svm.c 137.8 KB
Newer Older
A
Avi Kivity 已提交
1 2 3 4 5 6
/*
 * Kernel-based Virtual Machine driver for Linux
 *
 * AMD SVM support
 *
 * Copyright (C) 2006 Qumranet, Inc.
N
Nicolas Kaiser 已提交
7
 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
A
Avi Kivity 已提交
8 9 10 11 12 13 14 15 16
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
17 18 19

#define pr_fmt(fmt) "SVM: " fmt

20 21
#include <linux/kvm_host.h>

22
#include "irq.h"
23
#include "mmu.h"
24
#include "kvm_cache_regs.h"
25
#include "x86.h"
26
#include "cpuid.h"
27
#include "pmu.h"
A
Avi Kivity 已提交
28

A
Avi Kivity 已提交
29
#include <linux/module.h>
30
#include <linux/mod_devicetable.h>
31
#include <linux/kernel.h>
A
Avi Kivity 已提交
32 33
#include <linux/vmalloc.h>
#include <linux/highmem.h>
A
Alexey Dobriyan 已提交
34
#include <linux/sched.h>
35
#include <linux/trace_events.h>
36
#include <linux/slab.h>
37 38
#include <linux/amd-iommu.h>
#include <linux/hashtable.h>
A
Avi Kivity 已提交
39

40
#include <asm/apic.h>
41
#include <asm/perf_event.h>
42
#include <asm/tlbflush.h>
A
Avi Kivity 已提交
43
#include <asm/desc.h>
44
#include <asm/debugreg.h>
G
Gleb Natapov 已提交
45
#include <asm/kvm_para.h>
46
#include <asm/irq_remapping.h>
A
Avi Kivity 已提交
47

48
#include <asm/virtext.h>
49
#include "trace.h"
50

51 52
#define __ex(x) __kvm_handle_fault_on_reboot(x)

A
Avi Kivity 已提交
53 54 55
MODULE_AUTHOR("Qumranet");
MODULE_LICENSE("GPL");

56 57 58 59 60 61
static const struct x86_cpu_id svm_cpu_id[] = {
	X86_FEATURE_MATCH(X86_FEATURE_SVM),
	{}
};
MODULE_DEVICE_TABLE(x86cpu, svm_cpu_id);

A
Avi Kivity 已提交
62 63 64 65 66 67
#define IOPM_ALLOC_ORDER 2
#define MSRPM_ALLOC_ORDER 1

#define SEG_TYPE_LDT 2
#define SEG_TYPE_BUSY_TSS16 3

68 69 70 71
#define SVM_FEATURE_NPT            (1 <<  0)
#define SVM_FEATURE_LBRV           (1 <<  1)
#define SVM_FEATURE_SVML           (1 <<  2)
#define SVM_FEATURE_NRIP           (1 <<  3)
72 73 74 75
#define SVM_FEATURE_TSC_RATE       (1 <<  4)
#define SVM_FEATURE_VMCB_CLEAN     (1 <<  5)
#define SVM_FEATURE_FLUSH_ASID     (1 <<  6)
#define SVM_FEATURE_DECODE_ASSIST  (1 <<  7)
76
#define SVM_FEATURE_PAUSE_FILTER   (1 << 10)
77

78 79
#define SVM_AVIC_DOORBELL	0xc001011b

80 81 82 83
#define NESTED_EXIT_HOST	0	/* Exit handled on host level */
#define NESTED_EXIT_DONE	1	/* Exit caused nested vmexit  */
#define NESTED_EXIT_CONTINUE	2	/* Further checks needed      */

84 85
#define DEBUGCTL_RESERVED_BITS (~(0x3fULL))

86
#define TSC_RATIO_RSVD          0xffffff0000000000ULL
87 88
#define TSC_RATIO_MIN		0x0000000000000001ULL
#define TSC_RATIO_MAX		0x000000ffffffffffULL
89

D
Dan Carpenter 已提交
90
#define AVIC_HPA_MASK	~((0xFFFULL << 52) | 0xFFF)
91 92 93 94 95 96 97

/*
 * 0xff is broadcast, so the max index allowed for physical APIC ID
 * table is 0xfe.  APIC IDs above 0xff are reserved.
 */
#define AVIC_MAX_PHYSICAL_ID_COUNT	255

98 99 100 101
#define AVIC_UNACCEL_ACCESS_WRITE_MASK		1
#define AVIC_UNACCEL_ACCESS_OFFSET_MASK		0xFF0
#define AVIC_UNACCEL_ACCESS_VECTOR_MASK		0xFFFFFFFF

102 103 104 105 106 107 108 109 110 111 112 113 114
/* AVIC GATAG is encoded using VM and VCPU IDs */
#define AVIC_VCPU_ID_BITS		8
#define AVIC_VCPU_ID_MASK		((1 << AVIC_VCPU_ID_BITS) - 1)

#define AVIC_VM_ID_BITS			24
#define AVIC_VM_ID_NR			(1 << AVIC_VM_ID_BITS)
#define AVIC_VM_ID_MASK			((1 << AVIC_VM_ID_BITS) - 1)

#define AVIC_GATAG(x, y)		(((x & AVIC_VM_ID_MASK) << AVIC_VCPU_ID_BITS) | \
						(y & AVIC_VCPU_ID_MASK))
#define AVIC_GATAG_TO_VMID(x)		((x >> AVIC_VCPU_ID_BITS) & AVIC_VM_ID_MASK)
#define AVIC_GATAG_TO_VCPUID(x)		(x & AVIC_VCPU_ID_MASK)

115 116
static bool erratum_383_found __read_mostly;

A
Avi Kivity 已提交
117 118 119 120 121 122
static const u32 host_save_user_msrs[] = {
#ifdef CONFIG_X86_64
	MSR_STAR, MSR_LSTAR, MSR_CSTAR, MSR_SYSCALL_MASK, MSR_KERNEL_GS_BASE,
	MSR_FS_BASE,
#endif
	MSR_IA32_SYSENTER_CS, MSR_IA32_SYSENTER_ESP, MSR_IA32_SYSENTER_EIP,
P
Paolo Bonzini 已提交
123
	MSR_TSC_AUX,
A
Avi Kivity 已提交
124 125 126 127 128 129
};

#define NR_HOST_SAVE_USER_MSRS ARRAY_SIZE(host_save_user_msrs)

struct kvm_vcpu;

130 131 132
struct nested_state {
	struct vmcb *hsave;
	u64 hsave_msr;
133
	u64 vm_cr_msr;
134 135 136 137 138 139 140
	u64 vmcb;

	/* These are the merged vectors */
	u32 *msrpm;

	/* gpa pointers to the real vectors */
	u64 vmcb_msrpm;
141
	u64 vmcb_iopm;
J
Joerg Roedel 已提交
142

143 144 145
	/* A VMEXIT is required but not yet emulated */
	bool exit_required;

J
Joerg Roedel 已提交
146
	/* cache for intercepts of the guest */
147
	u32 intercept_cr;
148
	u32 intercept_dr;
J
Joerg Roedel 已提交
149 150 151
	u32 intercept_exceptions;
	u64 intercept;

152 153
	/* Nested Paging related state */
	u64 nested_cr3;
154 155
};

156 157 158
#define MSRPM_OFFSETS	16
static u32 msrpm_offsets[MSRPM_OFFSETS] __read_mostly;

159 160 161 162 163 164
/*
 * Set osvw_len to higher value when updated Revision Guides
 * are published and we know what the new status bits are
 */
static uint64_t osvw_len = 4, osvw_status;

A
Avi Kivity 已提交
165 166 167 168 169 170 171 172
struct vcpu_svm {
	struct kvm_vcpu vcpu;
	struct vmcb *vmcb;
	unsigned long vmcb_pa;
	struct svm_cpu_data *svm_data;
	uint64_t asid_generation;
	uint64_t sysenter_esp;
	uint64_t sysenter_eip;
P
Paolo Bonzini 已提交
173
	uint64_t tsc_aux;
A
Avi Kivity 已提交
174 175 176 177

	u64 next_rip;

	u64 host_user_msrs[NR_HOST_SAVE_USER_MSRS];
178
	struct {
179 180 181
		u16 fs;
		u16 gs;
		u16 ldt;
182 183
		u64 gs_base;
	} host;
A
Avi Kivity 已提交
184 185 186

	u32 *msrpm;

187 188
	ulong nmi_iret_rip;

189
	struct nested_state nested;
J
Jan Kiszka 已提交
190 191

	bool nmi_singlestep;
192 193 194

	unsigned int3_injected;
	unsigned long int3_rip;
G
Gleb Natapov 已提交
195
	u32 apf_reason;
196

197 198
	/* cached guest cpuid flags for faster access */
	bool nrips_enabled	: 1;
199

200
	u32 ldr_reg;
201 202
	struct page *avic_backing_page;
	u64 *avic_physical_id_cache;
203
	bool avic_is_running;
204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220

	/*
	 * Per-vcpu list of struct amd_svm_iommu_ir:
	 * This is used mainly to store interrupt remapping information used
	 * when update the vcpu affinity. This avoids the need to scan for
	 * IRTE and try to match ga_tag in the IOMMU driver.
	 */
	struct list_head ir_list;
	spinlock_t ir_list_lock;
};

/*
 * This is a wrapper of struct amd_iommu_ir_data.
 */
struct amd_svm_iommu_ir {
	struct list_head node;	/* Used by SVM for per-vcpu ir_list */
	void *data;		/* Storing pointer to struct amd_ir_data */
A
Avi Kivity 已提交
221 222
};

223 224 225 226 227 228 229 230
#define AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK	(0xFF)
#define AVIC_LOGICAL_ID_ENTRY_VALID_MASK		(1 << 31)

#define AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK	(0xFFULL)
#define AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK	(0xFFFFFFFFFFULL << 12)
#define AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK		(1ULL << 62)
#define AVIC_PHYSICAL_ID_ENTRY_VALID_MASK		(1ULL << 63)

231 232 233
static DEFINE_PER_CPU(u64, current_tsc_ratio);
#define TSC_RATIO_DEFAULT	0x0100000000ULL

234 235
#define MSR_INVALID			0xffffffffU

236
static const struct svm_direct_access_msrs {
237 238 239
	u32 index;   /* Index of the MSR */
	bool always; /* True if intercept is always on */
} direct_access_msrs[] = {
B
Brian Gerst 已提交
240
	{ .index = MSR_STAR,				.always = true  },
241 242 243 244 245 246 247 248 249 250 251 252 253 254
	{ .index = MSR_IA32_SYSENTER_CS,		.always = true  },
#ifdef CONFIG_X86_64
	{ .index = MSR_GS_BASE,				.always = true  },
	{ .index = MSR_FS_BASE,				.always = true  },
	{ .index = MSR_KERNEL_GS_BASE,			.always = true  },
	{ .index = MSR_LSTAR,				.always = true  },
	{ .index = MSR_CSTAR,				.always = true  },
	{ .index = MSR_SYSCALL_MASK,			.always = true  },
#endif
	{ .index = MSR_IA32_LASTBRANCHFROMIP,		.always = false },
	{ .index = MSR_IA32_LASTBRANCHTOIP,		.always = false },
	{ .index = MSR_IA32_LASTINTFROMIP,		.always = false },
	{ .index = MSR_IA32_LASTINTTOIP,		.always = false },
	{ .index = MSR_INVALID,				.always = false },
A
Avi Kivity 已提交
255 256
};

257 258 259 260
/* enable NPT for AMD64 and X86 with PAE */
#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
static bool npt_enabled = true;
#else
J
Joerg Roedel 已提交
261
static bool npt_enabled;
262
#endif
263

264 265
/* allow nested paging (virtualized MMU) for all guests */
static int npt = true;
266
module_param(npt, int, S_IRUGO);
267

268 269
/* allow nested virtualization in KVM/SVM */
static int nested = true;
270 271
module_param(nested, int, S_IRUGO);

272 273
/* enable / disable AVIC */
static int avic;
274
#ifdef CONFIG_X86_LOCAL_APIC
275
module_param(avic, int, S_IRUGO);
276
#endif
277

278 279 280 281
/* AVIC VM ID bit masks and lock */
static DECLARE_BITMAP(avic_vm_id_bitmap, AVIC_VM_ID_NR);
static DEFINE_SPINLOCK(avic_vm_id_lock);

282
static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
283
static void svm_flush_tlb(struct kvm_vcpu *vcpu);
284
static void svm_complete_interrupts(struct vcpu_svm *svm);
285

286
static int nested_svm_exit_handled(struct vcpu_svm *svm);
287
static int nested_svm_intercept(struct vcpu_svm *svm);
288 289 290 291
static int nested_svm_vmexit(struct vcpu_svm *svm);
static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
				      bool has_error_code, u32 error_code);

292
enum {
293 294
	VMCB_INTERCEPTS, /* Intercept vectors, TSC offset,
			    pause filter count */
295
	VMCB_PERM_MAP,   /* IOPM Base and MSRPM Base */
296
	VMCB_ASID,	 /* ASID */
297
	VMCB_INTR,	 /* int_ctl, int_vector */
298
	VMCB_NPT,        /* npt_en, nCR3, gPAT */
299
	VMCB_CR,	 /* CR0, CR3, CR4, EFER */
300
	VMCB_DR,         /* DR6, DR7 */
301
	VMCB_DT,         /* GDT, IDT */
302
	VMCB_SEG,        /* CS, DS, SS, ES, CPL */
303
	VMCB_CR2,        /* CR2 only */
304
	VMCB_LBR,        /* DBGCTL, BR_FROM, BR_TO, LAST_EX_FROM, LAST_EX_TO */
305 306 307 308
	VMCB_AVIC,       /* AVIC APIC_BAR, AVIC APIC_BACKING_PAGE,
			  * AVIC PHYSICAL_TABLE pointer,
			  * AVIC LOGICAL_TABLE pointer
			  */
309 310 311
	VMCB_DIRTY_MAX,
};

312 313
/* TPR and CR2 are always written before VMRUN */
#define VMCB_ALWAYS_DIRTY_MASK	((1U << VMCB_INTR) | (1U << VMCB_CR2))
314

315 316
#define VMCB_AVIC_APIC_BAR_MASK		0xFFFFFFFFFF000ULL

317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332
static inline void mark_all_dirty(struct vmcb *vmcb)
{
	vmcb->control.clean = 0;
}

static inline void mark_all_clean(struct vmcb *vmcb)
{
	vmcb->control.clean = ((1 << VMCB_DIRTY_MAX) - 1)
			       & ~VMCB_ALWAYS_DIRTY_MASK;
}

static inline void mark_dirty(struct vmcb *vmcb, int bit)
{
	vmcb->control.clean &= ~(1 << bit);
}

333 334
static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
{
R
Rusty Russell 已提交
335
	return container_of(vcpu, struct vcpu_svm, vcpu);
336 337
}

338 339 340 341 342 343
static inline void avic_update_vapic_bar(struct vcpu_svm *svm, u64 data)
{
	svm->vmcb->control.avic_vapic_bar = data & VMCB_AVIC_APIC_BAR_MASK;
	mark_dirty(svm->vmcb, VMCB_AVIC);
}

344 345 346 347 348 349 350 351 352 353 354
static inline bool avic_vcpu_is_running(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 *entry = svm->avic_physical_id_cache;

	if (!entry)
		return false;

	return (READ_ONCE(*entry) & AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK);
}

355 356 357 358 359
static void recalc_intercepts(struct vcpu_svm *svm)
{
	struct vmcb_control_area *c, *h;
	struct nested_state *g;

360 361
	mark_dirty(svm->vmcb, VMCB_INTERCEPTS);

362 363 364 365 366 367 368
	if (!is_guest_mode(&svm->vcpu))
		return;

	c = &svm->vmcb->control;
	h = &svm->nested.hsave->control;
	g = &svm->nested;

369
	c->intercept_cr = h->intercept_cr | g->intercept_cr;
370
	c->intercept_dr = h->intercept_dr | g->intercept_dr;
371 372 373 374
	c->intercept_exceptions = h->intercept_exceptions | g->intercept_exceptions;
	c->intercept = h->intercept | g->intercept;
}

375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407
static inline struct vmcb *get_host_vmcb(struct vcpu_svm *svm)
{
	if (is_guest_mode(&svm->vcpu))
		return svm->nested.hsave;
	else
		return svm->vmcb;
}

static inline void set_cr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_cr |= (1U << bit);

	recalc_intercepts(svm);
}

static inline void clr_cr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_cr &= ~(1U << bit);

	recalc_intercepts(svm);
}

static inline bool is_cr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	return vmcb->control.intercept_cr & (1U << bit);
}

408
static inline void set_dr_intercepts(struct vcpu_svm *svm)
409 410 411
{
	struct vmcb *vmcb = get_host_vmcb(svm);

412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427
	vmcb->control.intercept_dr = (1 << INTERCEPT_DR0_READ)
		| (1 << INTERCEPT_DR1_READ)
		| (1 << INTERCEPT_DR2_READ)
		| (1 << INTERCEPT_DR3_READ)
		| (1 << INTERCEPT_DR4_READ)
		| (1 << INTERCEPT_DR5_READ)
		| (1 << INTERCEPT_DR6_READ)
		| (1 << INTERCEPT_DR7_READ)
		| (1 << INTERCEPT_DR0_WRITE)
		| (1 << INTERCEPT_DR1_WRITE)
		| (1 << INTERCEPT_DR2_WRITE)
		| (1 << INTERCEPT_DR3_WRITE)
		| (1 << INTERCEPT_DR4_WRITE)
		| (1 << INTERCEPT_DR5_WRITE)
		| (1 << INTERCEPT_DR6_WRITE)
		| (1 << INTERCEPT_DR7_WRITE);
428 429 430 431

	recalc_intercepts(svm);
}

432
static inline void clr_dr_intercepts(struct vcpu_svm *svm)
433 434 435
{
	struct vmcb *vmcb = get_host_vmcb(svm);

436
	vmcb->control.intercept_dr = 0;
437 438 439 440

	recalc_intercepts(svm);
}

441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458
static inline void set_exception_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_exceptions |= (1U << bit);

	recalc_intercepts(svm);
}

static inline void clr_exception_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept_exceptions &= ~(1U << bit);

	recalc_intercepts(svm);
}

459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476
static inline void set_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept |= (1ULL << bit);

	recalc_intercepts(svm);
}

static inline void clr_intercept(struct vcpu_svm *svm, int bit)
{
	struct vmcb *vmcb = get_host_vmcb(svm);

	vmcb->control.intercept &= ~(1ULL << bit);

	recalc_intercepts(svm);
}

477 478 479 480 481 482 483 484 485 486 487 488 489 490 491
static inline void enable_gif(struct vcpu_svm *svm)
{
	svm->vcpu.arch.hflags |= HF_GIF_MASK;
}

static inline void disable_gif(struct vcpu_svm *svm)
{
	svm->vcpu.arch.hflags &= ~HF_GIF_MASK;
}

static inline bool gif_set(struct vcpu_svm *svm)
{
	return !!(svm->vcpu.arch.hflags & HF_GIF_MASK);
}

492
static unsigned long iopm_base;
A
Avi Kivity 已提交
493 494 495 496

struct kvm_ldttss_desc {
	u16 limit0;
	u16 base0;
J
Joerg Roedel 已提交
497 498
	unsigned base1:8, type:5, dpl:2, p:1;
	unsigned limit1:4, zero0:3, g:1, base2:8;
A
Avi Kivity 已提交
499 500 501 502 503 504 505
	u32 base3;
	u32 zero1;
} __attribute__((packed));

struct svm_cpu_data {
	int cpu;

A
Avi Kivity 已提交
506 507 508
	u64 asid_generation;
	u32 max_asid;
	u32 next_asid;
A
Avi Kivity 已提交
509 510 511 512 513 514 515 516 517 518 519 520
	struct kvm_ldttss_desc *tss_desc;

	struct page *save_area;
};

static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data);

struct svm_init_data {
	int cpu;
	int r;
};

521
static const u32 msrpm_ranges[] = {0, 0xc0000000, 0xc0010000};
A
Avi Kivity 已提交
522

523
#define NUM_MSR_MAPS ARRAY_SIZE(msrpm_ranges)
A
Avi Kivity 已提交
524 525 526
#define MSRS_RANGE_SIZE 2048
#define MSRS_IN_RANGE (MSRS_RANGE_SIZE * 8 / 2)

527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547
static u32 svm_msrpm_offset(u32 msr)
{
	u32 offset;
	int i;

	for (i = 0; i < NUM_MSR_MAPS; i++) {
		if (msr < msrpm_ranges[i] ||
		    msr >= msrpm_ranges[i] + MSRS_IN_RANGE)
			continue;

		offset  = (msr - msrpm_ranges[i]) / 4; /* 4 msrs per u8 */
		offset += (i * MSRS_RANGE_SIZE);       /* add range offset */

		/* Now we have the u8 offset - but need the u32 offset */
		return offset / 4;
	}

	/* MSR not in any range */
	return MSR_INVALID;
}

A
Avi Kivity 已提交
548 549 550 551
#define MAX_INST_SIZE 15

static inline void clgi(void)
{
552
	asm volatile (__ex(SVM_CLGI));
A
Avi Kivity 已提交
553 554 555 556
}

static inline void stgi(void)
{
557
	asm volatile (__ex(SVM_STGI));
A
Avi Kivity 已提交
558 559 560 561
}

static inline void invlpga(unsigned long addr, u32 asid)
{
J
Joerg Roedel 已提交
562
	asm volatile (__ex(SVM_INVLPGA) : : "a"(addr), "c"(asid));
A
Avi Kivity 已提交
563 564
}

565 566 567 568 569 570 571 572 573
static int get_npt_level(void)
{
#ifdef CONFIG_X86_64
	return PT64_ROOT_LEVEL;
#else
	return PT32E_ROOT_LEVEL;
#endif
}

A
Avi Kivity 已提交
574 575
static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
{
576
	vcpu->arch.efer = efer;
577
	if (!npt_enabled && !(efer & EFER_LMA))
578
		efer &= ~EFER_LME;
A
Avi Kivity 已提交
579

580
	to_svm(vcpu)->vmcb->save.efer = efer | EFER_SVME;
581
	mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
A
Avi Kivity 已提交
582 583 584 585 586 587 588 589
}

static int is_external_interrupt(u32 info)
{
	info &= SVM_EVTINJ_TYPE_MASK | SVM_EVTINJ_VALID;
	return info == (SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR);
}

590
static u32 svm_get_interrupt_shadow(struct kvm_vcpu *vcpu)
591 592 593 594 595
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 ret = 0;

	if (svm->vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK)
596 597
		ret = KVM_X86_SHADOW_INT_STI | KVM_X86_SHADOW_INT_MOV_SS;
	return ret;
598 599 600 601 602 603 604 605 606 607 608 609 610
}

static void svm_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (mask == 0)
		svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
	else
		svm->vmcb->control.int_state |= SVM_INTERRUPT_SHADOW_MASK;

}

A
Avi Kivity 已提交
611 612
static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
{
613 614
	struct vcpu_svm *svm = to_svm(vcpu);

615
	if (svm->vmcb->control.next_rip != 0) {
616
		WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS));
617
		svm->next_rip = svm->vmcb->control.next_rip;
618
	}
619

620
	if (!svm->next_rip) {
621
		if (emulate_instruction(vcpu, EMULTYPE_SKIP) !=
622 623
				EMULATE_DONE)
			printk(KERN_DEBUG "%s: NOP\n", __func__);
A
Avi Kivity 已提交
624 625
		return;
	}
626 627 628
	if (svm->next_rip - kvm_rip_read(vcpu) > MAX_INST_SIZE)
		printk(KERN_ERR "%s: ip 0x%lx next 0x%llx\n",
		       __func__, kvm_rip_read(vcpu), svm->next_rip);
A
Avi Kivity 已提交
629

630
	kvm_rip_write(vcpu, svm->next_rip);
631
	svm_set_interrupt_shadow(vcpu, 0);
A
Avi Kivity 已提交
632 633
}

J
Jan Kiszka 已提交
634
static void svm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
635 636
				bool has_error_code, u32 error_code,
				bool reinject)
J
Jan Kiszka 已提交
637 638 639
{
	struct vcpu_svm *svm = to_svm(vcpu);

J
Joerg Roedel 已提交
640 641 642 643
	/*
	 * If we are within a nested VM we'd better #VMEXIT and let the guest
	 * handle the exception
	 */
644 645
	if (!reinject &&
	    nested_svm_check_exception(svm, nr, has_error_code, error_code))
J
Jan Kiszka 已提交
646 647
		return;

648
	if (nr == BP_VECTOR && !static_cpu_has(X86_FEATURE_NRIPS)) {
649 650 651 652 653 654 655 656 657 658 659 660 661 662 663
		unsigned long rip, old_rip = kvm_rip_read(&svm->vcpu);

		/*
		 * For guest debugging where we have to reinject #BP if some
		 * INT3 is guest-owned:
		 * Emulate nRIP by moving RIP forward. Will fail if injection
		 * raises a fault that is not intercepted. Still better than
		 * failing in all cases.
		 */
		skip_emulated_instruction(&svm->vcpu);
		rip = kvm_rip_read(&svm->vcpu);
		svm->int3_rip = rip + svm->vmcb->save.cs.base;
		svm->int3_injected = rip - old_rip;
	}

J
Jan Kiszka 已提交
664 665 666 667 668 669 670
	svm->vmcb->control.event_inj = nr
		| SVM_EVTINJ_VALID
		| (has_error_code ? SVM_EVTINJ_VALID_ERR : 0)
		| SVM_EVTINJ_TYPE_EXEPT;
	svm->vmcb->control.event_inj_err = error_code;
}

671 672 673 674 675 676
static void svm_init_erratum_383(void)
{
	u32 low, high;
	int err;
	u64 val;

677
	if (!static_cpu_has_bug(X86_BUG_AMD_TLB_MMATCH))
678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694
		return;

	/* Use _safe variants to not break nested virtualization */
	val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
	if (err)
		return;

	val |= (1ULL << 47);

	low  = lower_32_bits(val);
	high = upper_32_bits(val);

	native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);

	erratum_383_found = true;
}

695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715
static void svm_init_osvw(struct kvm_vcpu *vcpu)
{
	/*
	 * Guests should see errata 400 and 415 as fixed (assuming that
	 * HLT and IO instructions are intercepted).
	 */
	vcpu->arch.osvw.length = (osvw_len >= 3) ? (osvw_len) : 3;
	vcpu->arch.osvw.status = osvw_status & ~(6ULL);

	/*
	 * By increasing VCPU's osvw.length to 3 we are telling the guest that
	 * all osvw.status bits inside that length, including bit 0 (which is
	 * reserved for erratum 298), are valid. However, if host processor's
	 * osvw_len is 0 then osvw_status[0] carries no information. We need to
	 * be conservative here and therefore we tell the guest that erratum 298
	 * is present (because we really don't know).
	 */
	if (osvw_len == 0 && boot_cpu_data.x86 == 0x10)
		vcpu->arch.osvw.status |= 1;
}

