svm.c 49.8 KB
Newer Older
A
Avi Kivity 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
/*
 * Kernel-based Virtual Machine driver for Linux
 *
 * AMD SVM support
 *
 * Copyright (C) 2006 Qumranet, Inc.
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
16 17
#include <linux/kvm_host.h>

A
Avi Kivity 已提交
18
#include "kvm_svm.h"
19
#include "irq.h"
20
#include "mmu.h"
21
#include "kvm_cache_regs.h"
A
Avi Kivity 已提交
22

A
Avi Kivity 已提交
23
#include <linux/module.h>
24
#include <linux/kernel.h>
A
Avi Kivity 已提交
25 26
#include <linux/vmalloc.h>
#include <linux/highmem.h>
A
Alexey Dobriyan 已提交
27
#include <linux/sched.h>
A
Avi Kivity 已提交
28

A
Avi Kivity 已提交
29
#include <asm/desc.h>
A
Avi Kivity 已提交
30

31 32
#define __ex(x) __kvm_handle_fault_on_reboot(x)

A
Avi Kivity 已提交
33 34 35 36 37 38 39 40 41 42 43 44
MODULE_AUTHOR("Qumranet");
MODULE_LICENSE("GPL");

#define IOPM_ALLOC_ORDER 2
#define MSRPM_ALLOC_ORDER 1

#define DR7_GD_MASK (1 << 13)
#define DR6_BD_MASK (1 << 13)

#define SEG_TYPE_LDT 2
#define SEG_TYPE_BUSY_TSS16 3

45 46
#define SVM_FEATURE_NPT  (1 << 0)
#define SVM_FEATURE_LBRV (1 << 1)
A
Amit Shah 已提交
47
#define SVM_FEATURE_SVML (1 << 2)
48

49 50
#define DEBUGCTL_RESERVED_BITS (~(0x3fULL))

51 52 53 54
/* enable NPT for AMD64 and X86 with PAE */
#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
static bool npt_enabled = true;
#else
55
static bool npt_enabled = false;
56
#endif
57 58 59
static int npt = 1;

module_param(npt, int, S_IRUGO);
60

61
static void kvm_reput_irq(struct vcpu_svm *svm);
62
static void svm_flush_tlb(struct kvm_vcpu *vcpu);
63

64 65
static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
{
R
Rusty Russell 已提交
66
	return container_of(vcpu, struct vcpu_svm, vcpu);
67 68
}

69
static unsigned long iopm_base;
A
Avi Kivity 已提交
70 71 72 73 74 75 76 77 78 79 80 81 82

struct kvm_ldttss_desc {
	u16 limit0;
	u16 base0;
	unsigned base1 : 8, type : 5, dpl : 2, p : 1;
	unsigned limit1 : 4, zero0 : 3, g : 1, base2 : 8;
	u32 base3;
	u32 zero1;
} __attribute__((packed));

struct svm_cpu_data {
	int cpu;

A
Avi Kivity 已提交
83 84 85
	u64 asid_generation;
	u32 max_asid;
	u32 next_asid;
A
Avi Kivity 已提交
86 87 88 89 90 91
	struct kvm_ldttss_desc *tss_desc;

	struct page *save_area;
};

static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data);
92
static uint32_t svm_features;
A
Avi Kivity 已提交
93 94 95 96 97 98 99 100

struct svm_init_data {
	int cpu;
	int r;
};

static u32 msrpm_ranges[] = {0, 0xc0000000, 0xc0010000};

101
#define NUM_MSR_MAPS ARRAY_SIZE(msrpm_ranges)
A
Avi Kivity 已提交
102 103 104 105 106
#define MSRS_RANGE_SIZE 2048
#define MSRS_IN_RANGE (MSRS_RANGE_SIZE * 8 / 2)

#define MAX_INST_SIZE 15

107 108 109 110 111
static inline u32 svm_has(u32 feat)
{
	return svm_features & feat;
}

A
Avi Kivity 已提交
112 113
static inline u8 pop_irq(struct kvm_vcpu *vcpu)
{
114 115
	int word_index = __ffs(vcpu->arch.irq_summary);
	int bit_index = __ffs(vcpu->arch.irq_pending[word_index]);
A
Avi Kivity 已提交
116 117
	int irq = word_index * BITS_PER_LONG + bit_index;

118 119 120
	clear_bit(bit_index, &vcpu->arch.irq_pending[word_index]);
	if (!vcpu->arch.irq_pending[word_index])
		clear_bit(word_index, &vcpu->arch.irq_summary);
A
Avi Kivity 已提交
121 122 123 124 125
	return irq;
}

static inline void push_irq(struct kvm_vcpu *vcpu, u8 irq)
{
126 127
	set_bit(irq, vcpu->arch.irq_pending);
	set_bit(irq / BITS_PER_LONG, &vcpu->arch.irq_summary);
A
Avi Kivity 已提交
128 129 130 131
}

static inline void clgi(void)
{
132
	asm volatile (__ex(SVM_CLGI));
A
Avi Kivity 已提交
133 134 135 136
}

static inline void stgi(void)
{
137
	asm volatile (__ex(SVM_STGI));
A
Avi Kivity 已提交
138 139 140 141
}

static inline void invlpga(unsigned long addr, u32 asid)
{
142
	asm volatile (__ex(SVM_INVLPGA) :: "a"(addr), "c"(asid));
A
Avi Kivity 已提交
143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
}

static inline unsigned long kvm_read_cr2(void)
{
	unsigned long cr2;

	asm volatile ("mov %%cr2, %0" : "=r" (cr2));
	return cr2;
}

static inline void kvm_write_cr2(unsigned long val)
{
	asm volatile ("mov %0, %%cr2" :: "r" (val));
}

static inline unsigned long read_dr6(void)
{
	unsigned long dr6;

	asm volatile ("mov %%dr6, %0" : "=r" (dr6));
	return dr6;
}

static inline void write_dr6(unsigned long val)
{
	asm volatile ("mov %0, %%dr6" :: "r" (val));
}

static inline unsigned long read_dr7(void)
{
	unsigned long dr7;

	asm volatile ("mov %%dr7, %0" : "=r" (dr7));
	return dr7;
}

static inline void write_dr7(unsigned long val)
{
	asm volatile ("mov %0, %%dr7" :: "r" (val));
}

static inline void force_new_asid(struct kvm_vcpu *vcpu)
{
186
	to_svm(vcpu)->asid_generation--;
A
Avi Kivity 已提交
187 188 189 190 191 192 193 194 195
}

static inline void flush_guest_tlb(struct kvm_vcpu *vcpu)
{
	force_new_asid(vcpu);
}

static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
{
196
	if (!npt_enabled && !(efer & EFER_LMA))
197
		efer &= ~EFER_LME;
A
Avi Kivity 已提交
198

199
	to_svm(vcpu)->vmcb->save.efer = efer | MSR_EFER_SVME_MASK;
200
	vcpu->arch.shadow_efer = efer;
A
Avi Kivity 已提交
201 202
}

203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
static void svm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
				bool has_error_code, u32 error_code)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.event_inj = nr
		| SVM_EVTINJ_VALID
		| (has_error_code ? SVM_EVTINJ_VALID_ERR : 0)
		| SVM_EVTINJ_TYPE_EXEPT;
	svm->vmcb->control.event_inj_err = error_code;
}

static bool svm_exception_injected(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	return !(svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_VALID);
}

A
Avi Kivity 已提交
222 223 224 225 226 227 228 229
static int is_external_interrupt(u32 info)
{
	info &= SVM_EVTINJ_TYPE_MASK | SVM_EVTINJ_VALID;
	return info == (SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR);
}

static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
{
230 231 232
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!svm->next_rip) {
233
		printk(KERN_DEBUG "%s: NOP\n", __func__);
A
Avi Kivity 已提交
234 235
		return;
	}
236 237 238
	if (svm->next_rip - kvm_rip_read(vcpu) > MAX_INST_SIZE)
		printk(KERN_ERR "%s: ip 0x%lx next 0x%llx\n",
		       __func__, kvm_rip_read(vcpu), svm->next_rip);
A
Avi Kivity 已提交
239

240
	kvm_rip_write(vcpu, svm->next_rip);
241
	svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
242

243
	vcpu->arch.interrupt_window_open = 1;
A
Avi Kivity 已提交
244 245 246 247 248 249
}

static int has_svm(void)
{
	uint32_t eax, ebx, ecx, edx;

250
	if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
A
Avi Kivity 已提交
251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270
		printk(KERN_INFO "has_svm: not amd\n");
		return 0;
	}

	cpuid(0x80000000, &eax, &ebx, &ecx, &edx);
	if (eax < SVM_CPUID_FUNC) {
		printk(KERN_INFO "has_svm: can't execute cpuid_8000000a\n");
		return 0;
	}

	cpuid(0x80000001, &eax, &ebx, &ecx, &edx);
	if (!(ecx & (1 << SVM_CPUID_FEATURE_SHIFT))) {
		printk(KERN_DEBUG "has_svm: svm not available\n");
		return 0;
	}
	return 1;
}

static void svm_hardware_disable(void *garbage)
{
271
	uint64_t efer;
A
Avi Kivity 已提交
272

273 274 275
	wrmsrl(MSR_VM_HSAVE_PA, 0);
	rdmsrl(MSR_EFER, efer);
	wrmsrl(MSR_EFER, efer & ~MSR_EFER_SVME_MASK);
A
Avi Kivity 已提交
276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302
}

static void svm_hardware_enable(void *garbage)
{

	struct svm_cpu_data *svm_data;
	uint64_t efer;
	struct desc_ptr gdt_descr;
	struct desc_struct *gdt;
	int me = raw_smp_processor_id();

	if (!has_svm()) {
		printk(KERN_ERR "svm_cpu_init: err EOPNOTSUPP on %d\n", me);
		return;
	}
	svm_data = per_cpu(svm_data, me);

	if (!svm_data) {
		printk(KERN_ERR "svm_cpu_init: svm_data is NULL on %d\n",
		       me);
		return;
	}

	svm_data->asid_generation = 1;
	svm_data->max_asid = cpuid_ebx(SVM_CPUID_FUNC) - 1;
	svm_data->next_asid = svm_data->max_asid + 1;

