);
4812 		break;
4813 	}
4814 	case KVM_X86_SET_MCE: {
4815 		struct kvm_x86_mce mce;
4816 
4817 		r = -EFAULT;
4818 		if (copy_from_user(&mce, argp, sizeof(mce)))
4819 			goto out;
4820 		r = kvm_vcpu_ioctl_x86_set_mce(vcpu, &mce);
4821 		break;
4822 	}
4823 	case KVM_GET_VCPU_EVENTS: {
4824 		struct kvm_vcpu_events events;
4825 
4826 		kvm_vcpu_ioctl_x86_get_vcpu_events(vcpu, &events);
4827 
4828 		r = -EFAULT;
4829 		if (copy_to_user(argp, &events, sizeof(struct kvm_vcpu_events)))
4830 			break;
4831 		r = 0;
4832 		break;
4833 	}
4834 	case KVM_SET_VCPU_EVENTS: {
4835 		struct kvm_vcpu_events events;
4836 
4837 		r = -EFAULT;
4838 		if (copy_from_user(&events, argp, sizeof(struct kvm_vcpu_events)))
4839 			break;
4840 
4841 		r = kvm_vcpu_ioctl_x86_set_vcpu_events(vcpu, &events);
4842 		break;
4843 	}
4844 	case KVM_GET_DEBUGREGS: {
4845 		struct kvm_debugregs dbgregs;
4846 
4847 		kvm_vcpu_ioctl_x86_get_debugregs(vcpu, &dbgregs);
4848 
4849 		r = -EFAULT;
4850 		if (copy_to_user(argp, &dbgregs,
4851 				 sizeof(struct kvm_debugregs)))
4852 			break;
4853 		r = 0;
4854 		break;
4855 	}
4856 	case KVM_SET_DEBUGREGS: {
4857 		struct kvm_debugregs dbgregs;
4858 
4859 		r = -EFAULT;
4860 		if (copy_from_user(&dbgregs, argp,
4861 				   sizeof(struct kvm_debugregs)))
4862 			break;
4863 
4864 		r = kvm_vcpu_ioctl_x86_set_debugregs(vcpu, &dbgregs);
4865 		break;
4866 	}
4867 	case KVM_GET_XSAVE: {
4868 		u.xsave = kzalloc(sizeof(struct kvm_xsave), GFP_KERNEL_ACCOUNT);
4869 		r = -ENOMEM;
4870 		if (!u.xsave)
4871 			break;
4872 
4873 		kvm_vcpu_ioctl_x86_get_xsave(vcpu, u.xsave);
4874 
4875 		r = -EFAULT;
4876 		if (copy_to_user(argp, u.xsave, sizeof(struct kvm_xsave)))
4877 			break;
4878 		r = 0;
4879 		break;
4880 	}
4881 	case KVM_SET_XSAVE: {
4882 		u.xsave = memdup_user(argp, sizeof(*u.xsave));
4883 		if (IS_ERR(u.xsave)) {
4884 			r = PTR_ERR(u.xsave);
4885 			goto out_nofree;
4886 		}
4887 
4888 		r = kvm_vcpu_ioctl_x86_set_xsave(vcpu, u.xsave);
4889 		break;
4890 	}
4891 	case KVM_GET_XCRS: {
4892 		u.xcrs = kzalloc(sizeof(struct kvm_xcrs), GFP_KERNEL_ACCOUNT);
4893 		r = -ENOMEM;
4894 		if (!u.xcrs)
4895 			break;
4896 
4897 		kvm_vcpu_ioctl_x86_get_xcrs(vcpu, u.xcrs);
4898 
4899 		r = -EFAULT;
4900 		if (copy_to_user(argp, u.xcrs,
4901 				 sizeof(struct kvm_xcrs)))
4902 			break;
4903 		r = 0;
4904 		break;
4905 	}
4906 	case KVM_SET_XCRS: {
4907 		u.xcrs = memdup_user(argp, sizeof(*u.xcrs));
4908 		if (IS_ERR(u.xcrs)) {
4909 			r = PTR_ERR(u.xcrs);
4910 			goto out_nofree;
4911 		}
4912 
4913 		r = kvm_vcpu_ioctl_x86_set_xcrs(vcpu, u.xcrs);
4914 		break;
4915 	}
4916 	case KVM_SET_TSC_KHZ: {
4917 		u32 user_tsc_khz;
4918 
4919 		r = -EINVAL;
4920 		user_tsc_khz = (u32)arg;
4921 
4922 		if (kvm_has_tsc_control &&
4923 		    user_tsc_khz >= kvm_max_guest_tsc_khz)
4924 			goto out;
4925 
4926 		if (user_tsc_khz == 0)
4927 			user_tsc_khz = tsc_khz;
4928 
4929 		if (!kvm_set_tsc_khz(vcpu, user_tsc_khz))
4930 			r = 0;
4931 
4932 		goto out;
4933 	}
4934 	case KVM_GET_TSC_KHZ: {
4935 		r = vcpu->arch.virtual_tsc_khz;
4936 		goto out;
4937 	}
4938 	case KVM_KVMCLOCK_CTRL: {
4939 		r = kvm_set_guest_paused(vcpu);
4940 		goto out;
4941 	}
4942 	case KVM_ENABLE_CAP: {
4943 		struct kvm_enable_cap cap;
4944 
4945 		r = -EFAULT;
4946 		if (copy_from_user(&cap, argp, sizeof(cap)))
4947 			goto out;
4948 		r = kvm_vcpu_ioctl_enable_cap(vcpu, &cap);
4949 		break;
4950 	}
4951 	case KVM_GET_NESTED_STATE: {
4952 		struct kvm_nested_state __user *user_kvm_nested_state = argp;
4953 		u32 user_data_size;
4954 
4955 		r = -EINVAL;
4956 		if (!kvm_x86_ops.nested_ops->get_state)
4957 			break;
4958 
4959 		BUILD_BUG_ON(sizeof(user_data_size) != sizeof(user_kvm_nested_state->size));
4960 		r = -EFAULT;
4961 		if (get_user(user_data_size, &user_kvm_nested_state->size))
4962 			break;
4963 
4964 		r = kvm_x86_ops.nested_ops->get_state(vcpu, user_kvm_nested_state,
4965 						     user_data_size);
4966 		if (r < 0)
4967 			break;
4968 
4969 		if (r > user_data_size) {
4970 			if (put_user(r, &user_kvm_nested_state->size))
4971 				r = -EFAULT;
4972 			else
4973 				r = -E2BIG;
4974 			break;
4975 		}
4976 
4977 		r = 0;
4978 		break;
4979 	}
4980 	case KVM_SET_NESTED_STATE: {
4981 		struct kvm_nested_state __user *user_kvm_nested_state = argp;
4982 		struct kvm_nested_state kvm_state;
4983 		int idx;
4984 
4985 		r = -EINVAL;
4986 		if (!kvm_x86_ops.nested_ops->set_state)
4987 			break;
4988 
4989 		r = -EFAULT;
4990 		if (copy_from_user(&kvm_state, user_kvm_nested_state, sizeof(kvm_state)))
4991 			break;
4992 
4993 		r = -EINVAL;
4994 		if (kvm_state.size < sizeof(kvm_state))
4995 			break;
4996 
4997 		if (kvm_state.flags &
4998 		    ~(KVM_STATE_NESTED_RUN_PENDING | KVM_STATE_NESTED_GUEST_MODE
4999 		      | KVM_STATE_NESTED_EVMCS | KVM_STATE_NESTED_MTF_PENDING
5000 		      | KVM_STATE_NESTED_GIF_SET))
5001 			break;
5002 
5003 		/* nested_run_pending implies guest_mode.  */
5004 		if ((kvm_state.flags & KVM_STATE_NESTED_RUN_PENDING)
5005 		    && !(kvm_state.flags & KVM_STATE_NESTED_GUEST_MODE))
5006 			break;
5007 
5008 		idx = srcu_read_lock(&vcpu->kvm->srcu);
5009 		r = kvm_x86_ops.nested_ops->set_state(vcpu, user_kvm_nested_state, &kvm_state);
5010 		srcu_read_unlock(&vcpu->kvm->srcu, idx);
5011 		break;
5012 	}
5013 	case KVM_GET_SUPPORTED_HV_CPUID:
5014 		r = kvm_ioctl_get_supported_hv_cpuid(vcpu, argp);
5015 		break;
5016 	case KVM_XEN_VCPU_GET_ATTR: {
5017 		struct kvm_xen_vcpu_attr xva;
5018 
5019 		r = -EFAULT;
5020 		if (copy_from_user(&xva, argp, sizeof(xva)))
5021 			goto out;
5022 		r = kvm_xen_vcpu_get_attr(vcpu, &xva);
5023 		if (!r && copy_to_user(argp, &xva, sizeof(xva)))
5024 			r = -EFAULT;
5025 		break;
5026 	}
5027 	case KVM_XEN_VCPU_SET_ATTR: {
5028 		struct kvm_xen_vcpu_attr xva;
5029 
5030 		r = -EFAULT;
5031 		if (copy_from_user(&xva, argp, sizeof(xva)))
5032 			goto out;
5033 		r = kvm_xen_vcpu_set_attr(vcpu, &xva);
5034 		break;
5035 	}
5036 	default:
5037 		r = -EINVAL;
5038 	}
5039 out:
5040 	kfree(u.buffer);
5041 out_nofree:
5042 	vcpu_put(vcpu);
5043 	return r;
5044 }
5045 
5046 vm_fault_t kvm_arch_vcpu_fault(struct kvm_vcpu *vcpu, struct vm_fault *vmf)
5047 {
5048 	return VM_FAULT_SIGBUS;
5049 }
5050 
5051 static int kvm_vm_ioctl_set_tss_addr(struct kvm *kvm, unsigned long addr)
5052 {
5053 	int ret;
5054 
5055 	if (addr > (unsigned int)(-3 * PAGE_SIZE))
5056 		return -EINVAL;
5057 	ret = static_call(kvm_x86_set_tss_addr)(kvm, addr);
5058 	return ret;
5059 }
5060 
5061 static int kvm_vm_ioctl_set_identity_map_addr(struct kvm *kvm,
5062 					      u64 ident_addr)
5063 {
5064 	return static_call(kvm_x86_set_identity_map_addr)(kvm, ident_addr);
5065 }
5066 
5067 static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
5068 					 unsigned long kvm_nr_mmu_pages)
5069 {
5070 	if (kvm_nr_mmu_pages < KVM_MIN_ALLOC_MMU_PAGES)
5071 		return -EINVAL;
5072 
5073 	mutex_lock(&kvm->slots_lock);
5074 
5075 	kvm_mmu_change_mmu_pages(kvm, kvm_nr_mmu_pages);
5076 	kvm->arch.n_requested_mmu_pages = kvm_nr_mmu_pages;
5077 
5078 	mutex_unlock(&kvm->slots_lock);
5079 	return 0;
5080 }
5081 
5082 static unsigned long kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
5083 {
5084 	return kvm->arch.n_max_mmu_pages;
5085 }
5086 
5087 static int kvm_vm_ioctl_get_irqchip(struct kvm *kvm, struct kvm_irqchip *chip)
5088 {
5089 	struct kvm_pic *pic = kvm->arch.vpic;
5090 	int r;
5091 
5092 	r = 0;
5093 	switch (chip->chip_id) {
5094 	case KVM_IRQCHIP_PIC_MASTER:
5095 		memcpy(&chip->chip.pic, &pic->pics[0],
5096 			sizeof(struct kvm_pic_state));
5097 		break;
5098 	case KVM_IRQCHIP_PIC_SLAVE:
5099 		memcpy(&chip->chip.pic, &pic->pics[1],
5100 			sizeof(struct kvm_pic_state));
5101 		break;
5102 	case KVM_IRQCHIP_IOAPIC:
5103 		kvm_get_ioapic(kvm, &chip->chip.ioapic);
5104 		break;
5105 	default:
5106 		r = -EINVAL;
5107 		break;
5108 	}
5109 	return r;
5110 }
5111 
5112 static int kvm_vm_ioctl_set_irqchip(struct kvm *kvm, struct kvm_irqchip *chip)
5113 {
5114 	struct kvm_pic *pic = kvm->arch.vpic;
5115 	int r;
5116 
5117 	r = 0;
5118 	switch (chip->chip_id) {
5119 	case KVM_IRQCHIP_PIC_MASTER:
5120 		spin_lock(&pic->lock);
5121 		memcpy(&pic->pics[0], &chip->chip.pic,
5122 			sizeof(struct kvm_pic_state));
5123 		spin_unlock(&pic->lock);
5124 		break;
5125 	case KVM_IRQCHIP_PIC_SLAVE:
5126 		spin_lock(&pic->lock);
5127 		memcpy(&pic->pics[1], &chip->chip.pic,
5128 			sizeof(struct kvm_pic_state));
5129 		spin_unlock(&pic->lock);
5130 		break;
5131 	case KVM_IRQCHIP_IOAPIC:
5132 		kvm_set_ioapic(kvm, &chip->chip.ioapic);
5133 		break;
5134 	default:
5135 		r = -EINVAL;
5136 		break;
5137 	}
5138 	kvm_pic_update_irq(pic);
5139 	return r;
5140 }
5141 
5142 static int kvm_vm_ioctl_get_pit(struct kvm *kvm, struct kvm_pit_state *ps)
5143 {
5144 	struct kvm_kpit_state *kps = &kvm->arch.vpit->pit_state;
5145 
5146 	BUILD_BUG_ON(sizeof(*ps) != sizeof(kps->channels));
5147 
5148 	mutex_lock(&kps->lock);
5149 	memcpy(ps, &kps->channels, sizeof(*ps));
5150 	mutex_unlock(&kps->lock);
5151 	return 0;
5152 }
5153 
5154 static int kvm_vm_ioctl_set_pit(struct kvm *kvm, struct kvm_pit_state *ps)
5155 {
5156 	int i;
5157 	struct kvm_pit *pit = kvm->arch.vpit;
5158 
5159 	mutex_lock(&pit->pit_state.lock);
5160 	memcpy(&pit->pit_state.channels, ps, sizeof(*ps));
5161 	for (i = 0; i < 3; i++)
5162 		kvm_pit_load_count(pit, i, ps->channels[i].count, 0);
5163 	mutex_unlock(&pit->pit_state.lock);
5164 	return 0;
5165 }
5166 
5167 static int kvm_vm_ioctl_get_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
5168 {
5169 	mutex_lock(&kvm->arch.vpit->pit_state.lock);
5170 	memcpy(ps->channels, &kvm->arch.vpit->pit_state.channels,
5171 		sizeof(ps->channels));
5172 	ps->flags = kvm->arch.vpit->pit_state.flags;
5173 	mutex_unlock(&kvm->arch.vpit->pit_state.lock);
5174 	memset(&ps->reserved, 0, sizeof(ps->reserved));
5175 	return 0;
5176 }
5177 
5178 static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
5179 {
5180 	int start = 0;
5181 	int i;
5182 	u32 prev_legacy, cur_legacy;
5183 	struct kvm_pit *pit = kvm->arch.vpit;
5184 
5185 	mutex_lock(&pit->pit_state.lock);
5186 	prev_legacy = pit->pit_state.flags & KVM_PIT_FLAGS_HPET_LEGACY;
5187 	cur_legacy = ps->flags & KVM_PIT_FLAGS_HPET_LEGACY;
5188 	if (!prev_legacy && cur_legacy)
5189 		start = 1;
5190 	memcpy(&pit->pit_state.channels, &ps->channels,
5191 	       sizeof(pit->pit_state.channels));
5192 	pit->pit_state.flags = ps->flags;
5193 	for (i = 0; i < 3; i++)
5194 		kvm_pit_load_count(pit, i, pit->pit_state.channels[i].count,
5195 				   start && i == 0);
5196 	mutex_unlock(&pit->pit_state.lock);
5197 	return 0;
5198 }
5199 
5200 static int kvm_vm_ioctl_reinject(struct kvm *kvm,
5201 				 struct kvm_reinject_control *control)
5202 {
5203 	struct kvm_pit *pit = kvm->arch.vpit;
5204 
5205 	/* pit->pit_state.lock was overloaded to prevent userspace from getting
5206 	 * an inconsistent state after running multiple KVM_REINJECT_CONTROL
5207 	 * ioctls in parallel.  Use a separate lock if that ioctl isn't rare.
5208 	 */
5209 	mutex_lock(&pit->pit_state.lock);
5210 	kvm_pit_set_reinject(pit, control->pit_reinject);
5211 	mutex_unlock(&pit->pit_state.lock);
5212 
5213 	return 0;
5214 }
5215 
5216 void kvm_arch_sync_dirty_log(struct kvm *kvm, struct kvm_memory_slot *memslot)
5217 {
5218 	/*
5219 	 * Flush potentially hardware-cached dirty pages to dirty_bitmap.
5220 	 */
5221 	static_call_cond(kvm_x86_flush_log_dirty)(kvm);
5222 }
5223 
5224 int kvm_vm_ioctl_irq_line(struct kvm *kvm, struct kvm_irq_level *irq_event,
5225 			bool line_status)
5226 {
5227 	if (!irqchip_in_kernel(kvm))
5228 		return -ENXIO;
5229 
5230 	irq_event->status = kvm_set_irq(kvm, KVM_USERSPACE_IRQ_SOURCE_ID,
5231 					irq_event->irq, irq_event->level,
5232 					line_status);
5233 	return 0;
5234 }
5235 
5236 int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
5237 			    struct kvm_enable_cap *cap)
5238 {
5239 	int r;
5240 
5241 	if (cap->flags)
5242 		return -EINVAL;
5243 
5244 	switch (cap->cap) {
5245 	case KVM_CAP_DISABLE_QUIRKS:
5246 		kvm->arch.disabled_quirks = cap->args[0];
5247 		r = 0;
5248 		break;
5249 	case KVM_CAP_SPLIT_IRQCHIP: {
5250 		mutex_lock(&kvm->lock);
5251 		r = -EINVAL;
5252 		if (cap->args[0] > MAX_NR_RESERVED_IOAPIC_PINS)
5253 			goto split_irqchip_unlock;
5254 		r = -EEXIST;
5255 		if (irqchip_in_kernel(kvm))
5256 			goto split_irqchip_unlock;
5257 		if (kvm->created_vcpus)
5258 			goto split_irqchip_unlock;
5259 		r = kvm_setup_empty_irq_routing(kvm);
5260 		if (r)
5261 			goto split_irqchip_unlock;
5262 		/* Pairs with irqchip_in_kernel. */
5263 		smp_wmb();
5264 		kvm->arch.irqchip_mode = KVM_IRQCHIP_SPLIT;
5265 		kvm->arch.nr_reserved_ioapic_pins = cap->args[0];
5266 		r = 0;
5267 split_irqchip_unlock:
5268 		mutex_unlock(&kvm->lock);
5269 		break;
5270 	}
5271 	case KVM_CAP_X2APIC_API:
5272 		r = -EINVAL;
5273 		if (cap->args[0] & ~KVM_X2APIC_API_VALID_FLAGS)
5274 			break;
5275 
5276 		if (cap->args[0] & KVM_X2APIC_API_USE_32BIT_IDS)
5277 			kvm->arch.x2apic_format = true;
5278 		if (cap->args[0] & KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK)
5279 			kvm->arch.x2apic_broadcast_quirk_disabled = true;
5280 
5281 		r = 0;
5282 		break;
5283 	case KVM_CAP_X86_DISABLE_EXITS:
5284 		r = -EINVAL;
5285 		if (cap->args[0] & ~KVM_X86_DISABLE_VALID_EXITS)
5286 			break;
5287 
5288 		if ((cap->args[0] & KVM_X86_DISABLE_EXITS_MWAIT) &&
5289 			kvm_can_mwait_in_guest())
5290 			kvm->arch.mwait_in_guest = true;
5291 		if (cap->args[0] & KVM_X86_DISABLE_EXITS_HLT)
5292 			kvm->arch.hlt_in_guest = true;
5293 		if (cap->args[0] & KVM_X86_DISABLE_EXITS_PAUSE)
5294 			kvm->arch.pause_in_guest = true;
5295 		if (cap->args[0] & KVM_X86_DISABLE_EXITS_CSTATE)
5296 			kvm->arch.cstate_in_guest = true;
5297 		r = 0;
5298 		break;
5299 	case KVM_CAP_MSR_PLATFORM_INFO:
5300 		kvm->arch.guest_can_read_msr_platform_info = cap->args[0];
5301 		r = 0;
5302 		break;
5303 	case KVM_CAP_EXCEPTION_PAYLOAD:
5304 		kvm->arch.exception_payload_enabled = cap->args[0];
5305 		r = 0;
5306 		break;
5307 	case KVM_CAP_X86_USER_SPACE_MSR:
5308 		kvm->arch.user_space_msr_mask = cap->args[0];
5309 		r = 0;
5310 		break;
5311 	case KVM_CAP_X86_BUS_LOCK_EXIT:
5312 		r = -EINVAL;
5313 		if (cap->args[0] & ~KVM_BUS_LOCK_DETECTION_VALID_MODE)
5314 			break;
5315 
5316 		if ((cap->args[0] & KVM_BUS_LOCK_DETECTION_OFF) &&
5317 		    (cap->args[0] & KVM_BUS_LOCK_DETECTION_EXIT))
5318 			break;
5319 
5320 		if (kvm_has_bus_lock_exit &&
5321 		    cap->args[0] & KVM_BUS_LOCK_DETECTION_EXIT)
5322 			kvm->arch.bus_lock_detection_enabled = true;
5323 		r = 0;
5324 		break;
5325 	default:
5326 		r = -EINVAL;
5327 		break;
5328 	}
5329 	return r;
5330 }
5331 
5332 static void kvm_clear_msr_filter(struct kvm *kvm)
5333 {
5334 	u32 i;
5335 	u32 count = kvm->arch.msr_filter.count;
5336 	struct msr_bitmap_range ranges[16];
5337 
5338 	mutex_lock(&kvm->lock);
5339 	kvm->arch.msr_filter.count = 0;
5340 	memcpy(ranges, kvm->arch.msr_filter.ranges, count * sizeof(ranges[0]));
5341 	mutex_unlock(&kvm->lock);
5342 	synchronize_srcu(&kvm->srcu);
5343 
5344 	for (i = 0; i < count; i++)
5345 		kfree(ranges[i].bitmap);
5346 }
5347 
5348 static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user_range)
5349 {
5350 	struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges;
5351 	struct msr_bitmap_range range;
5352 	unsigned long *bitmap = NULL;
5353 	size_t bitmap_size;
5354 	int r;
5355 
5356 	if (!user_range->nmsrs)
5357 		return 0;
5358 
5359 	bitmap_size = BITS_TO_LONGS(user_range->nmsrs) * sizeof(long);
5360 	if (!bitmap_size || bitmap_size > KVM_MSR_FILTER_MAX_BITMAP_SIZE)
5361 		return -EINVAL;
5362 
5363 	bitmap = memdup_user((__user u8*)user_range->bitmap, bitmap_size);
5364 	if (IS_ERR(bitmap))
5365 		return PTR_ERR(bitmap);
5366 
5367 	range = (struct msr_bitmap_range) {
5368 		.flags = user_range->flags,
5369 		.base = user_range->base,
5370 		.nmsrs = user_range->nmsrs,
5371 		.bitmap = bitmap,
5372 	};
5373 
5374 	if (range.flags & ~(KVM_MSR_FILTER_READ | KVM_MSR_FILTER_WRITE)) {
5375 		r = -EINVAL;
5376 		goto err;
5377 	}
5378 
5379 	if (!range.flags) {
5380 		r = -EINVAL;
5381 		goto err;
5382 	}
5383 
5384 	/* Everything ok, add this range identifier to our global pool */
5385 	ranges[kvm->arch.msr_filter.count] = range;
5386 	/* Make sure we filled the array before we tell anyone to walk it */
5387 	smp_wmb();
5388 	kvm->arch.msr_filter.count++;
5389 
5390 	return 0;
5391 err:
5392 	kfree(bitmap);
5393 	return r;
5394 }
5395 
5396 static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
5397 {
5398 	struct kvm_msr_filter __user *user_msr_filter = argp;
5399 	struct kvm_msr_filter filter;
5400 	bool default_allow;
5401 	int r = 0;
5402 	bool empty = true;
5403 	u32 i;
5404 
5405 	if (copy_from_user(&filter, user_msr_filter, sizeof(filter)))
5406 		return -EFAULT;
5407 
5408 	for (i = 0; i < ARRAY_SIZE(filter.ranges); i++)
5409 		empty &= !filter.ranges[i].nmsrs;
5410 
5411 	default_allow = !(filter.flags & KVM_MSR_FILTER_DEFAULT_DENY);
5412 	if (empty && !default_allow)
5413 		return -EINVAL;
5414 
5415 	kvm_clear_msr_filter(kvm);
5416 
5417 	kvm->arch.msr_filter.default_allow = default_allow;
5418 
5419 	/*
5420 	 * Protect from concurrent calls to this function that could trigger
5421 	 * a TOCTOU violation on kvm->arch.msr_filter.count.
5422 	 */
5423 	mutex_lock(&kvm->lock);
5424 	for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) {
5425 		r = kvm_add_msr_filter(kvm, &filter.ranges[i]);
5426 		if (r)
5427 			break;
5428 	}
5429 
5430 	kvm_make_all_cpus_request(kvm, KVM_REQ_MSR_FILTER_CHANGED);
5431 	mutex_unlock(&kvm->lock);
5432 
5433 	return r;
5434 }
5435 
5436 long kvm_arch_vm_ioctl(struct file *filp,
5437 		       unsigned int ioctl, unsigned long arg)
5438 {
5439 	struct kvm *kvm = filp->private_data;
5440 	void __user *argp = (void __user *)arg;
5441 	int r = -ENOTTY;
5442 	/*
5443 	 * This union makes it completely explicit to gcc-3.x
5444 	 * that these two variables' stack usage should be
5445 	 * combined, not added together.
5446 	 */
5447 	union {
5448 		struct kvm_pit_state ps;
5449 		struct kvm_pit_state2 ps2;
5450 		struct kvm_pit_config pit_config;
5451 	} u;
5452 
5453 	switch (ioctl) {
5454 	case KVM_SET_TSS_ADDR:
5455 		r = kvm_vm_ioctl_set_tss_addr(kvm, arg);
5456 		break;
5457 	case KVM_SET_IDENTITY_MAP_ADDR: {
5458 		u64 ident_addr;
5459 
5460 		mutex_lock(&kvm->lock);
5461 		r = -EINVAL;
5462 		if (kvm->created_vcpus)
5463 			goto set_identity_unlock;
5464 		r = -EFAULT;
5465 		if (copy_from_user(&ident_addr, argp, sizeof(ident_addr)))
5466 			goto set_identity_unlock;
5467 		r = kvm_vm_ioctl_set_identity_map_addr(kvm, ident_addr);
5468 set_identity_unlock:
5469 		mutex_unlock(&kvm->lock);
5470 		break;
5471 	}
5472 	case KVM_SET_NR_MMU_PAGES:
5473 		r = kvm_vm_ioctl_set_nr_mmu_pages(kvm, arg);
5474 		break;
5475 	case KVM_GET_NR_MMU_PAGES:
5476 		r = kvm_vm_ioctl_get_nr_mmu_pages(kvm);
5477 		break;
5478 	case KVM_CREATE_IRQCHIP: {
5479 		mutex_lock(&kvm->lock);
5480 
5481 		r = -EEXIST;
5482 		if (irqchip_in_kernel(kvm))
5483 			goto create_irqchip_unlock;
5484 
5485 		r = -EINVAL;
5486 		if (kvm->created_vcpus)
5487 			goto create_irqchip_unlock;
5488 
5489 		r = kvm_pic_init(kvm);
5490 		if (r)
5491 			goto create_irqchip_unlock;
5492 
5493 		r = kvm_ioapic_init(kvm);
5494 		if (r) {
5495 			kvm_pic_destroy(kvm);
5496 			goto create_irqchip_unlock;
5497 		}
5498 
5499 		r = kvm_setup_default_irq_routing(kvm);
5500 		if (r) {
5501 			kvm_ioapic_destroy(kvm);
5502 			kvm_pic_destroy(kvm);
5503 			goto create_irqchip_unlock;
5504 		}
5505 		/* Write kvm->irq_routing before enabling irqchip_in_kernel. */
5506 		smp_wmb();
5507 		kvm->arch.irqchip_mode = KVM_IRQCHIP_KERNEL;
5508 	create_irqchip_unlock:
5509 		mutex_unlock(&kvm->lock);
5510 		break;
5511 	}
5512 	case KVM_CREATE_PIT:
5513 		u.pit_config.flags = KVM_PIT_SPEAKER_DUMMY;
5514 		goto create_pit;
5515 	case KVM_CREATE_PIT2:
5516 		r = -EFAULT;
5517 		if (copy_from_user(&u.pit_config, argp,
5518 				   sizeof(struct kvm_pit_config)))
5519 			goto out;
5520 	create_pit:
5521 		mutex_lock(&kvm->lock);
5522 		r = -EEXIST;
5523 		if (kvm->arch.vpit)
5524 			goto create_pit_unlock;
5525 		r = -ENOMEM;
5526 		kvm->arch.vpit = kvm_create_pit(kvm, u.pit_config.flags);
5527 		if (kvm->arch.vpit)
5528 			r = 0;
5529 	create_pit_unlock:
5530 		mutex_unlock(&kvm->lock);
5531 		break;
5532 	case KVM_GET_IRQCHIP: {
5533 		/* 0: PIC master, 1: PIC slave, 2: IOAPIC */
5534 		struct kvm_irqchip *chip;
5535 
5536 		chip = memdup_user(argp, sizeof(*chip));
5537 		if (IS_ERR(chip)) {
5538 			r = PTR_ERR(chip);
5539 			goto out;
5540 		}
5541 
5542 		r = -ENXIO;
5543 		if (!irqchip_kernel(kvm))
5544 			goto get_irqchip_out;
5545 		r = kvm_vm_ioctl_get_irqchip(kvm, chip);
5546 		if (r)
5547 			goto get_irqchip_out;
5548 		r = -EFAULT;
5549 		if (copy_to_user(argp, chip, sizeof(*chip)))
5550 			goto get_irqchip_out;
5551 		r = 0;
5552 	get_irqchip_out:
5553 		kfree(chip);
5554 		break;
5555 	}
5556 	case KVM_SET_IRQCHIP: {
5557 		/* 0: PIC master, 1: PIC slave, 2: IOAPIC */
5558 		struct kvm_irqchip *chip;
5559 
5560 		chip = memdup_user(argp, sizeof(*chip));
5561 		if (IS_ERR(chip)) {
5562 			r = PTR_ERR(chip);
5563 			goto out;
5564 		}
5565 
5566 		r = -ENXIO;
5567 		if (!irqchip_kernel(kvm))
5568 			goto set_irqchip_out;
5569 		r = kvm_vm_ioctl_set_irqchip(kvm, chip);
5570 	set_irqchip_out:
5571 		kfree(chip);
5572 		break;
5573 	}
5574 	case KVM_GET_PIT: {
5575 		r = -EFAULT;
5576 		if (copy_from_user(&u.ps, argp, sizeof(struct kvm_pit_state)))
5577 			goto out;
5578 		r = -ENXIO;
5579 		if (!kvm->arch.vpit)
5580 			goto out;
5581 		r = kvm_vm_ioctl_get_pit(kvm, &u.ps);
5582 		if (r)
5583 			goto out;
5584 		r = -EFAULT;
5585 		if (copy_to_user(argp, &u.ps, sizeof(struct kvm_pit_state)))
5586 			goto out;
5587 		r = 0;
5588 		break;
5589 	}
5590 	case KVM_SET_PIT: {
5591 		r = -EFAULT;
5592 		if (copy_from_user(&u.ps, argp, sizeof(u.ps)))
5593 			goto out;
5594 		mutex_lock(&kvm->lock);
5595 		r = -ENXIO;
5596 		if (!kvm->arch.vpit)
5597 			goto set_pit_out;
5598 		r = kvm_vm_ioctl_set_pit(kvm, &u.ps);
5599 set_pit_out:
5600 		mutex_unlock(&kvm->lock);
5601 		break;
5602 	}
5603 	case KVM_GET_PIT2: {
5604 		r = -ENXIO;
5605 		if (!kvm->arch.vpit)
5606 			goto out;
5607 		r = kvm_vm_ioctl_get_pit2(kvm, &u.ps2);
5608 		if (r)
5609 			goto out;
5610 		r = -EFAULT;
5611 		if (copy_to_user(argp, &u.ps2, sizeof(u.ps2)))
5612 			goto out;
5613 		r = 0;
5614 		break;
5615 	}
5616 	case KVM_SET_PIT2: {
5617 		r = -EFAULT;
5618 		if (copy_from_user(&u.ps2, argp, sizeof(u.ps2)))
5619 			goto out;
5620 		mutex_lock(&kvm->lock);
5621 		r = -ENXIO;
5622 		if (!kvm->arch.vpit)
5623 			goto set_pit2_out;
5624 		r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2);
5625 set_pit2_out:
5626 		mutex_unlock(&kvm->lock);
5627 		break;
5628 	}
5629 	case KVM_REINJECT_CONTROL: {
5630 		struct kvm_reinject_control control;
5631 		r =  -EFAULT;
5632 		if (copy_from_user(&control, argp, sizeof(control)))
5633 			goto out;
5634 		r = -ENXIO;
5635 		if (!kvm->arch.vpit)
5636 			goto out;
5637 		r = kvm_vm_ioctl_reinject(kvm, &control);
5638 		break;
5639 	}
5640 	case KVM_SET_BOOT_CPU_ID:
5641 		r = 0;
5642 		mutex_lock(&kvm->lock);
5643 		if (kvm->created_vcpus)
5644 			r = -EBUSY;
5645 		else
5646 			kvm->arch.bsp_vcpu_id = arg;
5647 		mutex_unlock(&kvm->lock);
5648 		break;
5649 	case KVM_XEN_HVM_CONFIG: {
5650 		struct kvm_xen_hvm_config xhc;
5651 		r = -EFAULT;
5652 		if (copy_from_user(&xhc, argp, sizeof(xhc)))
5653 			goto out;
5654 		r = kvm_xen_hvm_config(kvm, &xhc);
5655 		break;
5656 	}
5657 	case KVM_XEN_HVM_GET_ATTR: {
5658 		struct kvm_xen_hvm_attr xha;
5659 
5660 		r = -EFAULT;
5661 		if (copy_from_user(&xha, argp, sizeof(xha)))
5662 			goto out;
5663 		r = kvm_xen_hvm_get_attr(kvm, &xha);
5664 		if (!r && copy_to_user(argp, &xha, sizeof(xha)))
5665 			r = -EFAULT;
5666 		break;
5667 	}
5668 	case KVM_XEN_HVM_SET_ATTR: {
5669 		struct kvm_xen_hvm_attr xha;
5670 
5671 		r = -EFAULT;
5672 		if (copy_from_user(&xha, argp, sizeof(xha)))
5673 			goto out;
5674 		r = kvm_xen_hvm_set_attr(kvm, &xha);
5675 		break;
5676 	}
5677 	case KVM_SET_CLOCK: {
5678 		struct kvm_clock_data user_ns;
5679 		u64 now_ns;
5680 
5681 		r = -EFAULT;
5682 		if (copy_from_user(&user_ns, argp, sizeof(user_ns)))
5683 			goto out;
5684 
5685 		r = -EINVAL;
5686 		if (user_ns.flags)
5687 			goto out;
5688 
5689 		r = 0;
5690 		/*
5691 		 * TODO: userspace has to take care of races with VCPU_RUN, so
5692 		 * kvm_gen_update_masterclock() can be cut down to locked
5693 		 * pvclock_update_vm_gtod_copy().
