svm.c 138.5 KB
Newer Older
A
Avi Kivity 已提交
1 2 3 4 5 6
/*
 * Kernel-based Virtual Machine driver for Linux
 *
 * AMD SVM support
 *
 * Copyright (C) 2006 Qumranet, Inc.
N
Nicolas Kaiser 已提交
7
 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
A
Avi Kivity 已提交
8 9 10 11 12 13 14 15 16
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
17 18 19

#define pr_fmt(fmt) "SVM: " fmt

20 21
#include <linux/kvm_host.h>

22
#include "irq.h"
23
#include "mmu.h"
24
#include "kvm_cache_regs.h"
25
#include "x86.h"
26
#include "cpuid.h"
27
#include "pmu.h"
A
Avi Kivity 已提交
28

A
Avi Kivity 已提交
29
#include <linux/module.h>
30
#include <linux/mod_devicetable.h>
31
#include <linux/kernel.h>
A
Avi Kivity 已提交
32 33
#include <linux/vmalloc.h>
#include <linux/highmem.h>
A
Alexey Dobriyan 已提交
34
#include <linux/sched.h>
35
#include <linux/trace_events.h>
36
#include <linux/slab.h>
37 38
#include <linux/amd-iommu.h>
#include <linux/hashtable.h>
A
Avi Kivity 已提交
39

40
#include <asm/apic.h>
41
#include <asm/perf_event.h>
42
#include <asm/tlbflush.h>
A
Avi Kivity 已提交
43
#include <asm/desc.h>
44
#include <asm/debugreg.h>
G
Gleb Natapov 已提交
45
#include <asm/kvm_para.h>
46
#include <asm/irq_remapping.h>
A
Avi Kivity 已提交
47

48
#include <asm/virtext.h>
49
#include "trace.h"
50

51 52
#define __ex(x) __kvm_handle_fault_on_reboot(x)

A
Avi Kivity 已提交
53 54 55
MODULE_AUTHOR("Qumranet");
MODULE_LICENSE("GPL");

56 57 58 59 60 61
static const struct x86_cpu_id svm_cpu_id[] = {
	X86_FEATURE_MATCH(X86_FEATURE_SVM),
	{}
};
MODULE_DEVICE_TABLE(x86cpu, svm_cpu_id);

A
Avi Kivity 已提交
62 63 64 65 66 67
#define IOPM_ALLOC_ORDER 2
#define MSRPM_ALLOC_ORDER 1

#define SEG_TYPE_LDT 2
#define SEG_TYPE_BUSY_TSS16 3

68 69 70 71
#define SVM_FEATURE_NPT            (1 <<  0)
#define SVM_FEATURE_LBRV           (1 <<  1)
#define SVM_FEATURE_SVML           (1 <<  2)
#define SVM_FEATURE_NRIP           (1 <<  3)
72 73 74 75
#define SVM_FEATURE_TSC_RATE       (1 <<  4)
#define SVM_FEATURE_VMCB_CLEAN     (1 <<  5)
#define SVM_FEATURE_FLUSH_ASID     (1 <<  6)
#define SVM_FEATURE_DECODE_ASSIST  (1 <<  7)
76
#define SVM_FEATURE_PAUSE_FILTER   (1 << 10)
77

78 79
#define SVM_AVIC_DOORBELL	0xc001011b

80 81 82 83
#define NESTED_EXIT_HOST	0	/* Exit handled on host level */
#define NESTED_EXIT_DONE	1	/* Exit caused nested vmexit  */
#define NESTED_EXIT_CONTINUE	2	/* Further checks needed      */

84 85
#define DEBUGCTL_RESERVED_BITS (~(0x3fULL))

86
#define TSC_RATIO_RSVD          0xffffff0000000000ULL
87 88
#define TSC_RATIO_MIN		0x0000000000000001ULL
#define TSC_RATIO_MAX		0x000000ffffffffffULL
89

D
Dan Carpenter 已提交
90
#define AVIC_HPA_MASK	~((0xFFFULL << 52) | 0xFFF)
91 92 93 94 95 96 97

/*
 * 0xff is broadcast, so the max index allowed for physical APIC ID
 * table is 0xfe.  APIC IDs above 0xff are reserved.
 */
#define AVIC_MAX_PHYSICAL_ID_COUNT	255

98 99 100 101
#define AVIC_UNACCEL_ACCESS_WRITE_MASK		1
#define AVIC_UNACCEL_ACCESS_OFFSET_MASK		0xFF0
#define AVIC_UNACCEL_ACCESS_VECTOR_MASK		0xFFFFFFFF

102 103 104 105 106 107 108 109 110 111 112 113 114
/* AVIC GATAG is encoded using VM and VCPU IDs */
#define AVIC_VCPU_ID_BITS		8
#define AVIC_VCPU_ID_MASK		((1 << AVIC_VCPU_ID_BITS) - 1)

#define AVIC_VM_ID_BITS			24
#define AVIC_VM_ID_NR			(1 << AVIC_VM_ID_BITS)
#define AVIC_VM_ID_MASK			((1 << AVIC_VM_ID_BITS) - 1)

#define AVIC_GATAG(x, y)		(((x & AVIC_VM_ID_MASK) << AVIC_VCPU_ID_BITS) | \
						(y & AVIC_VCPU_ID_MASK))
#define AVIC_GATAG_TO_VMID(x)		((x >> AVIC_VCPU_ID_BITS) & AVIC_VM_ID_MASK)
#define AVIC_GATAG_TO_VCPUID(x)		(x & AVIC_VCPU_ID_MASK)

115 116
static bool erratum_383_found __read_mostly;

A
Avi Kivity 已提交
117 118 119 120 121 122
static const u32 host_save_user_msrs[] = {
#ifdef CONFIG_X86_64
	MSR_STAR, MSR_LSTAR, MSR_CSTAR, MSR_SYSCALL_MASK, MSR_KERNEL_GS_BASE,
	MSR_FS_BASE,
#endif
	MSR_IA32_SYSENTER_CS, MSR_IA32_SYSENTER_ESP, MSR_IA32_SYSENTER_EIP,
P
Paolo Bonzini 已提交
123
	MSR_TSC_AUX,
A
Avi Kivity 已提交
124 125 126 127 128 129
};

#define NR_HOST_SAVE_USER_MSRS ARRAY_SIZE(host_save_user_msrs)

struct kvm_vcpu;

130 131 132
struct nested_state {
	struct vmcb *hsave;
	u64 hsave_msr;
133
	u64 vm_cr_msr;
134 135 136 137 138 139 140
	u64 vmcb;

	/* These are the merged vectors */
	u32 *msrpm;

	/* gpa pointers to the real vectors */
	u64 vmcb_msrpm;
141
	u64 vmcb_iopm;
J
Joerg Roedel 已提交
142

143 144 145
	/* A VMEXIT is required but not yet emulated */
	bool exit_required;

J
Joerg Roedel 已提交
146
	/* cache for intercepts of the guest */
147
	u32 intercept_cr;
148
	u32 intercept_dr;
J
Joerg Roedel 已提交
149 150 151
	u32 intercept_exceptions;
	u64 intercept;

152 153
	/* Nested Paging related state */
	u64 nested_cr3;
154 155
};

156 157 158
#define MSRPM_OFFSETS	16
static u32 msrpm_offsets[MSRPM_OFFSETS] __read_mostly;

159 160 161 162 163 164
/*
 * Set osvw_len to higher value when updated Revision Guides
 * are published and we know what the new status bits are
 */
static uint64_t osvw_len = 4, osvw_status;

A
Avi Kivity 已提交
165 166 167 168 169 170 171 172
struct vcpu_svm {
	struct kvm_vcpu vcpu;
	struct vmcb *vmcb;
	unsigned long vmcb_pa;
	struct svm_cpu_data *svm_data;
	uint64_t asid_generation;
	uint64_t sysenter_esp;
	uint64_t sysenter_eip;
P
Paolo Bonzini 已提交
173
	uint64_t tsc_aux;
A
Avi Kivity 已提交
174 175 176 177

	u64 next_rip;

	u64 host_user_msrs[NR_HOST_SAVE_USER_MSRS];
178
	struct {
179 180 181
		u16 fs;
		u16 gs;
		u16 ldt;
182 183
		u64 gs_base;
	} host;
A
Avi Kivity 已提交
184 185 186

	u32 *msrpm;

187 188
	ulong nmi_iret_rip;

189
	struct nested_state nested;
J
Jan Kiszka 已提交
190 191

	bool nmi_singlestep;
192 193 194

	unsigned int3_injected;
	unsigned long int3_rip;
G
Gleb Natapov 已提交
195
	u32 apf_reason;
196

197 198
	/* cached guest cpuid flags for faster access */
	bool nrips_enabled	: 1;
199

200
	u32 ldr_reg;
201 202
	struct page *avic_backing_page;
	u64 *avic_physical_id_cache;
203
	bool avic_is_running;
204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220

	/*
	 * Per-vcpu list of struct amd_svm_iommu_ir:
	 * This is used mainly to store interrupt remapping information used
	 * when update the vcpu affinity. This avoids the need to scan for
	 * IRTE and try to match ga_tag in the IOMMU driver.
	 */
	struct list_head ir_list;
	spinlock_t ir_list_lock;
};

/*
 * This is a wrapper of struct amd_iommu_ir_data.
 */
struct amd_svm_iommu_ir {
	struct list_head node;	/* Used by SVM for per-vcpu ir_list */
	void *data;		/* Storing pointer to struct amd_ir_data */
A
Avi Kivity 已提交
221 222
};

223 224 225 226 227 228 229 230
#define AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK	(0xFF)
#define AVIC_LOGICAL_ID_ENTRY_VALID_MASK		(1 << 31)

#define AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK	(0xFFULL)
#define AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK	(0xFFFFFFFFFFULL << 12)
#define AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK		(1ULL << 62)
#define AVIC_PHYSICAL_ID_ENTRY_VALID_MASK		(1ULL << 63)

231 232 233
static DEFINE_PER_CPU(u64, current_tsc_ratio);
#define TSC_RATIO_DEFAULT	0x0100000000ULL

234 235
#define MSR_INVALID			0xffffffffU

236
static const struct svm_direct_access_msrs {
237 238 239
	u32 index;   /* Index of the MSR */
	bool always; /* True if intercept is always on */
} direct_access_msrs[] = {
B
Brian Gerst 已提交
240
	{ .index = MSR_STAR,				.always = true  },
241 242 243 244 245 246 247 248 249 250 251 252 253 254
	{ .index = MSR_IA32_SYSENTER_CS,		.always = true  },
#ifdef CONFIG_X86_64
	{ .index = MSR_GS_BASE,				.always = true  },
	{ .index = MSR_FS_BASE,				.always = true  },
	{ .index = MSR_KERNEL_GS_BASE,			.always = true  },
	{ .index = MSR_LSTAR,				.always = true  },
	{ .index = MSR_CSTAR,				.always = true  },
	{ .index = MSR_SYSCALL_MASK,			.always = true  },
#endif
	{ .index = MSR_IA32_LASTBRANCHFROMIP,		.always = false },
	{ .index = MSR_IA32_LASTBRANCHTOIP,		.always = false },
	{ .index = MSR_IA32_LASTINTFROMIP,		.always = false },
	{ .index = MSR_IA32_LASTINTTOIP,		.always = false },
	{ .index = MSR_INVALID,				.always = false },
A
Avi Kivity 已提交
255 256
};

257 258 259 260
/* enable NPT for AMD64 and X86 with PAE */
#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
static bool npt_enabled = true;
#else
J
Joerg Roedel 已提交
261
static bool npt_enabled;
262
#endif
263

264 265
/* allow nested paging (virtualized MMU) for all guests */
static int npt = true;
266
module_param(npt, int, S_IRUGO);
267

268 269
/* allow nested virtualization in KVM/SVM */
static int nested = true;
270 271
module_param(nested, int, S_IRUGO);

272 273
/* enable / disable AVIC */
static int avic;
274
#ifdef CONFIG_X86_LOCAL_APIC
275
module_param(avic, int, S_IRUGO);
276
#endif
277

278 279 280 281
/* AVIC VM ID bit masks and lock */
static DECLARE_BITMAP(avic_vm_id_bitmap, AVIC_VM_ID_NR);
static DEFINE_SPINLOCK(avic_vm_id_lock);

282
static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
283
static void svm_flush_tlb(struct kvm_vcpu *vcpu);
284
static void svm_complete_interrupts(struct vcpu_svm *svm);
285

286
static int nested_svm_exit_handled(struct vcpu_svm *svm);
287
static int nested_svm_intercept(struct vcpu_svm *svm);
288 289 290 291
static int nested_svm_vmexit(struct vcpu_svm *svm);
static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
				      bool has_error_code, u32 error_code);

292
enum {
293 294
	VMCB_INTERCEPTS, /* Intercept vectors, TSC offset,
			    pause filter count */
295
	VMCB_PERM_MAP,   /* IOPM Base and MSRPM Base */
296
	VMCB_ASID,	 /* ASID */
297
	VMCB_INTR,	 /* int_ctl, int_vector */
298
	VMCB_NPT,        /* npt_en, nCR3, gPAT */
299
	VMCB_CR,	 /* CR0, CR3, CR4, EFER */
300
	VMCB_DR,         /* DR6, DR7 */
301
	VMCB_DT,         /* GDT, IDT */
302
	VMCB_SEG,        /* CS, DS, SS, ES, CPL */
303
	VMCB_CR2,        /* CR2 only */
304
	VMCB_LBR,        /* DBGCTL, BR_FROM, BR_TO, LAST_EX_FROM, LAST_EX_TO */
305 306 307 308
	VMCB_AVIC,       /* AVIC APIC_BAR, AVIC APIC_BACKING_PAGE,
			  * AVIC PHYSICAL_TABLE pointer,
			  * AVIC LOGICAL_TABLE pointer
			  */
309 310 311
	VMCB_DIRTY_MAX,
};

312 313
/* TPR and CR2 are always written before VMRUN */
#define VMCB_ALWAYS_DIRTY_MASK	((1U << VMCB_INTR) | (1U << VMCB_CR2))
314

315 316
#define VMCB_AVIC_APIC_BAR_MASK		0xFFFFFFFFFF000ULL

317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332
static inline void mark_all_dirty(struct vmcb *vmcb)
{
	vmcb->control.clean = 0;
}

static inline void mark_all_clean(struct vmcb *vmcb)
{
	vmcb->control.clean = ((1 << VMCB_DIRTY_MAX) - 1)
			       & ~VMCB_ALWAYS_DIRTY_MASK;
}

static inline void mark_dirty(struct vmcb *vmcb, int bit)
{
	vmcb->control.clean &= ~(1 << bit);
}

333 334
static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
{
R
Rusty Russell 已提交
335
	return container_of(vcpu, struct vcpu_svm, vcpu);
336 337
}

338 339 340 341 342 343
static inline void avic_update_vapic_bar(struct vcpu_svm *svm, u64 data)
{
	svm->vmcb->control.avic_vapic_bar = data & VMCB_AVIC_APIC_BAR_MASK;
	mark_dirty(svm->vmcb, VMCB_AVIC);
}

344 345 346 347 348 349 350 351 352 353 354
static inline bool avic_vcpu_is_running(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 *entry = svm->avic_physical_id_cache;

	if (!entry)
		return false;

	return (READ_ONCE(*entry) & AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK);
}

355 356 357 358 359
static void recalc_intercepts(struct vcpu_svm *svm)
{
	struct vmcb_control_area *c, *h;
	struct nested_state *g;

360 361
	mark_dirty(svm->vmcb, VMCB_INTERCEPTS);

362 363 364 365 366 367 368
	if (!is_guest_mode(&svm->vcpu))
		return;

	c = &svm->vmcb->control;
	h = &svm->nested.hsave->control;
	g = &svm->nested;

369
	c->intercept_cr = h->intercept_cr | g->intercept_cr;
370
	c->intercept_dr = h->intercept_dr | g->intercept_dr;
371 372 373 374
	c->intercept_exceptions = h->intercept_exceptions | g->intercept_exceptions;
	c->intercept = h->intercept | g->intercept;
}

375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407
static inline struct vmcb *get_host_vmcb(struct vcpu_svm *svm)
{
	if (is_guest_mode(&svm->vcpu))
		return svm->nested.hsave;
	else
		return svm->vmcb;
}

static inline void set_cr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_cr |= (1U << bit);

	recalc_intercepts(svm);
}

static inline void clr_cr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_cr &= ~(1U << bit);

	recalc_intercepts(svm);
}

static inline bool is_cr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	return vmcb->control.intercept_cr & (1U << bit);
}

408
static inline void set_dr_intercepts(struct vcpu_svm *svm)
409 410 411
{
	struct vmcb *vmcb = get_host_vmcb(svm);

412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427
	vmcb->control.intercept_dr = (1 << INTERCEPT_DR0_READ)
		| (1 << INTERCEPT_DR1_READ)
		| (1 << INTERCEPT_DR2_READ)
		| (1 << INTERCEPT_DR3_READ)
		| (1 << INTERCEPT_DR4_READ)
		| (1 << INTERCEPT_DR5_READ)
		| (1 << INTERCEPT_DR6_READ)
		| (1 << INTERCEPT_DR7_READ)
		| (1 << INTERCEPT_DR0_WRITE)
		| (1 << INTERCEPT_DR1_WRITE)
		| (1 << INTERCEPT_DR2_WRITE)
		| (1 << INTERCEPT_DR3_WRITE)
		| (1 << INTERCEPT_DR4_WRITE)
		| (1 << INTERCEPT_DR5_WRITE)
		| (1 << INTERCEPT_DR6_WRITE)
		| (1 << INTERCEPT_DR7_WRITE);
428 429 430 431

	recalc_intercepts(svm);
}

432
static inline void clr_dr_intercepts(struct vcpu_svm *svm)
433 434 435
{
	struct vmcb *vmcb = get_host_vmcb(svm);

436
	vmcb->control.intercept_dr = 0;
437 438 439 440

	recalc_intercepts(svm);
}

441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458
static inline void set_exception_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_exceptions |= (1U << bit);

	recalc_intercepts(svm);
}

static inline void clr_exception_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_exceptions &= ~(1U << bit);

	recalc_intercepts(svm);
}

459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476
static inline void set_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept |= (1ULL << bit);

	recalc_intercepts(svm);
}

static inline void clr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept &= ~(1ULL << bit);

	recalc_intercepts(svm);
}

477 478 479 480 481 482 483 484 485 486 487 488 489 490 491
static inline void enable_gif(struct vcpu_svm *svm)
{
	svm->vcpu.arch.hflags |= HF_GIF_MASK;
}

static inline void disable_gif(struct vcpu_svm *svm)
{
	svm->vcpu.arch.hflags &= ~HF_GIF_MASK;
}

static inline bool gif_set(struct vcpu_svm *svm)
{
	return !!(svm->vcpu.arch.hflags & HF_GIF_MASK);
}

492
static unsigned long iopm_base;
A
Avi Kivity 已提交
493 494 495 496

struct kvm_ldttss_desc {
	u16 limit0;
	u16 base0;
J
Joerg Roedel 已提交
497 498
	unsigned base1:8, type:5, dpl:2, p:1;
	unsigned limit1:4, zero0:3, g:1, base2:8;
A
Avi Kivity 已提交
499 500 501 502 503 504 505
	u32 base3;
	u32 zero1;
} __attribute__((packed));

struct svm_cpu_data {
	int cpu;

A
Avi Kivity 已提交
506 507 508
	u64 asid_generation;
	u32 max_asid;
	u32 next_asid;
A
Avi Kivity 已提交
509 510 511 512 513 514 515 516 517 518 519 520
	struct kvm_ldttss_desc *tss_desc;

	struct page *save_area;
};

static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data);

struct svm_init_data {
	int cpu;
	int r;
};

521
static const u32 msrpm_ranges[] = {0, 0xc0000000, 0xc0010000};
A
Avi Kivity 已提交
522

523
#define NUM_MSR_MAPS ARRAY_SIZE(msrpm_ranges)
A
Avi Kivity 已提交
524 525 526
#define MSRS_RANGE_SIZE 2048
#define MSRS_IN_RANGE (MSRS_RANGE_SIZE * 8 / 2)

527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547
static u32 svm_msrpm_offset(u32 msr)
{
	u32 offset;
	int i;

	for (i = 0; i < NUM_MSR_MAPS; i++) {
		if (msr < msrpm_ranges[i] ||
		    msr >= msrpm_ranges[i] + MSRS_IN_RANGE)
			continue;

		offset  = (msr - msrpm_ranges[i]) / 4; /* 4 msrs per u8 */
		offset += (i * MSRS_RANGE_SIZE);       /* add range offset */

		/* Now we have the u8 offset - but need the u32 offset */
		return offset / 4;
	}

	/* MSR not in any range */
	return MSR_INVALID;
}

A
Avi Kivity 已提交
548 549 550 551
#define MAX_INST_SIZE 15

static inline void clgi(void)
{
552
	asm volatile (__ex(SVM_CLGI));
A
Avi Kivity 已提交
553 554 555 556
}

static inline void stgi(void)
{
557
	asm volatile (__ex(SVM_STGI));
A
Avi Kivity 已提交
558 559 560 561
}

static inline void invlpga(unsigned long addr, u32 asid)
{
J
Joerg Roedel 已提交
562
	asm volatile (__ex(SVM_INVLPGA) : : "a"(addr), "c"(asid));
A
Avi Kivity 已提交
563 564
}

565 566 567 568 569 570 571 572 573
static int get_npt_level(void)
{
#ifdef CONFIG_X86_64
	return PT64_ROOT_LEVEL;
#else
	return PT32E_ROOT_LEVEL;
#endif
}

A
Avi Kivity 已提交
574 575
static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
{
576
	vcpu->arch.efer = efer;
577
	if (!npt_enabled && !(efer & EFER_LMA))
578
		efer &= ~EFER_LME;
A
Avi Kivity 已提交
579

580
	to_svm(vcpu)->vmcb->save.efer = efer | EFER_SVME;
581
	mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
A
Avi Kivity 已提交
582 583 584 585 586 587 588 589
}

static int is_external_interrupt(u32 info)
{
	info &= SVM_EVTINJ_TYPE_MASK | SVM_EVTINJ_VALID;
	return info == (SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR);
}

590
static u32 svm_get_interrupt_shadow(struct kvm_vcpu *vcpu)
591 592 593 594 595
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 ret = 0;

	if (svm->vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK)
596 597
		ret = KVM_X86_SHADOW_INT_STI | KVM_X86_SHADOW_INT_MOV_SS;
	return ret;
598 599 600 601 602 603 604 605 606 607 608 609 610
}

static void svm_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (mask == 0)
		svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
	else
		svm->vmcb->control.int_state |= SVM_INTERRUPT_SHADOW_MASK;

}

A
Avi Kivity 已提交
611 612
static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
{
613 614
	struct vcpu_svm *svm = to_svm(vcpu);

615
	if (svm->vmcb->control.next_rip != 0) {
616
		WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS));
617
		svm->next_rip = svm->vmcb->control.next_rip;
618
	}
619

620
	if (!svm->next_rip) {
621
		if (emulate_instruction(vcpu, EMULTYPE_SKIP) !=
622 623
				EMULATE_DONE)
			printk(KERN_DEBUG "%s: NOP\n", __func__);
A
Avi Kivity 已提交
624 625
		return;
	}
626 627 628
	if (svm->next_rip - kvm_rip_read(vcpu) > MAX_INST_SIZE)
		printk(KERN_ERR "%s: ip 0x%lx next 0x%llx\n",
		       __func__, kvm_rip_read(vcpu), svm->next_rip);
A
Avi Kivity 已提交
629

630
	kvm_rip_write(vcpu, svm->next_rip);
631
	svm_set_interrupt_shadow(vcpu, 0);
A
Avi Kivity 已提交
632 633
}

J
Jan Kiszka 已提交
634
static void svm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
635 636
				bool has_error_code, u32 error_code,
				bool reinject)
J
Jan Kiszka 已提交
637 638 639
{
	struct vcpu_svm *svm = to_svm(vcpu);

J
Joerg Roedel 已提交
640 641 642 643
	/*
	 * If we are within a nested VM we'd better #VMEXIT and let the guest
	 * handle the exception
	 */
644 645
	if (!reinject &&
	    nested_svm_check_exception(svm, nr, has_error_code, error_code))
J
Jan Kiszka 已提交
646 647
		return;

648
	if (nr == BP_VECTOR && !static_cpu_has(X86_FEATURE_NRIPS)) {
649 650 651 652 653 654 655 656 657 658 659 660 661 662 663
		unsigned long rip, old_rip = kvm_rip_read(&svm->vcpu);

		/*
		 * For guest debugging where we have to reinject #BP if some
		 * INT3 is guest-owned:
		 * Emulate nRIP by moving RIP forward. Will fail if injection
		 * raises a fault that is not intercepted. Still better than
		 * failing in all cases.
		 */
		skip_emulated_instruction(&svm->vcpu);
		rip = kvm_rip_read(&svm->vcpu);
		svm->int3_rip = rip + svm->vmcb->save.cs.base;
		svm->int3_injected = rip - old_rip;
	}

J
Jan Kiszka 已提交
664 665 666 667 668 669 670
	svm->vmcb->control.event_inj = nr
		| SVM_EVTINJ_VALID
		| (has_error_code ? SVM_EVTINJ_VALID_ERR : 0)
		| SVM_EVTINJ_TYPE_EXEPT;
	svm->vmcb->control.event_inj_err = error_code;
}

671 672 673 674 675 676
static void svm_init_erratum_383(void)
{
	u32 low, high;
	int err;
	u64 val;

677
	if (!static_cpu_has_bug(X86_BUG_AMD_TLB_MMATCH))
678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694
		return;

	/* Use _safe variants to not break nested virtualization */
	val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
	if (err)
		return;

	val |= (1ULL << 47);

	low  = lower_32_bits(val);
	high = upper_32_bits(val);

	native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);

	erratum_383_found = true;
}

695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715
static void svm_init_osvw(struct kvm_vcpu *vcpu)
{
	/*
	 * Guests should see errata 400 and 415 as fixed (assuming that
	 * HLT and IO instructions are intercepted).
	 */
	vcpu->arch.osvw.length = (osvw_len >= 3) ? (osvw_len) : 3;
	vcpu->arch.osvw.status = osvw_status & ~(6ULL);

	/*
	 * By increasing VCPU's osvw.length to 3 we are telling the guest that
	 * all osvw.status bits inside that length, including bit 0 (which is
	 * reserved for erratum 298), are valid. However, if host processor's
	 * osvw_len is 0 then osvw_status[0] carries no information. We need to
	 * be conservative here and therefore we tell the guest that erratum 298
	 * is present (because we really don't know).
	 */
	if (osvw_len == 0 && boot_cpu_data.x86 == 0x10)
		vcpu->arch.osvw.status |= 1;
}

A
Avi Kivity 已提交
716 717
static int has_svm(void)
{
718
	const char *msg;
A
Avi Kivity 已提交
719