M
Mike Day 已提交
303
	asm volatile ("sgdt %0" : "=m"(gdt_descr));
A
Avi Kivity 已提交
304 305 306 307 308 309 310 311 312 313
	gdt = (struct desc_struct *)gdt_descr.address;
	svm_data->tss_desc = (struct kvm_ldttss_desc *)(gdt + GDT_ENTRY_TSS);

	rdmsrl(MSR_EFER, efer);
	wrmsrl(MSR_EFER, efer | MSR_EFER_SVME_MASK);

	wrmsrl(MSR_VM_HSAVE_PA,
	       page_to_pfn(svm_data->save_area) << PAGE_SHIFT);
}

314 315 316 317 318 319 320 321 322 323 324 325 326
static void svm_cpu_uninit(int cpu)
{
	struct svm_cpu_data *svm_data
		= per_cpu(svm_data, raw_smp_processor_id());

	if (!svm_data)
		return;

	per_cpu(svm_data, raw_smp_processor_id()) = NULL;
	__free_page(svm_data->save_area);
	kfree(svm_data);
}

A
Avi Kivity 已提交
327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350
static int svm_cpu_init(int cpu)
{
	struct svm_cpu_data *svm_data;
	int r;

	svm_data = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL);
	if (!svm_data)
		return -ENOMEM;
	svm_data->cpu = cpu;
	svm_data->save_area = alloc_page(GFP_KERNEL);
	r = -ENOMEM;
	if (!svm_data->save_area)
		goto err_1;

	per_cpu(svm_data, cpu) = svm_data;

	return 0;

err_1:
	kfree(svm_data);
	return r;

}

351 352
static void set_msr_interception(u32 *msrpm, unsigned msr,
				 int read, int write)
A
Avi Kivity 已提交
353 354 355 356 357 358 359 360 361 362 363 364 365 366
{
	int i;

	for (i = 0; i < NUM_MSR_MAPS; i++) {
		if (msr >= msrpm_ranges[i] &&
		    msr < msrpm_ranges[i] + MSRS_IN_RANGE) {
			u32 msr_offset = (i * MSRS_IN_RANGE + msr -
					  msrpm_ranges[i]) * 2;

			u32 *base = msrpm + (msr_offset / 32);
			u32 msr_shift = msr_offset % 32;
			u32 mask = ((write) ? 0 : 2) | ((read) ? 0 : 1);
			*base = (*base & ~(0x3 << msr_shift)) |
				(mask << msr_shift);
367
			return;
A
Avi Kivity 已提交
368 369
		}
	}
370
	BUG();
A
Avi Kivity 已提交
371 372
}

373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390
static void svm_vcpu_init_msrpm(u32 *msrpm)
{
	memset(msrpm, 0xff, PAGE_SIZE * (1 << MSRPM_ALLOC_ORDER));

#ifdef CONFIG_X86_64
	set_msr_interception(msrpm, MSR_GS_BASE, 1, 1);
	set_msr_interception(msrpm, MSR_FS_BASE, 1, 1);
	set_msr_interception(msrpm, MSR_KERNEL_GS_BASE, 1, 1);
	set_msr_interception(msrpm, MSR_LSTAR, 1, 1);
	set_msr_interception(msrpm, MSR_CSTAR, 1, 1);
	set_msr_interception(msrpm, MSR_SYSCALL_MASK, 1, 1);
#endif
	set_msr_interception(msrpm, MSR_K6_STAR, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_SYSENTER_CS, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_SYSENTER_ESP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_SYSENTER_EIP, 1, 1);
}

391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412
static void svm_enable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 1;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
}

static void svm_disable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 0;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
}

A
Avi Kivity 已提交
413 414 415 416
static __init int svm_hardware_setup(void)
{
	int cpu;
	struct page *iopm_pages;
417
	void *iopm_va;
A
Avi Kivity 已提交
418 419 420 421 422 423
	int r;

	iopm_pages = alloc_pages(GFP_KERNEL, IOPM_ALLOC_ORDER);

	if (!iopm_pages)
		return -ENOMEM;
424 425 426 427

	iopm_va = page_address(iopm_pages);
	memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
	clear_bit(0x80, iopm_va); /* allow direct access to PC debug port */
A
Avi Kivity 已提交
428 429
	iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;

430 431 432
	if (boot_cpu_has(X86_FEATURE_NX))
		kvm_enable_efer_bits(EFER_NX);

A
Avi Kivity 已提交
433 434 435
	for_each_online_cpu(cpu) {
		r = svm_cpu_init(cpu);
		if (r)
436
			goto err;
A
Avi Kivity 已提交
437
	}
438 439 440

	svm_features = cpuid_edx(SVM_CPUID_FUNC);

441 442 443
	if (!svm_has(SVM_FEATURE_NPT))
		npt_enabled = false;

444 445 446 447 448
	if (npt_enabled && !npt) {
		printk(KERN_INFO "kvm: Nested Paging disabled\n");
		npt_enabled = false;
	}

449
	if (npt_enabled) {
450
		printk(KERN_INFO "kvm: Nested Paging enabled\n");
451
		kvm_enable_tdp();
452 453
	} else
		kvm_disable_tdp();
454

A
Avi Kivity 已提交
455 456
	return 0;

457
err:
A
Avi Kivity 已提交
458 459 460 461 462 463 464
	__free_pages(iopm_pages, IOPM_ALLOC_ORDER);
	iopm_base = 0;
	return r;
}

static __exit void svm_hardware_unsetup(void)
{
465 466 467 468 469
	int cpu;

	for_each_online_cpu(cpu)
		svm_cpu_uninit(cpu);

A
Avi Kivity 已提交
470
	__free_pages(pfn_to_page(iopm_base >> PAGE_SHIFT), IOPM_ALLOC_ORDER);
471
	iopm_base = 0;
A
Avi Kivity 已提交
472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490
}

static void init_seg(struct vmcb_seg *seg)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | SVM_SELECTOR_S_MASK |
		SVM_SELECTOR_WRITE_MASK; /* Read/Write Data Segment */
	seg->limit = 0xffff;
	seg->base = 0;
}

static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | type;
	seg->limit = 0xffff;
	seg->base = 0;
}

491
static void init_vmcb(struct vcpu_svm *svm)
A
Avi Kivity 已提交
492
{
493 494
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;
A
Avi Kivity 已提交
495 496 497

	control->intercept_cr_read = 	INTERCEPT_CR0_MASK |
					INTERCEPT_CR3_MASK |
498
					INTERCEPT_CR4_MASK;
A
Avi Kivity 已提交
499 500 501

	control->intercept_cr_write = 	INTERCEPT_CR0_MASK |
					INTERCEPT_CR3_MASK |
502 503
					INTERCEPT_CR4_MASK |
					INTERCEPT_CR8_MASK;
A
Avi Kivity 已提交
504 505 506 507 508 509 510 511 512 513 514 515 516

	control->intercept_dr_read = 	INTERCEPT_DR0_MASK |
					INTERCEPT_DR1_MASK |
					INTERCEPT_DR2_MASK |
					INTERCEPT_DR3_MASK;

	control->intercept_dr_write = 	INTERCEPT_DR0_MASK |
					INTERCEPT_DR1_MASK |
					INTERCEPT_DR2_MASK |
					INTERCEPT_DR3_MASK |
					INTERCEPT_DR5_MASK |
					INTERCEPT_DR7_MASK;

517
	control->intercept_exceptions = (1 << PF_VECTOR) |
518 519
					(1 << UD_VECTOR) |
					(1 << MC_VECTOR);
A
Avi Kivity 已提交
520 521 522 523


	control->intercept = 	(1ULL << INTERCEPT_INTR) |
				(1ULL << INTERCEPT_NMI) |
524
				(1ULL << INTERCEPT_SMI) |
A
Avi Kivity 已提交
525
				(1ULL << INTERCEPT_CPUID) |
526
				(1ULL << INTERCEPT_INVD) |
A
Avi Kivity 已提交
527
				(1ULL << INTERCEPT_HLT) |
M
Marcelo Tosatti 已提交
528
				(1ULL << INTERCEPT_INVLPG) |
A
Avi Kivity 已提交
529 530 531 532
				(1ULL << INTERCEPT_INVLPGA) |
				(1ULL << INTERCEPT_IOIO_PROT) |
				(1ULL << INTERCEPT_MSR_PROT) |
				(1ULL << INTERCEPT_TASK_SWITCH) |
533
				(1ULL << INTERCEPT_SHUTDOWN) |
A
Avi Kivity 已提交
534 535 536 537 538 539
				(1ULL << INTERCEPT_VMRUN) |
				(1ULL << INTERCEPT_VMMCALL) |
				(1ULL << INTERCEPT_VMLOAD) |
				(1ULL << INTERCEPT_VMSAVE) |
				(1ULL << INTERCEPT_STGI) |
				(1ULL << INTERCEPT_CLGI) |
540
				(1ULL << INTERCEPT_SKINIT) |
541
				(1ULL << INTERCEPT_WBINVD) |
542 543
				(1ULL << INTERCEPT_MONITOR) |
				(1ULL << INTERCEPT_MWAIT);
A
Avi Kivity 已提交
544 545

	control->iopm_base_pa = iopm_base;
546
	control->msrpm_base_pa = __pa(svm->msrpm);
547
	control->tsc_offset = 0;
A
Avi Kivity 已提交
548 549 550 551 552 553 554 555 556 557 558 559 560
	control->int_ctl = V_INTR_MASKING_MASK;

	init_seg(&save->es);
	init_seg(&save->ss);
	init_seg(&save->ds);
	init_seg(&save->fs);
	init_seg(&save->gs);

	save->cs.selector = 0xf000;
	/* Executable/Readable Code Segment */
	save->cs.attrib = SVM_SELECTOR_READ_MASK | SVM_SELECTOR_P_MASK |
		SVM_SELECTOR_S_MASK | SVM_SELECTOR_CODE_MASK;
	save->cs.limit = 0xffff;
561 562 563 564 565 566 567
	/*
	 * cs.base should really be 0xffff0000, but vmx can't handle that, so
	 * be consistent with it.
	 *
	 * Replace when we have real mode working for vmx.
	 */
	save->cs.base = 0xf0000;
A
Avi Kivity 已提交
568 569 570 571 572 573 574 575

	save->gdtr.limit = 0xffff;
	save->idtr.limit = 0xffff;

	init_sys_seg(&save->ldtr, SEG_TYPE_LDT);
	init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16);

	save->efer = MSR_EFER_SVME_MASK;
M
Mike Day 已提交
576
	save->dr6 = 0xffff0ff0;
A
Avi Kivity 已提交
577 578 579
	save->dr7 = 0x400;
	save->rflags = 2;
	save->rip = 0x0000fff0;
580
	svm->vcpu.arch.regs[VCPU_REGS_RIP] = save->rip;
A
Avi Kivity 已提交
581 582 583 584 585