5694 		 */
5695 		kvm_gen_update_masterclock(kvm);
5696 		now_ns = get_kvmclock_ns(kvm);
5697 		kvm->arch.kvmclock_offset += user_ns.clock - now_ns;
5698 		kvm_make_all_cpus_request(kvm, KVM_REQ_CLOCK_UPDATE);
5699 		break;
5700 	}
5701 	case KVM_GET_CLOCK: {
5702 		struct kvm_clock_data user_ns;
5703 		u64 now_ns;
5704 
5705 		now_ns = get_kvmclock_ns(kvm);
5706 		user_ns.clock = now_ns;
5707 		user_ns.flags = kvm->arch.use_master_clock ? KVM_CLOCK_TSC_STABLE : 0;
5708 		memset(&user_ns.pad, 0, sizeof(user_ns.pad));
5709 
5710 		r = -EFAULT;
5711 		if (copy_to_user(argp, &user_ns, sizeof(user_ns)))
5712 			goto out;
5713 		r = 0;
5714 		break;
5715 	}
5716 	case KVM_MEMORY_ENCRYPT_OP: {
5717 		r = -ENOTTY;
5718 		if (kvm_x86_ops.mem_enc_op)
5719 			r = static_call(kvm_x86_mem_enc_op)(kvm, argp);
5720 		break;
5721 	}
5722 	case KVM_MEMORY_ENCRYPT_REG_REGION: {
5723 		struct kvm_enc_region region;
5724 
5725 		r = -EFAULT;
5726 		if (copy_from_user(&region, argp, sizeof(region)))
5727 			goto out;
5728 
5729 		r = -ENOTTY;
5730 		if (kvm_x86_ops.mem_enc_reg_region)
5731 			r = static_call(kvm_x86_mem_enc_reg_region)(kvm, &region);
5732 		break;
5733 	}
5734 	case KVM_MEMORY_ENCRYPT_UNREG_REGION: {
5735 		struct kvm_enc_region region;
5736 
5737 		r = -EFAULT;
5738 		if (copy_from_user(&region, argp, sizeof(region)))
5739 			goto out;
5740 
5741 		r = -ENOTTY;
5742 		if (kvm_x86_ops.mem_enc_unreg_region)
5743 			r = static_call(kvm_x86_mem_enc_unreg_region)(kvm, &region);
5744 		break;
5745 	}
5746 	case KVM_HYPERV_EVENTFD: {
5747 		struct kvm_hyperv_eventfd hvevfd;
5748 
5749 		r = -EFAULT;
5750 		if (copy_from_user(&hvevfd, argp, sizeof(hvevfd)))
5751 			goto out;
5752 		r = kvm_vm_ioctl_hv_eventfd(kvm, &hvevfd);
5753 		break;
5754 	}
5755 	case KVM_SET_PMU_EVENT_FILTER:
5756 		r = kvm_vm_ioctl_set_pmu_event_filter(kvm, argp);
5757 		break;
5758 	case KVM_X86_SET_MSR_FILTER:
5759 		r = kvm_vm_ioctl_set_msr_filter(kvm, argp);
5760 		break;
5761 	default:
5762 		r = -ENOTTY;
5763 	}
5764 out:
5765 	return r;
5766 }
5767 
5768 static void kvm_init_msr_list(void)
5769 {
5770 	struct x86_pmu_capability x86_pmu;
5771 	u32 dummy[2];
5772 	unsigned i;
5773 
5774 	BUILD_BUG_ON_MSG(INTEL_PMC_MAX_FIXED != 4,
5775 			 "Please update the fixed PMCs in msrs_to_saved_all[]");
5776 
5777 	perf_get_x86_pmu_capability(&x86_pmu);
5778 
5779 	num_msrs_to_save = 0;
5780 	num_emulated_msrs = 0;
5781 	num_msr_based_features = 0;
5782 
5783 	for (i = 0; i < ARRAY_SIZE(msrs_to_save_all); i++) {
5784 		if (rdmsr_safe(msrs_to_save_all[i], &dummy[0], &dummy[1]) < 0)
5785 			continue;
5786 
5787 		/*
5788 		 * Even MSRs that are valid in the host may not be exposed
5789 		 * to the guests in some cases.
5790 		 */
5791 		switch (msrs_to_save_all[i]) {
5792 		case MSR_IA32_BNDCFGS:
5793 			if (!kvm_mpx_supported())
5794 				continue;
5795 			break;
5796 		case MSR_TSC_AUX:
5797 			if (!kvm_cpu_cap_has(X86_FEATURE_RDTSCP))
5798 				continue;
5799 			break;
5800 		case MSR_IA32_UMWAIT_CONTROL:
5801 			if (!kvm_cpu_cap_has(X86_FEATURE_WAITPKG))
5802 				continue;
5803 			break;
5804 		case MSR_IA32_RTIT_CTL:
5805 		case MSR_IA32_RTIT_STATUS:
5806 			if (!kvm_cpu_cap_has(X86_FEATURE_INTEL_PT))
5807 				continue;
5808 			break;
5809 		case MSR_IA32_RTIT_CR3_MATCH:
5810 			if (!kvm_cpu_cap_has(X86_FEATURE_INTEL_PT) ||
5811 			    !intel_pt_validate_hw_cap(PT_CAP_cr3_filtering))
5812 				continue;
5813 			break;
5814 		case MSR_IA32_RTIT_OUTPUT_BASE:
5815 		case MSR_IA32_RTIT_OUTPUT_MASK:
5816 			if (!kvm_cpu_cap_has(X86_FEATURE_INTEL_PT) ||
5817 				(!intel_pt_validate_hw_cap(PT_CAP_topa_output) &&
5818 				 !intel_pt_validate_hw_cap(PT_CAP_single_range_output)))
5819 				continue;
5820 			break;
5821 		case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
5822 			if (!kvm_cpu_cap_has(X86_FEATURE_INTEL_PT) ||
5823 				msrs_to_save_all[i] - MSR_IA32_RTIT_ADDR0_A >=
5824 				intel_pt_validate_hw_cap(PT_CAP_num_address_ranges) * 2)
5825 				continue;
5826 			break;
5827 		case MSR_ARCH_PERFMON_PERFCTR0 ... MSR_ARCH_PERFMON_PERFCTR0 + 17:
5828 			if (msrs_to_save_all[i] - MSR_ARCH_PERFMON_PERFCTR0 >=
5829 			    min(INTEL_PMC_MAX_GENERIC, x86_pmu.num_counters_gp))
5830 				continue;
5831 			break;
5832 		case MSR_ARCH_PERFMON_EVENTSEL0 ... MSR_ARCH_PERFMON_EVENTSEL0 + 17:
5833 			if (msrs_to_save_all[i] - MSR_ARCH_PERFMON_EVENTSEL0 >=
5834 			    min(INTEL_PMC_MAX_GENERIC, x86_pmu.num_counters_gp))
5835 				continue;
5836 			break;
5837 		default:
5838 			break;
5839 		}
5840 
5841 		msrs_to_save[num_msrs_to_save++] = msrs_to_save_all[i];
5842 	}
5843 
5844 	for (i = 0; i < ARRAY_SIZE(emulated_msrs_all); i++) {
5845 		if (!static_call(kvm_x86_has_emulated_msr)(NULL, emulated_msrs_all[i]))
5846 			continue;
5847 
5848 		emulated_msrs[num_emulated_msrs++] = emulated_msrs_all[i];
5849 	}
5850 
5851 	for (i = 0; i < ARRAY_SIZE(msr_based_features_all); i++) {
5852 		struct kvm_msr_entry msr;
5853 
5854 		msr.index = msr_based_features_all[i];
5855 		if (kvm_get_msr_feature(&msr))
5856 			continue;
5857 
5858 		msr_based_features[num_msr_based_features++] = msr_based_features_all[i];
5859 	}
5860 }
5861 
5862 static int vcpu_mmio_write(struct kvm_vcpu *vcpu, gpa_t addr, int len,
5863 			   const void *v)
5864 {
5865 	int handled = 0;
5866 	int n;
5867 
5868 	do {
5869 		n = min(len, 8);
5870 		if (!(lapic_in_kernel(vcpu) &&
5871 		      !kvm_iodevice_write(vcpu, &vcpu->arch.apic->dev, addr, n, v))
5872 		    && kvm_io_bus_write(vcpu, KVM_MMIO_BUS, addr, n, v))
5873 			break;
5874 		handled += n;
5875 		addr += n;
5876 		len -= n;
5877 		v += n;
5878 	} while (len);
5879 
5880 	return handled;
5881 }
5882 
5883 static int vcpu_mmio_read(struct kvm_vcpu *vcpu, gpa_t addr, int len, void *v)
5884 {
5885 	int handled = 0;
5886 	int n;
5887 
5888 	do {
5889 		n = min(len, 8);
5890 		if (!(lapic_in_kernel(vcpu) &&
5891 		      !kvm_iodevice_read(vcpu, &vcpu->arch.apic->dev,
5892 					 addr, n, v))
5893 		    && kvm_io_bus_read(vcpu, KVM_MMIO_BUS, addr, n, v))
5894 			break;
5895 		trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, v);
5896 		handled += n;
5897 		addr += n;
5898 		len -= n;
5899 		v += n;
5900 	} while (len);
5901 
5902 	return handled;
5903 }
5904 
5905 static void kvm_set_segment(struct kvm_vcpu *vcpu,
5906 			struct kvm_segment *var, int seg)
5907 {
5908 	static_call(kvm_x86_set_segment)(vcpu, var, seg);
5909 }
5910 
5911 void kvm_get_segment(struct kvm_vcpu *vcpu,
5912 		     struct kvm_segment *var, int seg)
5913 {
5914 	static_call(kvm_x86_get_segment)(vcpu, var, seg);
5915 }
5916 
5917 gpa_t translate_nested_gpa(struct kvm_vcpu *vcpu, gpa_t gpa, u32 access,
5918 			   struct x86_exception *exception)
5919 {
5920 	gpa_t t_gpa;
5921 
5922 	BUG_ON(!mmu_is_nested(vcpu));
5923 
5924 	/* NPT walks are always user-walks */
5925 	access |= PFERR_USER_MASK;
5926 	t_gpa  = vcpu->arch.mmu->gva_to_gpa(vcpu, gpa, access, exception);
5927 
5928 	return t_gpa;
5929 }
5930 
5931 gpa_t kvm_mmu_gva_to_gpa_read(struct kvm_vcpu *vcpu, gva_t gva,
5932 			      struct x86_exception *exception)
5933 {
5934 	u32 access = (static_call(kvm_x86_get_cpl)(vcpu) == 3) ? PFERR_USER_MASK : 0;
5935 	return vcpu->arch.walk_mmu->gva_to_gpa(vcpu, gva, access, exception);
5936 }
5937 
5938  gpa_t kvm_mmu_gva_to_gpa_fetch(struct kvm_vcpu *vcpu, gva_t gva,
5939 				struct x86_exception *exception)
5940 {
5941 	u32 access = (static_call(kvm_x86_get_cpl)(vcpu) == 3) ? PFERR_USER_MASK : 0;
5942 	access |= PFERR_FETCH_MASK;
5943 	return vcpu->arch.walk_mmu->gva_to_gpa(vcpu, gva, access, exception);
5944 }
5945 
5946 gpa_t kvm_mmu_gva_to_gpa_write(struct kvm_vcpu *vcpu, gva_t gva,
5947 			       struct x86_exception *exception)
5948 {
5949 	u32 access = (static_call(kvm_x86_get_cpl)(vcpu) == 3) ? PFERR_USER_MASK : 0;
5950 	access |= PFERR_WRITE_MASK;
5951 	return vcpu->arch.walk_mmu->gva_to_gpa(vcpu, gva, access, exception);
5952 }
5953 
5954 /* uses this to access any guest's mapped memory without checking CPL */
5955 gpa_t kvm_mmu_gva_to_gpa_system(struct kvm_vcpu *vcpu, gva_t gva,
5956 				struct x86_exception *exception)
5957 {
5958 	return vcpu->arch.walk_mmu->gva_to_gpa(vcpu, gva, 0, exception);
5959 }
5960 
5961 static int kvm_read_guest_virt_helper(gva_t addr, void *val, unsigned int bytes,
5962 				      struct kvm_vcpu *vcpu, u32 access,
5963 				      struct x86_exception *exception)
5964 {
5965 	void *data = val;
5966 	int r = X86EMUL_CONTINUE;
5967 
5968 	while (bytes) {
5969 		gpa_t gpa = vcpu->arch.walk_mmu->gva_to_gpa(vcpu, addr, access,
5970 							    exception);
5971 		unsigned offset = addr & (PAGE_SIZE-1);
5972 		unsigned toread = min(bytes, (unsigned)PAGE_SIZE - offset);
5973 		int ret;
5974 
5975 		if (gpa == UNMAPPED_GVA)
5976 			return X86EMUL_PROPAGATE_FAULT;
5977 		ret = kvm_vcpu_read_guest_page(vcpu, gpa >> PAGE_SHIFT, data,
5978 					       offset, toread);
5979 		if (ret < 0) {
5980 			r = X86EMUL_IO_NEEDED;
5981 			goto out;
5982 		}
5983 
5984 		bytes -= toread;
5985 		data += toread;
5986 		addr += toread;
5987 	}
5988 out:
5989 	return r;
5990 }
5991 
5992 /* used for instruction fetching */
5993 static int kvm_fetch_guest_virt(struct x86_emulate_ctxt *ctxt,
5994 				gva_t addr, void *val, unsigned int bytes,
5995 				struct x86_exception *exception)
5996 {
5997 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
5998 	u32 access = (static_call(kvm_x86_get_cpl)(vcpu) == 3) ? PFERR_USER_MASK : 0;
5999 	unsigned offset;
6000 	int ret;
6001 
6002 	/* Inline kvm_read_guest_virt_helper for speed.  */
6003 	gpa_t gpa = vcpu->arch.walk_mmu->gva_to_gpa(vcpu, addr, access|PFERR_FETCH_MASK,
6004 						    exception);
6005 	if (unlikely(gpa == UNMAPPED_GVA))
6006 		return X86EMUL_PROPAGATE_FAULT;
6007 
6008 	offset = addr & (PAGE_SIZE-1);
6009 	if (WARN_ON(offset + bytes > PAGE_SIZE))
6010 		bytes = (unsigned)PAGE_SIZE - offset;
6011 	ret = kvm_vcpu_read_guest_page(vcpu, gpa >> PAGE_SHIFT, val,
6012 				       offset, bytes);
6013 	if (unlikely(ret < 0))
6014 		return X86EMUL_IO_NEEDED;
6015 
6016 	return X86EMUL_CONTINUE;
6017 }
6018 
6019 int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
6020 			       gva_t addr, void *val, unsigned int bytes,
6021 			       struct x86_exception *exception)
6022 {
6023 	u32 access = (static_call(kvm_x86_get_cpl)(vcpu) == 3) ? PFERR_USER_MASK : 0;
6024 
6025 	/*
6026 	 * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
6027 	 * is returned, but our callers are not ready for that and they blindly
6028 	 * call kvm_inject_page_fault.  Ensure that they at least do not leak
6029 	 * uninitialized kernel stack memory into cr2 and error code.
6030 	 */
6031 	memset(exception, 0, sizeof(*exception));
6032 	return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
6033 					  exception);
6034 }
6035 EXPORT_SYMBOL_GPL(kvm_read_guest_virt);
6036 
6037 static int emulator_read_std(struct x86_emulate_ctxt *ctxt,
6038 			     gva_t addr, void *val, unsigned int bytes,
6039 			     struct x86_exception *exception, bool system)
6040 {
6041 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6042 	u32 access = 0;
6043 
6044 	if (!system && static_call(kvm_x86_get_cpl)(vcpu) == 3)
6045 		access |= PFERR_USER_MASK;
6046 
6047 	return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access, exception);
6048 }
6049 
6050 static int kvm_read_guest_phys_system(struct x86_emulate_ctxt *ctxt,
6051 		unsigned long addr, void *val, unsigned int bytes)
6052 {
6053 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6054 	int r = kvm_vcpu_read_guest(vcpu, addr, val, bytes);
6055 
6056 	return r < 0 ? X86EMUL_IO_NEEDED : X86EMUL_CONTINUE;
6057 }
6058 
6059 static int kvm_write_guest_virt_helper(gva_t addr, void *val, unsigned int bytes,
6060 				      struct kvm_vcpu *vcpu, u32 access,
6061 				      struct x86_exception *exception)
6062 {
6063 	void *data = val;
6064 	int r = X86EMUL_CONTINUE;
6065 
6066 	while (bytes) {
6067 		gpa_t gpa =  vcpu->arch.walk_mmu->gva_to_gpa(vcpu, addr,
6068 							     access,
6069 							     exception);
6070 		unsigned offset = addr & (PAGE_SIZE-1);
6071 		unsigned towrite = min(bytes, (unsigned)PAGE_SIZE - offset);
6072 		int ret;
6073 
6074 		if (gpa == UNMAPPED_GVA)
6075 			return X86EMUL_PROPAGATE_FAULT;
6076 		ret = kvm_vcpu_write_guest(vcpu, gpa, data, towrite);
6077 		if (ret < 0) {
6078 			r = X86EMUL_IO_NEEDED;
6079 			goto out;
6080 		}
6081 
6082 		bytes -= towrite;
6083 		data += towrite;
6084 		addr += towrite;
6085 	}
6086 out:
6087 	return r;
6088 }
6089 
6090 static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *val,
6091 			      unsigned int bytes, struct x86_exception *exception,
6092 			      bool system)
6093 {
6094 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6095 	u32 access = PFERR_WRITE_MASK;
6096 
6097 	if (!system && static_call(kvm_x86_get_cpl)(vcpu) == 3)
6098 		access |= PFERR_USER_MASK;
6099 
6100 	return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,
6101 					   access, exception);
6102 }
6103 
6104 int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val,
6105 				unsigned int bytes, struct x86_exception *exception)
6106 {
6107 	/* kvm_write_guest_virt_system can pull in tons of pages. */
6108 	vcpu->arch.l1tf_flush_l1d = true;
6109 
6110 	return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,
6111 					   PFERR_WRITE_MASK, exception);
6112 }
6113 EXPORT_SYMBOL_GPL(kvm_write_guest_virt_system);
6114 
6115 int handle_ud(struct kvm_vcpu *vcpu)
6116 {
6117 	static const char kvm_emulate_prefix[] = { __KVM_EMULATE_PREFIX };
6118 	int emul_type = EMULTYPE_TRAP_UD;
6119 	char sig[5]; /* ud2; .ascii "kvm" */
6120 	struct x86_exception e;
6121 
6122 	if (unlikely(!static_call(kvm_x86_can_emulate_instruction)(vcpu, NULL, 0)))
6123 		return 1;
6124 
6125 	if (force_emulation_prefix &&
6126 	    kvm_read_guest_virt(vcpu, kvm_get_linear_rip(vcpu),
6127 				sig, sizeof(sig), &e) == 0 &&
6128 	    memcmp(sig, kvm_emulate_prefix, sizeof(sig)) == 0) {
6129 		kvm_rip_write(vcpu, kvm_rip_read(vcpu) + sizeof(sig));
6130 		emul_type = EMULTYPE_TRAP_UD_FORCED;
6131 	}
6132 
6133 	return kvm_emulate_instruction(vcpu, emul_type);
6134 }
6135 EXPORT_SYMBOL_GPL(handle_ud);
6136 
6137 static int vcpu_is_mmio_gpa(struct kvm_vcpu *vcpu, unsigned long gva,
6138 			    gpa_t gpa, bool write)
6139 {
6140 	/* For APIC access vmexit */
6141 	if ((gpa & PAGE_MASK) == APIC_DEFAULT_PHYS_BASE)
6142 		return 1;
6143 
6144 	if (vcpu_match_mmio_gpa(vcpu, gpa)) {
6145 		trace_vcpu_match_mmio(gva, gpa, write, true);
6146 		return 1;
6147 	}
6148 
6149 	return 0;
6150 }
6151 
6152 static int vcpu_mmio_gva_to_gpa(struct kvm_vcpu *vcpu, unsigned long gva,
6153 				gpa_t *gpa, struct x86_exception *exception,
6154 				bool write)
6155 {
6156 	u32 access = ((static_call(kvm_x86_get_cpl)(vcpu) == 3) ? PFERR_USER_MASK : 0)
6157 		| (write ? PFERR_WRITE_MASK : 0);
6158 
6159 	/*
6160 	 * currently PKRU is only applied to ept enabled guest so
6161 	 * there is no pkey in EPT page table for L1 guest or EPT
6162 	 * shadow page table for L2 guest.
6163 	 */
6164 	if (vcpu_match_mmio_gva(vcpu, gva)
6165 	    && !permission_fault(vcpu, vcpu->arch.walk_mmu,
6166 				 vcpu->arch.mmio_access, 0, access)) {
6167 		*gpa = vcpu->arch.mmio_gfn << PAGE_SHIFT |
6168 					(gva & (PAGE_SIZE - 1));
6169 		trace_vcpu_match_mmio(gva, *gpa, write, false);
6170 		return 1;
6171 	}
6172 
6173 	*gpa = vcpu->arch.walk_mmu->gva_to_gpa(vcpu, gva, access, exception);
6174 
6175 	if (*gpa == UNMAPPED_GVA)
6176 		return -1;
6177 
6178 	return vcpu_is_mmio_gpa(vcpu, gva, *gpa, write);
6179 }
6180 
6181 int emulator_write_phys(struct kvm_vcpu *vcpu, gpa_t gpa,
6182 			const void *val, int bytes)
6183 {
6184 	int ret;
6185 
6186 	ret = kvm_vcpu_write_guest(vcpu, gpa, val, bytes);
6187 	if (ret < 0)
6188 		return 0;
6189 	kvm_page_track_write(vcpu, gpa, val, bytes);
6190 	return 1;
6191 }
6192 
6193 struct read_write_emulator_ops {
6194 	int (*read_write_prepare)(struct kvm_vcpu *vcpu, void *val,
6195 				  int bytes);
6196 	int (*read_write_emulate)(struct kvm_vcpu *vcpu, gpa_t gpa,
6197 				  void *val, int bytes);
6198 	int (*read_write_mmio)(struct kvm_vcpu *vcpu, gpa_t gpa,
6199 			       int bytes, void *val);
6200 	int (*read_write_exit_mmio)(struct kvm_vcpu *vcpu, gpa_t gpa,
6201 				    void *val, int bytes);
6202 	bool write;
6203 };
6204 
6205 static int read_prepare(struct kvm_vcpu *vcpu, void *val, int bytes)
6206 {
6207 	if (vcpu->mmio_read_completed) {
6208 		trace_kvm_mmio(KVM_TRACE_MMIO_READ, bytes,
6209 			       vcpu->mmio_fragments[0].gpa, val);
6210 		vcpu->mmio_read_completed = 0;
6211 		return 1;
6212 	}
6213 
6214 	return 0;
6215 }
6216 
6217 static int read_emulate(struct kvm_vcpu *vcpu, gpa_t gpa,
6218 			void *val, int bytes)
6219 {
6220 	return !kvm_vcpu_read_guest(vcpu, gpa, val, bytes);
6221 }
6222 
6223 static int write_emulate(struct kvm_vcpu *vcpu, gpa_t gpa,
6224 			 void *val, int bytes)
6225 {
6226 	return emulator_write_phys(vcpu, gpa, val, bytes);
6227 }
6228 
6229 static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val)
6230 {
6231 	trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, val);
6232 	return vcpu_mmio_write(vcpu, gpa, bytes, val);
6233 }
6234 
6235 static int read_exit_mmio(struct kvm_vcpu *vcpu, gpa_t gpa,
6236 			  void *val, int bytes)
6237 {
6238 	trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, NULL);
6239 	return X86EMUL_IO_NEEDED;
6240 }
6241 
6242 static int write_exit_mmio(struct kvm_vcpu *vcpu, gpa_t gpa,
6243 			   void *val, int bytes)
6244 {
6245 	struct kvm_mmio_fragment *frag = &vcpu->mmio_fragments[0];
6246 
6247 	memcpy(vcpu->run->mmio.data, frag->data, min(8u, frag->len));
6248 	return X86EMUL_CONTINUE;
6249 }
6250 
6251 static const struct read_write_emulator_ops read_emultor = {
6252 	.read_write_prepare = read_prepare,
6253 	.read_write_emulate = read_emulate,
6254 	.read_write_mmio = vcpu_mmio_read,
6255 	.read_write_exit_mmio = read_exit_mmio,
6256 };
6257 
6258 static const struct read_write_emulator_ops write_emultor = {
6259 	.read_write_emulate = write_emulate,
6260 	.read_write_mmio = write_mmio,
6261 	.read_write_exit_mmio = write_exit_mmio,
6262 	.write = true,
6263 };
6264 
6265 static int emulator_read_write_onepage(unsigned long addr, void *val,
6266 				       unsigned int bytes,
6267 				       struct x86_exception *exception,
6268 				       struct kvm_vcpu *vcpu,
6269 				       const struct read_write_emulator_ops *ops)
6270 {
6271 	gpa_t gpa;
6272 	int handled, ret;
6273 	bool write = ops->write;
6274 	struct kvm_mmio_fragment *frag;
6275 	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
6276 
6277 	/*
6278 	 * If the exit was due to a NPF we may already have a GPA.
6279 	 * If the GPA is present, use it to avoid the GVA to GPA table walk.
6280 	 * Note, this cannot be used on string operations since string
6281 	 * operation using rep will only have the initial GPA from the NPF
6282 	 * occurred.
6283 	 */
6284 	if (ctxt->gpa_available && emulator_can_use_gpa(ctxt) &&
6285 	    (addr & ~PAGE_MASK) == (ctxt->gpa_val & ~PAGE_MASK)) {
6286 		gpa = ctxt->gpa_val;
6287 		ret = vcpu_is_mmio_gpa(vcpu, addr, gpa, write);
6288 	} else {
6289 		ret = vcpu_mmio_gva_to_gpa(vcpu, addr, &gpa, exception, write);
6290 		if (ret < 0)
6291 			return X86EMUL_PROPAGATE_FAULT;
6292 	}
6293 
6294 	if (!ret && ops->read_write_emulate(vcpu, gpa, val, bytes))
6295 		return X86EMUL_CONTINUE;
6296 
6297 	/*
6298 	 * Is this MMIO handled locally?
6299 	 */
6300 	handled = ops->read_write_mmio(vcpu, gpa, bytes, val);
6301 	if (handled == bytes)
6302 		return X86EMUL_CONTINUE;
6303 
6304 	gpa += handled;
6305 	bytes -= handled;
6306 	val += handled;
6307 
6308 	WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
6309 	frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
6310 	frag->gpa = gpa;
6311 	frag->data = val;
6312 	frag->len = bytes;
6313 	return X86EMUL_CONTINUE;
6314 }
6315 
6316 static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
6317 			unsigned long addr,
6318 			void *val, unsigned int bytes,
6319 			struct x86_exception *exception,
6320 			const struct read_write_emulator_ops *ops)
6321 {
6322 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6323 	gpa_t gpa;
6324 	int rc;
6325 
6326 	if (ops->read_write_prepare &&
6327 		  ops->read_write_prepare(vcpu, val, bytes))
6328 		return X86EMUL_CONTINUE;
6329 
6330 	vcpu->mmio_nr_fragments = 0;
6331 
6332 	/* Crossing a page boundary? */
6333 	if (((addr + bytes - 1) ^ addr) & PAGE_MASK) {
6334 		int now;
6335 
6336 		now = -addr & ~PAGE_MASK;
6337 		rc = emulator_read_write_onepage(addr, val, now, exception,
6338 						 vcpu, ops);
6339 
6340 		if (rc != X86EMUL_CONTINUE)
6341 			return rc;
6342 		addr += now;
6343 		if (ctxt->mode != X86EMUL_MODE_PROT64)
6344 			addr = (u32)addr;
6345 		val += now;
6346 		bytes -= now;
6347 	}
6348 
6349 	rc = emulator_read_write_onepage(addr, val, bytes, exception,
6350 					 vcpu, ops);
6351 	if (rc != X86EMUL_CONTINUE)
6352 		return rc;
6353 
6354 	if (!vcpu->mmio_nr_fragments)
6355 		return rc;
6356 
6357 	gpa = vcpu->mmio_fragments[0].gpa;
6358 
6359 	vcpu->mmio_needed = 1;
6360 	vcpu->mmio_cur_fragment = 0;
6361 
6362 	vcpu->run->mmio.len = min(8u, vcpu->mmio_fragments[0].len);
6363 	vcpu->run->mmio.is_write = vcpu->mmio_is_write = ops->write;
6364 	vcpu->run->exit_reason = KVM_EXIT_MMIO;
6365 	vcpu->run->mmio.phys_addr = gpa;
6366 
6367 	return ops->read_write_exit_mmio(vcpu, gpa, val, bytes);
6368 }
6369 
6370 static int emulator_read_emulated(struct x86_emulate_ctxt *ctxt,
6371 				  unsigned long addr,
6372 				  void *val,
6373 				  unsigned int bytes,
6374 				  struct x86_exception *exception)
6375 {
6376 	return emulator_read_write(ctxt, addr, val, bytes,
6377 				   exception, &read_emultor);
6378 }
6379 
6380 static int emulator_write_emulated(struct x86_emulate_ctxt *ctxt,
6381 			    unsigned long addr,
6382 			    const void *val,
6383 			    unsigned int bytes,
6384 			    struct x86_exception *exception)
6385 {
6386 	return emulator_read_write(ctxt, addr, (void *)val, bytes,
6387 				   exception, &write_emultor);
6388 }
6389 
6390 #define CMPXCHG_TYPE(t, ptr, old, new) \
6391 	(cmpxchg((t *)(ptr), *(t *)(old), *(t *)(new)) == *(t *)(old))
6392 
6393 #ifdef CONFIG_X86_64
6394 #  define CMPXCHG64(ptr, old, new) CMPXCHG_TYPE(u64, ptr, old, new)
6395 #else
6396 #  define CMPXCHG64(ptr, old, new) \
6397 	(cmpxchg64((u64 *)(ptr), *(u64 *)(old), *(u64 *)(new)) == *(u64 *)(old))
6398 #endif
6399 
6400 static int emulator_cmpxchg_emulated(struct x86_emulate_ctxt *ctxt,
6401 				     unsigned long addr,
6402 				     const void *old,
6403 				     const void *new,
6404 				     unsigned int bytes,
6405 				     struct x86_exception *exception)
6406 {
6407 	struct kvm_host_map map;
6408 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6409 	u64 page_line_mask;
6410 	gpa_t gpa;
6411 	char *kaddr;
6412 	bool exchanged;
6413 
6414 	/* guests cmpxchg8b have to be emulated atomically */
6415 	if (bytes > 8 || (bytes & (bytes - 1)))
6416 		goto emul_write;
6417 
6418 	gpa = kvm_mmu_gva_to_gpa_write(vcpu, addr, NULL);
6419 
6420 	if (gpa == UNMAPPED_GVA ||
6421 	    (gpa & PAGE_MASK) == APIC_DEFAULT_PHYS_BASE)
6422 		goto emul_write;
6423 
6424 	/*
6425 	 * Emulate the atomic as a straight write to avoid #AC if SLD is
6426 	 * enabled in the host and the access splits a cache line.
