svm.c 122.3 KB
Newer Older
1 2
#define pr_fmt(fmt) "SVM: " fmt

3 4
#include <linux/kvm_host.h>

5
#include "irq.h"
6
#include "mmu.h"
7
#include "kvm_cache_regs.h"
8
#include "x86.h"
9
#include "cpuid.h"
10
#include "pmu.h"
A
Avi Kivity 已提交
11

A
Avi Kivity 已提交
12
#include <linux/module.h>
13
#include <linux/mod_devicetable.h>
14
#include <linux/kernel.h>
A
Avi Kivity 已提交
15 16
#include <linux/vmalloc.h>
#include <linux/highmem.h>
17
#include <linux/amd-iommu.h>
A
Alexey Dobriyan 已提交
18
#include <linux/sched.h>
19
#include <linux/trace_events.h>
20
#include <linux/slab.h>
21
#include <linux/hashtable.h>
22
#include <linux/objtool.h>
B
Brijesh Singh 已提交
23
#include <linux/psp-sev.h>
B
Brijesh Singh 已提交
24
#include <linux/file.h>
25 26
#include <linux/pagemap.h>
#include <linux/swap.h>
27
#include <linux/rwsem.h>
A
Avi Kivity 已提交
28

29
#include <asm/apic.h>
30
#include <asm/perf_event.h>
31
#include <asm/tlbflush.h>
A
Avi Kivity 已提交
32
#include <asm/desc.h>
33
#include <asm/debugreg.h>
G
Gleb Natapov 已提交
34
#include <asm/kvm_para.h>
35
#include <asm/irq_remapping.h>
36
#include <asm/spec-ctrl.h>
37
#include <asm/cpu_device_id.h>
38
#include <asm/traps.h>
A
Avi Kivity 已提交
39

40
#include <asm/virtext.h>
41
#include "trace.h"
42

43
#include "svm.h"
44
#include "svm_ops.h"
45

46 47
#define __ex(x) __kvm_handle_fault_on_reboot(x)

A
Avi Kivity 已提交
48 49 50
MODULE_AUTHOR("Qumranet");
MODULE_LICENSE("GPL");

51
#ifdef MODULE
52
static const struct x86_cpu_id svm_cpu_id[] = {
53
	X86_MATCH_FEATURE(X86_FEATURE_SVM, NULL),
54 55 56
	{}
};
MODULE_DEVICE_TABLE(x86cpu, svm_cpu_id);
57
#endif
58

A
Avi Kivity 已提交
59 60 61 62 63 64
#define IOPM_ALLOC_ORDER 2
#define MSRPM_ALLOC_ORDER 1

#define SEG_TYPE_LDT 2
#define SEG_TYPE_BUSY_TSS16 3

65 66
#define SVM_FEATURE_LBRV           (1 <<  1)
#define SVM_FEATURE_SVML           (1 <<  2)
67 68 69 70
#define SVM_FEATURE_TSC_RATE       (1 <<  4)
#define SVM_FEATURE_VMCB_CLEAN     (1 <<  5)
#define SVM_FEATURE_FLUSH_ASID     (1 <<  6)
#define SVM_FEATURE_DECODE_ASSIST  (1 <<  7)
71
#define SVM_FEATURE_PAUSE_FILTER   (1 << 10)
72

73 74
#define DEBUGCTL_RESERVED_BITS (~(0x3fULL))

75
#define TSC_RATIO_RSVD          0xffffff0000000000ULL
76 77
#define TSC_RATIO_MIN		0x0000000000000001ULL
#define TSC_RATIO_MAX		0x000000ffffffffffULL
78

79 80
static bool erratum_383_found __read_mostly;

81
u32 msrpm_offsets[MSRPM_OFFSETS] __read_mostly;
82

83 84 85 86 87 88
/*
 * Set osvw_len to higher value when updated Revision Guides
 * are published and we know what the new status bits are
 */
static uint64_t osvw_len = 4, osvw_status;

89 90 91
static DEFINE_PER_CPU(u64, current_tsc_ratio);
#define TSC_RATIO_DEFAULT	0x0100000000ULL

92
static const struct svm_direct_access_msrs {
93
	u32 index;   /* Index of the MSR */
94
	bool always; /* True if intercept is initially cleared */
95
} direct_access_msrs[MAX_DIRECT_ACCESS_MSRS] = {
B
Brian Gerst 已提交
96
	{ .index = MSR_STAR,				.always = true  },
97 98 99 100 101 102 103 104 105
	{ .index = MSR_IA32_SYSENTER_CS,		.always = true  },
#ifdef CONFIG_X86_64
	{ .index = MSR_GS_BASE,				.always = true  },
	{ .index = MSR_FS_BASE,				.always = true  },
	{ .index = MSR_KERNEL_GS_BASE,			.always = true  },
	{ .index = MSR_LSTAR,				.always = true  },
	{ .index = MSR_CSTAR,				.always = true  },
	{ .index = MSR_SYSCALL_MASK,			.always = true  },
#endif
106
	{ .index = MSR_IA32_SPEC_CTRL,			.always = false },
A
Ashok Raj 已提交
107
	{ .index = MSR_IA32_PRED_CMD,			.always = false },
108 109 110 111
	{ .index = MSR_IA32_LASTBRANCHFROMIP,		.always = false },
	{ .index = MSR_IA32_LASTBRANCHTOIP,		.always = false },
	{ .index = MSR_IA32_LASTINTFROMIP,		.always = false },
	{ .index = MSR_IA32_LASTINTTOIP,		.always = false },
112 113 114
	{ .index = MSR_EFER,				.always = false },
	{ .index = MSR_IA32_CR_PAT,			.always = false },
	{ .index = MSR_AMD64_SEV_ES_GHCB,		.always = true  },
115
	{ .index = MSR_INVALID,				.always = false },
A
Avi Kivity 已提交
116 117
};

118 119
/* enable NPT for AMD64 and X86 with PAE */
#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
120
bool npt_enabled = true;
121
#else
122
bool npt_enabled;
123
#endif
124

125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172
/*
 * These 2 parameters are used to config the controls for Pause-Loop Exiting:
 * pause_filter_count: On processors that support Pause filtering(indicated
 *	by CPUID Fn8000_000A_EDX), the VMCB provides a 16 bit pause filter
 *	count value. On VMRUN this value is loaded into an internal counter.
 *	Each time a pause instruction is executed, this counter is decremented
 *	until it reaches zero at which time a #VMEXIT is generated if pause
 *	intercept is enabled. Refer to  AMD APM Vol 2 Section 15.14.4 Pause
 *	Intercept Filtering for more details.
 *	This also indicate if ple logic enabled.
 *
 * pause_filter_thresh: In addition, some processor families support advanced
 *	pause filtering (indicated by CPUID Fn8000_000A_EDX) upper bound on
 *	the amount of time a guest is allowed to execute in a pause loop.
 *	In this mode, a 16-bit pause filter threshold field is added in the
 *	VMCB. The threshold value is a cycle count that is used to reset the
 *	pause counter. As with simple pause filtering, VMRUN loads the pause
 *	count value from VMCB into an internal counter. Then, on each pause
 *	instruction the hardware checks the elapsed number of cycles since
 *	the most recent pause instruction against the pause filter threshold.
 *	If the elapsed cycle count is greater than the pause filter threshold,
 *	then the internal pause count is reloaded from the VMCB and execution
 *	continues. If the elapsed cycle count is less than the pause filter
 *	threshold, then the internal pause count is decremented. If the count
 *	value is less than zero and PAUSE intercept is enabled, a #VMEXIT is
 *	triggered. If advanced pause filtering is supported and pause filter
 *	threshold field is set to zero, the filter will operate in the simpler,
 *	count only mode.
 */

static unsigned short pause_filter_thresh = KVM_DEFAULT_PLE_GAP;
module_param(pause_filter_thresh, ushort, 0444);

static unsigned short pause_filter_count = KVM_SVM_DEFAULT_PLE_WINDOW;
module_param(pause_filter_count, ushort, 0444);

/* Default doubles per-vcpu window every exit. */
static unsigned short pause_filter_count_grow = KVM_DEFAULT_PLE_WINDOW_GROW;
module_param(pause_filter_count_grow, ushort, 0444);

/* Default resets per-vcpu window every exit to pause_filter_count. */
static unsigned short pause_filter_count_shrink = KVM_DEFAULT_PLE_WINDOW_SHRINK;
module_param(pause_filter_count_shrink, ushort, 0444);

/* Default is to compute the maximum so we can never overflow. */
static unsigned short pause_filter_count_max = KVM_SVM_DEFAULT_PLE_WINDOW_MAX;
module_param(pause_filter_count_max, ushort, 0444);

173 174
/* allow nested paging (virtualized MMU) for all guests */
static int npt = true;
175
module_param(npt, int, S_IRUGO);
176

177 178
/* allow nested virtualization in KVM/SVM */
static int nested = true;
179 180
module_param(nested, int, S_IRUGO);

181 182 183 184
/* enable/disable Next RIP Save */
static int nrips = true;
module_param(nrips, int, 0444);

185 186 187 188
/* enable/disable Virtual VMLOAD VMSAVE */
static int vls = true;
module_param(vls, int, 0444);

189 190 191
/* enable/disable Virtual GIF */
static int vgif = true;
module_param(vgif, int, 0444);
192

B
Brijesh Singh 已提交
193
/* enable/disable SEV support */
194
int sev = IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT);
B
Brijesh Singh 已提交
195 196
module_param(sev, int, 0444);

197 198 199 200
/* enable/disable SEV-ES support */
int sev_es = IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT);
module_param(sev_es, int, 0444);

201
bool __read_mostly dump_invalid_vmcb;
202 203
module_param(dump_invalid_vmcb, bool, 0644);

204 205
bool svm_gp_erratum_intercept = true;

B
Brijesh Singh 已提交
206 207
static u8 rsm_ins_bytes[] = "\x0f\xaa";

208
static void svm_complete_interrupts(struct vcpu_svm *svm);
209

210
static unsigned long iopm_base;
A
Avi Kivity 已提交
211 212 213 214

struct kvm_ldttss_desc {
	u16 limit0;
	u16 base0;
J
Joerg Roedel 已提交
215 216
	unsigned base1:8, type:5, dpl:2, p:1;
	unsigned limit1:4, zero0:3, g:1, base2:8;
A
Avi Kivity 已提交
217 218 219 220
	u32 base3;
	u32 zero1;
} __attribute__((packed));

221
DEFINE_PER_CPU(struct svm_cpu_data *, svm_data);
A
Avi Kivity 已提交
222

223
static const u32 msrpm_ranges[] = {0, 0xc0000000, 0xc0010000};
A
Avi Kivity 已提交
224

225
#define NUM_MSR_MAPS ARRAY_SIZE(msrpm_ranges)
A
Avi Kivity 已提交
226 227 228
#define MSRS_RANGE_SIZE 2048
#define MSRS_IN_RANGE (MSRS_RANGE_SIZE * 8 / 2)

229
u32 svm_msrpm_offset(u32 msr)
230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249
{
	u32 offset;
	int i;

	for (i = 0; i < NUM_MSR_MAPS; i++) {
		if (msr < msrpm_ranges[i] ||
		    msr >= msrpm_ranges[i] + MSRS_IN_RANGE)
			continue;

		offset  = (msr - msrpm_ranges[i]) / 4; /* 4 msrs per u8 */
		offset += (i * MSRS_RANGE_SIZE);       /* add range offset */

		/* Now we have the u8 offset - but need the u32 offset */
		return offset / 4;
	}

	/* MSR not in any range */
	return MSR_INVALID;
}

A
Avi Kivity 已提交
250 251
#define MAX_INST_SIZE 15

252
static int get_max_npt_level(void)
253 254
{
#ifdef CONFIG_X86_64
255
	return PT64_ROOT_4LEVEL;
256 257 258 259 260
#else
	return PT32E_ROOT_LEVEL;
#endif
}

261
int svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
A
Avi Kivity 已提交
262
{
263
	struct vcpu_svm *svm = to_svm(vcpu);
264
	u64 old_efer = vcpu->arch.efer;
265
	vcpu->arch.efer = efer;
266 267 268 269 270 271 272 273

	if (!npt_enabled) {
		/* Shadow paging assumes NX to be available.  */
		efer |= EFER_NX;

		if (!(efer & EFER_LMA))
			efer &= ~EFER_LME;
	}
A
Avi Kivity 已提交
274

275 276 277 278
	if ((old_efer & EFER_SVME) != (efer & EFER_SVME)) {
		if (!(efer & EFER_SVME)) {
			svm_leave_nested(svm);
			svm_set_gif(svm, true);
279 280 281
			/* #GP intercept is still needed for vmware backdoor */
			if (!enable_vmware_backdoor)
				clr_exception_intercept(svm, GP_VECTOR);
282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297

			/*
			 * Free the nested guest state, unless we are in SMM.
			 * In this case we will return to the nested guest
			 * as soon as we leave SMM.
			 */
			if (!is_smm(&svm->vcpu))
				svm_free_nested(svm);

		} else {
			int ret = svm_allocate_nested(svm);

			if (ret) {
				vcpu->arch.efer = old_efer;
				return ret;
			}
298 299 300

			if (svm_gp_erratum_intercept)
				set_exception_intercept(svm, GP_VECTOR);
301
		}
302 303 304
	}

	svm->vmcb->save.efer = efer | EFER_SVME;
305
	vmcb_mark_dirty(svm->vmcb, VMCB_CR);
306
	return 0;
A
Avi Kivity 已提交
307 308 309 310 311 312 313 314
}

static int is_external_interrupt(u32 info)
{
	info &= SVM_EVTINJ_TYPE_MASK | SVM_EVTINJ_VALID;
	return info == (SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR);
}

315
static u32 svm_get_interrupt_shadow(struct kvm_vcpu *vcpu)
316 317 318 319 320
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 ret = 0;

	if (svm->vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK)
321 322
		ret = KVM_X86_SHADOW_INT_STI | KVM_X86_SHADOW_INT_MOV_SS;
	return ret;
323 324 325 326 327 328 329 330 331 332 333 334 335
}

static void svm_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (mask == 0)
		svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
	else
		svm->vmcb->control.int_state |= SVM_INTERRUPT_SHADOW_MASK;

}

336
static int skip_emulated_instruction(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
337
{
338 339
	struct vcpu_svm *svm = to_svm(vcpu);

340 341 342 343 344 345 346
	/*
	 * SEV-ES does not expose the next RIP. The RIP update is controlled by
	 * the type of exit and the #VC handler in the guest.
	 */
	if (sev_es_guest(vcpu->kvm))
		goto done;

347
	if (nrips && svm->vmcb->control.next_rip != 0) {
348
		WARN_ON_ONCE(!static_cpu_has(X86_FEATURE_NRIPS));
349
		svm->next_rip = svm->vmcb->control.next_rip;
350
	}
351

352 353 354 355 356 357
	if (!svm->next_rip) {
		if (!kvm_emulate_instruction(vcpu, EMULTYPE_SKIP))
			return 0;
	} else {
		kvm_rip_write(vcpu, svm->next_rip);
	}
358 359

done:
360
	svm_set_interrupt_shadow(vcpu, 0);
361

362
	return 1;
A
Avi Kivity 已提交
363 364
}

365
static void svm_queue_exception(struct kvm_vcpu *vcpu)
J
Jan Kiszka 已提交
366 367
{
	struct vcpu_svm *svm = to_svm(vcpu);
368 369 370
	unsigned nr = vcpu->arch.exception.nr;
	bool has_error_code = vcpu->arch.exception.has_error_code;
	u32 error_code = vcpu->arch.exception.error_code;
J
Jan Kiszka 已提交
371

372 373
	kvm_deliver_exception_payload(&svm->vcpu);

374
	if (nr == BP_VECTOR && !nrips) {
375 376 377 378 379 380 381 382 383
		unsigned long rip, old_rip = kvm_rip_read(&svm->vcpu);

		/*
		 * For guest debugging where we have to reinject #BP if some
		 * INT3 is guest-owned:
		 * Emulate nRIP by moving RIP forward. Will fail if injection
		 * raises a fault that is not intercepted. Still better than
		 * failing in all cases.
		 */
384
		(void)skip_emulated_instruction(&svm->vcpu);
385 386 387 388 389
		rip = kvm_rip_read(&svm->vcpu);
		svm->int3_rip = rip + svm->vmcb->save.cs.base;
		svm->int3_injected = rip - old_rip;
	}