A
Avi Kivity 已提交
716 717
static int has_svm(void)
{
718
	const char *msg;
A
Avi Kivity 已提交
719

720
	if (!cpu_has_svm(&msg)) {
J
Joe Perches 已提交
721
		printk(KERN_INFO "has_svm: %s\n", msg);
A
Avi Kivity 已提交
722 723 724 725 726 727
		return 0;
	}

	return 1;
}

728
static void svm_hardware_disable(void)
A
Avi Kivity 已提交
729
{
730 731 732 733
	/* Make sure we clean up behind us */
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR))
		wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);

734
	cpu_svm_disable();
735 736

	amd_pmu_disable_virt();
A
Avi Kivity 已提交
737 738
}

739
static int svm_hardware_enable(void)
A
Avi Kivity 已提交
740 741
{

742
	struct svm_cpu_data *sd;
A
Avi Kivity 已提交
743 744 745 746
	uint64_t efer;
	struct desc_struct *gdt;
	int me = raw_smp_processor_id();

747 748 749 750
	rdmsrl(MSR_EFER, efer);
	if (efer & EFER_SVME)
		return -EBUSY;

A
Avi Kivity 已提交
751
	if (!has_svm()) {
752
		pr_err("%s: err EOPNOTSUPP on %d\n", __func__, me);
753
		return -EINVAL;
A
Avi Kivity 已提交
754
	}
755 756
	sd = per_cpu(svm_data, me);
	if (!sd) {
757
		pr_err("%s: svm_data is NULL on %d\n", __func__, me);
758
		return -EINVAL;
A
Avi Kivity 已提交
759 760
	}

761 762 763
	sd->asid_generation = 1;
	sd->max_asid = cpuid_ebx(SVM_CPUID_FUNC) - 1;
	sd->next_asid = sd->max_asid + 1;
A
Avi Kivity 已提交
764

765
	gdt = get_current_gdt_rw();
766
	sd->tss_desc = (struct kvm_ldttss_desc *)(gdt + GDT_ENTRY_TSS);
A
Avi Kivity 已提交
767

768
	wrmsrl(MSR_EFER, efer | EFER_SVME);
A
Avi Kivity 已提交
769

770
	wrmsrl(MSR_VM_HSAVE_PA, page_to_pfn(sd->save_area) << PAGE_SHIFT);
771

772 773
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
774
		__this_cpu_write(current_tsc_ratio, TSC_RATIO_DEFAULT);
775 776
	}

777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806

	/*
	 * Get OSVW bits.
	 *
	 * Note that it is possible to have a system with mixed processor
	 * revisions and therefore different OSVW bits. If bits are not the same
	 * on different processors then choose the worst case (i.e. if erratum
	 * is present on one processor and not on another then assume that the
	 * erratum is present everywhere).
	 */
	if (cpu_has(&boot_cpu_data, X86_FEATURE_OSVW)) {
		uint64_t len, status = 0;
		int err;

		len = native_read_msr_safe(MSR_AMD64_OSVW_ID_LENGTH, &err);
		if (!err)
			status = native_read_msr_safe(MSR_AMD64_OSVW_STATUS,
						      &err);

		if (err)
			osvw_status = osvw_len = 0;
		else {
			if (len < osvw_len)
				osvw_len = len;
			osvw_status |= status;
			osvw_status &= (1ULL << osvw_len) - 1;
		}
	} else
		osvw_status = osvw_len = 0;

807 808
	svm_init_erratum_383();

809 810
	amd_pmu_enable_virt();

811
	return 0;
A
Avi Kivity 已提交
812 813
}

814 815
static void svm_cpu_uninit(int cpu)
{
816
	struct svm_cpu_data *sd = per_cpu(svm_data, raw_smp_processor_id());
817

818
	if (!sd)
819 820 821
		return;

	per_cpu(svm_data, raw_smp_processor_id()) = NULL;
822 823
	__free_page(sd->save_area);
	kfree(sd);
824 825
}

A
Avi Kivity 已提交
826 827
static int svm_cpu_init(int cpu)
{
828
	struct svm_cpu_data *sd;
A
Avi Kivity 已提交
829 830
	int r;

831 832
	sd = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL);
	if (!sd)
A
Avi Kivity 已提交
833
		return -ENOMEM;
834 835
	sd->cpu = cpu;
	sd->save_area = alloc_page(GFP_KERNEL);
A
Avi Kivity 已提交
836
	r = -ENOMEM;
837
	if (!sd->save_area)
A
Avi Kivity 已提交
838 839
		goto err_1;

840
	per_cpu(svm_data, cpu) = sd;
A
Avi Kivity 已提交
841 842 843 844

	return 0;

err_1:
845
	kfree(sd);
A
Avi Kivity 已提交
846 847 848 849
	return r;

}

850 851 852 853 854 855 856 857 858 859 860
static bool valid_msr_intercept(u32 index)
{
	int i;

	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++)
		if (direct_access_msrs[i].index == index)
			return true;

	return false;
}

861 862
static void set_msr_interception(u32 *msrpm, unsigned msr,
				 int read, int write)
A
Avi Kivity 已提交
863
{
864 865 866
	u8 bit_read, bit_write;
	unsigned long tmp;
	u32 offset;
A
Avi Kivity 已提交
867

868 869 870 871 872 873
	/*
	 * If this warning triggers extend the direct_access_msrs list at the
	 * beginning of the file
	 */
	WARN_ON(!valid_msr_intercept(msr));

874 875 876 877 878 879 880 881 882 883 884
	offset    = svm_msrpm_offset(msr);
	bit_read  = 2 * (msr & 0x0f);
	bit_write = 2 * (msr & 0x0f) + 1;
	tmp       = msrpm[offset];

	BUG_ON(offset == MSR_INVALID);

	read  ? clear_bit(bit_read,  &tmp) : set_bit(bit_read,  &tmp);
	write ? clear_bit(bit_write, &tmp) : set_bit(bit_write, &tmp);

	msrpm[offset] = tmp;
A
Avi Kivity 已提交
885 886
}

887
static void svm_vcpu_init_msrpm(u32 *msrpm)
A
Avi Kivity 已提交
888 889 890
{
	int i;

891 892
	memset(msrpm, 0xff, PAGE_SIZE * (1 << MSRPM_ALLOC_ORDER));

893 894 895 896 897 898
	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
		if (!direct_access_msrs[i].always)
			continue;

		set_msr_interception(msrpm, direct_access_msrs[i].index, 1, 1);
	}
899 900
}

901 902 903 904 905 906 907 908
static void add_msr_offset(u32 offset)
{
	int i;

	for (i = 0; i < MSRPM_OFFSETS; ++i) {

		/* Offset already in list? */
		if (msrpm_offsets[i] == offset)
909
			return;
910 911 912 913 914 915 916 917 918

		/* Slot used by another offset? */
		if (msrpm_offsets[i] != MSR_INVALID)
			continue;

		/* Add offset to list */
		msrpm_offsets[i] = offset;

		return;
A
Avi Kivity 已提交
919
	}
920 921 922 923 924

	/*
	 * If this BUG triggers the msrpm_offsets table has an overflow. Just
	 * increase MSRPM_OFFSETS in this case.
	 */
925
	BUG();
A
Avi Kivity 已提交
926 927
}

928
static void init_msrpm_offsets(void)
929
{
930
	int i;
931

932 933 934 935 936 937 938 939 940 941
	memset(msrpm_offsets, 0xff, sizeof(msrpm_offsets));

	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
		u32 offset;

		offset = svm_msrpm_offset(direct_access_msrs[i].index);
		BUG_ON(offset == MSR_INVALID);

		add_msr_offset(offset);
	}
942 943
}

944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965
static void svm_enable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 1;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
}

static void svm_disable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 0;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
}

966 967 968 969 970 971
/* Note:
 * This hash table is used to map VM_ID to a struct kvm_arch,
 * when handling AMD IOMMU GALOG notification to schedule in
 * a particular vCPU.
 */
#define SVM_VM_DATA_HASH_BITS	8
972 973
static DEFINE_HASHTABLE(svm_vm_data_hash, SVM_VM_DATA_HASH_BITS);
static DEFINE_SPINLOCK(svm_vm_data_hash_lock);
974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014

/* Note:
 * This function is called from IOMMU driver to notify
 * SVM to schedule in a particular vCPU of a particular VM.
 */
static int avic_ga_log_notifier(u32 ga_tag)
{
	unsigned long flags;
	struct kvm_arch *ka = NULL;
	struct kvm_vcpu *vcpu = NULL;
	u32 vm_id = AVIC_GATAG_TO_VMID(ga_tag);
	u32 vcpu_id = AVIC_GATAG_TO_VCPUID(ga_tag);

	pr_debug("SVM: %s: vm_id=%#x, vcpu_id=%#x\n", __func__, vm_id, vcpu_id);

	spin_lock_irqsave(&svm_vm_data_hash_lock, flags);
	hash_for_each_possible(svm_vm_data_hash, ka, hnode, vm_id) {
		struct kvm *kvm = container_of(ka, struct kvm, arch);
		struct kvm_arch *vm_data = &kvm->arch;

		if (vm_data->avic_vm_id != vm_id)
			continue;
		vcpu = kvm_get_vcpu_by_id(kvm, vcpu_id);
		break;
	}
	spin_unlock_irqrestore(&svm_vm_data_hash_lock, flags);

	if (!vcpu)
		return 0;

	/* Note:
	 * At this point, the IOMMU should have already set the pending
	 * bit in the vAPIC backing page. So, we just need to schedule
	 * in the vcpu.
	 */
	if (vcpu->mode == OUTSIDE_GUEST_MODE)
		kvm_vcpu_wake_up(vcpu);

	return 0;
}

A
Avi Kivity 已提交
1015 1016 1017 1018
static __init int svm_hardware_setup(void)
{
	int cpu;
	struct page *iopm_pages;
1019
	void *iopm_va;
A
Avi Kivity 已提交
1020 1021 1022 1023 1024 1025
	int r;

	iopm_pages = alloc_pages(GFP_KERNEL, IOPM_ALLOC_ORDER);

	if (!iopm_pages)
		return -ENOMEM;
1026 1027 1028

	iopm_va = page_address(iopm_pages);
	memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
A
Avi Kivity 已提交
1029 1030
	iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;

1031 1032
	init_msrpm_offsets();

1033 1034 1035
	if (boot_cpu_has(X86_FEATURE_NX))
		kvm_enable_efer_bits(EFER_NX);

A
Alexander Graf 已提交
1036 1037 1038
	if (boot_cpu_has(X86_FEATURE_FXSR_OPT))
		kvm_enable_efer_bits(EFER_FFXSR);

1039 1040
	if (boot_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		kvm_has_tsc_control = true;
1041 1042
		kvm_max_tsc_scaling_ratio = TSC_RATIO_MAX;
		kvm_tsc_scaling_ratio_frac_bits = 32;
1043 1044
	}

1045 1046
	if (nested) {
		printk(KERN_INFO "kvm: Nested Virtualization enabled\n");
1047
		kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE);
1048 1049
	}

Z
Zachary Amsden 已提交
1050
	for_each_possible_cpu(cpu) {
A
Avi Kivity 已提交
1051 1052
		r = svm_cpu_init(cpu);
		if (r)
1053
			goto err;
A
Avi Kivity 已提交
1054
	}
1055

1056
	if (!boot_cpu_has(X86_FEATURE_NPT))
1057 1058
		npt_enabled = false;

1059 1060 1061 1062 1063
	if (npt_enabled && !npt) {
		printk(KERN_INFO "kvm: Nested Paging disabled\n");
		npt_enabled = false;
	}

1064
	if (npt_enabled) {
1065
		printk(KERN_INFO "kvm: Nested Paging enabled\n");
1066
		kvm_enable_tdp();
1067 1068
	} else
		kvm_disable_tdp();
1069

1070 1071 1072
	if (avic) {
		if (!npt_enabled ||
		    !boot_cpu_has(X86_FEATURE_AVIC) ||
1073
		    !IS_ENABLED(CONFIG_X86_LOCAL_APIC)) {
1074
			avic = false;
1075
		} else {
1076
			pr_info("AVIC enabled\n");
1077 1078 1079

			amd_iommu_register_ga_log_notifier(&avic_ga_log_notifier);
		}
1080
	}
1081

A
Avi Kivity 已提交
1082 1083
	return 0;

1084
err:
A
Avi Kivity 已提交
1085 1086 1087 1088 1089 1090 1091
	__free_pages(iopm_pages, IOPM_ALLOC_ORDER);
	iopm_base = 0;
	return r;
}

static __exit void svm_hardware_unsetup(void)
{
1092 1093
	int cpu;

Z
Zachary Amsden 已提交
1094
	for_each_possible_cpu(cpu)
1095 1096
		svm_cpu_uninit(cpu);

A
Avi Kivity 已提交
1097
	__free_pages(pfn_to_page(iopm_base >> PAGE_SHIFT), IOPM_ALLOC_ORDER);
1098
	iopm_base = 0;
A
Avi Kivity 已提交
1099 1100 1101 1102 1103 1104
}

static void init_seg(struct vmcb_seg *seg)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | SVM_SELECTOR_S_MASK |
J
Joerg Roedel 已提交
1105
		      SVM_SELECTOR_WRITE_MASK; /* Read/Write Data Segment */
A
Avi Kivity 已提交
1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117
	seg->limit = 0xffff;
	seg->base = 0;
}

static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | type;
	seg->limit = 0xffff;
	seg->base = 0;
}

1118 1119 1120 1121 1122
static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 g_tsc_offset = 0;

1123
	if (is_guest_mode(vcpu)) {
1124 1125 1126
		g_tsc_offset = svm->vmcb->control.tsc_offset -
			       svm->nested.hsave->control.tsc_offset;
		svm->nested.hsave->control.tsc_offset = offset;
1127 1128 1129 1130
	} else
		trace_kvm_write_tsc_offset(vcpu->vcpu_id,
					   svm->vmcb->control.tsc_offset,
					   offset);
1131 1132

	svm->vmcb->control.tsc_offset = offset + g_tsc_offset;
1133 1134

	mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
1135 1136
}

1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152
static void avic_init_vmcb(struct vcpu_svm *svm)
{
	struct vmcb *vmcb = svm->vmcb;
	struct kvm_arch *vm_data = &svm->vcpu.kvm->arch;
	phys_addr_t bpa = page_to_phys(svm->avic_backing_page);
	phys_addr_t lpa = page_to_phys(vm_data->avic_logical_id_table_page);
	phys_addr_t ppa = page_to_phys(vm_data->avic_physical_id_table_page);

	vmcb->control.avic_backing_page = bpa & AVIC_HPA_MASK;
	vmcb->control.avic_logical_id = lpa & AVIC_HPA_MASK;
	vmcb->control.avic_physical_id = ppa & AVIC_HPA_MASK;
	vmcb->control.avic_physical_id |= AVIC_MAX_PHYSICAL_ID_COUNT;
	vmcb->control.int_ctl |= AVIC_ENABLE_MASK;
	svm->vcpu.arch.apicv_active = true;
}

P
Paolo Bonzini 已提交
1153
static void init_vmcb(struct vcpu_svm *svm)
A
Avi Kivity 已提交
1154
{
1155 1156
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;
A
Avi Kivity 已提交
1157

1158
	svm->vcpu.arch.hflags = 0;
1159

1160 1161 1162 1163 1164 1165
	set_cr_intercept(svm, INTERCEPT_CR0_READ);
	set_cr_intercept(svm, INTERCEPT_CR3_READ);
	set_cr_intercept(svm, INTERCEPT_CR4_READ);
	set_cr_intercept(svm, INTERCEPT_CR0_WRITE);
	set_cr_intercept(svm, INTERCEPT_CR3_WRITE);
	set_cr_intercept(svm, INTERCEPT_CR4_WRITE);
1166 1167
	if (!kvm_vcpu_apicv_active(&svm->vcpu))
		set_cr_intercept(svm, INTERCEPT_CR8_WRITE);
A
Avi Kivity 已提交
1168

1169
	set_dr_intercepts(svm);
A
Avi Kivity 已提交
1170

1171 1172 1173
	set_exception_intercept(svm, PF_VECTOR);
	set_exception_intercept(svm, UD_VECTOR);
	set_exception_intercept(svm, MC_VECTOR);
1174
	set_exception_intercept(svm, AC_VECTOR);
1175
	set_exception_intercept(svm, DB_VECTOR);
A
Avi Kivity 已提交
1176

1177 1178 1179 1180
	set_intercept(svm, INTERCEPT_INTR);
	set_intercept(svm, INTERCEPT_NMI);
	set_intercept(svm, INTERCEPT_SMI);
	set_intercept(svm, INTERCEPT_SELECTIVE_CR0);
A
Avi Kivity 已提交
1181
	set_intercept(svm, INTERCEPT_RDPMC);
1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198
	set_intercept(svm, INTERCEPT_CPUID);
	set_intercept(svm, INTERCEPT_INVD);
	set_intercept(svm, INTERCEPT_HLT);
	set_intercept(svm, INTERCEPT_INVLPG);
	set_intercept(svm, INTERCEPT_INVLPGA);
	set_intercept(svm, INTERCEPT_IOIO_PROT);
	set_intercept(svm, INTERCEPT_MSR_PROT);
	set_intercept(svm, INTERCEPT_TASK_SWITCH);
	set_intercept(svm, INTERCEPT_SHUTDOWN);
	set_intercept(svm, INTERCEPT_VMRUN);
	set_intercept(svm, INTERCEPT_VMMCALL);
	set_intercept(svm, INTERCEPT_VMLOAD);
	set_intercept(svm, INTERCEPT_VMSAVE);
	set_intercept(svm, INTERCEPT_STGI);
	set_intercept(svm, INTERCEPT_CLGI);
	set_intercept(svm, INTERCEPT_SKINIT);
	set_intercept(svm, INTERCEPT_WBINVD);
J
Joerg Roedel 已提交
1199
	set_intercept(svm, INTERCEPT_XSETBV);
A
Avi Kivity 已提交
1200

1201 1202 1203 1204 1205
	if (!kvm_mwait_in_guest()) {
		set_intercept(svm, INTERCEPT_MONITOR);
		set_intercept(svm, INTERCEPT_MWAIT);
	}

A
Avi Kivity 已提交
1206
	control->iopm_base_pa = iopm_base;
1207
	control->msrpm_base_pa = __pa(svm->msrpm);
A
Avi Kivity 已提交
1208 1209 1210 1211 1212 1213 1214 1215 1216
	control->int_ctl = V_INTR_MASKING_MASK;

	init_seg(&save->es);
	init_seg(&save->ss);
	init_seg(&save->ds);
	init_seg(&save->fs);
	init_seg(&save->gs);

	save->cs.selector = 0xf000;
1217
	save->cs.base = 0xffff0000;
A
Avi Kivity 已提交
1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228
	/* Executable/Readable Code Segment */
	save->cs.attrib = SVM_SELECTOR_READ_MASK | SVM_SELECTOR_P_MASK |
		SVM_SELECTOR_S_MASK | SVM_SELECTOR_CODE_MASK;
	save->cs.limit = 0xffff;

	save->gdtr.limit = 0xffff;
	save->idtr.limit = 0xffff;

	init_sys_seg(&save->ldtr, SEG_TYPE_LDT);
	init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16);

P
Paolo Bonzini 已提交
1229
	svm_set_efer(&svm->vcpu, 0);
M
Mike Day 已提交
1230
	save->dr6 = 0xffff0ff0;
1231
	kvm_set_rflags(&svm->vcpu, 2);
A
Avi Kivity 已提交
1232
	save->rip = 0x0000fff0;
1233
	svm->vcpu.arch.regs[VCPU_REGS_RIP] = save->rip;
A
Avi Kivity 已提交
1234

J
Joerg Roedel 已提交
1235
	/*
1236
	 * svm_set_cr0() sets PG and WP and clears NW and CD on save->cr0.
1237
	 * It also updates the guest-visible cr0 value.
A
Avi Kivity 已提交
1238
	 */
1239
	svm_set_cr0(&svm->vcpu, X86_CR0_NW | X86_CR0_CD | X86_CR0_ET);
1240
	kvm_mmu_reset_context(&svm->vcpu);
1241

1242
	save->cr4 = X86_CR4_PAE;
A
Avi Kivity 已提交
1243
	/* rdx = ?? */
1244 1245 1246 1247

	if (npt_enabled) {
		/* Setup VMCB for Nested Paging */
		control->nested_ctl = 1;
1248
		clr_intercept(svm, INTERCEPT_INVLPG);
1249
		clr_exception_intercept(svm, PF_VECTOR);
1250 1251
		clr_cr_intercept(svm, INTERCEPT_CR3_READ);
		clr_cr_intercept(svm, INTERCEPT_CR3_WRITE);
1252
		save->g_pat = svm->vcpu.arch.pat;
1253 1254 1255
		save->cr3 = 0;
		save->cr4 = 0;
	}
1256
	svm->asid_generation = 0;
1257

1258
	svm->nested.vmcb = 0;
1259 1260
	svm->vcpu.arch.hflags = 0;

1261
	if (boot_cpu_has(X86_FEATURE_PAUSEFILTER)) {
1262
		control->pause_filter_count = 3000;
1263
		set_intercept(svm, INTERCEPT_PAUSE);
1264 1265
	}

1266 1267 1268
	if (avic)
		avic_init_vmcb(svm);

1269 1270
	mark_all_dirty(svm->vmcb);

1271
	enable_gif(svm);
1272 1273 1274

}

1275 1276
static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu,
				       unsigned int index)
1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350
{
	u64 *avic_physical_id_table;
	struct kvm_arch *vm_data = &vcpu->kvm->arch;

	if (index >= AVIC_MAX_PHYSICAL_ID_COUNT)
		return NULL;

	avic_physical_id_table = page_address(vm_data->avic_physical_id_table_page);

	return &avic_physical_id_table[index];
}

/**
 * Note:
 * AVIC hardware walks the nested page table to check permissions,
 * but does not use the SPA address specified in the leaf page
 * table entry since it uses  address in the AVIC_BACKING_PAGE pointer
 * field of the VMCB. Therefore, we set up the
 * APIC_ACCESS_PAGE_PRIVATE_MEMSLOT (4KB) here.
 */
static int avic_init_access_page(struct kvm_vcpu *vcpu)
{
	struct kvm *kvm = vcpu->kvm;
	int ret;

	if (kvm->arch.apic_access_page_done)
		return 0;

	ret = x86_set_memory_region(kvm,
				    APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
				    APIC_DEFAULT_PHYS_BASE,
				    PAGE_SIZE);
	if (ret)
		return ret;

	kvm->arch.apic_access_page_done = true;
	return 0;
}

static int avic_init_backing_page(struct kvm_vcpu *vcpu)
{
	int ret;
	u64 *entry, new_entry;
	int id = vcpu->vcpu_id;
	struct vcpu_svm *svm = to_svm(vcpu);

	ret = avic_init_access_page(vcpu);
	if (ret)
		return ret;

	if (id >= AVIC_MAX_PHYSICAL_ID_COUNT)
		return -EINVAL;

	if (!svm->vcpu.arch.apic->regs)
		return -EINVAL;

	svm->avic_backing_page = virt_to_page(svm->vcpu.arch.apic->regs);

	/* Setting AVIC backing page address in the phy APIC ID table */
	entry = avic_get_physical_id_entry(vcpu, id);
	if (!entry)
		return -EINVAL;

	new_entry = READ_ONCE(*entry);
	new_entry = (page_to_phys(svm->avic_backing_page) &
		     AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK) |
		     AVIC_PHYSICAL_ID_ENTRY_VALID_MASK;
	WRITE_ONCE(*entry, new_entry);

	svm->avic_physical_id_cache = entry;

	return 0;
}

1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378
static inline int avic_get_next_vm_id(void)
{
	int id;

	spin_lock(&avic_vm_id_lock);

	/* AVIC VM ID is one-based. */
	id = find_next_zero_bit(avic_vm_id_bitmap, AVIC_VM_ID_NR, 1);
	if (id <= AVIC_VM_ID_MASK)
		__set_bit(id, avic_vm_id_bitmap);
	else
		id = -EAGAIN;

	spin_unlock(&avic_vm_id_lock);
	return id;
}

static inline int avic_free_vm_id(int id)
{
	if (id <= 0 || id > AVIC_VM_ID_MASK)
		return -EINVAL;

	spin_lock(&avic_vm_id_lock);
	__clear_bit(id, avic_vm_id_bitmap);
	spin_unlock(&avic_vm_id_lock);
	return 0;
}

1379 1380
static void avic_vm_destroy(struct kvm *kvm)
{
1381
	unsigned long flags;
1382 1383
	struct kvm_arch *vm_data = &kvm->arch;

1384 1385 1386
	if (!avic)
		return;

1387 1388
	avic_free_vm_id(vm_data->avic_vm_id);

1389 1390 1391 1392
	if (vm_data->avic_logical_id_table_page)
		__free_page(vm_data->avic_logical_id_table_page);
	if (vm_data->avic_physical_id_table_page)
		__free_page(vm_data->avic_physical_id_table_page);
1393 1394 1395 1396

	spin_lock_irqsave(&svm_vm_data_hash_lock, flags);
	hash_del(&vm_data->hnode);
	spin_unlock_irqrestore(&svm_vm_data_hash_lock, flags);
1397 1398 1399 1400
}

static int avic_vm_init(struct kvm *kvm)
{
1401
	unsigned long flags;
1402
	int vm_id, err = -ENOMEM;
1403 1404 1405 1406 1407 1408 1409
	struct kvm_arch *vm_data = &kvm->arch;
	struct page *p_page;
	struct page *l_page;

	if (!avic)
		return 0;

1410 1411 1412 1413
	vm_id = avic_get_next_vm_id();
	if (vm_id < 0)
		return vm_id;
	vm_data->avic_vm_id = (u32)vm_id;
1414

1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430
	/* Allocating physical APIC ID table (4KB) */
	p_page = alloc_page(GFP_KERNEL);
	if (!p_page)
		goto free_avic;

	vm_data->avic_physical_id_table_page = p_page;
	clear_page(page_address(p_page));

	/* Allocating logical APIC ID table (4KB) */
	l_page = alloc_page(GFP_KERNEL);
	if (!l_page)
		goto free_avic;

	vm_data->avic_logical_id_table_page = l_page;
	clear_page(page_address(l_page));

1431 1432 1433 1434
	spin_lock_irqsave(&svm_vm_data_hash_lock, flags);
	hash_add(svm_vm_data_hash, &vm_data->hnode, vm_data->avic_vm_id);
	spin_unlock_irqrestore(&svm_vm_data_hash_lock, flags);

1435 1436 1437 1438 1439
	return 0;

free_avic:
	avic_vm_destroy(kvm);
	return err;
A
Avi Kivity 已提交
1440 1441
}

1442 1443
static inline int
avic_update_iommu_vcpu_affinity(struct kvm_vcpu *vcpu, int cpu, bool r)
1444
{
1445 1446 1447
	int ret = 0;
	unsigned long flags;
	struct amd_svm_iommu_ir *ir;
1448 1449
	struct vcpu_svm *svm = to_svm(vcpu);