720
	if (!cpu_has_svm(&msg)) {
J
Joe Perches 已提交
721
		printk(KERN_INFO "has_svm: %s\n", msg);
A
Avi Kivity 已提交
722 723 724 725 726 727
		return 0;
	}

	return 1;
}

728
static void svm_hardware_disable(void)
A
Avi Kivity 已提交
729
{
730 731 732 733
	/* Make sure we clean up behind us */
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR))
		wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);

734
	cpu_svm_disable();
735 736

	amd_pmu_disable_virt();
A
Avi Kivity 已提交
737 738
}

739
static int svm_hardware_enable(void)
A
Avi Kivity 已提交
740 741
{

742
	struct svm_cpu_data *sd;
A
Avi Kivity 已提交
743
	uint64_t efer;
744
	struct desc_ptr gdt_descr;
A
Avi Kivity 已提交
745 746 747
	struct desc_struct *gdt;
	int me = raw_smp_processor_id();

748 749 750 751
	rdmsrl(MSR_EFER, efer);
	if (efer & EFER_SVME)
		return -EBUSY;

A
Avi Kivity 已提交
752
	if (!has_svm()) {
753
		pr_err("%s: err EOPNOTSUPP on %d\n", __func__, me);
754
		return -EINVAL;
A
Avi Kivity 已提交
755
	}
756 757
	sd = per_cpu(svm_data, me);
	if (!sd) {
758
		pr_err("%s: svm_data is NULL on %d\n", __func__, me);
759
		return -EINVAL;
A
Avi Kivity 已提交
760 761
	}

762 763 764
	sd->asid_generation = 1;
	sd->max_asid = cpuid_ebx(SVM_CPUID_FUNC) - 1;
	sd->next_asid = sd->max_asid + 1;
A
Avi Kivity 已提交
765

766
	native_store_gdt(&gdt_descr);
767
	gdt = (struct desc_struct *)gdt_descr.address;
768
	sd->tss_desc = (struct kvm_ldttss_desc *)(gdt + GDT_ENTRY_TSS);
A
Avi Kivity 已提交
769

770
	wrmsrl(MSR_EFER, efer | EFER_SVME);
A
Avi Kivity 已提交
771

772
	wrmsrl(MSR_VM_HSAVE_PA, page_to_pfn(sd->save_area) << PAGE_SHIFT);
773

774 775
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
776
		__this_cpu_write(current_tsc_ratio, TSC_RATIO_DEFAULT);
777 778
	}

779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808

	/*
	 * Get OSVW bits.
	 *
	 * Note that it is possible to have a system with mixed processor
	 * revisions and therefore different OSVW bits. If bits are not the same
	 * on different processors then choose the worst case (i.e. if erratum
	 * is present on one processor and not on another then assume that the
	 * erratum is present everywhere).
	 */
	if (cpu_has(&boot_cpu_data, X86_FEATURE_OSVW)) {
		uint64_t len, status = 0;
		int err;

		len = native_read_msr_safe(MSR_AMD64_OSVW_ID_LENGTH, &err);
		if (!err)
			status = native_read_msr_safe(MSR_AMD64_OSVW_STATUS,
						      &err);

		if (err)
			osvw_status = osvw_len = 0;
		else {
			if (len < osvw_len)
				osvw_len = len;
			osvw_status |= status;
			osvw_status &= (1ULL << osvw_len) - 1;
		}
	} else
		osvw_status = osvw_len = 0;

809 810
	svm_init_erratum_383();

811 812
	amd_pmu_enable_virt();

813
	return 0;
A
Avi Kivity 已提交
814 815
}

816 817
static void svm_cpu_uninit(int cpu)
{
818
	struct svm_cpu_data *sd = per_cpu(svm_data, raw_smp_processor_id());
819

820
	if (!sd)
821 822 823
		return;

	per_cpu(svm_data, raw_smp_processor_id()) = NULL;
824 825
	__free_page(sd->save_area);
	kfree(sd);
826 827
}

A
Avi Kivity 已提交
828 829
static int svm_cpu_init(int cpu)
{
830
	struct svm_cpu_data *sd;
A
Avi Kivity 已提交
831 832
	int r;

833 834
	sd = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL);
	if (!sd)
A
Avi Kivity 已提交
835
		return -ENOMEM;
836 837
	sd->cpu = cpu;
	sd->save_area = alloc_page(GFP_KERNEL);
A
Avi Kivity 已提交
838
	r = -ENOMEM;
839
	if (!sd->save_area)
A
Avi Kivity 已提交
840 841
		goto err_1;

842
	per_cpu(svm_data, cpu) = sd;
A
Avi Kivity 已提交
843 844 845 846

	return 0;

err_1:
847
	kfree(sd);
A
Avi Kivity 已提交
848 849 850 851
	return r;

}

852 853 854 855 856 857 858 859 860 861 862
static bool valid_msr_intercept(u32 index)
{
	int i;

	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++)
		if (direct_access_msrs[i].index == index)
			return true;

	return false;
}

863 864
static void set_msr_interception(u32 *msrpm, unsigned msr,
				 int read, int write)
A
Avi Kivity 已提交
865
{
866 867 868
	u8 bit_read, bit_write;
	unsigned long tmp;
	u32 offset;
A
Avi Kivity 已提交
869

870 871 872 873 874 875
	/*
	 * If this warning triggers extend the direct_access_msrs list at the
	 * beginning of the file
	 */
	WARN_ON(!valid_msr_intercept(msr));

876 877 878 879 880 881 882 883 884 885 886
	offset    = svm_msrpm_offset(msr);
	bit_read  = 2 * (msr & 0x0f);
	bit_write = 2 * (msr & 0x0f) + 1;
	tmp       = msrpm[offset];

	BUG_ON(offset == MSR_INVALID);

	read  ? clear_bit(bit_read,  &tmp) : set_bit(bit_read,  &tmp);
	write ? clear_bit(bit_write, &tmp) : set_bit(bit_write, &tmp);

	msrpm[offset] = tmp;
A
Avi Kivity 已提交
887 888
}

889
static void svm_vcpu_init_msrpm(u32 *msrpm)
A
Avi Kivity 已提交
890 891 892
{
	int i;

893 894
	memset(msrpm, 0xff, PAGE_SIZE * (1 << MSRPM_ALLOC_ORDER));

895 896 897 898 899 900
	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
		if (!direct_access_msrs[i].always)
			continue;

		set_msr_interception(msrpm, direct_access_msrs[i].index, 1, 1);
	}
901 902
}

903 904 905 906 907 908 909 910
static void add_msr_offset(u32 offset)
{
	int i;

	for (i = 0; i < MSRPM_OFFSETS; ++i) {

		/* Offset already in list? */
		if (msrpm_offsets[i] == offset)
911
			return;
912 913 914 915 916 917 918 919 920

		/* Slot used by another offset? */
		if (msrpm_offsets[i] != MSR_INVALID)
			continue;

		/* Add offset to list */
		msrpm_offsets[i] = offset;

		return;
A
Avi Kivity 已提交
921
	}
922 923 924 925 926

	/*
	 * If this BUG triggers the msrpm_offsets table has an overflow. Just
	 * increase MSRPM_OFFSETS in this case.
	 */
927
	BUG();
A
Avi Kivity 已提交
928 929
}

930
static void init_msrpm_offsets(void)
931
{
932
	int i;
933

934 935 936 937 938 939 940 941 942 943
	memset(msrpm_offsets, 0xff, sizeof(msrpm_offsets));

	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
		u32 offset;

		offset = svm_msrpm_offset(direct_access_msrs[i].index);
		BUG_ON(offset == MSR_INVALID);

		add_msr_offset(offset);
	}
944 945
}

946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967
static void svm_enable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 1;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
}

static void svm_disable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 0;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
}

968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016
/* Note:
 * This hash table is used to map VM_ID to a struct kvm_arch,
 * when handling AMD IOMMU GALOG notification to schedule in
 * a particular vCPU.
 */
#define SVM_VM_DATA_HASH_BITS	8
DECLARE_HASHTABLE(svm_vm_data_hash, SVM_VM_DATA_HASH_BITS);
static spinlock_t svm_vm_data_hash_lock;

/* Note:
 * This function is called from IOMMU driver to notify
 * SVM to schedule in a particular vCPU of a particular VM.
 */
static int avic_ga_log_notifier(u32 ga_tag)
{
	unsigned long flags;
	struct kvm_arch *ka = NULL;
	struct kvm_vcpu *vcpu = NULL;
	u32 vm_id = AVIC_GATAG_TO_VMID(ga_tag);
	u32 vcpu_id = AVIC_GATAG_TO_VCPUID(ga_tag);

	pr_debug("SVM: %s: vm_id=%#x, vcpu_id=%#x\n", __func__, vm_id, vcpu_id);

	spin_lock_irqsave(&svm_vm_data_hash_lock, flags);
	hash_for_each_possible(svm_vm_data_hash, ka, hnode, vm_id) {
		struct kvm *kvm = container_of(ka, struct kvm, arch);
		struct kvm_arch *vm_data = &kvm->arch;

		if (vm_data->avic_vm_id != vm_id)
			continue;
		vcpu = kvm_get_vcpu_by_id(kvm, vcpu_id);
		break;
	}
	spin_unlock_irqrestore(&svm_vm_data_hash_lock, flags);

	if (!vcpu)
		return 0;

	/* Note:
	 * At this point, the IOMMU should have already set the pending
	 * bit in the vAPIC backing page. So, we just need to schedule
	 * in the vcpu.
	 */
	if (vcpu->mode == OUTSIDE_GUEST_MODE)
		kvm_vcpu_wake_up(vcpu);

	return 0;
}

A
Avi Kivity 已提交
1017 1018 1019 1020
static __init int svm_hardware_setup(void)
{
	int cpu;
	struct page *iopm_pages;
1021
	void *iopm_va;
A
Avi Kivity 已提交
1022 1023 1024 1025 1026 1027
	int r;

	iopm_pages = alloc_pages(GFP_KERNEL, IOPM_ALLOC_ORDER);

	if (!iopm_pages)
		return -ENOMEM;
1028 1029 1030

	iopm_va = page_address(iopm_pages);
	memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
A
Avi Kivity 已提交
1031 1032
	iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;

1033 1034
	init_msrpm_offsets();

1035 1036 1037
	if (boot_cpu_has(X86_FEATURE_NX))
		kvm_enable_efer_bits(EFER_NX);

A
Alexander Graf 已提交
1038 1039 1040
	if (boot_cpu_has(X86_FEATURE_FXSR_OPT))
		kvm_enable_efer_bits(EFER_FFXSR);

1041 1042
	if (boot_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		kvm_has_tsc_control = true;
1043 1044
		kvm_max_tsc_scaling_ratio = TSC_RATIO_MAX;
		kvm_tsc_scaling_ratio_frac_bits = 32;
1045 1046
	}

1047 1048
	if (nested) {
		printk(KERN_INFO "kvm: Nested Virtualization enabled\n");
1049
		kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE);
1050 1051
	}

Z
Zachary Amsden 已提交
1052
	for_each_possible_cpu(cpu) {
A
Avi Kivity 已提交
1053 1054
		r = svm_cpu_init(cpu);
		if (r)
1055
			goto err;
A
Avi Kivity 已提交
1056
	}
1057

1058
	if (!boot_cpu_has(X86_FEATURE_NPT))
1059 1060
		npt_enabled = false;

1061 1062 1063 1064 1065
	if (npt_enabled && !npt) {
		printk(KERN_INFO "kvm: Nested Paging disabled\n");
		npt_enabled = false;
	}

1066
	if (npt_enabled) {
1067
		printk(KERN_INFO "kvm: Nested Paging enabled\n");
1068
		kvm_enable_tdp();
1069 1070
	} else
		kvm_disable_tdp();
1071

1072 1073 1074
	if (avic) {
		if (!npt_enabled ||
		    !boot_cpu_has(X86_FEATURE_AVIC) ||
1075
		    !IS_ENABLED(CONFIG_X86_LOCAL_APIC)) {
1076
			avic = false;
1077
		} else {
1078
			pr_info("AVIC enabled\n");
1079 1080 1081 1082 1083

			hash_init(svm_vm_data_hash);
			spin_lock_init(&svm_vm_data_hash_lock);
			amd_iommu_register_ga_log_notifier(&avic_ga_log_notifier);
		}
1084
	}
1085

A
Avi Kivity 已提交
1086 1087
	return 0;

1088
err:
A
Avi Kivity 已提交
1089 1090 1091 1092 1093 1094 1095
	__free_pages(iopm_pages, IOPM_ALLOC_ORDER);
	iopm_base = 0;
	return r;
}

static __exit void svm_hardware_unsetup(void)
{
1096 1097
	int cpu;

Z
Zachary Amsden 已提交
1098
	for_each_possible_cpu(cpu)
1099 1100
		svm_cpu_uninit(cpu);

A
Avi Kivity 已提交
1101
	__free_pages(pfn_to_page(iopm_base >> PAGE_SHIFT), IOPM_ALLOC_ORDER);
1102
	iopm_base = 0;
A
Avi Kivity 已提交
1103 1104 1105 1106 1107 1108
}

static void init_seg(struct vmcb_seg *seg)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | SVM_SELECTOR_S_MASK |
J
Joerg Roedel 已提交
1109
		      SVM_SELECTOR_WRITE_MASK; /* Read/Write Data Segment */
A
Avi Kivity 已提交
1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121
	seg->limit = 0xffff;
	seg->base = 0;
}

static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | type;
	seg->limit = 0xffff;
	seg->base = 0;
}

1122 1123 1124 1125 1126
static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 g_tsc_offset = 0;

1127
	if (is_guest_mode(vcpu)) {
1128 1129 1130
		g_tsc_offset = svm->vmcb->control.tsc_offset -
			       svm->nested.hsave->control.tsc_offset;
		svm->nested.hsave->control.tsc_offset = offset;
1131 1132 1133 1134
	} else
		trace_kvm_write_tsc_offset(vcpu->vcpu_id,
					   svm->vmcb->control.tsc_offset,
					   offset);
1135 1136

	svm->vmcb->control.tsc_offset = offset + g_tsc_offset;
1137 1138

	mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
1139 1140
}

1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156
static void avic_init_vmcb(struct vcpu_svm *svm)
{
	struct vmcb *vmcb = svm->vmcb;
	struct kvm_arch *vm_data = &svm->vcpu.kvm->arch;
	phys_addr_t bpa = page_to_phys(svm->avic_backing_page);
	phys_addr_t lpa = page_to_phys(vm_data->avic_logical_id_table_page);
	phys_addr_t ppa = page_to_phys(vm_data->avic_physical_id_table_page);

	vmcb->control.avic_backing_page = bpa & AVIC_HPA_MASK;
	vmcb->control.avic_logical_id = lpa & AVIC_HPA_MASK;
	vmcb->control.avic_physical_id = ppa & AVIC_HPA_MASK;
	vmcb->control.avic_physical_id |= AVIC_MAX_PHYSICAL_ID_COUNT;
	vmcb->control.int_ctl |= AVIC_ENABLE_MASK;
	svm->vcpu.arch.apicv_active = true;
}

P
Paolo Bonzini 已提交
1157
static void init_vmcb(struct vcpu_svm *svm)
A
Avi Kivity 已提交
1158
{
1159 1160
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;
A
Avi Kivity 已提交
1161

1162
	svm->vcpu.fpu_active = 1;
1163
	svm->vcpu.arch.hflags = 0;
1164

1165 1166 1167 1168 1169 1170
	set_cr_intercept(svm, INTERCEPT_CR0_READ);
	set_cr_intercept(svm, INTERCEPT_CR3_READ);
	set_cr_intercept(svm, INTERCEPT_CR4_READ);
	set_cr_intercept(svm, INTERCEPT_CR0_WRITE);
	set_cr_intercept(svm, INTERCEPT_CR3_WRITE);
	set_cr_intercept(svm, INTERCEPT_CR4_WRITE);
1171 1172
	if (!kvm_vcpu_apicv_active(&svm->vcpu))
		set_cr_intercept(svm, INTERCEPT_CR8_WRITE);
A
Avi Kivity 已提交
1173

1174
	set_dr_intercepts(svm);
A
Avi Kivity 已提交
1175

1176 1177 1178
	set_exception_intercept(svm, PF_VECTOR);
	set_exception_intercept(svm, UD_VECTOR);
	set_exception_intercept(svm, MC_VECTOR);
1179
	set_exception_intercept(svm, AC_VECTOR);
1180
	set_exception_intercept(svm, DB_VECTOR);
A
Avi Kivity 已提交
1181

1182 1183 1184 1185
	set_intercept(svm, INTERCEPT_INTR);
	set_intercept(svm, INTERCEPT_NMI);
	set_intercept(svm, INTERCEPT_SMI);
	set_intercept(svm, INTERCEPT_SELECTIVE_CR0);
A
Avi Kivity 已提交
1186
	set_intercept(svm, INTERCEPT_RDPMC);
1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205
	set_intercept(svm, INTERCEPT_CPUID);
	set_intercept(svm, INTERCEPT_INVD);
	set_intercept(svm, INTERCEPT_HLT);
	set_intercept(svm, INTERCEPT_INVLPG);
	set_intercept(svm, INTERCEPT_INVLPGA);
	set_intercept(svm, INTERCEPT_IOIO_PROT);
	set_intercept(svm, INTERCEPT_MSR_PROT);
	set_intercept(svm, INTERCEPT_TASK_SWITCH);
	set_intercept(svm, INTERCEPT_SHUTDOWN);
	set_intercept(svm, INTERCEPT_VMRUN);
	set_intercept(svm, INTERCEPT_VMMCALL);
	set_intercept(svm, INTERCEPT_VMLOAD);
	set_intercept(svm, INTERCEPT_VMSAVE);
	set_intercept(svm, INTERCEPT_STGI);
	set_intercept(svm, INTERCEPT_CLGI);
	set_intercept(svm, INTERCEPT_SKINIT);
	set_intercept(svm, INTERCEPT_WBINVD);
	set_intercept(svm, INTERCEPT_MONITOR);
	set_intercept(svm, INTERCEPT_MWAIT);
J
Joerg Roedel 已提交
1206
	set_intercept(svm, INTERCEPT_XSETBV);
A
Avi Kivity 已提交
1207 1208

	control->iopm_base_pa = iopm_base;
1209
	control->msrpm_base_pa = __pa(svm->msrpm);
A
Avi Kivity 已提交
1210 1211 1212 1213 1214 1215 1216 1217 1218
	control->int_ctl = V_INTR_MASKING_MASK;

	init_seg(&save->es);
	init_seg(&save->ss);
	init_seg(&save->ds);
	init_seg(&save->fs);
	init_seg(&save->gs);

	save->cs.selector = 0xf000;
1219
	save->cs.base = 0xffff0000;
A
Avi Kivity 已提交
1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230
	/* Executable/Readable Code Segment */
	save->cs.attrib = SVM_SELECTOR_READ_MASK | SVM_SELECTOR_P_MASK |
		SVM_SELECTOR_S_MASK | SVM_SELECTOR_CODE_MASK;
	save->cs.limit = 0xffff;

	save->gdtr.limit = 0xffff;
	save->idtr.limit = 0xffff;

	init_sys_seg(&save->ldtr, SEG_TYPE_LDT);
	init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16);

P
Paolo Bonzini 已提交
1231
	svm_set_efer(&svm->vcpu, 0);
M
Mike Day 已提交
1232
	save->dr6 = 0xffff0ff0;
1233
	kvm_set_rflags(&svm->vcpu, 2);
A
Avi Kivity 已提交
1234
	save->rip = 0x0000fff0;
1235
	svm->vcpu.arch.regs[VCPU_REGS_RIP] = save->rip;
A
Avi Kivity 已提交
1236

J
Joerg Roedel 已提交
1237
	/*
1238
	 * svm_set_cr0() sets PG and WP and clears NW and CD on save->cr0.
1239
	 * It also updates the guest-visible cr0 value.
A
Avi Kivity 已提交
1240
	 */
1241
	svm_set_cr0(&svm->vcpu, X86_CR0_NW | X86_CR0_CD | X86_CR0_ET);
1242
	kvm_mmu_reset_context(&svm->vcpu);
1243

1244
	save->cr4 = X86_CR4_PAE;
A
Avi Kivity 已提交
1245
	/* rdx = ?? */
1246 1247 1248 1249

	if (npt_enabled) {
		/* Setup VMCB for Nested Paging */
		control->nested_ctl = 1;
1250
		clr_intercept(svm, INTERCEPT_INVLPG);
1251
		clr_exception_intercept(svm, PF_VECTOR);
1252 1253
		clr_cr_intercept(svm, INTERCEPT_CR3_READ);
		clr_cr_intercept(svm, INTERCEPT_CR3_WRITE);
1254
		save->g_pat = svm->vcpu.arch.pat;
1255 1256 1257
		save->cr3 = 0;
		save->cr4 = 0;
	}
1258
	svm->asid_generation = 0;
1259

1260
	svm->nested.vmcb = 0;
1261 1262
	svm->vcpu.arch.hflags = 0;

1263
	if (boot_cpu_has(X86_FEATURE_PAUSEFILTER)) {
1264
		control->pause_filter_count = 3000;
1265
		set_intercept(svm, INTERCEPT_PAUSE);
1266 1267
	}

1268 1269 1270
	if (avic)
		avic_init_vmcb(svm);

1271 1272
	mark_all_dirty(svm->vmcb);

1273
	enable_gif(svm);
1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351

}

static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu, int index)
{
	u64 *avic_physical_id_table;
	struct kvm_arch *vm_data = &vcpu->kvm->arch;

	if (index >= AVIC_MAX_PHYSICAL_ID_COUNT)
		return NULL;

	avic_physical_id_table = page_address(vm_data->avic_physical_id_table_page);

	return &avic_physical_id_table[index];
}

/**
 * Note:
 * AVIC hardware walks the nested page table to check permissions,
 * but does not use the SPA address specified in the leaf page
 * table entry since it uses  address in the AVIC_BACKING_PAGE pointer
 * field of the VMCB. Therefore, we set up the
 * APIC_ACCESS_PAGE_PRIVATE_MEMSLOT (4KB) here.
 */
static int avic_init_access_page(struct kvm_vcpu *vcpu)
{
	struct kvm *kvm = vcpu->kvm;
	int ret;

	if (kvm->arch.apic_access_page_done)
		return 0;

	ret = x86_set_memory_region(kvm,
				    APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
				    APIC_DEFAULT_PHYS_BASE,
				    PAGE_SIZE);
	if (ret)
		return ret;

	kvm->arch.apic_access_page_done = true;
	return 0;
}

static int avic_init_backing_page(struct kvm_vcpu *vcpu)
{
	int ret;
	u64 *entry, new_entry;
	int id = vcpu->vcpu_id;
	struct vcpu_svm *svm = to_svm(vcpu);

	ret = avic_init_access_page(vcpu);
	if (ret)
		return ret;

	if (id >= AVIC_MAX_PHYSICAL_ID_COUNT)
		return -EINVAL;

	if (!svm->vcpu.arch.apic->regs)
		return -EINVAL;

	svm->avic_backing_page = virt_to_page(svm->vcpu.arch.apic->regs);

	/* Setting AVIC backing page address in the phy APIC ID table */
	entry = avic_get_physical_id_entry(vcpu, id);
	if (!entry)
		return -EINVAL;

	new_entry = READ_ONCE(*entry);
	new_entry = (page_to_phys(svm->avic_backing_page) &
		     AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK) |
		     AVIC_PHYSICAL_ID_ENTRY_VALID_MASK;
	WRITE_ONCE(*entry, new_entry);

	svm->avic_physical_id_cache = entry;

	return 0;
}

1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379
static inline int avic_get_next_vm_id(void)
{
	int id;

	spin_lock(&avic_vm_id_lock);

	/* AVIC VM ID is one-based. */
	id = find_next_zero_bit(avic_vm_id_bitmap, AVIC_VM_ID_NR, 1);
	if (id <= AVIC_VM_ID_MASK)
		__set_bit(id, avic_vm_id_bitmap);
	else
		id = -EAGAIN;

	spin_unlock(&avic_vm_id_lock);
	return id;
}

static inline int avic_free_vm_id(int id)
{
	if (id <= 0 || id > AVIC_VM_ID_MASK)
		return -EINVAL;

	spin_lock(&avic_vm_id_lock);
	__clear_bit(id, avic_vm_id_bitmap);
	spin_unlock(&avic_vm_id_lock);
	return 0;
}

1380 1381
static void avic_vm_destroy(struct kvm *kvm)
{
1382
	unsigned long flags;
1383 1384
	struct kvm_arch *vm_data = &kvm->arch;

1385 1386
	avic_free_vm_id(vm_data->avic_vm_id);

1387 1388 1389 1390
	if (vm_data->avic_logical_id_table_page)
		__free_page(vm_data->avic_logical_id_table_page);
	if (vm_data->avic_physical_id_table_page)
		__free_page(vm_data->avic_physical_id_table_page);
1391 1392 1393 1394

	spin_lock_irqsave(&svm_vm_data_hash_lock, flags);
	hash_del(&vm_data->hnode);
	spin_unlock_irqrestore(&svm_vm_data_hash_lock, flags);
1395 1396 1397 1398
}

static int avic_vm_init(struct kvm *kvm)
{
1399
	unsigned long flags;
1400
	int vm_id, err = -ENOMEM;
1401 1402 1403 1404 1405 1406 1407
	struct kvm_arch *vm_data = &kvm->arch;
	struct page *p_page;
	struct page *l_page;

	if (!avic)
		return 0;

1408 1409 1410 1411
	vm_id = avic_get_next_vm_id();
	if (vm_id < 0)
		return vm_id;
	vm_data->avic_vm_id = (u32)vm_id;
1412

1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428
	/* Allocating physical APIC ID table (4KB) */
	p_page = alloc_page(GFP_KERNEL);
	if (!p_page)
		goto free_avic;

	vm_data->avic_physical_id_table_page = p_page;
	clear_page(page_address(p_page));

	/* Allocating logical APIC ID table (4KB) */
	l_page = alloc_page(GFP_KERNEL);
	if (!l_page)
		goto free_avic;

	vm_data->avic_logical_id_table_page = l_page;
	clear_page(page_address(l_page));

1429 1430 1431 1432
	spin_lock_irqsave(&svm_vm_data_hash_lock, flags);
	hash_add(svm_vm_data_hash, &vm_data->hnode, vm_data->avic_vm_id);
	spin_unlock_irqrestore(&svm_vm_data_hash_lock, flags);

1433 1434 1435 1436 1437
	return 0;

free_avic:
	avic_vm_destroy(kvm);
	return err;
A
Avi Kivity 已提交
1438 1439
}

1440 1441
static inline int
avic_update_iommu_vcpu_affinity(struct kvm_vcpu *vcpu, int cpu, bool r)
1442
{
1443 1444 1445
	int ret = 0;
	unsigned long flags;
	struct amd_svm_iommu_ir *ir;
1446 1447
	struct vcpu_svm *svm = to_svm(vcpu);