6427 	 */
6428 	if (boot_cpu_has(X86_FEATURE_SPLIT_LOCK_DETECT))
6429 		page_line_mask = ~(cache_line_size() - 1);
6430 	else
6431 		page_line_mask = PAGE_MASK;
6432 
6433 	if (((gpa + bytes - 1) & page_line_mask) != (gpa & page_line_mask))
6434 		goto emul_write;
6435 
6436 	if (kvm_vcpu_map(vcpu, gpa_to_gfn(gpa), &map))
6437 		goto emul_write;
6438 
6439 	kaddr = map.hva + offset_in_page(gpa);
6440 
6441 	switch (bytes) {
6442 	case 1:
6443 		exchanged = CMPXCHG_TYPE(u8, kaddr, old, new);
6444 		break;
6445 	case 2:
6446 		exchanged = CMPXCHG_TYPE(u16, kaddr, old, new);
6447 		break;
6448 	case 4:
6449 		exchanged = CMPXCHG_TYPE(u32, kaddr, old, new);
6450 		break;
6451 	case 8:
6452 		exchanged = CMPXCHG64(kaddr, old, new);
6453 		break;
6454 	default:
6455 		BUG();
6456 	}
6457 
6458 	kvm_vcpu_unmap(vcpu, &map, true);
6459 
6460 	if (!exchanged)
6461 		return X86EMUL_CMPXCHG_FAILED;
6462 
6463 	kvm_page_track_write(vcpu, gpa, new, bytes);
6464 
6465 	return X86EMUL_CONTINUE;
6466 
6467 emul_write:
6468 	printk_once(KERN_WARNING "kvm: emulating exchange as write\n");
6469 
6470 	return emulator_write_emulated(ctxt, addr, new, bytes, exception);
6471 }
6472 
6473 static int kernel_pio(struct kvm_vcpu *vcpu, void *pd)
6474 {
6475 	int r = 0, i;
6476 
6477 	for (i = 0; i < vcpu->arch.pio.count; i++) {
6478 		if (vcpu->arch.pio.in)
6479 			r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port,
6480 					    vcpu->arch.pio.size, pd);
6481 		else
6482 			r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
6483 					     vcpu->arch.pio.port, vcpu->arch.pio.size,
6484 					     pd);
6485 		if (r)
6486 			break;
6487 		pd += vcpu->arch.pio.size;
6488 	}
6489 	return r;
6490 }
6491 
6492 static int emulator_pio_in_out(struct kvm_vcpu *vcpu, int size,
6493 			       unsigned short port, void *val,
6494 			       unsigned int count, bool in)
6495 {
6496 	vcpu->arch.pio.port = port;
6497 	vcpu->arch.pio.in = in;
6498 	vcpu->arch.pio.count  = count;
6499 	vcpu->arch.pio.size = size;
6500 
6501 	if (!kernel_pio(vcpu, vcpu->arch.pio_data)) {
6502 		vcpu->arch.pio.count = 0;
6503 		return 1;
6504 	}
6505 
6506 	vcpu->run->exit_reason = KVM_EXIT_IO;
6507 	vcpu->run->io.direction = in ? KVM_EXIT_IO_IN : KVM_EXIT_IO_OUT;
6508 	vcpu->run->io.size = size;
6509 	vcpu->run->io.data_offset = KVM_PIO_PAGE_OFFSET * PAGE_SIZE;
6510 	vcpu->run->io.count = count;
6511 	vcpu->run->io.port = port;
6512 
6513 	return 0;
6514 }
6515 
6516 static int emulator_pio_in(struct kvm_vcpu *vcpu, int size,
6517 			   unsigned short port, void *val, unsigned int count)
6518 {
6519 	int ret;
6520 
6521 	if (vcpu->arch.pio.count)
6522 		goto data_avail;
6523 
6524 	memset(vcpu->arch.pio_data, 0, size * count);
6525 
6526 	ret = emulator_pio_in_out(vcpu, size, port, val, count, true);
6527 	if (ret) {
6528 data_avail:
6529 		memcpy(val, vcpu->arch.pio_data, size * count);
6530 		trace_kvm_pio(KVM_PIO_IN, port, size, count, vcpu->arch.pio_data);
6531 		vcpu->arch.pio.count = 0;
6532 		return 1;
6533 	}
6534 
6535 	return 0;
6536 }
6537 
6538 static int emulator_pio_in_emulated(struct x86_emulate_ctxt *ctxt,
6539 				    int size, unsigned short port, void *val,
6540 				    unsigned int count)
6541 {
6542 	return emulator_pio_in(emul_to_vcpu(ctxt), size, port, val, count);
6543 
6544 }
6545 
6546 static int emulator_pio_out(struct kvm_vcpu *vcpu, int size,
6547 			    unsigned short port, const void *val,
6548 			    unsigned int count)
6549 {
6550 	memcpy(vcpu->arch.pio_data, val, size * count);
6551 	trace_kvm_pio(KVM_PIO_OUT, port, size, count, vcpu->arch.pio_data);
6552 	return emulator_pio_in_out(vcpu, size, port, (void *)val, count, false);
6553 }
6554 
6555 static int emulator_pio_out_emulated(struct x86_emulate_ctxt *ctxt,
6556 				     int size, unsigned short port,
6557 				     const void *val, unsigned int count)
6558 {
6559 	return emulator_pio_out(emul_to_vcpu(ctxt), size, port, val, count);
6560 }
6561 
6562 static unsigned long get_segment_base(struct kvm_vcpu *vcpu, int seg)
6563 {
6564 	return static_call(kvm_x86_get_segment_base)(vcpu, seg);
6565 }
6566 
6567 static void emulator_invlpg(struct x86_emulate_ctxt *ctxt, ulong address)
6568 {
6569 	kvm_mmu_invlpg(emul_to_vcpu(ctxt), address);
6570 }
6571 
6572 static int kvm_emulate_wbinvd_noskip(struct kvm_vcpu *vcpu)
6573 {
6574 	if (!need_emulate_wbinvd(vcpu))
6575 		return X86EMUL_CONTINUE;
6576 
6577 	if (static_call(kvm_x86_has_wbinvd_exit)()) {
6578 		int cpu = get_cpu();
6579 
6580 		cpumask_set_cpu(cpu, vcpu->arch.wbinvd_dirty_mask);
6581 		smp_call_function_many(vcpu->arch.wbinvd_dirty_mask,
6582 				wbinvd_ipi, NULL, 1);
6583 		put_cpu();
6584 		cpumask_clear(vcpu->arch.wbinvd_dirty_mask);
6585 	} else
6586 		wbinvd();
6587 	return X86EMUL_CONTINUE;
6588 }
6589 
6590 int kvm_emulate_wbinvd(struct kvm_vcpu *vcpu)
6591 {
6592 	kvm_emulate_wbinvd_noskip(vcpu);
6593 	return kvm_skip_emulated_instruction(vcpu);
6594 }
6595 EXPORT_SYMBOL_GPL(kvm_emulate_wbinvd);
6596 
6597 
6598 
6599 static void emulator_wbinvd(struct x86_emulate_ctxt *ctxt)
6600 {
6601 	kvm_emulate_wbinvd_noskip(emul_to_vcpu(ctxt));
6602 }
6603 
6604 static void emulator_get_dr(struct x86_emulate_ctxt *ctxt, int dr,
6605 			    unsigned long *dest)
6606 {
6607 	kvm_get_dr(emul_to_vcpu(ctxt), dr, dest);
6608 }
6609 
6610 static int emulator_set_dr(struct x86_emulate_ctxt *ctxt, int dr,
6611 			   unsigned long value)
6612 {
6613 
6614 	return kvm_set_dr(emul_to_vcpu(ctxt), dr, value);
6615 }
6616 
6617 static u64 mk_cr_64(u64 curr_cr, u32 new_val)
6618 {
6619 	return (curr_cr & ~((1ULL << 32) - 1)) | new_val;
6620 }
6621 
6622 static unsigned long emulator_get_cr(struct x86_emulate_ctxt *ctxt, int cr)
6623 {
6624 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6625 	unsigned long value;
6626 
6627 	switch (cr) {
6628 	case 0:
6629 		value = kvm_read_cr0(vcpu);
6630 		break;
6631 	case 2:
6632 		value = vcpu->arch.cr2;
6633 		break;
6634 	case 3:
6635 		value = kvm_read_cr3(vcpu);
6636 		break;
6637 	case 4:
6638 		value = kvm_read_cr4(vcpu);
6639 		break;
6640 	case 8:
6641 		value = kvm_get_cr8(vcpu);
6642 		break;
6643 	default:
6644 		kvm_err("%s: unexpected cr %u\n", __func__, cr);
6645 		return 0;
6646 	}
6647 
6648 	return value;
6649 }
6650 
6651 static int emulator_set_cr(struct x86_emulate_ctxt *ctxt, int cr, ulong val)
6652 {
6653 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6654 	int res = 0;
6655 
6656 	switch (cr) {
6657 	case 0:
6658 		res = kvm_set_cr0(vcpu, mk_cr_64(kvm_read_cr0(vcpu), val));
6659 		break;
6660 	case 2:
6661 		vcpu->arch.cr2 = val;
6662 		break;
6663 	case 3:
6664 		res = kvm_set_cr3(vcpu, val);
6665 		break;
6666 	case 4:
6667 		res = kvm_set_cr4(vcpu, mk_cr_64(kvm_read_cr4(vcpu), val));
6668 		break;
6669 	case 8:
6670 		res = kvm_set_cr8(vcpu, val);
6671 		break;
6672 	default:
6673 		kvm_err("%s: unexpected cr %u\n", __func__, cr);
6674 		res = -1;
6675 	}
6676 
6677 	return res;
6678 }
6679 
6680 static int emulator_get_cpl(struct x86_emulate_ctxt *ctxt)
6681 {
6682 	return static_call(kvm_x86_get_cpl)(emul_to_vcpu(ctxt));
6683 }
6684 
6685 static void emulator_get_gdt(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt)
6686 {
6687 	static_call(kvm_x86_get_gdt)(emul_to_vcpu(ctxt), dt);
6688 }
6689 
6690 static void emulator_get_idt(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt)
6691 {
6692 	static_call(kvm_x86_get_idt)(emul_to_vcpu(ctxt), dt);
6693 }
6694 
6695 static void emulator_set_gdt(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt)
6696 {
6697 	static_call(kvm_x86_set_gdt)(emul_to_vcpu(ctxt), dt);
6698 }
6699 
6700 static void emulator_set_idt(struct x86_emulate_ctxt *ctxt, struct desc_ptr *dt)
6701 {
6702 	static_call(kvm_x86_set_idt)(emul_to_vcpu(ctxt), dt);
6703 }
6704 
6705 static unsigned long emulator_get_cached_segment_base(
6706 	struct x86_emulate_ctxt *ctxt, int seg)
6707 {
6708 	return get_segment_base(emul_to_vcpu(ctxt), seg);
6709 }
6710 
6711 static bool emulator_get_segment(struct x86_emulate_ctxt *ctxt, u16 *selector,
6712 				 struct desc_struct *desc, u32 *base3,
6713 				 int seg)
6714 {
6715 	struct kvm_segment var;
6716 
6717 	kvm_get_segment(emul_to_vcpu(ctxt), &var, seg);
6718 	*selector = var.selector;
6719 
6720 	if (var.unusable) {
6721 		memset(desc, 0, sizeof(*desc));
6722 		if (base3)
6723 			*base3 = 0;
6724 		return false;
6725 	}
6726 
6727 	if (var.g)
6728 		var.limit >>= 12;
6729 	set_desc_limit(desc, var.limit);
6730 	set_desc_base(desc, (unsigned long)var.base);
6731 #ifdef CONFIG_X86_64
6732 	if (base3)
6733 		*base3 = var.base >> 32;
6734 #endif
6735 	desc->type = var.type;
6736 	desc->s = var.s;
6737 	desc->dpl = var.dpl;
6738 	desc->p = var.present;
6739 	desc->avl = var.avl;
6740 	desc->l = var.l;
6741 	desc->d = var.db;
6742 	desc->g = var.g;
6743 
6744 	return true;
6745 }
6746 
6747 static void emulator_set_segment(struct x86_emulate_ctxt *ctxt, u16 selector,
6748 				 struct desc_struct *desc, u32 base3,
6749 				 int seg)
6750 {
6751 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6752 	struct kvm_segment var;
6753 
6754 	var.selector = selector;
6755 	var.base = get_desc_base(desc);
6756 #ifdef CONFIG_X86_64
6757 	var.base |= ((u64)base3) << 32;
6758 #endif
6759 	var.limit = get_desc_limit(desc);
6760 	if (desc->g)
6761 		var.limit = (var.limit << 12) | 0xfff;
6762 	var.type = desc->type;
6763 	var.dpl = desc->dpl;
6764 	var.db = desc->d;
6765 	var.s = desc->s;
6766 	var.l = desc->l;
6767 	var.g = desc->g;
6768 	var.avl = desc->avl;
6769 	var.present = desc->p;
6770 	var.unusable = !var.present;
6771 	var.padding = 0;
6772 
6773 	kvm_set_segment(vcpu, &var, seg);
6774 	return;
6775 }
6776 
6777 static int emulator_get_msr(struct x86_emulate_ctxt *ctxt,
6778 			    u32 msr_index, u64 *pdata)
6779 {
6780 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6781 	int r;
6782 
6783 	r = kvm_get_msr(vcpu, msr_index, pdata);
6784 
6785 	if (r && kvm_get_msr_user_space(vcpu, msr_index, r)) {
6786 		/* Bounce to user space */
6787 		return X86EMUL_IO_NEEDED;
6788 	}
6789 
6790 	return r;
6791 }
6792 
6793 static int emulator_set_msr(struct x86_emulate_ctxt *ctxt,
6794 			    u32 msr_index, u64 data)
6795 {
6796 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6797 	int r;
6798 
6799 	r = kvm_set_msr(vcpu, msr_index, data);
6800 
6801 	if (r && kvm_set_msr_user_space(vcpu, msr_index, data, r)) {
6802 		/* Bounce to user space */
6803 		return X86EMUL_IO_NEEDED;
6804 	}
6805 
6806 	return r;
6807 }
6808 
6809 static u64 emulator_get_smbase(struct x86_emulate_ctxt *ctxt)
6810 {
6811 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6812 
6813 	return vcpu->arch.smbase;
6814 }
6815 
6816 static void emulator_set_smbase(struct x86_emulate_ctxt *ctxt, u64 smbase)
6817 {
6818 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
6819 
6820 	vcpu->arch.smbase = smbase;
6821 }
6822 
6823 static int emulator_check_pmc(struct x86_emulate_ctxt *ctxt,
6824 			      u32 pmc)
6825 {
6826 	return kvm_pmu_is_valid_rdpmc_ecx(emul_to_vcpu(ctxt), pmc);
6827 }
6828 
6829 static int emulator_read_pmc(struct x86_emulate_ctxt *ctxt,
6830 			     u32 pmc, u64 *pdata)
6831 {
6832 	return kvm_pmu_rdpmc(emul_to_vcpu(ctxt), pmc, pdata);
6833 }
6834 
6835 static void emulator_halt(struct x86_emulate_ctxt *ctxt)
6836 {
6837 	emul_to_vcpu(ctxt)->arch.halt_request = 1;
6838 }
6839 
6840 static int emulator_intercept(struct x86_emulate_ctxt *ctxt,
6841 			      struct x86_instruction_info *info,
6842 			      enum x86_intercept_stage stage)
6843 {
6844 	return static_call(kvm_x86_check_intercept)(emul_to_vcpu(ctxt), info, stage,
6845 					    &ctxt->exception);
6846 }
6847 
6848 static bool emulator_get_cpuid(struct x86_emulate_ctxt *ctxt,
6849 			      u32 *eax, u32 *ebx, u32 *ecx, u32 *edx,
6850 			      bool exact_only)
6851 {
6852 	return kvm_cpuid(emul_to_vcpu(ctxt), eax, ebx, ecx, edx, exact_only);
6853 }
6854 
6855 static bool emulator_guest_has_long_mode(struct x86_emulate_ctxt *ctxt)
6856 {
6857 	return guest_cpuid_has(emul_to_vcpu(ctxt), X86_FEATURE_LM);
6858 }
6859 
6860 static bool emulator_guest_has_movbe(struct x86_emulate_ctxt *ctxt)
6861 {
6862 	return guest_cpuid_has(emul_to_vcpu(ctxt), X86_FEATURE_MOVBE);
6863 }
6864 
6865 static bool emulator_guest_has_fxsr(struct x86_emulate_ctxt *ctxt)
6866 {
6867 	return guest_cpuid_has(emul_to_vcpu(ctxt), X86_FEATURE_FXSR);
6868 }
6869 
6870 static ulong emulator_read_gpr(struct x86_emulate_ctxt *ctxt, unsigned reg)
6871 {
6872 	return kvm_register_read(emul_to_vcpu(ctxt), reg);
6873 }
6874 
6875 static void emulator_write_gpr(struct x86_emulate_ctxt *ctxt, unsigned reg, ulong val)
6876 {
6877 	kvm_register_write(emul_to_vcpu(ctxt), reg, val);
6878 }
6879 
6880 static void emulator_set_nmi_mask(struct x86_emulate_ctxt *ctxt, bool masked)
6881 {
6882 	static_call(kvm_x86_set_nmi_mask)(emul_to_vcpu(ctxt), masked);
6883 }
6884 
6885 static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt)
6886 {
6887 	return emul_to_vcpu(ctxt)->arch.hflags;
6888 }
6889 
6890 static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags)
6891 {
6892 	emul_to_vcpu(ctxt)->arch.hflags = emul_flags;
6893 }
6894 
6895 static int emulator_pre_leave_smm(struct x86_emulate_ctxt *ctxt,
6896 				  const char *smstate)
6897 {
6898 	return static_call(kvm_x86_pre_leave_smm)(emul_to_vcpu(ctxt), smstate);
6899 }
6900 
6901 static void emulator_post_leave_smm(struct x86_emulate_ctxt *ctxt)
6902 {
6903 	kvm_smm_changed(emul_to_vcpu(ctxt));
6904 }
6905 
6906 static int emulator_set_xcr(struct x86_emulate_ctxt *ctxt, u32 index, u64 xcr)
6907 {
6908 	return __kvm_set_xcr(emul_to_vcpu(ctxt), index, xcr);
6909 }
6910 
6911 static const struct x86_emulate_ops emulate_ops = {
6912 	.read_gpr            = emulator_read_gpr,
6913 	.write_gpr           = emulator_write_gpr,
6914 	.read_std            = emulator_read_std,
6915 	.write_std           = emulator_write_std,
6916 	.read_phys           = kvm_read_guest_phys_system,
6917 	.fetch               = kvm_fetch_guest_virt,
6918 	.read_emulated       = emulator_read_emulated,
6919 	.write_emulated      = emulator_write_emulated,
6920 	.cmpxchg_emulated    = emulator_cmpxchg_emulated,
6921 	.invlpg              = emulator_invlpg,
6922 	.pio_in_emulated     = emulator_pio_in_emulated,
6923 	.pio_out_emulated    = emulator_pio_out_emulated,
6924 	.get_segment         = emulator_get_segment,
6925 	.set_segment         = emulator_set_segment,
6926 	.get_cached_segment_base = emulator_get_cached_segment_base,
6927 	.get_gdt             = emulator_get_gdt,
6928 	.get_idt	     = emulator_get_idt,
6929 	.set_gdt             = emulator_set_gdt,
6930 	.set_idt	     = emulator_set_idt,
6931 	.get_cr              = emulator_get_cr,
6932 	.set_cr              = emulator_set_cr,
6933 	.cpl                 = emulator_get_cpl,
6934 	.get_dr              = emulator_get_dr,
6935 	.set_dr              = emulator_set_dr,
6936 	.get_smbase          = emulator_get_smbase,
6937 	.set_smbase          = emulator_set_smbase,
6938 	.set_msr             = emulator_set_msr,
6939 	.get_msr             = emulator_get_msr,
6940 	.check_pmc	     = emulator_check_pmc,
6941 	.read_pmc            = emulator_read_pmc,
6942 	.halt                = emulator_halt,
6943 	.wbinvd              = emulator_wbinvd,
6944 	.fix_hypercall       = emulator_fix_hypercall,
6945 	.intercept           = emulator_intercept,
6946 	.get_cpuid           = emulator_get_cpuid,
6947 	.guest_has_long_mode = emulator_guest_has_long_mode,
6948 	.guest_has_movbe     = emulator_guest_has_movbe,
6949 	.guest_has_fxsr      = emulator_guest_has_fxsr,
6950 	.set_nmi_mask        = emulator_set_nmi_mask,
6951 	.get_hflags          = emulator_get_hflags,
6952 	.set_hflags          = emulator_set_hflags,
6953 	.pre_leave_smm       = emulator_pre_leave_smm,
6954 	.post_leave_smm      = emulator_post_leave_smm,
6955 	.set_xcr             = emulator_set_xcr,
6956 };
6957 
6958 static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask)
6959 {
6960 	u32 int_shadow = static_call(kvm_x86_get_interrupt_shadow)(vcpu);
6961 	/*
6962 	 * an sti; sti; sequence only disable interrupts for the first
6963 	 * instruction. So, if the last instruction, be it emulated or
6964 	 * not, left the system with the INT_STI flag enabled, it
6965 	 * means that the last instruction is an sti. We should not
6966 	 * leave the flag on in this case. The same goes for mov ss
6967 	 */
6968 	if (int_shadow & mask)
6969 		mask = 0;
6970 	if (unlikely(int_shadow || mask)) {
6971 		static_call(kvm_x86_set_interrupt_shadow)(vcpu, mask);
6972 		if (!mask)
6973 			kvm_make_request(KVM_REQ_EVENT, vcpu);
6974 	}
6975 }
6976 
6977 static bool inject_emulated_exception(struct kvm_vcpu *vcpu)
6978 {
6979 	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
6980 	if (ctxt->exception.vector == PF_VECTOR)
6981 		return kvm_inject_emulated_page_fault(vcpu, &ctxt->exception);
6982 
6983 	if (ctxt->exception.error_code_valid)
6984 		kvm_queue_exception_e(vcpu, ctxt->exception.vector,
6985 				      ctxt->exception.error_code);
6986 	else
6987 		kvm_queue_exception(vcpu, ctxt->exception.vector);
6988 	return false;
6989 }
6990 
6991 static struct x86_emulate_ctxt *alloc_emulate_ctxt(struct kvm_vcpu *vcpu)
6992 {
6993 	struct x86_emulate_ctxt *ctxt;
6994 
6995 	ctxt = kmem_cache_zalloc(x86_emulator_cache, GFP_KERNEL_ACCOUNT);
6996 	if (!ctxt) {
6997 		pr_err("kvm: failed to allocate vcpu's emulator\n");
6998 		return NULL;
6999 	}
7000 
7001 	ctxt->vcpu = vcpu;
7002 	ctxt->ops = &emulate_ops;
7003 	vcpu->arch.emulate_ctxt = ctxt;
7004 
7005 	return ctxt;
7006 }
7007 
7008 static void init_emulate_ctxt(struct kvm_vcpu *vcpu)
7009 {
7010 	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
7011 	int cs_db, cs_l;
7012 
7013 	static_call(kvm_x86_get_cs_db_l_bits)(vcpu, &cs_db, &cs_l);
7014 
7015 	ctxt->gpa_available = false;
7016 	ctxt->eflags = kvm_get_rflags(vcpu);
7017 	ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0;
7018 
7019 	ctxt->eip = kvm_rip_read(vcpu);
7020 	ctxt->mode = (!is_protmode(vcpu))		? X86EMUL_MODE_REAL :
7021 		     (ctxt->eflags & X86_EFLAGS_VM)	? X86EMUL_MODE_VM86 :
7022 		     (cs_l && is_long_mode(vcpu))	? X86EMUL_MODE_PROT64 :
7023 		     cs_db				? X86EMUL_MODE_PROT32 :
7024 							  X86EMUL_MODE_PROT16;
7025 	BUILD_BUG_ON(HF_GUEST_MASK != X86EMUL_GUEST_MASK);
7026 	BUILD_BUG_ON(HF_SMM_MASK != X86EMUL_SMM_MASK);
7027 	BUILD_BUG_ON(HF_SMM_INSIDE_NMI_MASK != X86EMUL_SMM_INSIDE_NMI_MASK);
7028 
7029 	init_decode_cache(ctxt);
7030 	vcpu->arch.emulate_regs_need_sync_from_vcpu = false;
7031 }
7032 
7033 void kvm_inject_realmode_interrupt(struct kvm_vcpu *vcpu, int irq, int inc_eip)
7034 {
7035 	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
7036 	int ret;
7037 
7038 	init_emulate_ctxt(vcpu);
7039 
7040 	ctxt->op_bytes = 2;
7041 	ctxt->ad_bytes = 2;
7042 	ctxt->_eip = ctxt->eip + inc_eip;
7043 	ret = emulate_int_real(ctxt, irq);
7044 
7045 	if (ret != X86EMUL_CONTINUE) {
7046 		kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
7047 	} else {
7048 		ctxt->eip = ctxt->_eip;
7049 		kvm_rip_write(vcpu, ctxt->eip);
7050 		kvm_set_rflags(vcpu, ctxt->eflags);
7051 	}
7052 }
7053 EXPORT_SYMBOL_GPL(kvm_inject_realmode_interrupt);
7054 
7055 static int handle_emulation_failure(struct kvm_vcpu *vcpu, int emulation_type)
7056 {
7057 	++vcpu->stat.insn_emulation_fail;
7058 	trace_kvm_emulate_insn_failed(vcpu);
7059 
7060 	if (emulation_type & EMULTYPE_VMWARE_GP) {
7061 		kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
7062 		return 1;
7063 	}
7064 
7065 	if (emulation_type & EMULTYPE_SKIP) {
7066 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
7067 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
7068 		vcpu->run->internal.ndata = 0;
7069 		return 0;
7070 	}
7071 
7072 	kvm_queue_exception(vcpu, UD_VECTOR);
7073 
7074 	if (!is_guest_mode(vcpu) && static_call(kvm_x86_get_cpl)(vcpu) == 0) {
7075 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
7076 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
7077 		vcpu->run->internal.ndata = 0;
7078 		return 0;
7079 	}
7080 
7081 	return 1;
7082 }
7083 
7084 static bool reexecute_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
7085 				  bool write_fault_to_shadow_pgtable,
7086 				  int emulation_type)
7087 {
7088 	gpa_t gpa = cr2_or_gpa;
7089 	kvm_pfn_t pfn;
7090 
7091 	if (!(emulation_type & EMULTYPE_ALLOW_RETRY_PF))
7092 		return false;
7093 
7094 	if (WARN_ON_ONCE(is_guest_mode(vcpu)) ||
7095 	    WARN_ON_ONCE(!(emulation_type & EMULTYPE_PF)))
7096 		return false;
7097 
7098 	if (!vcpu->arch.mmu->direct_map) {
7099 		/*
7100 		 * Write permission should be allowed since only
7101 		 * write access need to be emulated.
7102 		 */
7103 		gpa = kvm_mmu_gva_to_gpa_write(vcpu, cr2_or_gpa, NULL);
7104 
7105 		/*
7106 		 * If the mapping is invalid in guest, let cpu retry
7107 		 * it to generate fault.
7108 		 */
7109 		if (gpa == UNMAPPED_GVA)
7110 			return true;
7111 	}
7112 
7113 	/*
7114 	 * Do not retry the unhandleable instruction if it faults on the
7115 	 * readonly host memory, otherwise it will goto a infinite loop:
7116 	 * retry instruction -> write #PF -> emulation fail -> retry
7117 	 * instruction -> ...
7118 	 */
7119 	pfn = gfn_to_pfn(vcpu->kvm, gpa_to_gfn(gpa));
7120 
7121 	/*
7122 	 * If the instruction failed on the error pfn, it can not be fixed,
7123 	 * report the error to userspace.
7124 	 */
7125 	if (is_error_noslot_pfn(pfn))
7126 		return false;
7127 
7128 	kvm_release_pfn_clean(pfn);
7129 
7130 	/* The instructions are well-emulated on direct mmu. */
7131 	if (vcpu->arch.mmu->direct_map) {
7132 		unsigned int indirect_shadow_pages;
7133 
7134 		write_lock(&vcpu->kvm->mmu_lock);
7135 		indirect_shadow_pages = vcpu->kvm->arch.indirect_shadow_pages;
7136 		write_unlock(&vcpu->kvm->mmu_lock);
7137 
7138 		if (indirect_shadow_pages)
7139 			kvm_mmu_unprotect_page(vcpu->kvm, gpa_to_gfn(gpa));
7140 
7141 		return true;
7142 	}
7143 
7144 	/*
7145 	 * if emulation was due to access to shadowed page table
7146 	 * and it failed try to unshadow page and re-enter the
7147 	 * guest to let CPU execute the instruction.
7148 	 */
7149 	kvm_mmu_unprotect_page(vcpu->kvm, gpa_to_gfn(gpa));
7150 
7151 	/*
7152 	 * If the access faults on its page table, it can not
7153 	 * be fixed by unprotecting shadow page and it should
7154 	 * be reported to userspace.
7155 	 */
7156 	return !write_fault_to_shadow_pgtable;
7157 }
7158 
7159 static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
7160 			      gpa_t cr2_or_gpa,  int emulation_type)
7161 {
7162 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
7163 	unsigned long last_retry_eip, last_retry_addr, gpa = cr2_or_gpa;
7164 
7165 	last_retry_eip = vcpu->arch.last_retry_eip;
7166 	last_retry_addr = vcpu->arch.last_retry_addr;
7167 
7168 	/*
7169 	 * If the emulation is caused by #PF and it is non-page_table
7170 	 * writing instruction, it means the VM-EXIT is caused by shadow
7171 	 * page protected, we can zap the shadow page and retry this
7172 	 * instruction directly.
7173 	 *
7174 	 * Note: if the guest uses a non-page-table modifying instruction
7175 	 * on the PDE that points to the instruction, then we will unmap
7176 	 * the instruction and go to an infinite loop. So, we cache the
7177 	 * last retried eip and the last fault address, if we meet the eip
7178 	 * and the address again, we can break out of the potential infinite
7179 	 * loop.
7180 	 */
7181 	vcpu->arch.last_retry_eip = vcpu->arch.last_retry_addr = 0;
7182 
7183 	if (!(emulation_type & EMULTYPE_ALLOW_RETRY_PF))
7184 		return false;
7185 
7186 	if (WARN_ON_ONCE(is_guest_mode(vcpu)) ||
7187 	    WARN_ON_ONCE(!(emulation_type & EMULTYPE_PF)))
7188 		return false;
7189 
7190 	if (x86_page_table_writing_insn(ctxt))
7191 		return false;
7192 
7193 	if (ctxt->eip == last_retry_eip && last_retry_addr == cr2_or_gpa)
7194 		return false;
7195 
7196 	vcpu->arch.last_retry_eip = ctxt->eip;
7197 	vcpu->arch.last_retry_addr = cr2_or_gpa;
7198 
7199 	if (!vcpu->arch.mmu->direct_map)
7200 		gpa = kvm_mmu_gva_to_gpa_write(vcpu, cr2_or_gpa, NULL);
7201 
7202 	kvm_mmu_unprotect_page(vcpu->kvm, gpa_to_gfn(gpa));
7203 
7204 	return true;
7205 }
7206 
7207 static int complete_emulated_mmio(struct kvm_vcpu *vcpu);
7208 static int complete_emulated_pio(struct kvm_vcpu *vcpu);
7209 
7210 static void kvm_smm_changed(struct kvm_vcpu *vcpu)
7211 {
7212 	if (!(vcpu->arch.hflags & HF_SMM_MASK)) {
7213 		/* This is a good place to trace that we are exiting SMM.  */
7214 		trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, false);
7215 
7216 		/* Process a latched INIT or SMI, if any.  */
7217 		kvm_make_request(KVM_REQ_EVENT, vcpu);
7218 	}
7219 
7220 	kvm_mmu_reset_context(vcpu);
7221 }
7222 
7223 static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7,
7224 				unsigned long *db)
7225 {
7226 	u32 dr6 = 0;
7227 	int i;
7228 	u32 enable, rwlen;
7229 
7230 	enable = dr7;
7231 	rwlen = dr7 >> 16;
7232 	for (i = 0; i < 4; i++, enable >>= 2, rwlen >>= 4)
7233 		if ((enable & 3) && (rwlen & 15) == type && db[i] == addr)
7234 			dr6 |= (1 << i);
7235 	return dr6;
7236 }
7237 
7238 static int kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu)
7239 {
7240 	struct kvm_run *kvm_run = vcpu->run;
7241 
7242 	if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
7243 		kvm_run->debug.arch.dr6 = DR6_BS | DR6_ACTIVE_LOW;
7244 		kvm_run->debug.arch.pc = kvm_get_linear_rip(vcpu);
7245 		kvm_run->debug.arch.exception = DB_VECTOR;
7246 		kvm_run->exit_reason = KVM_EXIT_DEBUG;
7247 		return 0;
7248 	}
7249 	kvm_queue_exception_p(vcpu, DB_VECTOR, DR6_BS);
7250 	return 1;
7251 }
7252 
7253 int kvm_skip_emulated_instruction(struct kvm_vcpu *vcpu)
7254 {
7255 	unsigned long rflags = static_call(kvm_x86_get_rflags)(vcpu);
7256 	int r;
7257 
7258 	r = static_call(kvm_x86_skip_emulated_instruction)(vcpu);
7259 	if (unlikely(!r))
7260 		return 0;
7261 
7262 	/*
7263 	 * rflags is the old, "raw" value of the flags.  The new value has
7264 	 * not been saved yet.
7265 	 *
7266 	 * This is correct even for TF set by the guest, because "the
7267 	 * processor will not generate this exception after the instruction
7268 	 * that sets the TF flag".
7269 	 */
7270 	if (unlikely(rflags & X86_EFLAGS_TF))
7271 		r = kvm_vcpu_do_singlestep(vcpu);
7272 	return r;
7273 }
7274 EXPORT_SYMBOL_GPL(kvm_skip_emulated_instruction);
7275 
7276 static bool kvm_vcpu_check_breakpoint(struct kvm_vcpu *vcpu, int *r)
7277 {
7278 	if (unlikely(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) &&
7279 	    (vcpu->arch.guest_debug_dr7 & DR7_BP_EN_MASK)) {
7280 		struct kvm_run *kvm_run = vcpu->run;
7281 		unsigned long eip = kvm_get_linear_rip(vcpu);
7282 		u32 dr6 = kvm_vcpu_check_hw_bp(eip, 0,
7283 					   vcpu->arch.guest_debug_dr7,
7284 					   vcpu->arch.eff_db);
7285 
7286 		if (dr6 != 0) {
7287 			kvm_run->debug.arch.dr6 = dr6 | DR6_ACTIVE_LOW;
7288 			kvm_run->debug.arch.pc = eip;
7289 			kvm_run->debug.arch.exception = DB_VECTOR;
7290 			kvm_run->exit_reason = KVM_EXIT_DEBUG;
7291 			*r = 0;
7292 			return true;
7293 		}
7294 	}
7295 
7296 	if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK) &&
7297 	    !(kvm_get_rflags(vcpu) & X86_EFLAGS_RF)) {
7298 		unsigned long eip = kvm_get_linear_rip(vcpu);
7299 		u32 dr6 = kvm_vcpu_check_hw_bp(eip, 0,
7300 					   vcpu->arch.dr7,
7301 					   vcpu->arch.db);
7302 
7303 		if (dr6 != 0) {
7304 			kvm_queue_exception_p(vcpu, DB_VECTOR, dr6);
7305 			*r = 1;
7306 			return true;
7307 		}
7308 	}
7309 
7310 	return false;
7311 }
7312 
7313 static bool is_vmware_backdoor_opcode(struct x86_emulate_ctxt *ctxt)
7314 {
7315 	switch (ctxt->opcode_len) {
7316 	case 1:
7317 		switch (ctxt->b) {
7318 		case 0xe4:	/* IN */
7319 		case 0xe5:
7320 		case 0xec:
7321 		case 0xed:
7322 		case 0xe6:	/* OUT */
7323 		case 0xe7:
7324 		case 0xee:
7325 		case 0xef:
7326 		case 0x6c:	/* INS */
7327 		case 0x6d:
7328 		case 0x6e:	/* OUTS */
7329 		case 0x6f:
7330 			return true;
7331 		}
7332 		break;
7333 	case 2:
7334 		switch (ctxt->b) {
7335 		case 0x33:	/* RDPMC */
7336 			return true;
7337 		}
7338 		break;
7339 	}
7340 
7341 	return false;
7342 }
7343 
7344 /*
7345  * Decode to be emulated instruction. Return EMULATION_OK if success.
7346  */
7347 int x86_decode_emulated_instruction(struct kvm_vcpu *vcpu, int emulation_type,
7348 				    void *insn, int insn_len)
7349 {
7350 	int r = EMULATION_OK;
7351 	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
7352 
7353 	init_emulate_ctxt(vcpu);
7354 
7355 	/*
7356 	 * We will reenter on the same instruction since we do not set
7357 	 * complete_userspace_io. This does not handle watchpoints yet,
7358 	 * those would be handled in the emulate_ops.
7359 	 */
7360 	if (!(emulation_type & EMULTYPE_SKIP) &&
7361 	    kvm_vcpu_check_breakpoint(vcpu, &r))
7362 		return r;
7363 
7364 	ctxt->interruptibility = 0;
7365 	ctxt->have_exception = false;
7366 	ctxt->exception.vector = -1;
7367 	ctxt->perm_ok = false;
7368 
7369 	ctxt->ud = emulation_type & EMULTYPE_TRAP_UD;
7370 
7371 	r = x86_decode_insn(ctxt, insn, insn_len);
7372 
7373 	trace_kvm_emulate_insn_start(vcpu);
7374 	++vcpu->stat.insn_emulation;
7375 
7376 	return r;
7377 }
7378 EXPORT_SYMBOL_GPL(x86_decode_emulated_instruction);
7379 
7380 int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
7381 			    int emulation_type, void *insn, int insn_len)
7382 {
7383 	int r;
7384 	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
7385 	bool writeback = true;
7386 	bool write_fault_to_spt;
7387 
7388 	if (unlikely(!static_call(kvm_x86_can_emulate_instruction)(vcpu, insn, insn_len)))
7389 		return 1;
7390 
7391 	vcpu->arch.l1tf_flush_l1d = true;
7392 
7393 	/*
7394 	 * Clear write_fault_to_shadow_pgtable here to ensure it is
7395 	 * never reused.
7396 	 */
7397 	write_fault_to_spt = vcpu->arch.write_fault_to_shadow_pgtable;
7398 	vcpu->arch.write_fault_to_shadow_pgtable = false;
7399 
7400 	if (!(emulation_type & EMULTYPE_NO_DECODE)) {
7401 		kvm_clear_exception_queue(vcpu);
7402 
7403 		r = x86_decode_emulated_instruction(vcpu, emulation_type,
7404 						    insn, insn_len);
7405 		if (r != EMULATION_OK)  {
7406 			if ((emulation_type & EMULTYPE_TRAP_UD) ||
7407 			    (emulation_type & EMULTYPE_TRAP_UD_FORCED)) {
7408 				kvm_queue_exception(vcpu, UD_VECTOR);
7409 				return 1;
7410 			}
7411 			if (reexecute_instruction(vcpu, cr2_or_gpa,
7412 						  write_fault_to_spt,
7413 						  emulation_type))
7414 				return 1;
7415 			if (ctxt->have_exception) {
7416 				/*
7417 				 * #UD should result in just EMULATION_FAILED, and trap-like
7418 				 * exception should not be encountered during decode.
7419 				 */
7420 				WARN_ON_ONCE(ctxt->exception.vector == UD_VECTOR ||
7421 					     exception_type(ctxt->exception.vector) == EXCPT_TRAP);
7422 				inject_emulated_exception(vcpu);
7423 				return 1;
7424 			}
7425 			return handle_emulation_failure(vcpu, emulation_type);
7426 		}
7427 	}
7428 
7429 	if ((emulation_type & EMULTYPE_VMWARE_GP) &&
7430 	    !is_vmware_backdoor_opcode(ctxt)) {
7431 		kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
7432 		return 1;
7433 	}
7434 
7435 	/*
7436 	 * Note, EMULTYPE_SKIP is intended for use *only* by vendor callbacks
7437 	 * for kvm_skip_emulated_instruction().  The caller is responsible for
7438 	 * updating interruptibility state and injecting single-step #DBs.