J
Jan Kiszka 已提交
390 391 392 393 394 395 396
	svm->vmcb->control.event_inj = nr
		| SVM_EVTINJ_VALID
		| (has_error_code ? SVM_EVTINJ_VALID_ERR : 0)
		| SVM_EVTINJ_TYPE_EXEPT;
	svm->vmcb->control.event_inj_err = error_code;
}

397 398 399 400 401 402
static void svm_init_erratum_383(void)
{
	u32 low, high;
	int err;
	u64 val;

403
	if (!static_cpu_has_bug(X86_BUG_AMD_TLB_MMATCH))
404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420
		return;

	/* Use _safe variants to not break nested virtualization */
	val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
	if (err)
		return;

	val |= (1ULL << 47);

	low  = lower_32_bits(val);
	high = upper_32_bits(val);

	native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);

	erratum_383_found = true;
}

421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441
static void svm_init_osvw(struct kvm_vcpu *vcpu)
{
	/*
	 * Guests should see errata 400 and 415 as fixed (assuming that
	 * HLT and IO instructions are intercepted).
	 */
	vcpu->arch.osvw.length = (osvw_len >= 3) ? (osvw_len) : 3;
	vcpu->arch.osvw.status = osvw_status & ~(6ULL);

	/*
	 * By increasing VCPU's osvw.length to 3 we are telling the guest that
	 * all osvw.status bits inside that length, including bit 0 (which is
	 * reserved for erratum 298), are valid. However, if host processor's
	 * osvw_len is 0 then osvw_status[0] carries no information. We need to
	 * be conservative here and therefore we tell the guest that erratum 298
	 * is present (because we really don't know).
	 */
	if (osvw_len == 0 && boot_cpu_data.x86 == 0x10)
		vcpu->arch.osvw.status |= 1;
}

A
Avi Kivity 已提交
442 443
static int has_svm(void)
{
444
	const char *msg;
A
Avi Kivity 已提交
445

446
	if (!cpu_has_svm(&msg)) {
J
Joe Perches 已提交
447
		printk(KERN_INFO "has_svm: %s\n", msg);
A
Avi Kivity 已提交
448 449 450
		return 0;
	}

451 452 453 454 455
	if (sev_active()) {
		pr_info("KVM is unsupported when running as an SEV guest\n");
		return 0;
	}

A
Avi Kivity 已提交
456 457 458
	return 1;
}

459
static void svm_hardware_disable(void)
A
Avi Kivity 已提交
460
{
461 462 463 464
	/* Make sure we clean up behind us */
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR))
		wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);

465
	cpu_svm_disable();
466 467

	amd_pmu_disable_virt();
A
Avi Kivity 已提交
468 469
}

470
static int svm_hardware_enable(void)
A
Avi Kivity 已提交
471 472
{

473
	struct svm_cpu_data *sd;
A
Avi Kivity 已提交
474 475 476 477
	uint64_t efer;
	struct desc_struct *gdt;
	int me = raw_smp_processor_id();

478 479 480 481
	rdmsrl(MSR_EFER, efer);
	if (efer & EFER_SVME)
		return -EBUSY;

A
Avi Kivity 已提交
482
	if (!has_svm()) {
483
		pr_err("%s: err EOPNOTSUPP on %d\n", __func__, me);
484
		return -EINVAL;
A
Avi Kivity 已提交
485
	}
486 487
	sd = per_cpu(svm_data, me);
	if (!sd) {
488
		pr_err("%s: svm_data is NULL on %d\n", __func__, me);
489
		return -EINVAL;
A
Avi Kivity 已提交
490 491
	}

492 493 494
	sd->asid_generation = 1;
	sd->max_asid = cpuid_ebx(SVM_CPUID_FUNC) - 1;
	sd->next_asid = sd->max_asid + 1;
495
	sd->min_asid = max_sev_asid + 1;
A
Avi Kivity 已提交
496

497
	gdt = get_current_gdt_rw();
498
	sd->tss_desc = (struct kvm_ldttss_desc *)(gdt + GDT_ENTRY_TSS);
A
Avi Kivity 已提交
499

500
	wrmsrl(MSR_EFER, efer | EFER_SVME);
A
Avi Kivity 已提交
501

502
	wrmsrl(MSR_VM_HSAVE_PA, __sme_page_pa(sd->save_area));
503

504 505
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
506
		__this_cpu_write(current_tsc_ratio, TSC_RATIO_DEFAULT);
507 508
	}

509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538

	/*
	 * Get OSVW bits.
	 *
	 * Note that it is possible to have a system with mixed processor
	 * revisions and therefore different OSVW bits. If bits are not the same
	 * on different processors then choose the worst case (i.e. if erratum
	 * is present on one processor and not on another then assume that the
	 * erratum is present everywhere).
	 */
	if (cpu_has(&boot_cpu_data, X86_FEATURE_OSVW)) {
		uint64_t len, status = 0;
		int err;

		len = native_read_msr_safe(MSR_AMD64_OSVW_ID_LENGTH, &err);
		if (!err)
			status = native_read_msr_safe(MSR_AMD64_OSVW_STATUS,
						      &err);

		if (err)
			osvw_status = osvw_len = 0;
		else {
			if (len < osvw_len)
				osvw_len = len;
			osvw_status |= status;
			osvw_status &= (1ULL << osvw_len) - 1;
		}
	} else
		osvw_status = osvw_len = 0;

539 540
	svm_init_erratum_383();

541 542
	amd_pmu_enable_virt();

543
	return 0;
A
Avi Kivity 已提交
544 545
}

546 547
static void svm_cpu_uninit(int cpu)
{
548
	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
549

550
	if (!sd)
551 552
		return;

553
	per_cpu(svm_data, cpu) = NULL;
554
	kfree(sd->sev_vmcbs);
555 556
	__free_page(sd->save_area);
	kfree(sd);
557 558
}

A
Avi Kivity 已提交
559 560
static int svm_cpu_init(int cpu)
{
561
	struct svm_cpu_data *sd;
A
Avi Kivity 已提交
562

563 564
	sd = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL);
	if (!sd)
A
Avi Kivity 已提交
565
		return -ENOMEM;
566
	sd->cpu = cpu;
567
	sd->save_area = alloc_page(GFP_KERNEL);
568
	if (!sd->save_area)
569
		goto free_cpu_data;
570
	clear_page(page_address(sd->save_area));
A
Avi Kivity 已提交
571

572
	if (svm_sev_enabled()) {
573 574 575
		sd->sev_vmcbs = kmalloc_array(max_sev_asid + 1,
					      sizeof(void *),
					      GFP_KERNEL);
576
		if (!sd->sev_vmcbs)
577
			goto free_save_area;
578 579
	}

580
	per_cpu(svm_data, cpu) = sd;
A
Avi Kivity 已提交
581 582 583

	return 0;

584 585 586
free_save_area:
	__free_page(sd->save_area);
free_cpu_data:
587
	kfree(sd);
588
	return -ENOMEM;
A
Avi Kivity 已提交
589 590 591

}

592
static int direct_access_msr_slot(u32 msr)
593
{
594
	u32 i;
595 596

	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++)
597 598
		if (direct_access_msrs[i].index == msr)
			return i;
599

600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621
	return -ENOENT;
}

static void set_shadow_msr_intercept(struct kvm_vcpu *vcpu, u32 msr, int read,
				     int write)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	int slot = direct_access_msr_slot(msr);

	if (slot == -ENOENT)
		return;

	/* Set the shadow bitmaps to the desired intercept states */
	if (read)
		set_bit(slot, svm->shadow_msr_intercept.read);
	else
		clear_bit(slot, svm->shadow_msr_intercept.read);

	if (write)
		set_bit(slot, svm->shadow_msr_intercept.write);
	else
		clear_bit(slot, svm->shadow_msr_intercept.write);
622 623
}

624 625 626
static bool valid_msr_intercept(u32 index)
{
	return direct_access_msr_slot(index) != -ENOENT;
627 628
}

629
static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr)
630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647
{
	u8 bit_write;
	unsigned long tmp;
	u32 offset;
	u32 *msrpm;

	msrpm = is_guest_mode(vcpu) ? to_svm(vcpu)->nested.msrpm:
				      to_svm(vcpu)->msrpm;

	offset    = svm_msrpm_offset(msr);
	bit_write = 2 * (msr & 0x0f) + 1;
	tmp       = msrpm[offset];

	BUG_ON(offset == MSR_INVALID);

	return !!test_bit(bit_write,  &tmp);
}

648 649
static void set_msr_interception_bitmap(struct kvm_vcpu *vcpu, u32 *msrpm,
					u32 msr, int read, int write)
A
Avi Kivity 已提交
650
{
651 652 653
	u8 bit_read, bit_write;
	unsigned long tmp;
	u32 offset;
A
Avi Kivity 已提交
654

655 656 657 658 659 660
	/*
	 * If this warning triggers extend the direct_access_msrs list at the
	 * beginning of the file
	 */
	WARN_ON(!valid_msr_intercept(msr));

661 662 663 664 665 666 667
	/* Enforce non allowed MSRs to trap */
	if (read && !kvm_msr_allowed(vcpu, msr, KVM_MSR_FILTER_READ))
		read = 0;

	if (write && !kvm_msr_allowed(vcpu, msr, KVM_MSR_FILTER_WRITE))
		write = 0;

668 669 670 671 672 673 674 675 676 677 678
	offset    = svm_msrpm_offset(msr);
	bit_read  = 2 * (msr & 0x0f);
	bit_write = 2 * (msr & 0x0f) + 1;
	tmp       = msrpm[offset];

	BUG_ON(offset == MSR_INVALID);

	read  ? clear_bit(bit_read,  &tmp) : set_bit(bit_read,  &tmp);
	write ? clear_bit(bit_write, &tmp) : set_bit(bit_write, &tmp);

	msrpm[offset] = tmp;
A
Avi Kivity 已提交
679 680
}

681 682
void set_msr_interception(struct kvm_vcpu *vcpu, u32 *msrpm, u32 msr,
			  int read, int write)
A
Avi Kivity 已提交
683
{
684 685 686 687
	set_shadow_msr_intercept(vcpu, msr, read, write);
	set_msr_interception_bitmap(vcpu, msrpm, msr, read, write);
}

688
u32 *svm_vcpu_alloc_msrpm(void)
A
Avi Kivity 已提交
689
{
690
	struct page *pages = alloc_pages(GFP_KERNEL_ACCOUNT, MSRPM_ALLOC_ORDER);
691
	u32 *msrpm;
692 693 694

	if (!pages)
		return NULL;
A
Avi Kivity 已提交
695

696
	msrpm = page_address(pages);
697 698
	memset(msrpm, 0xff, PAGE_SIZE * (1 << MSRPM_ALLOC_ORDER));

699 700 701
	return msrpm;
}

702
void svm_vcpu_init_msrpm(struct kvm_vcpu *vcpu, u32 *msrpm)
703 704 705
{
	int i;

706 707 708
	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
		if (!direct_access_msrs[i].always)
			continue;
709
		set_msr_interception(vcpu, msrpm, direct_access_msrs[i].index, 1, 1);
710
	}
711
}
712

713 714

void svm_vcpu_free_msrpm(u32 *msrpm)
715 716
{
	__free_pages(virt_to_page(msrpm), MSRPM_ALLOC_ORDER);
717 718
}

719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734
static void svm_msr_filter_changed(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 i;

	/*
	 * Set intercept permissions for all direct access MSRs again. They
	 * will automatically get filtered through the MSR filter, so we are
	 * back in sync after this.
	 */
	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
		u32 msr = direct_access_msrs[i].index;
		u32 read = test_bit(i, svm->shadow_msr_intercept.read);
		u32 write = test_bit(i, svm->shadow_msr_intercept.write);

		set_msr_interception_bitmap(vcpu, svm->msrpm, msr, read, write);
735
	}
736 737
}

738 739 740 741 742 743 744 745
static void add_msr_offset(u32 offset)
{
	int i;

	for (i = 0; i < MSRPM_OFFSETS; ++i) {

		/* Offset already in list? */
		if (msrpm_offsets[i] == offset)
746
			return;
747 748 749 750 751 752 753 754 755

		/* Slot used by another offset? */
		if (msrpm_offsets[i] != MSR_INVALID)
			continue;

		/* Add offset to list */
		msrpm_offsets[i] = offset;

		return;
A
Avi Kivity 已提交
756
	}
757 758 759 760 761

	/*
	 * If this BUG triggers the msrpm_offsets table has an overflow. Just
	 * increase MSRPM_OFFSETS in this case.
	 */
762
	BUG();
A
Avi Kivity 已提交
763 764
}

765
static void init_msrpm_offsets(void)
766
{
767
	int i;
768

769 770 771 772 773 774 775 776 777 778
	memset(msrpm_offsets, 0xff, sizeof(msrpm_offsets));

	for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
		u32 offset;

		offset = svm_msrpm_offset(direct_access_msrs[i].index);
		BUG_ON(offset == MSR_INVALID);

		add_msr_offset(offset);
	}
779 780
}

781
static void svm_enable_lbrv(struct kvm_vcpu *vcpu)
782
{
783
	struct vcpu_svm *svm = to_svm(vcpu);
784

785
	svm->vmcb->control.virt_ext |= LBR_CTL_ENABLE_MASK;
786 787 788 789
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
790 791
}

792
static void svm_disable_lbrv(struct kvm_vcpu *vcpu)
793
{
794
	struct vcpu_svm *svm = to_svm(vcpu);
795

796
	svm->vmcb->control.virt_ext &= ~LBR_CTL_ENABLE_MASK;
797 798 799 800
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHFROMIP, 0, 0);
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHTOIP, 0, 0);
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTFROMIP, 0, 0);
	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
801 802
}

803
void disable_nmi_singlestep(struct vcpu_svm *svm)
804 805
{
	svm->nmi_singlestep = false;
806

807 808 809 810 811 812 813
	if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP)) {
		/* Clear our flags if they were not set by the guest */
		if (!(svm->nmi_singlestep_guest_rflags & X86_EFLAGS_TF))
			svm->vmcb->save.rflags &= ~X86_EFLAGS_TF;
		if (!(svm->nmi_singlestep_guest_rflags & X86_EFLAGS_RF))
			svm->vmcb->save.rflags &= ~X86_EFLAGS_RF;
	}
814 815
}

816 817 818 819 820 821 822 823 824 825 826
static void grow_ple_window(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;
	int old = control->pause_filter_count;

	control->pause_filter_count = __grow_ple_window(old,
							pause_filter_count,
							pause_filter_count_grow,
							pause_filter_count_max);

P
Peter Xu 已提交
827
	if (control->pause_filter_count != old) {
828
		vmcb_mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
P
Peter Xu 已提交
829 830 831
		trace_kvm_ple_window_update(vcpu->vcpu_id,
					    control->pause_filter_count, old);
	}
832 833 834 835 836 837 838 839 840 841 842 843 844
}

static void shrink_ple_window(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;
	int old = control->pause_filter_count;

	control->pause_filter_count =
				__shrink_ple_window(old,
						    pause_filter_count,
						    pause_filter_count_shrink,
						    pause_filter_count);
P
Peter Xu 已提交
845
	if (control->pause_filter_count != old) {
846
		vmcb_mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
P
Peter Xu 已提交
847 848 849
		trace_kvm_ple_window_update(vcpu->vcpu_id,
					    control->pause_filter_count, old);
	}
850 851
}

852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889
/*
 * The default MMIO mask is a single bit (excluding the present bit),
 * which could conflict with the memory encryption bit. Check for
 * memory encryption support and override the default MMIO mask if
 * memory encryption is enabled.
 */
static __init void svm_adjust_mmio_mask(void)
{
	unsigned int enc_bit, mask_bit;
	u64 msr, mask;

	/* If there is no memory encryption support, use existing mask */
	if (cpuid_eax(0x80000000) < 0x8000001f)
		return;

	/* If memory encryption is not enabled, use existing mask */
	rdmsrl(MSR_K8_SYSCFG, msr);
	if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT))
		return;

	enc_bit = cpuid_ebx(0x8000001f) & 0x3f;
	mask_bit = boot_cpu_data.x86_phys_bits;

	/* Increment the mask bit if it is the same as the encryption bit */
	if (enc_bit == mask_bit)
		mask_bit++;

	/*
	 * If the mask bit location is below 52, then some bits above the
	 * physical addressing limit will always be reserved, so use the
	 * rsvd_bits() function to generate the mask. This mask, along with
	 * the present bit, will be used to generate a page fault with
	 * PFER.RSV = 1.
	 *
	 * If the mask bit location is 52 (or above), then clear the mask.
	 */
	mask = (mask_bit < 52) ? rsvd_bits(mask_bit, 51) | PT_PRESENT_MASK : 0;