1450 1451
	if (!kvm_arch_has_assigned_device(vcpu->kvm))
		return 0;
1452

1453 1454 1455 1456 1457
	/*
	 * Here, we go through the per-vcpu ir_list to update all existing
	 * interrupt remapping table entry targeting this vcpu.
	 */
	spin_lock_irqsave(&svm->ir_list_lock, flags);
1458

1459 1460
	if (list_empty(&svm->ir_list))
		goto out;
1461

1462 1463 1464 1465 1466 1467 1468 1469
	list_for_each_entry(ir, &svm->ir_list, node) {
		ret = amd_iommu_update_ga(cpu, r, ir->data);
		if (ret)
			break;
	}
out:
	spin_unlock_irqrestore(&svm->ir_list_lock, flags);
	return ret;
1470 1471 1472 1473 1474 1475
}

static void avic_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
{
	u64 entry;
	/* ID = 0xff (broadcast), ID > 0xff (reserved) */
1476
	int h_physical_id = kvm_cpu_get_apicid(cpu);
1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!kvm_vcpu_apicv_active(vcpu))
		return;

	if (WARN_ON(h_physical_id >= AVIC_MAX_PHYSICAL_ID_COUNT))
		return;

	entry = READ_ONCE(*(svm->avic_physical_id_cache));
	WARN_ON(entry & AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK);

	entry &= ~AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK;
	entry |= (h_physical_id & AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK);

	entry &= ~AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK;
	if (svm->avic_is_running)
		entry |= AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK;

	WRITE_ONCE(*(svm->avic_physical_id_cache), entry);
1496 1497
	avic_update_iommu_vcpu_affinity(vcpu, h_physical_id,
					svm->avic_is_running);
1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508
}

static void avic_vcpu_put(struct kvm_vcpu *vcpu)
{
	u64 entry;
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!kvm_vcpu_apicv_active(vcpu))
		return;

	entry = READ_ONCE(*(svm->avic_physical_id_cache));
1509 1510 1511
	if (entry & AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK)
		avic_update_iommu_vcpu_affinity(vcpu, -1, 0);

1512 1513
	entry &= ~AVIC_PHYSICAL_ID_ENTRY_IS_RUNNING_MASK;
	WRITE_ONCE(*(svm->avic_physical_id_cache), entry);
A
Avi Kivity 已提交
1514 1515
}

1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529
/**
 * This function is called during VCPU halt/unhalt.
 */
static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->avic_is_running = is_run;
	if (is_run)
		avic_vcpu_load(vcpu, vcpu->cpu);
	else
		avic_vcpu_put(vcpu);
}

1530
static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
1531 1532
{
	struct vcpu_svm *svm = to_svm(vcpu);
1533 1534
	u32 dummy;
	u32 eax = 1;
1535

1536 1537 1538 1539 1540 1541
	if (!init_event) {
		svm->vcpu.arch.apic_base = APIC_DEFAULT_PHYS_BASE |
					   MSR_IA32_APICBASE_ENABLE;
		if (kvm_vcpu_is_reset_bsp(&svm->vcpu))
			svm->vcpu.arch.apic_base |= MSR_IA32_APICBASE_BSP;
	}
P
Paolo Bonzini 已提交
1542
	init_vmcb(svm);
A
Avi Kivity 已提交
1543

1544 1545
	kvm_cpuid(vcpu, &eax, &dummy, &dummy, &dummy);
	kvm_register_write(vcpu, VCPU_REGS_RDX, eax);
1546 1547 1548

	if (kvm_vcpu_apicv_active(vcpu) && !init_event)
		avic_update_vapic_bar(svm, APIC_DEFAULT_PHYS_BASE);
1549 1550
}

R
Rusty Russell 已提交
1551
static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
A
Avi Kivity 已提交
1552
{
1553
	struct vcpu_svm *svm;
A
Avi Kivity 已提交
1554
	struct page *page;
1555
	struct page *msrpm_pages;
A
Alexander Graf 已提交
1556
	struct page *hsave_page;
A
Alexander Graf 已提交
1557
	struct page *nested_msrpm_pages;
R
Rusty Russell 已提交
1558
	int err;
A
Avi Kivity 已提交
1559

1560
	svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
R
Rusty Russell 已提交
1561 1562 1563 1564 1565 1566 1567 1568 1569
	if (!svm) {
		err = -ENOMEM;
		goto out;
	}

	err = kvm_vcpu_init(&svm->vcpu, kvm, id);
	if (err)
		goto free_svm;

1570
	err = -ENOMEM;
A
Avi Kivity 已提交
1571
	page = alloc_page(GFP_KERNEL);
1572
	if (!page)
R
Rusty Russell 已提交
1573
		goto uninit;
A
Avi Kivity 已提交
1574

1575 1576
	msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
	if (!msrpm_pages)
1577
		goto free_page1;
A
Alexander Graf 已提交
1578 1579 1580

	nested_msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
	if (!nested_msrpm_pages)
1581
		goto free_page2;
1582

A
Alexander Graf 已提交
1583 1584
	hsave_page = alloc_page(GFP_KERNEL);
	if (!hsave_page)
1585 1586
		goto free_page3;

1587 1588 1589 1590
	if (avic) {
		err = avic_init_backing_page(&svm->vcpu);
		if (err)
			goto free_page4;
1591 1592 1593

		INIT_LIST_HEAD(&svm->ir_list);
		spin_lock_init(&svm->ir_list_lock);
1594 1595
	}

1596 1597 1598 1599 1600
	/* We initialize this flag to true to make sure that the is_running
	 * bit would be set the first time the vcpu is loaded.
	 */
	svm->avic_is_running = true;

1601
	svm->nested.hsave = page_address(hsave_page);
A
Alexander Graf 已提交
1602

1603 1604 1605
	svm->msrpm = page_address(msrpm_pages);
	svm_vcpu_init_msrpm(svm->msrpm);

1606
	svm->nested.msrpm = page_address(nested_msrpm_pages);
1607
	svm_vcpu_init_msrpm(svm->nested.msrpm);
A
Alexander Graf 已提交
1608

1609 1610 1611 1612
	svm->vmcb = page_address(page);
	clear_page(svm->vmcb);
	svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
	svm->asid_generation = 0;
P
Paolo Bonzini 已提交
1613
	init_vmcb(svm);
A
Avi Kivity 已提交
1614

1615 1616
	svm_init_osvw(&svm->vcpu);

R
Rusty Russell 已提交
1617
	return &svm->vcpu;
1618

1619 1620
free_page4:
	__free_page(hsave_page);
1621 1622 1623 1624 1625 1626
free_page3:
	__free_pages(nested_msrpm_pages, MSRPM_ALLOC_ORDER);
free_page2:
	__free_pages(msrpm_pages, MSRPM_ALLOC_ORDER);
free_page1:
	__free_page(page);
R
Rusty Russell 已提交
1627 1628 1629
uninit:
	kvm_vcpu_uninit(&svm->vcpu);
free_svm:
1630
	kmem_cache_free(kvm_vcpu_cache, svm);
R
Rusty Russell 已提交
1631 1632
out:
	return ERR_PTR(err);
A
Avi Kivity 已提交
1633 1634 1635 1636
}

static void svm_free_vcpu(struct kvm_vcpu *vcpu)
{
1637 1638
	struct vcpu_svm *svm = to_svm(vcpu);

R
Rusty Russell 已提交
1639
	__free_page(pfn_to_page(svm->vmcb_pa >> PAGE_SHIFT));
1640
	__free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
1641 1642
	__free_page(virt_to_page(svm->nested.hsave));
	__free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
R
Rusty Russell 已提交
1643
	kvm_vcpu_uninit(vcpu);
1644
	kmem_cache_free(kvm_vcpu_cache, svm);
A
Avi Kivity 已提交
1645 1646
}

1647
static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
A
Avi Kivity 已提交
1648
{
1649
	struct vcpu_svm *svm = to_svm(vcpu);
1650
	int i;
1651 1652

	if (unlikely(cpu != vcpu->cpu)) {
1653
		svm->asid_generation = 0;
1654
		mark_all_dirty(svm->vmcb);
1655
	}
1656

1657 1658 1659
#ifdef CONFIG_X86_64
	rdmsrl(MSR_GS_BASE, to_svm(vcpu)->host.gs_base);
#endif
1660 1661 1662 1663
	savesegment(fs, svm->host.fs);
	savesegment(gs, svm->host.gs);
	svm->host.ldt = kvm_read_ldt();

1664
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
1665
		rdmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
1666

1667 1668 1669 1670 1671 1672
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		u64 tsc_ratio = vcpu->arch.tsc_scaling_ratio;
		if (tsc_ratio != __this_cpu_read(current_tsc_ratio)) {
			__this_cpu_write(current_tsc_ratio, tsc_ratio);
			wrmsrl(MSR_AMD64_TSC_RATIO, tsc_ratio);
		}
1673
	}
P
Paolo Bonzini 已提交
1674 1675 1676
	/* This assumes that the kernel never uses MSR_TSC_AUX */
	if (static_cpu_has(X86_FEATURE_RDTSCP))
		wrmsrl(MSR_TSC_AUX, svm->tsc_aux);
1677 1678

	avic_vcpu_load(vcpu, cpu);
A
Avi Kivity 已提交
1679 1680 1681 1682
}

static void svm_vcpu_put(struct kvm_vcpu *vcpu)
{
1683
	struct vcpu_svm *svm = to_svm(vcpu);
1684 1685
	int i;

1686 1687
	avic_vcpu_put(vcpu);

1688
	++vcpu->stat.host_state_reload;
1689 1690 1691
	kvm_load_ldt(svm->host.ldt);
#ifdef CONFIG_X86_64
	loadsegment(fs, svm->host.fs);
1692
	wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gsbase);
1693
	load_gs_index(svm->host.gs);
1694
#else
1695
#ifdef CONFIG_X86_32_LAZY_GS
1696
	loadsegment(gs, svm->host.gs);
1697
#endif
1698
#endif
1699
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
1700
		wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
A
Avi Kivity 已提交
1701 1702
}

1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
static void svm_vcpu_blocking(struct kvm_vcpu *vcpu)
{
	avic_set_running(vcpu, false);
}

static void svm_vcpu_unblocking(struct kvm_vcpu *vcpu)
{
	avic_set_running(vcpu, true);
}

A
Avi Kivity 已提交
1713 1714
static unsigned long svm_get_rflags(struct kvm_vcpu *vcpu)
{
1715
	return to_svm(vcpu)->vmcb->save.rflags;
A
Avi Kivity 已提交
1716 1717 1718 1719
}

static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
{
P
Paolo Bonzini 已提交
1720
       /*
A
Andrea Gelmini 已提交
1721
        * Any change of EFLAGS.VM is accompanied by a reload of SS
P
Paolo Bonzini 已提交
1722 1723 1724
        * (caused by either a task switch or an inter-privilege IRET),
        * so we do not need to update the CPL here.
        */
1725
	to_svm(vcpu)->vmcb->save.rflags = rflags;
A
Avi Kivity 已提交
1726 1727
}

1728 1729 1730 1731 1732
static u32 svm_get_pkru(struct kvm_vcpu *vcpu)
{
	return 0;
}

A
Avi Kivity 已提交
1733 1734 1735 1736 1737
static void svm_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
{
	switch (reg) {
	case VCPU_EXREG_PDPTR:
		BUG_ON(!npt_enabled);
1738
		load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu));
A
Avi Kivity 已提交
1739 1740 1741 1742 1743 1744
		break;
	default:
		BUG();
	}
}

1745 1746
static void svm_set_vintr(struct vcpu_svm *svm)
{
1747
	set_intercept(svm, INTERCEPT_VINTR);
1748 1749 1750 1751
}

static void svm_clear_vintr(struct vcpu_svm *svm)
{
1752
	clr_intercept(svm, INTERCEPT_VINTR);
1753 1754
}

A
Avi Kivity 已提交
1755 1756
static struct vmcb_seg *svm_seg(struct kvm_vcpu *vcpu, int seg)
{
1757
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
A
Avi Kivity 已提交
1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769

	switch (seg) {
	case VCPU_SREG_CS: return &save->cs;
	case VCPU_SREG_DS: return &save->ds;
	case VCPU_SREG_ES: return &save->es;
	case VCPU_SREG_FS: return &save->fs;
	case VCPU_SREG_GS: return &save->gs;
	case VCPU_SREG_SS: return &save->ss;
	case VCPU_SREG_TR: return &save->tr;
	case VCPU_SREG_LDTR: return &save->ldtr;
	}
	BUG();
A
Al Viro 已提交
1770
	return NULL;
A
Avi Kivity 已提交
1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794
}

static u64 svm_get_segment_base(struct kvm_vcpu *vcpu, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	return s->base;
}

static void svm_get_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	var->base = s->base;
	var->limit = s->limit;
	var->selector = s->selector;
	var->type = s->attrib & SVM_SELECTOR_TYPE_MASK;
	var->s = (s->attrib >> SVM_SELECTOR_S_SHIFT) & 1;
	var->dpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
	var->present = (s->attrib >> SVM_SELECTOR_P_SHIFT) & 1;
	var->avl = (s->attrib >> SVM_SELECTOR_AVL_SHIFT) & 1;
	var->l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
	var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
1795 1796 1797 1798 1799 1800 1801 1802 1803 1804

	/*
	 * AMD CPUs circa 2014 track the G bit for all segments except CS.
	 * However, the SVM spec states that the G bit is not observed by the
	 * CPU, and some VMware virtual CPUs drop the G bit for all segments.
	 * So let's synthesize a legal G bit for all segments, this helps
	 * running KVM nested. It also helps cross-vendor migration, because
	 * Intel's vmentry has a check on the 'G' bit.
	 */
	var->g = s->limit > 0xfffff;
1805

J
Joerg Roedel 已提交
1806 1807
	/*
	 * AMD's VMCB does not have an explicit unusable field, so emulate it
1808 1809 1810 1811
	 * for cross vendor migration purposes by "not present"
	 */
	var->unusable = !var->present || (var->type == 0);

1812 1813 1814 1815 1816 1817
	switch (seg) {
	case VCPU_SREG_TR:
		/*
		 * Work around a bug where the busy flag in the tr selector
		 * isn't exposed
		 */
1818
		var->type |= 0x2;
1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833
		break;
	case VCPU_SREG_DS:
	case VCPU_SREG_ES:
	case VCPU_SREG_FS:
	case VCPU_SREG_GS:
		/*
		 * The accessed bit must always be set in the segment
		 * descriptor cache, although it can be cleared in the
		 * descriptor, the cached bit always remains at 1. Since
		 * Intel has a check on this, set it here to support
		 * cross-vendor migration.
		 */
		if (!var->unusable)
			var->type |= 0x1;
		break;
1834
	case VCPU_SREG_SS:
J
Joerg Roedel 已提交
1835 1836
		/*
		 * On AMD CPUs sometimes the DB bit in the segment
1837 1838 1839 1840 1841 1842
		 * descriptor is left as 1, although the whole segment has
		 * been made unusable. Clear it here to pass an Intel VMX
		 * entry check when cross vendor migrating.
		 */
		if (var->unusable)
			var->db = 0;
J
Jan Kiszka 已提交
1843
		var->dpl = to_svm(vcpu)->vmcb->save.cpl;
1844
		break;
1845
	}
A
Avi Kivity 已提交
1846 1847
}

1848 1849 1850 1851 1852 1853 1854
static int svm_get_cpl(struct kvm_vcpu *vcpu)
{
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;

	return save->cpl;
}

1855
static void svm_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1856
{
1857 1858
	struct vcpu_svm *svm = to_svm(vcpu);

1859 1860
	dt->size = svm->vmcb->save.idtr.limit;
	dt->address = svm->vmcb->save.idtr.base;
A
Avi Kivity 已提交
1861 1862
}

1863
static void svm_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1864
{
1865 1866
	struct vcpu_svm *svm = to_svm(vcpu);

1867 1868
	svm->vmcb->save.idtr.limit = dt->size;
	svm->vmcb->save.idtr.base = dt->address ;
1869
	mark_dirty(svm->vmcb, VMCB_DT);
A
Avi Kivity 已提交
1870 1871
}

1872
static void svm_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1873
{
1874 1875
	struct vcpu_svm *svm = to_svm(vcpu);

1876 1877
	dt->size = svm->vmcb->save.gdtr.limit;
	dt->address = svm->vmcb->save.gdtr.base;
A
Avi Kivity 已提交
1878 1879
}

1880
static void svm_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1881
{
1882 1883
	struct vcpu_svm *svm = to_svm(vcpu);

1884 1885
	svm->vmcb->save.gdtr.limit = dt->size;
	svm->vmcb->save.gdtr.base = dt->address ;
1886
	mark_dirty(svm->vmcb, VMCB_DT);
A
Avi Kivity 已提交
1887 1888
}

1889 1890 1891 1892
static void svm_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
{
}

1893 1894 1895 1896
static void svm_decache_cr3(struct kvm_vcpu *vcpu)
{
}

1897
static void svm_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
1898 1899 1900
{
}

A
Avi Kivity 已提交
1901 1902 1903 1904 1905
static void update_cr0_intercept(struct vcpu_svm *svm)
{
	ulong gcr0 = svm->vcpu.arch.cr0;
	u64 *hcr0 = &svm->vmcb->save.cr0;

1906 1907
	*hcr0 = (*hcr0 & ~SVM_CR0_SELECTIVE_MASK)
		| (gcr0 & SVM_CR0_SELECTIVE_MASK);
A
Avi Kivity 已提交
1908

1909
	mark_dirty(svm->vmcb, VMCB_CR);
A
Avi Kivity 已提交
1910

1911
	if (gcr0 == *hcr0) {
1912 1913
		clr_cr_intercept(svm, INTERCEPT_CR0_READ);
		clr_cr_intercept(svm, INTERCEPT_CR0_WRITE);
A
Avi Kivity 已提交
1914
	} else {
1915 1916
		set_cr_intercept(svm, INTERCEPT_CR0_READ);
		set_cr_intercept(svm, INTERCEPT_CR0_WRITE);
A
Avi Kivity 已提交
1917 1918 1919
	}
}

A
Avi Kivity 已提交
1920 1921
static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
{
1922 1923
	struct vcpu_svm *svm = to_svm(vcpu);

1924
#ifdef CONFIG_X86_64
1925
	if (vcpu->arch.efer & EFER_LME) {
1926
		if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
1927
			vcpu->arch.efer |= EFER_LMA;
1928
			svm->vmcb->save.efer |= EFER_LMA | EFER_LME;
A
Avi Kivity 已提交
1929 1930
		}

M
Mike Day 已提交
1931
		if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) {
1932
			vcpu->arch.efer &= ~EFER_LMA;
1933
			svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME);
A
Avi Kivity 已提交
1934 1935 1936
		}
	}
#endif
1937
	vcpu->arch.cr0 = cr0;
1938 1939 1940

	if (!npt_enabled)
		cr0 |= X86_CR0_PG | X86_CR0_WP;
1941

1942 1943 1944 1945 1946 1947 1948
	/*
	 * re-enable caching here because the QEMU bios
	 * does not do it - this results in some delay at
	 * reboot
	 */
	if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
		cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
1949
	svm->vmcb->save.cr0 = cr0;
1950
	mark_dirty(svm->vmcb, VMCB_CR);
A
Avi Kivity 已提交
1951
	update_cr0_intercept(svm);
A
Avi Kivity 已提交
1952 1953
}

1954
static int svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
A
Avi Kivity 已提交
1955
{
1956
	unsigned long host_cr4_mce = cr4_read_shadow() & X86_CR4_MCE;
1957 1958
	unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;

1959 1960 1961
	if (cr4 & X86_CR4_VMXE)
		return 1;

1962
	if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
1963
		svm_flush_tlb(vcpu);
1964

1965 1966 1967
	vcpu->arch.cr4 = cr4;
	if (!npt_enabled)
		cr4 |= X86_CR4_PAE;
1968
	cr4 |= host_cr4_mce;
1969
	to_svm(vcpu)->vmcb->save.cr4 = cr4;
1970
	mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
1971
	return 0;
A
Avi Kivity 已提交
1972 1973 1974 1975 1976
}

static void svm_set_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
1977
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	s->base = var->base;
	s->limit = var->limit;
	s->selector = var->selector;
	if (var->unusable)
		s->attrib = 0;
	else {
		s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
		s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
		s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
		s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
		s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
		s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
		s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
		s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
	}
P
Paolo Bonzini 已提交
1995 1996 1997 1998 1999 2000 2001 2002 2003

	/*
	 * This is always accurate, except if SYSRET returned to a segment
	 * with SS.DPL != 3.  Intel does not have this quirk, and always
	 * forces SS.DPL to 3 on sysret, so we ignore that case; fixing it
	 * would entail passing the CPL to userspace and back.
	 */
	if (seg == VCPU_SREG_SS)
		svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
A
Avi Kivity 已提交
2004

2005
	mark_dirty(svm->vmcb, VMCB_SEG);
A
Avi Kivity 已提交
2006 2007
}

2008
static void update_bp_intercept(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
2009
{
J
Jan Kiszka 已提交
2010 2011
	struct vcpu_svm *svm = to_svm(vcpu);

2012
	clr_exception_intercept(svm, BP_VECTOR);
2013

J
Jan Kiszka 已提交
2014 2015
	if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
		if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
2016
			set_exception_intercept(svm, BP_VECTOR);
J
Jan Kiszka 已提交
2017 2018
	} else
		vcpu->guest_debug = 0;
2019 2020
}

2021
static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
A
Avi Kivity 已提交
2022
{
2023 2024 2025
	if (sd->next_asid > sd->max_asid) {
		++sd->asid_generation;
		sd->next_asid = 1;
2026
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
A
Avi Kivity 已提交
2027 2028
	}

2029 2030
	svm->asid_generation = sd->asid_generation;
	svm->vmcb->control.asid = sd->next_asid++;
2031 2032

	mark_dirty(svm->vmcb, VMCB_ASID);
A
Avi Kivity 已提交
2033 2034
}

J
Jan Kiszka 已提交
2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047
static u64 svm_get_dr6(struct kvm_vcpu *vcpu)
{
	return to_svm(vcpu)->vmcb->save.dr6;
}

static void svm_set_dr6(struct kvm_vcpu *vcpu, unsigned long value)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.dr6 = value;
	mark_dirty(svm->vmcb, VMCB_DR);
}

2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062
static void svm_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	get_debugreg(vcpu->arch.db[0], 0);
	get_debugreg(vcpu->arch.db[1], 1);
	get_debugreg(vcpu->arch.db[2], 2);
	get_debugreg(vcpu->arch.db[3], 3);
	vcpu->arch.dr6 = svm_get_dr6(vcpu);
	vcpu->arch.dr7 = svm->vmcb->save.dr7;

	vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
	set_dr_intercepts(svm);
}

2063
static void svm_set_dr7(struct kvm_vcpu *vcpu, unsigned long value)
A
Avi Kivity 已提交
2064
{
2065 2066
	struct vcpu_svm *svm = to_svm(vcpu);

2067
	svm->vmcb->save.dr7 = value;
2068
	mark_dirty(svm->vmcb, VMCB_DR);
A
Avi Kivity 已提交
2069 2070
}

A
Avi Kivity 已提交
2071
static int pf_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2072
{
G
Gleb Natapov 已提交
2073
	u64 fault_address = svm->vmcb->control.exit_info_2;
2074
	u64 error_code;
G
Gleb Natapov 已提交
2075
	int r = 1;
A
Avi Kivity 已提交
2076

G
Gleb Natapov 已提交
2077 2078 2079
	switch (svm->apf_reason) {
	default:
		error_code = svm->vmcb->control.exit_info_1;
2080

G
Gleb Natapov 已提交
2081 2082 2083
		trace_kvm_page_fault(fault_address, error_code);
		if (!npt_enabled && kvm_event_needs_reinjection(&svm->vcpu))
			kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
2084 2085 2086
		r = kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code,
			svm->vmcb->control.insn_bytes,
			svm->vmcb->control.insn_len);
G
Gleb Natapov 已提交
2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101
		break;
	case KVM_PV_REASON_PAGE_NOT_PRESENT:
		svm->apf_reason = 0;
		local_irq_disable();
		kvm_async_pf_task_wait(fault_address);
		local_irq_enable();
		break;
	case KVM_PV_REASON_PAGE_READY:
		svm->apf_reason = 0;
		local_irq_disable();
		kvm_async_pf_task_wake(fault_address);
		local_irq_enable();
		break;
	}
	return r;
A
Avi Kivity 已提交
2102 2103
}

A
Avi Kivity 已提交
2104
static int db_interception(struct vcpu_svm *svm)
J
Jan Kiszka 已提交
2105
{
A
Avi Kivity 已提交
2106 2107
	struct kvm_run *kvm_run = svm->vcpu.run;

J
Jan Kiszka 已提交
2108
	if (!(svm->vcpu.guest_debug &
2109
	      (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
J
Jan Kiszka 已提交
2110
		!svm->nmi_singlestep) {
J
Jan Kiszka 已提交
2111 2112 2113
		kvm_queue_exception(&svm->vcpu, DB_VECTOR);
		return 1;
	}
2114

J
Jan Kiszka 已提交
2115 2116
	if (svm->nmi_singlestep) {
		svm->nmi_singlestep = false;
2117 2118 2119 2120 2121 2122
		if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
			svm->vmcb->save.rflags &=
				~(X86_EFLAGS_TF | X86_EFLAGS_RF);
	}

	if (svm->vcpu.guest_debug &
J
Joerg Roedel 已提交
2123
	    (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) {
2124 2125 2126 2127 2128 2129 2130 2131
		kvm_run->exit_reason = KVM_EXIT_DEBUG;
		kvm_run->debug.arch.pc =
			svm->vmcb->save.cs.base + svm->vmcb->save.rip;
		kvm_run->debug.arch.exception = DB_VECTOR;
		return 0;
	}

	return 1;
J
Jan Kiszka 已提交
2132 2133
}

A
Avi Kivity 已提交
2134
static int bp_interception(struct vcpu_svm *svm)
J
Jan Kiszka 已提交
2135
{
A
Avi Kivity 已提交
2136 2137
	struct kvm_run *kvm_run = svm->vcpu.run;

J
Jan Kiszka 已提交
2138 2139 2140 2141 2142 2143
	kvm_run->exit_reason = KVM_EXIT_DEBUG;
	kvm_run->debug.arch.pc = svm->vmcb->save.cs.base + svm->vmcb->save.rip;
	kvm_run->debug.arch.exception = BP_VECTOR;
	return 0;
}

A
Avi Kivity 已提交
2144
static int ud_interception(struct vcpu_svm *svm)
2145 2146 2147
{
	int er;

2148
	er = emulate_instruction(&svm->vcpu, EMULTYPE_TRAP_UD);
2149
	if (er != EMULATE_DONE)
2150
		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
2151 2152 2153
	return 1;
}