7439 	 */
7440 	if (emulation_type & EMULTYPE_SKIP) {
7441 		kvm_rip_write(vcpu, ctxt->_eip);
7442 		if (ctxt->eflags & X86_EFLAGS_RF)
7443 			kvm_set_rflags(vcpu, ctxt->eflags & ~X86_EFLAGS_RF);
7444 		return 1;
7445 	}
7446 
7447 	if (retry_instruction(ctxt, cr2_or_gpa, emulation_type))
7448 		return 1;
7449 
7450 	/* this is needed for vmware backdoor interface to work since it
7451 	   changes registers values  during IO operation */
7452 	if (vcpu->arch.emulate_regs_need_sync_from_vcpu) {
7453 		vcpu->arch.emulate_regs_need_sync_from_vcpu = false;
7454 		emulator_invalidate_register_cache(ctxt);
7455 	}
7456 
7457 restart:
7458 	if (emulation_type & EMULTYPE_PF) {
7459 		/* Save the faulting GPA (cr2) in the address field */
7460 		ctxt->exception.address = cr2_or_gpa;
7461 
7462 		/* With shadow page tables, cr2 contains a GVA or nGPA. */
7463 		if (vcpu->arch.mmu->direct_map) {
7464 			ctxt->gpa_available = true;
7465 			ctxt->gpa_val = cr2_or_gpa;
7466 		}
7467 	} else {
7468 		/* Sanitize the address out of an abundance of paranoia. */
7469 		ctxt->exception.address = 0;
7470 	}
7471 
7472 	r = x86_emulate_insn(ctxt);
7473 
7474 	if (r == EMULATION_INTERCEPTED)
7475 		return 1;
7476 
7477 	if (r == EMULATION_FAILED) {
7478 		if (reexecute_instruction(vcpu, cr2_or_gpa, write_fault_to_spt,
7479 					emulation_type))
7480 			return 1;
7481 
7482 		return handle_emulation_failure(vcpu, emulation_type);
7483 	}
7484 
7485 	if (ctxt->have_exception) {
7486 		r = 1;
7487 		if (inject_emulated_exception(vcpu))
7488 			return r;
7489 	} else if (vcpu->arch.pio.count) {
7490 		if (!vcpu->arch.pio.in) {
7491 			/* FIXME: return into emulator if single-stepping.  */
7492 			vcpu->arch.pio.count = 0;
7493 		} else {
7494 			writeback = false;
7495 			vcpu->arch.complete_userspace_io = complete_emulated_pio;
7496 		}
7497 		r = 0;
7498 	} else if (vcpu->mmio_needed) {
7499 		++vcpu->stat.mmio_exits;
7500 
7501 		if (!vcpu->mmio_is_write)
7502 			writeback = false;
7503 		r = 0;
7504 		vcpu->arch.complete_userspace_io = complete_emulated_mmio;
7505 	} else if (r == EMULATION_RESTART)
7506 		goto restart;
7507 	else
7508 		r = 1;
7509 
7510 	if (writeback) {
7511 		unsigned long rflags = static_call(kvm_x86_get_rflags)(vcpu);
7512 		toggle_interruptibility(vcpu, ctxt->interruptibility);
7513 		vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
7514 		if (!ctxt->have_exception ||
7515 		    exception_type(ctxt->exception.vector) == EXCPT_TRAP) {
7516 			kvm_rip_write(vcpu, ctxt->eip);
7517 			if (r && (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
7518 				r = kvm_vcpu_do_singlestep(vcpu);
7519 			if (kvm_x86_ops.update_emulated_instruction)
7520 				static_call(kvm_x86_update_emulated_instruction)(vcpu);
7521 			__kvm_set_rflags(vcpu, ctxt->eflags);
7522 		}
7523 
7524 		/*
7525 		 * For STI, interrupts are shadowed; so KVM_REQ_EVENT will
7526 		 * do nothing, and it will be requested again as soon as
7527 		 * the shadow expires.  But we still need to check here,
7528 		 * because POPF has no interrupt shadow.
7529 		 */
7530 		if (unlikely((ctxt->eflags & ~rflags) & X86_EFLAGS_IF))
7531 			kvm_make_request(KVM_REQ_EVENT, vcpu);
7532 	} else
7533 		vcpu->arch.emulate_regs_need_sync_to_vcpu = true;
7534 
7535 	return r;
7536 }
7537 
7538 int kvm_emulate_instruction(struct kvm_vcpu *vcpu, int emulation_type)
7539 {
7540 	return x86_emulate_instruction(vcpu, 0, emulation_type, NULL, 0);
7541 }
7542 EXPORT_SYMBOL_GPL(kvm_emulate_instruction);
7543 
7544 int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
7545 					void *insn, int insn_len)
7546 {
7547 	return x86_emulate_instruction(vcpu, 0, 0, insn, insn_len);
7548 }
7549 EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer);
7550 
7551 static int complete_fast_pio_out_port_0x7e(struct kvm_vcpu *vcpu)
7552 {
7553 	vcpu->arch.pio.count = 0;
7554 	return 1;
7555 }
7556 
7557 static int complete_fast_pio_out(struct kvm_vcpu *vcpu)
7558 {
7559 	vcpu->arch.pio.count = 0;
7560 
7561 	if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip)))
7562 		return 1;
7563 
7564 	return kvm_skip_emulated_instruction(vcpu);
7565 }
7566 
7567 static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size,
7568 			    unsigned short port)
7569 {
7570 	unsigned long val = kvm_rax_read(vcpu);
7571 	int ret = emulator_pio_out(vcpu, size, port, &val, 1);
7572 
7573 	if (ret)
7574 		return ret;
7575 
7576 	/*
7577 	 * Workaround userspace that relies on old KVM behavior of %rip being
7578 	 * incremented prior to exiting to userspace to handle "OUT 0x7e".
7579 	 */
7580 	if (port == 0x7e &&
7581 	    kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_OUT_7E_INC_RIP)) {
7582 		vcpu->arch.complete_userspace_io =
7583 			complete_fast_pio_out_port_0x7e;
7584 		kvm_skip_emulated_instruction(vcpu);
7585 	} else {
7586 		vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
7587 		vcpu->arch.complete_userspace_io = complete_fast_pio_out;
7588 	}
7589 	return 0;
7590 }
7591 
7592 static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
7593 {
7594 	unsigned long val;
7595 
7596 	/* We should only ever be called with arch.pio.count equal to 1 */
7597 	BUG_ON(vcpu->arch.pio.count != 1);
7598 
7599 	if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip))) {
7600 		vcpu->arch.pio.count = 0;
7601 		return 1;
7602 	}
7603 
7604 	/* For size less than 4 we merge, else we zero extend */
7605 	val = (vcpu->arch.pio.size < 4) ? kvm_rax_read(vcpu) : 0;
7606 
7607 	/*
7608 	 * Since vcpu->arch.pio.count == 1 let emulator_pio_in perform
7609 	 * the copy and tracing
7610 	 */
7611 	emulator_pio_in(vcpu, vcpu->arch.pio.size, vcpu->arch.pio.port, &val, 1);
7612 	kvm_rax_write(vcpu, val);
7613 
7614 	return kvm_skip_emulated_instruction(vcpu);
7615 }
7616 
7617 static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
7618 			   unsigned short port)
7619 {
7620 	unsigned long val;
7621 	int ret;
7622 
7623 	/* For size less than 4 we merge, else we zero extend */
7624 	val = (size < 4) ? kvm_rax_read(vcpu) : 0;
7625 
7626 	ret = emulator_pio_in(vcpu, size, port, &val, 1);
7627 	if (ret) {
7628 		kvm_rax_write(vcpu, val);
7629 		return ret;
7630 	}
7631 
7632 	vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
7633 	vcpu->arch.complete_userspace_io = complete_fast_pio_in;
7634 
7635 	return 0;
7636 }
7637 
7638 int kvm_fast_pio(struct kvm_vcpu *vcpu, int size, unsigned short port, int in)
7639 {
7640 	int ret;
7641 
7642 	if (in)
7643 		ret = kvm_fast_pio_in(vcpu, size, port);
7644 	else
7645 		ret = kvm_fast_pio_out(vcpu, size, port);
7646 	return ret && kvm_skip_emulated_instruction(vcpu);
7647 }
7648 EXPORT_SYMBOL_GPL(kvm_fast_pio);
7649 
7650 static int kvmclock_cpu_down_prep(unsigned int cpu)
7651 {
7652 	__this_cpu_write(cpu_tsc_khz, 0);
7653 	return 0;
7654 }
7655 
7656 static void tsc_khz_changed(void *data)
7657 {
7658 	struct cpufreq_freqs *freq = data;
7659 	unsigned long khz = 0;
7660 
7661 	if (data)
7662 		khz = freq->new;
7663 	else if (!boot_cpu_has(X86_FEATURE_CONSTANT_TSC))
7664 		khz = cpufreq_quick_get(raw_smp_processor_id());
7665 	if (!khz)
7666 		khz = tsc_khz;
7667 	__this_cpu_write(cpu_tsc_khz, khz);
7668 }
7669 
7670 #ifdef CONFIG_X86_64
7671 static void kvm_hyperv_tsc_notifier(void)
7672 {
7673 	struct kvm *kvm;
7674 	struct kvm_vcpu *vcpu;
7675 	int cpu;
7676 
7677 	mutex_lock(&kvm_lock);
7678 	list_for_each_entry(kvm, &vm_list, vm_list)
7679 		kvm_make_mclock_inprogress_request(kvm);
7680 
7681 	hyperv_stop_tsc_emulation();
7682 
7683 	/* TSC frequency always matches when on Hyper-V */
7684 	for_each_present_cpu(cpu)
7685 		per_cpu(cpu_tsc_khz, cpu) = tsc_khz;
7686 	kvm_max_guest_tsc_khz = tsc_khz;
7687 
7688 	list_for_each_entry(kvm, &vm_list, vm_list) {
7689 		struct kvm_arch *ka = &kvm->arch;
7690 
7691 		spin_lock(&ka->pvclock_gtod_sync_lock);
7692 
7693 		pvclock_update_vm_gtod_copy(kvm);
7694 
7695 		kvm_for_each_vcpu(cpu, vcpu, kvm)
7696 			kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
7697 
7698 		kvm_for_each_vcpu(cpu, vcpu, kvm)
7699 			kvm_clear_request(KVM_REQ_MCLOCK_INPROGRESS, vcpu);
7700 
7701 		spin_unlock(&ka->pvclock_gtod_sync_lock);
7702 	}
7703 	mutex_unlock(&kvm_lock);
7704 }
7705 #endif
7706 
7707 static void __kvmclock_cpufreq_notifier(struct cpufreq_freqs *freq, int cpu)
7708 {
7709 	struct kvm *kvm;
7710 	struct kvm_vcpu *vcpu;
7711 	int i, send_ipi = 0;
7712 
7713 	/*
7714 	 * We allow guests to temporarily run on slowing clocks,
7715 	 * provided we notify them after, or to run on accelerating
7716 	 * clocks, provided we notify them before.  Thus time never
7717 	 * goes backwards.
7718 	 *
7719 	 * However, we have a problem.  We can't atomically update
7720 	 * the frequency of a given CPU from this function; it is
7721 	 * merely a notifier, which can be called from any CPU.
7722 	 * Changing the TSC frequency at arbitrary points in time
7723 	 * requires a recomputation of local variables related to
7724 	 * the TSC for each VCPU.  We must flag these local variables
7725 	 * to be updated and be sure the update takes place with the
7726 	 * new frequency before any guests proceed.
7727 	 *
7728 	 * Unfortunately, the combination of hotplug CPU and frequency
7729 	 * change creates an intractable locking scenario; the order
7730 	 * of when these callouts happen is undefined with respect to
7731 	 * CPU hotplug, and they can race with each other.  As such,
7732 	 * merely setting per_cpu(cpu_tsc_khz) = X during a hotadd is
7733 	 * undefined; you can actually have a CPU frequency change take
7734 	 * place in between the computation of X and the setting of the
7735 	 * variable.  To protect against this problem, all updates of
7736 	 * the per_cpu tsc_khz variable are done in an interrupt
7737 	 * protected IPI, and all callers wishing to update the value
7738 	 * must wait for a synchronous IPI to complete (which is trivial
7739 	 * if the caller is on the CPU already).  This establishes the
7740 	 * necessary total order on variable updates.
7741 	 *
7742 	 * Note that because a guest time update may take place
7743 	 * anytime after the setting of the VCPU's request bit, the
7744 	 * correct TSC value must be set before the request.  However,
7745 	 * to ensure the update actually makes it to any guest which
7746 	 * starts running in hardware virtualization between the set
7747 	 * and the acquisition of the spinlock, we must also ping the
7748 	 * CPU after setting the request bit.
7749 	 *
7750 	 */
7751 
7752 	smp_call_function_single(cpu, tsc_khz_changed, freq, 1);
7753 
7754 	mutex_lock(&kvm_lock);
7755 	list_for_each_entry(kvm, &vm_list, vm_list) {
7756 		kvm_for_each_vcpu(i, vcpu, kvm) {
7757 			if (vcpu->cpu != cpu)
7758 				continue;
7759 			kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
7760 			if (vcpu->cpu != raw_smp_processor_id())
7761 				send_ipi = 1;
7762 		}
7763 	}
7764 	mutex_unlock(&kvm_lock);
7765 
7766 	if (freq->old < freq->new && send_ipi) {
7767 		/*
7768 		 * We upscale the frequency.  Must make the guest
7769 		 * doesn't see old kvmclock values while running with
7770 		 * the new frequency, otherwise we risk the guest sees
7771 		 * time go backwards.
7772 		 *
7773 		 * In case we update the frequency for another cpu
7774 		 * (which might be in guest context) send an interrupt
7775 		 * to kick the cpu out of guest context.  Next time
7776 		 * guest context is entered kvmclock will be updated,
7777 		 * so the guest will not see stale values.
7778 		 */
7779 		smp_call_function_single(cpu, tsc_khz_changed, freq, 1);
7780 	}
7781 }
7782 
7783 static int kvmclock_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
7784 				     void *data)
7785 {
7786 	struct cpufreq_freqs *freq = data;
7787 	int cpu;
7788 
7789 	if (val == CPUFREQ_PRECHANGE && freq->old > freq->new)
7790 		return 0;
7791 	if (val == CPUFREQ_POSTCHANGE && freq->old < freq->new)
7792 		return 0;
7793 
7794 	for_each_cpu(cpu, freq->policy->cpus)
7795 		__kvmclock_cpufreq_notifier(freq, cpu);
7796 
7797 	return 0;
7798 }
7799 
7800 static struct notifier_block kvmclock_cpufreq_notifier_block = {
7801 	.notifier_call  = kvmclock_cpufreq_notifier
7802 };
7803 
7804 static int kvmclock_cpu_online(unsigned int cpu)
7805 {
7806 	tsc_khz_changed(NULL);
7807 	return 0;
7808 }
7809 
7810 static void kvm_timer_init(void)
7811 {
7812 	max_tsc_khz = tsc_khz;
7813 
7814 	if (!boot_cpu_has(X86_FEATURE_CONSTANT_TSC)) {
7815 #ifdef CONFIG_CPU_FREQ
7816 		struct cpufreq_policy *policy;
7817 		int cpu;
7818 
7819 		cpu = get_cpu();
7820 		policy = cpufreq_cpu_get(cpu);
7821 		if (policy) {
7822 			if (policy->cpuinfo.max_freq)
7823 				max_tsc_khz = policy->cpuinfo.max_freq;
7824 			cpufreq_cpu_put(policy);
7825 		}
7826 		put_cpu();
7827 #endif
7828 		cpufreq_register_notifier(&kvmclock_cpufreq_notifier_block,
7829 					  CPUFREQ_TRANSITION_NOTIFIER);
7830 	}
7831 
7832 	cpuhp_setup_state(CPUHP_AP_X86_KVM_CLK_ONLINE, "x86/kvm/clk:online",
7833 			  kvmclock_cpu_online, kvmclock_cpu_down_prep);
7834 }
7835 
7836 DEFINE_PER_CPU(struct kvm_vcpu *, current_vcpu);
7837 EXPORT_PER_CPU_SYMBOL_GPL(current_vcpu);
7838 
7839 int kvm_is_in_guest(void)
7840 {
7841 	return __this_cpu_read(current_vcpu) != NULL;
7842 }
7843 
7844 static int kvm_is_user_mode(void)
7845 {
7846 	int user_mode = 3;
7847 
7848 	if (__this_cpu_read(current_vcpu))
7849 		user_mode = static_call(kvm_x86_get_cpl)(__this_cpu_read(current_vcpu));
7850 
7851 	return user_mode != 0;
7852 }
7853 
7854 static unsigned long kvm_get_guest_ip(void)
7855 {
7856 	unsigned long ip = 0;
7857 
7858 	if (__this_cpu_read(current_vcpu))
7859 		ip = kvm_rip_read(__this_cpu_read(current_vcpu));
7860 
7861 	return ip;
7862 }
7863 
7864 static void kvm_handle_intel_pt_intr(void)
7865 {
7866 	struct kvm_vcpu *vcpu = __this_cpu_read(current_vcpu);
7867 
7868 	kvm_make_request(KVM_REQ_PMI, vcpu);
7869 	__set_bit(MSR_CORE_PERF_GLOBAL_OVF_CTRL_TRACE_TOPA_PMI_BIT,
7870 			(unsigned long *)&vcpu->arch.pmu.global_status);
7871 }
7872 
7873 static struct perf_guest_info_callbacks kvm_guest_cbs = {
7874 	.is_in_guest		= kvm_is_in_guest,
7875 	.is_user_mode		= kvm_is_user_mode,
7876 	.get_guest_ip		= kvm_get_guest_ip,
7877 	.handle_intel_pt_intr	= kvm_handle_intel_pt_intr,
7878 };
7879 
7880 #ifdef CONFIG_X86_64
7881 static void pvclock_gtod_update_fn(struct work_struct *work)
7882 {
7883 	struct kvm *kvm;
7884 
7885 	struct kvm_vcpu *vcpu;
7886 	int i;
7887 
7888 	mutex_lock(&kvm_lock);
7889 	list_for_each_entry(kvm, &vm_list, vm_list)
7890 		kvm_for_each_vcpu(i, vcpu, kvm)
7891 			kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
7892 	atomic_set(&kvm_guest_has_master_clock, 0);
7893 	mutex_unlock(&kvm_lock);
7894 }
7895 
7896 static DECLARE_WORK(pvclock_gtod_work, pvclock_gtod_update_fn);
7897 
7898 /*
7899  * Notification about pvclock gtod data update.
7900  */
7901 static int pvclock_gtod_notify(struct notifier_block *nb, unsigned long unused,
7902 			       void *priv)
7903 {
7904 	struct pvclock_gtod_data *gtod = &pvclock_gtod_data;
7905 	struct timekeeper *tk = priv;
7906 
7907 	update_pvclock_gtod(tk);
7908 
7909 	/* disable master clock if host does not trust, or does not
7910 	 * use, TSC based clocksource.
7911 	 */
7912 	if (!gtod_is_based_on_tsc(gtod->clock.vclock_mode) &&
7913 	    atomic_read(&kvm_guest_has_master_clock) != 0)
7914 		queue_work(system_long_wq, &pvclock_gtod_work);
7915 
7916 	return 0;
7917 }
7918 
7919 static struct notifier_block pvclock_gtod_notifier = {
7920 	.notifier_call = pvclock_gtod_notify,
7921 };
7922 #endif
7923 
7924 int kvm_arch_init(void *opaque)
7925 {
7926 	struct kvm_x86_init_ops *ops = opaque;
7927 	int r;
7928 
7929 	if (kvm_x86_ops.hardware_enable) {
7930 		printk(KERN_ERR "kvm: already loaded the other module\n");
7931 		r = -EEXIST;
7932 		goto out;
7933 	}
7934 
7935 	if (!ops->cpu_has_kvm_support()) {
7936 		pr_err_ratelimited("kvm: no hardware support\n");
7937 		r = -EOPNOTSUPP;
7938 		goto out;
7939 	}
7940 	if (ops->disabled_by_bios()) {
7941 		pr_err_ratelimited("kvm: disabled by bios\n");
7942 		r = -EOPNOTSUPP;
7943 		goto out;
7944 	}
7945 
7946 	/*
7947 	 * KVM explicitly assumes that the guest has an FPU and
7948 	 * FXSAVE/FXRSTOR. For example, the KVM_GET_FPU explicitly casts the
7949 	 * vCPU's FPU state as a fxregs_state struct.
7950 	 */
7951 	if (!boot_cpu_has(X86_FEATURE_FPU) || !boot_cpu_has(X86_FEATURE_FXSR)) {
7952 		printk(KERN_ERR "kvm: inadequate fpu\n");
7953 		r = -EOPNOTSUPP;
7954 		goto out;
7955 	}
7956 
7957 	r = -ENOMEM;
7958 	x86_fpu_cache = kmem_cache_create("x86_fpu", sizeof(struct fpu),
7959 					  __alignof__(struct fpu), SLAB_ACCOUNT,
7960 					  NULL);
7961 	if (!x86_fpu_cache) {
7962 		printk(KERN_ERR "kvm: failed to allocate cache for x86 fpu\n");
7963 		goto out;
7964 	}
7965 
7966 	x86_emulator_cache = kvm_alloc_emulator_cache();
7967 	if (!x86_emulator_cache) {
7968 		pr_err("kvm: failed to allocate cache for x86 emulator\n");
7969 		goto out_free_x86_fpu_cache;
7970 	}
7971 
7972 	user_return_msrs = alloc_percpu(struct kvm_user_return_msrs);
7973 	if (!user_return_msrs) {
7974 		printk(KERN_ERR "kvm: failed to allocate percpu kvm_user_return_msrs\n");
7975 		goto out_free_x86_emulator_cache;
7976 	}
7977 
7978 	r = kvm_mmu_module_init();
7979 	if (r)
7980 		goto out_free_percpu;
7981 
7982 	kvm_mmu_set_mask_ptes(PT_USER_MASK, PT_ACCESSED_MASK,
7983 			PT_DIRTY_MASK, PT64_NX_MASK, 0,
7984 			PT_PRESENT_MASK, 0, sme_me_mask);
7985 	kvm_timer_init();
7986 
7987 	perf_register_guest_info_callbacks(&kvm_guest_cbs);
7988 
7989 	if (boot_cpu_has(X86_FEATURE_XSAVE)) {
7990 		host_xcr0 = xgetbv(XCR_XFEATURE_ENABLED_MASK);
7991 		supported_xcr0 = host_xcr0 & KVM_SUPPORTED_XCR0;
7992 	}
7993 
7994 	if (pi_inject_timer == -1)
7995 		pi_inject_timer = housekeeping_enabled(HK_FLAG_TIMER);
7996 #ifdef CONFIG_X86_64
7997 	pvclock_gtod_register_notifier(&pvclock_gtod_notifier);
7998 
7999 	if (hypervisor_is_type(X86_HYPER_MS_HYPERV))
8000 		set_hv_tscchange_cb(kvm_hyperv_tsc_notifier);
8001 #endif
8002 
8003 	return 0;
8004 
8005 out_free_percpu:
8006 	free_percpu(user_return_msrs);
8007 out_free_x86_emulator_cache:
8008 	kmem_cache_destroy(x86_emulator_cache);
8009 out_free_x86_fpu_cache:
8010 	kmem_cache_destroy(x86_fpu_cache);
8011 out:
8012 	return r;
8013 }
8014 
8015 void kvm_arch_exit(void)
8016 {
8017 #ifdef CONFIG_X86_64
8018 	if (hypervisor_is_type(X86_HYPER_MS_HYPERV))
8019 		clear_hv_tscchange_cb();
8020 #endif
8021 	kvm_lapic_exit();
8022 	perf_unregister_guest_info_callbacks(&kvm_guest_cbs);
8023 
8024 	if (!boot_cpu_has(X86_FEATURE_CONSTANT_TSC))
8025 		cpufreq_unregister_notifier(&kvmclock_cpufreq_notifier_block,
8026 					    CPUFREQ_TRANSITION_NOTIFIER);
8027 	cpuhp_remove_state_nocalls(CPUHP_AP_X86_KVM_CLK_ONLINE);
8028 #ifdef CONFIG_X86_64
8029 	pvclock_gtod_unregister_notifier(&pvclock_gtod_notifier);
8030 #endif
8031 	kvm_x86_ops.hardware_enable = NULL;
8032 	kvm_mmu_module_exit();
8033 	free_percpu(user_return_msrs);
8034 	kmem_cache_destroy(x86_fpu_cache);
8035 	WARN_ON(static_branch_unlikely(&kvm_xen_enabled.key));
8036 }
8037 
8038 static int __kvm_vcpu_halt(struct kvm_vcpu *vcpu, int state, int reason)
8039 {
8040 	++vcpu->stat.halt_exits;
8041 	if (lapic_in_kernel(vcpu)) {
8042 		vcpu->arch.mp_state = state;
8043 		return 1;
8044 	} else {
8045 		vcpu->run->exit_reason = reason;
8046 		return 0;
8047 	}
8048 }
8049 
8050 int kvm_vcpu_halt(struct kvm_vcpu *vcpu)
8051 {
8052 	return __kvm_vcpu_halt(vcpu, KVM_MP_STATE_HALTED, KVM_EXIT_HLT);
8053 }
8054 EXPORT_SYMBOL_GPL(kvm_vcpu_halt);
8055 
8056 int kvm_emulate_halt(struct kvm_vcpu *vcpu)
8057 {
8058 	int ret = kvm_skip_emulated_instruction(vcpu);
8059 	/*
8060 	 * TODO: we might be squashing a GUESTDBG_SINGLESTEP-triggered
8061 	 * KVM_EXIT_DEBUG here.
8062 	 */
8063 	return kvm_vcpu_halt(vcpu) && ret;
8064 }
8065 EXPORT_SYMBOL_GPL(kvm_emulate_halt);
8066 
8067 int kvm_emulate_ap_reset_hold(struct kvm_vcpu *vcpu)
8068 {
8069 	int ret = kvm_skip_emulated_instruction(vcpu);
8070 
8071 	return __kvm_vcpu_halt(vcpu, KVM_MP_STATE_AP_RESET_HOLD, KVM_EXIT_AP_RESET_HOLD) && ret;
8072 }
8073 EXPORT_SYMBOL_GPL(kvm_emulate_ap_reset_hold);
8074 
8075 #ifdef CONFIG_X86_64
8076 static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr,
8077 			        unsigned long clock_type)
8078 {
8079 	struct kvm_clock_pairing clock_pairing;
8080 	struct timespec64 ts;
8081 	u64 cycle;
8082 	int ret;
8083 
8084 	if (clock_type != KVM_CLOCK_PAIRING_WALLCLOCK)
8085 		return -KVM_EOPNOTSUPP;
8086 
8087 	if (!kvm_get_walltime_and_clockread(&ts, &cycle))
8088 		return -KVM_EOPNOTSUPP;
8089 
8090 	clock_pairing.sec = ts.tv_sec;
8091 	clock_pairing.nsec = ts.tv_nsec;
8092 	clock_pairing.tsc = kvm_read_l1_tsc(vcpu, cycle);
8093 	clock_pairing.flags = 0;
8094 	memset(&clock_pairing.pad, 0, sizeof(clock_pairing.pad));
8095 
8096 	ret = 0;
8097 	if (kvm_write_guest(vcpu->kvm, paddr, &clock_pairing,
8098 			    sizeof(struct kvm_clock_pairing)))
8099 		ret = -KVM_EFAULT;
8100 
8101 	return ret;
8102 }
8103 #endif
8104 
8105 /*
8106  * kvm_pv_kick_cpu_op:  Kick a vcpu.
8107  *
8108  * @apicid - apicid of vcpu to be kicked.
8109  */
8110 static void kvm_pv_kick_cpu_op(struct kvm *kvm, unsigned long flags, int apicid)
8111 {
8112 	struct kvm_lapic_irq lapic_irq;
8113 
8114 	lapic_irq.shorthand = APIC_DEST_NOSHORT;
8115 	lapic_irq.dest_mode = APIC_DEST_PHYSICAL;
8116 	lapic_irq.level = 0;
8117 	lapic_irq.dest_id = apicid;
8118 	lapic_irq.msi_redir_hint = false;
8119 
8120 	lapic_irq.delivery_mode = APIC_DM_REMRD;
8121 	kvm_irq_delivery_to_apic(kvm, NULL, &lapic_irq, NULL);
8122 }
8123 
8124 bool kvm_apicv_activated(struct kvm *kvm)
8125 {
8126 	return (READ_ONCE(kvm->arch.apicv_inhibit_reasons) == 0);
8127 }
8128 EXPORT_SYMBOL_GPL(kvm_apicv_activated);
8129 
8130 void kvm_apicv_init(struct kvm *kvm, bool enable)
8131 {
8132 	if (enable)
8133 		clear_bit(APICV_INHIBIT_REASON_DISABLE,
8134 			  &kvm->arch.apicv_inhibit_reasons);
8135 	else
8136 		set_bit(APICV_INHIBIT_REASON_DISABLE,
8137 			&kvm->arch.apicv_inhibit_reasons);
8138 }
8139 EXPORT_SYMBOL_GPL(kvm_apicv_init);
8140 
8141 static void kvm_sched_yield(struct kvm *kvm, unsigned long dest_id)
8142 {
8143 	struct kvm_vcpu *target = NULL;
8144 	struct kvm_apic_map *map;
8145 
8146 	rcu_read_lock();
8147 	map = rcu_dereference(kvm->arch.apic_map);
8148 
8149 	if (likely(map) && dest_id <= map->max_apic_id && map->phys_map[dest_id])
8150 		target = map->phys_map[dest_id]->vcpu;
8151 
8152 	rcu_read_unlock();
8153 
8154 	if (target && READ_ONCE(target->ready))
8155 		kvm_vcpu_yield_to(target);
8156 }
8157 
8158 int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
8159 {
8160 	unsigned long nr, a0, a1, a2, a3, ret;
8161 	int op_64_bit;
8162 
8163 	if (kvm_xen_hypercall_enabled(vcpu->kvm))
8164 		return kvm_xen_hypercall(vcpu);
8165 
8166 	if (kvm_hv_hypercall_enabled(vcpu))
8167 		return kvm_hv_hypercall(vcpu);
8168 
8169 	nr = kvm_rax_read(vcpu);
8170 	a0 = kvm_rbx_read(vcpu);
8171 	a1 = kvm_rcx_read(vcpu);
8172 	a2 = kvm_rdx_read(vcpu);
8173 	a3 = kvm_rsi_read(vcpu);
8174 
8175 	trace_kvm_hypercall(nr, a0, a1, a2, a3);
8176 
8177 	op_64_bit = is_64_bit_mode(vcpu);
8178 	if (!op_64_bit) {
8179 		nr &= 0xFFFFFFFF;
8180 		a0 &= 0xFFFFFFFF;
8181 		a1 &= 0xFFFFFFFF;
8182 		a2 &= 0xFFFFFFFF;
8183 		a3 &= 0xFFFFFFFF;
8184 	}
8185 
8186 	if (static_call(kvm_x86_get_cpl)(vcpu) != 0) {
8187 		ret = -KVM_EPERM;
8188 		goto out;
8189 	}
8190 
8191 	ret = -KVM_ENOSYS;
8192 
8193 	switch (nr) {
8194 	case KVM_HC_VAPIC_POLL_IRQ:
8195 		ret = 0;
8196 		break;
8197 	case KVM_HC_KICK_CPU:
8198 		if (!guest_pv_has(vcpu, KVM_FEATURE_PV_UNHALT))
8199 			break;
8200 
8201 		kvm_pv_kick_cpu_op(vcpu->kvm, a0, a1);
8202 		kvm_sched_yield(vcpu->kvm, a1);
8203 		ret = 0;
8204 		break;
8205 #ifdef CONFIG_X86_64
8206 	case KVM_HC_CLOCK_PAIRING:
8207 		ret = kvm_pv_clock_pairing(vcpu, a0, a1);
8208 		break;
8209 #endif
8210 	case KVM_HC_SEND_IPI:
8211 		if (!guest_pv_has(vcpu, KVM_FEATURE_PV_SEND_IPI))
8212 			break;
8213 
8214 		ret = kvm_pv_send_ipi(vcpu->kvm, a0, a1, a2, a3, op_64_bit);
8215 		break;
8216 	case KVM_HC_SCHED_YIELD:
8217 		if (!guest_pv_has(vcpu, KVM_FEATURE_PV_SCHED_YIELD))
8218 			break;
8219 
8220 		kvm_sched_yield(vcpu->kvm, a0);
8221 		ret = 0;
8222 		break;
8223 	default:
8224 		ret = -KVM_ENOSYS;
8225 		break;
8226 	}
8227 out:
8228 	if (!op_64_bit)
8229 		ret = (u32)ret;
8230 	kvm_rax_write(vcpu, ret);
8231 
8232 	++vcpu->stat.hypercalls;
8233 	return kvm_skip_emulated_instruction(vcpu);
8234 }
8235 EXPORT_SYMBOL_GPL(kvm_emulate_hypercall);
8236 
8237 static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt)
8238 {
8239 	struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
8240 	char instruction[3];
8241 	unsigned long rip = kvm_rip_read(vcpu);
8242 
8243 	static_call(kvm_x86_patch_hypercall)(vcpu, instruction);
8244 
8245 	return emulator_write_emulated(ctxt, rip, instruction, 3,
8246 		&ctxt->exception);
8247 }
8248 
8249 static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu)
8250 {
8251 	return vcpu->run->request_interrupt_window &&
8252 		likely(!pic_in_kernel(vcpu->kvm));
8253 }
8254 
8255 static void post_kvm_run_save(struct kvm_vcpu *vcpu)
8256 {
8257 	struct kvm_run *kvm_run = vcpu->run;
8258 
8259 	/*
8260 	 * if_flag is obsolete and useless, so do not bother
8261 	 * setting it for SEV-ES guests.  Userspace can just
8262 	 * use kvm_run->ready_for_interrupt_injection.
8263 	 */
8264 	kvm_run->if_flag = !vcpu->arch.guest_state_protected
8265 		&& (kvm_get_rflags(vcpu) & X86_EFLAGS_IF) != 0;
8266 
8267 	kvm_run->cr8 = kvm_get_cr8(vcpu);
8268 	kvm_run->apic_base = kvm_get_apic_base(vcpu);
8269 	kvm_run->ready_for_interrupt_injection =
8270 		pic_in_kernel(vcpu->kvm) ||
8271 		kvm_vcpu_ready_for_interrupt_injection(vcpu);
8272 
8273 	if (is_smm(vcpu))
8274 		kvm_run->flags |= KVM_RUN_X86_SMM;
8275 }
8276 
8277 static void update_cr8_intercept(struct kvm_vcpu *vcpu)
8278 {
8279 	int max_irr, tpr;
8280 
8281 	if (!kvm_x86_ops.update_cr8_intercept)
8282 		return;
8283 
8284 	if (!lapic_in_kernel(vcpu))
8285 		return;
8286 
8287 	if (vcpu->arch.apicv_active)
8288 		return;
8289 
8290 	if (!vcpu->arch.apic->vapic_addr)
8291 		max_irr = kvm_lapic_find_highest_irr(vcpu);
8292 	else
8293 		max_irr = -1;
8294 
8295 	if (max_irr != -1)
8296 		max_irr >>= 4;
8297 
8298 	tpr = kvm_lapic_get_cr8(vcpu);
8299 
8300 	static_call(kvm_x86_update_cr8_intercept)(vcpu, tpr, max_irr);
8301 }
8302 
8303 static void inject_pending_event(struct kvm_vcpu *vcpu, bool *req_immediate_exit)
8304 {
8305 	int r;
8306 	bool can_inject = true;
8307 
8308 	/* try to reinject previous events if any */
8309 
8310 	if (vcpu->arch.exception.injected) {
8311 		static_call(kvm_x86_queue_exception)(vcpu);
8312 		can_inject = false;
8313 	}
8314 	/*
8315 	 * Do not inject an NMI or interrupt if there is a pending
8316 	 * exception.  Exceptions and interrupts are recognized at
8317 	 * instruction boundaries, i.e. the start of an instruction.