P
Paolo Bonzini 已提交
890
	kvm_mmu_set_mmio_spte_mask(mask, PT_WRITABLE_MASK | PT_USER_MASK);
891 892
}

893 894 895 896
static void svm_hardware_teardown(void)
{
	int cpu;

897 898
	if (svm_sev_enabled())
		sev_hardware_teardown();
899 900 901 902 903 904 905 906

	for_each_possible_cpu(cpu)
		svm_cpu_uninit(cpu);

	__free_pages(pfn_to_page(iopm_base >> PAGE_SHIFT), IOPM_ALLOC_ORDER);
	iopm_base = 0;
}

907 908 909 910
static __init void svm_set_cpu_caps(void)
{
	kvm_set_cpu_caps();

911 912
	supported_xss = 0;

913 914
	/* CPUID 0x80000001 and 0x8000000A (SVM features) */
	if (nested) {
915 916
		kvm_cpu_cap_set(X86_FEATURE_SVM);

917
		if (nrips)
918 919 920 921
			kvm_cpu_cap_set(X86_FEATURE_NRIPS);

		if (npt_enabled)
			kvm_cpu_cap_set(X86_FEATURE_NPT);
922 923 924

		/* Nested VM can receive #VMEXIT instead of triggering #GP */
		kvm_cpu_cap_set(X86_FEATURE_SVME_ADDR_CHK);
925 926
	}

927 928 929 930
	/* CPUID 0x80000008 */
	if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD) ||
	    boot_cpu_has(X86_FEATURE_AMD_SSBD))
		kvm_cpu_cap_set(X86_FEATURE_VIRT_SSBD);
931 932 933

	/* Enable INVPCID feature */
	kvm_cpu_cap_check_and_set(X86_FEATURE_INVPCID);
934 935
}

A
Avi Kivity 已提交
936 937 938 939
static __init int svm_hardware_setup(void)
{
	int cpu;
	struct page *iopm_pages;
940
	void *iopm_va;
A
Avi Kivity 已提交
941 942 943 944 945 946
	int r;

	iopm_pages = alloc_pages(GFP_KERNEL, IOPM_ALLOC_ORDER);

	if (!iopm_pages)
		return -ENOMEM;
947 948 949

	iopm_va = page_address(iopm_pages);
	memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
A
Avi Kivity 已提交
950 951
	iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;

952 953
	init_msrpm_offsets();

954 955
	supported_xcr0 &= ~(XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR);

956 957 958
	if (boot_cpu_has(X86_FEATURE_NX))
		kvm_enable_efer_bits(EFER_NX);

A
Alexander Graf 已提交
959 960 961
	if (boot_cpu_has(X86_FEATURE_FXSR_OPT))
		kvm_enable_efer_bits(EFER_FFXSR);

962 963
	if (boot_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		kvm_has_tsc_control = true;
964 965
		kvm_max_tsc_scaling_ratio = TSC_RATIO_MAX;
		kvm_tsc_scaling_ratio_frac_bits = 32;
966 967
	}

968 969 970 971 972 973 974 975
	/* Check for pause filtering support */
	if (!boot_cpu_has(X86_FEATURE_PAUSEFILTER)) {
		pause_filter_count = 0;
		pause_filter_thresh = 0;
	} else if (!boot_cpu_has(X86_FEATURE_PFTHRESHOLD)) {
		pause_filter_thresh = 0;
	}

976 977
	if (nested) {
		printk(KERN_INFO "kvm: Nested Virtualization enabled\n");
978
		kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE);
979 980
	}

981 982 983 984 985
	if (IS_ENABLED(CONFIG_KVM_AMD_SEV) && sev) {
		sev_hardware_setup();
	} else {
		sev = false;
		sev_es = false;
B
Brijesh Singh 已提交
986 987
	}

988 989
	svm_adjust_mmio_mask();

Z
Zachary Amsden 已提交
990
	for_each_possible_cpu(cpu) {
A
Avi Kivity 已提交
991 992
		r = svm_cpu_init(cpu);
		if (r)
993
			goto err;
A
Avi Kivity 已提交
994
	}
995

996
	if (!boot_cpu_has(X86_FEATURE_NPT))
997 998
		npt_enabled = false;

999
	if (npt_enabled && !npt)
1000 1001
		npt_enabled = false;

1002
	kvm_configure_mmu(npt_enabled, get_max_npt_level(), PG_LEVEL_1G);
1003
	pr_info("kvm: Nested Paging %sabled\n", npt_enabled ? "en" : "dis");
1004

1005 1006 1007 1008 1009
	if (nrips) {
		if (!boot_cpu_has(X86_FEATURE_NRIPS))
			nrips = false;
	}

1010 1011 1012
	if (avic) {
		if (!npt_enabled ||
		    !boot_cpu_has(X86_FEATURE_AVIC) ||
1013
		    !IS_ENABLED(CONFIG_X86_LOCAL_APIC)) {
1014
			avic = false;
1015
		} else {
1016
			pr_info("AVIC enabled\n");
1017 1018 1019

			amd_iommu_register_ga_log_notifier(&avic_ga_log_notifier);
		}
1020
	}
1021

1022 1023
	if (vls) {
		if (!npt_enabled ||
1024
		    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
1025 1026 1027 1028 1029 1030 1031
		    !IS_ENABLED(CONFIG_X86_64)) {
			vls = false;
		} else {
			pr_info("Virtual VMLOAD VMSAVE supported\n");
		}
	}

1032 1033 1034
	if (boot_cpu_has(X86_FEATURE_SVME_ADDR_CHK))
		svm_gp_erratum_intercept = false;

1035 1036 1037 1038 1039 1040 1041
	if (vgif) {
		if (!boot_cpu_has(X86_FEATURE_VGIF))
			vgif = false;
		else
			pr_info("Virtual GIF supported\n");
	}

1042
	svm_set_cpu_caps();
1043

1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058
	/*
	 * It seems that on AMD processors PTE's accessed bit is
	 * being set by the CPU hardware before the NPF vmexit.
	 * This is not expected behaviour and our tests fail because
	 * of it.
	 * A workaround here is to disable support for
	 * GUEST_MAXPHYADDR < HOST_MAXPHYADDR if NPT is enabled.
	 * In this case userspace can know if there is support using
	 * KVM_CAP_SMALLER_MAXPHYADDR extension and decide how to handle
	 * it
	 * If future AMD CPU models change the behaviour described above,
	 * this variable can be changed accordingly
	 */
	allow_smaller_maxphyaddr = !npt_enabled;

A
Avi Kivity 已提交
1059 1060
	return 0;

1061
err:
1062
	svm_hardware_teardown();
A
Avi Kivity 已提交
1063 1064 1065 1066 1067 1068 1069
	return r;
}

static void init_seg(struct vmcb_seg *seg)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | SVM_SELECTOR_S_MASK |
J
Joerg Roedel 已提交
1070
		      SVM_SELECTOR_WRITE_MASK; /* Read/Write Data Segment */
A
Avi Kivity 已提交
1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082
	seg->limit = 0xffff;
	seg->base = 0;
}

static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | type;
	seg->limit = 0xffff;
	seg->base = 0;
}

1083
static u64 svm_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
1084 1085 1086 1087
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 g_tsc_offset = 0;

1088
	if (is_guest_mode(vcpu)) {
1089
		/* Write L1's TSC offset.  */
1090 1091 1092
		g_tsc_offset = svm->vmcb->control.tsc_offset -
			       svm->nested.hsave->control.tsc_offset;
		svm->nested.hsave->control.tsc_offset = offset;
1093 1094 1095 1096 1097
	}

	trace_kvm_write_tsc_offset(vcpu->vcpu_id,
				   svm->vmcb->control.tsc_offset - g_tsc_offset,
				   offset);
1098 1099

	svm->vmcb->control.tsc_offset = offset + g_tsc_offset;
1100

1101
	vmcb_mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
1102
	return svm->vmcb->control.tsc_offset;
1103 1104
}

1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119
static void svm_check_invpcid(struct vcpu_svm *svm)
{
	/*
	 * Intercept INVPCID instruction only if shadow page table is
	 * enabled. Interception is not required with nested page table
	 * enabled.
	 */
	if (kvm_cpu_cap_has(X86_FEATURE_INVPCID)) {
		if (!npt_enabled)
			svm_set_intercept(svm, INTERCEPT_INVPCID);
		else
			svm_clr_intercept(svm, INTERCEPT_INVPCID);
	}
}

P
Paolo Bonzini 已提交
1120
static void init_vmcb(struct vcpu_svm *svm)
A
Avi Kivity 已提交
1121
{
1122 1123
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;
A
Avi Kivity 已提交
1124

1125
	svm->vcpu.arch.hflags = 0;
1126

1127 1128 1129 1130 1131 1132
	svm_set_intercept(svm, INTERCEPT_CR0_READ);
	svm_set_intercept(svm, INTERCEPT_CR3_READ);
	svm_set_intercept(svm, INTERCEPT_CR4_READ);
	svm_set_intercept(svm, INTERCEPT_CR0_WRITE);
	svm_set_intercept(svm, INTERCEPT_CR3_WRITE);
	svm_set_intercept(svm, INTERCEPT_CR4_WRITE);
1133
	if (!kvm_vcpu_apicv_active(&svm->vcpu))
1134
		svm_set_intercept(svm, INTERCEPT_CR8_WRITE);
A
Avi Kivity 已提交
1135

1136
	set_dr_intercepts(svm);
A
Avi Kivity 已提交
1137

1138 1139 1140
	set_exception_intercept(svm, PF_VECTOR);
	set_exception_intercept(svm, UD_VECTOR);
	set_exception_intercept(svm, MC_VECTOR);
1141
	set_exception_intercept(svm, AC_VECTOR);
1142
	set_exception_intercept(svm, DB_VECTOR);
1143 1144 1145 1146 1147 1148 1149 1150
	/*
	 * Guest access to VMware backdoor ports could legitimately
	 * trigger #GP because of TSS I/O permission bitmap.
	 * We intercept those #GP and allow access to them anyway
	 * as VMware does.
	 */
	if (enable_vmware_backdoor)
		set_exception_intercept(svm, GP_VECTOR);
A
Avi Kivity 已提交
1151

1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175
	svm_set_intercept(svm, INTERCEPT_INTR);
	svm_set_intercept(svm, INTERCEPT_NMI);
	svm_set_intercept(svm, INTERCEPT_SMI);
	svm_set_intercept(svm, INTERCEPT_SELECTIVE_CR0);
	svm_set_intercept(svm, INTERCEPT_RDPMC);
	svm_set_intercept(svm, INTERCEPT_CPUID);
	svm_set_intercept(svm, INTERCEPT_INVD);
	svm_set_intercept(svm, INTERCEPT_INVLPG);
	svm_set_intercept(svm, INTERCEPT_INVLPGA);
	svm_set_intercept(svm, INTERCEPT_IOIO_PROT);
	svm_set_intercept(svm, INTERCEPT_MSR_PROT);
	svm_set_intercept(svm, INTERCEPT_TASK_SWITCH);
	svm_set_intercept(svm, INTERCEPT_SHUTDOWN);
	svm_set_intercept(svm, INTERCEPT_VMRUN);
	svm_set_intercept(svm, INTERCEPT_VMMCALL);
	svm_set_intercept(svm, INTERCEPT_VMLOAD);
	svm_set_intercept(svm, INTERCEPT_VMSAVE);
	svm_set_intercept(svm, INTERCEPT_STGI);
	svm_set_intercept(svm, INTERCEPT_CLGI);
	svm_set_intercept(svm, INTERCEPT_SKINIT);
	svm_set_intercept(svm, INTERCEPT_WBINVD);
	svm_set_intercept(svm, INTERCEPT_XSETBV);
	svm_set_intercept(svm, INTERCEPT_RDPRU);
	svm_set_intercept(svm, INTERCEPT_RSM);
A
Avi Kivity 已提交
1176

1177
	if (!kvm_mwait_in_guest(svm->vcpu.kvm)) {
1178 1179
		svm_set_intercept(svm, INTERCEPT_MONITOR);
		svm_set_intercept(svm, INTERCEPT_MWAIT);
1180 1181
	}

1182
	if (!kvm_hlt_in_guest(svm->vcpu.kvm))
1183
		svm_set_intercept(svm, INTERCEPT_HLT);
1184

1185 1186
	control->iopm_base_pa = __sme_set(iopm_base);
	control->msrpm_base_pa = __sme_set(__pa(svm->msrpm));
A
Avi Kivity 已提交
1187 1188 1189 1190 1191 1192 1193 1194 1195
	control->int_ctl = V_INTR_MASKING_MASK;

	init_seg(&save->es);
	init_seg(&save->ss);
	init_seg(&save->ds);
	init_seg(&save->fs);
	init_seg(&save->gs);

	save->cs.selector = 0xf000;
1196
	save->cs.base = 0xffff0000;
A
Avi Kivity 已提交
1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207
	/* Executable/Readable Code Segment */
	save->cs.attrib = SVM_SELECTOR_READ_MASK | SVM_SELECTOR_P_MASK |
		SVM_SELECTOR_S_MASK | SVM_SELECTOR_CODE_MASK;
	save->cs.limit = 0xffff;

	save->gdtr.limit = 0xffff;
	save->idtr.limit = 0xffff;

	init_sys_seg(&save->ldtr, SEG_TYPE_LDT);
	init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16);

P
Paolo Bonzini 已提交
1208
	svm_set_efer(&svm->vcpu, 0);
M
Mike Day 已提交
1209
	save->dr6 = 0xffff0ff0;
1210
	kvm_set_rflags(&svm->vcpu, X86_EFLAGS_FIXED);
A
Avi Kivity 已提交
1211
	save->rip = 0x0000fff0;
1212
	svm->vcpu.arch.regs[VCPU_REGS_RIP] = save->rip;
A
Avi Kivity 已提交
1213

J
Joerg Roedel 已提交
1214
	/*
1215
	 * svm_set_cr0() sets PG and WP and clears NW and CD on save->cr0.
1216
	 * It also updates the guest-visible cr0 value.
A
Avi Kivity 已提交
1217
	 */
1218
	svm_set_cr0(&svm->vcpu, X86_CR0_NW | X86_CR0_CD | X86_CR0_ET);
1219
	kvm_mmu_reset_context(&svm->vcpu);
1220

1221
	save->cr4 = X86_CR4_PAE;
A
Avi Kivity 已提交
1222
	/* rdx = ?? */
1223 1224 1225

	if (npt_enabled) {
		/* Setup VMCB for Nested Paging */
1226
		control->nested_ctl |= SVM_NESTED_CTL_NP_ENABLE;
1227
		svm_clr_intercept(svm, INTERCEPT_INVLPG);
1228
		clr_exception_intercept(svm, PF_VECTOR);
1229 1230
		svm_clr_intercept(svm, INTERCEPT_CR3_READ);
		svm_clr_intercept(svm, INTERCEPT_CR3_WRITE);
1231
		save->g_pat = svm->vcpu.arch.pat;
1232 1233 1234
		save->cr3 = 0;
		save->cr4 = 0;
	}
1235
	svm->asid_generation = 0;
C
Cathy Avery 已提交
1236
	svm->asid = 0;
1237

1238
	svm->nested.vmcb12_gpa = 0;
1239 1240
	svm->vcpu.arch.hflags = 0;

1241
	if (!kvm_pause_in_guest(svm->vcpu.kvm)) {
1242 1243 1244
		control->pause_filter_count = pause_filter_count;
		if (pause_filter_thresh)
			control->pause_filter_thresh = pause_filter_thresh;
1245
		svm_set_intercept(svm, INTERCEPT_PAUSE);
1246
	} else {
1247
		svm_clr_intercept(svm, INTERCEPT_PAUSE);
1248 1249
	}

1250 1251
	svm_check_invpcid(svm);

1252
	if (kvm_vcpu_apicv_active(&svm->vcpu))
1253 1254
		avic_init_vmcb(svm);

1255 1256 1257 1258 1259
	/*
	 * If hardware supports Virtual VMLOAD VMSAVE then enable it
	 * in VMCB and clear intercepts to avoid #VMEXIT.
	 */
	if (vls) {
1260 1261
		svm_clr_intercept(svm, INTERCEPT_VMLOAD);
		svm_clr_intercept(svm, INTERCEPT_VMSAVE);
1262 1263 1264
		svm->vmcb->control.virt_ext |= VIRTUAL_VMLOAD_VMSAVE_ENABLE_MASK;
	}