	/*
	 * cr0 val on cpu init should be 0x60000010, we enable cpu
	 * cache by default. the orderly way is to enable cache in bios.
	 */
586
	save->cr0 = 0x00000010 | X86_CR0_PG | X86_CR0_WP;
587
	save->cr4 = X86_CR4_PAE;
A
Avi Kivity 已提交
588
	/* rdx = ?? */
589 590 591 592

	if (npt_enabled) {
		/* Setup VMCB for Nested Paging */
		control->nested_ctl = 1;
M
Marcelo Tosatti 已提交
593 594
		control->intercept &= ~((1ULL << INTERCEPT_TASK_SWITCH) |
					(1ULL << INTERCEPT_INVLPG));
595 596 597 598 599 600 601 602 603 604 605
		control->intercept_exceptions &= ~(1 << PF_VECTOR);
		control->intercept_cr_read &= ~(INTERCEPT_CR0_MASK|
						INTERCEPT_CR3_MASK);
		control->intercept_cr_write &= ~(INTERCEPT_CR0_MASK|
						 INTERCEPT_CR3_MASK);
		save->g_pat = 0x0007040600070406ULL;
		/* enable caching because the QEMU Bios doesn't enable it */
		save->cr0 = X86_CR0_ET;
		save->cr3 = 0;
		save->cr4 = 0;
	}
606
	force_new_asid(&svm->vcpu);
A
Avi Kivity 已提交
607 608
}

609
static int svm_vcpu_reset(struct kvm_vcpu *vcpu)
610 611 612
{
	struct vcpu_svm *svm = to_svm(vcpu);

613
	init_vmcb(svm);
A
Avi Kivity 已提交
614 615

	if (vcpu->vcpu_id != 0) {
616
		kvm_rip_write(vcpu, 0);
617 618
		svm->vmcb->save.cs.base = svm->vcpu.arch.sipi_vector << 12;
		svm->vmcb->save.cs.selector = svm->vcpu.arch.sipi_vector << 8;
A
Avi Kivity 已提交
619
	}
620 621
	vcpu->arch.regs_avail = ~0;
	vcpu->arch.regs_dirty = ~0;
622 623

	return 0;
624 625
}

R
Rusty Russell 已提交
626
static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
A
Avi Kivity 已提交
627
{
628
	struct vcpu_svm *svm;
A
Avi Kivity 已提交
629
	struct page *page;
630
	struct page *msrpm_pages;
R
Rusty Russell 已提交
631
	int err;
A
Avi Kivity 已提交
632

633
	svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
R
Rusty Russell 已提交
634 635 636 637 638 639 640 641 642
	if (!svm) {
		err = -ENOMEM;
		goto out;
	}

	err = kvm_vcpu_init(&svm->vcpu, kvm, id);
	if (err)
		goto free_svm;

A
Avi Kivity 已提交
643
	page = alloc_page(GFP_KERNEL);
R
Rusty Russell 已提交
644 645 646 647
	if (!page) {
		err = -ENOMEM;
		goto uninit;
	}
A
Avi Kivity 已提交
648

649 650 651 652 653 654 655
	err = -ENOMEM;
	msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
	if (!msrpm_pages)
		goto uninit;
	svm->msrpm = page_address(msrpm_pages);
	svm_vcpu_init_msrpm(svm->msrpm);

656 657 658 659 660
	svm->vmcb = page_address(page);
	clear_page(svm->vmcb);
	svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
	svm->asid_generation = 0;
	memset(svm->db_regs, 0, sizeof(svm->db_regs));
661
	init_vmcb(svm);
662

R
Rusty Russell 已提交
663 664
	fx_init(&svm->vcpu);
	svm->vcpu.fpu_active = 1;
665
	svm->vcpu.arch.apic_base = 0xfee00000 | MSR_IA32_APICBASE_ENABLE;
R
Rusty Russell 已提交
666
	if (svm->vcpu.vcpu_id == 0)
667
		svm->vcpu.arch.apic_base |= MSR_IA32_APICBASE_BSP;
A
Avi Kivity 已提交
668

R
Rusty Russell 已提交
669
	return &svm->vcpu;
670

R
Rusty Russell 已提交
671 672 673
uninit:
	kvm_vcpu_uninit(&svm->vcpu);
free_svm:
674
	kmem_cache_free(kvm_vcpu_cache, svm);
R
Rusty Russell 已提交
675 676
out:
	return ERR_PTR(err);
A
Avi Kivity 已提交
677 678 679 680
}

static void svm_free_vcpu(struct kvm_vcpu *vcpu)
{
681 682
	struct vcpu_svm *svm = to_svm(vcpu);

R
Rusty Russell 已提交
683
	__free_page(pfn_to_page(svm->vmcb_pa >> PAGE_SHIFT));
684
	__free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
R
Rusty Russell 已提交
685
	kvm_vcpu_uninit(vcpu);
686
	kmem_cache_free(kvm_vcpu_cache, svm);
A
Avi Kivity 已提交
687 688
}

689
static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
A
Avi Kivity 已提交
690
{
691
	struct vcpu_svm *svm = to_svm(vcpu);
692
	int i;
693 694 695 696 697 698 699 700 701

	if (unlikely(cpu != vcpu->cpu)) {
		u64 tsc_this, delta;

		/*
		 * Make sure that the guest sees a monotonically
		 * increasing TSC.
		 */
		rdtscll(tsc_this);
702
		delta = vcpu->arch.host_tsc - tsc_this;
703
		svm->vmcb->control.tsc_offset += delta;
704
		vcpu->cpu = cpu;
M
Marcelo Tosatti 已提交
705
		kvm_migrate_timers(vcpu);
706
	}
707 708

	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
709
		rdmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
A
Avi Kivity 已提交
710 711 712 713
}

static void svm_vcpu_put(struct kvm_vcpu *vcpu)
{
714
	struct vcpu_svm *svm = to_svm(vcpu);
715 716
	int i;

717
	++vcpu->stat.host_state_reload;
718
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
719
		wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
720

721
	rdtscll(vcpu->arch.host_tsc);
A
Avi Kivity 已提交
722 723 724 725
}

static unsigned long svm_get_rflags(struct kvm_vcpu *vcpu)
{
726
	return to_svm(vcpu)->vmcb->save.rflags;
A
Avi Kivity 已提交
727 728 729 730
}

static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
{
731
	to_svm(vcpu)->vmcb->save.rflags = rflags;
A
Avi Kivity 已提交
732 733 734 735
}

static struct vmcb_seg *svm_seg(struct kvm_vcpu *vcpu, int seg)
{
736
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
A
Avi Kivity 已提交
737 738 739 740 741 742 743 744 745 746 747 748

	switch (seg) {
	case VCPU_SREG_CS: return &save->cs;
	case VCPU_SREG_DS: return &save->ds;
	case VCPU_SREG_ES: return &save->es;
	case VCPU_SREG_FS: return &save->fs;
	case VCPU_SREG_GS: return &save->gs;
	case VCPU_SREG_SS: return &save->ss;
	case VCPU_SREG_TR: return &save->tr;
	case VCPU_SREG_LDTR: return &save->ldtr;
	}
	BUG();
A
Al Viro 已提交
749
	return NULL;
A
Avi Kivity 已提交
750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774
}

static u64 svm_get_segment_base(struct kvm_vcpu *vcpu, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	return s->base;
}

static void svm_get_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	var->base = s->base;
	var->limit = s->limit;
	var->selector = s->selector;
	var->type = s->attrib & SVM_SELECTOR_TYPE_MASK;
	var->s = (s->attrib >> SVM_SELECTOR_S_SHIFT) & 1;
	var->dpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
	var->present = (s->attrib >> SVM_SELECTOR_P_SHIFT) & 1;
	var->avl = (s->attrib >> SVM_SELECTOR_AVL_SHIFT) & 1;
	var->l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
	var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
	var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
775 776 777 778 779 780 781 782 783

	/*
	 * SVM always stores 0 for the 'G' bit in the CS selector in
	 * the VMCB on a VMEXIT. This hurts cross-vendor migration:
	 * Intel's VMENTRY has a check on the 'G' bit.
	 */
	if (seg == VCPU_SREG_CS)
		var->g = s->limit > 0xfffff;

784 785 786 787 788 789 790
	/*
	 * Work around a bug where the busy flag in the tr selector
	 * isn't exposed
	 */
	if (seg == VCPU_SREG_TR)
		var->type |= 0x2;

A
Avi Kivity 已提交
791 792 793
	var->unusable = !var->present;
}

794 795 796 797 798 799 800
static int svm_get_cpl(struct kvm_vcpu *vcpu)
{
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;

	return save->cpl;
}

A
Avi Kivity 已提交
801 802
static void svm_get_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
803 804 805 806
	struct vcpu_svm *svm = to_svm(vcpu);

	dt->limit = svm->vmcb->save.idtr.limit;
	dt->base = svm->vmcb->save.idtr.base;
A
Avi Kivity 已提交
807 808 809 810
}

static void svm_set_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
811 812 813 814
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.idtr.limit = dt->limit;
	svm->vmcb->save.idtr.base = dt->base ;
A
Avi Kivity 已提交
815 816 817 818
}

static void svm_get_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
819 820 821 822
	struct vcpu_svm *svm = to_svm(vcpu);

	dt->limit = svm->vmcb->save.gdtr.limit;
	dt->base = svm->vmcb->save.gdtr.base;
A
Avi Kivity 已提交
823 824 825 826
}

static void svm_set_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
827 828 829 830
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.gdtr.limit = dt->limit;
	svm->vmcb->save.gdtr.base = dt->base ;
A
Avi Kivity 已提交
831 832
}