8318 	 * Trap-like exceptions, e.g. #DB, have higher priority than
8319 	 * NMIs and interrupts, i.e. traps are recognized before an
8320 	 * NMI/interrupt that's pending on the same instruction.
8321 	 * Fault-like exceptions, e.g. #GP and #PF, are the lowest
8322 	 * priority, but are only generated (pended) during instruction
8323 	 * execution, i.e. a pending fault-like exception means the
8324 	 * fault occurred on the *previous* instruction and must be
8325 	 * serviced prior to recognizing any new events in order to
8326 	 * fully complete the previous instruction.
8327 	 */
8328 	else if (!vcpu->arch.exception.pending) {
8329 		if (vcpu->arch.nmi_injected) {
8330 			static_call(kvm_x86_set_nmi)(vcpu);
8331 			can_inject = false;
8332 		} else if (vcpu->arch.interrupt.injected) {
8333 			static_call(kvm_x86_set_irq)(vcpu);
8334 			can_inject = false;
8335 		}
8336 	}
8337 
8338 	WARN_ON_ONCE(vcpu->arch.exception.injected &&
8339 		     vcpu->arch.exception.pending);
8340 
8341 	/*
8342 	 * Call check_nested_events() even if we reinjected a previous event
8343 	 * in order for caller to determine if it should require immediate-exit
8344 	 * from L2 to L1 due to pending L1 events which require exit
8345 	 * from L2 to L1.
8346 	 */
8347 	if (is_guest_mode(vcpu)) {
8348 		r = kvm_x86_ops.nested_ops->check_events(vcpu);
8349 		if (r < 0)
8350 			goto busy;
8351 	}
8352 
8353 	/* try to inject new event if pending */
8354 	if (vcpu->arch.exception.pending) {
8355 		trace_kvm_inj_exception(vcpu->arch.exception.nr,
8356 					vcpu->arch.exception.has_error_code,
8357 					vcpu->arch.exception.error_code);
8358 
8359 		vcpu->arch.exception.pending = false;
8360 		vcpu->arch.exception.injected = true;
8361 
8362 		if (exception_type(vcpu->arch.exception.nr) == EXCPT_FAULT)
8363 			__kvm_set_rflags(vcpu, kvm_get_rflags(vcpu) |
8364 					     X86_EFLAGS_RF);
8365 
8366 		if (vcpu->arch.exception.nr == DB_VECTOR) {
8367 			kvm_deliver_exception_payload(vcpu);
8368 			if (vcpu->arch.dr7 & DR7_GD) {
8369 				vcpu->arch.dr7 &= ~DR7_GD;
8370 				kvm_update_dr7(vcpu);
8371 			}
8372 		}
8373 
8374 		static_call(kvm_x86_queue_exception)(vcpu);
8375 		can_inject = false;
8376 	}
8377 
8378 	/*
8379 	 * Finally, inject interrupt events.  If an event cannot be injected
8380 	 * due to architectural conditions (e.g. IF=0) a window-open exit
8381 	 * will re-request KVM_REQ_EVENT.  Sometimes however an event is pending
8382 	 * and can architecturally be injected, but we cannot do it right now:
8383 	 * an interrupt could have arrived just now and we have to inject it
8384 	 * as a vmexit, or there could already an event in the queue, which is
8385 	 * indicated by can_inject.  In that case we request an immediate exit
8386 	 * in order to make progress and get back here for another iteration.
8387 	 * The kvm_x86_ops hooks communicate this by returning -EBUSY.
8388 	 */
8389 	if (vcpu->arch.smi_pending) {
8390 		r = can_inject ? static_call(kvm_x86_smi_allowed)(vcpu, true) : -EBUSY;
8391 		if (r < 0)
8392 			goto busy;
8393 		if (r) {
8394 			vcpu->arch.smi_pending = false;
8395 			++vcpu->arch.smi_count;
8396 			enter_smm(vcpu);
8397 			can_inject = false;
8398 		} else
8399 			static_call(kvm_x86_enable_smi_window)(vcpu);
8400 	}
8401 
8402 	if (vcpu->arch.nmi_pending) {
8403 		r = can_inject ? static_call(kvm_x86_nmi_allowed)(vcpu, true) : -EBUSY;
8404 		if (r < 0)
8405 			goto busy;
8406 		if (r) {
8407 			--vcpu->arch.nmi_pending;
8408 			vcpu->arch.nmi_injected = true;
8409 			static_call(kvm_x86_set_nmi)(vcpu);
8410 			can_inject = false;
8411 			WARN_ON(static_call(kvm_x86_nmi_allowed)(vcpu, true) < 0);
8412 		}
8413 		if (vcpu->arch.nmi_pending)
8414 			static_call(kvm_x86_enable_nmi_window)(vcpu);
8415 	}
8416 
8417 	if (kvm_cpu_has_injectable_intr(vcpu)) {
8418 		r = can_inject ? static_call(kvm_x86_interrupt_allowed)(vcpu, true) : -EBUSY;
8419 		if (r < 0)
8420 			goto busy;
8421 		if (r) {
8422 			kvm_queue_interrupt(vcpu, kvm_cpu_get_interrupt(vcpu), false);
8423 			static_call(kvm_x86_set_irq)(vcpu);
8424 			WARN_ON(static_call(kvm_x86_interrupt_allowed)(vcpu, true) < 0);
8425 		}
8426 		if (kvm_cpu_has_injectable_intr(vcpu))
8427 			static_call(kvm_x86_enable_irq_window)(vcpu);
8428 	}
8429 
8430 	if (is_guest_mode(vcpu) &&
8431 	    kvm_x86_ops.nested_ops->hv_timer_pending &&
8432 	    kvm_x86_ops.nested_ops->hv_timer_pending(vcpu))
8433 		*req_immediate_exit = true;
8434 
8435 	WARN_ON(vcpu->arch.exception.pending);
8436 	return;
8437 
8438 busy:
8439 	*req_immediate_exit = true;
8440 	return;
8441 }
8442 
8443 static void process_nmi(struct kvm_vcpu *vcpu)
8444 {
8445 	unsigned limit = 2;
8446 
8447 	/*
8448 	 * x86 is limited to one NMI running, and one NMI pending after it.
8449 	 * If an NMI is already in progress, limit further NMIs to just one.
8450 	 * Otherwise, allow two (and we'll inject the first one immediately).
8451 	 */
8452 	if (static_call(kvm_x86_get_nmi_mask)(vcpu) || vcpu->arch.nmi_injected)
8453 		limit = 1;
8454 
8455 	vcpu->arch.nmi_pending += atomic_xchg(&vcpu->arch.nmi_queued, 0);
8456 	vcpu->arch.nmi_pending = min(vcpu->arch.nmi_pending, limit);
8457 	kvm_make_request(KVM_REQ_EVENT, vcpu);
8458 }
8459 
8460 static u32 enter_smm_get_segment_flags(struct kvm_segment *seg)
8461 {
8462 	u32 flags = 0;
8463 	flags |= seg->g       << 23;
8464 	flags |= seg->db      << 22;
8465 	flags |= seg->l       << 21;
8466 	flags |= seg->avl     << 20;
8467 	flags |= seg->present << 15;
8468 	flags |= seg->dpl     << 13;
8469 	flags |= seg->s       << 12;
8470 	flags |= seg->type    << 8;
8471 	return flags;
8472 }
8473 
8474 static void enter_smm_save_seg_32(struct kvm_vcpu *vcpu, char *buf, int n)
8475 {
8476 	struct kvm_segment seg;
8477 	int offset;
8478 
8479 	kvm_get_segment(vcpu, &seg, n);
8480 	put_smstate(u32, buf, 0x7fa8 + n * 4, seg.selector);
8481 
8482 	if (n < 3)
8483 		offset = 0x7f84 + n * 12;
8484 	else
8485 		offset = 0x7f2c + (n - 3) * 12;
8486 
8487 	put_smstate(u32, buf, offset + 8, seg.base);
8488 	put_smstate(u32, buf, offset + 4, seg.limit);
8489 	put_smstate(u32, buf, offset, enter_smm_get_segment_flags(&seg));
8490 }
8491 
8492 #ifdef CONFIG_X86_64
8493 static void enter_smm_save_seg_64(struct kvm_vcpu *vcpu, char *buf, int n)
8494 {
8495 	struct kvm_segment seg;
8496 	int offset;
8497 	u16 flags;
8498 
8499 	kvm_get_segment(vcpu, &seg, n);
8500 	offset = 0x7e00 + n * 16;
8501 
8502 	flags = enter_smm_get_segment_flags(&seg) >> 8;
8503 	put_smstate(u16, buf, offset, seg.selector);
8504 	put_smstate(u16, buf, offset + 2, flags);
8505 	put_smstate(u32, buf, offset + 4, seg.limit);
8506 	put_smstate(u64, buf, offset + 8, seg.base);
8507 }
8508 #endif
8509 
8510 static void enter_smm_save_state_32(struct kvm_vcpu *vcpu, char *buf)
8511 {
8512 	struct desc_ptr dt;
8513 	struct kvm_segment seg;
8514 	unsigned long val;
8515 	int i;
8516 
8517 	put_smstate(u32, buf, 0x7ffc, kvm_read_cr0(vcpu));
8518 	put_smstate(u32, buf, 0x7ff8, kvm_read_cr3(vcpu));
8519 	put_smstate(u32, buf, 0x7ff4, kvm_get_rflags(vcpu));
8520 	put_smstate(u32, buf, 0x7ff0, kvm_rip_read(vcpu));
8521 
8522 	for (i = 0; i < 8; i++)
8523 		put_smstate(u32, buf, 0x7fd0 + i * 4, kvm_register_read(vcpu, i));
8524 
8525 	kvm_get_dr(vcpu, 6, &val);
8526 	put_smstate(u32, buf, 0x7fcc, (u32)val);
8527 	kvm_get_dr(vcpu, 7, &val);
8528 	put_smstate(u32, buf, 0x7fc8, (u32)val);
8529 
8530 	kvm_get_segment(vcpu, &seg, VCPU_SREG_TR);
8531 	put_smstate(u32, buf, 0x7fc4, seg.selector);
8532 	put_smstate(u32, buf, 0x7f64, seg.base);
8533 	put_smstate(u32, buf, 0x7f60, seg.limit);
8534 	put_smstate(u32, buf, 0x7f5c, enter_smm_get_segment_flags(&seg));
8535 
8536 	kvm_get_segment(vcpu, &seg, VCPU_SREG_LDTR);
8537 	put_smstate(u32, buf, 0x7fc0, seg.selector);
8538 	put_smstate(u32, buf, 0x7f80, seg.base);
8539 	put_smstate(u32, buf, 0x7f7c, seg.limit);
8540 	put_smstate(u32, buf, 0x7f78, enter_smm_get_segment_flags(&seg));
8541 
8542 	static_call(kvm_x86_get_gdt)(vcpu, &dt);
8543 	put_smstate(u32, buf, 0x7f74, dt.address);
8544 	put_smstate(u32, buf, 0x7f70, dt.size);
8545 
8546 	static_call(kvm_x86_get_idt)(vcpu, &dt);
8547 	put_smstate(u32, buf, 0x7f58, dt.address);
8548 	put_smstate(u32, buf, 0x7f54, dt.size);
8549 
8550 	for (i = 0; i < 6; i++)
8551 		enter_smm_save_seg_32(vcpu, buf, i);
8552 
8553 	put_smstate(u32, buf, 0x7f14, kvm_read_cr4(vcpu));
8554 
8555 	/* revision id */
8556 	put_smstate(u32, buf, 0x7efc, 0x00020000);
8557 	put_smstate(u32, buf, 0x7ef8, vcpu->arch.smbase);
8558 }
8559 
8560 #ifdef CONFIG_X86_64
8561 static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
8562 {
8563 	struct desc_ptr dt;
8564 	struct kvm_segment seg;
8565 	unsigned long val;
8566 	int i;
8567 
8568 	for (i = 0; i < 16; i++)
8569 		put_smstate(u64, buf, 0x7ff8 - i * 8, kvm_register_read(vcpu, i));
8570 
8571 	put_smstate(u64, buf, 0x7f78, kvm_rip_read(vcpu));
8572 	put_smstate(u32, buf, 0x7f70, kvm_get_rflags(vcpu));
8573 
8574 	kvm_get_dr(vcpu, 6, &val);
8575 	put_smstate(u64, buf, 0x7f68, val);
8576 	kvm_get_dr(vcpu, 7, &val);
8577 	put_smstate(u64, buf, 0x7f60, val);
8578 
8579 	put_smstate(u64, buf, 0x7f58, kvm_read_cr0(vcpu));
8580 	put_smstate(u64, buf, 0x7f50, kvm_read_cr3(vcpu));
8581 	put_smstate(u64, buf, 0x7f48, kvm_read_cr4(vcpu));
8582 
8583 	put_smstate(u32, buf, 0x7f00, vcpu->arch.smbase);
8584 
8585 	/* revision id */
8586 	put_smstate(u32, buf, 0x7efc, 0x00020064);
8587 
8588 	put_smstate(u64, buf, 0x7ed0, vcpu->arch.efer);
8589 
8590 	kvm_get_segment(vcpu, &seg, VCPU_SREG_TR);
8591 	put_smstate(u16, buf, 0x7e90, seg.selector);
8592 	put_smstate(u16, buf, 0x7e92, enter_smm_get_segment_flags(&seg) >> 8);
8593 	put_smstate(u32, buf, 0x7e94, seg.limit);
8594 	put_smstate(u64, buf, 0x7e98, seg.base);
8595 
8596 	static_call(kvm_x86_get_idt)(vcpu, &dt);
8597 	put_smstate(u32, buf, 0x7e84, dt.size);
8598 	put_smstate(u64, buf, 0x7e88, dt.address);
8599 
8600 	kvm_get_segment(vcpu, &seg, VCPU_SREG_LDTR);
8601 	put_smstate(u16, buf, 0x7e70, seg.selector);
8602 	put_smstate(u16, buf, 0x7e72, enter_smm_get_segment_flags(&seg) >> 8);
8603 	put_smstate(u32, buf, 0x7e74, seg.limit);
8604 	put_smstate(u64, buf, 0x7e78, seg.base);
8605 
8606 	static_call(kvm_x86_get_gdt)(vcpu, &dt);
8607 	put_smstate(u32, buf, 0x7e64, dt.size);
8608 	put_smstate(u64, buf, 0x7e68, dt.address);
8609 
8610 	for (i = 0; i < 6; i++)
8611 		enter_smm_save_seg_64(vcpu, buf, i);
8612 }
8613 #endif
8614 
8615 static void enter_smm(struct kvm_vcpu *vcpu)
8616 {
8617 	struct kvm_segment cs, ds;
8618 	struct desc_ptr dt;
8619 	char buf[512];
8620 	u32 cr0;
8621 
8622 	trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true);
8623 	memset(buf, 0, 512);
8624 #ifdef CONFIG_X86_64
8625 	if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
8626 		enter_smm_save_state_64(vcpu, buf);
8627 	else
8628 #endif
8629 		enter_smm_save_state_32(vcpu, buf);
8630 
8631 	/*
8632 	 * Give pre_enter_smm() a chance to make ISA-specific changes to the
8633 	 * vCPU state (e.g. leave guest mode) after we've saved the state into
8634 	 * the SMM state-save area.
8635 	 */
8636 	static_call(kvm_x86_pre_enter_smm)(vcpu, buf);
8637 
8638 	vcpu->arch.hflags |= HF_SMM_MASK;
8639 	kvm_vcpu_write_guest(vcpu, vcpu->arch.smbase + 0xfe00, buf, sizeof(buf));
8640 
8641 	if (static_call(kvm_x86_get_nmi_mask)(vcpu))
8642 		vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
8643 	else
8644 		static_call(kvm_x86_set_nmi_mask)(vcpu, true);
8645 
8646 	kvm_set_rflags(vcpu, X86_EFLAGS_FIXED);
8647 	kvm_rip_write(vcpu, 0x8000);
8648 
8649 	cr0 = vcpu->arch.cr0 & ~(X86_CR0_PE | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG);
8650 	static_call(kvm_x86_set_cr0)(vcpu, cr0);
8651 	vcpu->arch.cr0 = cr0;
8652 
8653 	static_call(kvm_x86_set_cr4)(vcpu, 0);
8654 
8655 	/* Undocumented: IDT limit is set to zero on entry to SMM.  */
8656 	dt.address = dt.size = 0;
8657 	static_call(kvm_x86_set_idt)(vcpu, &dt);
8658 
8659 	kvm_set_dr(vcpu, 7, DR7_FIXED_1);
8660 
8661 	cs.selector = (vcpu->arch.smbase >> 4) & 0xffff;
8662 	cs.base = vcpu->arch.smbase;
8663 
8664 	ds.selector = 0;
8665 	ds.base = 0;
8666 
8667 	cs.limit    = ds.limit = 0xffffffff;
8668 	cs.type     = ds.type = 0x3;
8669 	cs.dpl      = ds.dpl = 0;
8670 	cs.db       = ds.db = 0;
8671 	cs.s        = ds.s = 1;
8672 	cs.l        = ds.l = 0;
8673 	cs.g        = ds.g = 1;
8674 	cs.avl      = ds.avl = 0;
8675 	cs.present  = ds.present = 1;
8676 	cs.unusable = ds.unusable = 0;
8677 	cs.padding  = ds.padding = 0;
8678 
8679 	kvm_set_segment(vcpu, &cs, VCPU_SREG_CS);
8680 	kvm_set_segment(vcpu, &ds, VCPU_SREG_DS);
8681 	kvm_set_segment(vcpu, &ds, VCPU_SREG_ES);
8682 	kvm_set_segment(vcpu, &ds, VCPU_SREG_FS);
8683 	kvm_set_segment(vcpu, &ds, VCPU_SREG_GS);
8684 	kvm_set_segment(vcpu, &ds, VCPU_SREG_SS);
8685 
8686 #ifdef CONFIG_X86_64
8687 	if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
8688 		static_call(kvm_x86_set_efer)(vcpu, 0);
8689 #endif
8690 
8691 	kvm_update_cpuid_runtime(vcpu);
8692 	kvm_mmu_reset_context(vcpu);
8693 }
8694 
8695 static void process_smi(struct kvm_vcpu *vcpu)
8696 {
8697 	vcpu->arch.smi_pending = true;
8698 	kvm_make_request(KVM_REQ_EVENT, vcpu);
8699 }
8700 
8701 void kvm_make_scan_ioapic_request_mask(struct kvm *kvm,
8702 				       unsigned long *vcpu_bitmap)
8703 {
8704 	cpumask_var_t cpus;
8705 
8706 	zalloc_cpumask_var(&cpus, GFP_ATOMIC);
8707 
8708 	kvm_make_vcpus_request_mask(kvm, KVM_REQ_SCAN_IOAPIC,
8709 				    NULL, vcpu_bitmap, cpus);
8710 
8711 	free_cpumask_var(cpus);
8712 }
8713 
8714 void kvm_make_scan_ioapic_request(struct kvm *kvm)
8715 {
8716 	kvm_make_all_cpus_request(kvm, KVM_REQ_SCAN_IOAPIC);
8717 }
8718 
8719 void kvm_vcpu_update_apicv(struct kvm_vcpu *vcpu)
8720 {
8721 	if (!lapic_in_kernel(vcpu))
8722 		return;
8723 
8724 	vcpu->arch.apicv_active = kvm_apicv_activated(vcpu->kvm);
8725 	kvm_apic_update_apicv(vcpu);
8726 	static_call(kvm_x86_refresh_apicv_exec_ctrl)(vcpu);
8727 }
8728 EXPORT_SYMBOL_GPL(kvm_vcpu_update_apicv);
8729 
8730 /*
8731  * NOTE: Do not hold any lock prior to calling this.
8732  *
8733  * In particular, kvm_request_apicv_update() expects kvm->srcu not to be
8734  * locked, because it calls __x86_set_memory_region() which does
8735  * synchronize_srcu(&kvm->srcu).
8736  */
8737 void kvm_request_apicv_update(struct kvm *kvm, bool activate, ulong bit)
8738 {
8739 	struct kvm_vcpu *except;
8740 	unsigned long old, new, expected;
8741 
8742 	if (!kvm_x86_ops.check_apicv_inhibit_reasons ||
8743 	    !static_call(kvm_x86_check_apicv_inhibit_reasons)(bit))
8744 		return;
8745 
8746 	old = READ_ONCE(kvm->arch.apicv_inhibit_reasons);
8747 	do {
8748 		expected = new = old;
8749 		if (activate)
8750 			__clear_bit(bit, &new);
8751 		else
8752 			__set_bit(bit, &new);
8753 		if (new == old)
8754 			break;
8755 		old = cmpxchg(&kvm->arch.apicv_inhibit_reasons, expected, new);
8756 	} while (old != expected);
8757 
8758 	if (!!old == !!new)
8759 		return;
8760 
8761 	trace_kvm_apicv_update_request(activate, bit);
8762 	if (kvm_x86_ops.pre_update_apicv_exec_ctrl)
8763 		static_call(kvm_x86_pre_update_apicv_exec_ctrl)(kvm, activate);
8764 
8765 	/*
8766 	 * Sending request to update APICV for all other vcpus,
8767 	 * while update the calling vcpu immediately instead of
8768 	 * waiting for another #VMEXIT to handle the request.
8769 	 */
8770 	except = kvm_get_running_vcpu();
8771 	kvm_make_all_cpus_request_except(kvm, KVM_REQ_APICV_UPDATE,
8772 					 except);
8773 	if (except)
8774 		kvm_vcpu_update_apicv(except);
8775 }
8776 EXPORT_SYMBOL_GPL(kvm_request_apicv_update);
8777 
8778 static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu)
8779 {
8780 	if (!kvm_apic_present(vcpu))
8781 		return;
8782 
8783 	bitmap_zero(vcpu->arch.ioapic_handled_vectors, 256);
8784 
8785 	if (irqchip_split(vcpu->kvm))
8786 		kvm_scan_ioapic_routes(vcpu, vcpu->arch.ioapic_handled_vectors);
8787 	else {
8788 		if (vcpu->arch.apicv_active)
8789 			static_call(kvm_x86_sync_pir_to_irr)(vcpu);
8790 		if (ioapic_in_kernel(vcpu->kvm))
8791 			kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
8792 	}
8793 
8794 	if (is_guest_mode(vcpu))
8795 		vcpu->arch.load_eoi_exitmap_pending = true;
8796 	else
8797 		kvm_make_request(KVM_REQ_LOAD_EOI_EXITMAP, vcpu);
8798 }
8799 
8800 static void vcpu_load_eoi_exitmap(struct kvm_vcpu *vcpu)
8801 {
8802 	u64 eoi_exit_bitmap[4];
8803 
8804 	if (!kvm_apic_hw_enabled(vcpu->arch.apic))
8805 		return;
8806 
8807 	if (to_hv_vcpu(vcpu))
8808 		bitmap_or((ulong *)eoi_exit_bitmap,
8809 			  vcpu->arch.ioapic_handled_vectors,
8810 			  to_hv_synic(vcpu)->vec_bitmap, 256);
8811 
8812 	static_call(kvm_x86_load_eoi_exitmap)(vcpu, eoi_exit_bitmap);
8813 }
8814 
8815 void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
8816 					    unsigned long start, unsigned long end)
8817 {
8818 	unsigned long apic_address;
8819 
8820 	/*
8821 	 * The physical address of apic access page is stored in the VMCS.
8822 	 * Update it when it becomes invalid.
8823 	 */
8824 	apic_address = gfn_to_hva(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
8825 	if (start <= apic_address && apic_address < end)
8826 		kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD);
8827 }
8828 
8829 void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu)
8830 {
8831 	if (!lapic_in_kernel(vcpu))
8832 		return;
8833 
8834 	if (!kvm_x86_ops.set_apic_access_page_addr)
8835 		return;
8836 
8837 	static_call(kvm_x86_set_apic_access_page_addr)(vcpu);
8838 }
8839 
8840 void __kvm_request_immediate_exit(struct kvm_vcpu *vcpu)
8841 {
8842 	smp_send_reschedule(vcpu->cpu);
8843 }
8844 EXPORT_SYMBOL_GPL(__kvm_request_immediate_exit);
8845 
8846 /*
8847  * Returns 1 to let vcpu_run() continue the guest execution loop without
8848  * exiting to the userspace.  Otherwise, the value will be returned to the
8849  * userspace.
8850  */
8851 static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
8852 {
8853 	int r;
8854 	bool req_int_win =
8855 		dm_request_for_irq_injection(vcpu) &&
8856 		kvm_cpu_accept_dm_intr(vcpu);
8857 	fastpath_t exit_fastpath;
8858 
8859 	bool req_immediate_exit = false;
8860 
8861 	/* Forbid vmenter if vcpu dirty ring is soft-full */
8862 	if (unlikely(vcpu->kvm->dirty_ring_size &&
8863 		     kvm_dirty_ring_soft_full(&vcpu->dirty_ring))) {
8864 		vcpu->run->exit_reason = KVM_EXIT_DIRTY_RING_FULL;
8865 		trace_kvm_dirty_ring_exit(vcpu);
8866 		r = 0;
8867 		goto out;
8868 	}
8869 
8870 	if (kvm_request_pending(vcpu)) {
8871 		if (kvm_check_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu)) {
8872 			if (unlikely(!kvm_x86_ops.nested_ops->get_nested_state_pages(vcpu))) {
8873 				r = 0;
8874 				goto out;
8875 			}
8876 		}
8877 		if (kvm_check_request(KVM_REQ_MMU_RELOAD, vcpu))
8878 			kvm_mmu_unload(vcpu);
8879 		if (kvm_check_request(KVM_REQ_MIGRATE_TIMER, vcpu))
8880 			__kvm_migrate_timers(vcpu);
8881 		if (kvm_check_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu))
8882 			kvm_gen_update_masterclock(vcpu->kvm);
8883 		if (kvm_check_request(KVM_REQ_GLOBAL_CLOCK_UPDATE, vcpu))
8884 			kvm_gen_kvmclock_update(vcpu);
8885 		if (kvm_check_request(KVM_REQ_CLOCK_UPDATE, vcpu)) {
8886 			r = kvm_guest_time_update(vcpu);
8887 			if (unlikely(r))
8888 				goto out;
8889 		}
8890 		if (kvm_check_request(KVM_REQ_MMU_SYNC, vcpu))
8891 			kvm_mmu_sync_roots(vcpu);
8892 		if (kvm_check_request(KVM_REQ_LOAD_MMU_PGD, vcpu))
8893 			kvm_mmu_load_pgd(vcpu);
8894 		if (kvm_check_request(KVM_REQ_TLB_FLUSH, vcpu)) {
8895 			kvm_vcpu_flush_tlb_all(vcpu);
8896 
8897 			/* Flushing all ASIDs flushes the current ASID... */
8898 			kvm_clear_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
8899 		}
8900 		if (kvm_check_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu))
8901 			kvm_vcpu_flush_tlb_current(vcpu);
8902 		if (kvm_check_request(KVM_REQ_HV_TLB_FLUSH, vcpu))
8903 			kvm_vcpu_flush_tlb_guest(vcpu);
8904 
8905 		if (kvm_check_request(KVM_REQ_REPORT_TPR_ACCESS, vcpu)) {
8906 			vcpu->run->exit_reason = KVM_EXIT_TPR_ACCESS;
8907 			r = 0;
8908 			goto out;
8909 		}
8910 		if (kvm_check_request(KVM_REQ_TRIPLE_FAULT, vcpu)) {
8911 			vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
8912 			vcpu->mmio_needed = 0;
8913 			r = 0;
8914 			goto out;
8915 		}
8916 		if (kvm_check_request(KVM_REQ_APF_HALT, vcpu)) {
8917 			/* Page is swapped out. Do synthetic halt */
8918 			vcpu->arch.apf.halted = true;
8919 			r = 1;
8920 			goto out;
8921 		}
8922 		if (kvm_check_request(KVM_REQ_STEAL_UPDATE, vcpu))
8923 			record_steal_time(vcpu);
8924 		if (kvm_check_request(KVM_REQ_SMI, vcpu))
8925 			process_smi(vcpu);
8926 		if (kvm_check_request(KVM_REQ_NMI, vcpu))
8927 			process_nmi(vcpu);
8928 		if (kvm_check_request(KVM_REQ_PMU, vcpu))
8929 			kvm_pmu_handle_event(vcpu);
8930 		if (kvm_check_request(KVM_REQ_PMI, vcpu))
8931 			kvm_pmu_deliver_pmi(vcpu);
8932 		if (kvm_check_request(KVM_REQ_IOAPIC_EOI_EXIT, vcpu)) {
8933 			BUG_ON(vcpu->arch.pending_ioapic_eoi > 255);
8934 			if (test_bit(vcpu->arch.pending_ioapic_eoi,
8935 				     vcpu->arch.ioapic_handled_vectors)) {
8936 				vcpu->run->exit_reason = KVM_EXIT_IOAPIC_EOI;
8937 				vcpu->run->eoi.vector =
8938 						vcpu->arch.pending_ioapic_eoi;
8939 				r = 0;
8940 				goto out;
8941 			}
8942 		}
8943 		if (kvm_check_request(KVM_REQ_SCAN_IOAPIC, vcpu))
8944 			vcpu_scan_ioapic(vcpu);
8945 		if (kvm_check_request(KVM_REQ_LOAD_EOI_EXITMAP, vcpu))
8946 			vcpu_load_eoi_exitmap(vcpu);
8947 		if (kvm_check_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu))
8948 			kvm_vcpu_reload_apic_access_page(vcpu);
8949 		if (kvm_check_request(KVM_REQ_HV_CRASH, vcpu)) {
8950 			vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
8951 			vcpu->run->system_event.type = KVM_SYSTEM_EVENT_CRASH;
8952 			r = 0;
8953 			goto out;
8954 		}
8955 		if (kvm_check_request(KVM_REQ_HV_RESET, vcpu)) {
8956 			vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
8957 			vcpu->run->system_event.type = KVM_SYSTEM_EVENT_RESET;
8958 			r = 0;
8959 			goto out;
8960 		}
8961 		if (kvm_check_request(KVM_REQ_HV_EXIT, vcpu)) {
8962 			struct kvm_vcpu_hv *hv_vcpu = to_hv_vcpu(vcpu);
8963 
8964 			vcpu->run->exit_reason = KVM_EXIT_HYPERV;
8965 			vcpu->run->hyperv = hv_vcpu->exit;
8966 			r = 0;
8967 			goto out;
8968 		}
8969 
8970 		/*
8971 		 * KVM_REQ_HV_STIMER has to be processed after
8972 		 * KVM_REQ_CLOCK_UPDATE, because Hyper-V SynIC timers
8973 		 * depend on the guest clock being up-to-date
8974 		 */
8975 		if (kvm_check_request(KVM_REQ_HV_STIMER, vcpu))
8976 			kvm_hv_process_stimers(vcpu);
8977 		if (kvm_check_request(KVM_REQ_APICV_UPDATE, vcpu))
8978 			kvm_vcpu_update_apicv(vcpu);
8979 		if (kvm_check_request(KVM_REQ_APF_READY, vcpu))
8980 			kvm_check_async_pf_completion(vcpu);
8981 		if (kvm_check_request(KVM_REQ_MSR_FILTER_CHANGED, vcpu))
8982 			static_call(kvm_x86_msr_filter_changed)(vcpu);
8983 	}
8984 
8985 	if (kvm_check_request(KVM_REQ_EVENT, vcpu) || req_int_win ||
8986 	    kvm_xen_has_interrupt(vcpu)) {
8987 		++vcpu->stat.req_event;
8988 		kvm_apic_accept_events(vcpu);
8989 		if (vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED) {
8990 			r = 1;
8991 			goto out;
8992 		}
8993 
8994 		inject_pending_event(vcpu, &req_immediate_exit);
8995 		if (req_int_win)
8996 			static_call(kvm_x86_enable_irq_window)(vcpu);
8997 
8998 		if (kvm_lapic_enabled(vcpu)) {
8999 			update_cr8_intercept(vcpu);
9000 			kvm_lapic_sync_to_vapic(vcpu);
9001 		}
9002 	}
9003 
9004 	r = kvm_mmu_reload(vcpu);
9005 	if (unlikely(r)) {
9006 		goto cancel_injection;
9007 	}
9008 
9009 	preempt_disable();
9010 
9011 	static_call(kvm_x86_prepare_guest_switch)(vcpu);
9012 
9013 	/*
9014 	 * Disable IRQs before setting IN_GUEST_MODE.  Posted interrupt
9015 	 * IPI are then delayed after guest entry, which ensures that they
9016 	 * result in virtual interrupt delivery.
9017 	 */
9018 	local_irq_disable();
9019 	vcpu->mode = IN_GUEST_MODE;
9020 
9021 	srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
9022 
9023 	/*
9024 	 * 1) We should set ->mode before checking ->requests.  Please see
9025 	 * the comment in kvm_vcpu_exiting_guest_mode().
9026 	 *
9027 	 * 2) For APICv, we should set ->mode before checking PID.ON. This
9028 	 * pairs with the memory barrier implicit in pi_test_and_set_on
9029 	 * (see vmx_deliver_posted_interrupt).
9030 	 *
9031 	 * 3) This also orders the write to mode from any reads to the page
9032 	 * tables done while the VCPU is running.  Please see the comment
9033 	 * in kvm_flush_remote_tlbs.
9034 	 */
9035 	smp_mb__after_srcu_read_unlock();
9036 
9037 	/*
9038 	 * This handles the case where a posted interrupt was
9039 	 * notified with kvm_vcpu_kick.
9040 	 */
9041 	if (kvm_lapic_enabled(vcpu) && vcpu->arch.apicv_active)
9042 		static_call(kvm_x86_sync_pir_to_irr)(vcpu);
9043 
9044 	if (kvm_vcpu_exit_request(vcpu)) {
9045 		vcpu->mode = OUTSIDE_GUEST_MODE;
9046 		smp_wmb();
9047 		local_irq_enable();
9048 		preempt_enable();
9049 		vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
9050 		r = 1;
9051 		goto cancel_injection;
9052 	}
9053 
9054 	if (req_immediate_exit) {
9055 		kvm_make_request(KVM_REQ_EVENT, vcpu);
9056 		static_call(kvm_x86_request_immediate_exit)(vcpu);
9057 	}
9058 
9059 	fpregs_assert_state_consistent();
9060 	if (test_thread_flag(TIF_NEED_FPU_LOAD))
9061 		switch_fpu_return();
9062 
9063 	if (unlikely(vcpu->arch.switch_db_regs)) {
9064 		set_debugreg(0, 7);
9065 		set_debugreg(vcpu->arch.eff_db[0], 0);
9066 		set_debugreg(vcpu->arch.eff_db[1], 1);
9067 		set_debugreg(vcpu->arch.eff_db[2], 2);
9068 		set_debugreg(vcpu->arch.eff_db[3], 3);
9069 		set_debugreg(vcpu->arch.dr6, 6);
9070 		vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD;
9071 	}
9072 
9073 	for (;;) {
9074 		exit_fastpath = static_call(kvm_x86_run)(vcpu);
9075 		if (likely(exit_fastpath != EXIT_FASTPATH_REENTER_GUEST))
9076 			break;
9077 
9078                 if (unlikely(kvm_vcpu_exit_request(vcpu))) {
9079 			exit_fastpath = EXIT_FASTPATH_EXIT_HANDLED;
9080 			break;
9081 		}
9082 
9083 		if (vcpu->arch.apicv_active)
9084 			static_call(kvm_x86_sync_pir_to_irr)(vcpu);
9085         }
9086 
9087 	/*
9088 	 * Do this here before restoring debug registers on the host.  And
9089 	 * since we do this before handling the vmexit, a DR access vmexit
9090 	 * can (a) read the correct value of the debug registers, (b) set
9091 	 * KVM_DEBUGREG_WONT_EXIT again.