1448 1449
	if (!kvm_arch_has_assigned_device(vcpu->kvm))
		return 0;
1450

1451 1452 1453 1454 1455
	/*
	 * Here, we go through the per-vcpu ir_list to update all existing
	 * interrupt remapping table entry targeting this vcpu.
	 */
	spin_lock_irqsave(&svm->ir_list_lock, flags);
1456

1457 1458
	if (list_empty(&svm->ir_list))
		goto out;
1459

1460 1461 1462 1463 1464 1465 1466 1467
	list_for_each_entry(ir, &svm->ir_list, node) {
		ret = amd_iommu_update_ga(cpu, r, ir->data);
		if (ret)
			break;
	}
out:
	spin_unlock_irqrestore(&svm->ir_list_lock, flags);
	return ret;
1468 1469 1470 1471 1472 1473
}

static void avic_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
{
	u64 entry;
	/* ID = 0xff (broadcast), ID > 0xff (reserved) */
1474
	int h_physical_id = kvm_cpu_get_apicid(cpu);
1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!kvm_vcpu_apicv_active(vcpu))
		return;

	if (WARN_ON(h_physical_id >= AVIC_MAX_PHYSICAL_ID_COUNT))
		return;

	entry = READ_ONCE(*(svm->avic_physical_id_cache));
	WARN_ON(entry & AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK);

	entry &= ~AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK;
	entry |= (h_physical_id & AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK);

	entry &= ~AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK;
	if (svm->avic_is_running)
		entry |= AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK;

	WRITE_ONCE(*(svm->avic_physical_id_cache), entry);
1494 1495
	avic_update_iommu_vcpu_affinity(vcpu, h_physical_id,
					svm->avic_is_running);
1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506
}

static void avic_vcpu_put(struct kvm_vcpu *vcpu)
{
	u64 entry;
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!kvm_vcpu_apicv_active(vcpu))
		return;

	entry = READ_ONCE(*(svm->avic_physical_id_cache));
1507 1508 1509
	if (entry & AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK)
		avic_update_iommu_vcpu_affinity(vcpu, -1, 0);

1510 1511
	entry &= ~AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK;
	WRITE_ONCE(*(svm->avic_physical_id_cache), entry);
A
Avi Kivity 已提交
1512 1513
}

1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527
/**
 * This function is called during VCPU halt/unhalt.
 */
static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->avic_is_running = is_run;
	if (is_run)
		avic_vcpu_load(vcpu, vcpu->cpu);
	else
		avic_vcpu_put(vcpu);
}

1528
static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
1529 1530
{
	struct vcpu_svm *svm = to_svm(vcpu);
1531 1532
	u32 dummy;
	u32 eax = 1;
1533

1534 1535 1536 1537 1538 1539
	if (!init_event) {
		svm->vcpu.arch.apic_base = APIC_DEFAULT_PHYS_BASE |
					   MSR_IA32_APICBASE_ENABLE;
		if (kvm_vcpu_is_reset_bsp(&svm->vcpu))
			svm->vcpu.arch.apic_base |= MSR_IA32_APICBASE_BSP;
	}
P
Paolo Bonzini 已提交
1540
	init_vmcb(svm);
A
Avi Kivity 已提交
1541

1542 1543
	kvm_cpuid(vcpu, &eax, &dummy, &dummy, &dummy);
	kvm_register_write(vcpu, VCPU_REGS_RDX, eax);
1544 1545 1546

	if (kvm_vcpu_apicv_active(vcpu) && !init_event)
		avic_update_vapic_bar(svm, APIC_DEFAULT_PHYS_BASE);
1547 1548
}

R
Rusty Russell 已提交
1549
static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
A
Avi Kivity 已提交
1550
{
1551
	struct vcpu_svm *svm;
A
Avi Kivity 已提交
1552
	struct page *page;
1553
	struct page *msrpm_pages;
A
Alexander Graf 已提交
1554
	struct page *hsave_page;
A
Alexander Graf 已提交
1555
	struct page *nested_msrpm_pages;
R
Rusty Russell 已提交
1556
	int err;
A
Avi Kivity 已提交
1557

1558
	svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
R
Rusty Russell 已提交
1559 1560 1561 1562 1563 1564 1565 1566 1567
	if (!svm) {
		err = -ENOMEM;
		goto out;
	}

	err = kvm_vcpu_init(&svm->vcpu, kvm, id);
	if (err)
		goto free_svm;

1568
	err = -ENOMEM;
A
Avi Kivity 已提交
1569
	page = alloc_page(GFP_KERNEL);
1570
	if (!page)
R
Rusty Russell 已提交
1571
		goto uninit;
A
Avi Kivity 已提交
1572

1573 1574
	msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
	if (!msrpm_pages)
1575
		goto free_page1;
A
Alexander Graf 已提交
1576 1577 1578

	nested_msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
	if (!nested_msrpm_pages)
1579
		goto free_page2;
1580

A
Alexander Graf 已提交
1581 1582
	hsave_page = alloc_page(GFP_KERNEL);
	if (!hsave_page)
1583 1584
		goto free_page3;

1585 1586 1587 1588
	if (avic) {
		err = avic_init_backing_page(&svm->vcpu);
		if (err)
			goto free_page4;
1589 1590 1591

		INIT_LIST_HEAD(&svm->ir_list);
		spin_lock_init(&svm->ir_list_lock);
1592 1593
	}

1594 1595 1596 1597 1598
	/* We initialize this flag to true to make sure that the is_running
	 * bit would be set the first time the vcpu is loaded.
	 */
	svm->avic_is_running = true;

1599
	svm->nested.hsave = page_address(hsave_page);
A
Alexander Graf 已提交
1600

1601 1602 1603
	svm->msrpm = page_address(msrpm_pages);
	svm_vcpu_init_msrpm(svm->msrpm);

1604
	svm->nested.msrpm = page_address(nested_msrpm_pages);
1605
	svm_vcpu_init_msrpm(svm->nested.msrpm);
A
Alexander Graf 已提交
1606

1607 1608 1609 1610
	svm->vmcb = page_address(page);
	clear_page(svm->vmcb);
	svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
	svm->asid_generation = 0;
P
Paolo Bonzini 已提交
1611
	init_vmcb(svm);
A
Avi Kivity 已提交
1612

1613 1614
	svm_init_osvw(&svm->vcpu);

R
Rusty Russell 已提交
1615
	return &svm->vcpu;
1616

1617 1618
free_page4:
	__free_page(hsave_page);
1619 1620 1621 1622 1623 1624
free_page3:
	__free_pages(nested_msrpm_pages, MSRPM_ALLOC_ORDER);
free_page2:
	__free_pages(msrpm_pages, MSRPM_ALLOC_ORDER);
free_page1:
	__free_page(page);
R
Rusty Russell 已提交
1625 1626 1627
uninit:
	kvm_vcpu_uninit(&svm->vcpu);
free_svm:
1628
	kmem_cache_free(kvm_vcpu_cache, svm);
R
Rusty Russell 已提交
1629 1630
out:
	return ERR_PTR(err);
A
Avi Kivity 已提交
1631 1632 1633 1634
}

static void svm_free_vcpu(struct kvm_vcpu *vcpu)
{
1635 1636
	struct vcpu_svm *svm = to_svm(vcpu);

R
Rusty Russell 已提交
1637
	__free_page(pfn_to_page(svm->vmcb_pa >> PAGE_SHIFT));
1638
	__free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
1639 1640
	__free_page(virt_to_page(svm->nested.hsave));
	__free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
R
Rusty Russell 已提交
1641
	kvm_vcpu_uninit(vcpu);
1642
	kmem_cache_free(kvm_vcpu_cache, svm);
A
Avi Kivity 已提交
1643 1644
}

1645
static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
A
Avi Kivity 已提交
1646
{
1647
	struct vcpu_svm *svm = to_svm(vcpu);
1648
	int i;
1649 1650

	if (unlikely(cpu != vcpu->cpu)) {
1651
		svm->asid_generation = 0;
1652
		mark_all_dirty(svm->vmcb);
1653
	}
1654

1655 1656 1657
#ifdef CONFIG_X86_64
	rdmsrl(MSR_GS_BASE, to_svm(vcpu)->host.gs_base);
#endif
1658 1659 1660 1661
	savesegment(fs, svm->host.fs);
	savesegment(gs, svm->host.gs);
	svm->host.ldt = kvm_read_ldt();

1662
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
1663
		rdmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
1664

1665 1666 1667 1668 1669 1670
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		u64 tsc_ratio = vcpu->arch.tsc_scaling_ratio;
		if (tsc_ratio != __this_cpu_read(current_tsc_ratio)) {
			__this_cpu_write(current_tsc_ratio, tsc_ratio);
			wrmsrl(MSR_AMD64_TSC_RATIO, tsc_ratio);
		}
1671
	}
P
Paolo Bonzini 已提交
1672 1673 1674
	/* This assumes that the kernel never uses MSR_TSC_AUX */
	if (static_cpu_has(X86_FEATURE_RDTSCP))
		wrmsrl(MSR_TSC_AUX, svm->tsc_aux);
1675 1676

	avic_vcpu_load(vcpu, cpu);
A
Avi Kivity 已提交
1677 1678 1679 1680
}

static void svm_vcpu_put(struct kvm_vcpu *vcpu)
{
1681
	struct vcpu_svm *svm = to_svm(vcpu);
1682 1683
	int i;

1684 1685
	avic_vcpu_put(vcpu);

1686
	++vcpu->stat.host_state_reload;
1687 1688 1689
	kvm_load_ldt(svm->host.ldt);
#ifdef CONFIG_X86_64
	loadsegment(fs, svm->host.fs);
1690
	wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gsbase);
1691
	load_gs_index(svm->host.gs);
1692
#else
1693
#ifdef CONFIG_X86_32_LAZY_GS
1694
	loadsegment(gs, svm->host.gs);
1695
#endif
1696
#endif
1697
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
1698
		wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
A
Avi Kivity 已提交
1699 1700
}

1701 1702 1703 1704 1705 1706 1707 1708 1709 1710
static void svm_vcpu_blocking(struct kvm_vcpu *vcpu)
{
	avic_set_running(vcpu, false);
}

static void svm_vcpu_unblocking(struct kvm_vcpu *vcpu)
{
	avic_set_running(vcpu, true);
}

A
Avi Kivity 已提交
1711 1712
static unsigned long svm_get_rflags(struct kvm_vcpu *vcpu)
{
1713
	return to_svm(vcpu)->vmcb->save.rflags;
A
Avi Kivity 已提交
1714 1715 1716 1717
}

static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
{
P
Paolo Bonzini 已提交
1718
       /*
A
Andrea Gelmini 已提交
1719
        * Any change of EFLAGS.VM is accompanied by a reload of SS
P
Paolo Bonzini 已提交
1720 1721 1722
        * (caused by either a task switch or an inter-privilege IRET),
        * so we do not need to update the CPL here.
        */
1723
	to_svm(vcpu)->vmcb->save.rflags = rflags;
A
Avi Kivity 已提交
1724 1725
}

1726 1727 1728 1729 1730
static u32 svm_get_pkru(struct kvm_vcpu *vcpu)
{
	return 0;
}

A
Avi Kivity 已提交
1731 1732 1733 1734 1735
static void svm_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
{
	switch (reg) {
	case VCPU_EXREG_PDPTR:
		BUG_ON(!npt_enabled);
1736
		load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu));
A
Avi Kivity 已提交
1737 1738 1739 1740 1741 1742
		break;
	default:
		BUG();
	}
}

1743 1744
static void svm_set_vintr(struct vcpu_svm *svm)
{
1745
	set_intercept(svm, INTERCEPT_VINTR);
1746 1747 1748 1749
}

static void svm_clear_vintr(struct vcpu_svm *svm)
{
1750
	clr_intercept(svm, INTERCEPT_VINTR);
1751 1752
}

A
Avi Kivity 已提交
1753 1754
static struct vmcb_seg *svm_seg(struct kvm_vcpu *vcpu, int seg)
{
1755
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
A
Avi Kivity 已提交
1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767

	switch (seg) {
	case VCPU_SREG_CS: return &save->cs;
	case VCPU_SREG_DS: return &save->ds;
	case VCPU_SREG_ES: return &save->es;
	case VCPU_SREG_FS: return &save->fs;
	case VCPU_SREG_GS: return &save->gs;
	case VCPU_SREG_SS: return &save->ss;
	case VCPU_SREG_TR: return &save->tr;
	case VCPU_SREG_LDTR: return &save->ldtr;
	}
	BUG();
A
Al Viro 已提交
1768
	return NULL;
A
Avi Kivity 已提交
1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792
}

static u64 svm_get_segment_base(struct kvm_vcpu *vcpu, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	return s->base;
}

static void svm_get_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	var->base = s->base;
	var->limit = s->limit;
	var->selector = s->selector;
	var->type = s->attrib & SVM_SELECTOR_TYPE_MASK;
	var->s = (s->attrib >> SVM_SELECTOR_S_SHIFT) & 1;
	var->dpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
	var->present = (s->attrib >> SVM_SELECTOR_P_SHIFT) & 1;
	var->avl = (s->attrib >> SVM_SELECTOR_AVL_SHIFT) & 1;
	var->l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
	var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
1793 1794 1795 1796 1797 1798 1799 1800 1801 1802

	/*
	 * AMD CPUs circa 2014 track the G bit for all segments except CS.
	 * However, the SVM spec states that the G bit is not observed by the
	 * CPU, and some VMware virtual CPUs drop the G bit for all segments.
	 * So let's synthesize a legal G bit for all segments, this helps
	 * running KVM nested. It also helps cross-vendor migration, because
	 * Intel's vmentry has a check on the 'G' bit.
	 */
	var->g = s->limit > 0xfffff;
1803

J
Joerg Roedel 已提交
1804 1805
	/*
	 * AMD's VMCB does not have an explicit unusable field, so emulate it
1806 1807 1808 1809
	 * for cross vendor migration purposes by "not present"
	 */
	var->unusable = !var->present || (var->type == 0);

1810 1811 1812 1813 1814 1815
	switch (seg) {
	case VCPU_SREG_TR:
		/*
		 * Work around a bug where the busy flag in the tr selector
		 * isn't exposed
		 */
1816
		var->type |= 0x2;
1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831
		break;
	case VCPU_SREG_DS:
	case VCPU_SREG_ES:
	case VCPU_SREG_FS:
	case VCPU_SREG_GS:
		/*
		 * The accessed bit must always be set in the segment
		 * descriptor cache, although it can be cleared in the
		 * descriptor, the cached bit always remains at 1. Since
		 * Intel has a check on this, set it here to support
		 * cross-vendor migration.
		 */
		if (!var->unusable)
			var->type |= 0x1;
		break;
1832
	case VCPU_SREG_SS:
J
Joerg Roedel 已提交
1833 1834
		/*
		 * On AMD CPUs sometimes the DB bit in the segment
1835 1836 1837 1838 1839 1840
		 * descriptor is left as 1, although the whole segment has
		 * been made unusable. Clear it here to pass an Intel VMX
		 * entry check when cross vendor migrating.
		 */
		if (var->unusable)
			var->db = 0;
J
Jan Kiszka 已提交
1841
		var->dpl = to_svm(vcpu)->vmcb->save.cpl;
1842
		break;
1843
	}
A
Avi Kivity 已提交
1844 1845
}

1846 1847 1848 1849 1850 1851 1852
static int svm_get_cpl(struct kvm_vcpu *vcpu)
{
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;

	return save->cpl;
}

1853
static void svm_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1854
{
1855 1856
	struct vcpu_svm *svm = to_svm(vcpu);

1857 1858
	dt->size = svm->vmcb->save.idtr.limit;
	dt->address = svm->vmcb->save.idtr.base;
A
Avi Kivity 已提交
1859 1860
}

1861
static void svm_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1862
{
1863 1864
	struct vcpu_svm *svm = to_svm(vcpu);

1865 1866
	svm->vmcb->save.idtr.limit = dt->size;
	svm->vmcb->save.idtr.base = dt->address ;
1867
	mark_dirty(svm->vmcb, VMCB_DT);
A
Avi Kivity 已提交
1868 1869
}

1870
static void svm_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1871
{
1872 1873
	struct vcpu_svm *svm = to_svm(vcpu);

1874 1875
	dt->size = svm->vmcb->save.gdtr.limit;
	dt->address = svm->vmcb->save.gdtr.base;
A
Avi Kivity 已提交
1876 1877
}

1878
static void svm_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1879
{
1880 1881
	struct vcpu_svm *svm = to_svm(vcpu);

1882 1883
	svm->vmcb->save.gdtr.limit = dt->size;
	svm->vmcb->save.gdtr.base = dt->address ;
1884
	mark_dirty(svm->vmcb, VMCB_DT);
A
Avi Kivity 已提交
1885 1886
}

1887 1888 1889 1890
static void svm_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
{
}

1891 1892 1893 1894
static void svm_decache_cr3(struct kvm_vcpu *vcpu)
{
}

1895
static void svm_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
1896 1897 1898
{
}

A
Avi Kivity 已提交
1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909
static void update_cr0_intercept(struct vcpu_svm *svm)
{
	ulong gcr0 = svm->vcpu.arch.cr0;
	u64 *hcr0 = &svm->vmcb->save.cr0;

	if (!svm->vcpu.fpu_active)
		*hcr0 |= SVM_CR0_SELECTIVE_MASK;
	else
		*hcr0 = (*hcr0 & ~SVM_CR0_SELECTIVE_MASK)
			| (gcr0 & SVM_CR0_SELECTIVE_MASK);

1910
	mark_dirty(svm->vmcb, VMCB_CR);
A
Avi Kivity 已提交
1911 1912

	if (gcr0 == *hcr0 && svm->vcpu.fpu_active) {
1913 1914
		clr_cr_intercept(svm, INTERCEPT_CR0_READ);
		clr_cr_intercept(svm, INTERCEPT_CR0_WRITE);
A
Avi Kivity 已提交
1915
	} else {
1916 1917
		set_cr_intercept(svm, INTERCEPT_CR0_READ);
		set_cr_intercept(svm, INTERCEPT_CR0_WRITE);
A
Avi Kivity 已提交
1918 1919 1920
	}
}

A
Avi Kivity 已提交
1921 1922
static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
{
1923 1924
	struct vcpu_svm *svm = to_svm(vcpu);

1925
#ifdef CONFIG_X86_64
1926
	if (vcpu->arch.efer & EFER_LME) {
1927
		if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
1928
			vcpu->arch.efer |= EFER_LMA;
1929
			svm->vmcb->save.efer |= EFER_LMA | EFER_LME;
A
Avi Kivity 已提交
1930 1931
		}

M
Mike Day 已提交
1932
		if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) {
1933
			vcpu->arch.efer &= ~EFER_LMA;
1934
			svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME);
A
Avi Kivity 已提交
1935 1936 1937
		}
	}
#endif
1938
	vcpu->arch.cr0 = cr0;
1939 1940 1941

	if (!npt_enabled)
		cr0 |= X86_CR0_PG | X86_CR0_WP;
1942 1943

	if (!vcpu->fpu_active)
J
Joerg Roedel 已提交
1944
		cr0 |= X86_CR0_TS;
1945 1946 1947 1948 1949 1950 1951
	/*
	 * re-enable caching here because the QEMU bios
	 * does not do it - this results in some delay at
	 * reboot
	 */
	if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
		cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
1952
	svm->vmcb->save.cr0 = cr0;
1953
	mark_dirty(svm->vmcb, VMCB_CR);
A
Avi Kivity 已提交
1954
	update_cr0_intercept(svm);
A
Avi Kivity 已提交
1955 1956
}

1957
static int svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
A
Avi Kivity 已提交
1958
{
1959
	unsigned long host_cr4_mce = cr4_read_shadow() & X86_CR4_MCE;
1960 1961
	unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;

1962 1963 1964
	if (cr4 & X86_CR4_VMXE)
		return 1;

1965
	if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
1966
		svm_flush_tlb(vcpu);
1967

1968 1969 1970
	vcpu->arch.cr4 = cr4;
	if (!npt_enabled)
		cr4 |= X86_CR4_PAE;
1971
	cr4 |= host_cr4_mce;
1972
	to_svm(vcpu)->vmcb->save.cr4 = cr4;
1973
	mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
1974
	return 0;
A
Avi Kivity 已提交
1975 1976 1977 1978 1979
}

static void svm_set_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
1980
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	s->base = var->base;
	s->limit = var->limit;
	s->selector = var->selector;
	if (var->unusable)
		s->attrib = 0;
	else {
		s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
		s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
		s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
		s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
		s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
		s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
		s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
		s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
	}
P
Paolo Bonzini 已提交
1998 1999 2000 2001 2002 2003 2004 2005 2006

	/*
	 * This is always accurate, except if SYSRET returned to a segment
	 * with SS.DPL != 3.  Intel does not have this quirk, and always
	 * forces SS.DPL to 3 on sysret, so we ignore that case; fixing it
	 * would entail passing the CPL to userspace and back.
	 */
	if (seg == VCPU_SREG_SS)
		svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
A
Avi Kivity 已提交
2007

2008
	mark_dirty(svm->vmcb, VMCB_SEG);
A
Avi Kivity 已提交
2009 2010
}

2011
static void update_bp_intercept(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
2012
{
J
Jan Kiszka 已提交
2013 2014
	struct vcpu_svm *svm = to_svm(vcpu);

2015
	clr_exception_intercept(svm, BP_VECTOR);
2016

J
Jan Kiszka 已提交
2017 2018
	if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
		if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
2019
			set_exception_intercept(svm, BP_VECTOR);
J
Jan Kiszka 已提交
2020 2021
	} else
		vcpu->guest_debug = 0;
2022 2023
}

2024
static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
A
Avi Kivity 已提交
2025
{
2026 2027 2028
	if (sd->next_asid > sd->max_asid) {
		++sd->asid_generation;
		sd->next_asid = 1;
2029
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
A
Avi Kivity 已提交
2030 2031
	}

2032 2033
	svm->asid_generation = sd->asid_generation;
	svm->vmcb->control.asid = sd->next_asid++;
2034 2035

	mark_dirty(svm->vmcb, VMCB_ASID);
A
Avi Kivity 已提交
2036 2037
}

J
Jan Kiszka 已提交
2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050
static u64 svm_get_dr6(struct kvm_vcpu *vcpu)
{
	return to_svm(vcpu)->vmcb->save.dr6;
}

static void svm_set_dr6(struct kvm_vcpu *vcpu, unsigned long value)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.dr6 = value;
	mark_dirty(svm->vmcb, VMCB_DR);
}

2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065
static void svm_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	get_debugreg(vcpu->arch.db[0], 0);
	get_debugreg(vcpu->arch.db[1], 1);
	get_debugreg(vcpu->arch.db[2], 2);
	get_debugreg(vcpu->arch.db[3], 3);
	vcpu->arch.dr6 = svm_get_dr6(vcpu);
	vcpu->arch.dr7 = svm->vmcb->save.dr7;

	vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
	set_dr_intercepts(svm);
}

2066
static void svm_set_dr7(struct kvm_vcpu *vcpu, unsigned long value)
A
Avi Kivity 已提交
2067
{
2068 2069
	struct vcpu_svm *svm = to_svm(vcpu);

2070
	svm->vmcb->save.dr7 = value;
2071
	mark_dirty(svm->vmcb, VMCB_DR);
A
Avi Kivity 已提交
2072 2073
}

A
Avi Kivity 已提交
2074
static int pf_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2075
{
G
Gleb Natapov 已提交
2076
	u64 fault_address = svm->vmcb->control.exit_info_2;
2077
	u64 error_code;
G
Gleb Natapov 已提交
2078
	int r = 1;
A
Avi Kivity 已提交
2079

G
Gleb Natapov 已提交
2080 2081 2082
	switch (svm->apf_reason) {
	default:
		error_code = svm->vmcb->control.exit_info_1;
2083

G
Gleb Natapov 已提交
2084 2085 2086
		trace_kvm_page_fault(fault_address, error_code);
		if (!npt_enabled && kvm_event_needs_reinjection(&svm->vcpu))
			kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
2087 2088 2089
		r = kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code,
			svm->vmcb->control.insn_bytes,
			svm->vmcb->control.insn_len);
G
Gleb Natapov 已提交
2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104
		break;
	case KVM_PV_REASON_PAGE_NOT_PRESENT:
		svm->apf_reason = 0;
		local_irq_disable();
		kvm_async_pf_task_wait(fault_address);
		local_irq_enable();
		break;
	case KVM_PV_REASON_PAGE_READY:
		svm->apf_reason = 0;
		local_irq_disable();
		kvm_async_pf_task_wake(fault_address);
		local_irq_enable();
		break;
	}
	return r;
A
Avi Kivity 已提交
2105 2106
}

A
Avi Kivity 已提交
2107
static int db_interception(struct vcpu_svm *svm)
J
Jan Kiszka 已提交
2108
{
A
Avi Kivity 已提交
2109 2110
	struct kvm_run *kvm_run = svm->vcpu.run;

J
Jan Kiszka 已提交
2111
	if (!(svm->vcpu.guest_debug &
2112
	      (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
J
Jan Kiszka 已提交
2113
		!svm->nmi_singlestep) {
J
Jan Kiszka 已提交
2114 2115 2116
		kvm_queue_exception(&svm->vcpu, DB_VECTOR);
		return 1;
	}
2117

J
Jan Kiszka 已提交
2118 2119
	if (svm->nmi_singlestep) {
		svm->nmi_singlestep = false;
2120 2121 2122 2123 2124 2125
		if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
			svm->vmcb->save.rflags &=
				~(X86_EFLAGS_TF | X86_EFLAGS_RF);
	}

	if (svm->vcpu.guest_debug &
J
Joerg Roedel 已提交
2126
	    (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) {
2127 2128 2129 2130 2131 2132 2133 2134
		kvm_run->exit_reason = KVM_EXIT_DEBUG;
		kvm_run->debug.arch.pc =
			svm->vmcb->save.cs.base + svm->vmcb->save.rip;
		kvm_run->debug.arch.exception = DB_VECTOR;
		return 0;
	}

	return 1;
J
Jan Kiszka 已提交
2135 2136
}

A
Avi Kivity 已提交
2137
static int bp_interception(struct vcpu_svm *svm)
J
Jan Kiszka 已提交
2138
{
A
Avi Kivity 已提交
2139 2140
	struct kvm_run *kvm_run = svm->vcpu.run;

J
Jan Kiszka 已提交
2141 2142 2143 2144 2145 2146
	kvm_run->exit_reason = KVM_EXIT_DEBUG;
	kvm_run->debug.arch.pc = svm->vmcb->save.cs.base + svm->vmcb->save.rip;
	kvm_run->debug.arch.exception = BP_VECTOR;
	return 0;
}

A
Avi Kivity 已提交
2147
static int ud_interception(struct vcpu_svm *svm)
2148 2149 2150
{
	int er;

2151
	er = emulate_instruction(&svm->vcpu, EMULTYPE_TRAP_UD);
2152
	if (er != EMULATE_DONE)
2153
		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
2154 2155 2156
	return 1;
}

2157 2158 2159 2160 2161 2162
static int ac_interception(struct vcpu_svm *svm)
{
	kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
	return 1;
}