833
static void svm_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
834 835 836
{
}

A
Avi Kivity 已提交
837 838
static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
{
839 840
	struct vcpu_svm *svm = to_svm(vcpu);

841
#ifdef CONFIG_X86_64
842
	if (vcpu->arch.shadow_efer & EFER_LME) {
843
		if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
844
			vcpu->arch.shadow_efer |= EFER_LMA;
845
			svm->vmcb->save.efer |= EFER_LMA | EFER_LME;
A
Avi Kivity 已提交
846 847
		}

M
Mike Day 已提交
848
		if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) {
849
			vcpu->arch.shadow_efer &= ~EFER_LMA;
850
			svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME);
A
Avi Kivity 已提交
851 852 853
		}
	}
#endif
854 855 856
	if (npt_enabled)
		goto set;

857
	if ((vcpu->arch.cr0 & X86_CR0_TS) && !(cr0 & X86_CR0_TS)) {
858
		svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
A
Anthony Liguori 已提交
859 860 861
		vcpu->fpu_active = 1;
	}

862
	vcpu->arch.cr0 = cr0;
863
	cr0 |= X86_CR0_PG | X86_CR0_WP;
864 865
	if (!vcpu->fpu_active) {
		svm->vmcb->control.intercept_exceptions |= (1 << NM_VECTOR);
J
Joerg Roedel 已提交
866
		cr0 |= X86_CR0_TS;
867
	}
868 869 870 871 872 873 874
set:
	/*
	 * re-enable caching here because the QEMU bios
	 * does not do it - this results in some delay at
	 * reboot
	 */
	cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
875
	svm->vmcb->save.cr0 = cr0;
A
Avi Kivity 已提交
876 877 878 879
}

static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
{
880
	unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
881 882 883 884
	unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;

	if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
		force_new_asid(vcpu);
885

886 887 888
	vcpu->arch.cr4 = cr4;
	if (!npt_enabled)
		cr4 |= X86_CR4_PAE;
889
	cr4 |= host_cr4_mce;
890
	to_svm(vcpu)->vmcb->save.cr4 = cr4;
A
Avi Kivity 已提交
891 892 893 894 895
}

static void svm_set_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
896
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	s->base = var->base;
	s->limit = var->limit;
	s->selector = var->selector;
	if (var->unusable)
		s->attrib = 0;
	else {
		s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
		s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
		s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
		s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
		s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
		s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
		s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
		s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
	}
	if (seg == VCPU_SREG_CS)
915 916
		svm->vmcb->save.cpl
			= (svm->vmcb->save.cs.attrib
A
Avi Kivity 已提交
917 918 919 920 921 922 923 924 925
			   >> SVM_SELECTOR_DPL_SHIFT) & 3;

}

static int svm_guest_debug(struct kvm_vcpu *vcpu, struct kvm_debug_guest *dbg)
{
	return -EOPNOTSUPP;
}

E
Eddie Dong 已提交
926 927 928 929 930 931 932 933 934 935
static int svm_get_irq(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 exit_int_info = svm->vmcb->control.exit_int_info;

	if (is_external_interrupt(exit_int_info))
		return exit_int_info & SVM_EVTINJ_VEC_MASK;
	return -1;
}

A
Avi Kivity 已提交
936 937
static void load_host_msrs(struct kvm_vcpu *vcpu)
{
938
#ifdef CONFIG_X86_64
939
	wrmsrl(MSR_GS_BASE, to_svm(vcpu)->host_gs_base);
940
#endif
A
Avi Kivity 已提交
941 942 943 944
}

static void save_host_msrs(struct kvm_vcpu *vcpu)
{
945
#ifdef CONFIG_X86_64
946
	rdmsrl(MSR_GS_BASE, to_svm(vcpu)->host_gs_base);
947
#endif
A
Avi Kivity 已提交
948 949
}

R
Rusty Russell 已提交
950
static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *svm_data)
A
Avi Kivity 已提交
951 952 953 954
{
	if (svm_data->next_asid > svm_data->max_asid) {
		++svm_data->asid_generation;
		svm_data->next_asid = 1;
955
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
A
Avi Kivity 已提交
956 957
	}

R
Rusty Russell 已提交
958
	svm->vcpu.cpu = svm_data->cpu;
959 960
	svm->asid_generation = svm_data->asid_generation;
	svm->vmcb->control.asid = svm_data->next_asid++;
A
Avi Kivity 已提交
961 962 963 964
}

static unsigned long svm_get_dr(struct kvm_vcpu *vcpu, int dr)
{
965 966 967
	unsigned long val = to_svm(vcpu)->db_regs[dr];
	KVMTRACE_2D(DR_READ, vcpu, (u32)dr, (u32)val, handler);
	return val;
A
Avi Kivity 已提交
968 969 970 971 972
}

static void svm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long value,
		       int *exception)
{
973 974
	struct vcpu_svm *svm = to_svm(vcpu);

A
Avi Kivity 已提交
975 976
	*exception = 0;

977 978 979
	if (svm->vmcb->save.dr7 & DR7_GD_MASK) {
		svm->vmcb->save.dr7 &= ~DR7_GD_MASK;
		svm->vmcb->save.dr6 |= DR6_BD_MASK;
A
Avi Kivity 已提交
980 981 982 983 984 985
		*exception = DB_VECTOR;
		return;
	}

	switch (dr) {
	case 0 ... 3:
986
		svm->db_regs[dr] = value;
A
Avi Kivity 已提交
987 988
		return;
	case 4 ... 5:
989
		if (vcpu->arch.cr4 & X86_CR4_DE) {
A
Avi Kivity 已提交
990 991 992 993 994 995 996 997
			*exception = UD_VECTOR;
			return;
		}
	case 7: {
		if (value & ~((1ULL << 32) - 1)) {
			*exception = GP_VECTOR;
			return;
		}
998
		svm->vmcb->save.dr7 = value;
A
Avi Kivity 已提交
999 1000 1001 1002
		return;
	}
	default:
		printk(KERN_DEBUG "%s: unexpected dr %u\n",
1003
		       __func__, dr);
A
Avi Kivity 已提交
1004 1005 1006 1007 1008
		*exception = UD_VECTOR;
		return;
	}
}

R
Rusty Russell 已提交
1009
static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1010
{
1011
	u32 exit_int_info = svm->vmcb->control.exit_int_info;
R
Rusty Russell 已提交
1012
	struct kvm *kvm = svm->vcpu.kvm;
A
Avi Kivity 已提交
1013 1014
	u64 fault_address;
	u32 error_code;
1015
	bool event_injection = false;
A
Avi Kivity 已提交
1016

1017
	if (!irqchip_in_kernel(kvm) &&
1018 1019
	    is_external_interrupt(exit_int_info)) {
		event_injection = true;
R
Rusty Russell 已提交
1020
		push_irq(&svm->vcpu, exit_int_info & SVM_EVTINJ_VEC_MASK);
1021
	}
A
Avi Kivity 已提交
1022

1023 1024
	fault_address  = svm->vmcb->control.exit_info_2;
	error_code = svm->vmcb->control.exit_info_1;
1025 1026 1027 1028 1029

	if (!npt_enabled)
		KVMTRACE_3D(PAGE_FAULT, &svm->vcpu, error_code,
			    (u32)fault_address, (u32)(fault_address >> 32),
			    handler);
1030 1031 1032 1033
	else
		KVMTRACE_3D(TDP_FAULT, &svm->vcpu, error_code,
			    (u32)fault_address, (u32)(fault_address >> 32),
			    handler);
1034 1035 1036 1037 1038 1039 1040
	/*
	 * FIXME: Tis shouldn't be necessary here, but there is a flush
	 * missing in the MMU code. Until we find this bug, flush the
	 * complete TLB here on an NPF
	 */
	if (npt_enabled)
		svm_flush_tlb(&svm->vcpu);
1041

1042
	if (!npt_enabled && event_injection)
1043
		kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
1044
	return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
A
Avi Kivity 已提交
1045 1046
}

1047 1048 1049 1050
static int ud_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	int er;

1051
	er = emulate_instruction(&svm->vcpu, kvm_run, 0, 0, EMULTYPE_TRAP_UD);
1052
	if (er != EMULATE_DONE)
1053
		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
1054 1055 1056
	return 1;
}

R
Rusty Russell 已提交
1057
static int nm_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Anthony Liguori 已提交
1058
{
1059
	svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
1060
	if (!(svm->vcpu.arch.cr0 & X86_CR0_TS))
1061
		svm->vmcb->save.cr0 &= ~X86_CR0_TS;
R
Rusty Russell 已提交
1062
	svm->vcpu.fpu_active = 1;
1063 1064

	return 1;
A
Anthony Liguori 已提交
1065 1066
}

1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079
static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	/*
	 * On an #MC intercept the MCE handler is not called automatically in
	 * the host. So do it by hand here.
	 */
	asm volatile (
		"int $0x12\n");
	/* not sure if we ever come back to this point */

	return 1;
}

R
Rusty Russell 已提交
1080
static int shutdown_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
1081 1082 1083 1084 1085
{
	/*
	 * VMCB is undefined after a SHUTDOWN intercept
	 * so reinitialize it.
	 */
1086
	clear_page(svm->vmcb);
1087
	init_vmcb(svm);
1088 1089 1090 1091 1092

	kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
	return 0;
}

R
Rusty Russell 已提交
1093
static int io_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1094
{
M
Mike Day 已提交
1095
	u32 io_info = svm->vmcb->control.exit_info_1; /* address size bug? */
1096 1097
	int size, down, in, string, rep;
	unsigned port;
A
Avi Kivity 已提交
1098

R
Rusty Russell 已提交
1099
	++svm->vcpu.stat.io_exits;
A
Avi Kivity 已提交
1100

1101
	svm->next_rip = svm->vmcb->control.exit_info_2;
A
Avi Kivity 已提交
1102

1103 1104 1105
	string = (io_info & SVM_IOIO_STR_MASK) != 0;

	if (string) {
1106 1107
		if (emulate_instruction(&svm->vcpu,
					kvm_run, 0, 0, 0) == EMULATE_DO_MMIO)
1108 1109 1110 1111
			return 0;
		return 1;
	}