1265
	if (vgif) {
1266 1267
		svm_clr_intercept(svm, INTERCEPT_STGI);
		svm_clr_intercept(svm, INTERCEPT_CLGI);
1268 1269 1270
		svm->vmcb->control.int_ctl |= V_GIF_ENABLE_MASK;
	}

1271
	if (sev_guest(svm->vcpu.kvm)) {
B
Brijesh Singh 已提交
1272
		svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE;
1273
		clr_exception_intercept(svm, UD_VECTOR);
1274 1275 1276 1277 1278

		if (sev_es_guest(svm->vcpu.kvm)) {
			/* Perform SEV-ES specific VMCB updates */
			sev_es_init_vmcb(svm);
		}
1279
	}
B
Brijesh Singh 已提交
1280

1281
	vmcb_mark_all_dirty(svm->vmcb);
1282

1283
	enable_gif(svm);
1284 1285 1286

}

1287
static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
1288 1289
{
	struct vcpu_svm *svm = to_svm(vcpu);
1290 1291
	u32 dummy;
	u32 eax = 1;
1292

1293
	svm->spec_ctrl = 0;
1294
	svm->virt_spec_ctrl = 0;
1295

1296 1297 1298 1299 1300 1301
	if (!init_event) {
		svm->vcpu.arch.apic_base = APIC_DEFAULT_PHYS_BASE |
					   MSR_IA32_APICBASE_ENABLE;
		if (kvm_vcpu_is_reset_bsp(&svm->vcpu))
			svm->vcpu.arch.apic_base |= MSR_IA32_APICBASE_BSP;
	}
P
Paolo Bonzini 已提交
1302
	init_vmcb(svm);
A
Avi Kivity 已提交
1303

1304
	kvm_cpuid(vcpu, &eax, &dummy, &dummy, &dummy, false);
1305
	kvm_rdx_write(vcpu, eax);
1306 1307 1308

	if (kvm_vcpu_apicv_active(vcpu) && !init_event)
		avic_update_vapic_bar(svm, APIC_DEFAULT_PHYS_BASE);
1309 1310
}

1311
static int svm_create_vcpu(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1312
{
1313
	struct vcpu_svm *svm;
1314
	struct page *vmcb_page;
1315
	struct page *vmsa_page = NULL;
R
Rusty Russell 已提交
1316
	int err;
A
Avi Kivity 已提交
1317

1318 1319
	BUILD_BUG_ON(offsetof(struct vcpu_svm, vcpu) != 0);
	svm = to_svm(vcpu);
R
Rusty Russell 已提交
1320

1321
	err = -ENOMEM;
1322
	vmcb_page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
1323
	if (!vmcb_page)
1324
		goto out;
A
Avi Kivity 已提交
1325

1326 1327 1328 1329 1330 1331 1332 1333
	if (sev_es_guest(svm->vcpu.kvm)) {
		/*
		 * SEV-ES guests require a separate VMSA page used to contain
		 * the encrypted register state of the guest.
		 */
		vmsa_page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
		if (!vmsa_page)
			goto error_free_vmcb_page;
1334 1335 1336 1337 1338 1339 1340 1341

		/*
		 * SEV-ES guests maintain an encrypted version of their FPU
		 * state which is restored and saved on VMRUN and VMEXIT.
		 * Free the fpu structure to prevent KVM from attempting to
		 * access the FPU state.
		 */
		kvm_free_guest_fpu(vcpu);
1342 1343
	}

1344 1345
	err = avic_init_vcpu(svm);
	if (err)
1346
		goto error_free_vmsa_page;
1347

1348 1349 1350
	/* We initialize this flag to true to make sure that the is_running
	 * bit would be set the first time the vcpu is loaded.
	 */
1351 1352
	if (irqchip_in_kernel(vcpu->kvm) && kvm_apicv_activated(vcpu->kvm))
		svm->avic_is_running = true;
1353

1354
	svm->msrpm = svm_vcpu_alloc_msrpm();
1355 1356
	if (!svm->msrpm) {
		err = -ENOMEM;
1357
		goto error_free_vmsa_page;
1358
	}
1359

1360
	svm_vcpu_init_msrpm(vcpu, svm->msrpm);
A
Alexander Graf 已提交
1361

1362 1363
	svm->vmcb = page_address(vmcb_page);
	svm->vmcb_pa = __sme_set(page_to_pfn(vmcb_page) << PAGE_SHIFT);
1364 1365 1366 1367

	if (vmsa_page)
		svm->vmsa = page_address(vmsa_page);

1368
	svm->asid_generation = 0;
1369
	svm->guest_state_loaded = false;
P
Paolo Bonzini 已提交
1370
	init_vmcb(svm);
A
Avi Kivity 已提交
1371

1372
	svm_init_osvw(vcpu);
1373
	vcpu->arch.microcode_version = 0x01000065;
1374

1375 1376 1377 1378
	if (sev_es_guest(svm->vcpu.kvm))
		/* Perform SEV-ES specific VMCB creation updates */
		sev_es_create_vcpu(svm);

1379
	return 0;
1380

1381 1382 1383
error_free_vmsa_page:
	if (vmsa_page)
		__free_page(vmsa_page);
1384
error_free_vmcb_page:
1385
	__free_page(vmcb_page);
1386
out:
1387
	return err;
A
Avi Kivity 已提交
1388 1389
}

1390 1391 1392 1393 1394 1395 1396 1397
static void svm_clear_current_vmcb(struct vmcb *vmcb)
{
	int i;

	for_each_online_cpu(i)
		cmpxchg(&per_cpu(svm_data, i)->current_vmcb, vmcb, NULL);
}

A
Avi Kivity 已提交
1398 1399
static void svm_free_vcpu(struct kvm_vcpu *vcpu)
{
1400 1401
	struct vcpu_svm *svm = to_svm(vcpu);

1402 1403 1404 1405 1406 1407 1408
	/*
	 * The vmcb page can be recycled, causing a false negative in
	 * svm_vcpu_load(). So, ensure that no logical CPU has this
	 * vmcb page recorded as its current vmcb.
	 */
	svm_clear_current_vmcb(svm->vmcb);

1409 1410
	svm_free_nested(svm);

1411 1412
	sev_free_vcpu(vcpu);

1413
	__free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT));
1414
	__free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
A
Avi Kivity 已提交
1415 1416
}

1417
static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1418
{
1419
	struct vcpu_svm *svm = to_svm(vcpu);
1420 1421
	struct svm_cpu_data *sd = per_cpu(svm_data, vcpu->cpu);
	unsigned int i;
1422

1423 1424 1425 1426 1427 1428 1429 1430 1431 1432
	if (svm->guest_state_loaded)
		return;

	/*
	 * Certain MSRs are restored on VMEXIT (sev-es), or vmload of host save
	 * area (non-sev-es). Save ones that aren't so we can restore them
	 * individually later.
	 */
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
		rdmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
1433

1434 1435 1436 1437
	/*
	 * Save additional host state that will be restored on VMEXIT (sev-es)
	 * or subsequent vmload of host save area.
	 */
1438
	if (sev_es_guest(svm->vcpu.kvm)) {
1439
		sev_es_prepare_guest_switch(svm, vcpu->cpu);
1440
	} else {
1441
		vmsave(__sme_page_pa(sd->save_area));
1442
	}
1443

1444 1445 1446 1447 1448 1449
	if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) {
		u64 tsc_ratio = vcpu->arch.tsc_scaling_ratio;
		if (tsc_ratio != __this_cpu_read(current_tsc_ratio)) {
			__this_cpu_write(current_tsc_ratio, tsc_ratio);
			wrmsrl(MSR_AMD64_TSC_RATIO, tsc_ratio);
		}
1450
	}
1451

P
Paolo Bonzini 已提交
1452 1453 1454
	/* This assumes that the kernel never uses MSR_TSC_AUX */
	if (static_cpu_has(X86_FEATURE_RDTSCP))
		wrmsrl(MSR_TSC_AUX, svm->tsc_aux);
1455

1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486
	svm->guest_state_loaded = true;
}

static void svm_prepare_host_switch(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	unsigned int i;

	if (!svm->guest_state_loaded)
		return;

	/*
	 * Certain MSRs are restored on VMEXIT (sev-es), or vmload of host save
	 * area (non-sev-es). Restore the ones that weren't.
	 */
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
		wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);

	svm->guest_state_loaded = false;
}

static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);

	if (unlikely(cpu != vcpu->cpu)) {
		svm->asid_generation = 0;
		vmcb_mark_all_dirty(svm->vmcb);
	}

A
Ashok Raj 已提交
1487 1488 1489 1490
	if (sd->current_vmcb != svm->vmcb) {
		sd->current_vmcb = svm->vmcb;
		indirect_branch_prediction_barrier();
	}
1491
	avic_vcpu_load(vcpu, cpu);
A
Avi Kivity 已提交
1492 1493 1494 1495
}

static void svm_vcpu_put(struct kvm_vcpu *vcpu)
{
1496
	avic_vcpu_put(vcpu);
1497
	svm_prepare_host_switch(vcpu);
1498

1499
	++vcpu->stat.host_state_reload;
A
Avi Kivity 已提交
1500 1501 1502 1503
}

static unsigned long svm_get_rflags(struct kvm_vcpu *vcpu)
{
1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514
	struct vcpu_svm *svm = to_svm(vcpu);
	unsigned long rflags = svm->vmcb->save.rflags;

	if (svm->nmi_singlestep) {
		/* Hide our flags if they were not set by the guest */
		if (!(svm->nmi_singlestep_guest_rflags & X86_EFLAGS_TF))
			rflags &= ~X86_EFLAGS_TF;
		if (!(svm->nmi_singlestep_guest_rflags & X86_EFLAGS_RF))
			rflags &= ~X86_EFLAGS_RF;
	}
	return rflags;
A
Avi Kivity 已提交
1515 1516 1517 1518
}

static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
{
1519 1520 1521
	if (to_svm(vcpu)->nmi_singlestep)
		rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);

P
Paolo Bonzini 已提交
1522
       /*
A
Andrea Gelmini 已提交
1523
        * Any change of EFLAGS.VM is accompanied by a reload of SS
P
Paolo Bonzini 已提交
1524 1525 1526
        * (caused by either a task switch or an inter-privilege IRET),
        * so we do not need to update the CPL here.
        */
1527
	to_svm(vcpu)->vmcb->save.rflags = rflags;
A
Avi Kivity 已提交
1528 1529
}

A
Avi Kivity 已提交
1530 1531 1532 1533 1534
static void svm_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
{
	switch (reg) {
	case VCPU_EXREG_PDPTR:
		BUG_ON(!npt_enabled);
1535
		load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu));
A
Avi Kivity 已提交
1536 1537
		break;
	default:
1538
		WARN_ON_ONCE(1);
A
Avi Kivity 已提交
1539 1540 1541
	}
}

1542
static void svm_set_vintr(struct vcpu_svm *svm)
1543 1544 1545 1546 1547
{
	struct vmcb_control_area *control;

	/* The following fields are ignored when AVIC is enabled */
	WARN_ON(kvm_vcpu_apicv_active(&svm->vcpu));
1548
	svm_set_intercept(svm, INTERCEPT_VINTR);
1549 1550 1551 1552 1553 1554 1555 1556 1557 1558

	/*
	 * This is just a dummy VINTR to actually cause a vmexit to happen.
	 * Actual injection of virtual interrupts happens through EVENTINJ.
	 */
	control = &svm->vmcb->control;
	control->int_vector = 0x0;
	control->int_ctl &= ~V_INTR_PRIO_MASK;
	control->int_ctl |= V_IRQ_MASK |
		((/*control->int_vector >> 4*/ 0xf) << V_INTR_PRIO_SHIFT);
1559
	vmcb_mark_dirty(svm->vmcb, VMCB_INTR);
1560 1561
}

1562 1563
static void svm_clear_vintr(struct vcpu_svm *svm)
{
1564
	const u32 mask = V_TPR_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK | V_INTR_MASKING_MASK;
1565
	svm_clr_intercept(svm, INTERCEPT_VINTR);
1566

1567 1568 1569
	/* Drop int_ctl fields related to VINTR injection.  */
	svm->vmcb->control.int_ctl &= mask;
	if (is_guest_mode(&svm->vcpu)) {
1570 1571
		svm->nested.hsave->control.int_ctl &= mask;

1572 1573 1574 1575 1576
		WARN_ON((svm->vmcb->control.int_ctl & V_TPR_MASK) !=
			(svm->nested.ctl.int_ctl & V_TPR_MASK));
		svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl & ~mask;
	}

1577
	vmcb_mark_dirty(svm->vmcb, VMCB_INTR);
1578 1579
}

A
Avi Kivity 已提交
1580 1581
static struct vmcb_seg *svm_seg(struct kvm_vcpu *vcpu, int seg)
{
1582
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
A
Avi Kivity 已提交
1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594

	switch (seg) {
	case VCPU_SREG_CS: return &save->cs;
	case VCPU_SREG_DS: return &save->ds;
	case VCPU_SREG_ES: return &save->es;
	case VCPU_SREG_FS: return &save->fs;
	case VCPU_SREG_GS: return &save->gs;
	case VCPU_SREG_SS: return &save->ss;
	case VCPU_SREG_TR: return &save->tr;
	case VCPU_SREG_LDTR: return &save->ldtr;
	}
	BUG();
A
Al Viro 已提交
1595
	return NULL;
A
Avi Kivity 已提交
1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619
}

static u64 svm_get_segment_base(struct kvm_vcpu *vcpu, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	return s->base;
}

static void svm_get_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	var->base = s->base;
	var->limit = s->limit;
	var->selector = s->selector;
	var->type = s->attrib & SVM_SELECTOR_TYPE_MASK;
	var->s = (s->attrib >> SVM_SELECTOR_S_SHIFT) & 1;
	var->dpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
	var->present = (s->attrib >> SVM_SELECTOR_P_SHIFT) & 1;
	var->avl = (s->attrib >> SVM_SELECTOR_AVL_SHIFT) & 1;
	var->l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
	var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
1620 1621 1622 1623 1624 1625 1626 1627 1628 1629

	/*
	 * AMD CPUs circa 2014 track the G bit for all segments except CS.
	 * However, the SVM spec states that the G bit is not observed by the
	 * CPU, and some VMware virtual CPUs drop the G bit for all segments.
	 * So let's synthesize a legal G bit for all segments, this helps
	 * running KVM nested. It also helps cross-vendor migration, because
	 * Intel's vmentry has a check on the 'G' bit.
	 */
	var->g = s->limit > 0xfffff;
1630

J
Joerg Roedel 已提交
1631 1632
	/*
	 * AMD's VMCB does not have an explicit unusable field, so emulate it
1633 1634
	 * for cross vendor migration purposes by "not present"
	 */
1635
	var->unusable = !var->present;
1636

1637 1638 1639 1640 1641 1642
	switch (seg) {
	case VCPU_SREG_TR:
		/*
		 * Work around a bug where the busy flag in the tr selector
		 * isn't exposed
		 */
1643
		var->type |= 0x2;
1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658
		break;
	case VCPU_SREG_DS:
	case VCPU_SREG_ES:
	case VCPU_SREG_FS:
	case VCPU_SREG_GS:
		/*
		 * The accessed bit must always be set in the segment
		 * descriptor cache, although it can be cleared in the
		 * descriptor, the cached bit always remains at 1. Since
		 * Intel has a check on this, set it here to support
		 * cross-vendor migration.
		 */
		if (!var->unusable)
			var->type |= 0x1;
		break;
1659
	case VCPU_SREG_SS:
J
Joerg Roedel 已提交
1660 1661
		/*
		 * On AMD CPUs sometimes the DB bit in the segment
1662 1663 1664 1665 1666 1667
		 * descriptor is left as 1, although the whole segment has
		 * been made unusable. Clear it here to pass an Intel VMX
		 * entry check when cross vendor migrating.
		 */
		if (var->unusable)
			var->db = 0;
1668
		/* This is symmetric with svm_set_segment() */
J
Jan Kiszka 已提交
1669
		var->dpl = to_svm(vcpu)->vmcb->save.cpl;
1670
		break;
1671
	}
A
Avi Kivity 已提交
1672 1673
}

1674 1675 1676 1677 1678 1679 1680
static int svm_get_cpl(struct kvm_vcpu *vcpu)
{
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;

	return save->cpl;
}

1681
static void svm_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1682
{
1683 1684
	struct vcpu_svm *svm = to_svm(vcpu);