A
Avi Kivity 已提交
2163
static void svm_fpu_activate(struct kvm_vcpu *vcpu)
A
Anthony Liguori 已提交
2164
{
A
Avi Kivity 已提交
2165
	struct vcpu_svm *svm = to_svm(vcpu);
2166

2167
	clr_exception_intercept(svm, NM_VECTOR);
2168

R
Rusty Russell 已提交
2169
	svm->vcpu.fpu_active = 1;
A
Avi Kivity 已提交
2170
	update_cr0_intercept(svm);
A
Avi Kivity 已提交
2171
}
2172

A
Avi Kivity 已提交
2173 2174 2175
static int nm_interception(struct vcpu_svm *svm)
{
	svm_fpu_activate(&svm->vcpu);
2176
	return 1;
A
Anthony Liguori 已提交
2177 2178
}

2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217
static bool is_erratum_383(void)
{
	int err, i;
	u64 value;

	if (!erratum_383_found)
		return false;

	value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
	if (err)
		return false;

	/* Bit 62 may or may not be set for this mce */
	value &= ~(1ULL << 62);

	if (value != 0xb600000000010015ULL)
		return false;

	/* Clear MCi_STATUS registers */
	for (i = 0; i < 6; ++i)
		native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);

	value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
	if (!err) {
		u32 low, high;

		value &= ~(1ULL << 2);
		low    = lower_32_bits(value);
		high   = upper_32_bits(value);

		native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
	}

	/* Flush tlb to evict multi-match entries */
	__flush_tlb_all();

	return true;
}

2218
static void svm_handle_mce(struct vcpu_svm *svm)
2219
{
2220 2221 2222 2223 2224 2225 2226
	if (is_erratum_383()) {
		/*
		 * Erratum 383 triggered. Guest state is corrupt so kill the
		 * guest.
		 */
		pr_err("KVM: Guest triggered AMD Erratum 383\n");

2227
		kvm_make_request(KVM_REQ_TRIPLE_FAULT, &svm->vcpu);
2228 2229 2230 2231

		return;
	}

2232 2233 2234 2235 2236 2237 2238 2239
	/*
	 * On an #MC intercept the MCE handler is not called automatically in
	 * the host. So do it by hand here.
	 */
	asm volatile (
		"int $0x12\n");
	/* not sure if we ever come back to this point */

2240 2241 2242 2243 2244
	return;
}

static int mc_interception(struct vcpu_svm *svm)
{
2245 2246 2247
	return 1;
}

A
Avi Kivity 已提交
2248
static int shutdown_interception(struct vcpu_svm *svm)
2249
{
A
Avi Kivity 已提交
2250 2251
	struct kvm_run *kvm_run = svm->vcpu.run;

2252 2253 2254 2255
	/*
	 * VMCB is undefined after a SHUTDOWN intercept
	 * so reinitialize it.
	 */
2256
	clear_page(svm->vmcb);
P
Paolo Bonzini 已提交
2257
	init_vmcb(svm);
2258 2259 2260 2261 2262

	kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
	return 0;
}

A
Avi Kivity 已提交
2263
static int io_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2264
{
2265
	struct kvm_vcpu *vcpu = &svm->vcpu;
M
Mike Day 已提交
2266
	u32 io_info = svm->vmcb->control.exit_info_1; /* address size bug? */
2267
	int size, in, string;
2268
	unsigned port;
A
Avi Kivity 已提交
2269

R
Rusty Russell 已提交
2270
	++svm->vcpu.stat.io_exits;
2271
	string = (io_info & SVM_IOIO_STR_MASK) != 0;
2272
	in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
2273
	if (string)
2274
		return emulate_instruction(vcpu, 0) == EMULATE_DONE;
2275

2276 2277
	port = io_info >> 16;
	size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
2278
	svm->next_rip = svm->vmcb->control.exit_info_2;
2279
	skip_emulated_instruction(&svm->vcpu);
2280

2281 2282
	return in ? kvm_fast_pio_in(vcpu, size, port)
		  : kvm_fast_pio_out(vcpu, size, port);
A
Avi Kivity 已提交
2283 2284
}

A
Avi Kivity 已提交
2285
static int nmi_interception(struct vcpu_svm *svm)
2286 2287 2288 2289
{
	return 1;
}

A
Avi Kivity 已提交
2290
static int intr_interception(struct vcpu_svm *svm)
2291 2292 2293 2294 2295
{
	++svm->vcpu.stat.irq_exits;
	return 1;
}

A
Avi Kivity 已提交
2296
static int nop_on_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2297 2298 2299 2300
{
	return 1;
}

A
Avi Kivity 已提交
2301
static int halt_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2302
{
2303
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 1;
R
Rusty Russell 已提交
2304
	return kvm_emulate_halt(&svm->vcpu);
A
Avi Kivity 已提交
2305 2306
}

A
Avi Kivity 已提交
2307
static int vmmcall_interception(struct vcpu_svm *svm)
2308
{
2309
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2310
	return kvm_emulate_hypercall(&svm->vcpu);
2311 2312
}

2313 2314 2315 2316 2317 2318 2319
static unsigned long nested_svm_get_tdp_cr3(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	return svm->nested.nested_cr3;
}

2320 2321 2322 2323 2324 2325 2326
static u64 nested_svm_get_tdp_pdptr(struct kvm_vcpu *vcpu, int index)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 cr3 = svm->nested.nested_cr3;
	u64 pdpte;
	int ret;

2327 2328
	ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(cr3), &pdpte,
				       offset_in_page(cr3) + index * 8, 8);
2329 2330 2331 2332 2333
	if (ret)
		return 0;
	return pdpte;
}

2334 2335 2336 2337 2338 2339
static void nested_svm_set_tdp_cr3(struct kvm_vcpu *vcpu,
				   unsigned long root)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.nested_cr3 = root;
2340
	mark_dirty(svm->vmcb, VMCB_NPT);
2341
	svm_flush_tlb(vcpu);
2342 2343
}

2344 2345
static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu,
				       struct x86_exception *fault)
2346 2347 2348
{
	struct vcpu_svm *svm = to_svm(vcpu);

2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368
	if (svm->vmcb->control.exit_code != SVM_EXIT_NPF) {
		/*
		 * TODO: track the cause of the nested page fault, and
		 * correctly fill in the high bits of exit_info_1.
		 */
		svm->vmcb->control.exit_code = SVM_EXIT_NPF;
		svm->vmcb->control.exit_code_hi = 0;
		svm->vmcb->control.exit_info_1 = (1ULL << 32);
		svm->vmcb->control.exit_info_2 = fault->address;
	}

	svm->vmcb->control.exit_info_1 &= ~0xffffffffULL;
	svm->vmcb->control.exit_info_1 |= fault->error_code;

	/*
	 * The present bit is always zero for page structure faults on real
	 * hardware.
	 */
	if (svm->vmcb->control.exit_info_1 & (2ULL << 32))
		svm->vmcb->control.exit_info_1 &= ~1;
2369 2370 2371 2372

	nested_svm_vmexit(svm);
}

2373
static void nested_svm_init_mmu_context(struct kvm_vcpu *vcpu)
2374
{
2375 2376
	WARN_ON(mmu_is_nested(vcpu));
	kvm_init_shadow_mmu(vcpu);
2377 2378
	vcpu->arch.mmu.set_cr3           = nested_svm_set_tdp_cr3;
	vcpu->arch.mmu.get_cr3           = nested_svm_get_tdp_cr3;
2379
	vcpu->arch.mmu.get_pdptr         = nested_svm_get_tdp_pdptr;
2380 2381
	vcpu->arch.mmu.inject_page_fault = nested_svm_inject_npf_exit;
	vcpu->arch.mmu.shadow_root_level = get_npt_level();
2382
	reset_shadow_zero_bits_mask(vcpu, &vcpu->arch.mmu);
2383 2384 2385 2386 2387 2388 2389 2390
	vcpu->arch.walk_mmu              = &vcpu->arch.nested_mmu;
}

static void nested_svm_uninit_mmu_context(struct kvm_vcpu *vcpu)
{
	vcpu->arch.walk_mmu = &vcpu->arch.mmu;
}

2391 2392
static int nested_svm_check_permissions(struct vcpu_svm *svm)
{
2393
	if (!(svm->vcpu.arch.efer & EFER_SVME)
2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406
	    || !is_paging(&svm->vcpu)) {
		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
		return 1;
	}

	if (svm->vmcb->save.cpl) {
		kvm_inject_gp(&svm->vcpu, 0);
		return 1;
	}

       return 0;
}

2407 2408 2409
static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
				      bool has_error_code, u32 error_code)
{
2410 2411
	int vmexit;

2412
	if (!is_guest_mode(&svm->vcpu))
2413
		return 0;
2414

2415 2416 2417 2418 2419
	svm->vmcb->control.exit_code = SVM_EXIT_EXCP_BASE + nr;
	svm->vmcb->control.exit_code_hi = 0;
	svm->vmcb->control.exit_info_1 = error_code;
	svm->vmcb->control.exit_info_2 = svm->vcpu.arch.cr2;

2420 2421 2422 2423 2424
	vmexit = nested_svm_intercept(svm);
	if (vmexit == NESTED_EXIT_DONE)
		svm->nested.exit_required = true;

	return vmexit;
2425 2426
}

2427 2428
/* This function returns true if it is save to enable the irq window */
static inline bool nested_svm_intr(struct vcpu_svm *svm)
2429
{
2430
	if (!is_guest_mode(&svm->vcpu))
2431
		return true;
2432

2433
	if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK))
2434
		return true;
2435

2436
	if (!(svm->vcpu.arch.hflags & HF_HIF_MASK))
2437
		return false;
2438

2439 2440 2441 2442 2443 2444 2445 2446
	/*
	 * if vmexit was already requested (by intercepted exception
	 * for instance) do not overwrite it with "external interrupt"
	 * vmexit.
	 */
	if (svm->nested.exit_required)
		return false;

2447 2448 2449
	svm->vmcb->control.exit_code   = SVM_EXIT_INTR;
	svm->vmcb->control.exit_info_1 = 0;
	svm->vmcb->control.exit_info_2 = 0;
2450

2451 2452 2453
	if (svm->nested.intercept & 1ULL) {
		/*
		 * The #vmexit can't be emulated here directly because this
G
Guo Chao 已提交
2454
		 * code path runs with irqs and preemption disabled. A
2455 2456 2457 2458
		 * #vmexit emulation might sleep. Only signal request for
		 * the #vmexit here.
		 */
		svm->nested.exit_required = true;
2459
		trace_kvm_nested_intr_vmexit(svm->vmcb->save.rip);
2460
		return false;
2461 2462
	}

2463
	return true;
2464 2465
}

2466 2467 2468
/* This function returns true if it is save to enable the nmi window */
static inline bool nested_svm_nmi(struct vcpu_svm *svm)
{
2469
	if (!is_guest_mode(&svm->vcpu))
2470 2471 2472 2473 2474 2475 2476 2477 2478
		return true;

	if (!(svm->nested.intercept & (1ULL << INTERCEPT_NMI)))
		return true;

	svm->vmcb->control.exit_code = SVM_EXIT_NMI;
	svm->nested.exit_required = true;

	return false;
2479 2480
}

2481
static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page)
2482 2483 2484
{
	struct page *page;

2485 2486
	might_sleep();

2487
	page = kvm_vcpu_gfn_to_page(&svm->vcpu, gpa >> PAGE_SHIFT);
2488 2489 2490
	if (is_error_page(page))
		goto error;

2491 2492 2493
	*_page = page;

	return kmap(page);
2494 2495 2496 2497 2498 2499 2500

error:
	kvm_inject_gp(&svm->vcpu, 0);

	return NULL;
}

2501
static void nested_svm_unmap(struct page *page)
2502
{
2503
	kunmap(page);
2504 2505 2506
	kvm_release_page_dirty(page);
}

2507 2508
static int nested_svm_intercept_ioio(struct vcpu_svm *svm)
{
2509 2510 2511
	unsigned port, size, iopm_len;
	u16 val, mask;
	u8 start_bit;
2512
	u64 gpa;
2513

2514 2515
	if (!(svm->nested.intercept & (1ULL << INTERCEPT_IOIO_PROT)))
		return NESTED_EXIT_HOST;
2516

2517
	port = svm->vmcb->control.exit_info_1 >> 16;
2518 2519
	size = (svm->vmcb->control.exit_info_1 & SVM_IOIO_SIZE_MASK) >>
		SVM_IOIO_SIZE_SHIFT;
2520
	gpa  = svm->nested.vmcb_iopm + (port / 8);
2521 2522 2523 2524
	start_bit = port % 8;
	iopm_len = (start_bit + size > 8) ? 2 : 1;
	mask = (0xf >> (4 - size)) << start_bit;
	val = 0;
2525

2526
	if (kvm_vcpu_read_guest(&svm->vcpu, gpa, &val, iopm_len))
2527
		return NESTED_EXIT_DONE;
2528

2529
	return (val & mask) ? NESTED_EXIT_DONE : NESTED_EXIT_HOST;
2530 2531
}

2532
static int nested_svm_exit_handled_msr(struct vcpu_svm *svm)
2533
{
2534 2535
	u32 offset, msr, value;
	int write, mask;
2536

2537
	if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
2538
		return NESTED_EXIT_HOST;
2539

2540 2541 2542 2543
	msr    = svm->vcpu.arch.regs[VCPU_REGS_RCX];
	offset = svm_msrpm_offset(msr);
	write  = svm->vmcb->control.exit_info_1 & 1;
	mask   = 1 << ((2 * (msr & 0xf)) + write);
2544

2545 2546
	if (offset == MSR_INVALID)
		return NESTED_EXIT_DONE;
2547

2548 2549
	/* Offset is in 32 bit units but need in 8 bit units */
	offset *= 4;
2550

2551
	if (kvm_vcpu_read_guest(&svm->vcpu, svm->nested.vmcb_msrpm + offset, &value, 4))
2552
		return NESTED_EXIT_DONE;
2553

2554
	return (value & mask) ? NESTED_EXIT_DONE : NESTED_EXIT_HOST;
2555 2556
}

2557
static int nested_svm_exit_special(struct vcpu_svm *svm)
2558 2559
{
	u32 exit_code = svm->vmcb->control.exit_code;
2560

2561 2562 2563
	switch (exit_code) {
	case SVM_EXIT_INTR:
	case SVM_EXIT_NMI:
2564
	case SVM_EXIT_EXCP_BASE + MC_VECTOR:
2565 2566
		return NESTED_EXIT_HOST;
	case SVM_EXIT_NPF:
J
Joerg Roedel 已提交
2567
		/* For now we are always handling NPFs when using them */
2568 2569 2570 2571
		if (npt_enabled)
			return NESTED_EXIT_HOST;
		break;
	case SVM_EXIT_EXCP_BASE + PF_VECTOR:
G
Gleb Natapov 已提交
2572 2573
		/* When we're shadowing, trap PFs, but not async PF */
		if (!npt_enabled && svm->apf_reason == 0)
2574 2575
			return NESTED_EXIT_HOST;
		break;
2576 2577 2578
	case SVM_EXIT_EXCP_BASE + NM_VECTOR:
		nm_interception(svm);
		break;
2579 2580
	default:
		break;
2581 2582
	}

2583 2584 2585 2586 2587 2588
	return NESTED_EXIT_CONTINUE;
}

/*
 * If this function returns true, this #vmexit was already handled
 */
2589
static int nested_svm_intercept(struct vcpu_svm *svm)
2590 2591 2592 2593
{
	u32 exit_code = svm->vmcb->control.exit_code;
	int vmexit = NESTED_EXIT_HOST;

2594
	switch (exit_code) {
2595
	case SVM_EXIT_MSR:
2596
		vmexit = nested_svm_exit_handled_msr(svm);
2597
		break;
2598 2599 2600
	case SVM_EXIT_IOIO:
		vmexit = nested_svm_intercept_ioio(svm);
		break;
2601 2602 2603
	case SVM_EXIT_READ_CR0 ... SVM_EXIT_WRITE_CR8: {
		u32 bit = 1U << (exit_code - SVM_EXIT_READ_CR0);
		if (svm->nested.intercept_cr & bit)
2604
			vmexit = NESTED_EXIT_DONE;
2605 2606
		break;
	}
2607 2608 2609
	case SVM_EXIT_READ_DR0 ... SVM_EXIT_WRITE_DR7: {
		u32 bit = 1U << (exit_code - SVM_EXIT_READ_DR0);
		if (svm->nested.intercept_dr & bit)
2610
			vmexit = NESTED_EXIT_DONE;
2611 2612 2613 2614
		break;
	}
	case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: {
		u32 excp_bits = 1 << (exit_code - SVM_EXIT_EXCP_BASE);
J
Joerg Roedel 已提交
2615
		if (svm->nested.intercept_exceptions & excp_bits)
2616
			vmexit = NESTED_EXIT_DONE;
G
Gleb Natapov 已提交
2617 2618 2619 2620
		/* async page fault always cause vmexit */
		else if ((exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR) &&
			 svm->apf_reason != 0)
			vmexit = NESTED_EXIT_DONE;
2621 2622
		break;
	}
2623 2624 2625 2626
	case SVM_EXIT_ERR: {
		vmexit = NESTED_EXIT_DONE;
		break;
	}
2627 2628
	default: {
		u64 exit_bits = 1ULL << (exit_code - SVM_EXIT_INTR);
J
Joerg Roedel 已提交
2629
		if (svm->nested.intercept & exit_bits)
2630
			vmexit = NESTED_EXIT_DONE;
2631 2632 2633
	}
	}

2634 2635 2636 2637 2638 2639 2640 2641 2642 2643
	return vmexit;
}

static int nested_svm_exit_handled(struct vcpu_svm *svm)
{
	int vmexit;

	vmexit = nested_svm_intercept(svm);

	if (vmexit == NESTED_EXIT_DONE)
2644 2645 2646
		nested_svm_vmexit(svm);

	return vmexit;
2647 2648
}

2649 2650 2651 2652 2653
static inline void copy_vmcb_control_area(struct vmcb *dst_vmcb, struct vmcb *from_vmcb)
{
	struct vmcb_control_area *dst  = &dst_vmcb->control;
	struct vmcb_control_area *from = &from_vmcb->control;

2654
	dst->intercept_cr         = from->intercept_cr;
2655
	dst->intercept_dr         = from->intercept_dr;
2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678
	dst->intercept_exceptions = from->intercept_exceptions;
	dst->intercept            = from->intercept;
	dst->iopm_base_pa         = from->iopm_base_pa;
	dst->msrpm_base_pa        = from->msrpm_base_pa;
	dst->tsc_offset           = from->tsc_offset;
	dst->asid                 = from->asid;
	dst->tlb_ctl              = from->tlb_ctl;
	dst->int_ctl              = from->int_ctl;
	dst->int_vector           = from->int_vector;
	dst->int_state            = from->int_state;
	dst->exit_code            = from->exit_code;
	dst->exit_code_hi         = from->exit_code_hi;
	dst->exit_info_1          = from->exit_info_1;
	dst->exit_info_2          = from->exit_info_2;
	dst->exit_int_info        = from->exit_int_info;
	dst->exit_int_info_err    = from->exit_int_info_err;
	dst->nested_ctl           = from->nested_ctl;
	dst->event_inj            = from->event_inj;
	dst->event_inj_err        = from->event_inj_err;
	dst->nested_cr3           = from->nested_cr3;
	dst->lbr_ctl              = from->lbr_ctl;
}

2679
static int nested_svm_vmexit(struct vcpu_svm *svm)
2680
{
2681
	struct vmcb *nested_vmcb;
2682
	struct vmcb *hsave = svm->nested.hsave;
J
Joerg Roedel 已提交
2683
	struct vmcb *vmcb = svm->vmcb;
2684
	struct page *page;
2685

2686 2687 2688 2689
	trace_kvm_nested_vmexit_inject(vmcb->control.exit_code,
				       vmcb->control.exit_info_1,
				       vmcb->control.exit_info_2,
				       vmcb->control.exit_int_info,
2690 2691
				       vmcb->control.exit_int_info_err,
				       KVM_ISA_SVM);
2692

2693
	nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, &page);
2694 2695 2696
	if (!nested_vmcb)
		return 1;

2697 2698
	/* Exit Guest-Mode */
	leave_guest_mode(&svm->vcpu);
2699 2700
	svm->nested.vmcb = 0;

2701
	/* Give the current vmcb to the guest */
J
Joerg Roedel 已提交
2702 2703 2704 2705 2706 2707 2708 2709
	disable_gif(svm);

	nested_vmcb->save.es     = vmcb->save.es;
	nested_vmcb->save.cs     = vmcb->save.cs;
	nested_vmcb->save.ss     = vmcb->save.ss;
	nested_vmcb->save.ds     = vmcb->save.ds;
	nested_vmcb->save.gdtr   = vmcb->save.gdtr;
	nested_vmcb->save.idtr   = vmcb->save.idtr;
2710
	nested_vmcb->save.efer   = svm->vcpu.arch.efer;
2711
	nested_vmcb->save.cr0    = kvm_read_cr0(&svm->vcpu);
2712
	nested_vmcb->save.cr3    = kvm_read_cr3(&svm->vcpu);
J
Joerg Roedel 已提交
2713
	nested_vmcb->save.cr2    = vmcb->save.cr2;
2714
	nested_vmcb->save.cr4    = svm->vcpu.arch.cr4;
2715
	nested_vmcb->save.rflags = kvm_get_rflags(&svm->vcpu);
J
Joerg Roedel 已提交
2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731
	nested_vmcb->save.rip    = vmcb->save.rip;
	nested_vmcb->save.rsp    = vmcb->save.rsp;
	nested_vmcb->save.rax    = vmcb->save.rax;
	nested_vmcb->save.dr7    = vmcb->save.dr7;
	nested_vmcb->save.dr6    = vmcb->save.dr6;
	nested_vmcb->save.cpl    = vmcb->save.cpl;

	nested_vmcb->control.int_ctl           = vmcb->control.int_ctl;
	nested_vmcb->control.int_vector        = vmcb->control.int_vector;
	nested_vmcb->control.int_state         = vmcb->control.int_state;
	nested_vmcb->control.exit_code         = vmcb->control.exit_code;
	nested_vmcb->control.exit_code_hi      = vmcb->control.exit_code_hi;
	nested_vmcb->control.exit_info_1       = vmcb->control.exit_info_1;
	nested_vmcb->control.exit_info_2       = vmcb->control.exit_info_2;
	nested_vmcb->control.exit_int_info     = vmcb->control.exit_int_info;
	nested_vmcb->control.exit_int_info_err = vmcb->control.exit_int_info_err;
2732 2733 2734

	if (svm->nrips_enabled)
		nested_vmcb->control.next_rip  = vmcb->control.next_rip;
2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750

	/*
	 * If we emulate a VMRUN/#VMEXIT in the same host #vmexit cycle we have
	 * to make sure that we do not lose injected events. So check event_inj
	 * here and copy it to exit_int_info if it is valid.
	 * Exit_int_info and event_inj can't be both valid because the case
	 * below only happens on a VMRUN instruction intercept which has
	 * no valid exit_int_info set.
	 */
	if (vmcb->control.event_inj & SVM_EVTINJ_VALID) {
		struct vmcb_control_area *nc = &nested_vmcb->control;

		nc->exit_int_info     = vmcb->control.event_inj;
		nc->exit_int_info_err = vmcb->control.event_inj_err;
	}

J
Joerg Roedel 已提交
2751 2752 2753
	nested_vmcb->control.tlb_ctl           = 0;
	nested_vmcb->control.event_inj         = 0;
	nested_vmcb->control.event_inj_err     = 0;
2754 2755 2756 2757 2758 2759

	/* We always set V_INTR_MASKING and remember the old value in hflags */
	if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK))
		nested_vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;

	/* Restore the original control entries */
2760
	copy_vmcb_control_area(vmcb, hsave);
2761

2762 2763
	kvm_clear_exception_queue(&svm->vcpu);
	kvm_clear_interrupt_queue(&svm->vcpu);
2764

2765 2766
	svm->nested.nested_cr3 = 0;

2767 2768 2769 2770 2771 2772 2773
	/* Restore selected save entries */
	svm->vmcb->save.es = hsave->save.es;
	svm->vmcb->save.cs = hsave->save.cs;
	svm->vmcb->save.ss = hsave->save.ss;
	svm->vmcb->save.ds = hsave->save.ds;
	svm->vmcb->save.gdtr = hsave->save.gdtr;
	svm->vmcb->save.idtr = hsave->save.idtr;
2774
	kvm_set_rflags(&svm->vcpu, hsave->save.rflags);
2775 2776 2777 2778 2779 2780 2781
	svm_set_efer(&svm->vcpu, hsave->save.efer);
	svm_set_cr0(&svm->vcpu, hsave->save.cr0 | X86_CR0_PE);
	svm_set_cr4(&svm->vcpu, hsave->save.cr4);
	if (npt_enabled) {
		svm->vmcb->save.cr3 = hsave->save.cr3;
		svm->vcpu.arch.cr3 = hsave->save.cr3;
	} else {
2782
		(void)kvm_set_cr3(&svm->vcpu, hsave->save.cr3);
2783 2784 2785 2786 2787 2788 2789 2790
	}
	kvm_register_write(&svm->vcpu, VCPU_REGS_RAX, hsave->save.rax);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RSP, hsave->save.rsp);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RIP, hsave->save.rip);
	svm->vmcb->save.dr7 = 0;
	svm->vmcb->save.cpl = 0;
	svm->vmcb->control.exit_int_info = 0;

2791 2792
	mark_all_dirty(svm->vmcb);

2793
	nested_svm_unmap(page);
2794

2795
	nested_svm_uninit_mmu_context(&svm->vcpu);
2796 2797 2798 2799 2800
	kvm_mmu_reset_context(&svm->vcpu);
	kvm_mmu_load(&svm->vcpu);

	return 0;
}
A
Alexander Graf 已提交
2801

2802
static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
A
Alexander Graf 已提交
2803
{
2804 2805
	/*
	 * This function merges the msr permission bitmaps of kvm and the
G
Guo Chao 已提交
2806
	 * nested vmcb. It is optimized in that it only merges the parts where
2807 2808
	 * the kvm msr permission bitmap may contain zero bits
	 */
A
Alexander Graf 已提交
2809
	int i;
2810

2811 2812
	if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
		return true;
2813

2814 2815 2816
	for (i = 0; i < MSRPM_OFFSETS; i++) {
		u32 value, p;
		u64 offset;
2817

2818 2819
		if (msrpm_offsets[i] == 0xffffffff)
			break;
A
Alexander Graf 已提交
2820

2821 2822
		p      = msrpm_offsets[i];
		offset = svm->nested.vmcb_msrpm + (p * 4);
2823