1112 1113 1114 1115
	in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
	port = io_info >> 16;
	size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
	rep = (io_info & SVM_IOIO_REP_MASK) != 0;
1116
	down = (svm->vmcb->save.rflags & X86_EFLAGS_DF) != 0;
A
Avi Kivity 已提交
1117

1118
	skip_emulated_instruction(&svm->vcpu);
L
Laurent Vivier 已提交
1119
	return kvm_emulate_pio(&svm->vcpu, kvm_run, in, size, port);
A
Avi Kivity 已提交
1120 1121
}

1122 1123
static int nmi_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
1124
	KVMTRACE_0D(NMI, &svm->vcpu, handler);
1125 1126 1127
	return 1;
}

1128 1129 1130
static int intr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	++svm->vcpu.stat.irq_exits;
1131
	KVMTRACE_0D(INTR, &svm->vcpu, handler);
1132 1133 1134
	return 1;
}

R
Rusty Russell 已提交
1135
static int nop_on_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1136 1137 1138 1139
{
	return 1;
}

R
Rusty Russell 已提交
1140
static int halt_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1141
{
1142
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 1;
R
Rusty Russell 已提交
1143 1144
	skip_emulated_instruction(&svm->vcpu);
	return kvm_emulate_halt(&svm->vcpu);
A
Avi Kivity 已提交
1145 1146
}

R
Rusty Russell 已提交
1147
static int vmmcall_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
1148
{
1149
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
R
Rusty Russell 已提交
1150
	skip_emulated_instruction(&svm->vcpu);
1151 1152
	kvm_emulate_hypercall(&svm->vcpu);
	return 1;
1153 1154
}

R
Rusty Russell 已提交
1155 1156
static int invalid_op_interception(struct vcpu_svm *svm,
				   struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1157
{
1158
	kvm_queue_exception(&svm->vcpu, UD_VECTOR);
A
Avi Kivity 已提交
1159 1160 1161
	return 1;
}

R
Rusty Russell 已提交
1162 1163
static int task_switch_interception(struct vcpu_svm *svm,
				    struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1164
{
1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176
	u16 tss_selector;

	tss_selector = (u16)svm->vmcb->control.exit_info_1;
	if (svm->vmcb->control.exit_info_2 &
	    (1ULL << SVM_EXITINFOSHIFT_TS_REASON_IRET))
		return kvm_task_switch(&svm->vcpu, tss_selector,
				       TASK_SWITCH_IRET);
	if (svm->vmcb->control.exit_info_2 &
	    (1ULL << SVM_EXITINFOSHIFT_TS_REASON_JMP))
		return kvm_task_switch(&svm->vcpu, tss_selector,
				       TASK_SWITCH_JMP);
	return kvm_task_switch(&svm->vcpu, tss_selector, TASK_SWITCH_CALL);
A
Avi Kivity 已提交
1177 1178
}

R
Rusty Russell 已提交
1179
static int cpuid_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1180
{
1181
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
1182
	kvm_emulate_cpuid(&svm->vcpu);
1183
	return 1;
A
Avi Kivity 已提交
1184 1185
}

M
Marcelo Tosatti 已提交
1186 1187 1188 1189 1190 1191 1192
static int invlpg_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	if (emulate_instruction(&svm->vcpu, kvm_run, 0, 0, 0) != EMULATE_DONE)
		pr_unimpl(&svm->vcpu, "%s: failed\n", __func__);
	return 1;
}

R
Rusty Russell 已提交
1193 1194
static int emulate_on_interception(struct vcpu_svm *svm,
				   struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1195
{
1196
	if (emulate_instruction(&svm->vcpu, NULL, 0, 0, 0) != EMULATE_DONE)
1197
		pr_unimpl(&svm->vcpu, "%s: failed\n", __func__);
A
Avi Kivity 已提交
1198 1199 1200
	return 1;
}

1201 1202 1203 1204 1205 1206 1207 1208 1209
static int cr8_write_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	emulate_instruction(&svm->vcpu, NULL, 0, 0, 0);
	if (irqchip_in_kernel(svm->vcpu.kvm))
		return 1;
	kvm_run->exit_reason = KVM_EXIT_SET_TPR;
	return 0;
}

A
Avi Kivity 已提交
1210 1211
static int svm_get_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 *data)
{
1212 1213
	struct vcpu_svm *svm = to_svm(vcpu);

A
Avi Kivity 已提交
1214 1215 1216 1217 1218
	switch (ecx) {
	case MSR_IA32_TIME_STAMP_COUNTER: {
		u64 tsc;

		rdtscll(tsc);
1219
		*data = svm->vmcb->control.tsc_offset + tsc;
A
Avi Kivity 已提交
1220 1221
		break;
	}
1222
	case MSR_K6_STAR:
1223
		*data = svm->vmcb->save.star;
A
Avi Kivity 已提交
1224
		break;
1225
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
1226
	case MSR_LSTAR:
1227
		*data = svm->vmcb->save.lstar;
A
Avi Kivity 已提交
1228 1229
		break;
	case MSR_CSTAR:
1230
		*data = svm->vmcb->save.cstar;
A
Avi Kivity 已提交
1231 1232
		break;
	case MSR_KERNEL_GS_BASE:
1233
		*data = svm->vmcb->save.kernel_gs_base;
A
Avi Kivity 已提交
1234 1235
		break;
	case MSR_SYSCALL_MASK:
1236
		*data = svm->vmcb->save.sfmask;
A
Avi Kivity 已提交
1237 1238 1239
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
1240
		*data = svm->vmcb->save.sysenter_cs;
A
Avi Kivity 已提交
1241 1242
		break;
	case MSR_IA32_SYSENTER_EIP:
1243
		*data = svm->vmcb->save.sysenter_eip;
A
Avi Kivity 已提交
1244 1245
		break;
	case MSR_IA32_SYSENTER_ESP:
1246
		*data = svm->vmcb->save.sysenter_esp;
A
Avi Kivity 已提交
1247
		break;
1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265
	/* Nobody will change the following 5 values in the VMCB so
	   we can safely return them on rdmsr. They will always be 0
	   until LBRV is implemented. */
	case MSR_IA32_DEBUGCTLMSR:
		*data = svm->vmcb->save.dbgctl;
		break;
	case MSR_IA32_LASTBRANCHFROMIP:
		*data = svm->vmcb->save.br_from;
		break;
	case MSR_IA32_LASTBRANCHTOIP:
		*data = svm->vmcb->save.br_to;
		break;
	case MSR_IA32_LASTINTFROMIP:
		*data = svm->vmcb->save.last_excp_from;
		break;
	case MSR_IA32_LASTINTTOIP:
		*data = svm->vmcb->save.last_excp_to;
		break;
A
Avi Kivity 已提交
1266
	default:
1267
		return kvm_get_msr_common(vcpu, ecx, data);
A
Avi Kivity 已提交
1268 1269 1270 1271
	}
	return 0;
}

R
Rusty Russell 已提交
1272
static int rdmsr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1273
{
1274
	u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
A
Avi Kivity 已提交
1275 1276
	u64 data;

R
Rusty Russell 已提交
1277
	if (svm_get_msr(&svm->vcpu, ecx, &data))
1278
		kvm_inject_gp(&svm->vcpu, 0);
A
Avi Kivity 已提交
1279
	else {
1280 1281 1282
		KVMTRACE_3D(MSR_READ, &svm->vcpu, ecx, (u32)data,
			    (u32)(data >> 32), handler);

1283
		svm->vcpu.arch.regs[VCPU_REGS_RAX] = data & 0xffffffff;
1284
		svm->vcpu.arch.regs[VCPU_REGS_RDX] = data >> 32;
1285
		svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
1286
		skip_emulated_instruction(&svm->vcpu);
A
Avi Kivity 已提交
1287 1288 1289 1290 1291 1292
	}
	return 1;
}

static int svm_set_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 data)
{
1293 1294
	struct vcpu_svm *svm = to_svm(vcpu);

A
Avi Kivity 已提交
1295 1296 1297 1298 1299
	switch (ecx) {
	case MSR_IA32_TIME_STAMP_COUNTER: {
		u64 tsc;

		rdtscll(tsc);
1300
		svm->vmcb->control.tsc_offset = data - tsc;
A
Avi Kivity 已提交
1301 1302
		break;
	}
1303
	case MSR_K6_STAR:
1304
		svm->vmcb->save.star = data;
A
Avi Kivity 已提交
1305
		break;
1306
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
1307
	case MSR_LSTAR:
1308
		svm->vmcb->save.lstar = data;
A
Avi Kivity 已提交
1309 1310
		break;
	case MSR_CSTAR:
1311
		svm->vmcb->save.cstar = data;
A
Avi Kivity 已提交
1312 1313
		break;
	case MSR_KERNEL_GS_BASE:
1314
		svm->vmcb->save.kernel_gs_base = data;
A
Avi Kivity 已提交
1315 1316
		break;
	case MSR_SYSCALL_MASK:
1317
		svm->vmcb->save.sfmask = data;
A
Avi Kivity 已提交
1318 1319 1320
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
1321
		svm->vmcb->save.sysenter_cs = data;
A
Avi Kivity 已提交
1322 1323
		break;
	case MSR_IA32_SYSENTER_EIP:
1324
		svm->vmcb->save.sysenter_eip = data;
A
Avi Kivity 已提交
1325 1326
		break;
	case MSR_IA32_SYSENTER_ESP:
1327
		svm->vmcb->save.sysenter_esp = data;
A
Avi Kivity 已提交
1328
		break;
1329
	case MSR_IA32_DEBUGCTLMSR:
1330 1331
		if (!svm_has(SVM_FEATURE_LBRV)) {
			pr_unimpl(vcpu, "%s: MSR_IA32_DEBUGCTL 0x%llx, nop\n",
1332
					__func__, data);
1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
			break;
		}
		if (data & DEBUGCTL_RESERVED_BITS)
			return 1;

		svm->vmcb->save.dbgctl = data;
		if (data & (1ULL<<0))
			svm_enable_lbrv(svm);
		else
			svm_disable_lbrv(svm);
1343
		break;
1344 1345 1346 1347
	case MSR_K7_EVNTSEL0:
	case MSR_K7_EVNTSEL1:
	case MSR_K7_EVNTSEL2:
	case MSR_K7_EVNTSEL3:
1348 1349 1350 1351
	case MSR_K7_PERFCTR0:
	case MSR_K7_PERFCTR1:
	case MSR_K7_PERFCTR2:
	case MSR_K7_PERFCTR3:
1352
		/*
1353 1354 1355
		 * Just discard all writes to the performance counters; this
		 * should keep both older linux and windows 64-bit guests
		 * happy
1356
		 */
1357 1358
		pr_unimpl(vcpu, "unimplemented perfctr wrmsr: 0x%x data 0x%llx\n", ecx, data);