1685 1686
	dt->size = svm->vmcb->save.idtr.limit;
	dt->address = svm->vmcb->save.idtr.base;
A
Avi Kivity 已提交
1687 1688
}

1689
static void svm_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1690
{
1691 1692
	struct vcpu_svm *svm = to_svm(vcpu);

1693 1694
	svm->vmcb->save.idtr.limit = dt->size;
	svm->vmcb->save.idtr.base = dt->address ;
1695
	vmcb_mark_dirty(svm->vmcb, VMCB_DT);
A
Avi Kivity 已提交
1696 1697
}

1698
static void svm_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1699
{
1700 1701
	struct vcpu_svm *svm = to_svm(vcpu);

1702 1703
	dt->size = svm->vmcb->save.gdtr.limit;
	dt->address = svm->vmcb->save.gdtr.base;
A
Avi Kivity 已提交
1704 1705
}

1706
static void svm_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
A
Avi Kivity 已提交
1707
{
1708 1709
	struct vcpu_svm *svm = to_svm(vcpu);

1710 1711
	svm->vmcb->save.gdtr.limit = dt->size;
	svm->vmcb->save.gdtr.base = dt->address ;
1712
	vmcb_mark_dirty(svm->vmcb, VMCB_DT);
A
Avi Kivity 已提交
1713 1714
}

A
Avi Kivity 已提交
1715 1716
static void update_cr0_intercept(struct vcpu_svm *svm)
{
1717 1718 1719 1720 1721 1722 1723 1724 1725
	ulong gcr0;
	u64 *hcr0;

	/*
	 * SEV-ES guests must always keep the CR intercepts cleared. CR
	 * tracking is done using the CR write traps.
	 */
	if (sev_es_guest(svm->vcpu.kvm))
		return;
A
Avi Kivity 已提交
1726

1727 1728
	gcr0 = svm->vcpu.arch.cr0;
	hcr0 = &svm->vmcb->save.cr0;
1729 1730
	*hcr0 = (*hcr0 & ~SVM_CR0_SELECTIVE_MASK)
		| (gcr0 & SVM_CR0_SELECTIVE_MASK);
A
Avi Kivity 已提交
1731

1732
	vmcb_mark_dirty(svm->vmcb, VMCB_CR);
A
Avi Kivity 已提交
1733

1734
	if (gcr0 == *hcr0) {
1735 1736
		svm_clr_intercept(svm, INTERCEPT_CR0_READ);
		svm_clr_intercept(svm, INTERCEPT_CR0_WRITE);
A
Avi Kivity 已提交
1737
	} else {
1738 1739
		svm_set_intercept(svm, INTERCEPT_CR0_READ);
		svm_set_intercept(svm, INTERCEPT_CR0_WRITE);
A
Avi Kivity 已提交
1740 1741 1742
	}
}

1743
void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
A
Avi Kivity 已提交
1744
{
1745 1746
	struct vcpu_svm *svm = to_svm(vcpu);

1747
#ifdef CONFIG_X86_64
1748
	if (vcpu->arch.efer & EFER_LME && !vcpu->arch.guest_state_protected) {
1749
		if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
1750
			vcpu->arch.efer |= EFER_LMA;
1751
			svm->vmcb->save.efer |= EFER_LMA | EFER_LME;
A
Avi Kivity 已提交
1752 1753
		}

M
Mike Day 已提交
1754
		if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) {
1755
			vcpu->arch.efer &= ~EFER_LMA;
1756
			svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME);
A
Avi Kivity 已提交
1757 1758 1759
		}
	}
#endif
1760
	vcpu->arch.cr0 = cr0;
1761 1762 1763

	if (!npt_enabled)
		cr0 |= X86_CR0_PG | X86_CR0_WP;
1764

1765 1766 1767 1768 1769 1770 1771
	/*
	 * re-enable caching here because the QEMU bios
	 * does not do it - this results in some delay at
	 * reboot
	 */
	if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
		cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
1772
	svm->vmcb->save.cr0 = cr0;
1773
	vmcb_mark_dirty(svm->vmcb, VMCB_CR);
A
Avi Kivity 已提交
1774
	update_cr0_intercept(svm);
A
Avi Kivity 已提交
1775 1776
}

1777 1778 1779 1780 1781 1782
static bool svm_is_valid_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
{
	return true;
}

void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
A
Avi Kivity 已提交
1783
{
1784
	unsigned long host_cr4_mce = cr4_read_shadow() & X86_CR4_MCE;
1785
	unsigned long old_cr4 = vcpu->arch.cr4;
1786 1787

	if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
1788
		svm_flush_tlb(vcpu);
1789

1790 1791 1792
	vcpu->arch.cr4 = cr4;
	if (!npt_enabled)
		cr4 |= X86_CR4_PAE;
1793
	cr4 |= host_cr4_mce;
1794
	to_svm(vcpu)->vmcb->save.cr4 = cr4;
1795
	vmcb_mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
1796 1797 1798

	if ((cr4 ^ old_cr4) & (X86_CR4_OSXSAVE | X86_CR4_PKE))
		kvm_update_cpuid_runtime(vcpu);
A
Avi Kivity 已提交
1799 1800 1801 1802 1803
}

static void svm_set_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
1804
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
1805 1806 1807 1808 1809
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	s->base = var->base;
	s->limit = var->limit;
	s->selector = var->selector;
1810 1811 1812 1813 1814 1815 1816 1817
	s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
	s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
	s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
	s->attrib |= ((var->present & 1) && !var->unusable) << SVM_SELECTOR_P_SHIFT;
	s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
	s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
	s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
	s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
P
Paolo Bonzini 已提交
1818 1819 1820 1821 1822 1823 1824 1825

	/*
	 * This is always accurate, except if SYSRET returned to a segment
	 * with SS.DPL != 3.  Intel does not have this quirk, and always
	 * forces SS.DPL to 3 on sysret, so we ignore that case; fixing it
	 * would entail passing the CPL to userspace and back.
	 */
	if (seg == VCPU_SREG_SS)
1826 1827
		/* This is symmetric with svm_get_segment() */
		svm->vmcb->save.cpl = (var->dpl & 3);
A
Avi Kivity 已提交
1828

1829
	vmcb_mark_dirty(svm->vmcb, VMCB_SEG);
A
Avi Kivity 已提交
1830 1831
}

1832
static void svm_update_exception_bitmap(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1833
{
J
Jan Kiszka 已提交
1834 1835
	struct vcpu_svm *svm = to_svm(vcpu);

1836
	clr_exception_intercept(svm, BP_VECTOR);
1837

J
Jan Kiszka 已提交
1838 1839
	if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
		if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
1840
			set_exception_intercept(svm, BP_VECTOR);
1841
	}
1842 1843
}

1844
static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
A
Avi Kivity 已提交
1845
{
1846 1847
	if (sd->next_asid > sd->max_asid) {
		++sd->asid_generation;
1848
		sd->next_asid = sd->min_asid;
1849
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
C
Cathy Avery 已提交
1850
		vmcb_mark_dirty(svm->vmcb, VMCB_ASID);
A
Avi Kivity 已提交
1851 1852
	}

1853
	svm->asid_generation = sd->asid_generation;
C
Cathy Avery 已提交
1854
	svm->asid = sd->next_asid++;
A
Avi Kivity 已提交
1855 1856
}

1857
static void svm_set_dr6(struct vcpu_svm *svm, unsigned long value)
J
Jan Kiszka 已提交
1858
{
1859
	struct vmcb *vmcb = svm->vmcb;
J
Jan Kiszka 已提交
1860

1861 1862 1863
	if (svm->vcpu.arch.guest_state_protected)
		return;

1864 1865
	if (unlikely(value != vmcb->save.dr6)) {
		vmcb->save.dr6 = value;
1866
		vmcb_mark_dirty(vmcb, VMCB_DR);
1867
	}
J
Jan Kiszka 已提交
1868 1869
}

1870 1871 1872 1873
static void svm_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

1874 1875 1876
	if (vcpu->arch.guest_state_protected)
		return;

1877 1878 1879 1880
	get_debugreg(vcpu->arch.db[0], 0);
	get_debugreg(vcpu->arch.db[1], 1);
	get_debugreg(vcpu->arch.db[2], 2);
	get_debugreg(vcpu->arch.db[3], 3);
1881
	/*
1882
	 * We cannot reset svm->vmcb->save.dr6 to DR6_ACTIVE_LOW here,
1883 1884
	 * because db_interception might need it.  We can do it before vmentry.
	 */
1885
	vcpu->arch.dr6 = svm->vmcb->save.dr6;
1886 1887 1888 1889 1890
	vcpu->arch.dr7 = svm->vmcb->save.dr7;
	vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
	set_dr_intercepts(svm);
}

1891
static void svm_set_dr7(struct kvm_vcpu *vcpu, unsigned long value)
A
Avi Kivity 已提交
1892
{
1893 1894
	struct vcpu_svm *svm = to_svm(vcpu);

1895 1896 1897
	if (vcpu->arch.guest_state_protected)
		return;

1898
	svm->vmcb->save.dr7 = value;
1899
	vmcb_mark_dirty(svm->vmcb, VMCB_DR);
A
Avi Kivity 已提交
1900 1901
}

A
Avi Kivity 已提交
1902
static int pf_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
1903
{
1904
	u64 fault_address = __sme_clr(svm->vmcb->control.exit_info_2);
1905
	u64 error_code = svm->vmcb->control.exit_info_1;
A
Avi Kivity 已提交
1906

1907
	return kvm_handle_page_fault(&svm->vcpu, error_code, fault_address,
1908 1909
			static_cpu_has(X86_FEATURE_DECODEASSISTS) ?
			svm->vmcb->control.insn_bytes : NULL,
1910 1911 1912 1913 1914
			svm->vmcb->control.insn_len);
}

static int npf_interception(struct vcpu_svm *svm)
{
1915
	u64 fault_address = __sme_clr(svm->vmcb->control.exit_info_2);
1916 1917 1918 1919
	u64 error_code = svm->vmcb->control.exit_info_1;

	trace_kvm_page_fault(fault_address, error_code);
	return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code,
1920 1921
			static_cpu_has(X86_FEATURE_DECODEASSISTS) ?
			svm->vmcb->control.insn_bytes : NULL,
1922
			svm->vmcb->control.insn_len);
A
Avi Kivity 已提交
1923 1924
}

A
Avi Kivity 已提交
1925
static int db_interception(struct vcpu_svm *svm)
J
Jan Kiszka 已提交
1926
{
A
Avi Kivity 已提交
1927
	struct kvm_run *kvm_run = svm->vcpu.run;
1928
	struct kvm_vcpu *vcpu = &svm->vcpu;
A
Avi Kivity 已提交
1929

J
Jan Kiszka 已提交
1930
	if (!(svm->vcpu.guest_debug &
1931
	      (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
J
Jan Kiszka 已提交
1932
		!svm->nmi_singlestep) {
1933
		u32 payload = svm->vmcb->save.dr6 ^ DR6_ACTIVE_LOW;
1934
		kvm_queue_exception_p(&svm->vcpu, DB_VECTOR, payload);
J
Jan Kiszka 已提交
1935 1936
		return 1;
	}
1937

J
Jan Kiszka 已提交
1938
	if (svm->nmi_singlestep) {
1939
		disable_nmi_singlestep(svm);
1940 1941
		/* Make sure we check for pending NMIs upon entry */
		kvm_make_request(KVM_REQ_EVENT, vcpu);
1942 1943 1944
	}

	if (svm->vcpu.guest_debug &
J
Joerg Roedel 已提交
1945
	    (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) {
1946
		kvm_run->exit_reason = KVM_EXIT_DEBUG;
1947 1948
		kvm_run->debug.arch.dr6 = svm->vmcb->save.dr6;
		kvm_run->debug.arch.dr7 = svm->vmcb->save.dr7;
1949 1950 1951 1952 1953 1954 1955
		kvm_run->debug.arch.pc =
			svm->vmcb->save.cs.base + svm->vmcb->save.rip;
		kvm_run->debug.arch.exception = DB_VECTOR;
		return 0;
	}

	return 1;
J
Jan Kiszka 已提交
1956 1957
}

A
Avi Kivity 已提交
1958
static int bp_interception(struct vcpu_svm *svm)
J
Jan Kiszka 已提交
1959
{
A
Avi Kivity 已提交
1960 1961
	struct kvm_run *kvm_run = svm->vcpu.run;

J
Jan Kiszka 已提交
1962 1963 1964 1965 1966 1967
	kvm_run->exit_reason = KVM_EXIT_DEBUG;
	kvm_run->debug.arch.pc = svm->vmcb->save.cs.base + svm->vmcb->save.rip;
	kvm_run->debug.arch.exception = BP_VECTOR;
	return 0;
}

A
Avi Kivity 已提交
1968
static int ud_interception(struct vcpu_svm *svm)
1969
{
W
Wanpeng Li 已提交
1970
	return handle_ud(&svm->vcpu);
1971 1972
}

1973 1974 1975 1976 1977 1978
static int ac_interception(struct vcpu_svm *svm)
{
	kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
	return 1;
}

1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017
static bool is_erratum_383(void)
{
	int err, i;
	u64 value;

	if (!erratum_383_found)
		return false;

	value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
	if (err)
		return false;

	/* Bit 62 may or may not be set for this mce */
	value &= ~(1ULL << 62);

	if (value != 0xb600000000010015ULL)
		return false;

	/* Clear MCi_STATUS registers */
	for (i = 0; i < 6; ++i)
		native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);

	value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
	if (!err) {
		u32 low, high;

		value &= ~(1ULL << 2);
		low    = lower_32_bits(value);
		high   = upper_32_bits(value);

		native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
	}

	/* Flush tlb to evict multi-match entries */
	__flush_tlb_all();

	return true;
}

2018
static void svm_handle_mce(struct vcpu_svm *svm)
2019
{
2020 2021 2022 2023 2024 2025 2026
	if (is_erratum_383()) {
		/*
		 * Erratum 383 triggered. Guest state is corrupt so kill the
		 * guest.
		 */
		pr_err("KVM: Guest triggered AMD Erratum 383\n");

2027
		kvm_make_request(KVM_REQ_TRIPLE_FAULT, &svm->vcpu);
2028 2029 2030 2031

		return;
	}

2032 2033 2034 2035
	/*
	 * On an #MC intercept the MCE handler is not called automatically in
	 * the host. So do it by hand here.
	 */
2036
	kvm_machine_check();
2037 2038 2039 2040
}

static int mc_interception(struct vcpu_svm *svm)
{
2041 2042 2043
	return 1;
}

A
Avi Kivity 已提交
2044
static int shutdown_interception(struct vcpu_svm *svm)
2045
{
A
Avi Kivity 已提交
2046 2047
	struct kvm_run *kvm_run = svm->vcpu.run;

2048 2049 2050 2051 2052 2053 2054
	/*
	 * The VM save area has already been encrypted so it
	 * cannot be reinitialized - just terminate.
	 */
	if (sev_es_guest(svm->vcpu.kvm))
		return -EINVAL;

2055 2056 2057 2058
	/*
	 * VMCB is undefined after a SHUTDOWN intercept
	 * so reinitialize it.
	 */
2059
	clear_page(svm->vmcb);
P
Paolo Bonzini 已提交
2060
	init_vmcb(svm);
2061 2062 2063 2064 2065

	kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
	return 0;
}

A
Avi Kivity 已提交
2066
static int io_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2067
{
2068
	struct kvm_vcpu *vcpu = &svm->vcpu;
M
Mike Day 已提交
2069
	u32 io_info = svm->vmcb->control.exit_info_1; /* address size bug? */
2070
	int size, in, string;
2071
	unsigned port;
A
Avi Kivity 已提交
2072

R
Rusty Russell 已提交
2073
	++svm->vcpu.stat.io_exits;
2074
	string = (io_info & SVM_IOIO_STR_MASK) != 0;
2075 2076 2077
	in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
	port = io_info >> 16;
	size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
2078 2079 2080 2081 2082 2083 2084 2085

	if (string) {
		if (sev_es_guest(vcpu->kvm))
			return sev_es_string_io(svm, size, port, in);
		else
			return kvm_emulate_instruction(vcpu, 0);
	}

2086 2087
	svm->next_rip = svm->vmcb->control.exit_info_2;

2088
	return kvm_fast_pio(&svm->vcpu, size, port, in);
A
Avi Kivity 已提交
2089 2090
}