2824
		if (kvm_vcpu_read_guest(&svm->vcpu, offset, &value, 4))
2825 2826 2827 2828
			return false;

		svm->nested.msrpm[p] = svm->msrpm[p] | value;
	}
A
Alexander Graf 已提交
2829

2830
	svm->vmcb->control.msrpm_base_pa = __pa(svm->nested.msrpm);
2831 2832

	return true;
A
Alexander Graf 已提交
2833 2834
}

2835 2836 2837 2838 2839
static bool nested_vmcb_checks(struct vmcb *vmcb)
{
	if ((vmcb->control.intercept & (1ULL << INTERCEPT_VMRUN)) == 0)
		return false;

2840 2841 2842
	if (vmcb->control.asid == 0)
		return false;

2843 2844 2845
	if (vmcb->control.nested_ctl && !npt_enabled)
		return false;

2846 2847 2848
	return true;
}

2849
static bool nested_svm_vmrun(struct vcpu_svm *svm)
A
Alexander Graf 已提交
2850
{
2851
	struct vmcb *nested_vmcb;
2852
	struct vmcb *hsave = svm->nested.hsave;
J
Joerg Roedel 已提交
2853
	struct vmcb *vmcb = svm->vmcb;
2854
	struct page *page;
2855
	u64 vmcb_gpa;
A
Alexander Graf 已提交
2856

2857
	vmcb_gpa = svm->vmcb->save.rax;
A
Alexander Graf 已提交
2858

2859
	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
2860 2861 2862
	if (!nested_vmcb)
		return false;

2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873
	if (!nested_vmcb_checks(nested_vmcb)) {
		nested_vmcb->control.exit_code    = SVM_EXIT_ERR;
		nested_vmcb->control.exit_code_hi = 0;
		nested_vmcb->control.exit_info_1  = 0;
		nested_vmcb->control.exit_info_2  = 0;

		nested_svm_unmap(page);

		return false;
	}

2874
	trace_kvm_nested_vmrun(svm->vmcb->save.rip, vmcb_gpa,
2875 2876 2877 2878 2879
			       nested_vmcb->save.rip,
			       nested_vmcb->control.int_ctl,
			       nested_vmcb->control.event_inj,
			       nested_vmcb->control.nested_ctl);

2880 2881
	trace_kvm_nested_intercepts(nested_vmcb->control.intercept_cr & 0xffff,
				    nested_vmcb->control.intercept_cr >> 16,
2882 2883 2884
				    nested_vmcb->control.intercept_exceptions,
				    nested_vmcb->control.intercept);

A
Alexander Graf 已提交
2885
	/* Clear internal status */
2886 2887
	kvm_clear_exception_queue(&svm->vcpu);
	kvm_clear_interrupt_queue(&svm->vcpu);
A
Alexander Graf 已提交
2888

J
Joerg Roedel 已提交
2889 2890 2891 2892
	/*
	 * Save the old vmcb, so we don't need to pick what we save, but can
	 * restore everything when a VMEXIT occurs
	 */
J
Joerg Roedel 已提交
2893 2894 2895 2896 2897 2898
	hsave->save.es     = vmcb->save.es;
	hsave->save.cs     = vmcb->save.cs;
	hsave->save.ss     = vmcb->save.ss;
	hsave->save.ds     = vmcb->save.ds;
	hsave->save.gdtr   = vmcb->save.gdtr;
	hsave->save.idtr   = vmcb->save.idtr;
2899
	hsave->save.efer   = svm->vcpu.arch.efer;
2900
	hsave->save.cr0    = kvm_read_cr0(&svm->vcpu);
J
Joerg Roedel 已提交
2901
	hsave->save.cr4    = svm->vcpu.arch.cr4;
2902
	hsave->save.rflags = kvm_get_rflags(&svm->vcpu);
2903
	hsave->save.rip    = kvm_rip_read(&svm->vcpu);
J
Joerg Roedel 已提交
2904 2905 2906 2907 2908
	hsave->save.rsp    = vmcb->save.rsp;
	hsave->save.rax    = vmcb->save.rax;
	if (npt_enabled)
		hsave->save.cr3    = vmcb->save.cr3;
	else
2909
		hsave->save.cr3    = kvm_read_cr3(&svm->vcpu);
J
Joerg Roedel 已提交
2910

2911
	copy_vmcb_control_area(hsave, vmcb);
A
Alexander Graf 已提交
2912

2913
	if (kvm_get_rflags(&svm->vcpu) & X86_EFLAGS_IF)
A
Alexander Graf 已提交
2914 2915 2916 2917
		svm->vcpu.arch.hflags |= HF_HIF_MASK;
	else
		svm->vcpu.arch.hflags &= ~HF_HIF_MASK;

2918 2919 2920 2921 2922 2923
	if (nested_vmcb->control.nested_ctl) {
		kvm_mmu_unload(&svm->vcpu);
		svm->nested.nested_cr3 = nested_vmcb->control.nested_cr3;
		nested_svm_init_mmu_context(&svm->vcpu);
	}

A
Alexander Graf 已提交
2924 2925 2926 2927 2928 2929 2930
	/* Load the nested guest state */
	svm->vmcb->save.es = nested_vmcb->save.es;
	svm->vmcb->save.cs = nested_vmcb->save.cs;
	svm->vmcb->save.ss = nested_vmcb->save.ss;
	svm->vmcb->save.ds = nested_vmcb->save.ds;
	svm->vmcb->save.gdtr = nested_vmcb->save.gdtr;
	svm->vmcb->save.idtr = nested_vmcb->save.idtr;
2931
	kvm_set_rflags(&svm->vcpu, nested_vmcb->save.rflags);
A
Alexander Graf 已提交
2932 2933 2934 2935 2936 2937
	svm_set_efer(&svm->vcpu, nested_vmcb->save.efer);
	svm_set_cr0(&svm->vcpu, nested_vmcb->save.cr0);
	svm_set_cr4(&svm->vcpu, nested_vmcb->save.cr4);
	if (npt_enabled) {
		svm->vmcb->save.cr3 = nested_vmcb->save.cr3;
		svm->vcpu.arch.cr3 = nested_vmcb->save.cr3;
2938
	} else
2939
		(void)kvm_set_cr3(&svm->vcpu, nested_vmcb->save.cr3);
2940 2941 2942 2943

	/* Guest paging mode is active - reset mmu */
	kvm_mmu_reset_context(&svm->vcpu);

J
Joerg Roedel 已提交
2944
	svm->vmcb->save.cr2 = svm->vcpu.arch.cr2 = nested_vmcb->save.cr2;
A
Alexander Graf 已提交
2945 2946 2947
	kvm_register_write(&svm->vcpu, VCPU_REGS_RAX, nested_vmcb->save.rax);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RSP, nested_vmcb->save.rsp);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RIP, nested_vmcb->save.rip);
J
Joerg Roedel 已提交
2948

A
Alexander Graf 已提交
2949 2950 2951 2952 2953 2954 2955 2956
	/* In case we don't even reach vcpu_run, the fields are not updated */
	svm->vmcb->save.rax = nested_vmcb->save.rax;
	svm->vmcb->save.rsp = nested_vmcb->save.rsp;
	svm->vmcb->save.rip = nested_vmcb->save.rip;
	svm->vmcb->save.dr7 = nested_vmcb->save.dr7;
	svm->vmcb->save.dr6 = nested_vmcb->save.dr6;
	svm->vmcb->save.cpl = nested_vmcb->save.cpl;

2957
	svm->nested.vmcb_msrpm = nested_vmcb->control.msrpm_base_pa & ~0x0fffULL;
2958
	svm->nested.vmcb_iopm  = nested_vmcb->control.iopm_base_pa  & ~0x0fffULL;
A
Alexander Graf 已提交
2959

J
Joerg Roedel 已提交
2960
	/* cache intercepts */
2961
	svm->nested.intercept_cr         = nested_vmcb->control.intercept_cr;
2962
	svm->nested.intercept_dr         = nested_vmcb->control.intercept_dr;
J
Joerg Roedel 已提交
2963 2964 2965
	svm->nested.intercept_exceptions = nested_vmcb->control.intercept_exceptions;
	svm->nested.intercept            = nested_vmcb->control.intercept;

2966
	svm_flush_tlb(&svm->vcpu);
A
Alexander Graf 已提交
2967 2968 2969 2970 2971 2972
	svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK;
	if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK)
		svm->vcpu.arch.hflags |= HF_VINTR_MASK;
	else
		svm->vcpu.arch.hflags &= ~HF_VINTR_MASK;

2973 2974
	if (svm->vcpu.arch.hflags & HF_VINTR_MASK) {
		/* We only want the cr8 intercept bits of the guest */
2975 2976
		clr_cr_intercept(svm, INTERCEPT_CR8_READ);
		clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
2977 2978
	}

2979
	/* We don't want to see VMMCALLs from a nested guest */
2980
	clr_intercept(svm, INTERCEPT_VMMCALL);
2981

2982
	svm->vmcb->control.lbr_ctl = nested_vmcb->control.lbr_ctl;
A
Alexander Graf 已提交
2983 2984 2985 2986 2987 2988
	svm->vmcb->control.int_vector = nested_vmcb->control.int_vector;
	svm->vmcb->control.int_state = nested_vmcb->control.int_state;
	svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset;
	svm->vmcb->control.event_inj = nested_vmcb->control.event_inj;
	svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err;

2989
	nested_svm_unmap(page);
2990

2991 2992 2993
	/* Enter Guest-Mode */
	enter_guest_mode(&svm->vcpu);

2994 2995 2996 2997 2998 2999
	/*
	 * Merge guest and host intercepts - must be called  with vcpu in
	 * guest-mode to take affect here
	 */
	recalc_intercepts(svm);

3000
	svm->nested.vmcb = vmcb_gpa;
3001

3002
	enable_gif(svm);
A
Alexander Graf 已提交
3003

3004 3005
	mark_all_dirty(svm->vmcb);

3006
	return true;
A
Alexander Graf 已提交
3007 3008
}

3009
static void nested_svm_vmloadsave(struct vmcb *from_vmcb, struct vmcb *to_vmcb)
3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024
{
	to_vmcb->save.fs = from_vmcb->save.fs;
	to_vmcb->save.gs = from_vmcb->save.gs;
	to_vmcb->save.tr = from_vmcb->save.tr;
	to_vmcb->save.ldtr = from_vmcb->save.ldtr;
	to_vmcb->save.kernel_gs_base = from_vmcb->save.kernel_gs_base;
	to_vmcb->save.star = from_vmcb->save.star;
	to_vmcb->save.lstar = from_vmcb->save.lstar;
	to_vmcb->save.cstar = from_vmcb->save.cstar;
	to_vmcb->save.sfmask = from_vmcb->save.sfmask;
	to_vmcb->save.sysenter_cs = from_vmcb->save.sysenter_cs;
	to_vmcb->save.sysenter_esp = from_vmcb->save.sysenter_esp;
	to_vmcb->save.sysenter_eip = from_vmcb->save.sysenter_eip;
}

A
Avi Kivity 已提交
3025
static int vmload_interception(struct vcpu_svm *svm)
3026
{
3027
	struct vmcb *nested_vmcb;
3028
	struct page *page;
3029

3030 3031 3032
	if (nested_svm_check_permissions(svm))
		return 1;

3033
	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
3034 3035 3036
	if (!nested_vmcb)
		return 1;

3037 3038 3039
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);

3040
	nested_svm_vmloadsave(nested_vmcb, svm->vmcb);
3041
	nested_svm_unmap(page);
3042 3043 3044 3045

	return 1;
}

A
Avi Kivity 已提交
3046
static int vmsave_interception(struct vcpu_svm *svm)
3047
{
3048
	struct vmcb *nested_vmcb;
3049
	struct page *page;
3050

3051 3052 3053
	if (nested_svm_check_permissions(svm))
		return 1;

3054
	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
3055 3056 3057
	if (!nested_vmcb)
		return 1;

3058 3059 3060
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);

3061
	nested_svm_vmloadsave(svm->vmcb, nested_vmcb);
3062
	nested_svm_unmap(page);
3063 3064 3065 3066

	return 1;
}

A
Avi Kivity 已提交
3067
static int vmrun_interception(struct vcpu_svm *svm)
A
Alexander Graf 已提交
3068 3069 3070 3071
{
	if (nested_svm_check_permissions(svm))
		return 1;

3072 3073
	/* Save rip after vmrun instruction */
	kvm_rip_write(&svm->vcpu, kvm_rip_read(&svm->vcpu) + 3);
A
Alexander Graf 已提交
3074

3075
	if (!nested_svm_vmrun(svm))
A
Alexander Graf 已提交
3076 3077
		return 1;

3078
	if (!nested_svm_vmrun_msrpm(svm))
3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090
		goto failed;

	return 1;

failed:

	svm->vmcb->control.exit_code    = SVM_EXIT_ERR;
	svm->vmcb->control.exit_code_hi = 0;
	svm->vmcb->control.exit_info_1  = 0;
	svm->vmcb->control.exit_info_2  = 0;

	nested_svm_vmexit(svm);
A
Alexander Graf 已提交
3091 3092 3093 3094

	return 1;
}

A
Avi Kivity 已提交
3095
static int stgi_interception(struct vcpu_svm *svm)
3096 3097 3098 3099 3100 3101
{
	if (nested_svm_check_permissions(svm))
		return 1;

	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);
3102
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3103

3104
	enable_gif(svm);
3105 3106 3107 3108

	return 1;
}

A
Avi Kivity 已提交
3109
static int clgi_interception(struct vcpu_svm *svm)
3110 3111 3112 3113 3114 3115 3116
{
	if (nested_svm_check_permissions(svm))
		return 1;

	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);

3117
	disable_gif(svm);
3118 3119

	/* After a CLGI no interrupts should come */
3120 3121 3122 3123 3124
	if (!kvm_vcpu_apicv_active(&svm->vcpu)) {
		svm_clear_vintr(svm);
		svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
		mark_dirty(svm->vmcb, VMCB_INTR);
	}
3125

3126 3127 3128
	return 1;
}

A
Avi Kivity 已提交
3129
static int invlpga_interception(struct vcpu_svm *svm)
A
Alexander Graf 已提交
3130 3131 3132
{
	struct kvm_vcpu *vcpu = &svm->vcpu;

3133 3134
	trace_kvm_invlpga(svm->vmcb->save.rip, kvm_register_read(&svm->vcpu, VCPU_REGS_RCX),
			  kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
3135

A
Alexander Graf 已提交
3136
	/* Let's treat INVLPGA the same as INVLPG (can be optimized!) */
3137
	kvm_mmu_invlpg(vcpu, kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
A
Alexander Graf 已提交
3138 3139 3140 3141 3142 3143

	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);
	return 1;
}

3144 3145
static int skinit_interception(struct vcpu_svm *svm)
{
3146
	trace_kvm_skinit(svm->vmcb->save.rip, kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
3147 3148 3149 3150 3151

	kvm_queue_exception(&svm->vcpu, UD_VECTOR);
	return 1;
}

D
David Kaplan 已提交
3152 3153
static int wbinvd_interception(struct vcpu_svm *svm)
{
3154
	return kvm_emulate_wbinvd(&svm->vcpu);
D
David Kaplan 已提交
3155 3156
}

J
Joerg Roedel 已提交
3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169
static int xsetbv_interception(struct vcpu_svm *svm)
{
	u64 new_bv = kvm_read_edx_eax(&svm->vcpu);
	u32 index = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);

	if (kvm_set_xcr(&svm->vcpu, index, new_bv) == 0) {
		svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
		skip_emulated_instruction(&svm->vcpu);
	}

	return 1;
}

A
Avi Kivity 已提交
3170
static int task_switch_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3171
{
3172
	u16 tss_selector;
3173 3174 3175
	int reason;
	int int_type = svm->vmcb->control.exit_int_info &
		SVM_EXITINTINFO_TYPE_MASK;
3176
	int int_vec = svm->vmcb->control.exit_int_info & SVM_EVTINJ_VEC_MASK;
3177 3178 3179 3180
	uint32_t type =
		svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_TYPE_MASK;
	uint32_t idt_v =
		svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_VALID;
3181 3182
	bool has_error_code = false;
	u32 error_code = 0;
3183 3184

	tss_selector = (u16)svm->vmcb->control.exit_info_1;
3185

3186 3187
	if (svm->vmcb->control.exit_info_2 &
	    (1ULL << SVM_EXITINFOSHIFT_TS_REASON_IRET))
3188 3189 3190 3191
		reason = TASK_SWITCH_IRET;
	else if (svm->vmcb->control.exit_info_2 &
		 (1ULL << SVM_EXITINFOSHIFT_TS_REASON_JMP))
		reason = TASK_SWITCH_JMP;
3192
	else if (idt_v)
3193 3194 3195 3196
		reason = TASK_SWITCH_GATE;
	else
		reason = TASK_SWITCH_CALL;

3197 3198 3199 3200 3201 3202
	if (reason == TASK_SWITCH_GATE) {
		switch (type) {
		case SVM_EXITINTINFO_TYPE_NMI:
			svm->vcpu.arch.nmi_injected = false;
			break;
		case SVM_EXITINTINFO_TYPE_EXEPT:
3203 3204 3205 3206 3207 3208
			if (svm->vmcb->control.exit_info_2 &
			    (1ULL << SVM_EXITINFOSHIFT_TS_HAS_ERROR_CODE)) {
				has_error_code = true;
				error_code =
					(u32)svm->vmcb->control.exit_info_2;
			}
3209 3210 3211 3212 3213 3214 3215 3216 3217
			kvm_clear_exception_queue(&svm->vcpu);
			break;
		case SVM_EXITINTINFO_TYPE_INTR:
			kvm_clear_interrupt_queue(&svm->vcpu);
			break;
		default:
			break;
		}
	}
3218

3219 3220 3221
	if (reason != TASK_SWITCH_GATE ||
	    int_type == SVM_EXITINTINFO_TYPE_SOFT ||
	    (int_type == SVM_EXITINTINFO_TYPE_EXEPT &&
3222 3223
	     (int_vec == OF_VECTOR || int_vec == BP_VECTOR)))
		skip_emulated_instruction(&svm->vcpu);
3224

3225 3226 3227 3228
	if (int_type != SVM_EXITINTINFO_TYPE_SOFT)
		int_vec = -1;

	if (kvm_task_switch(&svm->vcpu, tss_selector, int_vec, reason,
3229 3230 3231 3232 3233 3234 3235
				has_error_code, error_code) == EMULATE_FAIL) {
		svm->vcpu.run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
		svm->vcpu.run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
		svm->vcpu.run->internal.ndata = 0;
		return 0;
	}
	return 1;
A
Avi Kivity 已提交
3236 3237
}

A
Avi Kivity 已提交
3238
static int cpuid_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3239
{
3240
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
3241
	return kvm_emulate_cpuid(&svm->vcpu);
A
Avi Kivity 已提交
3242 3243
}

A
Avi Kivity 已提交
3244
static int iret_interception(struct vcpu_svm *svm)
3245 3246
{
	++svm->vcpu.stat.nmi_window_exits;
3247
	clr_intercept(svm, INTERCEPT_IRET);
3248
	svm->vcpu.arch.hflags |= HF_IRET_MASK;
3249
	svm->nmi_iret_rip = kvm_rip_read(&svm->vcpu);
3250
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3251 3252 3253
	return 1;
}

A
Avi Kivity 已提交
3254
static int invlpg_interception(struct vcpu_svm *svm)
M
Marcelo Tosatti 已提交
3255
{
3256 3257 3258 3259 3260 3261
	if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;

	kvm_mmu_invlpg(&svm->vcpu, svm->vmcb->control.exit_info_1);
	skip_emulated_instruction(&svm->vcpu);
	return 1;
M
Marcelo Tosatti 已提交
3262 3263
}

A
Avi Kivity 已提交
3264
static int emulate_on_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3265
{
3266
	return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
A
Avi Kivity 已提交
3267 3268
}

A
Avi Kivity 已提交
3269 3270 3271 3272 3273 3274 3275 3276
static int rdpmc_interception(struct vcpu_svm *svm)
{
	int err;

	if (!static_cpu_has(X86_FEATURE_NRIPS))
		return emulate_on_interception(svm);

	err = kvm_rdpmc(&svm->vcpu);
3277
	return kvm_complete_insn_gp(&svm->vcpu, err);
A
Avi Kivity 已提交
3278 3279
}

3280 3281
static bool check_selective_cr0_intercepted(struct vcpu_svm *svm,
					    unsigned long val)
3282 3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296 3297 3298 3299 3300 3301 3302 3303
{
	unsigned long cr0 = svm->vcpu.arch.cr0;
	bool ret = false;
	u64 intercept;

	intercept = svm->nested.intercept;

	if (!is_guest_mode(&svm->vcpu) ||
	    (!(intercept & (1ULL << INTERCEPT_SELECTIVE_CR0))))
		return false;

	cr0 &= ~SVM_CR0_SELECTIVE_MASK;
	val &= ~SVM_CR0_SELECTIVE_MASK;

	if (cr0 ^ val) {
		svm->vmcb->control.exit_code = SVM_EXIT_CR0_SEL_WRITE;
		ret = (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE);
	}

	return ret;
}

3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318
#define CR_VALID (1ULL << 63)

static int cr_interception(struct vcpu_svm *svm)
{
	int reg, cr;
	unsigned long val;
	int err;

	if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_on_interception(svm);

	if (unlikely((svm->vmcb->control.exit_info_1 & CR_VALID) == 0))
		return emulate_on_interception(svm);

	reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
3319 3320 3321 3322
	if (svm->vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE)
		cr = SVM_EXIT_WRITE_CR0 - SVM_EXIT_READ_CR0;
	else
		cr = svm->vmcb->control.exit_code - SVM_EXIT_READ_CR0;
3323 3324 3325 3326 3327 3328 3329

	err = 0;
	if (cr >= 16) { /* mov to cr */
		cr -= 16;
		val = kvm_register_read(&svm->vcpu, reg);
		switch (cr) {
		case 0:
3330 3331
			if (!check_selective_cr0_intercepted(svm, val))
				err = kvm_set_cr0(&svm->vcpu, val);
3332 3333 3334
			else
				return 1;

3335 3336 3337 3338 3339 3340 3341 3342 3343 3344 3345 3346 3347 3348 3349 3350 3351 3352 3353 3354 3355 3356 3357 3358
			break;
		case 3:
			err = kvm_set_cr3(&svm->vcpu, val);
			break;
		case 4:
			err = kvm_set_cr4(&svm->vcpu, val);
			break;
		case 8:
			err = kvm_set_cr8(&svm->vcpu, val);
			break;
		default:
			WARN(1, "unhandled write to CR%d", cr);
			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
			return 1;
		}
	} else { /* mov from cr */
		switch (cr) {
		case 0:
			val = kvm_read_cr0(&svm->vcpu);
			break;
		case 2:
			val = svm->vcpu.arch.cr2;
			break;
		case 3:
3359
			val = kvm_read_cr3(&svm->vcpu);
3360 3361 3362 3363 3364 3365 3366 3367 3368 3369 3370 3371 3372 3373
			break;
		case 4:
			val = kvm_read_cr4(&svm->vcpu);
			break;
		case 8:
			val = kvm_get_cr8(&svm->vcpu);
			break;
		default:
			WARN(1, "unhandled read from CR%d", cr);
			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
			return 1;
		}
		kvm_register_write(&svm->vcpu, reg, val);
	}
3374
	return kvm_complete_insn_gp(&svm->vcpu, err);
3375 3376
}

3377 3378 3379 3380 3381
static int dr_interception(struct vcpu_svm *svm)
{
	int reg, dr;
	unsigned long val;

3382 3383 3384 3385 3386 3387 3388 3389 3390 3391 3392
	if (svm->vcpu.guest_debug == 0) {
		/*
		 * No more DR vmexits; force a reload of the debug registers
		 * and reenter on this instruction.  The next vmexit will
		 * retrieve the full state of the debug registers.
		 */
		clr_dr_intercepts(svm);
		svm->vcpu.arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
		return 1;
	}

3393 3394 3395 3396 3397 3398 3399
	if (!boot_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_on_interception(svm);

	reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
	dr = svm->vmcb->control.exit_code - SVM_EXIT_READ_DR0;

	if (dr >= 16) { /* mov to DRn */
3400 3401
		if (!kvm_require_dr(&svm->vcpu, dr - 16))
			return 1;
3402 3403 3404
		val = kvm_register_read(&svm->vcpu, reg);
		kvm_set_dr(&svm->vcpu, dr - 16, val);
	} else {
3405 3406 3407 3408
		if (!kvm_require_dr(&svm->vcpu, dr))
			return 1;
		kvm_get_dr(&svm->vcpu, dr, &val);
		kvm_register_write(&svm->vcpu, reg, val);
3409 3410
	}

3411 3412
	skip_emulated_instruction(&svm->vcpu);

3413 3414 3415
	return 1;
}

A
Avi Kivity 已提交
3416
static int cr8_write_interception(struct vcpu_svm *svm)
3417
{
A
Avi Kivity 已提交
3418
	struct kvm_run *kvm_run = svm->vcpu.run;
A
Andre Przywara 已提交
3419
	int r;
A
Avi Kivity 已提交
3420

3421 3422
	u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
	/* instruction emulation calls kvm_set_cr8() */
3423
	r = cr_interception(svm);
3424
	if (lapic_in_kernel(&svm->vcpu))
3425
		return r;
3426
	if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
3427
		return r;
3428 3429 3430 3431
	kvm_run->exit_reason = KVM_EXIT_SET_TPR;
	return 0;
}

3432
static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
A
Avi Kivity 已提交
3433
{
3434 3435
	struct vcpu_svm *svm = to_svm(vcpu);

3436
	switch (msr_info->index) {
3437
	case MSR_IA32_TSC: {
3438
		msr_info->data = svm->vmcb->control.tsc_offset +
3439
			kvm_scale_tsc(vcpu, rdtsc());
3440