9092 	 */
9093 	if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) {
9094 		WARN_ON(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP);
9095 		static_call(kvm_x86_sync_dirty_debug_regs)(vcpu);
9096 		kvm_update_dr0123(vcpu);
9097 		kvm_update_dr7(vcpu);
9098 		vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD;
9099 	}
9100 
9101 	/*
9102 	 * If the guest has used debug registers, at least dr7
9103 	 * will be disabled while returning to the host.
9104 	 * If we don't have active breakpoints in the host, we don't
9105 	 * care about the messed up debug address registers. But if
9106 	 * we have some of them active, restore the old state.
9107 	 */
9108 	if (hw_breakpoint_active())
9109 		hw_breakpoint_restore();
9110 
9111 	vcpu->arch.last_vmentry_cpu = vcpu->cpu;
9112 	vcpu->arch.last_guest_tsc = kvm_read_l1_tsc(vcpu, rdtsc());
9113 
9114 	vcpu->mode = OUTSIDE_GUEST_MODE;
9115 	smp_wmb();
9116 
9117 	static_call(kvm_x86_handle_exit_irqoff)(vcpu);
9118 
9119 	/*
9120 	 * Consume any pending interrupts, including the possible source of
9121 	 * VM-Exit on SVM and any ticks that occur between VM-Exit and now.
9122 	 * An instruction is required after local_irq_enable() to fully unblock
9123 	 * interrupts on processors that implement an interrupt shadow, the
9124 	 * stat.exits increment will do nicely.
9125 	 */
9126 	kvm_before_interrupt(vcpu);
9127 	local_irq_enable();
9128 	++vcpu->stat.exits;
9129 	local_irq_disable();
9130 	kvm_after_interrupt(vcpu);
9131 
9132 	if (lapic_in_kernel(vcpu)) {
9133 		s64 delta = vcpu->arch.apic->lapic_timer.advance_expire_delta;
9134 		if (delta != S64_MIN) {
9135 			trace_kvm_wait_lapic_expire(vcpu->vcpu_id, delta);
9136 			vcpu->arch.apic->lapic_timer.advance_expire_delta = S64_MIN;
9137 		}
9138 	}
9139 
9140 	local_irq_enable();
9141 	preempt_enable();
9142 
9143 	vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
9144 
9145 	/*
9146 	 * Profile KVM exit RIPs:
9147 	 */
9148 	if (unlikely(prof_on == KVM_PROFILING)) {
9149 		unsigned long rip = kvm_rip_read(vcpu);
9150 		profile_hit(KVM_PROFILING, (void *)rip);
9151 	}
9152 
9153 	if (unlikely(vcpu->arch.tsc_always_catchup))
9154 		kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
9155 
9156 	if (vcpu->arch.apic_attention)
9157 		kvm_lapic_sync_from_vapic(vcpu);
9158 
9159 	r = static_call(kvm_x86_handle_exit)(vcpu, exit_fastpath);
9160 	return r;
9161 
9162 cancel_injection:
9163 	if (req_immediate_exit)
9164 		kvm_make_request(KVM_REQ_EVENT, vcpu);
9165 	static_call(kvm_x86_cancel_injection)(vcpu);
9166 	if (unlikely(vcpu->arch.apic_attention))
9167 		kvm_lapic_sync_from_vapic(vcpu);
9168 out:
9169 	return r;
9170 }
9171 
9172 static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
9173 {
9174 	if (!kvm_arch_vcpu_runnable(vcpu) &&
9175 	    (!kvm_x86_ops.pre_block || static_call(kvm_x86_pre_block)(vcpu) == 0)) {
9176 		srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
9177 		kvm_vcpu_block(vcpu);
9178 		vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
9179 
9180 		if (kvm_x86_ops.post_block)
9181 			static_call(kvm_x86_post_block)(vcpu);
9182 
9183 		if (!kvm_check_request(KVM_REQ_UNHALT, vcpu))
9184 			return 1;
9185 	}
9186 
9187 	kvm_apic_accept_events(vcpu);
9188 	switch(vcpu->arch.mp_state) {
9189 	case KVM_MP_STATE_HALTED:
9190 	case KVM_MP_STATE_AP_RESET_HOLD:
9191 		vcpu->arch.pv.pv_unhalted = false;
9192 		vcpu->arch.mp_state =
9193 			KVM_MP_STATE_RUNNABLE;
9194 		fallthrough;
9195 	case KVM_MP_STATE_RUNNABLE:
9196 		vcpu->arch.apf.halted = false;
9197 		break;
9198 	case KVM_MP_STATE_INIT_RECEIVED:
9199 		break;
9200 	default:
9201 		return -EINTR;
9202 	}
9203 	return 1;
9204 }
9205 
9206 static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
9207 {
9208 	if (is_guest_mode(vcpu))
9209 		kvm_x86_ops.nested_ops->check_events(vcpu);
9210 
9211 	return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
9212 		!vcpu->arch.apf.halted);
9213 }
9214 
9215 static int vcpu_run(struct kvm_vcpu *vcpu)
9216 {
9217 	int r;
9218 	struct kvm *kvm = vcpu->kvm;
9219 
9220 	vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
9221 	vcpu->arch.l1tf_flush_l1d = true;
9222 
9223 	for (;;) {
9224 		if (kvm_vcpu_running(vcpu)) {
9225 			r = vcpu_enter_guest(vcpu);
9226 		} else {
9227 			r = vcpu_block(kvm, vcpu);
9228 		}
9229 
9230 		if (r <= 0)
9231 			break;
9232 
9233 		kvm_clear_request(KVM_REQ_PENDING_TIMER, vcpu);
9234 		if (kvm_cpu_has_pending_timer(vcpu))
9235 			kvm_inject_pending_timer_irqs(vcpu);
9236 
9237 		if (dm_request_for_irq_injection(vcpu) &&
9238 			kvm_vcpu_ready_for_interrupt_injection(vcpu)) {
9239 			r = 0;
9240 			vcpu->run->exit_reason = KVM_EXIT_IRQ_WINDOW_OPEN;
9241 			++vcpu->stat.request_irq_exits;
9242 			break;
9243 		}
9244 
9245 		if (__xfer_to_guest_mode_work_pending()) {
9246 			srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
9247 			r = xfer_to_guest_mode_handle_work(vcpu);
9248 			if (r)
9249 				return r;
9250 			vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
9251 		}
9252 	}
9253 
9254 	srcu_read_unlock(&kvm->srcu, vcpu->srcu_idx);
9255 
9256 	return r;
9257 }
9258 
9259 static inline int complete_emulated_io(struct kvm_vcpu *vcpu)
9260 {
9261 	int r;
9262 
9263 	vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
9264 	r = kvm_emulate_instruction(vcpu, EMULTYPE_NO_DECODE);
9265 	srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
9266 	return r;
9267 }
9268 
9269 static int complete_emulated_pio(struct kvm_vcpu *vcpu)
9270 {
9271 	BUG_ON(!vcpu->arch.pio.count);
9272 
9273 	return complete_emulated_io(vcpu);
9274 }
9275 
9276 /*
9277  * Implements the following, as a state machine:
9278  *
9279  * read:
9280  *   for each fragment
9281  *     for each mmio piece in the fragment
9282  *       write gpa, len
9283  *       exit
9284  *       copy data
9285  *   execute insn
9286  *
9287  * write:
9288  *   for each fragment
9289  *     for each mmio piece in the fragment
9290  *       write gpa, len
9291  *       copy data
9292  *       exit
9293  */
9294 static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
9295 {
9296 	struct kvm_run *run = vcpu->run;
9297 	struct kvm_mmio_fragment *frag;
9298 	unsigned len;
9299 
9300 	BUG_ON(!vcpu->mmio_needed);
9301 
9302 	/* Complete previous fragment */
9303 	frag = &vcpu->mmio_fragments[vcpu->mmio_cur_fragment];
9304 	len = min(8u, frag->len);
9305 	if (!vcpu->mmio_is_write)
9306 		memcpy(frag->data, run->mmio.data, len);
9307 
9308 	if (frag->len <= 8) {
9309 		/* Switch to the next fragment. */
9310 		frag++;
9311 		vcpu->mmio_cur_fragment++;
9312 	} else {
9313 		/* Go forward to the next mmio piece. */
9314 		frag->data += len;
9315 		frag->gpa += len;
9316 		frag->len -= len;
9317 	}
9318 
9319 	if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) {
9320 		vcpu->mmio_needed = 0;
9321 
9322 		/* FIXME: return into emulator if single-stepping.  */
9323 		if (vcpu->mmio_is_write)
9324 			return 1;
9325 		vcpu->mmio_read_completed = 1;
9326 		return complete_emulated_io(vcpu);
9327 	}
9328 
9329 	run->exit_reason = KVM_EXIT_MMIO;
9330 	run->mmio.phys_addr = frag->gpa;
9331 	if (vcpu->mmio_is_write)
9332 		memcpy(run->mmio.data, frag->data, min(8u, frag->len));
9333 	run->mmio.len = min(8u, frag->len);
9334 	run->mmio.is_write = vcpu->mmio_is_write;
9335 	vcpu->arch.complete_userspace_io = complete_emulated_mmio;
9336 	return 0;
9337 }
9338 
9339 static void kvm_save_current_fpu(struct fpu *fpu)
9340 {
9341 	/*
9342 	 * If the target FPU state is not resident in the CPU registers, just
9343 	 * memcpy() from current, else save CPU state directly to the target.
9344 	 */
9345 	if (test_thread_flag(TIF_NEED_FPU_LOAD))
9346 		memcpy(&fpu->state, &current->thread.fpu.state,
9347 		       fpu_kernel_xstate_size);
9348 	else
9349 		copy_fpregs_to_fpstate(fpu);
9350 }
9351 
9352 /* Swap (qemu) user FPU context for the guest FPU context. */
9353 static void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
9354 {
9355 	fpregs_lock();
9356 
9357 	kvm_save_current_fpu(vcpu->arch.user_fpu);
9358 
9359 	/*
9360 	 * Guests with protected state can't have it set by the hypervisor,
9361 	 * so skip trying to set it.
9362 	 */
9363 	if (vcpu->arch.guest_fpu)
9364 		/* PKRU is separately restored in kvm_x86_ops.run. */
9365 		__copy_kernel_to_fpregs(&vcpu->arch.guest_fpu->state,
9366 					~XFEATURE_MASK_PKRU);
9367 
9368 	fpregs_mark_activate();
9369 	fpregs_unlock();
9370 
9371 	trace_kvm_fpu(1);
9372 }
9373 
9374 /* When vcpu_run ends, restore user space FPU context. */
9375 static void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
9376 {
9377 	fpregs_lock();
9378 
9379 	/*
9380 	 * Guests with protected state can't have it read by the hypervisor,
9381 	 * so skip trying to save it.
9382 	 */
9383 	if (vcpu->arch.guest_fpu)
9384 		kvm_save_current_fpu(vcpu->arch.guest_fpu);
9385 
9386 	copy_kernel_to_fpregs(&vcpu->arch.user_fpu->state);
9387 
9388 	fpregs_mark_activate();
9389 	fpregs_unlock();
9390 
9391 	++vcpu->stat.fpu_reload;
9392 	trace_kvm_fpu(0);
9393 }
9394 
9395 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
9396 {
9397 	struct kvm_run *kvm_run = vcpu->run;
9398 	int r;
9399 
9400 	vcpu_load(vcpu);
9401 	kvm_sigset_activate(vcpu);
9402 	kvm_run->flags = 0;
9403 	kvm_load_guest_fpu(vcpu);
9404 
9405 	if (unlikely(vcpu->arch.mp_state == KVM_MP_STATE_UNINITIALIZED)) {
9406 		if (kvm_run->immediate_exit) {
9407 			r = -EINTR;
9408 			goto out;
9409 		}
9410 		kvm_vcpu_block(vcpu);
9411 		kvm_apic_accept_events(vcpu);
9412 		kvm_clear_request(KVM_REQ_UNHALT, vcpu);
9413 		r = -EAGAIN;
9414 		if (signal_pending(current)) {
9415 			r = -EINTR;
9416 			kvm_run->exit_reason = KVM_EXIT_INTR;
9417 			++vcpu->stat.signal_exits;
9418 		}
9419 		goto out;
9420 	}
9421 
9422 	if (kvm_run->kvm_valid_regs & ~KVM_SYNC_X86_VALID_FIELDS) {
9423 		r = -EINVAL;
9424 		goto out;
9425 	}
9426 
9427 	if (kvm_run->kvm_dirty_regs) {
9428 		r = sync_regs(vcpu);
9429 		if (r != 0)
9430 			goto out;
9431 	}
9432 
9433 	/* re-sync apic's tpr */
9434 	if (!lapic_in_kernel(vcpu)) {
9435 		if (kvm_set_cr8(vcpu, kvm_run->cr8) != 0) {
9436 			r = -EINVAL;
9437 			goto out;
9438 		}
9439 	}
9440 
9441 	if (unlikely(vcpu->arch.complete_userspace_io)) {
9442 		int (*cui)(struct kvm_vcpu *) = vcpu->arch.complete_userspace_io;
9443 		vcpu->arch.complete_userspace_io = NULL;
9444 		r = cui(vcpu);
9445 		if (r <= 0)
9446 			goto out;
9447 	} else
9448 		WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
9449 
9450 	if (kvm_run->immediate_exit)
9451 		r = -EINTR;
9452 	else
9453 		r = vcpu_run(vcpu);
9454 
9455 out:
9456 	kvm_put_guest_fpu(vcpu);
9457 	if (kvm_run->kvm_valid_regs)
9458 		store_regs(vcpu);
9459 	post_kvm_run_save(vcpu);
9460 	kvm_sigset_deactivate(vcpu);
9461 
9462 	vcpu_put(vcpu);
9463 	return r;
9464 }
9465 
9466 static void __get_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
9467 {
9468 	if (vcpu->arch.emulate_regs_need_sync_to_vcpu) {
9469 		/*
9470 		 * We are here if userspace calls get_regs() in the middle of
9471 		 * instruction emulation. Registers state needs to be copied
9472 		 * back from emulation context to vcpu. Userspace shouldn't do
9473 		 * that usually, but some bad designed PV devices (vmware
9474 		 * backdoor interface) need this to work
9475 		 */
9476 		emulator_writeback_register_cache(vcpu->arch.emulate_ctxt);
9477 		vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
9478 	}
9479 	regs->rax = kvm_rax_read(vcpu);
9480 	regs->rbx = kvm_rbx_read(vcpu);
9481 	regs->rcx = kvm_rcx_read(vcpu);
9482 	regs->rdx = kvm_rdx_read(vcpu);
9483 	regs->rsi = kvm_rsi_read(vcpu);
9484 	regs->rdi = kvm_rdi_read(vcpu);
9485 	regs->rsp = kvm_rsp_read(vcpu);
9486 	regs->rbp = kvm_rbp_read(vcpu);
9487 #ifdef CONFIG_X86_64
9488 	regs->r8 = kvm_r8_read(vcpu);
9489 	regs->r9 = kvm_r9_read(vcpu);
9490 	regs->r10 = kvm_r10_read(vcpu);
9491 	regs->r11 = kvm_r11_read(vcpu);
9492 	regs->r12 = kvm_r12_read(vcpu);
9493 	regs->r13 = kvm_r13_read(vcpu);
9494 	regs->r14 = kvm_r14_read(vcpu);
9495 	regs->r15 = kvm_r15_read(vcpu);
9496 #endif
9497 
9498 	regs->rip = kvm_rip_read(vcpu);
9499 	regs->rflags = kvm_get_rflags(vcpu);
9500 }
9501 
9502 int kvm_arch_vcpu_ioctl_get_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
9503 {
9504 	vcpu_load(vcpu);
9505 	__get_regs(vcpu, regs);
9506 	vcpu_put(vcpu);
9507 	return 0;
9508 }
9509 
9510 static void __set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
9511 {
9512 	vcpu->arch.emulate_regs_need_sync_from_vcpu = true;
9513 	vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
9514 
9515 	kvm_rax_write(vcpu, regs->rax);
9516 	kvm_rbx_write(vcpu, regs->rbx);
9517 	kvm_rcx_write(vcpu, regs->rcx);
9518 	kvm_rdx_write(vcpu, regs->rdx);
9519 	kvm_rsi_write(vcpu, regs->rsi);
9520 	kvm_rdi_write(vcpu, regs->rdi);
9521 	kvm_rsp_write(vcpu, regs->rsp);
9522 	kvm_rbp_write(vcpu, regs->rbp);
9523 #ifdef CONFIG_X86_64
9524 	kvm_r8_write(vcpu, regs->r8);
9525 	kvm_r9_write(vcpu, regs->r9);
9526 	kvm_r10_write(vcpu, regs->r10);
9527 	kvm_r11_write(vcpu, regs->r11);
9528 	kvm_r12_write(vcpu, regs->r12);
9529 	kvm_r13_write(vcpu, regs->r13);
9530 	kvm_r14_write(vcpu, regs->r14);
9531 	kvm_r15_write(vcpu, regs->r15);
9532 #endif
9533 
9534 	kvm_rip_write(vcpu, regs->rip);
9535 	kvm_set_rflags(vcpu, regs->rflags | X86_EFLAGS_FIXED);
9536 
9537 	vcpu->arch.exception.pending = false;
9538 
9539 	kvm_make_request(KVM_REQ_EVENT, vcpu);
9540 }
9541 
9542 int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
9543 {
9544 	vcpu_load(vcpu);
9545 	__set_regs(vcpu, regs);
9546 	vcpu_put(vcpu);
9547 	return 0;
9548 }
9549 
9550 void kvm_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
9551 {
9552 	struct kvm_segment cs;
9553 
9554 	kvm_get_segment(vcpu, &cs, VCPU_SREG_CS);
9555 	*db = cs.db;
9556 	*l = cs.l;
9557 }
9558 EXPORT_SYMBOL_GPL(kvm_get_cs_db_l_bits);
9559 
9560 static void __get_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
9561 {
9562 	struct desc_ptr dt;
9563 
9564 	if (vcpu->arch.guest_state_protected)
9565 		goto skip_protected_regs;
9566 
9567 	kvm_get_segment(vcpu, &sregs->cs, VCPU_SREG_CS);
9568 	kvm_get_segment(vcpu, &sregs->ds, VCPU_SREG_DS);
9569 	kvm_get_segment(vcpu, &sregs->es, VCPU_SREG_ES);
9570 	kvm_get_segment(vcpu, &sregs->fs, VCPU_SREG_FS);
9571 	kvm_get_segment(vcpu, &sregs->gs, VCPU_SREG_GS);
9572 	kvm_get_segment(vcpu, &sregs->ss, VCPU_SREG_SS);
9573 
9574 	kvm_get_segment(vcpu, &sregs->tr, VCPU_SREG_TR);
9575 	kvm_get_segment(vcpu, &sregs->ldt, VCPU_SREG_LDTR);
9576 
9577 	static_call(kvm_x86_get_idt)(vcpu, &dt);
9578 	sregs->idt.limit = dt.size;
9579 	sregs->idt.base = dt.address;
9580 	static_call(kvm_x86_get_gdt)(vcpu, &dt);
9581 	sregs->gdt.limit = dt.size;
9582 	sregs->gdt.base = dt.address;
9583 
9584 	sregs->cr2 = vcpu->arch.cr2;
9585 	sregs->cr3 = kvm_read_cr3(vcpu);
9586 
9587 skip_protected_regs:
9588 	sregs->cr0 = kvm_read_cr0(vcpu);
9589 	sregs->cr4 = kvm_read_cr4(vcpu);
9590 	sregs->cr8 = kvm_get_cr8(vcpu);
9591 	sregs->efer = vcpu->arch.efer;
9592 	sregs->apic_base = kvm_get_apic_base(vcpu);
9593 
9594 	memset(sregs->interrupt_bitmap, 0, sizeof(sregs->interrupt_bitmap));
9595 
9596 	if (vcpu->arch.interrupt.injected && !vcpu->arch.interrupt.soft)
9597 		set_bit(vcpu->arch.interrupt.nr,
9598 			(unsigned long *)sregs->interrupt_bitmap);
9599 }
9600 
9601 int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
9602 				  struct kvm_sregs *sregs)
9603 {
9604 	vcpu_load(vcpu);
9605 	__get_sregs(vcpu, sregs);
9606 	vcpu_put(vcpu);
9607 	return 0;
9608 }
9609 
9610 int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
9611 				    struct kvm_mp_state *mp_state)
9612 {
9613 	vcpu_load(vcpu);
9614 	if (kvm_mpx_supported())
9615 		kvm_load_guest_fpu(vcpu);
9616 
9617 	kvm_apic_accept_events(vcpu);
9618 	if ((vcpu->arch.mp_state == KVM_MP_STATE_HALTED ||
9619 	     vcpu->arch.mp_state == KVM_MP_STATE_AP_RESET_HOLD) &&
9620 	    vcpu->arch.pv.pv_unhalted)
9621 		mp_state->mp_state = KVM_MP_STATE_RUNNABLE;
9622 	else
9623 		mp_state->mp_state = vcpu->arch.mp_state;
9624 
9625 	if (kvm_mpx_supported())
9626 		kvm_put_guest_fpu(vcpu);
9627 	vcpu_put(vcpu);
9628 	return 0;
9629 }
9630 
9631 int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
9632 				    struct kvm_mp_state *mp_state)
9633 {
9634 	int ret = -EINVAL;
9635 
9636 	vcpu_load(vcpu);
9637 
9638 	if (!lapic_in_kernel(vcpu) &&
9639 	    mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
9640 		goto out;
9641 
9642 	/*
9643 	 * KVM_MP_STATE_INIT_RECEIVED means the processor is in
9644 	 * INIT state; latched init should be reported using
9645 	 * KVM_SET_VCPU_EVENTS, so reject it here.
9646 	 */
9647 	if ((kvm_vcpu_latch_init(vcpu) || vcpu->arch.smi_pending) &&
9648 	    (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
9649 	     mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
9650 		goto out;
9651 
9652 	if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
9653 		vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
9654 		set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
9655 	} else
9656 		vcpu->arch.mp_state = mp_state->mp_state;
9657 	kvm_make_request(KVM_REQ_EVENT, vcpu);
9658 
9659 	ret = 0;
9660 out:
9661 	vcpu_put(vcpu);
9662 	return ret;
9663 }
9664 
9665 int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int idt_index,
9666 		    int reason, bool has_error_code, u32 error_code)
9667 {
9668 	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
9669 	int ret;
9670 
9671 	init_emulate_ctxt(vcpu);
9672 
9673 	ret = emulator_task_switch(ctxt, tss_selector, idt_index, reason,
9674 				   has_error_code, error_code);
9675 	if (ret) {
9676 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
9677 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
9678 		vcpu->run->internal.ndata = 0;
9679 		return 0;
9680 	}
9681 
9682 	kvm_rip_write(vcpu, ctxt->eip);
9683 	kvm_set_rflags(vcpu, ctxt->eflags);
9684 	return 1;
9685 }
9686 EXPORT_SYMBOL_GPL(kvm_task_switch);
9687 
9688 static bool kvm_is_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
9689 {
9690 	if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG)) {
9691 		/*
9692 		 * When EFER.LME and CR0.PG are set, the processor is in
9693 		 * 64-bit mode (though maybe in a 32-bit code segment).
9694 		 * CR4.PAE and EFER.LMA must be set.
9695 		 */
9696 		if (!(sregs->cr4 & X86_CR4_PAE) || !(sregs->efer & EFER_LMA))
9697 			return false;
9698 		if (kvm_vcpu_is_illegal_gpa(vcpu, sregs->cr3))
9699 			return false;
9700 	} else {
9701 		/*
9702 		 * Not in 64-bit mode: EFER.LMA is clear and the code
9703 		 * segment cannot be 64-bit.
9704 		 */
9705 		if (sregs->efer & EFER_LMA || sregs->cs.l)
9706 			return false;
9707 	}
9708 
9709 	return kvm_is_valid_cr4(vcpu, sregs->cr4);
9710 }
9711 
9712 static int __set_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
9713 {
9714 	struct msr_data apic_base_msr;
9715 	int mmu_reset_needed = 0;
9716 	int pending_vec, max_bits, idx;
9717 	struct desc_ptr dt;
9718 	int ret = -EINVAL;
9719 
9720 	if (!kvm_is_valid_sregs(vcpu, sregs))
9721 		goto out;
9722 
9723 	apic_base_msr.data = sregs->apic_base;
9724 	apic_base_msr.host_initiated = true;
9725 	if (kvm_set_apic_base(vcpu, &apic_base_msr))
9726 		goto out;
9727 
9728 	if (vcpu->arch.guest_state_protected)
9729 		goto skip_protected_regs;
9730 
9731 	dt.size = sregs->idt.limit;
9732 	dt.address = sregs->idt.base;
9733 	static_call(kvm_x86_set_idt)(vcpu, &dt);
9734 	dt.size = sregs->gdt.limit;
9735 	dt.address = sregs->gdt.base;
9736 	static_call(kvm_x86_set_gdt)(vcpu, &dt);
9737 
9738 	vcpu->arch.cr2 = sregs->cr2;
9739 	mmu_reset_needed |= kvm_read_cr3(vcpu) != sregs->cr3;
9740 	vcpu->arch.cr3 = sregs->cr3;
9741 	kvm_register_mark_available(vcpu, VCPU_EXREG_CR3);
9742 
9743 	kvm_set_cr8(vcpu, sregs->cr8);
9744 
9745 	mmu_reset_needed |= vcpu->arch.efer != sregs->efer;
9746 	static_call(kvm_x86_set_efer)(vcpu, sregs->efer);
9747 
9748 	mmu_reset_needed |= kvm_read_cr0(vcpu) != sregs->cr0;
9749 	static_call(kvm_x86_set_cr0)(vcpu, sregs->cr0);
9750 	vcpu->arch.cr0 = sregs->cr0;
9751 
9752 	mmu_reset_needed |= kvm_read_cr4(vcpu) != sregs->cr4;
9753 	static_call(kvm_x86_set_cr4)(vcpu, sregs->cr4);
9754 
9755 	idx = srcu_read_lock(&vcpu->kvm->srcu);
9756 	if (is_pae_paging(vcpu)) {
9757 		load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu));
9758 		mmu_reset_needed = 1;
9759 	}
9760 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
9761 
9762 	if (mmu_reset_needed)
9763 		kvm_mmu_reset_context(vcpu);
9764 
9765 	kvm_set_segment(vcpu, &sregs->cs, VCPU_SREG_CS);
9766 	kvm_set_segment(vcpu, &sregs->ds, VCPU_SREG_DS);
9767 	kvm_set_segment(vcpu, &sregs->es, VCPU_SREG_ES);
9768 	kvm_set_segment(vcpu, &sregs->fs, VCPU_SREG_FS);
9769 	kvm_set_segment(vcpu, &sregs->gs, VCPU_SREG_GS);
9770 	kvm_set_segment(vcpu, &sregs->ss, VCPU_SREG_SS);
9771 
9772 	kvm_set_segment(vcpu, &sregs->tr, VCPU_SREG_TR);
9773 	kvm_set_segment(vcpu, &sregs->ldt, VCPU_SREG_LDTR);
9774 
9775 	update_cr8_intercept(vcpu);
9776 
9777 	/* Older userspace won't unhalt the vcpu on reset. */
9778 	if (kvm_vcpu_is_bsp(vcpu) && kvm_rip_read(vcpu) == 0xfff0 &&
9779 	    sregs->cs.selector == 0xf000 && sregs->cs.base == 0xffff0000 &&
9780 	    !is_protmode(vcpu))
9781 		vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
9782 
9783 skip_protected_regs:
9784 	max_bits = KVM_NR_INTERRUPTS;
9785 	pending_vec = find_first_bit(
9786 		(const unsigned long *)sregs->interrupt_bitmap, max_bits);
9787 	if (pending_vec < max_bits) {
9788 		kvm_queue_interrupt(vcpu, pending_vec, false);
9789 		pr_debug("Set back pending irq %d\n", pending_vec);
9790 	}
9791 
9792 	kvm_make_request(KVM_REQ_EVENT, vcpu);
9793 
9794 	ret = 0;
9795 out:
9796 	return ret;
9797 }
9798 
9799 int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
9800 				  struct kvm_sregs *sregs)
9801 {
9802 	int ret;
9803 
9804 	vcpu_load(vcpu);
9805 	ret = __set_sregs(vcpu, sregs);
9806 	vcpu_put(vcpu);
9807 	return ret;
9808 }
9809 
9810 int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
9811 					struct kvm_guest_debug *dbg)
9812 {
9813 	unsigned long rflags;
9814 	int i, r;
9815 
9816 	if (vcpu->arch.guest_state_protected)
9817 		return -EINVAL;
9818 
9819 	vcpu_load(vcpu);
9820 
9821 	if (dbg->control & (KVM_GUESTDBG_INJECT_DB | KVM_GUESTDBG_INJECT_BP)) {
9822 		r = -EBUSY;
9823 		if (vcpu->arch.exception.pending)
9824 			goto out;
9825 		if (dbg->control & KVM_GUESTDBG_INJECT_DB)
9826 			kvm_queue_exception(vcpu, DB_VECTOR);
9827 		else
9828 			kvm_queue_exception(vcpu, BP_VECTOR);
9829 	}
9830 
9831 	/*
9832 	 * Read rflags as long as potentially injected trace flags are still
9833 	 * filtered out.
9834 	 */
9835 	rflags = kvm_get_rflags(vcpu);
9836 
9837 	vcpu->guest_debug = dbg->control;
9838 	if (!(vcpu->guest_debug & KVM_GUESTDBG_ENABLE))
9839 		vcpu->guest_debug = 0;
9840 
9841 	if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) {
9842 		for (i = 0; i < KVM_NR_DB_REGS; ++i)
9843 			vcpu->arch.eff_db[i] = dbg->arch.debugreg[i];
9844 		vcpu->arch.guest_debug_dr7 = dbg->arch.debugreg[7];
9845 	} else {
9846 		for (i = 0; i < KVM_NR_DB_REGS; i++)
9847 			vcpu->arch.eff_db[i] = vcpu->arch.db[i];
9848 	}
9849 	kvm_update_dr7(vcpu);
9850 
9851 	if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
9852 		vcpu->arch.singlestep_rip = kvm_rip_read(vcpu) +
9853 			get_segment_base(vcpu, VCPU_SREG_CS);
9854 
9855 	/*
9856 	 * Trigger an rflags update that will inject or remove the trace
9857 	 * flags.
9858 	 */
9859 	kvm_set_rflags(vcpu, rflags);
9860 
9861 	static_call(kvm_x86_update_exception_bitmap)(vcpu);
9862 
9863 	r = 0;
9864 
9865 out:
9866 	vcpu_put(vcpu);
9867 	return r;
9868 }
9869 
9870 /*
9871  * Translate a guest virtual address to a guest physical address.