A
Avi Kivity 已提交
2091
static int nmi_interception(struct vcpu_svm *svm)
2092 2093 2094 2095
{
	return 1;
}

A
Avi Kivity 已提交
2096
static int intr_interception(struct vcpu_svm *svm)
2097 2098 2099 2100 2101
{
	++svm->vcpu.stat.irq_exits;
	return 1;
}

A
Avi Kivity 已提交
2102
static int nop_on_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2103 2104 2105 2106
{
	return 1;
}

A
Avi Kivity 已提交
2107
static int halt_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2108
{
R
Rusty Russell 已提交
2109
	return kvm_emulate_halt(&svm->vcpu);
A
Avi Kivity 已提交
2110 2111
}

A
Avi Kivity 已提交
2112
static int vmmcall_interception(struct vcpu_svm *svm)
2113
{
2114
	return kvm_emulate_hypercall(&svm->vcpu);
2115 2116
}

A
Avi Kivity 已提交
2117
static int vmload_interception(struct vcpu_svm *svm)
2118
{
2119
	struct vmcb *nested_vmcb;
2120
	struct kvm_host_map map;
2121
	int ret;
2122

2123 2124 2125
	if (nested_svm_check_permissions(svm))
		return 1;

2126 2127 2128 2129
	ret = kvm_vcpu_map(&svm->vcpu, gpa_to_gfn(svm->vmcb->save.rax), &map);
	if (ret) {
		if (ret == -EINVAL)
			kvm_inject_gp(&svm->vcpu, 0);
2130
		return 1;
2131 2132 2133
	}

	nested_vmcb = map.hva;
2134

2135
	ret = kvm_skip_emulated_instruction(&svm->vcpu);
2136

2137
	nested_svm_vmloadsave(nested_vmcb, svm->vmcb);
2138
	kvm_vcpu_unmap(&svm->vcpu, &map, true);
2139

2140
	return ret;
2141 2142
}

A
Avi Kivity 已提交
2143
static int vmsave_interception(struct vcpu_svm *svm)
2144
{
2145
	struct vmcb *nested_vmcb;
2146
	struct kvm_host_map map;
2147
	int ret;
2148

2149 2150 2151
	if (nested_svm_check_permissions(svm))
		return 1;

2152 2153 2154 2155
	ret = kvm_vcpu_map(&svm->vcpu, gpa_to_gfn(svm->vmcb->save.rax), &map);
	if (ret) {
		if (ret == -EINVAL)
			kvm_inject_gp(&svm->vcpu, 0);
2156
		return 1;
2157 2158 2159
	}

	nested_vmcb = map.hva;
2160

2161
	ret = kvm_skip_emulated_instruction(&svm->vcpu);
2162

2163
	nested_svm_vmloadsave(svm->vmcb, nested_vmcb);
2164
	kvm_vcpu_unmap(&svm->vcpu, &map, true);
2165

2166
	return ret;
2167 2168
}

A
Avi Kivity 已提交
2169
static int vmrun_interception(struct vcpu_svm *svm)
A
Alexander Graf 已提交
2170 2171 2172 2173
{
	if (nested_svm_check_permissions(svm))
		return 1;

2174
	return nested_svm_vmrun(svm);
A
Alexander Graf 已提交
2175 2176
}

2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207
enum {
	NONE_SVM_INSTR,
	SVM_INSTR_VMRUN,
	SVM_INSTR_VMLOAD,
	SVM_INSTR_VMSAVE,
};

/* Return NONE_SVM_INSTR if not SVM instrs, otherwise return decode result */
static int svm_instr_opcode(struct kvm_vcpu *vcpu)
{
	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;

	if (ctxt->b != 0x1 || ctxt->opcode_len != 2)
		return NONE_SVM_INSTR;

	switch (ctxt->modrm) {
	case 0xd8: /* VMRUN */
		return SVM_INSTR_VMRUN;
	case 0xda: /* VMLOAD */
		return SVM_INSTR_VMLOAD;
	case 0xdb: /* VMSAVE */
		return SVM_INSTR_VMSAVE;
	default:
		break;
	}

	return NONE_SVM_INSTR;
}

static int emulate_svm_instr(struct kvm_vcpu *vcpu, int opcode)
{
2208 2209 2210 2211 2212
	const int guest_mode_exit_codes[] = {
		[SVM_INSTR_VMRUN] = SVM_EXIT_VMRUN,
		[SVM_INSTR_VMLOAD] = SVM_EXIT_VMLOAD,
		[SVM_INSTR_VMSAVE] = SVM_EXIT_VMSAVE,
	};
2213 2214 2215 2216 2217 2218 2219
	int (*const svm_instr_handlers[])(struct vcpu_svm *svm) = {
		[SVM_INSTR_VMRUN] = vmrun_interception,
		[SVM_INSTR_VMLOAD] = vmload_interception,
		[SVM_INSTR_VMSAVE] = vmsave_interception,
	};
	struct vcpu_svm *svm = to_svm(vcpu);

2220 2221 2222 2223 2224 2225 2226 2227
	if (is_guest_mode(vcpu)) {
		svm->vmcb->control.exit_code = guest_mode_exit_codes[opcode];
		svm->vmcb->control.exit_info_1 = 0;
		svm->vmcb->control.exit_info_2 = 0;

		return nested_svm_vmexit(svm);
	} else
		return svm_instr_handlers[opcode](svm);
2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261
}

/*
 * #GP handling code. Note that #GP can be triggered under the following two
 * cases:
 *   1) SVM VM-related instructions (VMRUN/VMSAVE/VMLOAD) that trigger #GP on
 *      some AMD CPUs when EAX of these instructions are in the reserved memory
 *      regions (e.g. SMM memory on host).
 *   2) VMware backdoor
 */
static int gp_interception(struct vcpu_svm *svm)
{
	struct kvm_vcpu *vcpu = &svm->vcpu;
	u32 error_code = svm->vmcb->control.exit_info_1;
	int opcode;

	/* Both #GP cases have zero error_code */
	if (error_code)
		goto reinject;

	/* Decode the instruction for usage later */
	if (x86_decode_emulated_instruction(vcpu, 0, NULL, 0) != EMULATION_OK)
		goto reinject;

	opcode = svm_instr_opcode(vcpu);

	if (opcode == NONE_SVM_INSTR) {
		if (!enable_vmware_backdoor)
			goto reinject;

		/*
		 * VMware backdoor emulation on #GP interception only handles
		 * IN{S}, OUT{S}, and RDPMC.
		 */
2262 2263
		if (!is_guest_mode(vcpu))
			return kvm_emulate_instruction(vcpu,
2264 2265 2266 2267 2268 2269 2270 2271 2272
				EMULTYPE_VMWARE_GP | EMULTYPE_NO_DECODE);
	} else
		return emulate_svm_instr(vcpu, opcode);

reinject:
	kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
	return 1;
}

P
Paolo Bonzini 已提交
2273 2274 2275 2276 2277 2278 2279 2280 2281 2282
void svm_set_gif(struct vcpu_svm *svm, bool value)
{
	if (value) {
		/*
		 * If VGIF is enabled, the STGI intercept is only added to
		 * detect the opening of the SMI/NMI window; remove it now.
		 * Likewise, clear the VINTR intercept, we will set it
		 * again while processing KVM_REQ_EVENT if needed.
		 */
		if (vgif_enabled(svm))
2283 2284
			svm_clr_intercept(svm, INTERCEPT_STGI);
		if (svm_is_intercept(svm, INTERCEPT_VINTR))
P
Paolo Bonzini 已提交
2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304
			svm_clear_vintr(svm);

		enable_gif(svm);
		if (svm->vcpu.arch.smi_pending ||
		    svm->vcpu.arch.nmi_pending ||
		    kvm_cpu_has_injectable_intr(&svm->vcpu))
			kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
	} else {
		disable_gif(svm);

		/*
		 * After a CLGI no interrupts should come.  But if vGIF is
		 * in use, we still rely on the VINTR intercept (rather than
		 * STGI) to detect an open interrupt window.
		*/
		if (!vgif_enabled(svm))
			svm_clear_vintr(svm);
	}
}

A
Avi Kivity 已提交
2305
static int stgi_interception(struct vcpu_svm *svm)
2306
{
2307 2308
	int ret;

2309 2310 2311
	if (nested_svm_check_permissions(svm))
		return 1;

2312
	ret = kvm_skip_emulated_instruction(&svm->vcpu);
P
Paolo Bonzini 已提交
2313
	svm_set_gif(svm, true);
2314
	return ret;
2315 2316
}

A
Avi Kivity 已提交
2317
static int clgi_interception(struct vcpu_svm *svm)
2318
{
2319 2320
	int ret;

2321 2322 2323
	if (nested_svm_check_permissions(svm))
		return 1;

2324
	ret = kvm_skip_emulated_instruction(&svm->vcpu);
P
Paolo Bonzini 已提交
2325
	svm_set_gif(svm, false);
2326
	return ret;
2327 2328
}

A
Avi Kivity 已提交
2329
static int invlpga_interception(struct vcpu_svm *svm)
A
Alexander Graf 已提交
2330 2331 2332
{
	struct kvm_vcpu *vcpu = &svm->vcpu;

2333 2334
	trace_kvm_invlpga(svm->vmcb->save.rip, kvm_rcx_read(&svm->vcpu),
			  kvm_rax_read(&svm->vcpu));
2335

A
Alexander Graf 已提交
2336
	/* Let's treat INVLPGA the same as INVLPG (can be optimized!) */
2337
	kvm_mmu_invlpg(vcpu, kvm_rax_read(&svm->vcpu));
A
Alexander Graf 已提交
2338

2339
	return kvm_skip_emulated_instruction(&svm->vcpu);
A
Alexander Graf 已提交
2340 2341
}

2342 2343
static int skinit_interception(struct vcpu_svm *svm)
{
2344
	trace_kvm_skinit(svm->vmcb->save.rip, kvm_rax_read(&svm->vcpu));
2345 2346 2347 2348 2349

	kvm_queue_exception(&svm->vcpu, UD_VECTOR);
	return 1;
}

D
David Kaplan 已提交
2350 2351
static int wbinvd_interception(struct vcpu_svm *svm)
{
2352
	return kvm_emulate_wbinvd(&svm->vcpu);
D
David Kaplan 已提交
2353 2354
}

J
Joerg Roedel 已提交
2355 2356 2357
static int xsetbv_interception(struct vcpu_svm *svm)
{
	u64 new_bv = kvm_read_edx_eax(&svm->vcpu);
2358
	u32 index = kvm_rcx_read(&svm->vcpu);
J
Joerg Roedel 已提交
2359 2360

	if (kvm_set_xcr(&svm->vcpu, index, new_bv) == 0) {
2361
		return kvm_skip_emulated_instruction(&svm->vcpu);
J
Joerg Roedel 已提交
2362 2363 2364 2365 2366
	}

	return 1;
}

J
Jim Mattson 已提交
2367 2368 2369 2370 2371 2372
static int rdpru_interception(struct vcpu_svm *svm)
{
	kvm_queue_exception(&svm->vcpu, UD_VECTOR);
	return 1;
}

A
Avi Kivity 已提交
2373
static int task_switch_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2374
{
2375
	u16 tss_selector;
2376 2377 2378
	int reason;
	int int_type = svm->vmcb->control.exit_int_info &
		SVM_EXITINTINFO_TYPE_MASK;
2379
	int int_vec = svm->vmcb->control.exit_int_info & SVM_EVTINJ_VEC_MASK;
2380 2381 2382 2383
	uint32_t type =
		svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_TYPE_MASK;
	uint32_t idt_v =
		svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_VALID;
2384 2385
	bool has_error_code = false;
	u32 error_code = 0;
2386 2387

	tss_selector = (u16)svm->vmcb->control.exit_info_1;
2388

2389 2390
	if (svm->vmcb->control.exit_info_2 &
	    (1ULL << SVM_EXITINFOSHIFT_TS_REASON_IRET))
2391 2392 2393 2394
		reason = TASK_SWITCH_IRET;
	else if (svm->vmcb->control.exit_info_2 &
		 (1ULL << SVM_EXITINFOSHIFT_TS_REASON_JMP))
		reason = TASK_SWITCH_JMP;
2395
	else if (idt_v)
2396 2397 2398 2399
		reason = TASK_SWITCH_GATE;
	else
		reason = TASK_SWITCH_CALL;

2400 2401 2402 2403 2404 2405
	if (reason == TASK_SWITCH_GATE) {
		switch (type) {
		case SVM_EXITINTINFO_TYPE_NMI:
			svm->vcpu.arch.nmi_injected = false;
			break;
		case SVM_EXITINTINFO_TYPE_EXEPT:
2406 2407 2408 2409 2410 2411
			if (svm->vmcb->control.exit_info_2 &
			    (1ULL << SVM_EXITINFOSHIFT_TS_HAS_ERROR_CODE)) {
				has_error_code = true;
				error_code =
					(u32)svm->vmcb->control.exit_info_2;
			}
2412 2413 2414 2415 2416 2417 2418 2419 2420
			kvm_clear_exception_queue(&svm->vcpu);
			break;
		case SVM_EXITINTINFO_TYPE_INTR:
			kvm_clear_interrupt_queue(&svm->vcpu);
			break;
		default:
			break;
		}
	}
2421

2422 2423 2424
	if (reason != TASK_SWITCH_GATE ||
	    int_type == SVM_EXITINTINFO_TYPE_SOFT ||
	    (int_type == SVM_EXITINTINFO_TYPE_EXEPT &&
2425
	     (int_vec == OF_VECTOR || int_vec == BP_VECTOR))) {
2426
		if (!skip_emulated_instruction(&svm->vcpu))
2427
			return 0;
2428
	}
2429

2430 2431 2432
	if (int_type != SVM_EXITINTINFO_TYPE_SOFT)
		int_vec = -1;

2433
	return kvm_task_switch(&svm->vcpu, tss_selector, int_vec, reason,
2434
			       has_error_code, error_code);
A
Avi Kivity 已提交
2435 2436
}

A
Avi Kivity 已提交
2437
static int cpuid_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2438
{
2439
	return kvm_emulate_cpuid(&svm->vcpu);
A
Avi Kivity 已提交
2440 2441
}

A
Avi Kivity 已提交
2442
static int iret_interception(struct vcpu_svm *svm)
2443 2444
{
	++svm->vcpu.stat.nmi_window_exits;
2445
	svm->vcpu.arch.hflags |= HF_IRET_MASK;
2446 2447 2448 2449
	if (!sev_es_guest(svm->vcpu.kvm)) {
		svm_clr_intercept(svm, INTERCEPT_IRET);
		svm->nmi_iret_rip = kvm_rip_read(&svm->vcpu);
	}
2450
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
2451 2452 2453
	return 1;
}

2454 2455 2456 2457 2458 2459
static int invd_interception(struct vcpu_svm *svm)
{
	/* Treat an INVD instruction as a NOP and just skip it. */
	return kvm_skip_emulated_instruction(&svm->vcpu);
}

A
Avi Kivity 已提交
2460
static int invlpg_interception(struct vcpu_svm *svm)
M
Marcelo Tosatti 已提交
2461
{
2462
	if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
2463
		return kvm_emulate_instruction(&svm->vcpu, 0);
2464 2465

	kvm_mmu_invlpg(&svm->vcpu, svm->vmcb->control.exit_info_1);
2466
	return kvm_skip_emulated_instruction(&svm->vcpu);
M
Marcelo Tosatti 已提交
2467 2468
}

A
Avi Kivity 已提交
2469
static int emulate_on_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2470
{
2471
	return kvm_emulate_instruction(&svm->vcpu, 0);
A
Avi Kivity 已提交
2472 2473
}

B
Brijesh Singh 已提交
2474 2475
static int rsm_interception(struct vcpu_svm *svm)
{
2476
	return kvm_emulate_instruction_from_buffer(&svm->vcpu, rsm_ins_bytes, 2);
B
Brijesh Singh 已提交
2477 2478
}

A
Avi Kivity 已提交
2479 2480 2481 2482
static int rdpmc_interception(struct vcpu_svm *svm)
{
	int err;

2483
	if (!nrips)
A
Avi Kivity 已提交
2484 2485 2486
		return emulate_on_interception(svm);

	err = kvm_rdpmc(&svm->vcpu);
2487
	return kvm_complete_insn_gp(&svm->vcpu, err);
A
Avi Kivity 已提交
2488 2489
}