A
Avi Kivity 已提交
3441 3442
		break;
	}
B
Brian Gerst 已提交
3443
	case MSR_STAR:
3444
		msr_info->data = svm->vmcb->save.star;
A
Avi Kivity 已提交
3445
		break;
3446
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
3447
	case MSR_LSTAR:
3448
		msr_info->data = svm->vmcb->save.lstar;
A
Avi Kivity 已提交
3449 3450
		break;
	case MSR_CSTAR:
3451
		msr_info->data = svm->vmcb->save.cstar;
A
Avi Kivity 已提交
3452 3453
		break;
	case MSR_KERNEL_GS_BASE:
3454
		msr_info->data = svm->vmcb->save.kernel_gs_base;
A
Avi Kivity 已提交
3455 3456
		break;
	case MSR_SYSCALL_MASK:
3457
		msr_info->data = svm->vmcb->save.sfmask;
A
Avi Kivity 已提交
3458 3459 3460
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
3461
		msr_info->data = svm->vmcb->save.sysenter_cs;
A
Avi Kivity 已提交
3462 3463
		break;
	case MSR_IA32_SYSENTER_EIP:
3464
		msr_info->data = svm->sysenter_eip;
A
Avi Kivity 已提交
3465 3466
		break;
	case MSR_IA32_SYSENTER_ESP:
3467
		msr_info->data = svm->sysenter_esp;
A
Avi Kivity 已提交
3468
		break;
P
Paolo Bonzini 已提交
3469 3470 3471 3472 3473
	case MSR_TSC_AUX:
		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
			return 1;
		msr_info->data = svm->tsc_aux;
		break;
J
Joerg Roedel 已提交
3474 3475 3476 3477 3478
	/*
	 * Nobody will change the following 5 values in the VMCB so we can
	 * safely return them on rdmsr. They will always be 0 until LBRV is
	 * implemented.
	 */
3479
	case MSR_IA32_DEBUGCTLMSR:
3480
		msr_info->data = svm->vmcb->save.dbgctl;
3481 3482
		break;
	case MSR_IA32_LASTBRANCHFROMIP:
3483
		msr_info->data = svm->vmcb->save.br_from;
3484 3485
		break;
	case MSR_IA32_LASTBRANCHTOIP:
3486
		msr_info->data = svm->vmcb->save.br_to;
3487 3488
		break;
	case MSR_IA32_LASTINTFROMIP:
3489
		msr_info->data = svm->vmcb->save.last_excp_from;
3490 3491
		break;
	case MSR_IA32_LASTINTTOIP:
3492
		msr_info->data = svm->vmcb->save.last_excp_to;
3493
		break;
A
Alexander Graf 已提交
3494
	case MSR_VM_HSAVE_PA:
3495
		msr_info->data = svm->nested.hsave_msr;
A
Alexander Graf 已提交
3496
		break;
3497
	case MSR_VM_CR:
3498
		msr_info->data = svm->nested.vm_cr_msr;
3499
		break;
3500
	case MSR_IA32_UCODE_REV:
3501
		msr_info->data = 0x01000065;
3502
		break;
3503 3504 3505 3506 3507 3508 3509 3510 3511 3512 3513 3514 3515 3516 3517 3518 3519
	case MSR_F15H_IC_CFG: {

		int family, model;

		family = guest_cpuid_family(vcpu);
		model  = guest_cpuid_model(vcpu);

		if (family < 0 || model < 0)
			return kvm_get_msr_common(vcpu, msr_info);

		msr_info->data = 0;

		if (family == 0x15 &&
		    (model >= 0x2 && model < 0x20))
			msr_info->data = 0x1E;
		}
		break;
A
Avi Kivity 已提交
3520
	default:
3521
		return kvm_get_msr_common(vcpu, msr_info);
A
Avi Kivity 已提交
3522 3523 3524 3525
	}
	return 0;
}

A
Avi Kivity 已提交
3526
static int rdmsr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3527
{
3528
	u32 ecx = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);
3529
	struct msr_data msr_info;
A
Avi Kivity 已提交
3530

3531 3532 3533
	msr_info.index = ecx;
	msr_info.host_initiated = false;
	if (svm_get_msr(&svm->vcpu, &msr_info)) {
3534
		trace_kvm_msr_read_ex(ecx);
3535
		kvm_inject_gp(&svm->vcpu, 0);
3536
	} else {
3537
		trace_kvm_msr_read(ecx, msr_info.data);
3538

3539 3540 3541 3542
		kvm_register_write(&svm->vcpu, VCPU_REGS_RAX,
				   msr_info.data & 0xffffffff);
		kvm_register_write(&svm->vcpu, VCPU_REGS_RDX,
				   msr_info.data >> 32);
3543
		svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
3544
		skip_emulated_instruction(&svm->vcpu);
A
Avi Kivity 已提交
3545 3546 3547 3548
	}
	return 1;
}

3549 3550 3551 3552 3553 3554 3555 3556 3557 3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568 3569 3570 3571 3572 3573
static int svm_set_vm_cr(struct kvm_vcpu *vcpu, u64 data)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	int svm_dis, chg_mask;

	if (data & ~SVM_VM_CR_VALID_MASK)
		return 1;

	chg_mask = SVM_VM_CR_VALID_MASK;

	if (svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK)
		chg_mask &= ~(SVM_VM_CR_SVM_LOCK_MASK | SVM_VM_CR_SVM_DIS_MASK);

	svm->nested.vm_cr_msr &= ~chg_mask;
	svm->nested.vm_cr_msr |= (data & chg_mask);

	svm_dis = svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK;

	/* check for svm_disable while efer.svme is set */
	if (svm_dis && (vcpu->arch.efer & EFER_SVME))
		return 1;

	return 0;
}

3574
static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
A
Avi Kivity 已提交
3575
{
3576 3577
	struct vcpu_svm *svm = to_svm(vcpu);

3578 3579
	u32 ecx = msr->index;
	u64 data = msr->data;
A
Avi Kivity 已提交
3580
	switch (ecx) {
3581
	case MSR_IA32_TSC:
3582
		kvm_write_tsc(vcpu, msr);
A
Avi Kivity 已提交
3583
		break;
B
Brian Gerst 已提交
3584
	case MSR_STAR:
3585
		svm->vmcb->save.star = data;
A
Avi Kivity 已提交
3586
		break;
3587
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
3588
	case MSR_LSTAR:
3589
		svm->vmcb->save.lstar = data;
A
Avi Kivity 已提交
3590 3591
		break;
	case MSR_CSTAR:
3592
		svm->vmcb->save.cstar = data;
A
Avi Kivity 已提交
3593 3594
		break;
	case MSR_KERNEL_GS_BASE:
3595
		svm->vmcb->save.kernel_gs_base = data;
A
Avi Kivity 已提交
3596 3597
		break;
	case MSR_SYSCALL_MASK:
3598
		svm->vmcb->save.sfmask = data;
A
Avi Kivity 已提交
3599 3600 3601
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
3602
		svm->vmcb->save.sysenter_cs = data;
A
Avi Kivity 已提交
3603 3604
		break;
	case MSR_IA32_SYSENTER_EIP:
3605
		svm->sysenter_eip = data;
3606
		svm->vmcb->save.sysenter_eip = data;
A
Avi Kivity 已提交
3607 3608
		break;
	case MSR_IA32_SYSENTER_ESP:
3609
		svm->sysenter_esp = data;
3610
		svm->vmcb->save.sysenter_esp = data;
A
Avi Kivity 已提交
3611
		break;
P
Paolo Bonzini 已提交
3612 3613 3614 3615 3616 3617 3618 3619 3620 3621 3622 3623
	case MSR_TSC_AUX:
		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
			return 1;

		/*
		 * This is rare, so we update the MSR here instead of using
		 * direct_access_msrs.  Doing that would require a rdmsr in
		 * svm_vcpu_put.
		 */
		svm->tsc_aux = data;
		wrmsrl(MSR_TSC_AUX, svm->tsc_aux);
		break;
3624
	case MSR_IA32_DEBUGCTLMSR:
3625
		if (!boot_cpu_has(X86_FEATURE_LBRV)) {
3626 3627
			vcpu_unimpl(vcpu, "%s: MSR_IA32_DEBUGCTL 0x%llx, nop\n",
				    __func__, data);
3628 3629 3630 3631 3632 3633
			break;
		}
		if (data & DEBUGCTL_RESERVED_BITS)
			return 1;

		svm->vmcb->save.dbgctl = data;
3634
		mark_dirty(svm->vmcb, VMCB_LBR);
3635 3636 3637 3638
		if (data & (1ULL<<0))
			svm_enable_lbrv(svm);
		else
			svm_disable_lbrv(svm);
3639
		break;
A
Alexander Graf 已提交
3640
	case MSR_VM_HSAVE_PA:
3641
		svm->nested.hsave_msr = data;
3642
		break;
3643
	case MSR_VM_CR:
3644
		return svm_set_vm_cr(vcpu, data);
3645
	case MSR_VM_IGNNE:
3646
		vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
3647
		break;
3648 3649 3650 3651
	case MSR_IA32_APICBASE:
		if (kvm_vcpu_apicv_active(vcpu))
			avic_update_vapic_bar(to_svm(vcpu), data);
		/* Follow through */
A
Avi Kivity 已提交
3652
	default:
3653
		return kvm_set_msr_common(vcpu, msr);
A
Avi Kivity 已提交
3654 3655 3656 3657
	}
	return 0;
}

A
Avi Kivity 已提交
3658
static int wrmsr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3659
{
3660
	struct msr_data msr;
3661 3662
	u32 ecx = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);
	u64 data = kvm_read_edx_eax(&svm->vcpu);
3663

3664 3665 3666
	msr.data = data;
	msr.index = ecx;
	msr.host_initiated = false;
3667

3668
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
3669
	if (kvm_set_msr(&svm->vcpu, &msr)) {
3670
		trace_kvm_msr_write_ex(ecx, data);
3671
		kvm_inject_gp(&svm->vcpu, 0);
3672 3673
	} else {
		trace_kvm_msr_write(ecx, data);
R
Rusty Russell 已提交
3674
		skip_emulated_instruction(&svm->vcpu);
3675
	}
A
Avi Kivity 已提交
3676 3677 3678
	return 1;
}

A
Avi Kivity 已提交
3679
static int msr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3680
{
R
Rusty Russell 已提交
3681
	if (svm->vmcb->control.exit_info_1)
A
Avi Kivity 已提交
3682
		return wrmsr_interception(svm);
A
Avi Kivity 已提交
3683
	else
A
Avi Kivity 已提交
3684
		return rdmsr_interception(svm);
A
Avi Kivity 已提交
3685 3686
}

A
Avi Kivity 已提交
3687
static int interrupt_window_interception(struct vcpu_svm *svm)
3688
{
3689
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3690
	svm_clear_vintr(svm);
3691
	svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
3692
	mark_dirty(svm->vmcb, VMCB_INTR);
3693
	++svm->vcpu.stat.irq_window_exits;
3694 3695 3696
	return 1;
}

3697 3698 3699 3700 3701 3702
static int pause_interception(struct vcpu_svm *svm)
{
	kvm_vcpu_on_spin(&(svm->vcpu));
	return 1;
}

3703 3704 3705 3706 3707 3708 3709 3710 3711 3712 3713 3714 3715 3716 3717 3718 3719 3720
static int nop_interception(struct vcpu_svm *svm)
{
	skip_emulated_instruction(&(svm->vcpu));
	return 1;
}

static int monitor_interception(struct vcpu_svm *svm)
{
	printk_once(KERN_WARNING "kvm: MONITOR instruction emulated as NOP!\n");
	return nop_interception(svm);
}

static int mwait_interception(struct vcpu_svm *svm)
{
	printk_once(KERN_WARNING "kvm: MWAIT instruction emulated as NOP!\n");
	return nop_interception(svm);
}

3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732
enum avic_ipi_failure_cause {
	AVIC_IPI_FAILURE_INVALID_INT_TYPE,
	AVIC_IPI_FAILURE_TARGET_NOT_RUNNING,
	AVIC_IPI_FAILURE_INVALID_TARGET,
	AVIC_IPI_FAILURE_INVALID_BACKING_PAGE,
};

static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
{
	u32 icrh = svm->vmcb->control.exit_info_1 >> 32;
	u32 icrl = svm->vmcb->control.exit_info_1;
	u32 id = svm->vmcb->control.exit_info_2 >> 32;
D
Dan Carpenter 已提交
3733
	u32 index = svm->vmcb->control.exit_info_2 & 0xFF;
3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749 3750 3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977 3978 3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992
	struct kvm_lapic *apic = svm->vcpu.arch.apic;

	trace_kvm_avic_incomplete_ipi(svm->vcpu.vcpu_id, icrh, icrl, id, index);

	switch (id) {
	case AVIC_IPI_FAILURE_INVALID_INT_TYPE:
		/*
		 * AVIC hardware handles the generation of
		 * IPIs when the specified Message Type is Fixed
		 * (also known as fixed delivery mode) and
		 * the Trigger Mode is edge-triggered. The hardware
		 * also supports self and broadcast delivery modes
		 * specified via the Destination Shorthand(DSH)
		 * field of the ICRL. Logical and physical APIC ID
		 * formats are supported. All other IPI types cause
		 * a #VMEXIT, which needs to emulated.
		 */
		kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
		kvm_lapic_reg_write(apic, APIC_ICR, icrl);
		break;
	case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
		int i;
		struct kvm_vcpu *vcpu;
		struct kvm *kvm = svm->vcpu.kvm;
		struct kvm_lapic *apic = svm->vcpu.arch.apic;

		/*
		 * At this point, we expect that the AVIC HW has already
		 * set the appropriate IRR bits on the valid target
		 * vcpus. So, we just need to kick the appropriate vcpu.
		 */
		kvm_for_each_vcpu(i, vcpu, kvm) {
			bool m = kvm_apic_match_dest(vcpu, apic,
						     icrl & KVM_APIC_SHORT_MASK,
						     GET_APIC_DEST_FIELD(icrh),
						     icrl & KVM_APIC_DEST_MASK);

			if (m && !avic_vcpu_is_running(vcpu))
				kvm_vcpu_wake_up(vcpu);
		}
		break;
	}
	case AVIC_IPI_FAILURE_INVALID_TARGET:
		break;
	case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE:
		WARN_ONCE(1, "Invalid backing page\n");
		break;
	default:
		pr_err("Unknown IPI interception\n");
	}

	return 1;
}

static u32 *avic_get_logical_id_entry(struct kvm_vcpu *vcpu, u32 ldr, bool flat)
{
	struct kvm_arch *vm_data = &vcpu->kvm->arch;
	int index;
	u32 *logical_apic_id_table;
	int dlid = GET_APIC_LOGICAL_ID(ldr);

	if (!dlid)
		return NULL;

	if (flat) { /* flat */
		index = ffs(dlid) - 1;
		if (index > 7)
			return NULL;
	} else { /* cluster */
		int cluster = (dlid & 0xf0) >> 4;
		int apic = ffs(dlid & 0x0f) - 1;

		if ((apic < 0) || (apic > 7) ||
		    (cluster >= 0xf))
			return NULL;
		index = (cluster << 2) + apic;
	}

	logical_apic_id_table = (u32 *) page_address(vm_data->avic_logical_id_table_page);

	return &logical_apic_id_table[index];
}

static int avic_ldr_write(struct kvm_vcpu *vcpu, u8 g_physical_id, u32 ldr,
			  bool valid)
{
	bool flat;
	u32 *entry, new_entry;

	flat = kvm_lapic_get_reg(vcpu->arch.apic, APIC_DFR) == APIC_DFR_FLAT;
	entry = avic_get_logical_id_entry(vcpu, ldr, flat);
	if (!entry)
		return -EINVAL;

	new_entry = READ_ONCE(*entry);
	new_entry &= ~AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK;
	new_entry |= (g_physical_id & AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK);
	if (valid)
		new_entry |= AVIC_LOGICAL_ID_ENTRY_VALID_MASK;
	else
		new_entry &= ~AVIC_LOGICAL_ID_ENTRY_VALID_MASK;
	WRITE_ONCE(*entry, new_entry);

	return 0;
}

static int avic_handle_ldr_update(struct kvm_vcpu *vcpu)
{
	int ret;
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 ldr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_LDR);

	if (!ldr)
		return 1;

	ret = avic_ldr_write(vcpu, vcpu->vcpu_id, ldr, true);
	if (ret && svm->ldr_reg) {
		avic_ldr_write(vcpu, 0, svm->ldr_reg, false);
		svm->ldr_reg = 0;
	} else {
		svm->ldr_reg = ldr;
	}
	return ret;
}

static int avic_handle_apic_id_update(struct kvm_vcpu *vcpu)
{
	u64 *old, *new;
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 apic_id_reg = kvm_lapic_get_reg(vcpu->arch.apic, APIC_ID);
	u32 id = (apic_id_reg >> 24) & 0xff;

	if (vcpu->vcpu_id == id)
		return 0;

	old = avic_get_physical_id_entry(vcpu, vcpu->vcpu_id);
	new = avic_get_physical_id_entry(vcpu, id);
	if (!new || !old)
		return 1;

	/* We need to move physical_id_entry to new offset */
	*new = *old;
	*old = 0ULL;
	to_svm(vcpu)->avic_physical_id_cache = new;

	/*
	 * Also update the guest physical APIC ID in the logical
	 * APIC ID table entry if already setup the LDR.
	 */
	if (svm->ldr_reg)
		avic_handle_ldr_update(vcpu);

	return 0;
}

static int avic_handle_dfr_update(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct kvm_arch *vm_data = &vcpu->kvm->arch;
	u32 dfr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_DFR);
	u32 mod = (dfr >> 28) & 0xf;

	/*
	 * We assume that all local APICs are using the same type.
	 * If this changes, we need to flush the AVIC logical
	 * APID id table.
	 */
	if (vm_data->ldr_mode == mod)
		return 0;

	clear_page(page_address(vm_data->avic_logical_id_table_page));
	vm_data->ldr_mode = mod;

	if (svm->ldr_reg)
		avic_handle_ldr_update(vcpu);
	return 0;
}

static int avic_unaccel_trap_write(struct vcpu_svm *svm)
{
	struct kvm_lapic *apic = svm->vcpu.arch.apic;
	u32 offset = svm->vmcb->control.exit_info_1 &
				AVIC_UNACCEL_ACCESS_OFFSET_MASK;

	switch (offset) {
	case APIC_ID:
		if (avic_handle_apic_id_update(&svm->vcpu))
			return 0;
		break;
	case APIC_LDR:
		if (avic_handle_ldr_update(&svm->vcpu))
			return 0;
		break;
	case APIC_DFR:
		avic_handle_dfr_update(&svm->vcpu);
		break;
	default:
		break;
	}

	kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset));

	return 1;
}

static bool is_avic_unaccelerated_access_trap(u32 offset)
{
	bool ret = false;

	switch (offset) {
	case APIC_ID:
	case APIC_EOI:
	case APIC_RRR:
	case APIC_LDR:
	case APIC_DFR:
	case APIC_SPIV:
	case APIC_ESR:
	case APIC_ICR:
	case APIC_LVTT:
	case APIC_LVTTHMR:
	case APIC_LVTPC:
	case APIC_LVT0:
	case APIC_LVT1:
	case APIC_LVTERR:
	case APIC_TMICT:
	case APIC_TDCR:
		ret = true;
		break;
	default:
		break;
	}
	return ret;
}

static int avic_unaccelerated_access_interception(struct vcpu_svm *svm)
{
	int ret = 0;
	u32 offset = svm->vmcb->control.exit_info_1 &
		     AVIC_UNACCEL_ACCESS_OFFSET_MASK;
	u32 vector = svm->vmcb->control.exit_info_2 &
		     AVIC_UNACCEL_ACCESS_VECTOR_MASK;
	bool write = (svm->vmcb->control.exit_info_1 >> 32) &
		     AVIC_UNACCEL_ACCESS_WRITE_MASK;
	bool trap = is_avic_unaccelerated_access_trap(offset);

	trace_kvm_avic_unaccelerated_access(svm->vcpu.vcpu_id, offset,
					    trap, write, vector);
	if (trap) {
		/* Handling Trap */
		WARN_ONCE(!write, "svm: Handling trap read.\n");
		ret = avic_unaccel_trap_write(svm);
	} else {
		/* Handling Fault */
		ret = (emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE);
	}

	return ret;
}

3993
static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
3994 3995 3996 3997
	[SVM_EXIT_READ_CR0]			= cr_interception,
	[SVM_EXIT_READ_CR3]			= cr_interception,
	[SVM_EXIT_READ_CR4]			= cr_interception,
	[SVM_EXIT_READ_CR8]			= cr_interception,
3998
	[SVM_EXIT_CR0_SEL_WRITE]		= cr_interception,
3999
	[SVM_EXIT_WRITE_CR0]			= cr_interception,
4000 4001
	[SVM_EXIT_WRITE_CR3]			= cr_interception,
	[SVM_EXIT_WRITE_CR4]			= cr_interception,
J
Joerg Roedel 已提交
4002
	[SVM_EXIT_WRITE_CR8]			= cr8_write_interception,
4003 4004 4005 4006 4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018
	[SVM_EXIT_READ_DR0]			= dr_interception,
	[SVM_EXIT_READ_DR1]			= dr_interception,
	[SVM_EXIT_READ_DR2]			= dr_interception,
	[SVM_EXIT_READ_DR3]			= dr_interception,
	[SVM_EXIT_READ_DR4]			= dr_interception,
	[SVM_EXIT_READ_DR5]			= dr_interception,
	[SVM_EXIT_READ_DR6]			= dr_interception,
	[SVM_EXIT_READ_DR7]			= dr_interception,
	[SVM_EXIT_WRITE_DR0]			= dr_interception,
	[SVM_EXIT_WRITE_DR1]			= dr_interception,
	[SVM_EXIT_WRITE_DR2]			= dr_interception,
	[SVM_EXIT_WRITE_DR3]			= dr_interception,
	[SVM_EXIT_WRITE_DR4]			= dr_interception,
	[SVM_EXIT_WRITE_DR5]			= dr_interception,
	[SVM_EXIT_WRITE_DR6]			= dr_interception,
	[SVM_EXIT_WRITE_DR7]			= dr_interception,
J
Jan Kiszka 已提交
4019 4020
	[SVM_EXIT_EXCP_BASE + DB_VECTOR]	= db_interception,
	[SVM_EXIT_EXCP_BASE + BP_VECTOR]	= bp_interception,
4021
	[SVM_EXIT_EXCP_BASE + UD_VECTOR]	= ud_interception,
J
Joerg Roedel 已提交
4022 4023 4024
	[SVM_EXIT_EXCP_BASE + PF_VECTOR]	= pf_interception,
	[SVM_EXIT_EXCP_BASE + NM_VECTOR]	= nm_interception,
	[SVM_EXIT_EXCP_BASE + MC_VECTOR]	= mc_interception,
4025
	[SVM_EXIT_EXCP_BASE + AC_VECTOR]	= ac_interception,
J
Joerg Roedel 已提交
4026
	[SVM_EXIT_INTR]				= intr_interception,
4027
	[SVM_EXIT_NMI]				= nmi_interception,
A
Avi Kivity 已提交
4028 4029
	[SVM_EXIT_SMI]				= nop_on_interception,
	[SVM_EXIT_INIT]				= nop_on_interception,
4030
	[SVM_EXIT_VINTR]			= interrupt_window_interception,
A
Avi Kivity 已提交
4031
	[SVM_EXIT_RDPMC]			= rdpmc_interception,
A
Avi Kivity 已提交
4032
	[SVM_EXIT_CPUID]			= cpuid_interception,
4033
	[SVM_EXIT_IRET]                         = iret_interception,
4034
	[SVM_EXIT_INVD]                         = emulate_on_interception,
4035
	[SVM_EXIT_PAUSE]			= pause_interception,
A
Avi Kivity 已提交
4036
	[SVM_EXIT_HLT]				= halt_interception,
M
Marcelo Tosatti 已提交
4037
	[SVM_EXIT_INVLPG]			= invlpg_interception,
A
Alexander Graf 已提交
4038
	[SVM_EXIT_INVLPGA]			= invlpga_interception,
J
Joerg Roedel 已提交
4039
	[SVM_EXIT_IOIO]				= io_interception,
A
Avi Kivity 已提交
4040 4041
	[SVM_EXIT_MSR]				= msr_interception,
	[SVM_EXIT_TASK_SWITCH]			= task_switch_interception,
4042
	[SVM_EXIT_SHUTDOWN]			= shutdown_interception,
A
Alexander Graf 已提交
4043
	[SVM_EXIT_VMRUN]			= vmrun_interception,
4044
	[SVM_EXIT_VMMCALL]			= vmmcall_interception,
4045 4046
	[SVM_EXIT_VMLOAD]			= vmload_interception,
	[SVM_EXIT_VMSAVE]			= vmsave_interception,
4047 4048
	[SVM_EXIT_STGI]				= stgi_interception,
	[SVM_EXIT_CLGI]				= clgi_interception,
4049
	[SVM_EXIT_SKINIT]			= skinit_interception,
D
David Kaplan 已提交
4050
	[SVM_EXIT_WBINVD]                       = wbinvd_interception,
4051 4052
	[SVM_EXIT_MONITOR]			= monitor_interception,
	[SVM_EXIT_MWAIT]			= mwait_interception,
J
Joerg Roedel 已提交
4053
	[SVM_EXIT_XSETBV]			= xsetbv_interception,
4054
	[SVM_EXIT_NPF]				= pf_interception,
P
Paolo Bonzini 已提交
4055
	[SVM_EXIT_RSM]                          = emulate_on_interception,
4056 4057
	[SVM_EXIT_AVIC_INCOMPLETE_IPI]		= avic_incomplete_ipi_interception,
	[SVM_EXIT_AVIC_UNACCELERATED_ACCESS]	= avic_unaccelerated_access_interception,
A
Avi Kivity 已提交
4058 4059
};