9872  */
9873 int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu,
9874 				    struct kvm_translation *tr)
9875 {
9876 	unsigned long vaddr = tr->linear_address;
9877 	gpa_t gpa;
9878 	int idx;
9879 
9880 	vcpu_load(vcpu);
9881 
9882 	idx = srcu_read_lock(&vcpu->kvm->srcu);
9883 	gpa = kvm_mmu_gva_to_gpa_system(vcpu, vaddr, NULL);
9884 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
9885 	tr->physical_address = gpa;
9886 	tr->valid = gpa != UNMAPPED_GVA;
9887 	tr->writeable = 1;
9888 	tr->usermode = 0;
9889 
9890 	vcpu_put(vcpu);
9891 	return 0;
9892 }
9893 
9894 int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
9895 {
9896 	struct fxregs_state *fxsave;
9897 
9898 	if (!vcpu->arch.guest_fpu)
9899 		return 0;
9900 
9901 	vcpu_load(vcpu);
9902 
9903 	fxsave = &vcpu->arch.guest_fpu->state.fxsave;
9904 	memcpy(fpu->fpr, fxsave->st_space, 128);
9905 	fpu->fcw = fxsave->cwd;
9906 	fpu->fsw = fxsave->swd;
9907 	fpu->ftwx = fxsave->twd;
9908 	fpu->last_opcode = fxsave->fop;
9909 	fpu->last_ip = fxsave->rip;
9910 	fpu->last_dp = fxsave->rdp;
9911 	memcpy(fpu->xmm, fxsave->xmm_space, sizeof(fxsave->xmm_space));
9912 
9913 	vcpu_put(vcpu);
9914 	return 0;
9915 }
9916 
9917 int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
9918 {
9919 	struct fxregs_state *fxsave;
9920 
9921 	if (!vcpu->arch.guest_fpu)
9922 		return 0;
9923 
9924 	vcpu_load(vcpu);
9925 
9926 	fxsave = &vcpu->arch.guest_fpu->state.fxsave;
9927 
9928 	memcpy(fxsave->st_space, fpu->fpr, 128);
9929 	fxsave->cwd = fpu->fcw;
9930 	fxsave->swd = fpu->fsw;
9931 	fxsave->twd = fpu->ftwx;
9932 	fxsave->fop = fpu->last_opcode;
9933 	fxsave->rip = fpu->last_ip;
9934 	fxsave->rdp = fpu->last_dp;
9935 	memcpy(fxsave->xmm_space, fpu->xmm, sizeof(fxsave->xmm_space));
9936 
9937 	vcpu_put(vcpu);
9938 	return 0;
9939 }
9940 
9941 static void store_regs(struct kvm_vcpu *vcpu)
9942 {
9943 	BUILD_BUG_ON(sizeof(struct kvm_sync_regs) > SYNC_REGS_SIZE_BYTES);
9944 
9945 	if (vcpu->run->kvm_valid_regs & KVM_SYNC_X86_REGS)
9946 		__get_regs(vcpu, &vcpu->run->s.regs.regs);
9947 
9948 	if (vcpu->run->kvm_valid_regs & KVM_SYNC_X86_SREGS)
9949 		__get_sregs(vcpu, &vcpu->run->s.regs.sregs);
9950 
9951 	if (vcpu->run->kvm_valid_regs & KVM_SYNC_X86_EVENTS)
9952 		kvm_vcpu_ioctl_x86_get_vcpu_events(
9953 				vcpu, &vcpu->run->s.regs.events);
9954 }
9955 
9956 static int sync_regs(struct kvm_vcpu *vcpu)
9957 {
9958 	if (vcpu->run->kvm_dirty_regs & ~KVM_SYNC_X86_VALID_FIELDS)
9959 		return -EINVAL;
9960 
9961 	if (vcpu->run->kvm_dirty_regs & KVM_SYNC_X86_REGS) {
9962 		__set_regs(vcpu, &vcpu->run->s.regs.regs);
9963 		vcpu->run->kvm_dirty_regs &= ~KVM_SYNC_X86_REGS;
9964 	}
9965 	if (vcpu->run->kvm_dirty_regs & KVM_SYNC_X86_SREGS) {
9966 		if (__set_sregs(vcpu, &vcpu->run->s.regs.sregs))
9967 			return -EINVAL;
9968 		vcpu->run->kvm_dirty_regs &= ~KVM_SYNC_X86_SREGS;
9969 	}
9970 	if (vcpu->run->kvm_dirty_regs & KVM_SYNC_X86_EVENTS) {
9971 		if (kvm_vcpu_ioctl_x86_set_vcpu_events(
9972 				vcpu, &vcpu->run->s.regs.events))
9973 			return -EINVAL;
9974 		vcpu->run->kvm_dirty_regs &= ~KVM_SYNC_X86_EVENTS;
9975 	}
9976 
9977 	return 0;
9978 }
9979 
9980 static void fx_init(struct kvm_vcpu *vcpu)
9981 {
9982 	if (!vcpu->arch.guest_fpu)
9983 		return;
9984 
9985 	fpstate_init(&vcpu->arch.guest_fpu->state);
9986 	if (boot_cpu_has(X86_FEATURE_XSAVES))
9987 		vcpu->arch.guest_fpu->state.xsave.header.xcomp_bv =
9988 			host_xcr0 | XSTATE_COMPACTION_ENABLED;
9989 
9990 	/*
9991 	 * Ensure guest xcr0 is valid for loading
9992 	 */
9993 	vcpu->arch.xcr0 = XFEATURE_MASK_FP;
9994 
9995 	vcpu->arch.cr0 |= X86_CR0_ET;
9996 }
9997 
9998 void kvm_free_guest_fpu(struct kvm_vcpu *vcpu)
9999 {
10000 	if (vcpu->arch.guest_fpu) {
10001 		kmem_cache_free(x86_fpu_cache, vcpu->arch.guest_fpu);
10002 		vcpu->arch.guest_fpu = NULL;
10003 	}
10004 }
10005 EXPORT_SYMBOL_GPL(kvm_free_guest_fpu);
10006 
10007 int kvm_arch_vcpu_precreate(struct kvm *kvm, unsigned int id)
10008 {
10009 	if (kvm_check_tsc_unstable() && atomic_read(&kvm->online_vcpus) != 0)
10010 		pr_warn_once("kvm: SMP vm created on host with unstable TSC; "
10011 			     "guest TSC will not be reliable\n");
10012 
10013 	return 0;
10014 }
10015 
10016 int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
10017 {
10018 	struct page *page;
10019 	int r;
10020 
10021 	if (!irqchip_in_kernel(vcpu->kvm) || kvm_vcpu_is_reset_bsp(vcpu))
10022 		vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
10023 	else
10024 		vcpu->arch.mp_state = KVM_MP_STATE_UNINITIALIZED;
10025 
10026 	kvm_set_tsc_khz(vcpu, max_tsc_khz);
10027 
10028 	r = kvm_mmu_create(vcpu);
10029 	if (r < 0)
10030 		return r;
10031 
10032 	if (irqchip_in_kernel(vcpu->kvm)) {
10033 		r = kvm_create_lapic(vcpu, lapic_timer_advance_ns);
10034 		if (r < 0)
10035 			goto fail_mmu_destroy;
10036 		if (kvm_apicv_activated(vcpu->kvm))
10037 			vcpu->arch.apicv_active = true;
10038 	} else
10039 		static_branch_inc(&kvm_has_noapic_vcpu);
10040 
10041 	r = -ENOMEM;
10042 
10043 	page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
10044 	if (!page)
10045 		goto fail_free_lapic;
10046 	vcpu->arch.pio_data = page_address(page);
10047 
10048 	vcpu->arch.mce_banks = kzalloc(KVM_MAX_MCE_BANKS * sizeof(u64) * 4,
10049 				       GFP_KERNEL_ACCOUNT);
10050 	if (!vcpu->arch.mce_banks)
10051 		goto fail_free_pio_data;
10052 	vcpu->arch.mcg_cap = KVM_MAX_MCE_BANKS;
10053 
10054 	if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask,
10055 				GFP_KERNEL_ACCOUNT))
10056 		goto fail_free_mce_banks;
10057 
10058 	if (!alloc_emulate_ctxt(vcpu))
10059 		goto free_wbinvd_dirty_mask;
10060 
10061 	vcpu->arch.user_fpu = kmem_cache_zalloc(x86_fpu_cache,
10062 						GFP_KERNEL_ACCOUNT);
10063 	if (!vcpu->arch.user_fpu) {
10064 		pr_err("kvm: failed to allocate userspace's fpu\n");
10065 		goto free_emulate_ctxt;
10066 	}
10067 
10068 	vcpu->arch.guest_fpu = kmem_cache_zalloc(x86_fpu_cache,
10069 						 GFP_KERNEL_ACCOUNT);
10070 	if (!vcpu->arch.guest_fpu) {
10071 		pr_err("kvm: failed to allocate vcpu's fpu\n");
10072 		goto free_user_fpu;
10073 	}
10074 	fx_init(vcpu);
10075 
10076 	vcpu->arch.maxphyaddr = cpuid_query_maxphyaddr(vcpu);
10077 	vcpu->arch.reserved_gpa_bits = kvm_vcpu_reserved_gpa_bits_raw(vcpu);
10078 
10079 	vcpu->arch.pat = MSR_IA32_CR_PAT_DEFAULT;
10080 
10081 	kvm_async_pf_hash_reset(vcpu);
10082 	kvm_pmu_init(vcpu);
10083 
10084 	vcpu->arch.pending_external_vector = -1;
10085 	vcpu->arch.preempted_in_kernel = false;
10086 
10087 	r = static_call(kvm_x86_vcpu_create)(vcpu);
10088 	if (r)
10089 		goto free_guest_fpu;
10090 
10091 	vcpu->arch.arch_capabilities = kvm_get_arch_capabilities();
10092 	vcpu->arch.msr_platform_info = MSR_PLATFORM_INFO_CPUID_FAULT;
10093 	kvm_vcpu_mtrr_init(vcpu);
10094 	vcpu_load(vcpu);
10095 	kvm_vcpu_reset(vcpu, false);
10096 	kvm_init_mmu(vcpu, false);
10097 	vcpu_put(vcpu);
10098 	return 0;
10099 
10100 free_guest_fpu:
10101 	kvm_free_guest_fpu(vcpu);
10102 free_user_fpu:
10103 	kmem_cache_free(x86_fpu_cache, vcpu->arch.user_fpu);
10104 free_emulate_ctxt:
10105 	kmem_cache_free(x86_emulator_cache, vcpu->arch.emulate_ctxt);
10106 free_wbinvd_dirty_mask:
10107 	free_cpumask_var(vcpu->arch.wbinvd_dirty_mask);
10108 fail_free_mce_banks:
10109 	kfree(vcpu->arch.mce_banks);
10110 fail_free_pio_data:
10111 	free_page((unsigned long)vcpu->arch.pio_data);
10112 fail_free_lapic:
10113 	kvm_free_lapic(vcpu);
10114 fail_mmu_destroy:
10115 	kvm_mmu_destroy(vcpu);
10116 	return r;
10117 }
10118 
10119 void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
10120 {
10121 	struct kvm *kvm = vcpu->kvm;
10122 
10123 	if (mutex_lock_killable(&vcpu->mutex))
10124 		return;
10125 	vcpu_load(vcpu);
10126 	kvm_synchronize_tsc(vcpu, 0);
10127 	vcpu_put(vcpu);
10128 
10129 	/* poll control enabled by default */
10130 	vcpu->arch.msr_kvm_poll_control = 1;
10131 
10132 	mutex_unlock(&vcpu->mutex);
10133 
10134 	if (kvmclock_periodic_sync && vcpu->vcpu_idx == 0)
10135 		schedule_delayed_work(&kvm->arch.kvmclock_sync_work,
10136 						KVMCLOCK_SYNC_PERIOD);
10137 }
10138 
10139 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
10140 {
10141 	struct gfn_to_pfn_cache *cache = &vcpu->arch.st.cache;
10142 	int idx;
10143 
10144 	kvm_release_pfn(cache->pfn, cache->dirty, cache);
10145 
10146 	kvmclock_reset(vcpu);
10147 
10148 	static_call(kvm_x86_vcpu_free)(vcpu);
10149 
10150 	kmem_cache_free(x86_emulator_cache, vcpu->arch.emulate_ctxt);
10151 	free_cpumask_var(vcpu->arch.wbinvd_dirty_mask);
10152 	kmem_cache_free(x86_fpu_cache, vcpu->arch.user_fpu);
10153 	kvm_free_guest_fpu(vcpu);
10154 
10155 	kvm_hv_vcpu_uninit(vcpu);
10156 	kvm_pmu_destroy(vcpu);
10157 	kfree(vcpu->arch.mce_banks);
10158 	kvm_free_lapic(vcpu);
10159 	idx = srcu_read_lock(&vcpu->kvm->srcu);
10160 	kvm_mmu_destroy(vcpu);
10161 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
10162 	free_page((unsigned long)vcpu->arch.pio_data);
10163 	kvfree(vcpu->arch.cpuid_entries);
10164 	if (!lapic_in_kernel(vcpu))
10165 		static_branch_dec(&kvm_has_noapic_vcpu);
10166 }
10167 
10168 void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
10169 {
10170 	kvm_lapic_reset(vcpu, init_event);
10171 
10172 	vcpu->arch.hflags = 0;
10173 
10174 	vcpu->arch.smi_pending = 0;
10175 	vcpu->arch.smi_count = 0;
10176 	atomic_set(&vcpu->arch.nmi_queued, 0);
10177 	vcpu->arch.nmi_pending = 0;
10178 	vcpu->arch.nmi_injected = false;
10179 	kvm_clear_interrupt_queue(vcpu);
10180 	kvm_clear_exception_queue(vcpu);
10181 
10182 	memset(vcpu->arch.db, 0, sizeof(vcpu->arch.db));
10183 	kvm_update_dr0123(vcpu);
10184 	vcpu->arch.dr6 = DR6_ACTIVE_LOW;
10185 	vcpu->arch.dr7 = DR7_FIXED_1;
10186 	kvm_update_dr7(vcpu);
10187 
10188 	vcpu->arch.cr2 = 0;
10189 
10190 	kvm_make_request(KVM_REQ_EVENT, vcpu);
10191 	vcpu->arch.apf.msr_en_val = 0;
10192 	vcpu->arch.apf.msr_int_val = 0;
10193 	vcpu->arch.st.msr_val = 0;
10194 
10195 	kvmclock_reset(vcpu);
10196 
10197 	kvm_clear_async_pf_completion_queue(vcpu);
10198 	kvm_async_pf_hash_reset(vcpu);
10199 	vcpu->arch.apf.halted = false;
10200 
10201 	if (vcpu->arch.guest_fpu && kvm_mpx_supported()) {
10202 		void *mpx_state_buffer;
10203 
10204 		/*
10205 		 * To avoid have the INIT path from kvm_apic_has_events() that be
10206 		 * called with loaded FPU and does not let userspace fix the state.
10207 		 */
10208 		if (init_event)
10209 			kvm_put_guest_fpu(vcpu);
10210 		mpx_state_buffer = get_xsave_addr(&vcpu->arch.guest_fpu->state.xsave,
10211 					XFEATURE_BNDREGS);
10212 		if (mpx_state_buffer)
10213 			memset(mpx_state_buffer, 0, sizeof(struct mpx_bndreg_state));
10214 		mpx_state_buffer = get_xsave_addr(&vcpu->arch.guest_fpu->state.xsave,
10215 					XFEATURE_BNDCSR);
10216 		if (mpx_state_buffer)
10217 			memset(mpx_state_buffer, 0, sizeof(struct mpx_bndcsr));
10218 		if (init_event)
10219 			kvm_load_guest_fpu(vcpu);
10220 	}
10221 
10222 	if (!init_event) {
10223 		kvm_pmu_reset(vcpu);
10224 		vcpu->arch.smbase = 0x30000;
10225 
10226 		vcpu->arch.msr_misc_features_enables = 0;
10227 
10228 		vcpu->arch.xcr0 = XFEATURE_MASK_FP;
10229 	}
10230 
10231 	memset(vcpu->arch.regs, 0, sizeof(vcpu->arch.regs));
10232 	vcpu->arch.regs_avail = ~0;
10233 	vcpu->arch.regs_dirty = ~0;
10234 
10235 	vcpu->arch.ia32_xss = 0;
10236 
10237 	static_call(kvm_x86_vcpu_reset)(vcpu, init_event);
10238 }
10239 
10240 void kvm_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector)
10241 {
10242 	struct kvm_segment cs;
10243 
10244 	kvm_get_segment(vcpu, &cs, VCPU_SREG_CS);
10245 	cs.selector = vector << 8;
10246 	cs.base = vector << 12;
10247 	kvm_set_segment(vcpu, &cs, VCPU_SREG_CS);
10248 	kvm_rip_write(vcpu, 0);
10249 }
10250 EXPORT_SYMBOL_GPL(kvm_vcpu_deliver_sipi_vector);
10251 
10252 int kvm_arch_hardware_enable(void)
10253 {
10254 	struct kvm *kvm;
10255 	struct kvm_vcpu *vcpu;
10256 	int i;
10257 	int ret;
10258 	u64 local_tsc;
10259 	u64 max_tsc = 0;
10260 	bool stable, backwards_tsc = false;
10261 
10262 	kvm_user_return_msr_cpu_online();
10263 	ret = static_call(kvm_x86_hardware_enable)();
10264 	if (ret != 0)
10265 		return ret;
10266 
10267 	local_tsc = rdtsc();
10268 	stable = !kvm_check_tsc_unstable();
10269 	list_for_each_entry(kvm, &vm_list, vm_list) {
10270 		kvm_for_each_vcpu(i, vcpu, kvm) {
10271 			if (!stable && vcpu->cpu == smp_processor_id())
10272 				kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
10273 			if (stable && vcpu->arch.last_host_tsc > local_tsc) {
10274 				backwards_tsc = true;
10275 				if (vcpu->arch.last_host_tsc > max_tsc)
10276 					max_tsc = vcpu->arch.last_host_tsc;
10277 			}
10278 		}
10279 	}
10280 
10281 	/*
10282 	 * Sometimes, even reliable TSCs go backwards.  This happens on
10283 	 * platforms that reset TSC during suspend or hibernate actions, but
10284 	 * maintain synchronization.  We must compensate.  Fortunately, we can
10285 	 * detect that condition here, which happens early in CPU bringup,
10286 	 * before any KVM threads can be running.  Unfortunately, we can't
10287 	 * bring the TSCs fully up to date with real time, as we aren't yet far
10288 	 * enough into CPU bringup that we know how much real time has actually
10289 	 * elapsed; our helper function, ktime_get_boottime_ns() will be using boot
10290 	 * variables that haven't been updated yet.
10291 	 *
10292 	 * So we simply find the maximum observed TSC above, then record the
10293 	 * adjustment to TSC in each VCPU.  When the VCPU later gets loaded,
10294 	 * the adjustment will be applied.  Note that we accumulate
10295 	 * adjustments, in case multiple suspend cycles happen before some VCPU
10296 	 * gets a chance to run again.  In the event that no KVM threads get a
10297 	 * chance to run, we will miss the entire elapsed period, as we'll have
10298 	 * reset last_host_tsc, so VCPUs will not have the TSC adjusted and may
10299 	 * loose cycle time.  This isn't too big a deal, since the loss will be
10300 	 * uniform across all VCPUs (not to mention the scenario is extremely
10301 	 * unlikely). It is possible that a second hibernate recovery happens
10302 	 * much faster than a first, causing the observed TSC here to be
10303 	 * smaller; this would require additional padding adjustment, which is
10304 	 * why we set last_host_tsc to the local tsc observed here.
10305 	 *
10306 	 * N.B. - this code below runs only on platforms with reliable TSC,
10307 	 * as that is the only way backwards_tsc is set above.  Also note
10308 	 * that this runs for ALL vcpus, which is not a bug; all VCPUs should
10309 	 * have the same delta_cyc adjustment applied if backwards_tsc
10310 	 * is detected.  Note further, this adjustment is only done once,
10311 	 * as we reset last_host_tsc on all VCPUs to stop this from being
10312 	 * called multiple times (one for each physical CPU bringup).
10313 	 *
10314 	 * Platforms with unreliable TSCs don't have to deal with this, they
10315 	 * will be compensated by the logic in vcpu_load, which sets the TSC to
10316 	 * catchup mode.  This will catchup all VCPUs to real time, but cannot
10317 	 * guarantee that they stay in perfect synchronization.
10318 	 */
10319 	if (backwards_tsc) {
10320 		u64 delta_cyc = max_tsc - local_tsc;
10321 		list_for_each_entry(kvm, &vm_list, vm_list) {
10322 			kvm->arch.backwards_tsc_observed = true;
10323 			kvm_for_each_vcpu(i, vcpu, kvm) {
10324 				vcpu->arch.tsc_offset_adjustment += delta_cyc;
10325 				vcpu->arch.last_host_tsc = local_tsc;
10326 				kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
10327 			}
10328 
10329 			/*
10330 			 * We have to disable TSC offset matching.. if you were
10331 			 * booting a VM while issuing an S4 host suspend....
10332 			 * you may have some problem.  Solving this issue is
10333 			 * left as an exercise to the reader.
10334 			 */
10335 			kvm->arch.last_tsc_nsec = 0;
10336 			kvm->arch.last_tsc_write = 0;
10337 		}
10338 
10339 	}
10340 	return 0;
10341 }
10342 
10343 void kvm_arch_hardware_disable(void)
10344 {
10345 	static_call(kvm_x86_hardware_disable)();
10346 	drop_user_return_notifiers();
10347 }
10348 
10349 int kvm_arch_hardware_setup(void *opaque)
10350 {
10351 	struct kvm_x86_init_ops *ops = opaque;
10352 	int r;
10353 
10354 	rdmsrl_safe(MSR_EFER, &host_efer);
10355 
10356 	if (boot_cpu_has(X86_FEATURE_XSAVES))
10357 		rdmsrl(MSR_IA32_XSS, host_xss);
10358 
10359 	r = ops->hardware_setup();
10360 	if (r != 0)
10361 		return r;
10362 
10363 	memcpy(&kvm_x86_ops, ops->runtime_ops, sizeof(kvm_x86_ops));
10364 	kvm_ops_static_call_update();
10365 
10366 	if (!kvm_cpu_cap_has(X86_FEATURE_XSAVES))
10367 		supported_xss = 0;
10368 
10369 #define __kvm_cpu_cap_has(UNUSED_, f) kvm_cpu_cap_has(f)
10370 	cr4_reserved_bits = __cr4_reserved_bits(__kvm_cpu_cap_has, UNUSED_);
10371 #undef __kvm_cpu_cap_has
10372 
10373 	if (kvm_has_tsc_control) {
10374 		/*
10375 		 * Make sure the user can only configure tsc_khz values that
10376 		 * fit into a signed integer.
10377 		 * A min value is not calculated because it will always
10378 		 * be 1 on all machines.
10379 		 */
10380 		u64 max = min(0x7fffffffULL,
10381 			      __scale_tsc(kvm_max_tsc_scaling_ratio, tsc_khz));
10382 		kvm_max_guest_tsc_khz = max;
10383 
10384 		kvm_default_tsc_scaling_ratio = 1ULL << kvm_tsc_scaling_ratio_frac_bits;
10385 	}
10386 
10387 	kvm_init_msr_list();
10388 	return 0;
10389 }
10390 
10391 void kvm_arch_hardware_unsetup(void)
10392 {
10393 	static_call(kvm_x86_hardware_unsetup)();
10394 }
10395 
10396 int kvm_arch_check_processor_compat(void *opaque)
10397 {
10398 	struct cpuinfo_x86 *c = &cpu_data(smp_processor_id());
10399 	struct kvm_x86_init_ops *ops = opaque;
10400 
10401 	WARN_ON(!irqs_disabled());
10402 
10403 	if (__cr4_reserved_bits(cpu_has, c) !=
10404 	    __cr4_reserved_bits(cpu_has, &boot_cpu_data))
10405 		return -EIO;
10406 
10407 	return ops->check_processor_compatibility();
10408 }
10409 
10410 bool kvm_vcpu_is_reset_bsp(struct kvm_vcpu *vcpu)
10411 {
10412 	return vcpu->kvm->arch.bsp_vcpu_id == vcpu->vcpu_id;
10413 }
10414 EXPORT_SYMBOL_GPL(kvm_vcpu_is_reset_bsp);
10415 
10416 bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
10417 {
10418 	return (vcpu->arch.apic_base & MSR_IA32_APICBASE_BSP) != 0;
10419 }
10420 
10421 __read_mostly DEFINE_STATIC_KEY_FALSE(kvm_has_noapic_vcpu);
10422 EXPORT_SYMBOL_GPL(kvm_has_noapic_vcpu);
10423 
10424 void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu)
10425 {
10426 	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
10427 
10428 	vcpu->arch.l1tf_flush_l1d = true;
10429 	if (pmu->version && unlikely(pmu->event_count)) {
10430 		pmu->need_cleanup = true;
10431 		kvm_make_request(KVM_REQ_PMU, vcpu);
10432 	}
10433 	static_call(kvm_x86_sched_in)(vcpu, cpu);
10434 }
10435 
10436 void kvm_arch_free_vm(struct kvm *kvm)
10437 {
10438 	kfree(to_kvm_hv(kvm)->hv_pa_pg);
10439 	vfree(kvm);
10440 }
10441 
10442 
10443 int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
10444 {
10445 	if (type)
10446 		return -EINVAL;
10447 
10448 	INIT_HLIST_HEAD(&kvm->arch.mask_notifier_list);
10449 	INIT_LIST_HEAD(&kvm->arch.active_mmu_pages);
10450 	INIT_LIST_HEAD(&kvm->arch.zapped_obsolete_pages);
10451 	INIT_LIST_HEAD(&kvm->arch.lpage_disallowed_mmu_pages);
10452 	INIT_LIST_HEAD(&kvm->arch.assigned_dev_head);
10453 	atomic_set(&kvm->arch.noncoherent_dma_count, 0);
10454 
10455 	/* Reserve bit 0 of irq_sources_bitmap for userspace irq source */
10456 	set_bit(KVM_USERSPACE_IRQ_SOURCE_ID, &kvm->arch.irq_sources_bitmap);
10457 	/* Reserve bit 1 of irq_sources_bitmap for irqfd-resampler */
10458 	set_bit(KVM_IRQFD_RESAMPLE_IRQ_SOURCE_ID,
10459 		&kvm->arch.irq_sources_bitmap);
10460 
10461 	raw_spin_lock_init(&kvm->arch.tsc_write_lock);
10462 	mutex_init(&kvm->arch.apic_map_lock);
10463 	spin_lock_init(&kvm->arch.pvclock_gtod_sync_lock);
10464 
10465 	kvm->arch.kvmclock_offset = -get_kvmclock_base_ns();
10466 	pvclock_update_vm_gtod_copy(kvm);
10467 
10468 	kvm->arch.guest_can_read_msr_platform_info = true;
10469 
10470 	INIT_DELAYED_WORK(&kvm->arch.kvmclock_update_work, kvmclock_update_fn);
10471 	INIT_DELAYED_WORK(&kvm->arch.kvmclock_sync_work, kvmclock_sync_fn);
10472 
10473 	kvm_hv_init_vm(kvm);
10474 	kvm_page_track_init(kvm);
10475 	kvm_mmu_init_vm(kvm);
10476 
10477 	return static_call(kvm_x86_vm_init)(kvm);
10478 }
10479 
10480 int kvm_arch_post_init_vm(struct kvm *kvm)
10481 {
10482 	return kvm_mmu_post_init_vm(kvm);
10483 }
10484 
10485 static void kvm_unload_vcpu_mmu(struct kvm_vcpu *vcpu)
10486 {
10487 	vcpu_load(vcpu);
10488 	kvm_mmu_unload(vcpu);
10489 	vcpu_put(vcpu);
10490 }
10491 
10492 static void kvm_free_vcpus(struct kvm *kvm)
10493 {
10494 	unsigned int i;
10495 	struct kvm_vcpu *vcpu;
10496 
10497 	/*
10498 	 * Unpin any mmu pages first.
10499 	 */
10500 	kvm_for_each_vcpu(i, vcpu, kvm) {
10501 		kvm_clear_async_pf_completion_queue(vcpu);
10502 		kvm_unload_vcpu_mmu(vcpu);
10503 	}
10504 	kvm_for_each_vcpu(i, vcpu, kvm)
10505 		kvm_vcpu_destroy(vcpu);
10506 
10507 	mutex_lock(&kvm->lock);
10508 	for (i = 0; i < atomic_read(&kvm->online_vcpus); i++)
10509 		kvm->vcpus[i] = NULL;
10510 
10511 	atomic_set(&kvm->online_vcpus, 0);
10512 	mutex_unlock(&kvm->lock);
10513 }
10514 
10515 void kvm_arch_sync_events(struct kvm *kvm)
10516 {
10517 	cancel_delayed_work_sync(&kvm->arch.kvmclock_sync_work);
10518 	cancel_delayed_work_sync(&kvm->arch.kvmclock_update_work);
10519 	kvm_free_pit(kvm);
10520 }
10521 
10522 #define  ERR_PTR_USR(e)  ((void __user *)ERR_PTR(e))
10523 
10524 /**
10525  * __x86_set_memory_region: Setup KVM internal memory slot
10526  *
10527  * @kvm: the kvm pointer to the VM.
10528  * @id: the slot ID to setup.
10529  * @gpa: the GPA to install the slot (unused when @size == 0).
10530  * @size: the size of the slot. Set to zero to uninstall a slot.
10531  *
10532  * This function helps to setup a KVM internal memory slot.  Specify
10533  * @size > 0 to install a new slot, while @size == 0 to uninstall a
10534  * slot.  The return code can be one of the following:
10535  *
10536  *   HVA:           on success (uninstall will return a bogus HVA)
10537  *   -errno:        on error
10538  *
10539  * The caller should always use IS_ERR() to check the return value
10540  * before use.  Note, the KVM internal memory slots are guaranteed to
10541  * remain valid and unchanged until the VM is destroyed, i.e., the
10542  * GPA->HVA translation will not change.  However, the HVA is a user
10543  * address, i.e. its accessibility is not guaranteed, and must be
10544  * accessed via __copy_{to,from}_user().
10545  */
10546 void __user * __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa,
10547 				      u32 size)
10548 {
10549 	int i, r;
10550 	unsigned long hva, old_npages;
10551 	struct kvm_memslots *slots = kvm_memslots(kvm);
10552 	struct kvm_memory_slot *slot;
10553 
10554 	/* Called with kvm->slots_lock held.  */
10555 	if (WARN_ON(id >= KVM_MEM_SLOTS_NUM))
10556 		return ERR_PTR_USR(-EINVAL);
10557 
10558 	slot = id_to_memslot(slots, id);
10559 	if (size) {
10560 		if (slot && slot->npages)
10561 			return ERR_PTR_USR(-EEXIST);
10562 
10563 		/*
10564 		 * MAP_SHARED to prevent internal slot pages from being moved
10565 		 * by fork()/COW.
10566 		 */
10567 		hva = vm_mmap(NULL, 0, size, PROT_READ | PROT_WRITE,
10568 			      MAP_SHARED | MAP_ANONYMOUS, 0);
10569 		if (IS_ERR((void *)hva))
10570 			return (void __user *)hva;
10571 	} else {
10572 		if (!slot || !slot->npages)
10573 			return 0;
10574 
10575 		old_npages = slot->npages;
10576 		hva = slot->userspace_addr;
10577 	}
10578 
10579 	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
10580 		struct kvm_userspace_memory_region m;
10581 
10582 		m.slot = id | (i << 16);
10583 		m.flags = 0;
10584 		m.guest_phys_addr = gpa;
10585 		m.userspace_addr = hva;
10586 		m.memory_size = size;
10587 		r = __kvm_set_memory_region(kvm, &m);
10588 		if (r < 0)
10589 			return ERR_PTR_USR(r);
10590 	}
10591 
10592 	if (!size)
10593 		vm_munmap(hva, old_npages * PAGE_SIZE);
10594 
10595 	return (void __user *)hva;
10596 }
10597 EXPORT_SYMBOL_GPL(__x86_set_memory_region);
10598 
10599 void kvm_arch_pre_destroy_vm(struct kvm *kvm)
10600 {
10601 	kvm_mmu_pre_destroy_vm(kvm);
10602 }
10603 
10604 void kvm_arch_destroy_vm(struct kvm *kvm)
10605 {
10606 	u32 i;
10607 
10608 	if (current->mm == kvm->mm) {
10609 		/*
10610 		 * Free memory regions allocated on behalf of userspace,
10611 		 * unless the the memory map has changed due to process exit
10612 		 * or fd copying.
10613 		 */
10614 		mutex_lock(&kvm->slots_lock);
10615 		__x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
10616 					0, 0);
10617 		__x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT,
10618 					0, 0);
10619 		__x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, 0, 0);
10620 		mutex_unlock(&kvm->slots_lock);
10621 	}
10622 	static_call_cond(kvm_x86_vm_destroy)(kvm);
10623 	for (i = 0; i < kvm->arch.msr_filter.count; i++)
10624 		kfree(kvm->arch.msr_filter.ranges[i].bitmap);
10625 	kvm_pic_destroy(kvm);
10626 	kvm_ioapic_destroy(kvm);
10627 	kvm_free_vcpus(kvm);
10628 	kvfree(rcu_dereference_check(kvm->arch.apic_map, 1));
10629 	kfree(srcu_dereference_check(kvm->arch.pmu_event_filter, &kvm->srcu, 1));
10630 	kvm_mmu_uninit_vm(kvm);
10631 	kvm_page_track_cleanup(kvm);
10632 	kvm_xen_destroy_vm(kvm);
10633 	kvm_hv_destroy_vm(kvm);
10634 }
10635 
10636 void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *slot)
10637 {
10638 	int i;
10639 
10640 	for (i = 0; i < KVM_NR_PAGE_SIZES; ++i) {
10641 		kvfree(slot->arch.rmap[i]);
10642 		slot->arch.rmap[i] = NULL;
10643 
10644 		if (i == 0)
10645 			continue;
10646 
10647 		kvfree(slot->arch.lpage_info[i - 1]);
10648 		slot->arch.lpage_info[i - 1] = NULL;
10649 	}
10650 
10651 	kvm_page_track_free_memslot(slot);
10652 }
10653 
10654 static int kvm_alloc_memslot_metadata(struct kvm_memory_slot *slot,
10655 				      unsigned long npages)
10656 {
10657 	int i;
10658 
10659 	/*
10660 	 * Clear out the previous array pointers for the KVM_MR_MOVE case.  The
10661 	 * old arrays will be freed by __kvm_set_memory_region() if installing
10662 	 * the new memslot is successful.
10663 	 */
10664 	memset(&slot->arch, 0, sizeof(slot->arch));
10665 
10666 	for (i = 0; i < KVM_NR_PAGE_SIZES; ++i) {
10667 		struct kvm_lpage_info *linfo;
10668 		unsigned long ugfn;
10669 		int lpages;
10670 		int level = i + 1;
10671 
10672 		lpages = gfn_to_index(slot->base_gfn + npages - 1,
10673 				      slot->base_gfn, level) + 1;
10674 
10675 		slot->arch.rmap[i] =
10676 			kvcalloc(lpages, sizeof(*slot->arch.rmap[i]),
10677 				 GFP_KERNEL_ACCOUNT);
10678 		if (!slot->arch.rmap[i])
10679 			goto out_free;
10680 		if (i == 0)
10681 			continue;
10682 
10683 		linfo = kvcalloc(lpages, sizeof(*linfo), GFP_KERNEL_ACCOUNT);
10684 		if (!linfo)
10685 			goto out_free;
10686 
10687 		slot->arch.lpage_info[i - 1] = linfo;
10688 
10689 		if (slot->base_gfn & (KVM_PAGES_PER_HPAGE(level) - 1))
10690 			linfo[0].disallow_lpage = 1;
10691 		if ((slot->base_gfn + npages) & (KVM_PAGES_PER_HPAGE(level) - 1))
10692 			linfo[lpages - 1].disallow_lpage = 1;
10693 		ugfn = slot->userspace_addr >> PAGE_SHIFT;
10694 		/*
10695 		 * If the gfn and userspace address are not aligned wrt each
10696 		 * other, disable large page support for this slot.
10697 		 */
10698 		if ((slot->base_gfn ^ ugfn) & (KVM_PAGES_PER_HPAGE(level) - 1)) {
10699 			unsigned long j;
10700 
10701 			for (j = 0; j < lpages; ++j)
10702 				linfo[j].disallow_lpage = 1;
10703 		}
10704 	}
10705 
10706 	if (kvm_page_track_create_memslot(slot, npages))
10707 		goto out_free;
10708 
10709 	return 0;
10710 
10711 out_free:
10712 	for (i = 0; i < KVM_NR_PAGE_SIZES; ++i) {
10713 		kvfree(slot->arch.rmap[i]);
10714 		slot->arch.rmap[i] = NULL;
10715 		if (i == 0)
10716 			continue;
10717 
10718 		kvfree(slot->arch.lpage_info[i - 1]);
10719 		slot->arch.lpage_info[i - 1] = NULL;
10720 	}
10721 	return -ENOMEM;
10722 }
10723 
10724 void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
10725 {
10726 	struct kvm_vcpu *vcpu;
10727 	int i;
10728 
10729 	/*
10730 	 * memslots->generation has been incremented.
10731 	 * mmio generation may have reached its maximum value.
10732 	 */
10733 	kvm_mmu_invalidate_mmio_sptes(kvm, gen);
10734 
10735 	/* Force re-initialization of steal_time cache */
10736 	kvm_for_each_vcpu(i, vcpu, kvm)
10737 		kvm_vcpu_kick(vcpu);
10738 }
10739 
10740 int kvm_arch_prepare_memory_region(struct kvm *kvm,
10741 				struct kvm_memory_slot *memslot,
10742 				const struct kvm_userspace_memory_region *mem,
10743 				enum kvm_mr_change change)
10744 {
10745 	if (change == KVM_MR_CREATE || change == KVM_MR_MOVE)
10746 		return kvm_alloc_memslot_metadata(memslot,
10747 						  mem->memory_size >> PAGE_SHIFT);
10748 	return 0;
10749 }
10750 
10751 static void kvm_mmu_slot_apply_flags(struct kvm *kvm,
10752 				     struct kvm_memory_slot *old,
10753 				     struct kvm_memory_slot *new,
10754 				     enum kvm_mr_change change)
10755 {
10756 	/*
10757 	 * Nothing to do for RO slots or CREATE/MOVE/DELETE of a slot.
10758 	 * See comments below.
10759 	 */
10760 	if ((change != KVM_MR_FLAGS_ONLY) || (new->flags & KVM_MEM_READONLY))
10761 		return;
10762 
10763 	/*
10764 	 * Dirty logging tracks sptes in 4k granularity, meaning that large
10765 	 * sptes have to be split.  If live migration is successful, the guest
10766 	 * in the source machine will be destroyed and large sptes will be
10767 	 * created in the destination. However, if the guest continues to run
10768 	 * in the source machine (for example if live migration fails), small
10769 	 * sptes will remain around and cause bad performance.
10770 	 *
10771 	 * Scan sptes if dirty logging has been stopped, dropping those
10772 	 * which can be collapsed into a single large-page spte.  Later
10773 	 * page faults will create the large-page sptes.
10774 	 *
10775 	 * There is no need to do this in any of the following cases:
10776 	 * CREATE:      No dirty mappings will already exist.
10777 	 * MOVE/DELETE: The old mappings will already have been cleaned up by
10778 	 *		kvm_arch_flush_shadow_memslot()
10779 	 */
10780 	if ((old->flags & KVM_MEM_LOG_DIRTY_PAGES) &&
10781 	    !(new->flags & KVM_MEM_LOG_DIRTY_PAGES))
10782 		kvm_mmu_zap_collapsible_sptes(kvm, new);
10783 
10784 	/*
10785 	 * Enable or disable dirty logging for the slot.