2490 2491
static bool check_selective_cr0_intercepted(struct vcpu_svm *svm,
					    unsigned long val)
2492 2493 2494 2495 2496
{
	unsigned long cr0 = svm->vcpu.arch.cr0;
	bool ret = false;

	if (!is_guest_mode(&svm->vcpu) ||
2497
	    (!(vmcb_is_intercept(&svm->nested.ctl, INTERCEPT_SELECTIVE_CR0))))
2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510
		return false;

	cr0 &= ~SVM_CR0_SELECTIVE_MASK;
	val &= ~SVM_CR0_SELECTIVE_MASK;

	if (cr0 ^ val) {
		svm->vmcb->control.exit_code = SVM_EXIT_CR0_SEL_WRITE;
		ret = (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE);
	}

	return ret;
}

2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525
#define CR_VALID (1ULL << 63)

static int cr_interception(struct vcpu_svm *svm)
{
	int reg, cr;
	unsigned long val;
	int err;

	if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_on_interception(svm);

	if (unlikely((svm->vmcb->control.exit_info_1 & CR_VALID) == 0))
		return emulate_on_interception(svm);

	reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
2526 2527 2528 2529
	if (svm->vmcb->control.exit_code == SVM_EXIT_CR0_SEL_WRITE)
		cr = SVM_EXIT_WRITE_CR0 - SVM_EXIT_READ_CR0;
	else
		cr = svm->vmcb->control.exit_code - SVM_EXIT_READ_CR0;
2530 2531 2532 2533 2534

	err = 0;
	if (cr >= 16) { /* mov to cr */
		cr -= 16;
		val = kvm_register_read(&svm->vcpu, reg);
2535
		trace_kvm_cr_write(cr, val);
2536 2537
		switch (cr) {
		case 0:
2538 2539
			if (!check_selective_cr0_intercepted(svm, val))
				err = kvm_set_cr0(&svm->vcpu, val);
2540 2541 2542
			else
				return 1;

2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566
			break;
		case 3:
			err = kvm_set_cr3(&svm->vcpu, val);
			break;
		case 4:
			err = kvm_set_cr4(&svm->vcpu, val);
			break;
		case 8:
			err = kvm_set_cr8(&svm->vcpu, val);
			break;
		default:
			WARN(1, "unhandled write to CR%d", cr);
			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
			return 1;
		}
	} else { /* mov from cr */
		switch (cr) {
		case 0:
			val = kvm_read_cr0(&svm->vcpu);
			break;
		case 2:
			val = svm->vcpu.arch.cr2;
			break;
		case 3:
2567
			val = kvm_read_cr3(&svm->vcpu);
2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580
			break;
		case 4:
			val = kvm_read_cr4(&svm->vcpu);
			break;
		case 8:
			val = kvm_get_cr8(&svm->vcpu);
			break;
		default:
			WARN(1, "unhandled read from CR%d", cr);
			kvm_queue_exception(&svm->vcpu, UD_VECTOR);
			return 1;
		}
		kvm_register_write(&svm->vcpu, reg, val);
2581
		trace_kvm_cr_read(cr, val);
2582
	}
2583
	return kvm_complete_insn_gp(&svm->vcpu, err);
2584 2585
}

2586 2587 2588 2589 2590
static int cr_trap(struct vcpu_svm *svm)
{
	struct kvm_vcpu *vcpu = &svm->vcpu;
	unsigned long old_value, new_value;
	unsigned int cr;
2591
	int ret = 0;
2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602

	new_value = (unsigned long)svm->vmcb->control.exit_info_1;

	cr = svm->vmcb->control.exit_code - SVM_EXIT_CR0_WRITE_TRAP;
	switch (cr) {
	case 0:
		old_value = kvm_read_cr0(vcpu);
		svm_set_cr0(vcpu, new_value);

		kvm_post_set_cr0(vcpu, old_value, new_value);
		break;
2603 2604 2605 2606 2607 2608
	case 4:
		old_value = kvm_read_cr4(vcpu);
		svm_set_cr4(vcpu, new_value);

		kvm_post_set_cr4(vcpu, old_value, new_value);
		break;
2609 2610 2611
	case 8:
		ret = kvm_set_cr8(&svm->vcpu, new_value);
		break;
2612 2613 2614 2615 2616 2617
	default:
		WARN(1, "unhandled CR%d write trap", cr);
		kvm_queue_exception(vcpu, UD_VECTOR);
		return 1;
	}

2618
	return kvm_complete_insn_gp(vcpu, ret);
2619 2620
}

2621 2622 2623 2624 2625
static int dr_interception(struct vcpu_svm *svm)
{
	int reg, dr;
	unsigned long val;

2626 2627 2628 2629 2630 2631 2632 2633 2634 2635 2636
	if (svm->vcpu.guest_debug == 0) {
		/*
		 * No more DR vmexits; force a reload of the debug registers
		 * and reenter on this instruction.  The next vmexit will
		 * retrieve the full state of the debug registers.
		 */
		clr_dr_intercepts(svm);
		svm->vcpu.arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
		return 1;
	}

2637 2638 2639 2640 2641 2642 2643
	if (!boot_cpu_has(X86_FEATURE_DECODEASSISTS))
		return emulate_on_interception(svm);

	reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
	dr = svm->vmcb->control.exit_code - SVM_EXIT_READ_DR0;

	if (dr >= 16) { /* mov to DRn */
2644 2645
		if (!kvm_require_dr(&svm->vcpu, dr - 16))
			return 1;
2646 2647 2648
		val = kvm_register_read(&svm->vcpu, reg);
		kvm_set_dr(&svm->vcpu, dr - 16, val);
	} else {
2649 2650 2651 2652
		if (!kvm_require_dr(&svm->vcpu, dr))
			return 1;
		kvm_get_dr(&svm->vcpu, dr, &val);
		kvm_register_write(&svm->vcpu, reg, val);
2653 2654
	}

2655
	return kvm_skip_emulated_instruction(&svm->vcpu);
2656 2657
}

A
Avi Kivity 已提交
2658
static int cr8_write_interception(struct vcpu_svm *svm)
2659
{
A
Avi Kivity 已提交
2660
	struct kvm_run *kvm_run = svm->vcpu.run;
A
Andre Przywara 已提交
2661
	int r;
A
Avi Kivity 已提交
2662

2663 2664
	u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
	/* instruction emulation calls kvm_set_cr8() */
2665
	r = cr_interception(svm);
2666
	if (lapic_in_kernel(&svm->vcpu))
2667
		return r;
2668
	if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
2669
		return r;
2670 2671 2672 2673
	kvm_run->exit_reason = KVM_EXIT_SET_TPR;
	return 0;
}

2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692
static int efer_trap(struct vcpu_svm *svm)
{
	struct msr_data msr_info;
	int ret;

	/*
	 * Clear the EFER_SVME bit from EFER. The SVM code always sets this
	 * bit in svm_set_efer(), but __kvm_valid_efer() checks it against
	 * whether the guest has X86_FEATURE_SVM - this avoids a failure if
	 * the guest doesn't have X86_FEATURE_SVM.
	 */
	msr_info.host_initiated = false;
	msr_info.index = MSR_EFER;
	msr_info.data = svm->vmcb->control.exit_info_1 & ~EFER_SVME;
	ret = kvm_set_msr_common(&svm->vcpu, &msr_info);

	return kvm_complete_insn_gp(&svm->vcpu, ret);
}

2693 2694
static int svm_get_msr_feature(struct kvm_msr_entry *msr)
{
2695 2696 2697 2698 2699 2700 2701
	msr->data = 0;

	switch (msr->index) {
	case MSR_F10H_DECFG:
		if (boot_cpu_has(X86_FEATURE_LFENCE_RDTSC))
			msr->data |= MSR_F10H_DECFG_LFENCE_SERIALIZE;
		break;
2702 2703
	case MSR_IA32_PERF_CAPABILITIES:
		return 0;
2704
	default:
2705
		return KVM_MSR_RET_INVALID;
2706 2707 2708
	}

	return 0;
2709 2710
}

2711
static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
A
Avi Kivity 已提交
2712
{
2713 2714
	struct vcpu_svm *svm = to_svm(vcpu);

2715
	switch (msr_info->index) {
B
Brian Gerst 已提交
2716
	case MSR_STAR:
2717
		msr_info->data = svm->vmcb->save.star;
A
Avi Kivity 已提交
2718
		break;
2719
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
2720
	case MSR_LSTAR:
2721
		msr_info->data = svm->vmcb->save.lstar;
A
Avi Kivity 已提交
2722 2723
		break;
	case MSR_CSTAR:
2724
		msr_info->data = svm->vmcb->save.cstar;
A
Avi Kivity 已提交
2725 2726
		break;
	case MSR_KERNEL_GS_BASE:
2727
		msr_info->data = svm->vmcb->save.kernel_gs_base;
A
Avi Kivity 已提交
2728 2729
		break;
	case MSR_SYSCALL_MASK:
2730
		msr_info->data = svm->vmcb->save.sfmask;
A
Avi Kivity 已提交
2731 2732 2733
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
2734
		msr_info->data = svm->vmcb->save.sysenter_cs;
A
Avi Kivity 已提交
2735 2736
		break;
	case MSR_IA32_SYSENTER_EIP:
2737
		msr_info->data = svm->sysenter_eip;
A
Avi Kivity 已提交
2738 2739
		break;
	case MSR_IA32_SYSENTER_ESP:
2740
		msr_info->data = svm->sysenter_esp;
A
Avi Kivity 已提交
2741
		break;
P
Paolo Bonzini 已提交
2742 2743 2744 2745 2746
	case MSR_TSC_AUX:
		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
			return 1;
		msr_info->data = svm->tsc_aux;
		break;
J
Joerg Roedel 已提交
2747 2748 2749 2750 2751
	/*
	 * Nobody will change the following 5 values in the VMCB so we can
	 * safely return them on rdmsr. They will always be 0 until LBRV is
	 * implemented.
	 */
2752
	case MSR_IA32_DEBUGCTLMSR:
2753
		msr_info->data = svm->vmcb->save.dbgctl;
2754 2755
		break;
	case MSR_IA32_LASTBRANCHFROMIP:
2756
		msr_info->data = svm->vmcb->save.br_from;
2757 2758
		break;
	case MSR_IA32_LASTBRANCHTOIP:
2759
		msr_info->data = svm->vmcb->save.br_to;
2760 2761
		break;
	case MSR_IA32_LASTINTFROMIP:
2762
		msr_info->data = svm->vmcb->save.last_excp_from;
2763 2764
		break;
	case MSR_IA32_LASTINTTOIP:
2765
		msr_info->data = svm->vmcb->save.last_excp_to;
2766
		break;
A
Alexander Graf 已提交
2767
	case MSR_VM_HSAVE_PA:
2768
		msr_info->data = svm->nested.hsave_msr;
A
Alexander Graf 已提交
2769
		break;
2770
	case MSR_VM_CR:
2771
		msr_info->data = svm->nested.vm_cr_msr;
2772
		break;
2773 2774
	case MSR_IA32_SPEC_CTRL:
		if (!msr_info->host_initiated &&
2775
		    !guest_has_spec_ctrl_msr(vcpu))
2776 2777 2778 2779
			return 1;

		msr_info->data = svm->spec_ctrl;
		break;
2780 2781 2782 2783 2784 2785 2786
	case MSR_AMD64_VIRT_SPEC_CTRL:
		if (!msr_info->host_initiated &&
		    !guest_cpuid_has(vcpu, X86_FEATURE_VIRT_SSBD))
			return 1;

		msr_info->data = svm->virt_spec_ctrl;
		break;
2787 2788 2789 2790 2791 2792 2793 2794 2795 2796 2797 2798 2799 2800 2801 2802 2803
	case MSR_F15H_IC_CFG: {

		int family, model;

		family = guest_cpuid_family(vcpu);
		model  = guest_cpuid_model(vcpu);

		if (family < 0 || model < 0)
			return kvm_get_msr_common(vcpu, msr_info);

		msr_info->data = 0;

		if (family == 0x15 &&
		    (model >= 0x2 && model < 0x20))
			msr_info->data = 0x1E;
		}
		break;
2804 2805 2806
	case MSR_F10H_DECFG:
		msr_info->data = svm->msr_decfg;
		break;
A
Avi Kivity 已提交
2807
	default:
2808
		return kvm_get_msr_common(vcpu, msr_info);
A
Avi Kivity 已提交
2809 2810 2811 2812
	}
	return 0;
}

2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826
static int svm_complete_emulated_msr(struct kvm_vcpu *vcpu, int err)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	if (!sev_es_guest(svm->vcpu.kvm) || !err)
		return kvm_complete_insn_gp(&svm->vcpu, err);

	ghcb_set_sw_exit_info_1(svm->ghcb, 1);
	ghcb_set_sw_exit_info_2(svm->ghcb,
				X86_TRAP_GP |
				SVM_EVTINJ_TYPE_EXEPT |
				SVM_EVTINJ_VALID);
	return 1;
}

A
Avi Kivity 已提交
2827
static int rdmsr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
2828
{
2829
	return kvm_emulate_rdmsr(&svm->vcpu);
A
Avi Kivity 已提交
2830 2831
}

2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856
static int svm_set_vm_cr(struct kvm_vcpu *vcpu, u64 data)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	int svm_dis, chg_mask;

	if (data & ~SVM_VM_CR_VALID_MASK)
		return 1;

	chg_mask = SVM_VM_CR_VALID_MASK;

	if (svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK)
		chg_mask &= ~(SVM_VM_CR_SVM_LOCK_MASK | SVM_VM_CR_SVM_DIS_MASK);

	svm->nested.vm_cr_msr &= ~chg_mask;
	svm->nested.vm_cr_msr |= (data & chg_mask);

	svm_dis = svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK;

	/* check for svm_disable while efer.svme is set */
	if (svm_dis && (vcpu->arch.efer & EFER_SVME))
		return 1;

	return 0;
}

2857
static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
A
Avi Kivity 已提交
2858
{
2859 2860
	struct vcpu_svm *svm = to_svm(vcpu);

2861 2862
	u32 ecx = msr->index;
	u64 data = msr->data;
A
Avi Kivity 已提交
2863
	switch (ecx) {
P
Paolo Bonzini 已提交
2864 2865 2866 2867 2868
	case MSR_IA32_CR_PAT:
		if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
			return 1;
		vcpu->arch.pat = data;
		svm->vmcb->save.g_pat = data;
2869
		vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
P
Paolo Bonzini 已提交
2870
		break;
2871 2872
	case MSR_IA32_SPEC_CTRL:
		if (!msr->host_initiated &&
2873
		    !guest_has_spec_ctrl_msr(vcpu))
2874 2875
			return 1;

2876
		if (kvm_spec_ctrl_test_value(data))
2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893
			return 1;

		svm->spec_ctrl = data;
		if (!data)
			break;

		/*
		 * For non-nested:
		 * When it's written (to non-zero) for the first time, pass
		 * it through.
		 *
		 * For nested:
		 * The handling of the MSR bitmap for L2 guests is done in
		 * nested_svm_vmrun_msrpm.
		 * We update the L1 MSR bit as well since it will end up
		 * touching the MSR anyway now.
		 */
2894
		set_msr_interception(vcpu, svm->msrpm, MSR_IA32_SPEC_CTRL, 1, 1);
2895
		break;
A
Ashok Raj 已提交
2896 2897
	case MSR_IA32_PRED_CMD:
		if (!msr->host_initiated &&
2898
		    !guest_has_pred_cmd_msr(vcpu))
A
Ashok Raj 已提交
2899 2900 2901 2902
			return 1;

		if (data & ~PRED_CMD_IBPB)
			return 1;
2903
		if (!boot_cpu_has(X86_FEATURE_IBPB))
2904
			return 1;
A
Ashok Raj 已提交
2905 2906 2907 2908
		if (!data)
			break;

		wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB);
2909
		set_msr_interception(vcpu, svm->msrpm, MSR_IA32_PRED_CMD, 0, 1);
A
Ashok Raj 已提交
2910
		break;
2911 2912 2913 2914 2915 2916 2917 2918 2919 2920
	case MSR_AMD64_VIRT_SPEC_CTRL:
		if (!msr->host_initiated &&
		    !guest_cpuid_has(vcpu, X86_FEATURE_VIRT_SSBD))
			return 1;

		if (data & ~SPEC_CTRL_SSBD)
			return 1;

		svm->virt_spec_ctrl = data;
		break;
B
Brian Gerst 已提交
2921
	case MSR_STAR:
2922
		svm->vmcb->save.star = data;
A
Avi Kivity 已提交
2923
		break;
2924
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
2925
	case MSR_LSTAR:
2926
		svm->vmcb->save.lstar = data;
A
Avi Kivity 已提交
2927 2928
		break;
	case MSR_CSTAR:
2929
		svm->vmcb->save.cstar = data;
A
Avi Kivity 已提交
2930 2931
		break;
	case MSR_KERNEL_GS_BASE:
2932
		svm->vmcb->save.kernel_gs_base = data;
A
Avi Kivity 已提交
2933 2934
		break;
	case MSR_SYSCALL_MASK:
2935
		svm->vmcb->save.sfmask = data;
A
Avi Kivity 已提交
2936 2937 2938
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
2939
		svm->vmcb->save.sysenter_cs = data;
A
Avi Kivity 已提交
2940 2941
		break;
	case MSR_IA32_SYSENTER_EIP:
2942
		svm->sysenter_eip = data;
2943
		svm->vmcb->save.sysenter_eip = data;
A
Avi Kivity 已提交
2944 2945
		break;
	case MSR_IA32_SYSENTER_ESP:
2946
		svm->sysenter_esp = data;
2947
		svm->vmcb->save.sysenter_esp = data;
A
Avi Kivity 已提交
2948
		break;
P
Paolo Bonzini 已提交
2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960
	case MSR_TSC_AUX:
		if (!boot_cpu_has(X86_FEATURE_RDTSCP))
			return 1;