2154 2155 2156 2157 2158 2159
static int ac_interception(struct vcpu_svm *svm)
{
	kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
	return 1;
}

2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198
static bool is_erratum_383(void)
{
	int err, i;
	u64 value;

	if (!erratum_383_found)
		return false;

	value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
	if (err)
		return false;

	/* Bit 62 may or may not be set for this mce */
	value &= ~(1ULL << 62);

	if (value != 0xb600000000010015ULL)
		return false;

	/* Clear MCi_STATUS registers */
	for (i = 0; i < 6; ++i)
		native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);

	value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
	if (!err) {
		u32 low, high;

		value &= ~(1ULL << 2);
		low    = lower_32_bits(value);
		high   = upper_32_bits(value);

		native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
	}

	/* Flush tlb to evict multi-match entries */
	__flush_tlb_all();

	return true;
}

2199
static void svm_handle_mce(struct vcpu_svm *svm)
2200
{
2201 2202 2203 2204 2205 2206 2207
	if (is_erratum_383()) {
		/*
		 * Erratum 383 triggered. Guest state is corrupt so kill the
		 * guest.
		 */
		pr_err("KVM: Guest triggered AMD Erratum 383\n");

2208
		kvm_make_request(KVM_REQ_TRIPLE_FAULT, &svm->vcpu);
2209 2210 2211 2212

		return;
	}

2213 2214 2215 2216 2217 2218 2219 2220
	/*
	 * On an #MC intercept the MCE handler is not called automatically in
	 * the host. So do it by hand here.
	 */
	asm volatile (
		"int $0x12\n");
	/* not sure if we ever come back to this point */

2221 2222 2223 2224 2225
	return;
}

static int mc_interception(struct vcpu_svm *svm)
{
2226 2227 2228
	return 1;
}

A
Avi Kivity 已提交
2229
static int shutdown_interception(struct vcpu_svm *svm)
2230
{
A
Avi Kivity 已提交
2231 2232
	struct kvm_run *kvm_run = svm->vcpu.run;

2233 2234 2235 2236
	/*
	 * VMCB is undefined after a SHUTDOWN intercept
	 * so reinitialize it.
	 */
2237
	clear_page(svm->vmcb);
P
Paolo Bonzini 已提交
2238
	init_vmcb(svm);
2239 2240 2241 2242 2243

	kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
	return 0;
}

A
Avi Kivity 已提交
2244
static int io_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2245
{
2246
	struct kvm_vcpu *vcpu = &svm->vcpu;
M
Mike Day 已提交
2247
	u32 io_info = svm->vmcb->control.exit_info_1; /* address size bug? */
2248
	int size, in, string;
2249
	unsigned port;
A
Avi Kivity 已提交
2250

R
Rusty Russell 已提交
2251
	++svm->vcpu.stat.io_exits;
2252
	string = (io_info & SVM_IOIO_STR_MASK) != 0;
2253
	in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
2254
	if (string)
2255
		return emulate_instruction(vcpu, 0) == EMULATE_DONE;
2256

2257 2258
	port = io_info >> 16;
	size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
2259
	svm->next_rip = svm->vmcb->control.exit_info_2;
2260
	skip_emulated_instruction(&svm->vcpu);
2261

2262 2263
	return in ? kvm_fast_pio_in(vcpu, size, port)
		  : kvm_fast_pio_out(vcpu, size, port);
A
Avi Kivity 已提交
2264 2265
}

A
Avi Kivity 已提交
2266
static int nmi_interception(struct vcpu_svm *svm)
2267 2268 2269 2270
{
	return 1;
}

A
Avi Kivity 已提交
2271
static int intr_interception(struct vcpu_svm *svm)
2272 2273 2274 2275 2276
{
	++svm->vcpu.stat.irq_exits;
	return 1;
}

A
Avi Kivity 已提交
2277
static int nop_on_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2278 2279 2280 2281
{
	return 1;
}

A
Avi Kivity 已提交
2282
static int halt_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2283
{
2284
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 1;
R
Rusty Russell 已提交
2285
	return kvm_emulate_halt(&svm->vcpu);
A
Avi Kivity 已提交
2286 2287
}

A
Avi Kivity 已提交
2288
static int vmmcall_interception(struct vcpu_svm *svm)
2289
{
2290
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2291
	return kvm_emulate_hypercall(&svm->vcpu);
2292 2293
}

2294 2295 2296 2297 2298 2299 2300
static unsigned long nested_svm_get_tdp_cr3(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	return svm->nested.nested_cr3;
}

2301 2302 2303 2304 2305 2306 2307
static u64 nested_svm_get_tdp_pdptr(struct kvm_vcpu *vcpu, int index)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 cr3 = svm->nested.nested_cr3;
	u64 pdpte;
	int ret;

2308 2309
	ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(cr3), &pdpte,
				       offset_in_page(cr3) + index * 8, 8);
2310 2311 2312 2313 2314
	if (ret)
		return 0;
	return pdpte;
}

2315 2316 2317 2318 2319 2320
static void nested_svm_set_tdp_cr3(struct kvm_vcpu *vcpu,
				   unsigned long root)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.nested_cr3 = root;
2321
	mark_dirty(svm->vmcb, VMCB_NPT);
2322
	svm_flush_tlb(vcpu);
2323 2324
}

2325 2326
static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu,
				       struct x86_exception *fault)
2327 2328 2329
{
	struct vcpu_svm *svm = to_svm(vcpu);

2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349
	if (svm->vmcb->control.exit_code != SVM_EXIT_NPF) {
		/*
		 * TODO: track the cause of the nested page fault, and
		 * correctly fill in the high bits of exit_info_1.
		 */
		svm->vmcb->control.exit_code = SVM_EXIT_NPF;
		svm->vmcb->control.exit_code_hi = 0;
		svm->vmcb->control.exit_info_1 = (1ULL << 32);
		svm->vmcb->control.exit_info_2 = fault->address;
	}

	svm->vmcb->control.exit_info_1 &= ~0xffffffffULL;
	svm->vmcb->control.exit_info_1 |= fault->error_code;

	/*
	 * The present bit is always zero for page structure faults on real
	 * hardware.
	 */
	if (svm->vmcb->control.exit_info_1 & (2ULL << 32))
		svm->vmcb->control.exit_info_1 &= ~1;
2350 2351 2352 2353

	nested_svm_vmexit(svm);
}

2354
static void nested_svm_init_mmu_context(struct kvm_vcpu *vcpu)
2355
{
2356 2357
	WARN_ON(mmu_is_nested(vcpu));
	kvm_init_shadow_mmu(vcpu);
2358 2359
	vcpu->arch.mmu.set_cr3           = nested_svm_set_tdp_cr3;
	vcpu->arch.mmu.get_cr3           = nested_svm_get_tdp_cr3;
2360
	vcpu->arch.mmu.get_pdptr         = nested_svm_get_tdp_pdptr;
2361 2362
	vcpu->arch.mmu.inject_page_fault = nested_svm_inject_npf_exit;
	vcpu->arch.mmu.shadow_root_level = get_npt_level();
2363
	reset_shadow_zero_bits_mask(vcpu, &vcpu->arch.mmu);
2364 2365 2366 2367 2368 2369 2370 2371
	vcpu->arch.walk_mmu              = &vcpu->arch.nested_mmu;
}

static void nested_svm_uninit_mmu_context(struct kvm_vcpu *vcpu)
{
	vcpu->arch.walk_mmu = &vcpu->arch.mmu;
}

2372 2373
static int nested_svm_check_permissions(struct vcpu_svm *svm)
{
2374
	if (!(svm->vcpu.arch.efer & EFER_SVME)
2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387
	    || !is_paging(&svm->vcpu)) {
		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
		return 1;
	}

	if (svm->vmcb->save.cpl) {
		kvm_inject_gp(&svm->vcpu, 0);
		return 1;
	}

       return 0;
}

2388 2389 2390
static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
				      bool has_error_code, u32 error_code)
{
2391 2392
	int vmexit;

2393
	if (!is_guest_mode(&svm->vcpu))
2394
		return 0;
2395

2396 2397 2398 2399 2400
	svm->vmcb->control.exit_code = SVM_EXIT_EXCP_BASE + nr;
	svm->vmcb->control.exit_code_hi = 0;
	svm->vmcb->control.exit_info_1 = error_code;
	svm->vmcb->control.exit_info_2 = svm->vcpu.arch.cr2;

2401 2402 2403 2404 2405
	vmexit = nested_svm_intercept(svm);
	if (vmexit == NESTED_EXIT_DONE)
		svm->nested.exit_required = true;

	return vmexit;
2406 2407
}

2408 2409
/* This function returns true if it is save to enable the irq window */
static inline bool nested_svm_intr(struct vcpu_svm *svm)
2410
{
2411
	if (!is_guest_mode(&svm->vcpu))
2412
		return true;
2413

2414
	if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK))
2415
		return true;
2416

2417
	if (!(svm->vcpu.arch.hflags & HF_HIF_MASK))
2418
		return false;
2419

2420 2421 2422 2423 2424 2425 2426 2427
	/*
	 * if vmexit was already requested (by intercepted exception
	 * for instance) do not overwrite it with "external interrupt"
	 * vmexit.
	 */
	if (svm->nested.exit_required)
		return false;

2428 2429 2430
	svm->vmcb->control.exit_code   = SVM_EXIT_INTR;
	svm->vmcb->control.exit_info_1 = 0;
	svm->vmcb->control.exit_info_2 = 0;
2431

2432 2433 2434
	if (svm->nested.intercept & 1ULL) {
		/*
		 * The #vmexit can't be emulated here directly because this
G
Guo Chao 已提交
2435
		 * code path runs with irqs and preemption disabled. A
2436 2437 2438 2439
		 * #vmexit emulation might sleep. Only signal request for
		 * the #vmexit here.
		 */
		svm->nested.exit_required = true;
2440
		trace_kvm_nested_intr_vmexit(svm->vmcb->save.rip);
2441
		return false;
2442 2443
	}

2444
	return true;
2445 2446
}

2447 2448 2449
/* This function returns true if it is save to enable the nmi window */
static inline bool nested_svm_nmi(struct vcpu_svm *svm)
{
2450
	if (!is_guest_mode(&svm->vcpu))
2451 2452 2453 2454 2455 2456 2457 2458 2459
		return true;

	if (!(svm->nested.intercept & (1ULL << INTERCEPT_NMI)))
		return true;

	svm->vmcb->control.exit_code = SVM_EXIT_NMI;
	svm->nested.exit_required = true;

	return false;
2460 2461
}

2462
static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page)
2463 2464 2465
{
	struct page *page;

2466 2467
	might_sleep();

2468
	page = kvm_vcpu_gfn_to_page(&svm->vcpu, gpa >> PAGE_SHIFT);
2469 2470 2471
	if (is_error_page(page))
		goto error;

2472 2473 2474
	*_page = page;

	return kmap(page);
2475 2476 2477 2478 2479 2480 2481

error:
	kvm_inject_gp(&svm->vcpu, 0);

	return NULL;
}

2482
static void nested_svm_unmap(struct page *page)
2483
{
2484
	kunmap(page);
2485 2486 2487
	kvm_release_page_dirty(page);
}

2488 2489
static int nested_svm_intercept_ioio(struct vcpu_svm *svm)
{
2490 2491 2492
	unsigned port, size, iopm_len;
	u16 val, mask;
	u8 start_bit;
2493
	u64 gpa;
2494

2495 2496
	if (!(svm->nested.intercept & (1ULL << INTERCEPT_IOIO_PROT)))
		return NESTED_EXIT_HOST;
2497

2498
	port = svm->vmcb->control.exit_info_1 >> 16;
2499 2500
	size = (svm->vmcb->control.exit_info_1 & SVM_IOIO_SIZE_MASK) >>
		SVM_IOIO_SIZE_SHIFT;
2501
	gpa  = svm->nested.vmcb_iopm + (port / 8);
2502 2503 2504 2505
	start_bit = port % 8;
	iopm_len = (start_bit + size > 8) ? 2 : 1;
	mask = (0xf >> (4 - size)) << start_bit;
	val = 0;
2506

2507
	if (kvm_vcpu_read_guest(&svm->vcpu, gpa, &val, iopm_len))
2508
		return NESTED_EXIT_DONE;
2509

2510
	return (val & mask) ? NESTED_EXIT_DONE : NESTED_EXIT_HOST;
2511 2512
}

2513
static int nested_svm_exit_handled_msr(struct vcpu_svm *svm)
2514
{
2515 2516
	u32 offset, msr, value;
	int write, mask;
2517

2518
	if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
2519
		return NESTED_EXIT_HOST;
2520

2521 2522 2523 2524
	msr    = svm->vcpu.arch.regs[VCPU_REGS_RCX];
	offset = svm_msrpm_offset(msr);
	write  = svm->vmcb->control.exit_info_1 & 1;
	mask   = 1 << ((2 * (msr & 0xf)) + write);
2525

2526 2527
	if (offset == MSR_INVALID)
		return NESTED_EXIT_DONE;
2528

2529 2530
	/* Offset is in 32 bit units but need in 8 bit units */
	offset *= 4;
2531

2532
	if (kvm_vcpu_read_guest(&svm->vcpu, svm->nested.vmcb_msrpm + offset, &value, 4))
2533
		return NESTED_EXIT_DONE;
2534

2535
	return (value & mask) ? NESTED_EXIT_DONE : NESTED_EXIT_HOST;
2536 2537
}

2538
static int nested_svm_exit_special(struct vcpu_svm *svm)
2539 2540
{
	u32 exit_code = svm->vmcb->control.exit_code;
2541

2542 2543 2544
	switch (exit_code) {
	case SVM_EXIT_INTR:
	case SVM_EXIT_NMI:
2545
	case SVM_EXIT_EXCP_BASE + MC_VECTOR:
2546 2547
		return NESTED_EXIT_HOST;
	case SVM_EXIT_NPF:
J
Joerg Roedel 已提交
2548
		/* For now we are always handling NPFs when using them */
2549 2550 2551 2552
		if (npt_enabled)
			return NESTED_EXIT_HOST;
		break;
	case SVM_EXIT_EXCP_BASE + PF_VECTOR:
G
Gleb Natapov 已提交
2553 2554
		/* When we're shadowing, trap PFs, but not async PF */
		if (!npt_enabled && svm->apf_reason == 0)
2555 2556 2557 2558
			return NESTED_EXIT_HOST;
		break;
	default:
		break;
2559 2560
	}

2561 2562 2563 2564 2565 2566
	return NESTED_EXIT_CONTINUE;
}

/*
 * If this function returns true, this #vmexit was already handled
 */
2567
static int nested_svm_intercept(struct vcpu_svm *svm)
2568 2569 2570 2571
{
	u32 exit_code = svm->vmcb->control.exit_code;
	int vmexit = NESTED_EXIT_HOST;

2572
	switch (exit_code) {
2573
	case SVM_EXIT_MSR:
2574
		vmexit = nested_svm_exit_handled_msr(svm);
2575
		break;
2576 2577 2578
	case SVM_EXIT_IOIO:
		vmexit = nested_svm_intercept_ioio(svm);
		break;
2579 2580 2581
	case SVM_EXIT_READ_CR0 ... SVM_EXIT_WRITE_CR8: {
		u32 bit = 1U << (exit_code - SVM_EXIT_READ_CR0);
		if (svm->nested.intercept_cr & bit)
2582
			vmexit = NESTED_EXIT_DONE;
2583 2584
		break;
	}
2585 2586 2587
	case SVM_EXIT_READ_DR0 ... SVM_EXIT_WRITE_DR7: {
		u32 bit = 1U << (exit_code - SVM_EXIT_READ_DR0);
		if (svm->nested.intercept_dr & bit)
2588
			vmexit = NESTED_EXIT_DONE;
2589 2590 2591 2592
		break;
	}
	case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: {
		u32 excp_bits = 1 << (exit_code - SVM_EXIT_EXCP_BASE);
J
Joerg Roedel 已提交
2593
		if (svm->nested.intercept_exceptions & excp_bits)
2594
			vmexit = NESTED_EXIT_DONE;
G
Gleb Natapov 已提交
2595 2596 2597 2598
		/* async page fault always cause vmexit */
		else if ((exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR) &&
			 svm->apf_reason != 0)
			vmexit = NESTED_EXIT_DONE;
2599 2600
		break;
	}
2601 2602 2603 2604
	case SVM_EXIT_ERR: {
		vmexit = NESTED_EXIT_DONE;
		break;
	}
2605 2606
	default: {
		u64 exit_bits = 1ULL << (exit_code - SVM_EXIT_INTR);
J
Joerg Roedel 已提交
2607
		if (svm->nested.intercept & exit_bits)
2608
			vmexit = NESTED_EXIT_DONE;
2609 2610 2611
	}
	}

2612 2613 2614 2615 2616 2617 2618 2619 2620 2621
	return vmexit;
}

static int nested_svm_exit_handled(struct vcpu_svm *svm)
{
	int vmexit;

	vmexit = nested_svm_intercept(svm);

	if (vmexit == NESTED_EXIT_DONE)
2622 2623 2624
		nested_svm_vmexit(svm);

	return vmexit;
2625 2626
}

2627 2628 2629 2630 2631
static inline void copy_vmcb_control_area(struct vmcb *dst_vmcb, struct vmcb *from_vmcb)
{
	struct vmcb_control_area *dst  = &dst_vmcb->control;
	struct vmcb_control_area *from = &from_vmcb->control;

2632
	dst->intercept_cr         = from->intercept_cr;
2633
	dst->intercept_dr         = from->intercept_dr;
2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656
	dst->intercept_exceptions = from->intercept_exceptions;
	dst->intercept            = from->intercept;
	dst->iopm_base_pa         = from->iopm_base_pa;
	dst->msrpm_base_pa        = from->msrpm_base_pa;
	dst->tsc_offset           = from->tsc_offset;
	dst->asid                 = from->asid;
	dst->tlb_ctl              = from->tlb_ctl;
	dst->int_ctl              = from->int_ctl;
	dst->int_vector           = from->int_vector;
	dst->int_state            = from->int_state;
	dst->exit_code            = from->exit_code;
	dst->exit_code_hi         = from->exit_code_hi;
	dst->exit_info_1          = from->exit_info_1;
	dst->exit_info_2          = from->exit_info_2;
	dst->exit_int_info        = from->exit_int_info;
	dst->exit_int_info_err    = from->exit_int_info_err;
	dst->nested_ctl           = from->nested_ctl;
	dst->event_inj            = from->event_inj;
	dst->event_inj_err        = from->event_inj_err;
	dst->nested_cr3           = from->nested_cr3;
	dst->lbr_ctl              = from->lbr_ctl;
}

2657
static int nested_svm_vmexit(struct vcpu_svm *svm)
2658
{
2659
	struct vmcb *nested_vmcb;
2660
	struct vmcb *hsave = svm->nested.hsave;
J
Joerg Roedel 已提交
2661
	struct vmcb *vmcb = svm->vmcb;
2662
	struct page *page;
2663

2664 2665 2666 2667
	trace_kvm_nested_vmexit_inject(vmcb->control.exit_code,
				       vmcb->control.exit_info_1,
				       vmcb->control.exit_info_2,
				       vmcb->control.exit_int_info,
2668 2669
				       vmcb->control.exit_int_info_err,
				       KVM_ISA_SVM);
2670

2671
	nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, &page);
2672 2673 2674
	if (!nested_vmcb)
		return 1;

2675 2676
	/* Exit Guest-Mode */
	leave_guest_mode(&svm->vcpu);
2677 2678
	svm->nested.vmcb = 0;

2679
	/* Give the current vmcb to the guest */
J
Joerg Roedel 已提交
2680 2681 2682 2683 2684 2685 2686 2687
	disable_gif(svm);

	nested_vmcb->save.es     = vmcb->save.es;
	nested_vmcb->save.cs     = vmcb->save.cs;
	nested_vmcb->save.ss     = vmcb->save.ss;
	nested_vmcb->save.ds     = vmcb->save.ds;
	nested_vmcb->save.gdtr   = vmcb->save.gdtr;
	nested_vmcb->save.idtr   = vmcb->save.idtr;
2688
	nested_vmcb->save.efer   = svm->vcpu.arch.efer;
2689
	nested_vmcb->save.cr0    = kvm_read_cr0(&svm->vcpu);
2690
	nested_vmcb->save.cr3    = kvm_read_cr3(&svm->vcpu);
J
Joerg Roedel 已提交
2691
	nested_vmcb->save.cr2    = vmcb->save.cr2;
2692
	nested_vmcb->save.cr4    = svm->vcpu.arch.cr4;
2693
	nested_vmcb->save.rflags = kvm_get_rflags(&svm->vcpu);
J
Joerg Roedel 已提交
2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709
	nested_vmcb->save.rip    = vmcb->save.rip;
	nested_vmcb->save.rsp    = vmcb->save.rsp;
	nested_vmcb->save.rax    = vmcb->save.rax;
	nested_vmcb->save.dr7    = vmcb->save.dr7;
	nested_vmcb->save.dr6    = vmcb->save.dr6;
	nested_vmcb->save.cpl    = vmcb->save.cpl;

	nested_vmcb->control.int_ctl           = vmcb->control.int_ctl;
	nested_vmcb->control.int_vector        = vmcb->control.int_vector;
	nested_vmcb->control.int_state         = vmcb->control.int_state;
	nested_vmcb->control.exit_code         = vmcb->control.exit_code;
	nested_vmcb->control.exit_code_hi      = vmcb->control.exit_code_hi;
	nested_vmcb->control.exit_info_1       = vmcb->control.exit_info_1;
	nested_vmcb->control.exit_info_2       = vmcb->control.exit_info_2;
	nested_vmcb->control.exit_int_info     = vmcb->control.exit_int_info;
	nested_vmcb->control.exit_int_info_err = vmcb->control.exit_int_info_err;
2710 2711 2712

	if (svm->nrips_enabled)
		nested_vmcb->control.next_rip  = vmcb->control.next_rip;
2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728

	/*
	 * If we emulate a VMRUN/#VMEXIT in the same host #vmexit cycle we have
	 * to make sure that we do not lose injected events. So check event_inj
	 * here and copy it to exit_int_info if it is valid.
	 * Exit_int_info and event_inj can't be both valid because the case
	 * below only happens on a VMRUN instruction intercept which has
	 * no valid exit_int_info set.
	 */
	if (vmcb->control.event_inj & SVM_EVTINJ_VALID) {
		struct vmcb_control_area *nc = &nested_vmcb->control;

		nc->exit_int_info     = vmcb->control.event_inj;
		nc->exit_int_info_err = vmcb->control.event_inj_err;
	}

J
Joerg Roedel 已提交
2729 2730 2731
	nested_vmcb->control.tlb_ctl           = 0;
	nested_vmcb->control.event_inj         = 0;
	nested_vmcb->control.event_inj_err     = 0;
2732 2733 2734 2735 2736 2737

	/* We always set V_INTR_MASKING and remember the old value in hflags */
	if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK))
		nested_vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;

	/* Restore the original control entries */
2738
	copy_vmcb_control_area(vmcb, hsave);
2739

2740 2741
	kvm_clear_exception_queue(&svm->vcpu);
	kvm_clear_interrupt_queue(&svm->vcpu);
2742

2743 2744
	svm->nested.nested_cr3 = 0;

2745 2746 2747 2748 2749 2750 2751
	/* Restore selected save entries */
	svm->vmcb->save.es = hsave->save.es;
	svm->vmcb->save.cs = hsave->save.cs;
	svm->vmcb->save.ss = hsave->save.ss;
	svm->vmcb->save.ds = hsave->save.ds;
	svm->vmcb->save.gdtr = hsave->save.gdtr;
	svm->vmcb->save.idtr = hsave->save.idtr;
2752
	kvm_set_rflags(&svm->vcpu, hsave->save.rflags);
2753 2754 2755 2756 2757 2758 2759
	svm_set_efer(&svm->vcpu, hsave->save.efer);
	svm_set_cr0(&svm->vcpu, hsave->save.cr0 | X86_CR0_PE);
	svm_set_cr4(&svm->vcpu, hsave->save.cr4);
	if (npt_enabled) {
		svm->vmcb->save.cr3 = hsave->save.cr3;
		svm->vcpu.arch.cr3 = hsave->save.cr3;
	} else {
2760
		(void)kvm_set_cr3(&svm->vcpu, hsave->save.cr3);
2761 2762 2763 2764 2765 2766 2767 2768
	}
	kvm_register_write(&svm->vcpu, VCPU_REGS_RAX, hsave->save.rax);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RSP, hsave->save.rsp);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RIP, hsave->save.rip);
	svm->vmcb->save.dr7 = 0;
	svm->vmcb->save.cpl = 0;
	svm->vmcb->control.exit_int_info = 0;

2769 2770
	mark_all_dirty(svm->vmcb);

2771
	nested_svm_unmap(page);
2772

2773
	nested_svm_uninit_mmu_context(&svm->vcpu);
2774 2775 2776 2777 2778
	kvm_mmu_reset_context(&svm->vcpu);
	kvm_mmu_load(&svm->vcpu);

	return 0;
}
A
Alexander Graf 已提交
2779

2780
static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
A
Alexander Graf 已提交
2781
{
2782 2783
	/*
	 * This function merges the msr permission bitmaps of kvm and the
G
Guo Chao 已提交
2784
	 * nested vmcb. It is optimized in that it only merges the parts where
2785 2786
	 * the kvm msr permission bitmap may contain zero bits
	 */
A
Alexander Graf 已提交
2787
	int i;
2788

2789 2790
	if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
		return true;
2791

2792 2793 2794
	for (i = 0; i < MSRPM_OFFSETS; i++) {
		u32 value, p;
		u64 offset;
2795

2796 2797
		if (msrpm_offsets[i] == 0xffffffff)
			break;
A
Alexander Graf 已提交
2798

2799 2800
		p      = msrpm_offsets[i];
		offset = svm->nested.vmcb_msrpm + (p * 4);
2801

2802
		if (kvm_vcpu_read_guest(&svm->vcpu, offset, &value, 4))
2803 2804 2805 2806
			return false;

		svm->nested.msrpm[p] = svm->msrpm[p] | value;
	}
A
Alexander Graf 已提交
2807

2808
	svm->vmcb->control.msrpm_base_pa = __pa(svm->nested.msrpm);
2809 2810

	return true;
A
Alexander Graf 已提交
2811 2812
}

2813 2814 2815 2816 2817
static bool nested_vmcb_checks(struct vmcb *vmcb)
{
	if ((vmcb->control.intercept & (1ULL << INTERCEPT_VMRUN)) == 0)
		return false;

2818 2819 2820
	if (vmcb->control.asid == 0)
		return false;

2821 2822 2823
	if (vmcb->control.nested_ctl && !npt_enabled)
		return false;

2824 2825 2826
	return true;
}

2827
static bool nested_svm_vmrun(struct vcpu_svm *svm)
A
Alexander Graf 已提交
2828
{
2829
	struct vmcb *nested_vmcb;
2830
	struct vmcb *hsave = svm->nested.hsave;
J
Joerg Roedel 已提交
2831
	struct vmcb *vmcb = svm->vmcb;
2832
	struct page *page;
2833
	u64 vmcb_gpa;
A
Alexander Graf 已提交
2834