10786 	 *
10787 	 * For KVM_MR_DELETE and KVM_MR_MOVE, the shadow pages of the old
10788 	 * slot have been zapped so no dirty logging updates are needed for
10789 	 * the old slot.
10790 	 * For KVM_MR_CREATE and KVM_MR_MOVE, once the new slot is visible
10791 	 * any mappings that might be created in it will consume the
10792 	 * properties of the new slot and do not need to be updated here.
10793 	 *
10794 	 * When PML is enabled, the kvm_x86_ops dirty logging hooks are
10795 	 * called to enable/disable dirty logging.
10796 	 *
10797 	 * When disabling dirty logging with PML enabled, the D-bit is set
10798 	 * for sptes in the slot in order to prevent unnecessary GPA
10799 	 * logging in the PML buffer (and potential PML buffer full VMEXIT).
10800 	 * This guarantees leaving PML enabled for the guest's lifetime
10801 	 * won't have any additional overhead from PML when the guest is
10802 	 * running with dirty logging disabled.
10803 	 *
10804 	 * When enabling dirty logging, large sptes are write-protected
10805 	 * so they can be split on first write.  New large sptes cannot
10806 	 * be created for this slot until the end of the logging.
10807 	 * See the comments in fast_page_fault().
10808 	 * For small sptes, nothing is done if the dirty log is in the
10809 	 * initial-all-set state.  Otherwise, depending on whether pml
10810 	 * is enabled the D-bit or the W-bit will be cleared.
10811 	 */
10812 	if (new->flags & KVM_MEM_LOG_DIRTY_PAGES) {
10813 		if (kvm_x86_ops.slot_enable_log_dirty) {
10814 			static_call(kvm_x86_slot_enable_log_dirty)(kvm, new);
10815 		} else {
10816 			int level =
10817 				kvm_dirty_log_manual_protect_and_init_set(kvm) ?
10818 				PG_LEVEL_2M : PG_LEVEL_4K;
10819 
10820 			/*
10821 			 * If we're with initial-all-set, we don't need
10822 			 * to write protect any small page because
10823 			 * they're reported as dirty already.  However
10824 			 * we still need to write-protect huge pages
10825 			 * so that the page split can happen lazily on
10826 			 * the first write to the huge page.
10827 			 */
10828 			kvm_mmu_slot_remove_write_access(kvm, new, level);
10829 		}
10830 	} else {
10831 		static_call_cond(kvm_x86_slot_disable_log_dirty)(kvm, new);
10832 	}
10833 }
10834 
10835 void kvm_arch_commit_memory_region(struct kvm *kvm,
10836 				const struct kvm_userspace_memory_region *mem,
10837 				struct kvm_memory_slot *old,
10838 				const struct kvm_memory_slot *new,
10839 				enum kvm_mr_change change)
10840 {
10841 	if (!kvm->arch.n_requested_mmu_pages)
10842 		kvm_mmu_change_mmu_pages(kvm,
10843 				kvm_mmu_calculate_default_mmu_pages(kvm));
10844 
10845 	/*
10846 	 * FIXME: const-ify all uses of struct kvm_memory_slot.
10847 	 */
10848 	kvm_mmu_slot_apply_flags(kvm, old, (struct kvm_memory_slot *) new, change);
10849 
10850 	/* Free the arrays associated with the old memslot. */
10851 	if (change == KVM_MR_MOVE)
10852 		kvm_arch_free_memslot(kvm, old);
10853 }
10854 
10855 void kvm_arch_flush_shadow_all(struct kvm *kvm)
10856 {
10857 	kvm_mmu_zap_all(kvm);
10858 }
10859 
10860 void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
10861 				   struct kvm_memory_slot *slot)
10862 {
10863 	kvm_page_track_flush_slot(kvm, slot);
10864 }
10865 
10866 static inline bool kvm_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
10867 {
10868 	return (is_guest_mode(vcpu) &&
10869 			kvm_x86_ops.guest_apic_has_interrupt &&
10870 			static_call(kvm_x86_guest_apic_has_interrupt)(vcpu));
10871 }
10872 
10873 static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu)
10874 {
10875 	if (!list_empty_careful(&vcpu->async_pf.done))
10876 		return true;
10877 
10878 	if (kvm_apic_has_events(vcpu))
10879 		return true;
10880 
10881 	if (vcpu->arch.pv.pv_unhalted)
10882 		return true;
10883 
10884 	if (vcpu->arch.exception.pending)
10885 		return true;
10886 
10887 	if (kvm_test_request(KVM_REQ_NMI, vcpu) ||
10888 	    (vcpu->arch.nmi_pending &&
10889 	     static_call(kvm_x86_nmi_allowed)(vcpu, false)))
10890 		return true;
10891 
10892 	if (kvm_test_request(KVM_REQ_SMI, vcpu) ||
10893 	    (vcpu->arch.smi_pending &&
10894 	     static_call(kvm_x86_smi_allowed)(vcpu, false)))
10895 		return true;
10896 
10897 	if (kvm_arch_interrupt_allowed(vcpu) &&
10898 	    (kvm_cpu_has_interrupt(vcpu) ||
10899 	    kvm_guest_apic_has_interrupt(vcpu)))
10900 		return true;
10901 
10902 	if (kvm_hv_has_stimer_pending(vcpu))
10903 		return true;
10904 
10905 	if (is_guest_mode(vcpu) &&
10906 	    kvm_x86_ops.nested_ops->hv_timer_pending &&
10907 	    kvm_x86_ops.nested_ops->hv_timer_pending(vcpu))
10908 		return true;
10909 
10910 	return false;
10911 }
10912 
10913 int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
10914 {
10915 	return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu);
10916 }
10917 
10918 bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
10919 {
10920 	if (READ_ONCE(vcpu->arch.pv.pv_unhalted))
10921 		return true;
10922 
10923 	if (kvm_test_request(KVM_REQ_NMI, vcpu) ||
10924 		kvm_test_request(KVM_REQ_SMI, vcpu) ||
10925 		 kvm_test_request(KVM_REQ_EVENT, vcpu))
10926 		return true;
10927 
10928 	if (vcpu->arch.apicv_active && static_call(kvm_x86_dy_apicv_has_pending_interrupt)(vcpu))
10929 		return true;
10930 
10931 	return false;
10932 }
10933 
10934 bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
10935 {
10936 	return vcpu->arch.preempted_in_kernel;
10937 }
10938 
10939 int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu)
10940 {
10941 	return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE;
10942 }
10943 
10944 int kvm_arch_interrupt_allowed(struct kvm_vcpu *vcpu)
10945 {
10946 	return static_call(kvm_x86_interrupt_allowed)(vcpu, false);
10947 }
10948 
10949 unsigned long kvm_get_linear_rip(struct kvm_vcpu *vcpu)
10950 {
10951 	/* Can't read the RIP when guest state is protected, just return 0 */
10952 	if (vcpu->arch.guest_state_protected)
10953 		return 0;
10954 
10955 	if (is_64_bit_mode(vcpu))
10956 		return kvm_rip_read(vcpu);
10957 	return (u32)(get_segment_base(vcpu, VCPU_SREG_CS) +
10958 		     kvm_rip_read(vcpu));
10959 }
10960 EXPORT_SYMBOL_GPL(kvm_get_linear_rip);
10961 
10962 bool kvm_is_linear_rip(struct kvm_vcpu *vcpu, unsigned long linear_rip)
10963 {
10964 	return kvm_get_linear_rip(vcpu) == linear_rip;
10965 }
10966 EXPORT_SYMBOL_GPL(kvm_is_linear_rip);
10967 
10968 unsigned long kvm_get_rflags(struct kvm_vcpu *vcpu)
10969 {
10970 	unsigned long rflags;
10971 
10972 	rflags = static_call(kvm_x86_get_rflags)(vcpu);
10973 	if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
10974 		rflags &= ~X86_EFLAGS_TF;
10975 	return rflags;
10976 }
10977 EXPORT_SYMBOL_GPL(kvm_get_rflags);
10978 
10979 static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
10980 {
10981 	if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP &&
10982 	    kvm_is_linear_rip(vcpu, vcpu->arch.singlestep_rip))
10983 		rflags |= X86_EFLAGS_TF;
10984 	static_call(kvm_x86_set_rflags)(vcpu, rflags);
10985 }
10986 
10987 void kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
10988 {
10989 	__kvm_set_rflags(vcpu, rflags);
10990 	kvm_make_request(KVM_REQ_EVENT, vcpu);
10991 }
10992 EXPORT_SYMBOL_GPL(kvm_set_rflags);
10993 
10994 void kvm_arch_async_page_ready(struct kvm_vcpu *vcpu, struct kvm_async_pf *work)
10995 {
10996 	int r;
10997 
10998 	if ((vcpu->arch.mmu->direct_map != work->arch.direct_map) ||
10999 	      work->wakeup_all)
11000 		return;
11001 
11002 	r = kvm_mmu_reload(vcpu);
11003 	if (unlikely(r))
11004 		return;
11005 
11006 	if (!vcpu->arch.mmu->direct_map &&
11007 	      work->arch.cr3 != vcpu->arch.mmu->get_guest_pgd(vcpu))
11008 		return;
11009 
11010 	kvm_mmu_do_page_fault(vcpu, work->cr2_or_gpa, 0, true);
11011 }
11012 
11013 static inline u32 kvm_async_pf_hash_fn(gfn_t gfn)
11014 {
11015 	BUILD_BUG_ON(!is_power_of_2(ASYNC_PF_PER_VCPU));
11016 
11017 	return hash_32(gfn & 0xffffffff, order_base_2(ASYNC_PF_PER_VCPU));
11018 }
11019 
11020 static inline u32 kvm_async_pf_next_probe(u32 key)
11021 {
11022 	return (key + 1) & (ASYNC_PF_PER_VCPU - 1);
11023 }
11024 
11025 static void kvm_add_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn)
11026 {
11027 	u32 key = kvm_async_pf_hash_fn(gfn);
11028 
11029 	while (vcpu->arch.apf.gfns[key] != ~0)
11030 		key = kvm_async_pf_next_probe(key);
11031 
11032 	vcpu->arch.apf.gfns[key] = gfn;
11033 }
11034 
11035 static u32 kvm_async_pf_gfn_slot(struct kvm_vcpu *vcpu, gfn_t gfn)
11036 {
11037 	int i;
11038 	u32 key = kvm_async_pf_hash_fn(gfn);
11039 
11040 	for (i = 0; i < ASYNC_PF_PER_VCPU &&
11041 		     (vcpu->arch.apf.gfns[key] != gfn &&
11042 		      vcpu->arch.apf.gfns[key] != ~0); i++)
11043 		key = kvm_async_pf_next_probe(key);
11044 
11045 	return key;
11046 }
11047 
11048 bool kvm_find_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn)
11049 {
11050 	return vcpu->arch.apf.gfns[kvm_async_pf_gfn_slot(vcpu, gfn)] == gfn;
11051 }
11052 
11053 static void kvm_del_async_pf_gfn(struct kvm_vcpu *vcpu, gfn_t gfn)
11054 {
11055 	u32 i, j, k;
11056 
11057 	i = j = kvm_async_pf_gfn_slot(vcpu, gfn);
11058 
11059 	if (WARN_ON_ONCE(vcpu->arch.apf.gfns[i] != gfn))
11060 		return;
11061 
11062 	while (true) {
11063 		vcpu->arch.apf.gfns[i] = ~0;
11064 		do {
11065 			j = kvm_async_pf_next_probe(j);
11066 			if (vcpu->arch.apf.gfns[j] == ~0)
11067 				return;
11068 			k = kvm_async_pf_hash_fn(vcpu->arch.apf.gfns[j]);
11069 			/*
11070 			 * k lies cyclically in ]i,j]
11071 			 * |    i.k.j |
11072 			 * |....j i.k.| or  |.k..j i...|
11073 			 */
11074 		} while ((i <= j) ? (i < k && k <= j) : (i < k || k <= j));
11075 		vcpu->arch.apf.gfns[i] = vcpu->arch.apf.gfns[j];
11076 		i = j;
11077 	}
11078 }
11079 
11080 static inline int apf_put_user_notpresent(struct kvm_vcpu *vcpu)
11081 {
11082 	u32 reason = KVM_PV_REASON_PAGE_NOT_PRESENT;
11083 
11084 	return kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.apf.data, &reason,
11085 				      sizeof(reason));
11086 }
11087 
11088 static inline int apf_put_user_ready(struct kvm_vcpu *vcpu, u32 token)
11089 {
11090 	unsigned int offset = offsetof(struct kvm_vcpu_pv_apf_data, token);
11091 
11092 	return kvm_write_guest_offset_cached(vcpu->kvm, &vcpu->arch.apf.data,
11093 					     &token, offset, sizeof(token));
11094 }
11095 
11096 static inline bool apf_pageready_slot_free(struct kvm_vcpu *vcpu)
11097 {
11098 	unsigned int offset = offsetof(struct kvm_vcpu_pv_apf_data, token);
11099 	u32 val;
11100 
11101 	if (kvm_read_guest_offset_cached(vcpu->kvm, &vcpu->arch.apf.data,
11102 					 &val, offset, sizeof(val)))
11103 		return false;
11104 
11105 	return !val;
11106 }
11107 
11108 static bool kvm_can_deliver_async_pf(struct kvm_vcpu *vcpu)
11109 {
11110 	if (!vcpu->arch.apf.delivery_as_pf_vmexit && is_guest_mode(vcpu))
11111 		return false;
11112 
11113 	if (!kvm_pv_async_pf_enabled(vcpu) ||
11114 	    (vcpu->arch.apf.send_user_only && static_call(kvm_x86_get_cpl)(vcpu) == 0))
11115 		return false;
11116 
11117 	return true;
11118 }
11119 
11120 bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
11121 {
11122 	if (unlikely(!lapic_in_kernel(vcpu) ||
11123 		     kvm_event_needs_reinjection(vcpu) ||
11124 		     vcpu->arch.exception.pending))
11125 		return false;
11126 
11127 	if (kvm_hlt_in_guest(vcpu->kvm) && !kvm_can_deliver_async_pf(vcpu))
11128 		return false;
11129 
11130 	/*
11131 	 * If interrupts are off we cannot even use an artificial
11132 	 * halt state.
11133 	 */
11134 	return kvm_arch_interrupt_allowed(vcpu);
11135 }
11136 
11137 bool kvm_arch_async_page_not_present(struct kvm_vcpu *vcpu,
11138 				     struct kvm_async_pf *work)
11139 {
11140 	struct x86_exception fault;
11141 
11142 	trace_kvm_async_pf_not_present(work->arch.token, work->cr2_or_gpa);
11143 	kvm_add_async_pf_gfn(vcpu, work->arch.gfn);
11144 
11145 	if (kvm_can_deliver_async_pf(vcpu) &&
11146 	    !apf_put_user_notpresent(vcpu)) {
11147 		fault.vector = PF_VECTOR;
11148 		fault.error_code_valid = true;
11149 		fault.error_code = 0;
11150 		fault.nested_page_fault = false;
11151 		fault.address = work->arch.token;
11152 		fault.async_page_fault = true;
11153 		kvm_inject_page_fault(vcpu, &fault);
11154 		return true;
11155 	} else {
11156 		/*
11157 		 * It is not possible to deliver a paravirtualized asynchronous
11158 		 * page fault, but putting the guest in an artificial halt state
11159 		 * can be beneficial nevertheless: if an interrupt arrives, we
11160 		 * can deliver it timely and perhaps the guest will schedule
11161 		 * another process.  When the instruction that triggered a page
11162 		 * fault is retried, hopefully the page will be ready in the host.
11163 		 */
11164 		kvm_make_request(KVM_REQ_APF_HALT, vcpu);
11165 		return false;
11166 	}
11167 }
11168 
11169 void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
11170 				 struct kvm_async_pf *work)
11171 {
11172 	struct kvm_lapic_irq irq = {
11173 		.delivery_mode = APIC_DM_FIXED,
11174 		.vector = vcpu->arch.apf.vec
11175 	};
11176 
11177 	if (work->wakeup_all)
11178 		work->arch.token = ~0; /* broadcast wakeup */
11179 	else
11180 		kvm_del_async_pf_gfn(vcpu, work->arch.gfn);
11181 	trace_kvm_async_pf_ready(work->arch.token, work->cr2_or_gpa);
11182 
11183 	if ((work->wakeup_all || work->notpresent_injected) &&
11184 	    kvm_pv_async_pf_enabled(vcpu) &&
11185 	    !apf_put_user_ready(vcpu, work->arch.token)) {
11186 		vcpu->arch.apf.pageready_pending = true;
11187 		kvm_apic_set_irq(vcpu, &irq, NULL);
11188 	}
11189 
11190 	vcpu->arch.apf.halted = false;
11191 	vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
11192 }
11193 
11194 void kvm_arch_async_page_present_queued(struct kvm_vcpu *vcpu)
11195 {
11196 	kvm_make_request(KVM_REQ_APF_READY, vcpu);
11197 	if (!vcpu->arch.apf.pageready_pending)
11198 		kvm_vcpu_kick(vcpu);
11199 }
11200 
11201 bool kvm_arch_can_dequeue_async_page_present(struct kvm_vcpu *vcpu)
11202 {
11203 	if (!kvm_pv_async_pf_enabled(vcpu))
11204 		return true;
11205 	else
11206 		return apf_pageready_slot_free(vcpu);
11207 }
11208 
11209 void kvm_arch_start_assignment(struct kvm *kvm)
11210 {
11211 	atomic_inc(&kvm->arch.assigned_device_count);
11212 }
11213 EXPORT_SYMBOL_GPL(kvm_arch_start_assignment);
11214 
11215 void kvm_arch_end_assignment(struct kvm *kvm)
11216 {
11217 	atomic_dec(&kvm->arch.assigned_device_count);
11218 }
11219 EXPORT_SYMBOL_GPL(kvm_arch_end_assignment);
11220 
11221 bool kvm_arch_has_assigned_device(struct kvm *kvm)
11222 {
11223 	return atomic_read(&kvm->arch.assigned_device_count);
11224 }
11225 EXPORT_SYMBOL_GPL(kvm_arch_has_assigned_device);
11226 
11227 void kvm_arch_register_noncoherent_dma(struct kvm *kvm)
11228 {
11229 	atomic_inc(&kvm->arch.noncoherent_dma_count);
11230 }
11231 EXPORT_SYMBOL_GPL(kvm_arch_register_noncoherent_dma);
11232 
11233 void kvm_arch_unregister_noncoherent_dma(struct kvm *kvm)
11234 {
11235 	atomic_dec(&kvm->arch.noncoherent_dma_count);
11236 }
11237 EXPORT_SYMBOL_GPL(kvm_arch_unregister_noncoherent_dma);
11238 
11239 bool kvm_arch_has_noncoherent_dma(struct kvm *kvm)
11240 {
11241 	return atomic_read(&kvm->arch.noncoherent_dma_count);
11242 }
11243 EXPORT_SYMBOL_GPL(kvm_arch_has_noncoherent_dma);
11244 
11245 bool kvm_arch_has_irq_bypass(void)
11246 {
11247 	return true;
11248 }
11249 
11250 int kvm_arch_irq_bypass_add_producer(struct irq_bypass_consumer *cons,
11251 				      struct irq_bypass_producer *prod)
11252 {
11253 	struct kvm_kernel_irqfd *irqfd =
11254 		container_of(cons, struct kvm_kernel_irqfd, consumer);
11255 	int ret;
11256 
11257 	irqfd->producer = prod;
11258 	kvm_arch_start_assignment(irqfd->kvm);
11259 	ret = static_call(kvm_x86_update_pi_irte)(irqfd->kvm,
11260 					 prod->irq, irqfd->gsi, 1);
11261 
11262 	if (ret)
11263 		kvm_arch_end_assignment(irqfd->kvm);
11264 
11265 	return ret;
11266 }
11267 
11268 void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
11269 				      struct irq_bypass_producer *prod)
11270 {
11271 	int ret;
11272 	struct kvm_kernel_irqfd *irqfd =
11273 		container_of(cons, struct kvm_kernel_irqfd, consumer);
11274 
11275 	WARN_ON(irqfd->producer != prod);
11276 	irqfd->producer = NULL;
11277 
11278 	/*
11279 	 * When producer of consumer is unregistered, we change back to
11280 	 * remapped mode, so we can re-use the current implementation
11281 	 * when the irq is masked/disabled or the consumer side (KVM
11282 	 * int this case doesn't want to receive the interrupts.
11283 	*/
11284 	ret = static_call(kvm_x86_update_pi_irte)(irqfd->kvm, prod->irq, irqfd->gsi, 0);
11285 	if (ret)
11286 		printk(KERN_INFO "irq bypass consumer (token %p) unregistration"
11287 		       " fails: %d\n", irqfd->consumer.token, ret);
11288 
11289 	kvm_arch_end_assignment(irqfd->kvm);
11290 }
11291 
11292 int kvm_arch_update_irqfd_routing(struct kvm *kvm, unsigned int host_irq,
11293 				   uint32_t guest_irq, bool set)
11294 {
11295 	return static_call(kvm_x86_update_pi_irte)(kvm, host_irq, guest_irq, set);
11296 }
11297 
11298 bool kvm_vector_hashing_enabled(void)
11299 {
11300 	return vector_hashing;
11301 }
11302 
11303 bool kvm_arch_no_poll(struct kvm_vcpu *vcpu)
11304 {
11305 	return (vcpu->arch.msr_kvm_poll_control & 1) == 0;
11306 }
11307 EXPORT_SYMBOL_GPL(kvm_arch_no_poll);
11308 
11309 
11310 int kvm_spec_ctrl_test_value(u64 value)
11311 {
11312 	/*
11313 	 * test that setting IA32_SPEC_CTRL to given value
11314 	 * is allowed by the host processor
11315 	 */
11316 
11317 	u64 saved_value;
11318 	unsigned long flags;
11319 	int ret = 0;
11320 
11321 	local_irq_save(flags);
11322 
11323 	if (rdmsrl_safe(MSR_IA32_SPEC_CTRL, &saved_value))
11324 		ret = 1;
11325 	else if (wrmsrl_safe(MSR_IA32_SPEC_CTRL, value))
11326 		ret = 1;
11327 	else
11328 		wrmsrl(MSR_IA32_SPEC_CTRL, saved_value);
11329 
11330 	local_irq_restore(flags);
11331 
11332 	return ret;
11333 }
11334 EXPORT_SYMBOL_GPL(kvm_spec_ctrl_test_value);
11335 
11336 void kvm_fixup_and_inject_pf_error(struct kvm_vcpu *vcpu, gva_t gva, u16 error_code)
11337 {
11338 	struct x86_exception fault;
11339 	u32 access = error_code &
11340 		(PFERR_WRITE_MASK | PFERR_FETCH_MASK | PFERR_USER_MASK);
11341 
11342 	if (!(error_code & PFERR_PRESENT_MASK) ||
11343 	    vcpu->arch.walk_mmu->gva_to_gpa(vcpu, gva, access, &fault) != UNMAPPED_GVA) {
11344 		/*
11345 		 * If vcpu->arch.walk_mmu->gva_to_gpa succeeded, the page
11346 		 * tables probably do not match the TLB.  Just proceed
11347 		 * with the error code that the processor gave.
11348 		 */
11349 		fault.vector = PF_VECTOR;
11350 		fault.error_code_valid = true;
11351 		fault.error_code = error_code;
11352 		fault.nested_page_fault = false;
11353 		fault.address = gva;
11354 	}
11355 	vcpu->arch.walk_mmu->inject_page_fault(vcpu, &fault);
11356 }
11357 EXPORT_SYMBOL_GPL(kvm_fixup_and_inject_pf_error);
11358 
11359 /*
11360  * Handles kvm_read/write_guest_virt*() result and either injects #PF or returns
11361  * KVM_EXIT_INTERNAL_ERROR for cases not currently handled by KVM. Return value
11362  * indicates whether exit to userspace is needed.
11363  */
11364 int kvm_handle_memory_failure(struct kvm_vcpu *vcpu, int r,
11365 			      struct x86_exception *e)
11366 {
11367 	if (r == X86EMUL_PROPAGATE_FAULT) {
11368 		kvm_inject_emulated_page_fault(vcpu, e);
11369 		return 1;
11370 	}
11371 
11372 	/*
11373 	 * In case kvm_read/write_guest_virt*() failed with X86EMUL_IO_NEEDED
11374 	 * while handling a VMX instruction KVM could've handled the request
11375 	 * correctly by exiting to userspace and performing I/O but there
11376 	 * doesn't seem to be a real use-case behind such requests, just return
11377 	 * KVM_EXIT_INTERNAL_ERROR for now.
11378 	 */
11379 	vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
11380 	vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
11381 	vcpu->run->internal.ndata = 0;
11382 
11383 	return 0;
11384 }
11385 EXPORT_SYMBOL_GPL(kvm_handle_memory_failure);
11386 
11387 int kvm_handle_invpcid(struct kvm_vcpu *vcpu, unsigned long type, gva_t gva)
11388 {
11389 	bool pcid_enabled;
11390 	struct x86_exception e;
11391 	unsigned i;
11392 	unsigned long roots_to_free = 0;
11393 	struct {
11394 		u64 pcid;
11395 		u64 gla;
11396 	} operand;
11397 	int r;
11398 
11399 	r = kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e);
11400 	if (r != X86EMUL_CONTINUE)
11401 		return kvm_handle_memory_failure(vcpu, r, &e);
11402 
11403 	if (operand.pcid >> 12 != 0) {
11404 		kvm_inject_gp(vcpu, 0);
11405 		return 1;
11406 	}
11407 
11408 	pcid_enabled = kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE);
11409 
11410 	switch (type) {
11411 	case INVPCID_TYPE_INDIV_ADDR:
11412 		if ((!pcid_enabled && (operand.pcid != 0)) ||
11413 		    is_noncanonical_address(operand.gla, vcpu)) {
11414 			kvm_inject_gp(vcpu, 0);
11415 			return 1;
11416 		}
11417 		kvm_mmu_invpcid_gva(vcpu, operand.gla, operand.pcid);
11418 		return kvm_skip_emulated_instruction(vcpu);
11419 
11420 	case INVPCID_TYPE_SINGLE_CTXT:
11421 		if (!pcid_enabled && (operand.pcid != 0)) {
11422 			kvm_inject_gp(vcpu, 0);
11423 			return 1;
11424 		}
11425 
11426 		if (kvm_get_active_pcid(vcpu) == operand.pcid) {
11427 			kvm_mmu_sync_roots(vcpu);
11428 			kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
11429 		}
11430 
11431 		for (i = 0; i < KVM_MMU_NUM_PREV_ROOTS; i++)
11432 			if (kvm_get_pcid(vcpu, vcpu->arch.mmu->prev_roots[i].pgd)
11433 			    == operand.pcid)
11434 				roots_to_free |= KVM_MMU_ROOT_PREVIOUS(i);
11435 
11436 		kvm_mmu_free_roots(vcpu, vcpu->arch.mmu, roots_to_free);
11437 		/*
11438 		 * If neither the current cr3 nor any of the prev_roots use the
11439 		 * given PCID, then nothing needs to be done here because a
11440 		 * resync will happen anyway before switching to any other CR3.
11441 		 */
11442 
11443 		return kvm_skip_emulated_instruction(vcpu);
11444 
11445 	case INVPCID_TYPE_ALL_NON_GLOBAL:
11446 		/*
11447 		 * Currently, KVM doesn't mark global entries in the shadow
11448 		 * page tables, so a non-global flush just degenerates to a
11449 		 * global flush. If needed, we could optimize this later by
11450 		 * keeping track of global entries in shadow page tables.
11451 		 */
11452 
11453 		fallthrough;
11454 	case INVPCID_TYPE_ALL_INCL_GLOBAL:
11455 		kvm_mmu_unload(vcpu);
11456 		return kvm_skip_emulated_instruction(vcpu);
11457 
11458 	default:
11459 		BUG(); /* We have already checked above that type <= 3 */
11460 	}
11461 }
11462 EXPORT_SYMBOL_GPL(kvm_handle_invpcid);
11463 
11464 static int complete_sev_es_emulated_mmio(struct kvm_vcpu *vcpu)
11465 {
11466 	struct kvm_run *run = vcpu->run;
11467 	struct kvm_mmio_fragment *frag;
11468 	unsigned int len;
11469 
11470 	BUG_ON(!vcpu->mmio_needed);
11471 
11472 	/* Complete previous fragment */
11473 	frag = &vcpu->mmio_fragments[vcpu->mmio_cur_fragment];
11474 	len = min(8u, frag->len);
11475 	if (!vcpu->mmio_is_write)
11476 		memcpy(frag->data, run->mmio.data, len);
11477 
11478 	if (frag->len <= 8) {
11479 		/* Switch to the next fragment. */
11480 		frag++;
11481 		vcpu->mmio_cur_fragment++;
11482 	} else {
11483 		/* Go forward to the next mmio piece. */
11484 		frag->data += len;
11485 		frag->gpa += len;
11486 		frag->len -= len;
11487 	}
11488 
11489 	if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) {
11490 		vcpu->mmio_needed = 0;
11491 
11492 		// VMG change, at this point, we're always done
11493 		// RIP has already been advanced
11494 		return 1;
11495 	}
11496 
11497 	// More MMIO is needed
11498 	run->mmio.phys_addr = frag->gpa;
11499 	run->mmio.len = min(8u, frag->len);
11500 	run->mmio.is_write = vcpu->mmio_is_write;
11501 	if (run->mmio.is_write)
11502 		memcpy(run->mmio.data, frag->data, min(8u, frag->len));
11503 	run->exit_reason = KVM_EXIT_MMIO;
11504 
11505 	vcpu->arch.complete_userspace_io = complete_sev_es_emulated_mmio;
11506 
11507 	return 0;
11508 }
11509 
11510 int kvm_sev_es_mmio_write(struct kvm_vcpu *vcpu, gpa_t gpa, unsigned int bytes,
11511 			  void *data)
11512 {
11513 	int handled;
11514 	struct kvm_mmio_fragment *frag;
11515 
11516 	if (!data)
11517 		return -EINVAL;
11518 
11519 	handled = write_emultor.read_write_mmio(vcpu, gpa, bytes, data);
11520 	if (handled == bytes)
11521 		return 1;
11522 
11523 	bytes -= handled;
11524 	gpa += handled;
11525 	data += handled;
11526 
11527 	/*TODO: Check if need to increment number of frags */
11528 	frag = vcpu->mmio_fragments;
11529 	vcpu->mmio_nr_fragments = 1;
11530 	frag->len = bytes;
11531 	frag->gpa = gpa;
11532 	frag->data = data;
11533 
11534 	vcpu->mmio_needed = 1;
11535 	vcpu->mmio_cur_fragment = 0;
11536 
11537 	vcpu->run->mmio.phys_addr = gpa;
11538 	vcpu->run->mmio.len = min(8u, frag->len);
11539 	vcpu->run->mmio.is_write = 1;
11540 	memcpy(vcpu->run->mmio.data, frag->data, min(8u, frag->len));
11541 	vcpu->run->exit_reason = KVM_EXIT_MMIO;
11542 
11543 	vcpu->arch.complete_userspace_io = complete_sev_es_emulated_mmio;
11544 
11545 	return 0;
11546 }
11547 EXPORT_SYMBOL_GPL(kvm_sev_es_mmio_write);
11548 
11549 int kvm_sev_es_mmio_read(struct kvm_vcpu *vcpu, gpa_t gpa, unsigned int bytes,
11550 			 void *data)
11551 {
11552 	int handled;
11553 	struct kvm_mmio_fragment *frag;
11554 
11555 	if (!data)
11556 		return -EINVAL;
11557 
11558 	handled = read_emultor.read_write_mmio(vcpu, gpa, bytes, data);
11559 	if (handled == bytes)
11560 		return 1;
11561 
11562 	bytes -= handled;
11563 	gpa += handled;
11564 	data += handled;
11565 
11566 	/*TODO: Check if need to increment number of frags */
11567 	frag = vcpu->mmio_fragments;
11568 	vcpu->mmio_nr_fragments = 1;
11569 	frag->len = bytes;
11570 	frag->gpa = gpa;
11571 	frag->data = data;
11572 
11573 	vcpu->mmio_needed = 1;
11574 	vcpu->mmio_cur_fragment = 0;
11575 
11576 	vcpu->run->mmio.phys_addr = gpa;
11577 	vcpu->run->mmio.len = min(8u, frag->len);
11578 	vcpu->run->mmio.is_write = 0;
11579 	vcpu->run->exit_reason = KVM_EXIT_MMIO;
11580 
11581 	vcpu->arch.complete_userspace_io = complete_sev_es_emulated_mmio;
11582 
11583 	return 0;
11584 }
11585 EXPORT_SYMBOL_GPL(kvm_sev_es_mmio_read);
11586 
11587 static int complete_sev_es_emulated_ins(struct kvm_vcpu *vcpu)
11588 {
11589 	memcpy(vcpu->arch.guest_ins_data, vcpu->arch.pio_data,
11590 	       vcpu->arch.pio.count * vcpu->arch.pio.size);
11591 	vcpu->arch.pio.count = 0;
11592 
11593 	return 1;
11594 }
11595 
11596 static int kvm_sev_es_outs(struct kvm_vcpu *vcpu, unsigned int size,
11597 			   unsigned int port, void *data,  unsigned int count)
11598 {
11599 	int ret;
11600 
11601 	ret = emulator_pio_out_emulated(vcpu->arch.emulate_ctxt, size, port,
11602 					data, count);
11603 	if (ret)
11604 		return ret;
11605 
11606 	vcpu->arch.pio.count = 0;
11607 
11608 	return 0;
11609 }
11610 
11611 static int kvm_sev_es_ins(struct kvm_vcpu *vcpu, unsigned int size,
11612 			  unsigned int port, void *data, unsigned int count)
11613 {
11614 	int ret;
11615 
11616 	ret = emulator_pio_in_emulated(vcpu->arch.emulate_ctxt, size, port,
11617 				       data, count);
11618 	if (ret) {
11619 		vcpu->arch.pio.count = 0;
11620 	} else {
11621 		vcpu->arch.guest_ins_data = data;
11622 		vcpu->arch.complete_userspace_io = complete_sev_es_emulated_ins;
11623 	}
11624 
11625 	return 0;
11626 }
11627 
11628 int kvm_sev_es_string_io(struct kvm_vcpu *vcpu, unsigned int size,
11629 			 unsigned int port, void *data,  unsigned int count,
11630 			 int in)
11631 {
11632 	return in ? kvm_sev_es_ins(vcpu, size, port, data, count)
11633 		  : kvm_sev_es_outs(vcpu, size, port, data, count);
11634 }
11635 EXPORT_SYMBOL_GPL(kvm_sev_es_string_io);
11636 
11637 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_entry);
11638 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_exit);
11639 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_fast_mmio);
11640 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_inj_virq);
11641 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_page_fault);
11642 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_msr);
11643 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_cr);
11644 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_nested_vmrun);
11645 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_nested_vmexit);
11646 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_nested_vmexit_inject);
11647 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_nested_intr_vmexit);
11648 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_nested_vmenter_failed);
11649 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_invlpga);
11650 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_skinit);
11651 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_nested_intercepts);
11652 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_write_tsc_offset);
11653 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_ple_window_update);
11654 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_pml_full);
11655 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_pi_irte_update);
11656 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_avic_unaccelerated_access);
11657 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_avic_incomplete_ipi);
11658 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_avic_ga_log);
11659 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_apicv_update_request);
11660 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_vmgexit_enter);
11661 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_vmgexit_exit);
11662 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_vmgexit_msr_protocol_enter);
11663 EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_vmgexit_msr_protocol_exit);
11664