4060
static void dump_vmcb(struct kvm_vcpu *vcpu)
4061 4062 4063 4064 4065 4066
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;

	pr_err("VMCB Control Area:\n");
4067 4068 4069 4070 4071 4072 4073 4074 4075 4076 4077 4078 4079 4080 4081 4082 4083 4084 4085 4086 4087 4088
	pr_err("%-20s%04x\n", "cr_read:", control->intercept_cr & 0xffff);
	pr_err("%-20s%04x\n", "cr_write:", control->intercept_cr >> 16);
	pr_err("%-20s%04x\n", "dr_read:", control->intercept_dr & 0xffff);
	pr_err("%-20s%04x\n", "dr_write:", control->intercept_dr >> 16);
	pr_err("%-20s%08x\n", "exceptions:", control->intercept_exceptions);
	pr_err("%-20s%016llx\n", "intercepts:", control->intercept);
	pr_err("%-20s%d\n", "pause filter count:", control->pause_filter_count);
	pr_err("%-20s%016llx\n", "iopm_base_pa:", control->iopm_base_pa);
	pr_err("%-20s%016llx\n", "msrpm_base_pa:", control->msrpm_base_pa);
	pr_err("%-20s%016llx\n", "tsc_offset:", control->tsc_offset);
	pr_err("%-20s%d\n", "asid:", control->asid);
	pr_err("%-20s%d\n", "tlb_ctl:", control->tlb_ctl);
	pr_err("%-20s%08x\n", "int_ctl:", control->int_ctl);
	pr_err("%-20s%08x\n", "int_vector:", control->int_vector);
	pr_err("%-20s%08x\n", "int_state:", control->int_state);
	pr_err("%-20s%08x\n", "exit_code:", control->exit_code);
	pr_err("%-20s%016llx\n", "exit_info1:", control->exit_info_1);
	pr_err("%-20s%016llx\n", "exit_info2:", control->exit_info_2);
	pr_err("%-20s%08x\n", "exit_int_info:", control->exit_int_info);
	pr_err("%-20s%08x\n", "exit_int_info_err:", control->exit_int_info_err);
	pr_err("%-20s%lld\n", "nested_ctl:", control->nested_ctl);
	pr_err("%-20s%016llx\n", "nested_cr3:", control->nested_cr3);
4089
	pr_err("%-20s%016llx\n", "avic_vapic_bar:", control->avic_vapic_bar);
4090 4091 4092 4093
	pr_err("%-20s%08x\n", "event_inj:", control->event_inj);
	pr_err("%-20s%08x\n", "event_inj_err:", control->event_inj_err);
	pr_err("%-20s%lld\n", "lbr_ctl:", control->lbr_ctl);
	pr_err("%-20s%016llx\n", "next_rip:", control->next_rip);
4094 4095 4096
	pr_err("%-20s%016llx\n", "avic_backing_page:", control->avic_backing_page);
	pr_err("%-20s%016llx\n", "avic_logical_id:", control->avic_logical_id);
	pr_err("%-20s%016llx\n", "avic_physical_id:", control->avic_physical_id);
4097
	pr_err("VMCB State Save Area:\n");
4098 4099 4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116 4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "es:",
	       save->es.selector, save->es.attrib,
	       save->es.limit, save->es.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "cs:",
	       save->cs.selector, save->cs.attrib,
	       save->cs.limit, save->cs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ss:",
	       save->ss.selector, save->ss.attrib,
	       save->ss.limit, save->ss.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ds:",
	       save->ds.selector, save->ds.attrib,
	       save->ds.limit, save->ds.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "fs:",
	       save->fs.selector, save->fs.attrib,
	       save->fs.limit, save->fs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "gs:",
	       save->gs.selector, save->gs.attrib,
	       save->gs.limit, save->gs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "gdtr:",
	       save->gdtr.selector, save->gdtr.attrib,
	       save->gdtr.limit, save->gdtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ldtr:",
	       save->ldtr.selector, save->ldtr.attrib,
	       save->ldtr.limit, save->ldtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "idtr:",
	       save->idtr.selector, save->idtr.attrib,
	       save->idtr.limit, save->idtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "tr:",
	       save->tr.selector, save->tr.attrib,
	       save->tr.limit, save->tr.base);
4138 4139
	pr_err("cpl:            %d                efer:         %016llx\n",
		save->cpl, save->efer);
4140 4141 4142 4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156 4157 4158 4159 4160 4161 4162 4163 4164 4165 4166
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cr0:", save->cr0, "cr2:", save->cr2);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cr3:", save->cr3, "cr4:", save->cr4);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "dr6:", save->dr6, "dr7:", save->dr7);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "rip:", save->rip, "rflags:", save->rflags);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "rsp:", save->rsp, "rax:", save->rax);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "star:", save->star, "lstar:", save->lstar);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cstar:", save->cstar, "sfmask:", save->sfmask);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "kernel_gs_base:", save->kernel_gs_base,
	       "sysenter_cs:", save->sysenter_cs);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "sysenter_esp:", save->sysenter_esp,
	       "sysenter_eip:", save->sysenter_eip);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "gpat:", save->g_pat, "dbgctl:", save->dbgctl);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "br_from:", save->br_from, "br_to:", save->br_to);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "excp_from:", save->last_excp_from,
	       "excp_to:", save->last_excp_to);
4167 4168
}

4169 4170 4171 4172 4173 4174 4175 4176
static void svm_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
{
	struct vmcb_control_area *control = &to_svm(vcpu)->vmcb->control;

	*info1 = control->exit_info_1;
	*info2 = control->exit_info_2;
}

A
Avi Kivity 已提交
4177
static int handle_exit(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4178
{
4179
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
4180
	struct kvm_run *kvm_run = vcpu->run;
4181
	u32 exit_code = svm->vmcb->control.exit_code;
A
Avi Kivity 已提交
4182

4183 4184
	trace_kvm_exit(exit_code, vcpu, KVM_ISA_SVM);

4185
	if (!is_cr_intercept(svm, INTERCEPT_CR0_WRITE))
4186 4187 4188
		vcpu->arch.cr0 = svm->vmcb->save.cr0;
	if (npt_enabled)
		vcpu->arch.cr3 = svm->vmcb->save.cr3;
4189

4190 4191 4192 4193 4194 4195 4196
	if (unlikely(svm->nested.exit_required)) {
		nested_svm_vmexit(svm);
		svm->nested.exit_required = false;

		return 1;
	}

4197
	if (is_guest_mode(vcpu)) {
4198 4199
		int vmexit;

4200 4201 4202 4203
		trace_kvm_nested_vmexit(svm->vmcb->save.rip, exit_code,
					svm->vmcb->control.exit_info_1,
					svm->vmcb->control.exit_info_2,
					svm->vmcb->control.exit_int_info,
4204 4205
					svm->vmcb->control.exit_int_info_err,
					KVM_ISA_SVM);
4206

4207 4208 4209 4210 4211 4212
		vmexit = nested_svm_exit_special(svm);

		if (vmexit == NESTED_EXIT_CONTINUE)
			vmexit = nested_svm_exit_handled(svm);

		if (vmexit == NESTED_EXIT_DONE)
4213 4214 4215
			return 1;
	}

4216 4217
	svm_complete_interrupts(svm);

4218 4219 4220 4221
	if (svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
		kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
		kvm_run->fail_entry.hardware_entry_failure_reason
			= svm->vmcb->control.exit_code;
4222 4223
		pr_err("KVM: FAILED VMRUN WITH VMCB:\n");
		dump_vmcb(vcpu);
4224 4225 4226
		return 0;
	}

4227
	if (is_external_interrupt(svm->vmcb->control.exit_int_info) &&
4228
	    exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR &&
4229 4230
	    exit_code != SVM_EXIT_NPF && exit_code != SVM_EXIT_TASK_SWITCH &&
	    exit_code != SVM_EXIT_INTR && exit_code != SVM_EXIT_NMI)
4231
		printk(KERN_ERR "%s: unexpected exit_int_info 0x%x "
A
Avi Kivity 已提交
4232
		       "exit_code 0x%x\n",
4233
		       __func__, svm->vmcb->control.exit_int_info,
A
Avi Kivity 已提交
4234 4235
		       exit_code);

4236
	if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
J
Joe Perches 已提交
4237
	    || !svm_exit_handlers[exit_code]) {
4238
		WARN_ONCE(1, "svm: unexpected exit reason 0x%x\n", exit_code);
4239 4240
		kvm_queue_exception(vcpu, UD_VECTOR);
		return 1;
A
Avi Kivity 已提交
4241 4242
	}

A
Avi Kivity 已提交
4243
	return svm_exit_handlers[exit_code](svm);
A
Avi Kivity 已提交
4244 4245 4246 4247 4248 4249
}

static void reload_tss(struct kvm_vcpu *vcpu)
{
	int cpu = raw_smp_processor_id();

4250 4251
	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
	sd->tss_desc->type = 9; /* available 32/64-bit TSS */
A
Avi Kivity 已提交
4252 4253 4254
	load_TR_desc();
}

R
Rusty Russell 已提交
4255
static void pre_svm_run(struct vcpu_svm *svm)
A
Avi Kivity 已提交
4256 4257 4258
{
	int cpu = raw_smp_processor_id();

4259
	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
A
Avi Kivity 已提交
4260

4261
	/* FIXME: handle wraparound of asid_generation */
4262 4263
	if (svm->asid_generation != sd->asid_generation)
		new_asid(svm, sd);
A
Avi Kivity 已提交
4264 4265
}

4266 4267 4268 4269 4270 4271
static void svm_inject_nmi(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
	vcpu->arch.hflags |= HF_NMI_MASK;
4272
	set_intercept(svm, INTERCEPT_IRET);
4273 4274
	++vcpu->stat.nmi_injections;
}
A
Avi Kivity 已提交
4275

4276
static inline void svm_inject_irq(struct vcpu_svm *svm, int irq)
A
Avi Kivity 已提交
4277 4278 4279
{
	struct vmcb_control_area *control;

4280
	/* The following fields are ignored when AVIC is enabled */
R
Rusty Russell 已提交
4281
	control = &svm->vmcb->control;
4282
	control->int_vector = irq;
A
Avi Kivity 已提交
4283 4284 4285
	control->int_ctl &= ~V_INTR_PRIO_MASK;
	control->int_ctl |= V_IRQ_MASK |
		((/*control->int_vector >> 4*/ 0xf) << V_INTR_PRIO_SHIFT);
4286
	mark_dirty(svm->vmcb, VMCB_INTR);
A
Avi Kivity 已提交
4287 4288
}

4289
static void svm_set_irq(struct kvm_vcpu *vcpu)
E
Eddie Dong 已提交
4290 4291 4292
{
	struct vcpu_svm *svm = to_svm(vcpu);

4293
	BUG_ON(!(gif_set(svm)));
4294

4295 4296 4297
	trace_kvm_inj_virq(vcpu->arch.interrupt.nr);
	++vcpu->stat.irq_injections;

4298 4299
	svm->vmcb->control.event_inj = vcpu->arch.interrupt.nr |
		SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR;
E
Eddie Dong 已提交
4300 4301
}

4302 4303 4304 4305 4306
static inline bool svm_nested_virtualize_tpr(struct kvm_vcpu *vcpu)
{
	return is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK);
}

4307
static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
4308 4309 4310
{
	struct vcpu_svm *svm = to_svm(vcpu);

4311 4312
	if (svm_nested_virtualize_tpr(vcpu) ||
	    kvm_vcpu_apicv_active(vcpu))
4313 4314
		return;

4315 4316
	clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);

4317
	if (irr == -1)
4318 4319
		return;

4320
	if (tpr >= irr)
4321
		set_cr_intercept(svm, INTERCEPT_CR8_WRITE);
4322
}
4323

4324 4325 4326 4327 4328
static void svm_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
{
	return;
}

4329 4330
static bool svm_get_enable_apicv(void)
{
4331 4332 4333 4334 4335
	return avic;
}

static void svm_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
{
4336 4337
}

4338
static void svm_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
4339
{
4340 4341
}

4342
/* Note: Currently only used by Hyper-V. */
4343
static void svm_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
4344
{
4345 4346 4347 4348 4349 4350 4351 4352
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;

	if (!avic)
		return;

	vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
	mark_dirty(vmcb, VMCB_INTR);
4353 4354
}

4355
static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
4356 4357 4358 4359
{
	return;
}

4360 4361 4362 4363 4364
static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu)
{
	return;
}

4365 4366 4367 4368 4369 4370 4371
static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
{
	kvm_lapic_set_irr(vec, vcpu->arch.apic);
	smp_mb__after_atomic();

	if (avic_vcpu_is_running(vcpu))
		wrmsrl(SVM_AVIC_DOORBELL,
4372
		       kvm_cpu_get_apicid(vcpu->cpu));
4373 4374 4375 4376
	else
		kvm_vcpu_wake_up(vcpu);
}

4377 4378 4379 4380 4381 4382 4383 4384 4385 4386 4387 4388 4389 4390 4391 4392 4393 4394 4395 4396 4397 4398 4399 4400 4401 4402 4403 4404 4405 4406 4407 4408 4409 4410 4411 4412 4413 4414 4415 4416 4417 4418 4419 4420 4421 4422 4423 4424 4425 4426 4427 4428 4429 4430 4431 4432 4433 4434 4435 4436 4437 4438 4439 4440 4441 4442 4443 4444 4445 4446 4447 4448 4449 4450 4451 4452 4453 4454 4455 4456 4457 4458 4459 4460 4461 4462 4463 4464 4465 4466 4467 4468 4469 4470 4471 4472 4473 4474 4475 4476 4477 4478 4479 4480 4481 4482 4483 4484 4485 4486 4487 4488 4489 4490 4491 4492 4493 4494 4495 4496 4497 4498 4499 4500 4501 4502 4503 4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531 4532 4533 4534 4535 4536 4537 4538 4539 4540 4541 4542 4543 4544 4545 4546 4547 4548 4549 4550 4551 4552 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 4563 4564 4565 4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578 4579
static void svm_ir_list_del(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
{
	unsigned long flags;
	struct amd_svm_iommu_ir *cur;

	spin_lock_irqsave(&svm->ir_list_lock, flags);
	list_for_each_entry(cur, &svm->ir_list, node) {
		if (cur->data != pi->ir_data)
			continue;
		list_del(&cur->node);
		kfree(cur);
		break;
	}
	spin_unlock_irqrestore(&svm->ir_list_lock, flags);
}

static int svm_ir_list_add(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
{
	int ret = 0;
	unsigned long flags;
	struct amd_svm_iommu_ir *ir;

	/**
	 * In some cases, the existing irte is updaed and re-set,
	 * so we need to check here if it's already been * added
	 * to the ir_list.
	 */
	if (pi->ir_data && (pi->prev_ga_tag != 0)) {
		struct kvm *kvm = svm->vcpu.kvm;
		u32 vcpu_id = AVIC_GATAG_TO_VCPUID(pi->prev_ga_tag);
		struct kvm_vcpu *prev_vcpu = kvm_get_vcpu_by_id(kvm, vcpu_id);
		struct vcpu_svm *prev_svm;

		if (!prev_vcpu) {
			ret = -EINVAL;
			goto out;
		}

		prev_svm = to_svm(prev_vcpu);
		svm_ir_list_del(prev_svm, pi);
	}

	/**
	 * Allocating new amd_iommu_pi_data, which will get
	 * add to the per-vcpu ir_list.
	 */
	ir = kzalloc(sizeof(struct amd_svm_iommu_ir), GFP_KERNEL);
	if (!ir) {
		ret = -ENOMEM;
		goto out;
	}
	ir->data = pi->ir_data;

	spin_lock_irqsave(&svm->ir_list_lock, flags);
	list_add(&ir->node, &svm->ir_list);
	spin_unlock_irqrestore(&svm->ir_list_lock, flags);
out:
	return ret;
}

/**
 * Note:
 * The HW cannot support posting multicast/broadcast
 * interrupts to a vCPU. So, we still use legacy interrupt
 * remapping for these kind of interrupts.
 *
 * For lowest-priority interrupts, we only support
 * those with single CPU as the destination, e.g. user
 * configures the interrupts via /proc/irq or uses
 * irqbalance to make the interrupts single-CPU.
 */
static int
get_pi_vcpu_info(struct kvm *kvm, struct kvm_kernel_irq_routing_entry *e,
		 struct vcpu_data *vcpu_info, struct vcpu_svm **svm)
{
	struct kvm_lapic_irq irq;
	struct kvm_vcpu *vcpu = NULL;

	kvm_set_msi_irq(kvm, e, &irq);

	if (!kvm_intr_is_single_vcpu(kvm, &irq, &vcpu)) {
		pr_debug("SVM: %s: use legacy intr remap mode for irq %u\n",
			 __func__, irq.vector);
		return -1;
	}

	pr_debug("SVM: %s: use GA mode for irq %u\n", __func__,
		 irq.vector);
	*svm = to_svm(vcpu);
	vcpu_info->pi_desc_addr = page_to_phys((*svm)->avic_backing_page);
	vcpu_info->vector = irq.vector;

	return 0;
}

/*
 * svm_update_pi_irte - set IRTE for Posted-Interrupts
 *
 * @kvm: kvm
 * @host_irq: host irq of the interrupt
 * @guest_irq: gsi of the interrupt
 * @set: set or unset PI
 * returns 0 on success, < 0 on failure
 */
static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
			      uint32_t guest_irq, bool set)
{
	struct kvm_kernel_irq_routing_entry *e;
	struct kvm_irq_routing_table *irq_rt;
	int idx, ret = -EINVAL;

	if (!kvm_arch_has_assigned_device(kvm) ||
	    !irq_remapping_cap(IRQ_POSTING_CAP))
		return 0;

	pr_debug("SVM: %s: host_irq=%#x, guest_irq=%#x, set=%#x\n",
		 __func__, host_irq, guest_irq, set);

	idx = srcu_read_lock(&kvm->irq_srcu);
	irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
	WARN_ON(guest_irq >= irq_rt->nr_rt_entries);

	hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
		struct vcpu_data vcpu_info;
		struct vcpu_svm *svm = NULL;

		if (e->type != KVM_IRQ_ROUTING_MSI)
			continue;

		/**
		 * Here, we setup with legacy mode in the following cases:
		 * 1. When cannot target interrupt to a specific vcpu.
		 * 2. Unsetting posted interrupt.
		 * 3. APIC virtialization is disabled for the vcpu.
		 */
		if (!get_pi_vcpu_info(kvm, e, &vcpu_info, &svm) && set &&
		    kvm_vcpu_apicv_active(&svm->vcpu)) {
			struct amd_iommu_pi_data pi;

			/* Try to enable guest_mode in IRTE */
			pi.base = page_to_phys(svm->avic_backing_page) & AVIC_HPA_MASK;
			pi.ga_tag = AVIC_GATAG(kvm->arch.avic_vm_id,
						     svm->vcpu.vcpu_id);
			pi.is_guest_mode = true;
			pi.vcpu_data = &vcpu_info;
			ret = irq_set_vcpu_affinity(host_irq, &pi);

			/**
			 * Here, we successfully setting up vcpu affinity in
			 * IOMMU guest mode. Now, we need to store the posted
			 * interrupt information in a per-vcpu ir_list so that
			 * we can reference to them directly when we update vcpu
			 * scheduling information in IOMMU irte.
			 */
			if (!ret && pi.is_guest_mode)
				svm_ir_list_add(svm, &pi);
		} else {
			/* Use legacy mode in IRTE */
			struct amd_iommu_pi_data pi;

			/**
			 * Here, pi is used to:
			 * - Tell IOMMU to use legacy mode for this interrupt.
			 * - Retrieve ga_tag of prior interrupt remapping data.
			 */
			pi.is_guest_mode = false;
			ret = irq_set_vcpu_affinity(host_irq, &pi);

			/**
			 * Check if the posted interrupt was previously
			 * setup with the guest_mode by checking if the ga_tag
			 * was cached. If so, we need to clean up the per-vcpu
			 * ir_list.
			 */
			if (!ret && pi.prev_ga_tag) {
				int id = AVIC_GATAG_TO_VCPUID(pi.prev_ga_tag);
				struct kvm_vcpu *vcpu;

				vcpu = kvm_get_vcpu_by_id(kvm, id);
				if (vcpu)
					svm_ir_list_del(to_svm(vcpu), &pi);
			}
		}

		if (!ret && svm) {
			trace_kvm_pi_irte_update(svm->vcpu.vcpu_id,
						 host_irq, e->gsi,
						 vcpu_info.vector,
						 vcpu_info.pi_desc_addr, set);
		}

		if (ret < 0) {
			pr_err("%s: failed to update PI IRTE\n", __func__);
			goto out;
		}
	}

	ret = 0;
out:
	srcu_read_unlock(&kvm->irq_srcu, idx);
	return ret;
}

4580 4581 4582 4583
static int svm_nmi_allowed(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
J
Joerg Roedel 已提交
4584 4585 4586 4587 4588 4589
	int ret;
	ret = !(vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK) &&
	      !(svm->vcpu.arch.hflags & HF_NMI_MASK);
	ret = ret && gif_set(svm) && nested_svm_nmi(svm);

	return ret;
4590 4591
}

J
Jan Kiszka 已提交
4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604
static bool svm_get_nmi_mask(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	return !!(svm->vcpu.arch.hflags & HF_NMI_MASK);
}

static void svm_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (masked) {
		svm->vcpu.arch.hflags |= HF_NMI_MASK;
4605
		set_intercept(svm, INTERCEPT_IRET);
J
Jan Kiszka 已提交
4606 4607
	} else {
		svm->vcpu.arch.hflags &= ~HF_NMI_MASK;
4608
		clr_intercept(svm, INTERCEPT_IRET);
J
Jan Kiszka 已提交
4609 4610 4611
	}
}

4612 4613 4614 4615
static int svm_interrupt_allowed(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
4616 4617 4618 4619 4620 4621
	int ret;

	if (!gif_set(svm) ||
	     (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK))
		return 0;

4622
	ret = !!(kvm_get_rflags(vcpu) & X86_EFLAGS_IF);
4623

4624
	if (is_guest_mode(vcpu))
4625 4626 4627
		return ret && !(svm->vcpu.arch.hflags & HF_VINTR_MASK);

	return ret;
4628 4629
}

4630
static void enable_irq_window(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4631
{
4632 4633
	struct vcpu_svm *svm = to_svm(vcpu);

4634 4635 4636
	if (kvm_vcpu_apicv_active(vcpu))
		return;

J
Joerg Roedel 已提交
4637 4638 4639 4640 4641 4642
	/*
	 * In case GIF=0 we can't rely on the CPU to tell us when GIF becomes
	 * 1, because that's a separate STGI/VMRUN intercept.  The next time we
	 * get that intercept, this function will be called again though and
	 * we'll get the vintr intercept.
	 */
4643
	if (gif_set(svm) && nested_svm_intr(svm)) {
4644 4645 4646
		svm_set_vintr(svm);
		svm_inject_irq(svm, 0x0);
	}
4647 4648
}

4649
static void enable_nmi_window(struct kvm_vcpu *vcpu)
4650
{
4651
	struct vcpu_svm *svm = to_svm(vcpu);
4652

4653 4654
	if ((svm->vcpu.arch.hflags & (HF_NMI_MASK | HF_IRET_MASK))
	    == HF_NMI_MASK)
4655
		return; /* IRET will cause a vm exit */
4656

J
Joerg Roedel 已提交
4657 4658 4659 4660
	/*
	 * Something prevents NMI from been injected. Single step over possible
	 * problem (IRET or exception injection or interrupt shadow)
	 */
J
Jan Kiszka 已提交
4661
	svm->nmi_singlestep = true;
4662
	svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
4663 4664
}

4665 4666 4667 4668 4669
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
{
	return 0;
}

4670 4671
static void svm_flush_tlb(struct kvm_vcpu *vcpu)
{
4672 4673 4674 4675 4676 4677
	struct vcpu_svm *svm = to_svm(vcpu);

	if (static_cpu_has(X86_FEATURE_FLUSHBYASID))
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ASID;
	else
		svm->asid_generation--;
4678 4679
}

4680 4681 4682 4683
static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
{
}

4684 4685 4686 4687
static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

4688
	if (svm_nested_virtualize_tpr(vcpu))
4689 4690
		return;

4691
	if (!is_cr_intercept(svm, INTERCEPT_CR8_WRITE)) {
4692
		int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK;
4693
		kvm_set_cr8(vcpu, cr8);
4694 4695 4696
	}
}

4697 4698 4699 4700 4701
static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 cr8;

4702 4703
	if (svm_nested_virtualize_tpr(vcpu) ||
	    kvm_vcpu_apicv_active(vcpu))
4704 4705
		return;

4706 4707 4708 4709 4710
	cr8 = kvm_get_cr8(vcpu);
	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
}

4711 4712 4713 4714 4715
static void svm_complete_interrupts(struct vcpu_svm *svm)
{
	u8 vector;
	int type;
	u32 exitintinfo = svm->vmcb->control.exit_int_info;
4716 4717 4718
	unsigned int3_injected = svm->int3_injected;

	svm->int3_injected = 0;
4719

4720 4721 4722 4723 4724 4725
	/*
	 * If we've made progress since setting HF_IRET_MASK, we've
	 * executed an IRET and can allow NMI injection.
	 */
	if ((svm->vcpu.arch.hflags & HF_IRET_MASK)
	    && kvm_rip_read(&svm->vcpu) != svm->nmi_iret_rip) {
4726
		svm->vcpu.arch.hflags &= ~(HF_NMI_MASK | HF_IRET_MASK);
4727 4728
		kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
	}
4729

4730 4731 4732 4733 4734 4735 4736
	svm->vcpu.arch.nmi_injected = false;
	kvm_clear_exception_queue(&svm->vcpu);
	kvm_clear_interrupt_queue(&svm->vcpu);

	if (!(exitintinfo & SVM_EXITINTINFO_VALID))
		return;

4737 4738
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);

4739 4740 4741 4742 4743 4744 4745 4746
	vector = exitintinfo & SVM_EXITINTINFO_VEC_MASK;
	type = exitintinfo & SVM_EXITINTINFO_TYPE_MASK;

	switch (type) {
	case SVM_EXITINTINFO_TYPE_NMI:
		svm->vcpu.arch.nmi_injected = true;
		break;
	case SVM_EXITINTINFO_TYPE_EXEPT:
4747 4748 4749 4750 4751 4752 4753 4754 4755 4756 4757
		/*
		 * In case of software exceptions, do not reinject the vector,
		 * but re-execute the instruction instead. Rewind RIP first
		 * if we emulated INT3 before.
		 */
		if (kvm_exception_is_soft(vector)) {
			if (vector == BP_VECTOR && int3_injected &&
			    kvm_is_linear_rip(&svm->vcpu, svm->int3_rip))
				kvm_rip_write(&svm->vcpu,
					      kvm_rip_read(&svm->vcpu) -
					      int3_injected);
4758
			break;
4759
		}
4760 4761
		if (exitintinfo & SVM_EXITINTINFO_VALID_ERR) {
			u32 err = svm->vmcb->control.exit_int_info_err;
4762
			kvm_requeue_exception_e(&svm->vcpu, vector, err);
4763 4764

		} else
4765
			kvm_requeue_exception(&svm->vcpu, vector);
4766 4767
		break;
	case SVM_EXITINTINFO_TYPE_INTR:
4768
		kvm_queue_interrupt(&svm->vcpu, vector, false);
4769 4770 4771 4772 4773 4774
		break;
	default:
		break;
	}
}

A
Avi Kivity 已提交
4775 4776 4777 4778 4779 4780 4781 4782 4783 4784 4785
static void svm_cancel_injection(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;

	control->exit_int_info = control->event_inj;
	control->exit_int_info_err = control->event_inj_err;
	control->event_inj = 0;
	svm_complete_interrupts(svm);
}

A
Avi Kivity 已提交
4786
static void svm_vcpu_run(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4787
{
4788
	struct vcpu_svm *svm = to_svm(vcpu);
4789

4790 4791 4792 4793
	svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
	svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
	svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];

4794 4795 4796 4797 4798 4799 4800
	/*
	 * A vmexit emulation is required before the vcpu can be executed
	 * again.
	 */
	if (unlikely(svm->nested.exit_required))
		return;

R
Rusty Russell 已提交
4801
	pre_svm_run(svm);
A
Avi Kivity 已提交
4802

4803 4804
	sync_lapic_to_cr8(vcpu);

4805
	svm->vmcb->save.cr2 = vcpu->arch.cr2;
A
Avi Kivity 已提交
4806

4807 4808 4809
	clgi();

	local_irq_enable();
4810

A
Avi Kivity 已提交
4811
	asm volatile (
A
Avi Kivity 已提交
4812 4813 4814 4815 4816 4817 4818
		"push %%" _ASM_BP "; \n\t"
		"mov %c[rbx](%[svm]), %%" _ASM_BX " \n\t"
		"mov %c[rcx](%[svm]), %%" _ASM_CX " \n\t"
		"mov %c[rdx](%[svm]), %%" _ASM_DX " \n\t"
		"mov %c[rsi](%[svm]), %%" _ASM_SI " \n\t"
		"mov %c[rdi](%[svm]), %%" _ASM_DI " \n\t"
		"mov %c[rbp](%[svm]), %%" _ASM_BP " \n\t"
4819
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
4820 4821 4822 4823 4824 4825 4826 4827
		"mov %c[r8](%[svm]),  %%r8  \n\t"
		"mov %c[r9](%[svm]),  %%r9  \n\t"
		"mov %c[r10](%[svm]), %%r10 \n\t"
		"mov %c[r11](%[svm]), %%r11 \n\t"
		"mov %c[r12](%[svm]), %%r12 \n\t"
		"mov %c[r13](%[svm]), %%r13 \n\t"
		"mov %c[r14](%[svm]), %%r14 \n\t"
		"mov %c[r15](%[svm]), %%r15 \n\t"
A
Avi Kivity 已提交
4828 4829 4830
#endif