2835
	vmcb_gpa = svm->vmcb->save.rax;
A
Alexander Graf 已提交
2836

2837
	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
2838 2839 2840
	if (!nested_vmcb)
		return false;

2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851
	if (!nested_vmcb_checks(nested_vmcb)) {
		nested_vmcb->control.exit_code    = SVM_EXIT_ERR;
		nested_vmcb->control.exit_code_hi = 0;
		nested_vmcb->control.exit_info_1  = 0;
		nested_vmcb->control.exit_info_2  = 0;

		nested_svm_unmap(page);

		return false;
	}

2852
	trace_kvm_nested_vmrun(svm->vmcb->save.rip, vmcb_gpa,
2853 2854 2855 2856 2857
			       nested_vmcb->save.rip,
			       nested_vmcb->control.int_ctl,
			       nested_vmcb->control.event_inj,
			       nested_vmcb->control.nested_ctl);

2858 2859
	trace_kvm_nested_intercepts(nested_vmcb->control.intercept_cr & 0xffff,
				    nested_vmcb->control.intercept_cr >> 16,
2860 2861 2862
				    nested_vmcb->control.intercept_exceptions,
				    nested_vmcb->control.intercept);

A
Alexander Graf 已提交
2863
	/* Clear internal status */
2864 2865
	kvm_clear_exception_queue(&svm->vcpu);
	kvm_clear_interrupt_queue(&svm->vcpu);
A
Alexander Graf 已提交
2866

J
Joerg Roedel 已提交
2867 2868 2869 2870
	/*
	 * Save the old vmcb, so we don't need to pick what we save, but can
	 * restore everything when a VMEXIT occurs
	 */
J
Joerg Roedel 已提交
2871 2872 2873 2874 2875 2876
	hsave->save.es     = vmcb->save.es;
	hsave->save.cs     = vmcb->save.cs;
	hsave->save.ss     = vmcb->save.ss;
	hsave->save.ds     = vmcb->save.ds;
	hsave->save.gdtr   = vmcb->save.gdtr;
	hsave->save.idtr   = vmcb->save.idtr;
2877
	hsave->save.efer   = svm->vcpu.arch.efer;
2878
	hsave->save.cr0    = kvm_read_cr0(&svm->vcpu);
J
Joerg Roedel 已提交
2879
	hsave->save.cr4    = svm->vcpu.arch.cr4;
2880
	hsave->save.rflags = kvm_get_rflags(&svm->vcpu);
2881
	hsave->save.rip    = kvm_rip_read(&svm->vcpu);
J
Joerg Roedel 已提交
2882 2883 2884 2885 2886
	hsave->save.rsp    = vmcb->save.rsp;
	hsave->save.rax    = vmcb->save.rax;
	if (npt_enabled)
		hsave->save.cr3    = vmcb->save.cr3;
	else
2887
		hsave->save.cr3    = kvm_read_cr3(&svm->vcpu);
J
Joerg Roedel 已提交
2888

2889
	copy_vmcb_control_area(hsave, vmcb);
A
Alexander Graf 已提交
2890

2891
	if (kvm_get_rflags(&svm->vcpu) & X86_EFLAGS_IF)
A
Alexander Graf 已提交
2892 2893 2894 2895
		svm->vcpu.arch.hflags |= HF_HIF_MASK;
	else
		svm->vcpu.arch.hflags &= ~HF_HIF_MASK;

2896 2897 2898 2899 2900 2901
	if (nested_vmcb->control.nested_ctl) {
		kvm_mmu_unload(&svm->vcpu);
		svm->nested.nested_cr3 = nested_vmcb->control.nested_cr3;
		nested_svm_init_mmu_context(&svm->vcpu);
	}

A
Alexander Graf 已提交
2902 2903 2904 2905 2906 2907 2908
	/* Load the nested guest state */
	svm->vmcb->save.es = nested_vmcb->save.es;
	svm->vmcb->save.cs = nested_vmcb->save.cs;
	svm->vmcb->save.ss = nested_vmcb->save.ss;
	svm->vmcb->save.ds = nested_vmcb->save.ds;
	svm->vmcb->save.gdtr = nested_vmcb->save.gdtr;
	svm->vmcb->save.idtr = nested_vmcb->save.idtr;
2909
	kvm_set_rflags(&svm->vcpu, nested_vmcb->save.rflags);
A
Alexander Graf 已提交
2910 2911 2912 2913 2914 2915
	svm_set_efer(&svm->vcpu, nested_vmcb->save.efer);
	svm_set_cr0(&svm->vcpu, nested_vmcb->save.cr0);
	svm_set_cr4(&svm->vcpu, nested_vmcb->save.cr4);
	if (npt_enabled) {
		svm->vmcb->save.cr3 = nested_vmcb->save.cr3;
		svm->vcpu.arch.cr3 = nested_vmcb->save.cr3;
2916
	} else
2917
		(void)kvm_set_cr3(&svm->vcpu, nested_vmcb->save.cr3);
2918 2919 2920 2921

	/* Guest paging mode is active - reset mmu */
	kvm_mmu_reset_context(&svm->vcpu);

J
Joerg Roedel 已提交
2922
	svm->vmcb->save.cr2 = svm->vcpu.arch.cr2 = nested_vmcb->save.cr2;
A
Alexander Graf 已提交
2923 2924 2925
	kvm_register_write(&svm->vcpu, VCPU_REGS_RAX, nested_vmcb->save.rax);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RSP, nested_vmcb->save.rsp);
	kvm_register_write(&svm->vcpu, VCPU_REGS_RIP, nested_vmcb->save.rip);
J
Joerg Roedel 已提交
2926

A
Alexander Graf 已提交
2927 2928 2929 2930 2931 2932 2933 2934
	/* In case we don't even reach vcpu_run, the fields are not updated */
	svm->vmcb->save.rax = nested_vmcb->save.rax;
	svm->vmcb->save.rsp = nested_vmcb->save.rsp;
	svm->vmcb->save.rip = nested_vmcb->save.rip;
	svm->vmcb->save.dr7 = nested_vmcb->save.dr7;
	svm->vmcb->save.dr6 = nested_vmcb->save.dr6;
	svm->vmcb->save.cpl = nested_vmcb->save.cpl;

2935
	svm->nested.vmcb_msrpm = nested_vmcb->control.msrpm_base_pa & ~0x0fffULL;
2936
	svm->nested.vmcb_iopm  = nested_vmcb->control.iopm_base_pa  & ~0x0fffULL;
A
Alexander Graf 已提交
2937

J
Joerg Roedel 已提交
2938
	/* cache intercepts */
2939
	svm->nested.intercept_cr         = nested_vmcb->control.intercept_cr;
2940
	svm->nested.intercept_dr         = nested_vmcb->control.intercept_dr;
J
Joerg Roedel 已提交
2941 2942 2943
	svm->nested.intercept_exceptions = nested_vmcb->control.intercept_exceptions;
	svm->nested.intercept            = nested_vmcb->control.intercept;

2944
	svm_flush_tlb(&svm->vcpu);
A
Alexander Graf 已提交
2945 2946 2947 2948 2949 2950
	svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK;
	if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK)
		svm->vcpu.arch.hflags |= HF_VINTR_MASK;
	else
		svm->vcpu.arch.hflags &= ~HF_VINTR_MASK;

2951 2952
	if (svm->vcpu.arch.hflags & HF_VINTR_MASK) {
		/* We only want the cr8 intercept bits of the guest */
2953 2954
		clr_cr_intercept(svm, INTERCEPT_CR8_READ);
		clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
2955 2956
	}

2957
	/* We don't want to see VMMCALLs from a nested guest */
2958
	clr_intercept(svm, INTERCEPT_VMMCALL);
2959

2960
	svm->vmcb->control.lbr_ctl = nested_vmcb->control.lbr_ctl;
A
Alexander Graf 已提交
2961 2962 2963 2964 2965 2966
	svm->vmcb->control.int_vector = nested_vmcb->control.int_vector;
	svm->vmcb->control.int_state = nested_vmcb->control.int_state;
	svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset;
	svm->vmcb->control.event_inj = nested_vmcb->control.event_inj;
	svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err;

2967
	nested_svm_unmap(page);
2968

2969 2970 2971
	/* Enter Guest-Mode */
	enter_guest_mode(&svm->vcpu);

2972 2973 2974 2975 2976 2977
	/*
	 * Merge guest and host intercepts - must be called  with vcpu in
	 * guest-mode to take affect here
	 */
	recalc_intercepts(svm);

2978
	svm->nested.vmcb = vmcb_gpa;
2979

2980
	enable_gif(svm);
A
Alexander Graf 已提交
2981

2982 2983
	mark_all_dirty(svm->vmcb);

2984
	return true;
A
Alexander Graf 已提交
2985 2986
}

2987
static void nested_svm_vmloadsave(struct vmcb *from_vmcb, struct vmcb *to_vmcb)
2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998 2999 3000 3001 3002
{
	to_vmcb->save.fs = from_vmcb->save.fs;
	to_vmcb->save.gs = from_vmcb->save.gs;
	to_vmcb->save.tr = from_vmcb->save.tr;
	to_vmcb->save.ldtr = from_vmcb->save.ldtr;
	to_vmcb->save.kernel_gs_base = from_vmcb->save.kernel_gs_base;
	to_vmcb->save.star = from_vmcb->save.star;
	to_vmcb->save.lstar = from_vmcb->save.lstar;
	to_vmcb->save.cstar = from_vmcb->save.cstar;
	to_vmcb->save.sfmask = from_vmcb->save.sfmask;
	to_vmcb->save.sysenter_cs = from_vmcb->save.sysenter_cs;
	to_vmcb->save.sysenter_esp = from_vmcb->save.sysenter_esp;
	to_vmcb->save.sysenter_eip = from_vmcb->save.sysenter_eip;
}

A
Avi Kivity 已提交
3003
static int vmload_interception(struct vcpu_svm *svm)
3004
{
3005
	struct vmcb *nested_vmcb;
3006
	struct page *page;
3007

3008 3009 3010
	if (nested_svm_check_permissions(svm))
		return 1;

3011
	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
3012 3013 3014
	if (!nested_vmcb)
		return 1;

3015 3016 3017
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);

3018
	nested_svm_vmloadsave(nested_vmcb, svm->vmcb);
3019
	nested_svm_unmap(page);
3020 3021 3022 3023

	return 1;
}

A
Avi Kivity 已提交
3024
static int vmsave_interception(struct vcpu_svm *svm)
3025
{
3026
	struct vmcb *nested_vmcb;
3027
	struct page *page;
3028

3029 3030 3031
	if (nested_svm_check_permissions(svm))
		return 1;

3032
	nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
3033 3034 3035
	if (!nested_vmcb)
		return 1;

3036 3037 3038
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);

3039
	nested_svm_vmloadsave(svm->vmcb, nested_vmcb);
3040
	nested_svm_unmap(page);
3041 3042 3043 3044

	return 1;
}

A
Avi Kivity 已提交
3045
static int vmrun_interception(struct vcpu_svm *svm)
A
Alexander Graf 已提交
3046 3047 3048 3049
{
	if (nested_svm_check_permissions(svm))
		return 1;

3050 3051
	/* Save rip after vmrun instruction */
	kvm_rip_write(&svm->vcpu, kvm_rip_read(&svm->vcpu) + 3);
A
Alexander Graf 已提交
3052

3053
	if (!nested_svm_vmrun(svm))
A
Alexander Graf 已提交
3054 3055
		return 1;

3056
	if (!nested_svm_vmrun_msrpm(svm))
3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068
		goto failed;

	return 1;

failed:

	svm->vmcb->control.exit_code    = SVM_EXIT_ERR;
	svm->vmcb->control.exit_code_hi = 0;
	svm->vmcb->control.exit_info_1  = 0;
	svm->vmcb->control.exit_info_2  = 0;

	nested_svm_vmexit(svm);
A
Alexander Graf 已提交
3069 3070 3071 3072

	return 1;
}

A
Avi Kivity 已提交
3073
static int stgi_interception(struct vcpu_svm *svm)
3074 3075 3076 3077 3078 3079
{
	if (nested_svm_check_permissions(svm))
		return 1;

	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);
3080
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3081

3082
	enable_gif(svm);
3083 3084 3085 3086

	return 1;
}

A
Avi Kivity 已提交
3087
static int clgi_interception(struct vcpu_svm *svm)
3088 3089 3090 3091 3092 3093 3094
{
	if (nested_svm_check_permissions(svm))
		return 1;

	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);

3095
	disable_gif(svm);
3096 3097

	/* After a CLGI no interrupts should come */
3098 3099 3100 3101 3102
	if (!kvm_vcpu_apicv_active(&svm->vcpu)) {
		svm_clear_vintr(svm);
		svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
		mark_dirty(svm->vmcb, VMCB_INTR);
	}
3103

3104 3105 3106
	return 1;
}

A
Avi Kivity 已提交
3107
static int invlpga_interception(struct vcpu_svm *svm)
A
Alexander Graf 已提交
3108 3109 3110
{
	struct kvm_vcpu *vcpu = &svm->vcpu;

3111 3112
	trace_kvm_invlpga(svm->vmcb->save.rip, kvm_register_read(&svm->vcpu, VCPU_REGS_RCX),
			  kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
3113

A
Alexander Graf 已提交
3114
	/* Let's treat INVLPGA the same as INVLPG (can be optimized!) */
3115
	kvm_mmu_invlpg(vcpu, kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
A
Alexander Graf 已提交
3116 3117 3118 3119 3120 3121

	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
	skip_emulated_instruction(&svm->vcpu);
	return 1;
}

3122 3123
static int skinit_interception(struct vcpu_svm *svm)
{
3124
	trace_kvm_skinit(svm->vmcb->save.rip, kvm_register_read(&svm->vcpu, VCPU_REGS_RAX));
3125 3126 3127 3128 3129

	kvm_queue_exception(&svm->vcpu, UD_VECTOR);
	return 1;
}

D
David Kaplan 已提交
3130 3131
static int wbinvd_interception(struct vcpu_svm *svm)
{
3132
	return kvm_emulate_wbinvd(&svm->vcpu);
D
David Kaplan 已提交
3133 3134
}

J
Joerg Roedel 已提交
3135 3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146 3147
static int xsetbv_interception(struct vcpu_svm *svm)
{
	u64 new_bv = kvm_read_edx_eax(&svm->vcpu);
	u32 index = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);

	if (kvm_set_xcr(&svm->vcpu, index, new_bv) == 0) {
		svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
		skip_emulated_instruction(&svm->vcpu);
	}

	return 1;
}

A
Avi Kivity 已提交
3148
static int task_switch_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3149
{
3150
	u16 tss_selector;
3151 3152 3153
	int reason;
	int int_type = svm->vmcb->control.exit_int_info &
		SVM_EXITINTINFO_TYPE_MASK;
3154
	int int_vec = svm->vmcb->control.exit_int_info & SVM_EVTINJ_VEC_MASK;
3155 3156 3157 3158
	uint32_t type =
		svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_TYPE_MASK;
	uint32_t idt_v =
		svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_VALID;
3159 3160
	bool has_error_code = false;
	u32 error_code = 0;
3161 3162

	tss_selector = (u16)svm->vmcb->control.exit_info_1;
3163

3164 3165
	if (svm->vmcb->control.exit_info_2 &
	    (1ULL << SVM_EXITINFOSHIFT_TS_REASON_IRET))
3166 3167 3168 3169
		reason = TASK_SWITCH_IRET;
	else if (svm->vmcb->control.exit_info_2 &
		 (1ULL << SVM_EXITINFOSHIFT_TS_REASON_JMP))
		reason = TASK_SWITCH_JMP;
3170
	else if (idt_v)
3171 3172 3173 3174
		reason = TASK_SWITCH_GATE;
	else
		reason = TASK_SWITCH_CALL;

3175 3176 3177 3178 3179 3180
	if (reason == TASK_SWITCH_GATE) {
		switch (type) {
		case SVM_EXITINTINFO_TYPE_NMI:
			svm->vcpu.arch.nmi_injected = false;
			break;
		case SVM_EXITINTINFO_TYPE_EXEPT:
3181 3182 3183 3184 3185 3186
			if (svm->vmcb->control.exit_info_2 &
			    (1ULL << SVM_EXITINFOSHIFT_TS_HAS_ERROR_CODE)) {
				has_error_code = true;
				error_code =
					(u32)svm->vmcb->control.exit_info_2;
			}
3187 3188 3189 3190 3191 3192 3193 3194 3195
			kvm_clear_exception_queue(&svm->vcpu);
			break;
		case SVM_EXITINTINFO_TYPE_INTR:
			kvm_clear_interrupt_queue(&svm->vcpu);
			break;
		default:
			break;
		}
	}
3196

3197 3198 3199
	if (reason != TASK_SWITCH_GATE ||
	    int_type == SVM_EXITINTINFO_TYPE_SOFT ||
	    (int_type == SVM_EXITINTINFO_TYPE_EXEPT &&
3200 3201
	     (int_vec == OF_VECTOR || int_vec == BP_VECTOR)))
		skip_emulated_instruction(&svm->vcpu);
3202

3203 3204 3205 3206
	if (int_type != SVM_EXITINTINFO_TYPE_SOFT)
		int_vec = -1;

	if (kvm_task_switch(&svm->vcpu, tss_selector, int_vec, reason,
3207 3208 3209 3210 3211 3212 3213
				has_error_code, error_code) == EMULATE_FAIL) {
		svm->vcpu.run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
		svm->vcpu.run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
		svm->vcpu.run->internal.ndata = 0;
		return 0;
	}
	return 1;
A
Avi Kivity 已提交
3214 3215
}

A
Avi Kivity 已提交
3216
static int cpuid_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3217
{
3218
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
3219
	return kvm_emulate_cpuid(&svm->vcpu);
A
Avi Kivity 已提交
3220 3221
}

A
Avi Kivity 已提交
3222
static int iret_interception(struct vcpu_svm *svm)
3223 3224
{
	++svm->vcpu.stat.nmi_window_exits;
3225
	clr_intercept(svm, INTERCEPT_IRET);
3226
	svm->vcpu.arch.hflags |= HF_IRET_MASK;
3227
	svm->nmi_iret_rip = kvm_rip_read(&svm->vcpu);
3228
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3229 3230 3231
	return 1;
}

A
Avi Kivity 已提交
3232
static int invlpg_interception(struct vcpu_svm *svm)
M
Marcelo Tosatti 已提交
3233
{
3234 3235 3236 3237 3238 3239
	if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;

	kvm_mmu_invlpg(&svm->vcpu, svm->vmcb->control.exit_info_1);
	skip_emulated_instruction(&svm->vcpu);
	return 1;
M
Marcelo Tosatti 已提交
3240 3241
}

A
Avi Kivity 已提交
3242
static int emulate_on_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3243
{
3244
	return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
A
Avi Kivity 已提交
3245 3246
}

A
Avi Kivity 已提交
3247 3248 3249 3250 3251 3252 3253 3254
static int rdpmc_interception(struct vcpu_svm *svm)
{
	int err;

	if (!static_cpu_has(X86_FEATURE_NRIPS))
		return emulate_on_interception(svm);

	err = kvm_rdpmc(&svm->vcpu);
3255
	return kvm_complete_insn_gp(&svm->vcpu, err);
A
Avi Kivity 已提交
3256 3257
}

3258 3259
static bool check_selective_cr0_intercepted(struct vcpu_svm *svm,
					    unsigned long val)
3260 3261 3262 3263 3264 3265 3266 3267 3268 3269 3270 3271 3272 3273 3274 3275 3276 3277 3278 3279 3280 3281
{
	unsigned long cr0 = svm->vcpu.arch.cr0;
	bool ret = false;
	u64 intercept;

	intercept = svm->nested.intercept;

	if (!is_guest_mode(&svm->vcpu) ||
	    (!(intercept & (1ULL << INTERCEPT_SELECTIVE_CR0))))
		return false;

	cr0 &= ~SVM_CR0_SELECTIVE_MASK;
	val &= ~SVM_CR0_SELECTIVE_MASK;

	if (cr0 ^ val) {
		svm->vmcb->control.exit_code = SVM_EXIT_CR0_SEL_WRITE;
		ret = (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE);
	}

	return ret;
}

3282 3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296
#define CR_VALID (1ULL << 63)

static int cr_interception(struct vcpu_svm *svm)
{
	int reg, cr;
	unsigned long val;
	int err;

	if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_on_interception(svm);

	if (unlikely((svm->vmcb->control.exit_info_1 & CR_VALID) == 0))
		return emulate_on_interception(svm);

	reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
3297 3298 3299 3300
	if (svm->vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE)
		cr = SVM_EXIT_WRITE_CR0 - SVM_EXIT_READ_CR0;
	else
		cr = svm->vmcb->control.exit_code - SVM_EXIT_READ_CR0;
3301 3302 3303 3304 3305 3306 3307

	err = 0;
	if (cr >= 16) { /* mov to cr */
		cr -= 16;
		val = kvm_register_read(&svm->vcpu, reg);
		switch (cr) {
		case 0:
3308 3309
			if (!check_selective_cr0_intercepted(svm, val))
				err = kvm_set_cr0(&svm->vcpu, val);
3310 3311 3312
			else
				return 1;

3313 3314 3315 3316 3317 3318 3319 3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332 3333 3334 3335 3336
			break;
		case 3:
			err = kvm_set_cr3(&svm->vcpu, val);
			break;
		case 4:
			err = kvm_set_cr4(&svm->vcpu, val);
			break;
		case 8:
			err = kvm_set_cr8(&svm->vcpu, val);
			break;
		default:
			WARN(1, "unhandled write to CR%d", cr);
			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
			return 1;
		}
	} else { /* mov from cr */
		switch (cr) {
		case 0:
			val = kvm_read_cr0(&svm->vcpu);
			break;
		case 2:
			val = svm->vcpu.arch.cr2;
			break;
		case 3:
3337
			val = kvm_read_cr3(&svm->vcpu);
3338 3339 3340 3341 3342 3343 3344 3345 3346 3347 3348 3349 3350 3351
			break;
		case 4:
			val = kvm_read_cr4(&svm->vcpu);
			break;
		case 8:
			val = kvm_get_cr8(&svm->vcpu);
			break;
		default:
			WARN(1, "unhandled read from CR%d", cr);
			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
			return 1;
		}
		kvm_register_write(&svm->vcpu, reg, val);
	}
3352
	return kvm_complete_insn_gp(&svm->vcpu, err);
3353 3354
}

3355 3356 3357 3358 3359
static int dr_interception(struct vcpu_svm *svm)
{
	int reg, dr;
	unsigned long val;

3360 3361 3362 3363 3364 3365 3366 3367 3368 3369 3370
	if (svm->vcpu.guest_debug == 0) {
		/*
		 * No more DR vmexits; force a reload of the debug registers
		 * and reenter on this instruction.  The next vmexit will
		 * retrieve the full state of the debug registers.
		 */
		clr_dr_intercepts(svm);
		svm->vcpu.arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
		return 1;
	}

3371 3372 3373 3374 3375 3376 3377
	if (!boot_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_on_interception(svm);

	reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
	dr = svm->vmcb->control.exit_code - SVM_EXIT_READ_DR0;

	if (dr >= 16) { /* mov to DRn */
3378 3379
		if (!kvm_require_dr(&svm->vcpu, dr - 16))
			return 1;
3380 3381 3382
		val = kvm_register_read(&svm->vcpu, reg);
		kvm_set_dr(&svm->vcpu, dr - 16, val);
	} else {
3383 3384 3385 3386
		if (!kvm_require_dr(&svm->vcpu, dr))
			return 1;
		kvm_get_dr(&svm->vcpu, dr, &val);
		kvm_register_write(&svm->vcpu, reg, val);
3387 3388
	}

3389 3390
	skip_emulated_instruction(&svm->vcpu);

3391 3392 3393
	return 1;
}

A
Avi Kivity 已提交
3394
static int cr8_write_interception(struct vcpu_svm *svm)
3395
{
A
Avi Kivity 已提交
3396
	struct kvm_run *kvm_run = svm->vcpu.run;
A
Andre Przywara 已提交
3397
	int r;
A
Avi Kivity 已提交
3398

3399 3400
	u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
	/* instruction emulation calls kvm_set_cr8() */
3401
	r = cr_interception(svm);
3402
	if (lapic_in_kernel(&svm->vcpu))
3403
		return r;
3404
	if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
3405
		return r;
3406 3407 3408 3409
	kvm_run->exit_reason = KVM_EXIT_SET_TPR;
	return 0;
}

3410
static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
A
Avi Kivity 已提交
3411
{
3412 3413
	struct vcpu_svm *svm = to_svm(vcpu);

3414
	switch (msr_info->index) {
3415
	case MSR_IA32_TSC: {
3416
		msr_info->data = svm->vmcb->control.tsc_offset +
3417
			kvm_scale_tsc(vcpu, rdtsc());
3418

A
Avi Kivity 已提交
3419 3420
		break;
	}
B
Brian Gerst 已提交
3421
	case MSR_STAR:
3422
		msr_info->data = svm->vmcb->save.star;
A
Avi Kivity 已提交
3423
		break;
3424
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
3425
	case MSR_LSTAR:
3426
		msr_info->data = svm->vmcb->save.lstar;
A
Avi Kivity 已提交
3427 3428
		break;
	case MSR_CSTAR:
3429
		msr_info->data = svm->vmcb->save.cstar;
A
Avi Kivity 已提交
3430 3431
		break;
	case MSR_KERNEL_GS_BASE:
3432
		msr_info->data = svm->vmcb->save.kernel_gs_base;
A
Avi Kivity 已提交
3433 3434
		break;
	case MSR_SYSCALL_MASK:
3435
		msr_info->data = svm->vmcb->save.sfmask;
A
Avi Kivity 已提交
3436 3437 3438
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
3439
		msr_info->data = svm->vmcb->save.sysenter_cs;
A
Avi Kivity 已提交
3440 3441
		break;
	case MSR_IA32_SYSENTER_EIP:
3442
		msr_info->data = svm->sysenter_eip;
A
Avi Kivity 已提交
3443 3444
		break;
	case MSR_IA32_SYSENTER_ESP:
3445
		msr_info->data = svm->sysenter_esp;
A
Avi Kivity 已提交
3446
		break;
P
Paolo Bonzini 已提交
3447 3448 3449 3450 3451
	case MSR_TSC_AUX:
		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
			return 1;
		msr_info->data = svm->tsc_aux;
		break;
J
Joerg Roedel 已提交
3452 3453 3454 3455 3456
	/*
	 * Nobody will change the following 5 values in the VMCB so we can
	 * safely return them on rdmsr. They will always be 0 until LBRV is
	 * implemented.
	 */
3457
	case MSR_IA32_DEBUGCTLMSR:
3458
		msr_info->data = svm->vmcb->save.dbgctl;
3459 3460
		break;
	case MSR_IA32_LASTBRANCHFROMIP:
3461
		msr_info->data = svm->vmcb->save.br_from;
3462 3463
		break;
	case MSR_IA32_LASTBRANCHTOIP:
3464
		msr_info->data = svm->vmcb->save.br_to;
3465 3466
		break;
	case MSR_IA32_LASTINTFROMIP:
3467
		msr_info->data = svm->vmcb->save.last_excp_from;
3468 3469
		break;
	case MSR_IA32_LASTINTTOIP:
3470
		msr_info->data = svm->vmcb->save.last_excp_to;
3471
		break;
A
Alexander Graf 已提交
3472
	case MSR_VM_HSAVE_PA:
3473
		msr_info->data = svm->nested.hsave_msr;
A
Alexander Graf 已提交
3474
		break;
3475
	case MSR_VM_CR:
3476
		msr_info->data = svm->nested.vm_cr_msr;
3477
		break;
3478
	case MSR_IA32_UCODE_REV:
3479
		msr_info->data = 0x01000065;
3480
		break;
3481 3482 3483 3484 3485 3486 3487 3488 3489 3490 3491 3492 3493 3494 3495 3496 3497
	case MSR_F15H_IC_CFG: {

		int family, model;

		family = guest_cpuid_family(vcpu);
		model  = guest_cpuid_model(vcpu);

		if (family < 0 || model < 0)
			return kvm_get_msr_common(vcpu, msr_info);

		msr_info->data = 0;

		if (family == 0x15 &&
		    (model >= 0x2 && model < 0x20))
			msr_info->data = 0x1E;
		}
		break;
A
Avi Kivity 已提交
3498
	default:
3499
		return kvm_get_msr_common(vcpu, msr_info);
A
Avi Kivity 已提交
3500 3501 3502 3503
	}
	return 0;
}