1359
		break;
A
Avi Kivity 已提交
1360
	default:
1361
		return kvm_set_msr_common(vcpu, ecx, data);
A
Avi Kivity 已提交
1362 1363 1364 1365
	}
	return 0;
}

R
Rusty Russell 已提交
1366
static int wrmsr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1367
{
1368
	u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
1369
	u64 data = (svm->vcpu.arch.regs[VCPU_REGS_RAX] & -1u)
1370
		| ((u64)(svm->vcpu.arch.regs[VCPU_REGS_RDX] & -1u) << 32);
1371 1372 1373 1374

	KVMTRACE_3D(MSR_WRITE, &svm->vcpu, ecx, (u32)data, (u32)(data >> 32),
		    handler);

1375
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
1376
	if (svm_set_msr(&svm->vcpu, ecx, data))
1377
		kvm_inject_gp(&svm->vcpu, 0);
A
Avi Kivity 已提交
1378
	else
R
Rusty Russell 已提交
1379
		skip_emulated_instruction(&svm->vcpu);
A
Avi Kivity 已提交
1380 1381 1382
	return 1;
}

R
Rusty Russell 已提交
1383
static int msr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1384
{
R
Rusty Russell 已提交
1385 1386
	if (svm->vmcb->control.exit_info_1)
		return wrmsr_interception(svm, kvm_run);
A
Avi Kivity 已提交
1387
	else
R
Rusty Russell 已提交
1388
		return rdmsr_interception(svm, kvm_run);
A
Avi Kivity 已提交
1389 1390
}

R
Rusty Russell 已提交
1391
static int interrupt_window_interception(struct vcpu_svm *svm,
1392 1393
				   struct kvm_run *kvm_run)
{
1394 1395
	KVMTRACE_0D(PEND_INTR, &svm->vcpu, handler);

1396 1397
	svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
	svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
1398 1399 1400 1401 1402
	/*
	 * If the user space waits to inject interrupts, exit as soon as
	 * possible
	 */
	if (kvm_run->request_interrupt_window &&
1403
	    !svm->vcpu.arch.irq_summary) {
R
Rusty Russell 已提交
1404
		++svm->vcpu.stat.irq_window_exits;
1405 1406 1407 1408 1409 1410 1411
		kvm_run->exit_reason = KVM_EXIT_IRQ_WINDOW_OPEN;
		return 0;
	}

	return 1;
}

R
Rusty Russell 已提交
1412
static int (*svm_exit_handlers[])(struct vcpu_svm *svm,
A
Avi Kivity 已提交
1413 1414 1415 1416
				      struct kvm_run *kvm_run) = {
	[SVM_EXIT_READ_CR0]           		= emulate_on_interception,
	[SVM_EXIT_READ_CR3]           		= emulate_on_interception,
	[SVM_EXIT_READ_CR4]           		= emulate_on_interception,
1417
	[SVM_EXIT_READ_CR8]           		= emulate_on_interception,
A
Avi Kivity 已提交
1418 1419 1420 1421
	/* for now: */
	[SVM_EXIT_WRITE_CR0]          		= emulate_on_interception,
	[SVM_EXIT_WRITE_CR3]          		= emulate_on_interception,
	[SVM_EXIT_WRITE_CR4]          		= emulate_on_interception,
1422
	[SVM_EXIT_WRITE_CR8]          		= cr8_write_interception,
A
Avi Kivity 已提交
1423 1424 1425 1426 1427 1428 1429 1430 1431 1432
	[SVM_EXIT_READ_DR0] 			= emulate_on_interception,
	[SVM_EXIT_READ_DR1]			= emulate_on_interception,
	[SVM_EXIT_READ_DR2]			= emulate_on_interception,
	[SVM_EXIT_READ_DR3]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR0]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR1]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR2]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR3]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR5]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR7]			= emulate_on_interception,
1433
	[SVM_EXIT_EXCP_BASE + UD_VECTOR]	= ud_interception,
A
Avi Kivity 已提交
1434
	[SVM_EXIT_EXCP_BASE + PF_VECTOR] 	= pf_interception,
A
Anthony Liguori 已提交
1435
	[SVM_EXIT_EXCP_BASE + NM_VECTOR] 	= nm_interception,
1436
	[SVM_EXIT_EXCP_BASE + MC_VECTOR] 	= mc_interception,
1437
	[SVM_EXIT_INTR] 			= intr_interception,
1438
	[SVM_EXIT_NMI]				= nmi_interception,
A
Avi Kivity 已提交
1439 1440
	[SVM_EXIT_SMI]				= nop_on_interception,
	[SVM_EXIT_INIT]				= nop_on_interception,
1441
	[SVM_EXIT_VINTR]			= interrupt_window_interception,
A
Avi Kivity 已提交
1442 1443
	/* [SVM_EXIT_CR0_SEL_WRITE]		= emulate_on_interception, */
	[SVM_EXIT_CPUID]			= cpuid_interception,
1444
	[SVM_EXIT_INVD]                         = emulate_on_interception,
A
Avi Kivity 已提交
1445
	[SVM_EXIT_HLT]				= halt_interception,
M
Marcelo Tosatti 已提交
1446
	[SVM_EXIT_INVLPG]			= invlpg_interception,
A
Avi Kivity 已提交
1447 1448 1449 1450
	[SVM_EXIT_INVLPGA]			= invalid_op_interception,
	[SVM_EXIT_IOIO] 		  	= io_interception,
	[SVM_EXIT_MSR]				= msr_interception,
	[SVM_EXIT_TASK_SWITCH]			= task_switch_interception,
1451
	[SVM_EXIT_SHUTDOWN]			= shutdown_interception,
A
Avi Kivity 已提交
1452
	[SVM_EXIT_VMRUN]			= invalid_op_interception,
1453
	[SVM_EXIT_VMMCALL]			= vmmcall_interception,
A
Avi Kivity 已提交
1454 1455 1456 1457 1458
	[SVM_EXIT_VMLOAD]			= invalid_op_interception,
	[SVM_EXIT_VMSAVE]			= invalid_op_interception,
	[SVM_EXIT_STGI]				= invalid_op_interception,
	[SVM_EXIT_CLGI]				= invalid_op_interception,
	[SVM_EXIT_SKINIT]			= invalid_op_interception,
1459
	[SVM_EXIT_WBINVD]                       = emulate_on_interception,
1460 1461
	[SVM_EXIT_MONITOR]			= invalid_op_interception,
	[SVM_EXIT_MWAIT]			= invalid_op_interception,
1462
	[SVM_EXIT_NPF]				= pf_interception,
A
Avi Kivity 已提交
1463 1464
};

1465
static int handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1466
{
1467
	struct vcpu_svm *svm = to_svm(vcpu);
1468
	u32 exit_code = svm->vmcb->control.exit_code;
A
Avi Kivity 已提交
1469

1470 1471 1472
	KVMTRACE_3D(VMEXIT, vcpu, exit_code, (u32)svm->vmcb->save.rip,
		    (u32)((u64)svm->vmcb->save.rip >> 32), entryexit);

1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492
	if (npt_enabled) {
		int mmu_reload = 0;
		if ((vcpu->arch.cr0 ^ svm->vmcb->save.cr0) & X86_CR0_PG) {
			svm_set_cr0(vcpu, svm->vmcb->save.cr0);
			mmu_reload = 1;
		}
		vcpu->arch.cr0 = svm->vmcb->save.cr0;
		vcpu->arch.cr3 = svm->vmcb->save.cr3;
		if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
			if (!load_pdptrs(vcpu, vcpu->arch.cr3)) {
				kvm_inject_gp(vcpu, 0);
				return 1;
			}
		}
		if (mmu_reload) {
			kvm_mmu_reset_context(vcpu);
			kvm_mmu_load(vcpu);
		}
	}

1493 1494 1495 1496 1497 1498 1499 1500 1501
	kvm_reput_irq(svm);

	if (svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
		kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
		kvm_run->fail_entry.hardware_entry_failure_reason
			= svm->vmcb->control.exit_code;
		return 0;
	}

1502
	if (is_external_interrupt(svm->vmcb->control.exit_int_info) &&
1503 1504
	    exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR &&
	    exit_code != SVM_EXIT_NPF)
A
Avi Kivity 已提交
1505 1506
		printk(KERN_ERR "%s: unexpected exit_ini_info 0x%x "
		       "exit_code 0x%x\n",
1507
		       __func__, svm->vmcb->control.exit_int_info,
A
Avi Kivity 已提交
1508 1509
		       exit_code);

1510
	if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
J
Joe Perches 已提交
1511
	    || !svm_exit_handlers[exit_code]) {
A
Avi Kivity 已提交
1512
		kvm_run->exit_reason = KVM_EXIT_UNKNOWN;
1513
		kvm_run->hw.hardware_exit_reason = exit_code;
A
Avi Kivity 已提交
1514 1515 1516
		return 0;
	}

R
Rusty Russell 已提交
1517
	return svm_exit_handlers[exit_code](svm, kvm_run);
A
Avi Kivity 已提交
1518 1519 1520 1521 1522 1523 1524
}

static void reload_tss(struct kvm_vcpu *vcpu)
{
	int cpu = raw_smp_processor_id();

	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
M
Mike Day 已提交
1525
	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
A
Avi Kivity 已提交
1526 1527 1528
	load_TR_desc();
}

R
Rusty Russell 已提交
1529
static void pre_svm_run(struct vcpu_svm *svm)
A
Avi Kivity 已提交
1530 1531 1532 1533 1534
{
	int cpu = raw_smp_processor_id();

	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);

1535
	svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
R
Rusty Russell 已提交
1536
	if (svm->vcpu.cpu != cpu ||
1537
	    svm->asid_generation != svm_data->asid_generation)
R
Rusty Russell 已提交
1538
		new_asid(svm, svm_data);
A
Avi Kivity 已提交
1539 1540 1541
}