		/* Enter guest mode */
A
Avi Kivity 已提交
4831 4832
		"push %%" _ASM_AX " \n\t"
		"mov %c[vmcb](%[svm]), %%" _ASM_AX " \n\t"
4833 4834 4835
		__ex(SVM_VMLOAD) "\n\t"
		__ex(SVM_VMRUN) "\n\t"
		__ex(SVM_VMSAVE) "\n\t"
A
Avi Kivity 已提交
4836
		"pop %%" _ASM_AX " \n\t"
A
Avi Kivity 已提交
4837 4838

		/* Save guest registers, load host registers */
A
Avi Kivity 已提交
4839 4840 4841 4842 4843 4844
		"mov %%" _ASM_BX ", %c[rbx](%[svm]) \n\t"
		"mov %%" _ASM_CX ", %c[rcx](%[svm]) \n\t"
		"mov %%" _ASM_DX ", %c[rdx](%[svm]) \n\t"
		"mov %%" _ASM_SI ", %c[rsi](%[svm]) \n\t"
		"mov %%" _ASM_DI ", %c[rdi](%[svm]) \n\t"
		"mov %%" _ASM_BP ", %c[rbp](%[svm]) \n\t"
4845
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
4846 4847 4848 4849 4850 4851 4852 4853
		"mov %%r8,  %c[r8](%[svm]) \n\t"
		"mov %%r9,  %c[r9](%[svm]) \n\t"
		"mov %%r10, %c[r10](%[svm]) \n\t"
		"mov %%r11, %c[r11](%[svm]) \n\t"
		"mov %%r12, %c[r12](%[svm]) \n\t"
		"mov %%r13, %c[r13](%[svm]) \n\t"
		"mov %%r14, %c[r14](%[svm]) \n\t"
		"mov %%r15, %c[r15](%[svm]) \n\t"
A
Avi Kivity 已提交
4854
#endif
A
Avi Kivity 已提交
4855
		"pop %%" _ASM_BP
A
Avi Kivity 已提交
4856
		:
R
Rusty Russell 已提交
4857
		: [svm]"a"(svm),
A
Avi Kivity 已提交
4858
		  [vmcb]"i"(offsetof(struct vcpu_svm, vmcb_pa)),
4859 4860 4861 4862 4863 4864
		  [rbx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBX])),
		  [rcx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RCX])),
		  [rdx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDX])),
		  [rsi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RSI])),
		  [rdi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDI])),
		  [rbp]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBP]))
4865
#ifdef CONFIG_X86_64
4866 4867 4868 4869 4870 4871 4872 4873
		  , [r8]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R8])),
		  [r9]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R9])),
		  [r10]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R10])),
		  [r11]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R11])),
		  [r12]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R12])),
		  [r13]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R13])),
		  [r14]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R14])),
		  [r15]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R15]))
A
Avi Kivity 已提交
4874
#endif
4875 4876
		: "cc", "memory"
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
4877
		, "rbx", "rcx", "rdx", "rsi", "rdi"
4878
		, "r8", "r9", "r10", "r11" , "r12", "r13", "r14", "r15"
A
Avi Kivity 已提交
4879 4880
#else
		, "ebx", "ecx", "edx", "esi", "edi"
4881 4882
#endif
		);
A
Avi Kivity 已提交
4883

4884 4885 4886
#ifdef CONFIG_X86_64
	wrmsrl(MSR_GS_BASE, svm->host.gs_base);
#else
4887
	loadsegment(fs, svm->host.fs);
4888 4889 4890
#ifndef CONFIG_X86_32_LAZY_GS
	loadsegment(gs, svm->host.gs);
#endif
4891
#endif
A
Avi Kivity 已提交
4892 4893 4894

	reload_tss(vcpu);

4895 4896
	local_irq_disable();

4897 4898 4899 4900 4901
	vcpu->arch.cr2 = svm->vmcb->save.cr2;
	vcpu->arch.regs[VCPU_REGS_RAX] = svm->vmcb->save.rax;
	vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
	vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;

4902 4903 4904 4905 4906 4907 4908 4909 4910 4911
	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
		kvm_before_handle_nmi(&svm->vcpu);

	stgi();

	/* Any pending NMI will happen here */

	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
		kvm_after_handle_nmi(&svm->vcpu);

4912 4913
	sync_cr8_to_lapic(vcpu);

4914
	svm->next_rip = 0;
4915

4916 4917
	svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;

G
Gleb Natapov 已提交
4918 4919 4920 4921
	/* if exit due to PF check for async PF */
	if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
		svm->apf_reason = kvm_read_and_reset_pf_reason();

A
Avi Kivity 已提交
4922 4923 4924 4925
	if (npt_enabled) {
		vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
		vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
	}
4926 4927 4928 4929 4930 4931 4932 4933

	/*
	 * We need to handle MC intercepts here before the vcpu has a chance to
	 * change the physical cpu
	 */
	if (unlikely(svm->vmcb->control.exit_code ==
		     SVM_EXIT_EXCP_BASE + MC_VECTOR))
		svm_handle_mce(svm);
4934 4935

	mark_all_clean(svm->vmcb);
A
Avi Kivity 已提交
4936 4937 4938 4939
}

static void svm_set_cr3(struct kvm_vcpu *vcpu, unsigned long root)
{
4940 4941 4942
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.cr3 = root;
4943
	mark_dirty(svm->vmcb, VMCB_CR);
4944
	svm_flush_tlb(vcpu);
A
Avi Kivity 已提交
4945 4946
}

4947 4948 4949 4950 4951
static void set_tdp_cr3(struct kvm_vcpu *vcpu, unsigned long root)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.nested_cr3 = root;
4952
	mark_dirty(svm->vmcb, VMCB_NPT);
4953 4954

	/* Also sync guest cr3 here in case we live migrate */
4955
	svm->vmcb->save.cr3 = kvm_read_cr3(vcpu);
4956
	mark_dirty(svm->vmcb, VMCB_CR);
4957

4958
	svm_flush_tlb(vcpu);
4959 4960
}

A
Avi Kivity 已提交
4961 4962
static int is_disabled(void)
{
4963 4964 4965 4966 4967 4968
	u64 vm_cr;

	rdmsrl(MSR_VM_CR, vm_cr);
	if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE))
		return 1;

A
Avi Kivity 已提交
4969 4970 4971
	return 0;
}

I
Ingo Molnar 已提交
4972 4973 4974 4975 4976 4977 4978 4979 4980 4981 4982
static void
svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
{
	/*
	 * Patch in the VMMCALL instruction:
	 */
	hypercall[0] = 0x0f;
	hypercall[1] = 0x01;
	hypercall[2] = 0xd9;
}

Y
Yang, Sheng 已提交
4983 4984 4985 4986 4987
static void svm_check_processor_compat(void *rtn)
{
	*(int *)rtn = 0;
}

4988 4989 4990 4991 4992
static bool svm_cpu_has_accelerated_tpr(void)
{
	return false;
}

4993 4994 4995 4996 4997
static bool svm_has_high_real_mode_segbase(void)
{
	return true;
}

4998 4999 5000 5001 5002
static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
{
	return 0;
}

5003 5004
static void svm_cpuid_update(struct kvm_vcpu *vcpu)
{
5005
	struct vcpu_svm *svm = to_svm(vcpu);
5006
	struct kvm_cpuid_entry2 *entry;
5007 5008 5009

	/* Update nrips enabled cache */
	svm->nrips_enabled = !!guest_cpuid_has_nrips(&svm->vcpu);
5010 5011 5012 5013 5014 5015 5016

	if (!kvm_vcpu_apicv_active(vcpu))
		return;

	entry = kvm_find_cpuid_entry(vcpu, 1, 0);
	if (entry)
		entry->ecx &= ~bit(X86_FEATURE_X2APIC);
5017 5018
}

5019 5020
static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
{
5021
	switch (func) {
5022 5023 5024 5025
	case 0x1:
		if (avic)
			entry->ecx &= ~bit(X86_FEATURE_X2APIC);
		break;
5026 5027 5028 5029
	case 0x80000001:
		if (nested)
			entry->ecx |= (1 << 2); /* Set SVM bit */
		break;
5030 5031 5032 5033 5034
	case 0x8000000A:
		entry->eax = 1; /* SVM revision 1 */
		entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper
				   ASID emulation to nested SVM */
		entry->ecx = 0; /* Reserved */
5035 5036 5037 5038
		entry->edx = 0; /* Per default do not support any
				   additional features */

		/* Support next_rip if host supports it */
5039
		if (boot_cpu_has(X86_FEATURE_NRIPS))
5040
			entry->edx |= SVM_FEATURE_NRIP;
5041

5042 5043 5044 5045
		/* Support NPT for the guest if enabled */
		if (npt_enabled)
			entry->edx |= SVM_FEATURE_NPT;

5046 5047
		break;
	}
5048 5049
}

5050
static int svm_get_lpage_level(void)
5051
{
5052
	return PT_PDPE_LEVEL;
5053 5054
}

5055 5056
static bool svm_rdtscp_supported(void)
{
P
Paolo Bonzini 已提交
5057
	return boot_cpu_has(X86_FEATURE_RDTSCP);
5058 5059
}

5060 5061 5062 5063 5064
static bool svm_invpcid_supported(void)
{
	return false;
}

5065 5066 5067 5068 5069
static bool svm_mpx_supported(void)
{
	return false;
}

5070 5071 5072 5073 5074
static bool svm_xsaves_supported(void)
{
	return false;
}

5075 5076 5077 5078 5079
static bool svm_has_wbinvd_exit(void)
{
	return true;
}

5080 5081 5082 5083
static void svm_fpu_deactivate(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

5084
	set_exception_intercept(svm, NM_VECTOR);
5085
	update_cr0_intercept(svm);
5086 5087
}

5088
#define PRE_EX(exit)  { .exit_code = (exit), \
5089
			.stage = X86_ICPT_PRE_EXCEPT, }
5090
#define POST_EX(exit) { .exit_code = (exit), \
5091
			.stage = X86_ICPT_POST_EXCEPT, }
5092
#define POST_MEM(exit) { .exit_code = (exit), \
5093
			.stage = X86_ICPT_POST_MEMACCESS, }
5094

5095
static const struct __x86_intercept {
5096 5097 5098 5099 5100 5101 5102 5103
	u32 exit_code;
	enum x86_intercept_stage stage;
} x86_intercept_map[] = {
	[x86_intercept_cr_read]		= POST_EX(SVM_EXIT_READ_CR0),
	[x86_intercept_cr_write]	= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_clts]		= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_lmsw]		= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_smsw]		= POST_EX(SVM_EXIT_READ_CR0),
5104 5105
	[x86_intercept_dr_read]		= POST_EX(SVM_EXIT_READ_DR0),
	[x86_intercept_dr_write]	= POST_EX(SVM_EXIT_WRITE_DR0),
5106 5107 5108 5109 5110 5111 5112 5113
	[x86_intercept_sldt]		= POST_EX(SVM_EXIT_LDTR_READ),
	[x86_intercept_str]		= POST_EX(SVM_EXIT_TR_READ),
	[x86_intercept_lldt]		= POST_EX(SVM_EXIT_LDTR_WRITE),
	[x86_intercept_ltr]		= POST_EX(SVM_EXIT_TR_WRITE),
	[x86_intercept_sgdt]		= POST_EX(SVM_EXIT_GDTR_READ),
	[x86_intercept_sidt]		= POST_EX(SVM_EXIT_IDTR_READ),
	[x86_intercept_lgdt]		= POST_EX(SVM_EXIT_GDTR_WRITE),
	[x86_intercept_lidt]		= POST_EX(SVM_EXIT_IDTR_WRITE),
5114 5115 5116 5117 5118 5119 5120 5121
	[x86_intercept_vmrun]		= POST_EX(SVM_EXIT_VMRUN),
	[x86_intercept_vmmcall]		= POST_EX(SVM_EXIT_VMMCALL),
	[x86_intercept_vmload]		= POST_EX(SVM_EXIT_VMLOAD),
	[x86_intercept_vmsave]		= POST_EX(SVM_EXIT_VMSAVE),
	[x86_intercept_stgi]		= POST_EX(SVM_EXIT_STGI),
	[x86_intercept_clgi]		= POST_EX(SVM_EXIT_CLGI),
	[x86_intercept_skinit]		= POST_EX(SVM_EXIT_SKINIT),
	[x86_intercept_invlpga]		= POST_EX(SVM_EXIT_INVLPGA),
5122 5123 5124
	[x86_intercept_rdtscp]		= POST_EX(SVM_EXIT_RDTSCP),
	[x86_intercept_monitor]		= POST_MEM(SVM_EXIT_MONITOR),
	[x86_intercept_mwait]		= POST_EX(SVM_EXIT_MWAIT),
5125 5126 5127 5128 5129 5130 5131 5132 5133
	[x86_intercept_invlpg]		= POST_EX(SVM_EXIT_INVLPG),
	[x86_intercept_invd]		= POST_EX(SVM_EXIT_INVD),
	[x86_intercept_wbinvd]		= POST_EX(SVM_EXIT_WBINVD),
	[x86_intercept_wrmsr]		= POST_EX(SVM_EXIT_MSR),
	[x86_intercept_rdtsc]		= POST_EX(SVM_EXIT_RDTSC),
	[x86_intercept_rdmsr]		= POST_EX(SVM_EXIT_MSR),
	[x86_intercept_rdpmc]		= POST_EX(SVM_EXIT_RDPMC),
	[x86_intercept_cpuid]		= PRE_EX(SVM_EXIT_CPUID),
	[x86_intercept_rsm]		= PRE_EX(SVM_EXIT_RSM),
5134 5135 5136 5137 5138 5139 5140
	[x86_intercept_pause]		= PRE_EX(SVM_EXIT_PAUSE),
	[x86_intercept_pushf]		= PRE_EX(SVM_EXIT_PUSHF),
	[x86_intercept_popf]		= PRE_EX(SVM_EXIT_POPF),
	[x86_intercept_intn]		= PRE_EX(SVM_EXIT_SWINT),
	[x86_intercept_iret]		= PRE_EX(SVM_EXIT_IRET),
	[x86_intercept_icebp]		= PRE_EX(SVM_EXIT_ICEBP),
	[x86_intercept_hlt]		= POST_EX(SVM_EXIT_HLT),
5141 5142 5143 5144
	[x86_intercept_in]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_ins]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_out]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_outs]		= POST_EX(SVM_EXIT_IOIO),
5145 5146
};

5147
#undef PRE_EX
5148
#undef POST_EX
5149
#undef POST_MEM
5150

5151 5152 5153 5154
static int svm_check_intercept(struct kvm_vcpu *vcpu,
			       struct x86_instruction_info *info,
			       enum x86_intercept_stage stage)
{
5155 5156 5157 5158 5159 5160 5161 5162 5163 5164
	struct vcpu_svm *svm = to_svm(vcpu);
	int vmexit, ret = X86EMUL_CONTINUE;
	struct __x86_intercept icpt_info;
	struct vmcb *vmcb = svm->vmcb;

	if (info->intercept >= ARRAY_SIZE(x86_intercept_map))
		goto out;

	icpt_info = x86_intercept_map[info->intercept];

5165
	if (stage != icpt_info.stage)
5166 5167 5168 5169 5170 5171 5172 5173 5174 5175 5176 5177 5178 5179
		goto out;

	switch (icpt_info.exit_code) {
	case SVM_EXIT_READ_CR0:
		if (info->intercept == x86_intercept_cr_read)
			icpt_info.exit_code += info->modrm_reg;
		break;
	case SVM_EXIT_WRITE_CR0: {
		unsigned long cr0, val;
		u64 intercept;

		if (info->intercept == x86_intercept_cr_write)
			icpt_info.exit_code += info->modrm_reg;

5180 5181
		if (icpt_info.exit_code != SVM_EXIT_WRITE_CR0 ||
		    info->intercept == x86_intercept_clts)
5182 5183 5184 5185 5186 5187 5188 5189 5190 5191 5192 5193 5194 5195 5196 5197 5198 5199 5200 5201 5202 5203 5204
			break;

		intercept = svm->nested.intercept;

		if (!(intercept & (1ULL << INTERCEPT_SELECTIVE_CR0)))
			break;

		cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
		val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;

		if (info->intercept == x86_intercept_lmsw) {
			cr0 &= 0xfUL;
			val &= 0xfUL;
			/* lmsw can't clear PE - catch this here */
			if (cr0 & X86_CR0_PE)
				val |= X86_CR0_PE;
		}

		if (cr0 ^ val)
			icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;

		break;
	}
5205 5206 5207 5208
	case SVM_EXIT_READ_DR0:
	case SVM_EXIT_WRITE_DR0:
		icpt_info.exit_code += info->modrm_reg;
		break;
5209 5210 5211 5212 5213 5214
	case SVM_EXIT_MSR:
		if (info->intercept == x86_intercept_wrmsr)
			vmcb->control.exit_info_1 = 1;
		else
			vmcb->control.exit_info_1 = 0;
		break;
5215 5216 5217 5218 5219 5220 5221
	case SVM_EXIT_PAUSE:
		/*
		 * We get this for NOP only, but pause
		 * is rep not, check this here
		 */
		if (info->rep_prefix != REPE_PREFIX)
			goto out;
5222 5223 5224 5225 5226 5227
	case SVM_EXIT_IOIO: {
		u64 exit_info;
		u32 bytes;

		if (info->intercept == x86_intercept_in ||
		    info->intercept == x86_intercept_ins) {
5228 5229
			exit_info = ((info->src_val & 0xffff) << 16) |
				SVM_IOIO_TYPE_MASK;
5230
			bytes = info->dst_bytes;
5231
		} else {
5232
			exit_info = (info->dst_val & 0xffff) << 16;
5233
			bytes = info->src_bytes;
5234 5235 5236 5237 5238 5239 5240 5241 5242 5243 5244 5245 5246 5247 5248 5249 5250 5251 5252 5253
		}

		if (info->intercept == x86_intercept_outs ||
		    info->intercept == x86_intercept_ins)
			exit_info |= SVM_IOIO_STR_MASK;

		if (info->rep_prefix)
			exit_info |= SVM_IOIO_REP_MASK;

		bytes = min(bytes, 4u);

		exit_info |= bytes << SVM_IOIO_SIZE_SHIFT;

		exit_info |= (u32)info->ad_bytes << (SVM_IOIO_ASIZE_SHIFT - 1);

		vmcb->control.exit_info_1 = exit_info;
		vmcb->control.exit_info_2 = info->next_rip;

		break;
	}
5254 5255 5256 5257
	default:
		break;
	}

5258 5259 5260
	/* TODO: Advertise NRIPS to guest hypervisor unconditionally */
	if (static_cpu_has(X86_FEATURE_NRIPS))
		vmcb->control.next_rip  = info->next_rip;
5261 5262 5263 5264 5265 5266 5267 5268
	vmcb->control.exit_code = icpt_info.exit_code;
	vmexit = nested_svm_exit_handled(svm);

	ret = (vmexit == NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED
					   : X86EMUL_CONTINUE;

out:
	return ret;
5269 5270
}

5271 5272 5273
static void svm_handle_external_intr(struct kvm_vcpu *vcpu)
{
	local_irq_enable();
P
Paolo Bonzini 已提交
5274 5275 5276 5277 5278 5279
	/*
	 * We must have an instruction with interrupts enabled, so
	 * the timer interrupt isn't delayed by the interrupt shadow.
	 */
	asm("nop");
	local_irq_disable();
5280 5281
}

5282 5283 5284 5285
static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
{
}

5286 5287 5288 5289 5290 5291 5292 5293 5294
static inline void avic_post_state_restore(struct kvm_vcpu *vcpu)
{
	if (avic_handle_apic_id_update(vcpu) != 0)
		return;
	if (avic_handle_dfr_update(vcpu) != 0)
		return;
	avic_handle_ldr_update(vcpu);
}

5295
static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
A
Avi Kivity 已提交
5296 5297 5298 5299
	.cpu_has_kvm_support = has_svm,
	.disabled_by_bios = is_disabled,
	.hardware_setup = svm_hardware_setup,
	.hardware_unsetup = svm_hardware_unsetup,
Y
Yang, Sheng 已提交
5300
	.check_processor_compatibility = svm_check_processor_compat,
A
Avi Kivity 已提交
5301 5302
	.hardware_enable = svm_hardware_enable,
	.hardware_disable = svm_hardware_disable,
5303
	.cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr,
5304
	.cpu_has_high_real_mode_segbase = svm_has_high_real_mode_segbase,
A
Avi Kivity 已提交
5305 5306 5307

	.vcpu_create = svm_create_vcpu,
	.vcpu_free = svm_free_vcpu,
5308
	.vcpu_reset = svm_vcpu_reset,
A
Avi Kivity 已提交
5309

5310 5311 5312
	.vm_init = avic_vm_init,
	.vm_destroy = avic_vm_destroy,

5313
	.prepare_guest_switch = svm_prepare_guest_switch,
A
Avi Kivity 已提交
5314 5315
	.vcpu_load = svm_vcpu_load,
	.vcpu_put = svm_vcpu_put,
5316 5317
	.vcpu_blocking = svm_vcpu_blocking,
	.vcpu_unblocking = svm_vcpu_unblocking,
A
Avi Kivity 已提交
5318

5319
	.update_bp_intercept = update_bp_intercept,
A
Avi Kivity 已提交
5320 5321 5322 5323 5324
	.get_msr = svm_get_msr,
	.set_msr = svm_set_msr,
	.get_segment_base = svm_get_segment_base,
	.get_segment = svm_get_segment,
	.set_segment = svm_set_segment,
5325
	.get_cpl = svm_get_cpl,
5326
	.get_cs_db_l_bits = kvm_get_cs_db_l_bits,
5327
	.decache_cr0_guest_bits = svm_decache_cr0_guest_bits,
5328
	.decache_cr3 = svm_decache_cr3,
5329
	.decache_cr4_guest_bits = svm_decache_cr4_guest_bits,
A
Avi Kivity 已提交
5330 5331 5332 5333 5334 5335 5336 5337
	.set_cr0 = svm_set_cr0,
	.set_cr3 = svm_set_cr3,
	.set_cr4 = svm_set_cr4,
	.set_efer = svm_set_efer,
	.get_idt = svm_get_idt,
	.set_idt = svm_set_idt,
	.get_gdt = svm_get_gdt,
	.set_gdt = svm_set_gdt,
J
Jan Kiszka 已提交
5338 5339
	.get_dr6 = svm_get_dr6,
	.set_dr6 = svm_set_dr6,
5340
	.set_dr7 = svm_set_dr7,
5341
	.sync_dirty_debug_regs = svm_sync_dirty_debug_regs,
A
Avi Kivity 已提交
5342
	.cache_reg = svm_cache_reg,
A
Avi Kivity 已提交
5343 5344
	.get_rflags = svm_get_rflags,
	.set_rflags = svm_set_rflags,
5345 5346 5347

	.get_pkru = svm_get_pkru,

5348
	.fpu_activate = svm_fpu_activate,
5349
	.fpu_deactivate = svm_fpu_deactivate,
A
Avi Kivity 已提交
5350 5351 5352 5353

	.tlb_flush = svm_flush_tlb,

	.run = svm_vcpu_run,
5354
	.handle_exit = handle_exit,
A
Avi Kivity 已提交
5355
	.skip_emulated_instruction = skip_emulated_instruction,
5356 5357
	.set_interrupt_shadow = svm_set_interrupt_shadow,
	.get_interrupt_shadow = svm_get_interrupt_shadow,
I
Ingo Molnar 已提交
5358
	.patch_hypercall = svm_patch_hypercall,
E
Eddie Dong 已提交
5359
	.set_irq = svm_set_irq,
5360
	.set_nmi = svm_inject_nmi,
5361
	.queue_exception = svm_queue_exception,
A
Avi Kivity 已提交
5362
	.cancel_injection = svm_cancel_injection,
5363
	.interrupt_allowed = svm_interrupt_allowed,
5364
	.nmi_allowed = svm_nmi_allowed,
J
Jan Kiszka 已提交
5365 5366
	.get_nmi_mask = svm_get_nmi_mask,
	.set_nmi_mask = svm_set_nmi_mask,
5367 5368 5369
	.enable_nmi_window = enable_nmi_window,
	.enable_irq_window = enable_irq_window,
	.update_cr8_intercept = update_cr8_intercept,
5370
	.set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode,
5371 5372
	.get_enable_apicv = svm_get_enable_apicv,
	.refresh_apicv_exec_ctrl = svm_refresh_apicv_exec_ctrl,
5373
	.load_eoi_exitmap = svm_load_eoi_exitmap,
5374
	.sync_pir_to_irr = svm_sync_pir_to_irr,
5375 5376
	.hwapic_irr_update = svm_hwapic_irr_update,
	.hwapic_isr_update = svm_hwapic_isr_update,
5377
	.apicv_post_state_restore = avic_post_state_restore,
5378 5379

	.set_tss_addr = svm_set_tss_addr,
5380
	.get_tdp_level = get_npt_level,
5381
	.get_mt_mask = svm_get_mt_mask,
5382

5383 5384
	.get_exit_info = svm_get_exit_info,

5385
	.get_lpage_level = svm_get_lpage_level,
5386 5387

	.cpuid_update = svm_cpuid_update,
5388 5389

	.rdtscp_supported = svm_rdtscp_supported,
5390
	.invpcid_supported = svm_invpcid_supported,
5391
	.mpx_supported = svm_mpx_supported,
5392
	.xsaves_supported = svm_xsaves_supported,
5393 5394

	.set_supported_cpuid = svm_set_supported_cpuid,
5395 5396

	.has_wbinvd_exit = svm_has_wbinvd_exit,
5397 5398

	.write_tsc_offset = svm_write_tsc_offset,
5399 5400

	.set_tdp_cr3 = set_tdp_cr3,
5401 5402

	.check_intercept = svm_check_intercept,
5403
	.handle_external_intr = svm_handle_external_intr,
5404 5405

	.sched_in = svm_sched_in,
5406 5407

	.pmu_ops = &amd_pmu_ops,
5408
	.deliver_posted_interrupt = svm_deliver_avic_intr,
5409
	.update_pi_irte = svm_update_pi_irte,
A
Avi Kivity 已提交
5410 5411 5412 5413
};

static int __init svm_init(void)
{
5414
	return kvm_init(&svm_x86_ops, sizeof(struct vcpu_svm),
5415
			__alignof__(struct vcpu_svm), THIS_MODULE);
A
Avi Kivity 已提交
5416 5417 5418 5419
}

static void __exit svm_exit(void)
{
5420
	kvm_exit();
A
Avi Kivity 已提交
5421 5422 5423 5424
}

module_init(svm_init)
module_exit(svm_exit)