A
Avi Kivity 已提交
3504
static int rdmsr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3505
{
3506
	u32 ecx = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);
3507
	struct msr_data msr_info;
A
Avi Kivity 已提交
3508

3509 3510 3511
	msr_info.index = ecx;
	msr_info.host_initiated = false;
	if (svm_get_msr(&svm->vcpu, &msr_info)) {
3512
		trace_kvm_msr_read_ex(ecx);
3513
		kvm_inject_gp(&svm->vcpu, 0);
3514
	} else {
3515
		trace_kvm_msr_read(ecx, msr_info.data);
3516

3517 3518 3519 3520
		kvm_register_write(&svm->vcpu, VCPU_REGS_RAX,
				   msr_info.data & 0xffffffff);
		kvm_register_write(&svm->vcpu, VCPU_REGS_RDX,
				   msr_info.data >> 32);
3521
		svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
3522
		skip_emulated_instruction(&svm->vcpu);
A
Avi Kivity 已提交
3523 3524 3525 3526
	}
	return 1;
}

3527 3528 3529 3530 3531 3532 3533 3534 3535 3536 3537 3538 3539 3540 3541 3542 3543 3544 3545 3546 3547 3548 3549 3550 3551
static int svm_set_vm_cr(struct kvm_vcpu *vcpu, u64 data)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	int svm_dis, chg_mask;

	if (data & ~SVM_VM_CR_VALID_MASK)
		return 1;

	chg_mask = SVM_VM_CR_VALID_MASK;

	if (svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK)
		chg_mask &= ~(SVM_VM_CR_SVM_LOCK_MASK | SVM_VM_CR_SVM_DIS_MASK);

	svm->nested.vm_cr_msr &= ~chg_mask;
	svm->nested.vm_cr_msr |= (data & chg_mask);

	svm_dis = svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK;

	/* check for svm_disable while efer.svme is set */
	if (svm_dis && (vcpu->arch.efer & EFER_SVME))
		return 1;

	return 0;
}

3552
static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
A
Avi Kivity 已提交
3553
{
3554 3555
	struct vcpu_svm *svm = to_svm(vcpu);

3556 3557
	u32 ecx = msr->index;
	u64 data = msr->data;
A
Avi Kivity 已提交
3558
	switch (ecx) {
3559
	case MSR_IA32_TSC:
3560
		kvm_write_tsc(vcpu, msr);
A
Avi Kivity 已提交
3561
		break;
B
Brian Gerst 已提交
3562
	case MSR_STAR:
3563
		svm->vmcb->save.star = data;
A
Avi Kivity 已提交
3564
		break;
3565
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
3566
	case MSR_LSTAR:
3567
		svm->vmcb->save.lstar = data;
A
Avi Kivity 已提交
3568 3569
		break;
	case MSR_CSTAR:
3570
		svm->vmcb->save.cstar = data;
A
Avi Kivity 已提交
3571 3572
		break;
	case MSR_KERNEL_GS_BASE:
3573
		svm->vmcb->save.kernel_gs_base = data;
A
Avi Kivity 已提交
3574 3575
		break;
	case MSR_SYSCALL_MASK:
3576
		svm->vmcb->save.sfmask = data;
A
Avi Kivity 已提交
3577 3578 3579
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
3580
		svm->vmcb->save.sysenter_cs = data;
A
Avi Kivity 已提交
3581 3582
		break;
	case MSR_IA32_SYSENTER_EIP:
3583
		svm->sysenter_eip = data;
3584
		svm->vmcb->save.sysenter_eip = data;
A
Avi Kivity 已提交
3585 3586
		break;
	case MSR_IA32_SYSENTER_ESP:
3587
		svm->sysenter_esp = data;
3588
		svm->vmcb->save.sysenter_esp = data;
A
Avi Kivity 已提交
3589
		break;
P
Paolo Bonzini 已提交
3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601
	case MSR_TSC_AUX:
		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
			return 1;

		/*
		 * This is rare, so we update the MSR here instead of using
		 * direct_access_msrs.  Doing that would require a rdmsr in
		 * svm_vcpu_put.
		 */
		svm->tsc_aux = data;
		wrmsrl(MSR_TSC_AUX, svm->tsc_aux);
		break;
3602
	case MSR_IA32_DEBUGCTLMSR:
3603
		if (!boot_cpu_has(X86_FEATURE_LBRV)) {
3604 3605
			vcpu_unimpl(vcpu, "%s: MSR_IA32_DEBUGCTL 0x%llx, nop\n",
				    __func__, data);
3606 3607 3608 3609 3610 3611
			break;
		}
		if (data & DEBUGCTL_RESERVED_BITS)
			return 1;

		svm->vmcb->save.dbgctl = data;
3612
		mark_dirty(svm->vmcb, VMCB_LBR);
3613 3614 3615 3616
		if (data & (1ULL<<0))
			svm_enable_lbrv(svm);
		else
			svm_disable_lbrv(svm);
3617
		break;
A
Alexander Graf 已提交
3618
	case MSR_VM_HSAVE_PA:
3619
		svm->nested.hsave_msr = data;
3620
		break;
3621
	case MSR_VM_CR:
3622
		return svm_set_vm_cr(vcpu, data);
3623
	case MSR_VM_IGNNE:
3624
		vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
3625
		break;
3626 3627 3628 3629
	case MSR_IA32_APICBASE:
		if (kvm_vcpu_apicv_active(vcpu))
			avic_update_vapic_bar(to_svm(vcpu), data);
		/* Follow through */
A
Avi Kivity 已提交
3630
	default:
3631
		return kvm_set_msr_common(vcpu, msr);
A
Avi Kivity 已提交
3632 3633 3634 3635
	}
	return 0;
}

A
Avi Kivity 已提交
3636
static int wrmsr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3637
{
3638
	struct msr_data msr;
3639 3640
	u32 ecx = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);
	u64 data = kvm_read_edx_eax(&svm->vcpu);
3641

3642 3643 3644
	msr.data = data;
	msr.index = ecx;
	msr.host_initiated = false;
3645

3646
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
3647
	if (kvm_set_msr(&svm->vcpu, &msr)) {
3648
		trace_kvm_msr_write_ex(ecx, data);
3649
		kvm_inject_gp(&svm->vcpu, 0);
3650 3651
	} else {
		trace_kvm_msr_write(ecx, data);
R
Rusty Russell 已提交
3652
		skip_emulated_instruction(&svm->vcpu);
3653
	}
A
Avi Kivity 已提交
3654 3655 3656
	return 1;
}

A
Avi Kivity 已提交
3657
static int msr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3658
{
R
Rusty Russell 已提交
3659
	if (svm->vmcb->control.exit_info_1)
A
Avi Kivity 已提交
3660
		return wrmsr_interception(svm);
A
Avi Kivity 已提交
3661
	else
A
Avi Kivity 已提交
3662
		return rdmsr_interception(svm);
A
Avi Kivity 已提交
3663 3664
}

A
Avi Kivity 已提交
3665
static int interrupt_window_interception(struct vcpu_svm *svm)
3666
{
3667
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3668
	svm_clear_vintr(svm);
3669
	svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
3670
	mark_dirty(svm->vmcb, VMCB_INTR);
3671
	++svm->vcpu.stat.irq_window_exits;
3672 3673 3674
	return 1;
}

3675 3676 3677 3678 3679 3680
static int pause_interception(struct vcpu_svm *svm)
{
	kvm_vcpu_on_spin(&(svm->vcpu));
	return 1;
}

3681 3682 3683 3684 3685 3686 3687 3688 3689 3690 3691 3692 3693 3694 3695 3696 3697 3698
static int nop_interception(struct vcpu_svm *svm)
{
	skip_emulated_instruction(&(svm->vcpu));
	return 1;
}

static int monitor_interception(struct vcpu_svm *svm)
{
	printk_once(KERN_WARNING "kvm: MONITOR instruction emulated as NOP!\n");
	return nop_interception(svm);
}

static int mwait_interception(struct vcpu_svm *svm)
{
	printk_once(KERN_WARNING "kvm: MWAIT instruction emulated as NOP!\n");
	return nop_interception(svm);
}

3699 3700 3701 3702 3703 3704 3705 3706 3707 3708 3709 3710
enum avic_ipi_failure_cause {
	AVIC_IPI_FAILURE_INVALID_INT_TYPE,
	AVIC_IPI_FAILURE_TARGET_NOT_RUNNING,
	AVIC_IPI_FAILURE_INVALID_TARGET,
	AVIC_IPI_FAILURE_INVALID_BACKING_PAGE,
};

static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
{
	u32 icrh = svm->vmcb->control.exit_info_1 >> 32;
	u32 icrl = svm->vmcb->control.exit_info_1;
	u32 id = svm->vmcb->control.exit_info_2 >> 32;
D
Dan Carpenter 已提交
3711
	u32 index = svm->vmcb->control.exit_info_2 & 0xFF;
3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749 3750 3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970
	struct kvm_lapic *apic = svm->vcpu.arch.apic;

	trace_kvm_avic_incomplete_ipi(svm->vcpu.vcpu_id, icrh, icrl, id, index);

	switch (id) {
	case AVIC_IPI_FAILURE_INVALID_INT_TYPE:
		/*
		 * AVIC hardware handles the generation of
		 * IPIs when the specified Message Type is Fixed
		 * (also known as fixed delivery mode) and
		 * the Trigger Mode is edge-triggered. The hardware
		 * also supports self and broadcast delivery modes
		 * specified via the Destination Shorthand(DSH)
		 * field of the ICRL. Logical and physical APIC ID
		 * formats are supported. All other IPI types cause
		 * a #VMEXIT, which needs to emulated.
		 */
		kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
		kvm_lapic_reg_write(apic, APIC_ICR, icrl);
		break;
	case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
		int i;
		struct kvm_vcpu *vcpu;
		struct kvm *kvm = svm->vcpu.kvm;
		struct kvm_lapic *apic = svm->vcpu.arch.apic;

		/*
		 * At this point, we expect that the AVIC HW has already
		 * set the appropriate IRR bits on the valid target
		 * vcpus. So, we just need to kick the appropriate vcpu.
		 */
		kvm_for_each_vcpu(i, vcpu, kvm) {
			bool m = kvm_apic_match_dest(vcpu, apic,
						     icrl & KVM_APIC_SHORT_MASK,
						     GET_APIC_DEST_FIELD(icrh),
						     icrl & KVM_APIC_DEST_MASK);

			if (m && !avic_vcpu_is_running(vcpu))
				kvm_vcpu_wake_up(vcpu);
		}
		break;
	}
	case AVIC_IPI_FAILURE_INVALID_TARGET:
		break;
	case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE:
		WARN_ONCE(1, "Invalid backing page\n");
		break;
	default:
		pr_err("Unknown IPI interception\n");
	}

	return 1;
}

static u32 *avic_get_logical_id_entry(struct kvm_vcpu *vcpu, u32 ldr, bool flat)
{
	struct kvm_arch *vm_data = &vcpu->kvm->arch;
	int index;
	u32 *logical_apic_id_table;
	int dlid = GET_APIC_LOGICAL_ID(ldr);

	if (!dlid)
		return NULL;

	if (flat) { /* flat */
		index = ffs(dlid) - 1;
		if (index > 7)
			return NULL;
	} else { /* cluster */
		int cluster = (dlid & 0xf0) >> 4;
		int apic = ffs(dlid & 0x0f) - 1;

		if ((apic < 0) || (apic > 7) ||
		    (cluster >= 0xf))
			return NULL;
		index = (cluster << 2) + apic;
	}

	logical_apic_id_table = (u32 *) page_address(vm_data->avic_logical_id_table_page);

	return &logical_apic_id_table[index];
}

static int avic_ldr_write(struct kvm_vcpu *vcpu, u8 g_physical_id, u32 ldr,
			  bool valid)
{
	bool flat;
	u32 *entry, new_entry;

	flat = kvm_lapic_get_reg(vcpu->arch.apic, APIC_DFR) == APIC_DFR_FLAT;
	entry = avic_get_logical_id_entry(vcpu, ldr, flat);
	if (!entry)
		return -EINVAL;

	new_entry = READ_ONCE(*entry);
	new_entry &= ~AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK;
	new_entry |= (g_physical_id & AVIC_LOGICAL_ID_ENTRY_GUEST_PHYSICAL_ID_MASK);
	if (valid)
		new_entry |= AVIC_LOGICAL_ID_ENTRY_VALID_MASK;
	else
		new_entry &= ~AVIC_LOGICAL_ID_ENTRY_VALID_MASK;
	WRITE_ONCE(*entry, new_entry);

	return 0;
}

static int avic_handle_ldr_update(struct kvm_vcpu *vcpu)
{
	int ret;
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 ldr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_LDR);

	if (!ldr)
		return 1;

	ret = avic_ldr_write(vcpu, vcpu->vcpu_id, ldr, true);
	if (ret && svm->ldr_reg) {
		avic_ldr_write(vcpu, 0, svm->ldr_reg, false);
		svm->ldr_reg = 0;
	} else {
		svm->ldr_reg = ldr;
	}
	return ret;
}

static int avic_handle_apic_id_update(struct kvm_vcpu *vcpu)
{
	u64 *old, *new;
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 apic_id_reg = kvm_lapic_get_reg(vcpu->arch.apic, APIC_ID);
	u32 id = (apic_id_reg >> 24) & 0xff;

	if (vcpu->vcpu_id == id)
		return 0;

	old = avic_get_physical_id_entry(vcpu, vcpu->vcpu_id);
	new = avic_get_physical_id_entry(vcpu, id);
	if (!new || !old)
		return 1;

	/* We need to move physical_id_entry to new offset */
	*new = *old;
	*old = 0ULL;
	to_svm(vcpu)->avic_physical_id_cache = new;

	/*
	 * Also update the guest physical APIC ID in the logical
	 * APIC ID table entry if already setup the LDR.
	 */
	if (svm->ldr_reg)
		avic_handle_ldr_update(vcpu);

	return 0;
}

static int avic_handle_dfr_update(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct kvm_arch *vm_data = &vcpu->kvm->arch;
	u32 dfr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_DFR);
	u32 mod = (dfr >> 28) & 0xf;

	/*
	 * We assume that all local APICs are using the same type.
	 * If this changes, we need to flush the AVIC logical
	 * APID id table.
	 */
	if (vm_data->ldr_mode == mod)
		return 0;

	clear_page(page_address(vm_data->avic_logical_id_table_page));
	vm_data->ldr_mode = mod;

	if (svm->ldr_reg)
		avic_handle_ldr_update(vcpu);
	return 0;
}

static int avic_unaccel_trap_write(struct vcpu_svm *svm)
{
	struct kvm_lapic *apic = svm->vcpu.arch.apic;
	u32 offset = svm->vmcb->control.exit_info_1 &
				AVIC_UNACCEL_ACCESS_OFFSET_MASK;

	switch (offset) {
	case APIC_ID:
		if (avic_handle_apic_id_update(&svm->vcpu))
			return 0;
		break;
	case APIC_LDR:
		if (avic_handle_ldr_update(&svm->vcpu))
			return 0;
		break;
	case APIC_DFR:
		avic_handle_dfr_update(&svm->vcpu);
		break;
	default:
		break;
	}

	kvm_lapic_reg_write(apic, offset, kvm_lapic_get_reg(apic, offset));

	return 1;
}

static bool is_avic_unaccelerated_access_trap(u32 offset)
{
	bool ret = false;

	switch (offset) {
	case APIC_ID:
	case APIC_EOI:
	case APIC_RRR:
	case APIC_LDR:
	case APIC_DFR:
	case APIC_SPIV:
	case APIC_ESR:
	case APIC_ICR:
	case APIC_LVTT:
	case APIC_LVTTHMR:
	case APIC_LVTPC:
	case APIC_LVT0:
	case APIC_LVT1:
	case APIC_LVTERR:
	case APIC_TMICT:
	case APIC_TDCR:
		ret = true;
		break;
	default:
		break;
	}
	return ret;
}

static int avic_unaccelerated_access_interception(struct vcpu_svm *svm)
{
	int ret = 0;
	u32 offset = svm->vmcb->control.exit_info_1 &
		     AVIC_UNACCEL_ACCESS_OFFSET_MASK;
	u32 vector = svm->vmcb->control.exit_info_2 &
		     AVIC_UNACCEL_ACCESS_VECTOR_MASK;
	bool write = (svm->vmcb->control.exit_info_1 >> 32) &
		     AVIC_UNACCEL_ACCESS_WRITE_MASK;
	bool trap = is_avic_unaccelerated_access_trap(offset);

	trace_kvm_avic_unaccelerated_access(svm->vcpu.vcpu_id, offset,
					    trap, write, vector);
	if (trap) {
		/* Handling Trap */
		WARN_ONCE(!write, "svm: Handling trap read.\n");
		ret = avic_unaccel_trap_write(svm);
	} else {
		/* Handling Fault */
		ret = (emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE);
	}

	return ret;
}

3971
static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
3972 3973 3974 3975
	[SVM_EXIT_READ_CR0]			= cr_interception,
	[SVM_EXIT_READ_CR3]			= cr_interception,
	[SVM_EXIT_READ_CR4]			= cr_interception,
	[SVM_EXIT_READ_CR8]			= cr_interception,
3976
	[SVM_EXIT_CR0_SEL_WRITE]		= cr_interception,
3977
	[SVM_EXIT_WRITE_CR0]			= cr_interception,
3978 3979
	[SVM_EXIT_WRITE_CR3]			= cr_interception,
	[SVM_EXIT_WRITE_CR4]			= cr_interception,
J
Joerg Roedel 已提交
3980
	[SVM_EXIT_WRITE_CR8]			= cr8_write_interception,
3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996
	[SVM_EXIT_READ_DR0]			= dr_interception,
	[SVM_EXIT_READ_DR1]			= dr_interception,
	[SVM_EXIT_READ_DR2]			= dr_interception,
	[SVM_EXIT_READ_DR3]			= dr_interception,
	[SVM_EXIT_READ_DR4]			= dr_interception,
	[SVM_EXIT_READ_DR5]			= dr_interception,
	[SVM_EXIT_READ_DR6]			= dr_interception,
	[SVM_EXIT_READ_DR7]			= dr_interception,
	[SVM_EXIT_WRITE_DR0]			= dr_interception,
	[SVM_EXIT_WRITE_DR1]			= dr_interception,
	[SVM_EXIT_WRITE_DR2]			= dr_interception,
	[SVM_EXIT_WRITE_DR3]			= dr_interception,
	[SVM_EXIT_WRITE_DR4]			= dr_interception,
	[SVM_EXIT_WRITE_DR5]			= dr_interception,
	[SVM_EXIT_WRITE_DR6]			= dr_interception,
	[SVM_EXIT_WRITE_DR7]			= dr_interception,
J
Jan Kiszka 已提交
3997 3998
	[SVM_EXIT_EXCP_BASE + DB_VECTOR]	= db_interception,
	[SVM_EXIT_EXCP_BASE + BP_VECTOR]	= bp_interception,
3999
	[SVM_EXIT_EXCP_BASE + UD_VECTOR]	= ud_interception,
J
Joerg Roedel 已提交
4000 4001
	[SVM_EXIT_EXCP_BASE + PF_VECTOR]	= pf_interception,
	[SVM_EXIT_EXCP_BASE + MC_VECTOR]	= mc_interception,
4002
	[SVM_EXIT_EXCP_BASE + AC_VECTOR]	= ac_interception,
J
Joerg Roedel 已提交
4003
	[SVM_EXIT_INTR]				= intr_interception,
4004
	[SVM_EXIT_NMI]				= nmi_interception,
A
Avi Kivity 已提交
4005 4006
	[SVM_EXIT_SMI]				= nop_on_interception,
	[SVM_EXIT_INIT]				= nop_on_interception,
4007
	[SVM_EXIT_VINTR]			= interrupt_window_interception,
A
Avi Kivity 已提交
4008
	[SVM_EXIT_RDPMC]			= rdpmc_interception,
A
Avi Kivity 已提交
4009
	[SVM_EXIT_CPUID]			= cpuid_interception,
4010
	[SVM_EXIT_IRET]                         = iret_interception,
4011
	[SVM_EXIT_INVD]                         = emulate_on_interception,
4012
	[SVM_EXIT_PAUSE]			= pause_interception,
A
Avi Kivity 已提交
4013
	[SVM_EXIT_HLT]				= halt_interception,
M
Marcelo Tosatti 已提交
4014
	[SVM_EXIT_INVLPG]			= invlpg_interception,
A
Alexander Graf 已提交
4015
	[SVM_EXIT_INVLPGA]			= invlpga_interception,
J
Joerg Roedel 已提交
4016
	[SVM_EXIT_IOIO]				= io_interception,
A
Avi Kivity 已提交
4017 4018
	[SVM_EXIT_MSR]				= msr_interception,
	[SVM_EXIT_TASK_SWITCH]			= task_switch_interception,
4019
	[SVM_EXIT_SHUTDOWN]			= shutdown_interception,
A
Alexander Graf 已提交
4020
	[SVM_EXIT_VMRUN]			= vmrun_interception,
4021
	[SVM_EXIT_VMMCALL]			= vmmcall_interception,
4022 4023
	[SVM_EXIT_VMLOAD]			= vmload_interception,
	[SVM_EXIT_VMSAVE]			= vmsave_interception,
4024 4025
	[SVM_EXIT_STGI]				= stgi_interception,
	[SVM_EXIT_CLGI]				= clgi_interception,
4026
	[SVM_EXIT_SKINIT]			= skinit_interception,
D
David Kaplan 已提交
4027
	[SVM_EXIT_WBINVD]                       = wbinvd_interception,
4028 4029
	[SVM_EXIT_MONITOR]			= monitor_interception,
	[SVM_EXIT_MWAIT]			= mwait_interception,
J
Joerg Roedel 已提交
4030
	[SVM_EXIT_XSETBV]			= xsetbv_interception,
4031
	[SVM_EXIT_NPF]				= pf_interception,
P
Paolo Bonzini 已提交
4032
	[SVM_EXIT_RSM]                          = emulate_on_interception,
4033 4034
	[SVM_EXIT_AVIC_INCOMPLETE_IPI]		= avic_incomplete_ipi_interception,
	[SVM_EXIT_AVIC_UNACCELERATED_ACCESS]	= avic_unaccelerated_access_interception,
A
Avi Kivity 已提交
4035 4036
};

4037
static void dump_vmcb(struct kvm_vcpu *vcpu)
4038 4039 4040 4041 4042 4043
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;

	pr_err("VMCB Control Area:\n");
4044 4045 4046 4047 4048 4049 4050 4051 4052 4053 4054 4055 4056 4057 4058 4059 4060 4061 4062 4063 4064 4065
	pr_err("%-20s%04x\n", "cr_read:", control->intercept_cr & 0xffff);
	pr_err("%-20s%04x\n", "cr_write:", control->intercept_cr >> 16);
	pr_err("%-20s%04x\n", "dr_read:", control->intercept_dr & 0xffff);
	pr_err("%-20s%04x\n", "dr_write:", control->intercept_dr >> 16);
	pr_err("%-20s%08x\n", "exceptions:", control->intercept_exceptions);
	pr_err("%-20s%016llx\n", "intercepts:", control->intercept);
	pr_err("%-20s%d\n", "pause filter count:", control->pause_filter_count);
	pr_err("%-20s%016llx\n", "iopm_base_pa:", control->iopm_base_pa);
	pr_err("%-20s%016llx\n", "msrpm_base_pa:", control->msrpm_base_pa);
	pr_err("%-20s%016llx\n", "tsc_offset:", control->tsc_offset);
	pr_err("%-20s%d\n", "asid:", control->asid);
	pr_err("%-20s%d\n", "tlb_ctl:", control->tlb_ctl);
	pr_err("%-20s%08x\n", "int_ctl:", control->int_ctl);
	pr_err("%-20s%08x\n", "int_vector:", control->int_vector);
	pr_err("%-20s%08x\n", "int_state:", control->int_state);
	pr_err("%-20s%08x\n", "exit_code:", control->exit_code);
	pr_err("%-20s%016llx\n", "exit_info1:", control->exit_info_1);
	pr_err("%-20s%016llx\n", "exit_info2:", control->exit_info_2);
	pr_err("%-20s%08x\n", "exit_int_info:", control->exit_int_info);
	pr_err("%-20s%08x\n", "exit_int_info_err:", control->exit_int_info_err);
	pr_err("%-20s%lld\n", "nested_ctl:", control->nested_ctl);
	pr_err("%-20s%016llx\n", "nested_cr3:", control->nested_cr3);
4066
	pr_err("%-20s%016llx\n", "avic_vapic_bar:", control->avic_vapic_bar);
4067 4068 4069 4070
	pr_err("%-20s%08x\n", "event_inj:", control->event_inj);
	pr_err("%-20s%08x\n", "event_inj_err:", control->event_inj_err);
	pr_err("%-20s%lld\n", "lbr_ctl:", control->lbr_ctl);
	pr_err("%-20s%016llx\n", "next_rip:", control->next_rip);
4071 4072 4073
	pr_err("%-20s%016llx\n", "avic_backing_page:", control->avic_backing_page);
	pr_err("%-20s%016llx\n", "avic_logical_id:", control->avic_logical_id);
	pr_err("%-20s%016llx\n", "avic_physical_id:", control->avic_physical_id);
4074
	pr_err("VMCB State Save Area:\n");
4075 4076 4077 4078 4079 4080 4081 4082 4083 4084 4085 4086 4087 4088 4089 4090 4091 4092 4093 4094 4095 4096 4097 4098 4099 4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 4114
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "es:",
	       save->es.selector, save->es.attrib,
	       save->es.limit, save->es.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "cs:",
	       save->cs.selector, save->cs.attrib,
	       save->cs.limit, save->cs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ss:",
	       save->ss.selector, save->ss.attrib,
	       save->ss.limit, save->ss.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ds:",
	       save->ds.selector, save->ds.attrib,
	       save->ds.limit, save->ds.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "fs:",
	       save->fs.selector, save->fs.attrib,
	       save->fs.limit, save->fs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "gs:",
	       save->gs.selector, save->gs.attrib,
	       save->gs.limit, save->gs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "gdtr:",
	       save->gdtr.selector, save->gdtr.attrib,
	       save->gdtr.limit, save->gdtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ldtr:",
	       save->ldtr.selector, save->ldtr.attrib,
	       save->ldtr.limit, save->ldtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "idtr:",
	       save->idtr.selector, save->idtr.attrib,
	       save->idtr.limit, save->idtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "tr:",
	       save->tr.selector, save->tr.attrib,
	       save->tr.limit, save->tr.base);
4115 4116
	pr_err("cpl:            %d                efer:         %016llx\n",
		save->cpl, save->efer);
4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140 4141 4142 4143
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cr0:", save->cr0, "cr2:", save->cr2);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cr3:", save->cr3, "cr4:", save->cr4);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "dr6:", save->dr6, "dr7:", save->dr7);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "rip:", save->rip, "rflags:", save->rflags);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "rsp:", save->rsp, "rax:", save->rax);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "star:", save->star, "lstar:", save->lstar);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cstar:", save->cstar, "sfmask:", save->sfmask);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "kernel_gs_base:", save->kernel_gs_base,
	       "sysenter_cs:", save->sysenter_cs);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "sysenter_esp:", save->sysenter_esp,
	       "sysenter_eip:", save->sysenter_eip);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "gpat:", save->g_pat, "dbgctl:", save->dbgctl);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "br_from:", save->br_from, "br_to:", save->br_to);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "excp_from:", save->last_excp_from,
	       "excp_to:", save->last_excp_to);
4144 4145
}