1542
static inline void svm_inject_irq(struct vcpu_svm *svm, int irq)
A
Avi Kivity 已提交
1543 1544 1545
{
	struct vmcb_control_area *control;

1546 1547
	KVMTRACE_1D(INJ_VIRQ, &svm->vcpu, (u32)irq, handler);

1548
	++svm->vcpu.stat.irq_injections;
R
Rusty Russell 已提交
1549
	control = &svm->vmcb->control;
1550
	control->int_vector = irq;
A
Avi Kivity 已提交
1551 1552 1553 1554 1555
	control->int_ctl &= ~V_INTR_PRIO_MASK;
	control->int_ctl |= V_IRQ_MASK |
		((/*control->int_vector >> 4*/ 0xf) << V_INTR_PRIO_SHIFT);
}

E
Eddie Dong 已提交
1556 1557 1558 1559 1560 1561 1562
static void svm_set_irq(struct kvm_vcpu *vcpu, int irq)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm_inject_irq(svm, irq);
}

1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583
static void update_cr8_intercept(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
	int max_irr, tpr;

	if (!irqchip_in_kernel(vcpu->kvm) || vcpu->arch.apic->vapic_addr)
		return;

	vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK;

	max_irr = kvm_lapic_find_highest_irr(vcpu);
	if (max_irr == -1)
		return;

	tpr = kvm_lapic_get_cr8(vcpu) << 4;

	if (tpr >= (max_irr & 0xf0))
		vmcb->control.intercept_cr_write |= INTERCEPT_CR8_MASK;
}

1584
static void svm_intr_assist(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1585
{
1586
	struct vcpu_svm *svm = to_svm(vcpu);
1587 1588 1589 1590 1591 1592 1593 1594 1595
	struct vmcb *vmcb = svm->vmcb;
	int intr_vector = -1;

	if ((vmcb->control.exit_int_info & SVM_EVTINJ_VALID) &&
	    ((vmcb->control.exit_int_info & SVM_EVTINJ_TYPE_MASK) == 0)) {
		intr_vector = vmcb->control.exit_int_info &
			      SVM_EVTINJ_VEC_MASK;
		vmcb->control.exit_int_info = 0;
		svm_inject_irq(svm, intr_vector);
1596
		goto out;
1597 1598 1599
	}

	if (vmcb->control.int_ctl & V_IRQ_MASK)
1600
		goto out;
1601

1602
	if (!kvm_cpu_has_interrupt(vcpu))
1603
		goto out;
1604 1605 1606 1607 1608 1609 1610

	if (!(vmcb->save.rflags & X86_EFLAGS_IF) ||
	    (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK) ||
	    (vmcb->control.event_inj & SVM_EVTINJ_VALID)) {
		/* unable to deliver irq, set pending irq */
		vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
		svm_inject_irq(svm, 0x0);
1611
		goto out;
1612 1613
	}
	/* Okay, we can deliver the interrupt: grab it and update PIC state. */
1614
	intr_vector = kvm_cpu_get_interrupt(vcpu);
1615
	svm_inject_irq(svm, intr_vector);
1616
	kvm_timer_intr_post(vcpu, intr_vector);
1617 1618
out:
	update_cr8_intercept(vcpu);
1619 1620 1621 1622
}

static void kvm_reput_irq(struct vcpu_svm *svm)
{
R
Rusty Russell 已提交
1623
	struct vmcb_control_area *control = &svm->vmcb->control;
A
Avi Kivity 已提交
1624

1625 1626
	if ((control->int_ctl & V_IRQ_MASK)
	    && !irqchip_in_kernel(svm->vcpu.kvm)) {
A
Avi Kivity 已提交
1627
		control->int_ctl &= ~V_IRQ_MASK;
R
Rusty Russell 已提交
1628
		push_irq(&svm->vcpu, control->int_vector);
A
Avi Kivity 已提交
1629
	}
1630

1631
	svm->vcpu.arch.interrupt_window_open =
1632 1633 1634
		!(control->int_state & SVM_INTERRUPT_SHADOW_MASK);
}

1635 1636 1637
static void svm_do_inject_vector(struct vcpu_svm *svm)
{
	struct kvm_vcpu *vcpu = &svm->vcpu;
1638 1639
	int word_index = __ffs(vcpu->arch.irq_summary);
	int bit_index = __ffs(vcpu->arch.irq_pending[word_index]);
1640 1641
	int irq = word_index * BITS_PER_LONG + bit_index;

1642 1643 1644
	clear_bit(bit_index, &vcpu->arch.irq_pending[word_index]);
	if (!vcpu->arch.irq_pending[word_index])
		clear_bit(word_index, &vcpu->arch.irq_summary);
1645 1646 1647
	svm_inject_irq(svm, irq);
}

1648
static void do_interrupt_requests(struct kvm_vcpu *vcpu,
1649 1650
				       struct kvm_run *kvm_run)
{
1651
	struct vcpu_svm *svm = to_svm(vcpu);
1652
	struct vmcb_control_area *control = &svm->vmcb->control;
1653

1654
	svm->vcpu.arch.interrupt_window_open =
1655
		(!(control->int_state & SVM_INTERRUPT_SHADOW_MASK) &&
1656
		 (svm->vmcb->save.rflags & X86_EFLAGS_IF));
1657

1658
	if (svm->vcpu.arch.interrupt_window_open && svm->vcpu.arch.irq_summary)
1659 1660 1661
		/*
		 * If interrupts enabled, and not blocked by sti or mov ss. Good.
		 */
1662
		svm_do_inject_vector(svm);
1663 1664 1665 1666

	/*
	 * Interrupts blocked.  Wait for unblock.
	 */
1667 1668
	if (!svm->vcpu.arch.interrupt_window_open &&
	    (svm->vcpu.arch.irq_summary || kvm_run->request_interrupt_window))
1669
		control->intercept |= 1ULL << INTERCEPT_VINTR;
M
Mike Day 已提交
1670
	 else
1671 1672 1673
		control->intercept &= ~(1ULL << INTERCEPT_VINTR);
}

1674 1675 1676 1677 1678
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
{
	return 0;
}

A
Avi Kivity 已提交
1679 1680
static void save_db_regs(unsigned long *db_regs)
{
1681 1682 1683 1684
	asm volatile ("mov %%dr0, %0" : "=r"(db_regs[0]));
	asm volatile ("mov %%dr1, %0" : "=r"(db_regs[1]));
	asm volatile ("mov %%dr2, %0" : "=r"(db_regs[2]));
	asm volatile ("mov %%dr3, %0" : "=r"(db_regs[3]));
A
Avi Kivity 已提交
1685 1686 1687 1688
}

static void load_db_regs(unsigned long *db_regs)
{
1689 1690 1691 1692
	asm volatile ("mov %0, %%dr0" : : "r"(db_regs[0]));
	asm volatile ("mov %0, %%dr1" : : "r"(db_regs[1]));
	asm volatile ("mov %0, %%dr2" : : "r"(db_regs[2]));
	asm volatile ("mov %0, %%dr3" : : "r"(db_regs[3]));
A
Avi Kivity 已提交
1693 1694
}

1695 1696 1697 1698 1699
static void svm_flush_tlb(struct kvm_vcpu *vcpu)
{
	force_new_asid(vcpu);
}

1700 1701 1702 1703
static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
{
}

1704 1705 1706 1707 1708 1709 1710 1711 1712 1713
static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!(svm->vmcb->control.intercept_cr_write & INTERCEPT_CR8_MASK)) {
		int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK;
		kvm_lapic_set_tpr(vcpu, cr8);
	}
}

1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726
static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 cr8;

	if (!irqchip_in_kernel(vcpu->kvm))
		return;

	cr8 = kvm_get_cr8(vcpu);
	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
}

1727 1728 1729 1730 1731 1732
#ifdef CONFIG_X86_64
#define R "r"
#else
#define R "e"
#endif

1733
static void svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1734
{
1735
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
1736 1737 1738
	u16 fs_selector;
	u16 gs_selector;
	u16 ldt_selector;
1739

1740 1741 1742 1743
	svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
	svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
	svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];

R
Rusty Russell 已提交
1744
	pre_svm_run(svm);
A
Avi Kivity 已提交
1745

1746 1747
	sync_lapic_to_cr8(vcpu);

A
Avi Kivity 已提交
1748
	save_host_msrs(vcpu);
1749 1750 1751
	fs_selector = kvm_read_fs();
	gs_selector = kvm_read_gs();
	ldt_selector = kvm_read_ldt();
1752 1753 1754
	svm->host_cr2 = kvm_read_cr2();
	svm->host_dr6 = read_dr6();
	svm->host_dr7 = read_dr7();
1755
	svm->vmcb->save.cr2 = vcpu->arch.cr2;
1756 1757 1758
	/* required for live migration with NPT */
	if (npt_enabled)
		svm->vmcb->save.cr3 = vcpu->arch.cr3;
A
Avi Kivity 已提交
1759

1760
	if (svm->vmcb->save.dr7 & 0xff) {
A
Avi Kivity 已提交
1761
		write_dr7(0);
1762 1763
		save_db_regs(svm->host_db_regs);
		load_db_regs(svm->db_regs);
A
Avi Kivity 已提交
1764
	}
1765

1766 1767 1768
	clgi();

	local_irq_enable();
1769

A
Avi Kivity 已提交
1770
	asm volatile (
1771 1772 1773 1774 1775 1776 1777
		"push %%"R"bp; \n\t"
		"mov %c[rbx](%[svm]), %%"R"bx \n\t"
		"mov %c[rcx](%[svm]), %%"R"cx \n\t"
		"mov %c[rdx](%[svm]), %%"R"dx \n\t"
		"mov %c[rsi](%[svm]), %%"R"si \n\t"
		"mov %c[rdi](%[svm]), %%"R"di \n\t"
		"mov %c[rbp](%[svm]), %%"R"bp \n\t"
1778
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
1779 1780 1781 1782 1783 1784 1785 1786
		"mov %c[r8](%[svm]),  %%r8  \n\t"
		"mov %c[r9](%[svm]),  %%r9  \n\t"
		"mov %c[r10](%[svm]), %%r10 \n\t"
		"mov %c[r11](%[svm]), %%r11 \n\t"
		"mov %c[r12](%[svm]), %%r12 \n\t"
		"mov %c[r13](%[svm]), %%r13 \n\t"
		"mov %c[r14](%[svm]), %%r14 \n\t"
		"mov %c[r15](%[svm]), %%r15 \n\t"
A
Avi Kivity 已提交
1787 1788 1789
#endif

		/* Enter guest mode */
1790 1791
		"push %%"R"ax \n\t"
		"mov %c[vmcb](%[svm]), %%"R"ax \n\t"
1792 1793 1794
		__ex(SVM_VMLOAD) "\n\t"
		__ex(SVM_VMRUN) "\n\t"
		__ex(SVM_VMSAVE) "\n\t"
1795
		"pop %%"R"ax \n\t"
A
Avi Kivity 已提交
1796 1797

		/* Save guest registers, load host registers */
1798 1799 1800 1801 1802 1803
		"mov %%"R"bx, %c[rbx](%[svm]) \n\t"
		"mov %%"R"cx, %c[rcx](%[svm]) \n\t"
		"mov %%"R"dx, %c[rdx](%[svm]) \n\t"
		"mov %%"R"si, %c[rsi](%[svm]) \n\t"
		"mov %%"R"di, %c[rdi](%[svm]) \n\t"
		"mov %%"R"bp, %c[rbp](%[svm]) \n\t"
1804
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
1805 1806 1807 1808 1809 1810 1811 1812
		"mov %%r8,  %c[r8](%[svm]) \n\t"
		"mov %%r9,  %c[r9](%[svm]) \n\t"
		"mov %%r10, %c[r10](%[svm]) \n\t"
		"mov %%r11, %c[r11](%[svm]) \n\t"
		"mov %%r12, %c[r12](%[svm]) \n\t"
		"mov %%r13, %c[r13](%[svm]) \n\t"
		"mov %%r14, %c[r14](%[svm]) \n\t"
		"mov %%r15, %c[r15](%[svm]) \n\t"
A
Avi Kivity 已提交
1813
#endif
1814
		"pop %%"R"bp"
A
Avi Kivity 已提交
1815
		:
R
Rusty Russell 已提交
1816
		: [svm]"a"(svm),
A
Avi Kivity 已提交
1817
		  [vmcb]"i"(offsetof(struct vcpu_svm, vmcb_pa)),
1818 1819 1820 1821 1822 1823
		  [rbx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBX])),
		  [rcx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RCX])),
		  [rdx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDX])),
		  [rsi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RSI])),
		  [rdi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDI])),
		  [rbp]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBP]))
1824
#ifdef CONFIG_X86_64
1825 1826 1827 1828 1829 1830 1831 1832
		  , [r8]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R8])),
		  [r9]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R9])),
		  [r10]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R10])),
		  [r11]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R11])),
		  [r12]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R12])),
		  [r13]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R13])),
		  [r14]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R14])),
		  [r15]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R15]))
A
Avi Kivity 已提交
1833
#endif
1834
		: "cc", "memory"
1835
		, R"bx", R"cx", R"dx", R"si", R"di"
1836 1837 1838 1839
#ifdef CONFIG_X86_64
		, "r8", "r9", "r10", "r11" , "r12", "r13", "r14", "r15"
#endif
		);
A
Avi Kivity 已提交
1840

1841 1842
	if ((svm->vmcb->save.dr7 & 0xff))
		load_db_regs(svm->host_db_regs);
A
Avi Kivity 已提交
1843

1844
	vcpu->arch.cr2 = svm->vmcb->save.cr2;
1845 1846 1847
	vcpu->arch.regs[VCPU_REGS_RAX] = svm->vmcb->save.rax;
	vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
	vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
A
Avi Kivity 已提交
1848

1849 1850 1851
	write_dr6(svm->host_dr6);
	write_dr7(svm->host_dr7);
	kvm_write_cr2(svm->host_cr2);
A
Avi Kivity 已提交
1852

1853 1854 1855
	kvm_load_fs(fs_selector);
	kvm_load_gs(gs_selector);
	kvm_load_ldt(ldt_selector);
A
Avi Kivity 已提交
1856 1857 1858 1859
	load_host_msrs(vcpu);

	reload_tss(vcpu);

1860 1861 1862 1863
	local_irq_disable();

	stgi();

1864 1865
	sync_cr8_to_lapic(vcpu);

1866
	svm->next_rip = 0;
A
Avi Kivity 已提交
1867 1868
}

1869 1870
#undef R

A
Avi Kivity 已提交
1871 1872
static void svm_set_cr3(struct kvm_vcpu *vcpu, unsigned long root)
{
1873 1874
	struct vcpu_svm *svm = to_svm(vcpu);

1875 1876 1877 1878 1879 1880
	if (npt_enabled) {
		svm->vmcb->control.nested_cr3 = root;
		force_new_asid(vcpu);
		return;
	}

1881
	svm->vmcb->save.cr3 = root;
A
Avi Kivity 已提交
1882
	force_new_asid(vcpu);
A
Anthony Liguori 已提交
1883 1884

	if (vcpu->fpu_active) {
1885 1886
		svm->vmcb->control.intercept_exceptions |= (1 << NM_VECTOR);
		svm->vmcb->save.cr0 |= X86_CR0_TS;
A
Anthony Liguori 已提交
1887 1888
		vcpu->fpu_active = 0;
	}
A
Avi Kivity 已提交
1889 1890 1891 1892
}

static int is_disabled(void)
{
1893 1894 1895 1896 1897 1898
	u64 vm_cr;

	rdmsrl(MSR_VM_CR, vm_cr);
	if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE))
		return 1;

A
Avi Kivity 已提交
1899 1900 1901
	return 0;
}

I
Ingo Molnar 已提交
1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912
static void
svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
{
	/*
	 * Patch in the VMMCALL instruction:
	 */
	hypercall[0] = 0x0f;
	hypercall[1] = 0x01;
	hypercall[2] = 0xd9;
}

Y
Yang, Sheng 已提交
1913 1914 1915 1916 1917
static void svm_check_processor_compat(void *rtn)
{
	*(int *)rtn = 0;
}

1918 1919 1920 1921 1922
static bool svm_cpu_has_accelerated_tpr(void)
{
	return false;
}

1923 1924 1925 1926 1927 1928 1929 1930 1931
static int get_npt_level(void)
{
#ifdef CONFIG_X86_64
	return PT64_ROOT_LEVEL;
#else
	return PT32E_ROOT_LEVEL;
#endif
}

S
Sheng Yang 已提交
1932 1933 1934 1935 1936
static int svm_get_mt_mask_shift(void)
{
	return 0;
}

1937
static struct kvm_x86_ops svm_x86_ops = {
A
Avi Kivity 已提交
1938 1939 1940 1941
	.cpu_has_kvm_support = has_svm,
	.disabled_by_bios = is_disabled,
	.hardware_setup = svm_hardware_setup,
	.hardware_unsetup = svm_hardware_unsetup,
Y
Yang, Sheng 已提交
1942
	.check_processor_compatibility = svm_check_processor_compat,
A
Avi Kivity 已提交
1943 1944
	.hardware_enable = svm_hardware_enable,
	.hardware_disable = svm_hardware_disable,
1945
	.cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr,
A
Avi Kivity 已提交
1946 1947 1948

	.vcpu_create = svm_create_vcpu,
	.vcpu_free = svm_free_vcpu,
1949
	.vcpu_reset = svm_vcpu_reset,
A
Avi Kivity 已提交
1950

1951
	.prepare_guest_switch = svm_prepare_guest_switch,
A
Avi Kivity 已提交
1952 1953 1954 1955 1956 1957 1958 1959 1960
	.vcpu_load = svm_vcpu_load,
	.vcpu_put = svm_vcpu_put,

	.set_guest_debug = svm_guest_debug,
	.get_msr = svm_get_msr,
	.set_msr = svm_set_msr,
	.get_segment_base = svm_get_segment_base,
	.get_segment = svm_get_segment,
	.set_segment = svm_set_segment,
1961
	.get_cpl = svm_get_cpl,
1962
	.get_cs_db_l_bits = kvm_get_cs_db_l_bits,
1963
	.decache_cr4_guest_bits = svm_decache_cr4_guest_bits,
A
Avi Kivity 已提交
1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979
	.set_cr0 = svm_set_cr0,
	.set_cr3 = svm_set_cr3,
	.set_cr4 = svm_set_cr4,
	.set_efer = svm_set_efer,
	.get_idt = svm_get_idt,
	.set_idt = svm_set_idt,
	.get_gdt = svm_get_gdt,
	.set_gdt = svm_set_gdt,
	.get_dr = svm_get_dr,
	.set_dr = svm_set_dr,
	.get_rflags = svm_get_rflags,
	.set_rflags = svm_set_rflags,

	.tlb_flush = svm_flush_tlb,

	.run = svm_vcpu_run,
1980
	.handle_exit = handle_exit,
A
Avi Kivity 已提交
1981
	.skip_emulated_instruction = skip_emulated_instruction,
I
Ingo Molnar 已提交
1982
	.patch_hypercall = svm_patch_hypercall,
E
Eddie Dong 已提交
1983 1984
	.get_irq = svm_get_irq,
	.set_irq = svm_set_irq,
1985 1986
	.queue_exception = svm_queue_exception,
	.exception_injected = svm_exception_injected,
1987 1988
	.inject_pending_irq = svm_intr_assist,
	.inject_pending_vectors = do_interrupt_requests,
1989 1990

	.set_tss_addr = svm_set_tss_addr,
1991
	.get_tdp_level = get_npt_level,
S
Sheng Yang 已提交
1992
	.get_mt_mask_shift = svm_get_mt_mask_shift,
A
Avi Kivity 已提交
1993 1994 1995 1996
};

static int __init svm_init(void)
{
1997
	return kvm_init(&svm_x86_ops, sizeof(struct vcpu_svm),
1998
			      THIS_MODULE);
A
Avi Kivity 已提交
1999 2000 2001 2002
}

static void __exit svm_exit(void)
{
2003
	kvm_exit();
A
Avi Kivity 已提交
2004 2005 2006 2007
}

module_init(svm_init)
module_exit(svm_exit)