4146 4147 4148 4149 4150 4151 4152 4153
static void svm_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
{
	struct vmcb_control_area *control = &to_svm(vcpu)->vmcb->control;

	*info1 = control->exit_info_1;
	*info2 = control->exit_info_2;
}

A
Avi Kivity 已提交
4154
static int handle_exit(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4155
{
4156
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
4157
	struct kvm_run *kvm_run = vcpu->run;
4158
	u32 exit_code = svm->vmcb->control.exit_code;
A
Avi Kivity 已提交
4159

4160 4161
	trace_kvm_exit(exit_code, vcpu, KVM_ISA_SVM);

4162 4163
	vcpu->arch.gpa_available = (exit_code == SVM_EXIT_NPF);

4164
	if (!is_cr_intercept(svm, INTERCEPT_CR0_WRITE))
4165 4166 4167
		vcpu->arch.cr0 = svm->vmcb->save.cr0;
	if (npt_enabled)
		vcpu->arch.cr3 = svm->vmcb->save.cr3;
4168

4169 4170 4171 4172 4173 4174 4175
	if (unlikely(svm->nested.exit_required)) {
		nested_svm_vmexit(svm);
		svm->nested.exit_required = false;

		return 1;
	}

4176
	if (is_guest_mode(vcpu)) {
4177 4178
		int vmexit;

4179 4180 4181 4182
		trace_kvm_nested_vmexit(svm->vmcb->save.rip, exit_code,
					svm->vmcb->control.exit_info_1,
					svm->vmcb->control.exit_info_2,
					svm->vmcb->control.exit_int_info,
4183 4184
					svm->vmcb->control.exit_int_info_err,
					KVM_ISA_SVM);
4185

4186 4187 4188 4189 4190 4191
		vmexit = nested_svm_exit_special(svm);

		if (vmexit == NESTED_EXIT_CONTINUE)
			vmexit = nested_svm_exit_handled(svm);

		if (vmexit == NESTED_EXIT_DONE)
4192 4193 4194
			return 1;
	}

4195 4196
	svm_complete_interrupts(svm);

4197 4198 4199 4200
	if (svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
		kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
		kvm_run->fail_entry.hardware_entry_failure_reason
			= svm->vmcb->control.exit_code;
4201 4202
		pr_err("KVM: FAILED VMRUN WITH VMCB:\n");
		dump_vmcb(vcpu);
4203 4204 4205
		return 0;
	}

4206
	if (is_external_interrupt(svm->vmcb->control.exit_int_info) &&
4207
	    exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR &&
4208 4209
	    exit_code != SVM_EXIT_NPF && exit_code != SVM_EXIT_TASK_SWITCH &&
	    exit_code != SVM_EXIT_INTR && exit_code != SVM_EXIT_NMI)
4210
		printk(KERN_ERR "%s: unexpected exit_int_info 0x%x "
A
Avi Kivity 已提交
4211
		       "exit_code 0x%x\n",
4212
		       __func__, svm->vmcb->control.exit_int_info,
A
Avi Kivity 已提交
4213 4214
		       exit_code);

4215
	if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
J
Joe Perches 已提交
4216
	    || !svm_exit_handlers[exit_code]) {
4217
		WARN_ONCE(1, "svm: unexpected exit reason 0x%x\n", exit_code);
4218 4219
		kvm_queue_exception(vcpu, UD_VECTOR);
		return 1;
A
Avi Kivity 已提交
4220 4221
	}

A
Avi Kivity 已提交
4222
	return svm_exit_handlers[exit_code](svm);
A
Avi Kivity 已提交
4223 4224 4225 4226 4227 4228
}

static void reload_tss(struct kvm_vcpu *vcpu)
{
	int cpu = raw_smp_processor_id();

4229 4230
	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
	sd->tss_desc->type = 9; /* available 32/64-bit TSS */
A
Avi Kivity 已提交
4231 4232 4233
	load_TR_desc();
}

R
Rusty Russell 已提交
4234
static void pre_svm_run(struct vcpu_svm *svm)
A
Avi Kivity 已提交
4235 4236 4237
{
	int cpu = raw_smp_processor_id();

4238
	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
A
Avi Kivity 已提交
4239

4240
	/* FIXME: handle wraparound of asid_generation */
4241 4242
	if (svm->asid_generation != sd->asid_generation)
		new_asid(svm, sd);
A
Avi Kivity 已提交
4243 4244
}

4245 4246 4247 4248 4249 4250
static void svm_inject_nmi(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
	vcpu->arch.hflags |= HF_NMI_MASK;
4251
	set_intercept(svm, INTERCEPT_IRET);
4252 4253
	++vcpu->stat.nmi_injections;
}
A
Avi Kivity 已提交
4254

4255
static inline void svm_inject_irq(struct vcpu_svm *svm, int irq)
A
Avi Kivity 已提交
4256 4257 4258
{
	struct vmcb_control_area *control;

4259
	/* The following fields are ignored when AVIC is enabled */
R
Rusty Russell 已提交
4260
	control = &svm->vmcb->control;
4261
	control->int_vector = irq;
A
Avi Kivity 已提交
4262 4263 4264
	control->int_ctl &= ~V_INTR_PRIO_MASK;
	control->int_ctl |= V_IRQ_MASK |
		((/*control->int_vector >> 4*/ 0xf) << V_INTR_PRIO_SHIFT);
4265
	mark_dirty(svm->vmcb, VMCB_INTR);
A
Avi Kivity 已提交
4266 4267
}

4268
static void svm_set_irq(struct kvm_vcpu *vcpu)
E
Eddie Dong 已提交
4269 4270 4271
{
	struct vcpu_svm *svm = to_svm(vcpu);

4272
	BUG_ON(!(gif_set(svm)));
4273

4274 4275 4276
	trace_kvm_inj_virq(vcpu->arch.interrupt.nr);
	++vcpu->stat.irq_injections;

4277 4278
	svm->vmcb->control.event_inj = vcpu->arch.interrupt.nr |
		SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR;
E
Eddie Dong 已提交
4279 4280
}

4281 4282 4283 4284 4285
static inline bool svm_nested_virtualize_tpr(struct kvm_vcpu *vcpu)
{
	return is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK);
}

4286
static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
4287 4288 4289
{
	struct vcpu_svm *svm = to_svm(vcpu);

4290 4291
	if (svm_nested_virtualize_tpr(vcpu) ||
	    kvm_vcpu_apicv_active(vcpu))
4292 4293
		return;

4294 4295
	clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);

4296
	if (irr == -1)
4297 4298
		return;

4299
	if (tpr >= irr)
4300
		set_cr_intercept(svm, INTERCEPT_CR8_WRITE);
4301
}
4302

4303 4304 4305 4306 4307
static void svm_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
{
	return;
}

4308 4309
static bool svm_get_enable_apicv(void)
{
4310 4311 4312 4313 4314
	return avic;
}

static void svm_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
{
4315 4316
}

4317
static void svm_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
4318
{
4319 4320
}

4321
/* Note: Currently only used by Hyper-V. */
4322
static void svm_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
4323
{
4324 4325 4326 4327 4328 4329 4330 4331
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;

	if (!avic)
		return;

	vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
	mark_dirty(vmcb, VMCB_INTR);
4332 4333
}

4334
static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
4335 4336 4337 4338
{
	return;
}

4339 4340 4341 4342 4343 4344 4345
static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
{
	kvm_lapic_set_irr(vec, vcpu->arch.apic);
	smp_mb__after_atomic();

	if (avic_vcpu_is_running(vcpu))
		wrmsrl(SVM_AVIC_DOORBELL,
4346
		       kvm_cpu_get_apicid(vcpu->cpu));
4347 4348 4349 4350
	else
		kvm_vcpu_wake_up(vcpu);
}

4351 4352 4353 4354 4355 4356 4357 4358 4359 4360 4361 4362 4363 4364 4365 4366 4367 4368 4369 4370 4371 4372 4373 4374 4375 4376 4377 4378 4379 4380 4381 4382 4383 4384 4385 4386 4387 4388 4389 4390 4391 4392 4393 4394 4395 4396 4397 4398 4399 4400 4401 4402 4403 4404 4405 4406 4407 4408 4409 4410 4411 4412 4413 4414 4415 4416 4417 4418 4419 4420 4421 4422 4423 4424 4425 4426 4427 4428 4429 4430 4431 4432 4433 4434 4435 4436 4437 4438 4439 4440 4441 4442 4443 4444 4445 4446 4447 4448 4449 4450 4451 4452 4453 4454 4455 4456 4457 4458 4459 4460 4461 4462 4463 4464 4465 4466 4467 4468 4469 4470 4471 4472 4473 4474 4475 4476 4477 4478 4479 4480 4481 4482 4483 4484 4485 4486 4487 4488 4489 4490 4491 4492 4493 4494 4495 4496 4497 4498 4499 4500 4501 4502 4503 4504 4505 4506 4507 4508 4509 4510 4511 4512 4513 4514 4515 4516 4517 4518 4519 4520 4521 4522 4523 4524 4525 4526 4527 4528 4529 4530 4531 4532 4533 4534 4535 4536 4537 4538 4539 4540 4541 4542 4543 4544 4545 4546 4547 4548 4549 4550 4551 4552 4553
static void svm_ir_list_del(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
{
	unsigned long flags;
	struct amd_svm_iommu_ir *cur;

	spin_lock_irqsave(&svm->ir_list_lock, flags);
	list_for_each_entry(cur, &svm->ir_list, node) {
		if (cur->data != pi->ir_data)
			continue;
		list_del(&cur->node);
		kfree(cur);
		break;
	}
	spin_unlock_irqrestore(&svm->ir_list_lock, flags);
}

static int svm_ir_list_add(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
{
	int ret = 0;
	unsigned long flags;
	struct amd_svm_iommu_ir *ir;

	/**
	 * In some cases, the existing irte is updaed and re-set,
	 * so we need to check here if it's already been * added
	 * to the ir_list.
	 */
	if (pi->ir_data && (pi->prev_ga_tag != 0)) {
		struct kvm *kvm = svm->vcpu.kvm;
		u32 vcpu_id = AVIC_GATAG_TO_VCPUID(pi->prev_ga_tag);
		struct kvm_vcpu *prev_vcpu = kvm_get_vcpu_by_id(kvm, vcpu_id);
		struct vcpu_svm *prev_svm;

		if (!prev_vcpu) {
			ret = -EINVAL;
			goto out;
		}

		prev_svm = to_svm(prev_vcpu);
		svm_ir_list_del(prev_svm, pi);
	}

	/**
	 * Allocating new amd_iommu_pi_data, which will get
	 * add to the per-vcpu ir_list.
	 */
	ir = kzalloc(sizeof(struct amd_svm_iommu_ir), GFP_KERNEL);
	if (!ir) {
		ret = -ENOMEM;
		goto out;
	}
	ir->data = pi->ir_data;

	spin_lock_irqsave(&svm->ir_list_lock, flags);
	list_add(&ir->node, &svm->ir_list);
	spin_unlock_irqrestore(&svm->ir_list_lock, flags);
out:
	return ret;
}

/**
 * Note:
 * The HW cannot support posting multicast/broadcast
 * interrupts to a vCPU. So, we still use legacy interrupt
 * remapping for these kind of interrupts.
 *
 * For lowest-priority interrupts, we only support
 * those with single CPU as the destination, e.g. user
 * configures the interrupts via /proc/irq or uses
 * irqbalance to make the interrupts single-CPU.
 */
static int
get_pi_vcpu_info(struct kvm *kvm, struct kvm_kernel_irq_routing_entry *e,
		 struct vcpu_data *vcpu_info, struct vcpu_svm **svm)
{
	struct kvm_lapic_irq irq;
	struct kvm_vcpu *vcpu = NULL;

	kvm_set_msi_irq(kvm, e, &irq);

	if (!kvm_intr_is_single_vcpu(kvm, &irq, &vcpu)) {
		pr_debug("SVM: %s: use legacy intr remap mode for irq %u\n",
			 __func__, irq.vector);
		return -1;
	}

	pr_debug("SVM: %s: use GA mode for irq %u\n", __func__,
		 irq.vector);
	*svm = to_svm(vcpu);
	vcpu_info->pi_desc_addr = page_to_phys((*svm)->avic_backing_page);
	vcpu_info->vector = irq.vector;

	return 0;
}

/*
 * svm_update_pi_irte - set IRTE for Posted-Interrupts
 *
 * @kvm: kvm
 * @host_irq: host irq of the interrupt
 * @guest_irq: gsi of the interrupt
 * @set: set or unset PI
 * returns 0 on success, < 0 on failure
 */
static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
			      uint32_t guest_irq, bool set)
{
	struct kvm_kernel_irq_routing_entry *e;
	struct kvm_irq_routing_table *irq_rt;
	int idx, ret = -EINVAL;

	if (!kvm_arch_has_assigned_device(kvm) ||
	    !irq_remapping_cap(IRQ_POSTING_CAP))
		return 0;

	pr_debug("SVM: %s: host_irq=%#x, guest_irq=%#x, set=%#x\n",
		 __func__, host_irq, guest_irq, set);

	idx = srcu_read_lock(&kvm->irq_srcu);
	irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
	WARN_ON(guest_irq >= irq_rt->nr_rt_entries);

	hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
		struct vcpu_data vcpu_info;
		struct vcpu_svm *svm = NULL;

		if (e->type != KVM_IRQ_ROUTING_MSI)
			continue;

		/**
		 * Here, we setup with legacy mode in the following cases:
		 * 1. When cannot target interrupt to a specific vcpu.
		 * 2. Unsetting posted interrupt.
		 * 3. APIC virtialization is disabled for the vcpu.
		 */
		if (!get_pi_vcpu_info(kvm, e, &vcpu_info, &svm) && set &&
		    kvm_vcpu_apicv_active(&svm->vcpu)) {
			struct amd_iommu_pi_data pi;

			/* Try to enable guest_mode in IRTE */
			pi.base = page_to_phys(svm->avic_backing_page) & AVIC_HPA_MASK;
			pi.ga_tag = AVIC_GATAG(kvm->arch.avic_vm_id,
						     svm->vcpu.vcpu_id);
			pi.is_guest_mode = true;
			pi.vcpu_data = &vcpu_info;
			ret = irq_set_vcpu_affinity(host_irq, &pi);

			/**
			 * Here, we successfully setting up vcpu affinity in
			 * IOMMU guest mode. Now, we need to store the posted
			 * interrupt information in a per-vcpu ir_list so that
			 * we can reference to them directly when we update vcpu
			 * scheduling information in IOMMU irte.
			 */
			if (!ret && pi.is_guest_mode)
				svm_ir_list_add(svm, &pi);
		} else {
			/* Use legacy mode in IRTE */
			struct amd_iommu_pi_data pi;

			/**
			 * Here, pi is used to:
			 * - Tell IOMMU to use legacy mode for this interrupt.
			 * - Retrieve ga_tag of prior interrupt remapping data.
			 */
			pi.is_guest_mode = false;
			ret = irq_set_vcpu_affinity(host_irq, &pi);

			/**
			 * Check if the posted interrupt was previously
			 * setup with the guest_mode by checking if the ga_tag
			 * was cached. If so, we need to clean up the per-vcpu
			 * ir_list.
			 */
			if (!ret && pi.prev_ga_tag) {
				int id = AVIC_GATAG_TO_VCPUID(pi.prev_ga_tag);
				struct kvm_vcpu *vcpu;

				vcpu = kvm_get_vcpu_by_id(kvm, id);
				if (vcpu)
					svm_ir_list_del(to_svm(vcpu), &pi);
			}
		}

		if (!ret && svm) {
			trace_kvm_pi_irte_update(svm->vcpu.vcpu_id,
						 host_irq, e->gsi,
						 vcpu_info.vector,
						 vcpu_info.pi_desc_addr, set);
		}

		if (ret < 0) {
			pr_err("%s: failed to update PI IRTE\n", __func__);
			goto out;
		}
	}

	ret = 0;
out:
	srcu_read_unlock(&kvm->irq_srcu, idx);
	return ret;
}

4554 4555 4556 4557
static int svm_nmi_allowed(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
J
Joerg Roedel 已提交
4558 4559 4560 4561 4562 4563
	int ret;
	ret = !(vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK) &&
	      !(svm->vcpu.arch.hflags & HF_NMI_MASK);
	ret = ret && gif_set(svm) && nested_svm_nmi(svm);

	return ret;
4564 4565
}

J
Jan Kiszka 已提交
4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578
static bool svm_get_nmi_mask(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	return !!(svm->vcpu.arch.hflags & HF_NMI_MASK);
}

static void svm_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (masked) {
		svm->vcpu.arch.hflags |= HF_NMI_MASK;
4579
		set_intercept(svm, INTERCEPT_IRET);
J
Jan Kiszka 已提交
4580 4581
	} else {
		svm->vcpu.arch.hflags &= ~HF_NMI_MASK;
4582
		clr_intercept(svm, INTERCEPT_IRET);
J
Jan Kiszka 已提交
4583 4584 4585
	}
}

4586 4587 4588 4589
static int svm_interrupt_allowed(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
4590 4591 4592 4593 4594 4595
	int ret;

	if (!gif_set(svm) ||
	     (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK))
		return 0;

4596
	ret = !!(kvm_get_rflags(vcpu) & X86_EFLAGS_IF);
4597

4598
	if (is_guest_mode(vcpu))
4599 4600 4601
		return ret && !(svm->vcpu.arch.hflags & HF_VINTR_MASK);

	return ret;
4602 4603
}

4604
static void enable_irq_window(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4605
{
4606 4607
	struct vcpu_svm *svm = to_svm(vcpu);

4608 4609 4610
	if (kvm_vcpu_apicv_active(vcpu))
		return;

J
Joerg Roedel 已提交
4611 4612 4613 4614 4615 4616
	/*
	 * In case GIF=0 we can't rely on the CPU to tell us when GIF becomes
	 * 1, because that's a separate STGI/VMRUN intercept.  The next time we
	 * get that intercept, this function will be called again though and
	 * we'll get the vintr intercept.
	 */
4617
	if (gif_set(svm) && nested_svm_intr(svm)) {
4618 4619 4620
		svm_set_vintr(svm);
		svm_inject_irq(svm, 0x0);
	}
4621 4622
}

4623
static void enable_nmi_window(struct kvm_vcpu *vcpu)
4624
{
4625
	struct vcpu_svm *svm = to_svm(vcpu);
4626

4627 4628
	if ((svm->vcpu.arch.hflags & (HF_NMI_MASK | HF_IRET_MASK))
	    == HF_NMI_MASK)
4629
		return; /* IRET will cause a vm exit */
4630

J
Joerg Roedel 已提交
4631 4632 4633 4634
	/*
	 * Something prevents NMI from been injected. Single step over possible
	 * problem (IRET or exception injection or interrupt shadow)
	 */
J
Jan Kiszka 已提交
4635
	svm->nmi_singlestep = true;
4636
	svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
4637 4638
}

4639 4640 4641 4642 4643
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
{
	return 0;
}

4644 4645
static void svm_flush_tlb(struct kvm_vcpu *vcpu)
{
4646 4647 4648 4649 4650 4651
	struct vcpu_svm *svm = to_svm(vcpu);

	if (static_cpu_has(X86_FEATURE_FLUSHBYASID))
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ASID;
	else
		svm->asid_generation--;
4652 4653
}

4654 4655 4656 4657
static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
{
}

4658 4659 4660 4661
static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

4662
	if (svm_nested_virtualize_tpr(vcpu))
4663 4664
		return;

4665
	if (!is_cr_intercept(svm, INTERCEPT_CR8_WRITE)) {
4666
		int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK;
4667
		kvm_set_cr8(vcpu, cr8);
4668 4669 4670
	}
}

4671 4672 4673 4674 4675
static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 cr8;

4676 4677
	if (svm_nested_virtualize_tpr(vcpu) ||
	    kvm_vcpu_apicv_active(vcpu))
4678 4679
		return;

4680 4681 4682 4683 4684
	cr8 = kvm_get_cr8(vcpu);
	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
}

4685 4686 4687 4688 4689
static void svm_complete_interrupts(struct vcpu_svm *svm)
{
	u8 vector;
	int type;
	u32 exitintinfo = svm->vmcb->control.exit_int_info;
4690 4691 4692
	unsigned int3_injected = svm->int3_injected;

	svm->int3_injected = 0;
4693

4694 4695 4696 4697 4698 4699
	/*
	 * If we've made progress since setting HF_IRET_MASK, we've
	 * executed an IRET and can allow NMI injection.
	 */
	if ((svm->vcpu.arch.hflags & HF_IRET_MASK)
	    && kvm_rip_read(&svm->vcpu) != svm->nmi_iret_rip) {
4700
		svm->vcpu.arch.hflags &= ~(HF_NMI_MASK | HF_IRET_MASK);
4701 4702
		kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
	}
4703

4704 4705 4706 4707 4708 4709 4710
	svm->vcpu.arch.nmi_injected = false;
	kvm_clear_exception_queue(&svm->vcpu);
	kvm_clear_interrupt_queue(&svm->vcpu);

	if (!(exitintinfo & SVM_EXITINTINFO_VALID))
		return;

4711 4712
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);

4713 4714 4715 4716 4717 4718 4719 4720
	vector = exitintinfo & SVM_EXITINTINFO_VEC_MASK;
	type = exitintinfo & SVM_EXITINTINFO_TYPE_MASK;

	switch (type) {
	case SVM_EXITINTINFO_TYPE_NMI:
		svm->vcpu.arch.nmi_injected = true;
		break;
	case SVM_EXITINTINFO_TYPE_EXEPT:
4721 4722 4723 4724 4725 4726 4727 4728 4729 4730 4731
		/*
		 * In case of software exceptions, do not reinject the vector,
		 * but re-execute the instruction instead. Rewind RIP first
		 * if we emulated INT3 before.
		 */
		if (kvm_exception_is_soft(vector)) {
			if (vector == BP_VECTOR && int3_injected &&
			    kvm_is_linear_rip(&svm->vcpu, svm->int3_rip))
				kvm_rip_write(&svm->vcpu,
					      kvm_rip_read(&svm->vcpu) -
					      int3_injected);
4732
			break;
4733
		}
4734 4735
		if (exitintinfo & SVM_EXITINTINFO_VALID_ERR) {
			u32 err = svm->vmcb->control.exit_int_info_err;
4736
			kvm_requeue_exception_e(&svm->vcpu, vector, err);
4737 4738

		} else
4739
			kvm_requeue_exception(&svm->vcpu, vector);
4740 4741
		break;
	case SVM_EXITINTINFO_TYPE_INTR:
4742
		kvm_queue_interrupt(&svm->vcpu, vector, false);
4743 4744 4745 4746 4747 4748
		break;
	default:
		break;
	}
}

A
Avi Kivity 已提交
4749 4750 4751 4752 4753 4754 4755 4756 4757 4758 4759
static void svm_cancel_injection(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;

	control->exit_int_info = control->event_inj;
	control->exit_int_info_err = control->event_inj_err;
	control->event_inj = 0;
	svm_complete_interrupts(svm);
}

A
Avi Kivity 已提交
4760
static void svm_vcpu_run(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
4761
{
4762
	struct vcpu_svm *svm = to_svm(vcpu);
4763

4764 4765 4766 4767
	svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
	svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
	svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];

4768 4769 4770 4771 4772 4773 4774
	/*
	 * A vmexit emulation is required before the vcpu can be executed
	 * again.
	 */
	if (unlikely(svm->nested.exit_required))
		return;

R
Rusty Russell 已提交
4775
	pre_svm_run(svm);
A
Avi Kivity 已提交
4776

4777 4778
	sync_lapic_to_cr8(vcpu);

4779
	svm->vmcb->save.cr2 = vcpu->arch.cr2;
A
Avi Kivity 已提交
4780

4781 4782 4783
	clgi();

	local_irq_enable();
4784

A
Avi Kivity 已提交
4785
	asm volatile (
A
Avi Kivity 已提交
4786 4787 4788 4789 4790 4791 4792
		"push %%" _ASM_BP "; \n\t"
		"mov %c[rbx](%[svm]), %%" _ASM_BX " \n\t"
		"mov %c[rcx](%[svm]), %%" _ASM_CX " \n\t"
		"mov %c[rdx](%[svm]), %%" _ASM_DX " \n\t"
		"mov %c[rsi](%[svm]), %%" _ASM_SI " \n\t"
		"mov %c[rdi](%[svm]), %%" _ASM_DI " \n\t"
		"mov %c[rbp](%[svm]), %%" _ASM_BP " \n\t"
4793
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
4794 4795 4796 4797 4798 4799 4800 4801
		"mov %c[r8](%[svm]),  %%r8  \n\t"
		"mov %c[r9](%[svm]),  %%r9  \n\t"
		"mov %c[r10](%[svm]), %%r10 \n\t"
		"mov %c[r11](%[svm]), %%r11 \n\t"
		"mov %c[r12](%[svm]), %%r12 \n\t"
		"mov %c[r13](%[svm]), %%r13 \n\t"
		"mov %c[r14](%[svm]), %%r14 \n\t"
		"mov %c[r15](%[svm]), %%r15 \n\t"
A
Avi Kivity 已提交
4802 4803 4804
#endif

		/* Enter guest mode */
A
Avi Kivity 已提交
4805 4806
		"push %%" _ASM_AX " \n\t"
		"mov %c[vmcb](%[svm]), %%" _ASM_AX " \n\t"
4807 4808 4809
		__ex(SVM_VMLOAD) "\n\t"
		__ex(SVM_VMRUN) "\n\t"
		__ex(SVM_VMSAVE) "\n\t"
A
Avi Kivity 已提交
4810
		"pop %%" _ASM_AX " \n\t"
A
Avi Kivity 已提交
4811 4812

		/* Save guest registers, load host registers */
A
Avi Kivity 已提交
4813 4814 4815 4816 4817 4818
		"mov %%" _ASM_BX ", %c[rbx](%[svm]) \n\t"
		"mov %%" _ASM_CX ", %c[rcx](%[svm]) \n\t"
		"mov %%" _ASM_DX ", %c[rdx](%[svm]) \n\t"
		"mov %%" _ASM_SI ", %c[rsi](%[svm]) \n\t"
		"mov %%" _ASM_DI ", %c[rdi](%[svm]) \n\t"
		"mov %%" _ASM_BP ", %c[rbp](%[svm]) \n\t"
4819
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
4820 4821 4822 4823 4824 4825 4826 4827
		"mov %%r8,  %c[r8](%[svm]) \n\t"
		"mov %%r9,  %c[r9](%[svm]) \n\t"
		"mov %%r10, %c[r10](%[svm]) \n\t"
		"mov %%r11, %c[r11](%[svm]) \n\t"
		"mov %%r12, %c[r12](%[svm]) \n\t"
		"mov %%r13, %c[r13](%[svm]) \n\t"
		"mov %%r14, %c[r14](%[svm]) \n\t"
		"mov %%r15, %c[r15](%[svm]) \n\t"
A
Avi Kivity 已提交
4828
#endif
A
Avi Kivity 已提交
4829
		"pop %%" _ASM_BP
A
Avi Kivity 已提交
4830
		:
R
Rusty Russell 已提交
4831
		: [svm]"a"(svm),
A
Avi Kivity 已提交
4832
		  [vmcb]"i"(offsetof(struct vcpu_svm, vmcb_pa)),
4833 4834 4835 4836 4837 4838
		  [rbx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBX])),
		  [rcx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RCX])),
		  [rdx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDX])),
		  [rsi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RSI])),
		  [rdi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDI])),
		  [rbp]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBP]))
4839
#ifdef CONFIG_X86_64
4840 4841 4842 4843 4844 4845 4846 4847
		  , [r8]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R8])),
		  [r9]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R9])),
		  [r10]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R10])),
		  [r11]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R11])),
		  [r12]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R12])),
		  [r13]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R13])),
		  [r14]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R14])),
		  [r15]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R15]))
A
Avi Kivity 已提交
4848
#endif
4849 4850
		: "cc", "memory"
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
4851
		, "rbx", "rcx", "rdx", "rsi", "rdi"
4852
		, "r8", "r9", "r10", "r11" , "r12", "r13", "r14", "r15"
A
Avi Kivity 已提交
4853 4854
#else
		, "ebx", "ecx", "edx", "esi", "edi"
4855 4856
#endif
		);
A
Avi Kivity 已提交
4857

4858 4859 4860
#ifdef CONFIG_X86_64
	wrmsrl(MSR_GS_BASE, svm->host.gs_base);
#else
4861
	loadsegment(fs, svm->host.fs);
4862 4863 4864
#ifndef CONFIG_X86_32_LAZY_GS
	loadsegment(gs, svm->host.gs);
#endif
4865
#endif
A
Avi Kivity 已提交
4866 4867 4868

	reload_tss(vcpu);

4869 4870
	local_irq_disable();

4871 4872 4873 4874 4875
	vcpu->arch.cr2 = svm->vmcb->save.cr2;
	vcpu->arch.regs[VCPU_REGS_RAX] = svm->vmcb->save.rax;
	vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
	vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;

4876 4877 4878 4879 4880 4881 4882 4883 4884 4885
	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
		kvm_before_handle_nmi(&svm->vcpu);

	stgi();

	/* Any pending NMI will happen here */

	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
		kvm_after_handle_nmi(&svm->vcpu);

4886 4887
	sync_cr8_to_lapic(vcpu);

4888
	svm->next_rip = 0;
4889

4890 4891
	svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;

G
Gleb Natapov 已提交
4892 4893 4894 4895
	/* if exit due to PF check for async PF */
	if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
		svm->apf_reason = kvm_read_and_reset_pf_reason();

A
Avi Kivity 已提交
4896 4897 4898 4899
	if (npt_enabled) {
		vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
		vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
	}
4900 4901 4902 4903 4904 4905 4906 4907

	/*
	 * We need to handle MC intercepts here before the vcpu has a chance to
	 * change the physical cpu
	 */
	if (unlikely(svm->vmcb->control.exit_code ==
		     SVM_EXIT_EXCP_BASE + MC_VECTOR))
		svm_handle_mce(svm);
4908 4909

	mark_all_clean(svm->vmcb);
A
Avi Kivity 已提交
4910 4911 4912 4913
}

static void svm_set_cr3(struct kvm_vcpu *vcpu, unsigned long root)
{
4914 4915 4916
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.cr3 = root;
4917
	mark_dirty(svm->vmcb, VMCB_CR);
4918
	svm_flush_tlb(vcpu);
A
Avi Kivity 已提交
4919 4920
}

4921 4922 4923 4924 4925
static void set_tdp_cr3(struct kvm_vcpu *vcpu, unsigned long root)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.nested_cr3 = root;
4926
	mark_dirty(svm->vmcb, VMCB_NPT);
4927 4928

	/* Also sync guest cr3 here in case we live migrate */
4929
	svm->vmcb->save.cr3 = kvm_read_cr3(vcpu);
4930
	mark_dirty(svm->vmcb, VMCB_CR);
4931

4932
	svm_flush_tlb(vcpu);
4933 4934
}

A
Avi Kivity 已提交
4935 4936
static int is_disabled(void)
{
4937 4938 4939 4940 4941 4942
	u64 vm_cr;

	rdmsrl(MSR_VM_CR, vm_cr);
	if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE))
		return 1;

A
Avi Kivity 已提交
4943 4944 4945
	return 0;
}

I
Ingo Molnar 已提交
4946 4947 4948 4949 4950 4951 4952 4953 4954 4955 4956
static void
svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
{
	/*
	 * Patch in the VMMCALL instruction:
	 */
	hypercall[0] = 0x0f;
	hypercall[1] = 0x01;
	hypercall[2] = 0xd9;
}

Y
Yang, Sheng 已提交
4957 4958 4959 4960 4961
static void svm_check_processor_compat(void *rtn)
{
	*(int *)rtn = 0;
}

4962 4963 4964 4965 4966
static bool svm_cpu_has_accelerated_tpr(void)
{
	return false;
}

4967 4968 4969 4970 4971
static bool svm_has_high_real_mode_segbase(void)
{
	return true;
}

4972 4973 4974 4975 4976
static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
{
	return 0;
}

4977 4978
static void svm_cpuid_update(struct kvm_vcpu *vcpu)
{
4979
	struct vcpu_svm *svm = to_svm(vcpu);
4980
	struct kvm_cpuid_entry2 *entry;
4981 4982 4983

	/* Update nrips enabled cache */
	svm->nrips_enabled = !!guest_cpuid_has_nrips(&svm->vcpu);
4984 4985 4986 4987 4988 4989 4990

	if (!kvm_vcpu_apicv_active(vcpu))
		return;

	entry = kvm_find_cpuid_entry(vcpu, 1, 0);
	if (entry)
		entry->ecx &= ~bit(X86_FEATURE_X2APIC);
4991 4992
}

4993 4994
static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
{
4995
	switch (func) {
4996 4997 4998 4999
	case 0x1:
		if (avic)
			entry->ecx &= ~bit(X86_FEATURE_X2APIC);
		break;
5000 5001 5002 5003
	case 0x80000001:
		if (nested)
			entry->ecx |= (1 << 2); /* Set SVM bit */
		break;
5004 5005 5006 5007 5008
	case 0x8000000A:
		entry->eax = 1; /* SVM revision 1 */
		entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper
				   ASID emulation to nested SVM */
		entry->ecx = 0; /* Reserved */
5009 5010 5011 5012
		entry->edx = 0; /* Per default do not support any
				   additional features */

		/* Support next_rip if host supports it */
5013
		if (boot_cpu_has(X86_FEATURE_NRIPS))
5014
			entry->edx |= SVM_FEATURE_NRIP;
5015

5016 5017 5018 5019
		/* Support NPT for the guest if enabled */
		if (npt_enabled)
			entry->edx |= SVM_FEATURE_NPT;

5020 5021
		break;
	}
5022 5023
}

5024
static int svm_get_lpage_level(void)
5025
{
5026
	return PT_PDPE_LEVEL;
5027 5028
}

5029 5030
static bool svm_rdtscp_supported(void)
{
P
Paolo Bonzini 已提交
5031
	return boot_cpu_has(X86_FEATURE_RDTSCP);
5032 5033
}

5034 5035 5036 5037 5038
static bool svm_invpcid_supported(void)
{
	return false;
}

5039 5040 5041 5042 5043
static bool svm_mpx_supported(void)
{
	return false;
}

5044 5045 5046 5047 5048
static bool svm_xsaves_supported(void)
{
	return false;
}

5049 5050 5051 5052 5053
static bool svm_has_wbinvd_exit(void)
{
	return true;
}

5054
#define PRE_EX(exit)  { .exit_code = (exit), \
5055
			.stage = X86_ICPT_PRE_EXCEPT, }
5056
#define POST_EX(exit) { .exit_code = (exit), \
5057
			.stage = X86_ICPT_POST_EXCEPT, }
5058
#define POST_MEM(exit) { .exit_code = (exit), \
5059
			.stage = X86_ICPT_POST_MEMACCESS, }
5060

5061
static const struct __x86_intercept {
5062 5063 5064 5065 5066 5067 5068 5069
	u32 exit_code;
	enum x86_intercept_stage stage;
} x86_intercept_map[] = {
	[x86_intercept_cr_read]		= POST_EX(SVM_EXIT_READ_CR0),
	[x86_intercept_cr_write]	= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_clts]		= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_lmsw]		= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_smsw]		= POST_EX(SVM_EXIT_READ_CR0),
5070 5071
	[x86_intercept_dr_read]		= POST_EX(SVM_EXIT_READ_DR0),
	[x86_intercept_dr_write]	= POST_EX(SVM_EXIT_WRITE_DR0),
5072 5073 5074 5075 5076 5077 5078 5079
	[x86_intercept_sldt]		= POST_EX(SVM_EXIT_LDTR_READ),
	[x86_intercept_str]		= POST_EX(SVM_EXIT_TR_READ),
	[x86_intercept_lldt]		= POST_EX(SVM_EXIT_LDTR_WRITE),
	[x86_intercept_ltr]		= POST_EX(SVM_EXIT_TR_WRITE),
	[x86_intercept_sgdt]		= POST_EX(SVM_EXIT_GDTR_READ),
	[x86_intercept_sidt]		= POST_EX(SVM_EXIT_IDTR_READ),
	[x86_intercept_lgdt]		= POST_EX(SVM_EXIT_GDTR_WRITE),
	[x86_intercept_lidt]		= POST_EX(SVM_EXIT_IDTR_WRITE),
5080 5081 5082 5083 5084 5085 5086 5087
	[x86_intercept_vmrun]		= POST_EX(SVM_EXIT_VMRUN),
	[x86_intercept_vmmcall]		= POST_EX(SVM_EXIT_VMMCALL),
	[x86_intercept_vmload]		= POST_EX(SVM_EXIT_VMLOAD),
	[x86_intercept_vmsave]		= POST_EX(SVM_EXIT_VMSAVE),
	[x86_intercept_stgi]		= POST_EX(SVM_EXIT_STGI),
	[x86_intercept_clgi]		= POST_EX(SVM_EXIT_CLGI),
	[x86_intercept_skinit]		= POST_EX(SVM_EXIT_SKINIT),
	[x86_intercept_invlpga]		= POST_EX(SVM_EXIT_INVLPGA),
5088 5089 5090
	[x86_intercept_rdtscp]		= POST_EX(SVM_EXIT_RDTSCP),
	[x86_intercept_monitor]		= POST_MEM(SVM_EXIT_MONITOR),
	[x86_intercept_mwait]		= POST_EX(SVM_EXIT_MWAIT),
5091 5092 5093 5094 5095 5096 5097 5098 5099
	[x86_intercept_invlpg]		= POST_EX(SVM_EXIT_INVLPG),
	[x86_intercept_invd]		= POST_EX(SVM_EXIT_INVD),
	[x86_intercept_wbinvd]		= POST_EX(SVM_EXIT_WBINVD),
	[x86_intercept_wrmsr]		= POST_EX(SVM_EXIT_MSR),
	[x86_intercept_rdtsc]		= POST_EX(SVM_EXIT_RDTSC),
	[x86_intercept_rdmsr]		= POST_EX(SVM_EXIT_MSR),
	[x86_intercept_rdpmc]		= POST_EX(SVM_EXIT_RDPMC),
	[x86_intercept_cpuid]		= PRE_EX(SVM_EXIT_CPUID),
	[x86_intercept_rsm]		= PRE_EX(SVM_EXIT_RSM),
5100 5101 5102 5103 5104 5105 5106
	[x86_intercept_pause]		= PRE_EX(SVM_EXIT_PAUSE),
	[x86_intercept_pushf]		= PRE_EX(SVM_EXIT_PUSHF),
	[x86_intercept_popf]		= PRE_EX(SVM_EXIT_POPF),
	[x86_intercept_intn]		= PRE_EX(SVM_EXIT_SWINT),
	[x86_intercept_iret]		= PRE_EX(SVM_EXIT_IRET),
	[x86_intercept_icebp]		= PRE_EX(SVM_EXIT_ICEBP),
	[x86_intercept_hlt]		= POST_EX(SVM_EXIT_HLT),
5107 5108 5109 5110
	[x86_intercept_in]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_ins]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_out]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_outs]		= POST_EX(SVM_EXIT_IOIO),
5111 5112
};

5113
#undef PRE_EX
5114
#undef POST_EX
5115
#undef POST_MEM
5116

5117 5118 5119 5120
static int svm_check_intercept(struct kvm_vcpu *vcpu,
			       struct x86_instruction_info *info,
			       enum x86_intercept_stage stage)
{
5121 5122 5123 5124 5125 5126 5127 5128 5129 5130
	struct vcpu_svm *svm = to_svm(vcpu);
	int vmexit, ret = X86EMUL_CONTINUE;
	struct __x86_intercept icpt_info;
	struct vmcb *vmcb = svm->vmcb;

	if (info->intercept >= ARRAY_SIZE(x86_intercept_map))
		goto out;

	icpt_info = x86_intercept_map[info->intercept];

5131
	if (stage != icpt_info.stage)
5132 5133 5134 5135 5136 5137 5138 5139 5140 5141 5142 5143 5144 5145
		goto out;

	switch (icpt_info.exit_code) {
	case SVM_EXIT_READ_CR0:
		if (info->intercept == x86_intercept_cr_read)
			icpt_info.exit_code += info->modrm_reg;
		break;
	case SVM_EXIT_WRITE_CR0: {
		unsigned long cr0, val;
		u64 intercept;

		if (info->intercept == x86_intercept_cr_write)
			icpt_info.exit_code += info->modrm_reg;

5146 5147
		if (icpt_info.exit_code != SVM_EXIT_WRITE_CR0 ||
		    info->intercept == x86_intercept_clts)
5148 5149 5150 5151 5152 5153 5154 5155 5156 5157 5158 5159 5160 5161 5162 5163 5164 5165 5166 5167 5168 5169 5170
			break;

		intercept = svm->nested.intercept;

		if (!(intercept & (1ULL << INTERCEPT_SELECTIVE_CR0)))
			break;

		cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
		val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;

		if (info->intercept == x86_intercept_lmsw) {
			cr0 &= 0xfUL;
			val &= 0xfUL;
			/* lmsw can't clear PE - catch this here */
			if (cr0 & X86_CR0_PE)
				val |= X86_CR0_PE;
		}

		if (cr0 ^ val)
			icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;

		break;
	}
5171 5172 5173 5174
	case SVM_EXIT_READ_DR0:
	case SVM_EXIT_WRITE_DR0:
		icpt_info.exit_code += info->modrm_reg;
		break;
5175 5176 5177 5178 5179 5180
	case SVM_EXIT_MSR:
		if (info->intercept == x86_intercept_wrmsr)
			vmcb->control.exit_info_1 = 1;
		else
			vmcb->control.exit_info_1 = 0;
		break;
5181 5182 5183 5184 5185 5186 5187
	case SVM_EXIT_PAUSE:
		/*
		 * We get this for NOP only, but pause
		 * is rep not, check this here
		 */
		if (info->rep_prefix != REPE_PREFIX)
			goto out;
5188 5189 5190 5191 5192 5193
	case SVM_EXIT_IOIO: {
		u64 exit_info;
		u32 bytes;

		if (info->intercept == x86_intercept_in ||
		    info->intercept == x86_intercept_ins) {
5194 5195
			exit_info = ((info->src_val & 0xffff) << 16) |
				SVM_IOIO_TYPE_MASK;
5196
			bytes = info->dst_bytes;
5197
		} else {
5198
			exit_info = (info->dst_val & 0xffff) << 16;
5199
			bytes = info->src_bytes;
5200 5201 5202 5203 5204 5205 5206 5207 5208 5209 5210 5211 5212 5213 5214 5215 5216 5217 5218 5219
		}

		if (info->intercept == x86_intercept_outs ||
		    info->intercept == x86_intercept_ins)
			exit_info |= SVM_IOIO_STR_MASK;

		if (info->rep_prefix)
			exit_info |= SVM_IOIO_REP_MASK;

		bytes = min(bytes, 4u);

		exit_info |= bytes << SVM_IOIO_SIZE_SHIFT;

		exit_info |= (u32)info->ad_bytes << (SVM_IOIO_ASIZE_SHIFT - 1);

		vmcb->control.exit_info_1 = exit_info;
		vmcb->control.exit_info_2 = info->next_rip;

		break;
	}
5220 5221 5222 5223
	default:
		break;
	}

5224 5225 5226
	/* TODO: Advertise NRIPS to guest hypervisor unconditionally */
	if (static_cpu_has(X86_FEATURE_NRIPS))
		vmcb->control.next_rip  = info->next_rip;
5227 5228 5229 5230 5231 5232 5233 5234
	vmcb->control.exit_code = icpt_info.exit_code;
	vmexit = nested_svm_exit_handled(svm);

	ret = (vmexit == NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED
					   : X86EMUL_CONTINUE;

out:
	return ret;
5235 5236
}

5237 5238 5239
static void svm_handle_external_intr(struct kvm_vcpu *vcpu)
{
	local_irq_enable();
P
Paolo Bonzini 已提交
5240 5241 5242 5243 5244 5245
	/*
	 * We must have an instruction with interrupts enabled, so
	 * the timer interrupt isn't delayed by the interrupt shadow.
	 */
	asm("nop");
	local_irq_disable();
5246 5247
}

5248 5249 5250 5251
static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
{
}

5252 5253 5254 5255 5256 5257 5258 5259 5260
static inline void avic_post_state_restore(struct kvm_vcpu *vcpu)
{
	if (avic_handle_apic_id_update(vcpu) != 0)
		return;
	if (avic_handle_dfr_update(vcpu) != 0)
		return;
	avic_handle_ldr_update(vcpu);
}

5261 5262 5263 5264 5265 5266
static void svm_setup_mce(struct kvm_vcpu *vcpu)
{
	/* [63:9] are reserved. */
	vcpu->arch.mcg_cap &= 0x1ff;
}

5267
static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
A
Avi Kivity 已提交
5268 5269 5270 5271
	.cpu_has_kvm_support = has_svm,
	.disabled_by_bios = is_disabled,
	.hardware_setup = svm_hardware_setup,
	.hardware_unsetup = svm_hardware_unsetup,
Y
Yang, Sheng 已提交
5272
	.check_processor_compatibility = svm_check_processor_compat,
A
Avi Kivity 已提交
5273 5274
	.hardware_enable = svm_hardware_enable,
	.hardware_disable = svm_hardware_disable,
5275
	.cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr,
5276
	.cpu_has_high_real_mode_segbase = svm_has_high_real_mode_segbase,
A
Avi Kivity 已提交
5277 5278 5279

	.vcpu_create = svm_create_vcpu,
	.vcpu_free = svm_free_vcpu,
5280
	.vcpu_reset = svm_vcpu_reset,
A
Avi Kivity 已提交
5281

5282 5283 5284
	.vm_init = avic_vm_init,
	.vm_destroy = avic_vm_destroy,

5285
	.prepare_guest_switch = svm_prepare_guest_switch,
A
Avi Kivity 已提交
5286 5287
	.vcpu_load = svm_vcpu_load,
	.vcpu_put = svm_vcpu_put,
5288 5289
	.vcpu_blocking = svm_vcpu_blocking,
	.vcpu_unblocking = svm_vcpu_unblocking,
A
Avi Kivity 已提交
5290

5291
	.update_bp_intercept = update_bp_intercept,
A
Avi Kivity 已提交
5292 5293 5294 5295 5296
	.get_msr = svm_get_msr,
	.set_msr = svm_set_msr,
	.get_segment_base = svm_get_segment_base,
	.get_segment = svm_get_segment,
	.set_segment = svm_set_segment,
5297
	.get_cpl = svm_get_cpl,
5298
	.get_cs_db_l_bits = kvm_get_cs_db_l_bits,
5299
	.decache_cr0_guest_bits = svm_decache_cr0_guest_bits,
5300
	.decache_cr3 = svm_decache_cr3,
5301
	.decache_cr4_guest_bits = svm_decache_cr4_guest_bits,
A
Avi Kivity 已提交
5302 5303 5304 5305 5306 5307 5308 5309
	.set_cr0 = svm_set_cr0,
	.set_cr3 = svm_set_cr3,
	.set_cr4 = svm_set_cr4,
	.set_efer = svm_set_efer,
	.get_idt = svm_get_idt,
	.set_idt = svm_set_idt,
	.get_gdt = svm_get_gdt,
	.set_gdt = svm_set_gdt,
J
Jan Kiszka 已提交
5310 5311
	.get_dr6 = svm_get_dr6,
	.set_dr6 = svm_set_dr6,
5312
	.set_dr7 = svm_set_dr7,
5313
	.sync_dirty_debug_regs = svm_sync_dirty_debug_regs,
A
Avi Kivity 已提交
5314
	.cache_reg = svm_cache_reg,
A
Avi Kivity 已提交
5315 5316
	.get_rflags = svm_get_rflags,
	.set_rflags = svm_set_rflags,
5317 5318 5319

	.get_pkru = svm_get_pkru,

A
Avi Kivity 已提交
5320 5321 5322
	.tlb_flush = svm_flush_tlb,

	.run = svm_vcpu_run,
5323
	.handle_exit = handle_exit,
A
Avi Kivity 已提交
5324
	.skip_emulated_instruction = skip_emulated_instruction,
5325 5326
	.set_interrupt_shadow = svm_set_interrupt_shadow,
	.get_interrupt_shadow = svm_get_interrupt_shadow,
I
Ingo Molnar 已提交
5327
	.patch_hypercall = svm_patch_hypercall,
E
Eddie Dong 已提交
5328
	.set_irq = svm_set_irq,
5329
	.set_nmi = svm_inject_nmi,
5330
	.queue_exception = svm_queue_exception,
A
Avi Kivity 已提交
5331
	.cancel_injection = svm_cancel_injection,
5332
	.interrupt_allowed = svm_interrupt_allowed,
5333
	.nmi_allowed = svm_nmi_allowed,
J
Jan Kiszka 已提交
5334 5335
	.get_nmi_mask = svm_get_nmi_mask,
	.set_nmi_mask = svm_set_nmi_mask,
5336 5337 5338
	.enable_nmi_window = enable_nmi_window,
	.enable_irq_window = enable_irq_window,
	.update_cr8_intercept = update_cr8_intercept,
5339
	.set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode,
5340 5341
	.get_enable_apicv = svm_get_enable_apicv,
	.refresh_apicv_exec_ctrl = svm_refresh_apicv_exec_ctrl,
5342
	.load_eoi_exitmap = svm_load_eoi_exitmap,
5343 5344
	.hwapic_irr_update = svm_hwapic_irr_update,
	.hwapic_isr_update = svm_hwapic_isr_update,
5345
	.apicv_post_state_restore = avic_post_state_restore,
5346 5347

	.set_tss_addr = svm_set_tss_addr,
5348
	.get_tdp_level = get_npt_level,
5349
	.get_mt_mask = svm_get_mt_mask,
5350

5351 5352
	.get_exit_info = svm_get_exit_info,

5353
	.get_lpage_level = svm_get_lpage_level,
5354 5355

	.cpuid_update = svm_cpuid_update,
5356 5357

	.rdtscp_supported = svm_rdtscp_supported,
5358
	.invpcid_supported = svm_invpcid_supported,
5359
	.mpx_supported = svm_mpx_supported,
5360
	.xsaves_supported = svm_xsaves_supported,
5361 5362

	.set_supported_cpuid = svm_set_supported_cpuid,
5363 5364

	.has_wbinvd_exit = svm_has_wbinvd_exit,
5365 5366

	.write_tsc_offset = svm_write_tsc_offset,
5367 5368

	.set_tdp_cr3 = set_tdp_cr3,
5369 5370

	.check_intercept = svm_check_intercept,
5371
	.handle_external_intr = svm_handle_external_intr,
5372 5373

	.sched_in = svm_sched_in,
5374 5375

	.pmu_ops = &amd_pmu_ops,
5376
	.deliver_posted_interrupt = svm_deliver_avic_intr,
5377
	.update_pi_irte = svm_update_pi_irte,
5378
	.setup_mce = svm_setup_mce,
A
Avi Kivity 已提交
5379 5380 5381 5382
};

static int __init svm_init(void)
{
5383
	return kvm_init(&svm_x86_ops, sizeof(struct vcpu_svm),
5384
			__alignof__(struct vcpu_svm), THIS_MODULE);
A
Avi Kivity 已提交
5385 5386 5387 5388
}

static void __exit svm_exit(void)
{
5389
	kvm_exit();
A
Avi Kivity 已提交
5390 5391 5392 5393
}

module_init(svm_init)
module_exit(svm_exit)