		/*
		 * This is rare, so we update the MSR here instead of using
		 * direct_access_msrs.  Doing that would require a rdmsr in
		 * svm_vcpu_put.
		 */
		svm->tsc_aux = data;
		wrmsrl(MSR_TSC_AUX, svm->tsc_aux);
		break;
2961
	case MSR_IA32_DEBUGCTLMSR:
2962
		if (!boot_cpu_has(X86_FEATURE_LBRV)) {
2963 2964
			vcpu_unimpl(vcpu, "%s: MSR_IA32_DEBUGCTL 0x%llx, nop\n",
				    __func__, data);
2965 2966 2967 2968 2969 2970
			break;
		}
		if (data & DEBUGCTL_RESERVED_BITS)
			return 1;

		svm->vmcb->save.dbgctl = data;
2971
		vmcb_mark_dirty(svm->vmcb, VMCB_LBR);
2972
		if (data & (1ULL<<0))
2973
			svm_enable_lbrv(vcpu);
2974
		else
2975
			svm_disable_lbrv(vcpu);
2976
		break;
A
Alexander Graf 已提交
2977
	case MSR_VM_HSAVE_PA:
2978
		svm->nested.hsave_msr = data;
2979
		break;
2980
	case MSR_VM_CR:
2981
		return svm_set_vm_cr(vcpu, data);
2982
	case MSR_VM_IGNNE:
2983
		vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
2984
		break;
2985 2986 2987 2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998 2999 3000 3001 3002
	case MSR_F10H_DECFG: {
		struct kvm_msr_entry msr_entry;

		msr_entry.index = msr->index;
		if (svm_get_msr_feature(&msr_entry))
			return 1;

		/* Check the supported bits */
		if (data & ~msr_entry.data)
			return 1;

		/* Don't allow the guest to change a bit, #GP */
		if (!msr->host_initiated && (data ^ msr_entry.data))
			return 1;

		svm->msr_decfg = data;
		break;
	}
3003 3004 3005
	case MSR_IA32_APICBASE:
		if (kvm_vcpu_apicv_active(vcpu))
			avic_update_vapic_bar(to_svm(vcpu), data);
3006
		fallthrough;
A
Avi Kivity 已提交
3007
	default:
3008
		return kvm_set_msr_common(vcpu, msr);
A
Avi Kivity 已提交
3009 3010 3011 3012
	}
	return 0;
}

A
Avi Kivity 已提交
3013
static int wrmsr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3014
{
3015
	return kvm_emulate_wrmsr(&svm->vcpu);
A
Avi Kivity 已提交
3016 3017
}

A
Avi Kivity 已提交
3018
static int msr_interception(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3019
{
R
Rusty Russell 已提交
3020
	if (svm->vmcb->control.exit_info_1)
A
Avi Kivity 已提交
3021
		return wrmsr_interception(svm);
A
Avi Kivity 已提交
3022
	else
A
Avi Kivity 已提交
3023
		return rdmsr_interception(svm);
A
Avi Kivity 已提交
3024 3025
}

A
Avi Kivity 已提交
3026
static int interrupt_window_interception(struct vcpu_svm *svm)
3027
{
3028
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3029
	svm_clear_vintr(svm);
3030 3031 3032 3033 3034 3035 3036 3037

	/*
	 * For AVIC, the only reason to end up here is ExtINTs.
	 * In this case AVIC was temporarily disabled for
	 * requesting the IRQ window and we have to re-enable it.
	 */
	svm_toggle_avic_for_irq_window(&svm->vcpu, true);

3038
	++svm->vcpu.stat.irq_window_exits;
3039 3040 3041
	return 1;
}

3042 3043
static int pause_interception(struct vcpu_svm *svm)
{
3044
	struct kvm_vcpu *vcpu = &svm->vcpu;
3045 3046 3047 3048 3049 3050 3051 3052
	bool in_kernel;

	/*
	 * CPL is not made available for an SEV-ES guest, therefore
	 * vcpu->arch.preempted_in_kernel can never be true.  Just
	 * set in_kernel to false as well.
	 */
	in_kernel = !sev_es_guest(svm->vcpu.kvm) && svm_get_cpl(vcpu) == 0;
3053

3054
	if (!kvm_pause_in_guest(vcpu->kvm))
3055 3056
		grow_ple_window(vcpu);

3057
	kvm_vcpu_on_spin(vcpu, in_kernel);
3058 3059 3060
	return 1;
}

3061 3062
static int nop_interception(struct vcpu_svm *svm)
{
3063
	return kvm_skip_emulated_instruction(&(svm->vcpu));
3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077
}

static int monitor_interception(struct vcpu_svm *svm)
{
	printk_once(KERN_WARNING "kvm: MONITOR instruction emulated as NOP!\n");
	return nop_interception(svm);
}

static int mwait_interception(struct vcpu_svm *svm)
{
	printk_once(KERN_WARNING "kvm: MWAIT instruction emulated as NOP!\n");
	return nop_interception(svm);
}

3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100 3101 3102 3103 3104
static int invpcid_interception(struct vcpu_svm *svm)
{
	struct kvm_vcpu *vcpu = &svm->vcpu;
	unsigned long type;
	gva_t gva;

	if (!guest_cpuid_has(vcpu, X86_FEATURE_INVPCID)) {
		kvm_queue_exception(vcpu, UD_VECTOR);
		return 1;
	}

	/*
	 * For an INVPCID intercept:
	 * EXITINFO1 provides the linear address of the memory operand.
	 * EXITINFO2 provides the contents of the register operand.
	 */
	type = svm->vmcb->control.exit_info_2;
	gva = svm->vmcb->control.exit_info_1;

	if (type > 3) {
		kvm_inject_gp(vcpu, 0);
		return 1;
	}

	return kvm_handle_invpcid(vcpu, type, gva);
}

3105
static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
3106 3107 3108 3109
	[SVM_EXIT_READ_CR0]			= cr_interception,
	[SVM_EXIT_READ_CR3]			= cr_interception,
	[SVM_EXIT_READ_CR4]			= cr_interception,
	[SVM_EXIT_READ_CR8]			= cr_interception,
3110
	[SVM_EXIT_CR0_SEL_WRITE]		= cr_interception,
3111
	[SVM_EXIT_WRITE_CR0]			= cr_interception,
3112 3113
	[SVM_EXIT_WRITE_CR3]			= cr_interception,
	[SVM_EXIT_WRITE_CR4]			= cr_interception,
J
Joerg Roedel 已提交
3114
	[SVM_EXIT_WRITE_CR8]			= cr8_write_interception,
3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130
	[SVM_EXIT_READ_DR0]			= dr_interception,
	[SVM_EXIT_READ_DR1]			= dr_interception,
	[SVM_EXIT_READ_DR2]			= dr_interception,
	[SVM_EXIT_READ_DR3]			= dr_interception,
	[SVM_EXIT_READ_DR4]			= dr_interception,
	[SVM_EXIT_READ_DR5]			= dr_interception,
	[SVM_EXIT_READ_DR6]			= dr_interception,
	[SVM_EXIT_READ_DR7]			= dr_interception,
	[SVM_EXIT_WRITE_DR0]			= dr_interception,
	[SVM_EXIT_WRITE_DR1]			= dr_interception,
	[SVM_EXIT_WRITE_DR2]			= dr_interception,
	[SVM_EXIT_WRITE_DR3]			= dr_interception,
	[SVM_EXIT_WRITE_DR4]			= dr_interception,
	[SVM_EXIT_WRITE_DR5]			= dr_interception,
	[SVM_EXIT_WRITE_DR6]			= dr_interception,
	[SVM_EXIT_WRITE_DR7]			= dr_interception,
J
Jan Kiszka 已提交
3131 3132
	[SVM_EXIT_EXCP_BASE + DB_VECTOR]	= db_interception,
	[SVM_EXIT_EXCP_BASE + BP_VECTOR]	= bp_interception,
3133
	[SVM_EXIT_EXCP_BASE + UD_VECTOR]	= ud_interception,
J
Joerg Roedel 已提交
3134 3135
	[SVM_EXIT_EXCP_BASE + PF_VECTOR]	= pf_interception,
	[SVM_EXIT_EXCP_BASE + MC_VECTOR]	= mc_interception,
3136
	[SVM_EXIT_EXCP_BASE + AC_VECTOR]	= ac_interception,
3137
	[SVM_EXIT_EXCP_BASE + GP_VECTOR]	= gp_interception,
J
Joerg Roedel 已提交
3138
	[SVM_EXIT_INTR]				= intr_interception,
3139
	[SVM_EXIT_NMI]				= nmi_interception,
A
Avi Kivity 已提交
3140 3141
	[SVM_EXIT_SMI]				= nop_on_interception,
	[SVM_EXIT_INIT]				= nop_on_interception,
3142
	[SVM_EXIT_VINTR]			= interrupt_window_interception,
A
Avi Kivity 已提交
3143
	[SVM_EXIT_RDPMC]			= rdpmc_interception,
A
Avi Kivity 已提交
3144
	[SVM_EXIT_CPUID]			= cpuid_interception,
3145
	[SVM_EXIT_IRET]                         = iret_interception,
3146
	[SVM_EXIT_INVD]                         = invd_interception,
3147
	[SVM_EXIT_PAUSE]			= pause_interception,
A
Avi Kivity 已提交
3148
	[SVM_EXIT_HLT]				= halt_interception,
M
Marcelo Tosatti 已提交
3149
	[SVM_EXIT_INVLPG]			= invlpg_interception,
A
Alexander Graf 已提交
3150
	[SVM_EXIT_INVLPGA]			= invlpga_interception,
J
Joerg Roedel 已提交
3151
	[SVM_EXIT_IOIO]				= io_interception,
A
Avi Kivity 已提交
3152 3153
	[SVM_EXIT_MSR]				= msr_interception,
	[SVM_EXIT_TASK_SWITCH]			= task_switch_interception,
3154
	[SVM_EXIT_SHUTDOWN]			= shutdown_interception,
A
Alexander Graf 已提交
3155
	[SVM_EXIT_VMRUN]			= vmrun_interception,
3156
	[SVM_EXIT_VMMCALL]			= vmmcall_interception,
3157 3158
	[SVM_EXIT_VMLOAD]			= vmload_interception,
	[SVM_EXIT_VMSAVE]			= vmsave_interception,
3159 3160
	[SVM_EXIT_STGI]				= stgi_interception,
	[SVM_EXIT_CLGI]				= clgi_interception,
3161
	[SVM_EXIT_SKINIT]			= skinit_interception,
D
David Kaplan 已提交
3162
	[SVM_EXIT_WBINVD]                       = wbinvd_interception,
3163 3164
	[SVM_EXIT_MONITOR]			= monitor_interception,
	[SVM_EXIT_MWAIT]			= mwait_interception,
J
Joerg Roedel 已提交
3165
	[SVM_EXIT_XSETBV]			= xsetbv_interception,
J
Jim Mattson 已提交
3166
	[SVM_EXIT_RDPRU]			= rdpru_interception,
3167
	[SVM_EXIT_EFER_WRITE_TRAP]		= efer_trap,
3168
	[SVM_EXIT_CR0_WRITE_TRAP]		= cr_trap,
3169
	[SVM_EXIT_CR4_WRITE_TRAP]		= cr_trap,
3170
	[SVM_EXIT_CR8_WRITE_TRAP]		= cr_trap,
3171
	[SVM_EXIT_INVPCID]                      = invpcid_interception,
3172
	[SVM_EXIT_NPF]				= npf_interception,
B
Brijesh Singh 已提交
3173
	[SVM_EXIT_RSM]                          = rsm_interception,
3174 3175
	[SVM_EXIT_AVIC_INCOMPLETE_IPI]		= avic_incomplete_ipi_interception,
	[SVM_EXIT_AVIC_UNACCELERATED_ACCESS]	= avic_unaccelerated_access_interception,
3176
	[SVM_EXIT_VMGEXIT]			= sev_handle_vmgexit,
A
Avi Kivity 已提交
3177 3178
};

3179
static void dump_vmcb(struct kvm_vcpu *vcpu)
3180 3181 3182 3183 3184
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;

3185 3186 3187 3188 3189
	if (!dump_invalid_vmcb) {
		pr_warn_ratelimited("set kvm_amd.dump_invalid_vmcb=1 to dump internal KVM state.\n");
		return;
	}

3190
	pr_err("VMCB Control Area:\n");
3191 3192
	pr_err("%-20s%04x\n", "cr_read:", control->intercepts[INTERCEPT_CR] & 0xffff);
	pr_err("%-20s%04x\n", "cr_write:", control->intercepts[INTERCEPT_CR] >> 16);
3193 3194
	pr_err("%-20s%04x\n", "dr_read:", control->intercepts[INTERCEPT_DR] & 0xffff);
	pr_err("%-20s%04x\n", "dr_write:", control->intercepts[INTERCEPT_DR] >> 16);
3195
	pr_err("%-20s%08x\n", "exceptions:", control->intercepts[INTERCEPT_EXCEPTION]);
3196 3197 3198
	pr_err("%-20s%08x %08x\n", "intercepts:",
              control->intercepts[INTERCEPT_WORD3],
	       control->intercepts[INTERCEPT_WORD4]);
3199
	pr_err("%-20s%d\n", "pause filter count:", control->pause_filter_count);
3200 3201
	pr_err("%-20s%d\n", "pause filter threshold:",
	       control->pause_filter_thresh);
3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212 3213 3214 3215 3216
	pr_err("%-20s%016llx\n", "iopm_base_pa:", control->iopm_base_pa);
	pr_err("%-20s%016llx\n", "msrpm_base_pa:", control->msrpm_base_pa);
	pr_err("%-20s%016llx\n", "tsc_offset:", control->tsc_offset);
	pr_err("%-20s%d\n", "asid:", control->asid);
	pr_err("%-20s%d\n", "tlb_ctl:", control->tlb_ctl);
	pr_err("%-20s%08x\n", "int_ctl:", control->int_ctl);
	pr_err("%-20s%08x\n", "int_vector:", control->int_vector);
	pr_err("%-20s%08x\n", "int_state:", control->int_state);
	pr_err("%-20s%08x\n", "exit_code:", control->exit_code);
	pr_err("%-20s%016llx\n", "exit_info1:", control->exit_info_1);
	pr_err("%-20s%016llx\n", "exit_info2:", control->exit_info_2);
	pr_err("%-20s%08x\n", "exit_int_info:", control->exit_int_info);
	pr_err("%-20s%08x\n", "exit_int_info_err:", control->exit_int_info_err);
	pr_err("%-20s%lld\n", "nested_ctl:", control->nested_ctl);
	pr_err("%-20s%016llx\n", "nested_cr3:", control->nested_cr3);
3217
	pr_err("%-20s%016llx\n", "avic_vapic_bar:", control->avic_vapic_bar);
3218
	pr_err("%-20s%016llx\n", "ghcb:", control->ghcb_gpa);
3219 3220
	pr_err("%-20s%08x\n", "event_inj:", control->event_inj);
	pr_err("%-20s%08x\n", "event_inj_err:", control->event_inj_err);
3221
	pr_err("%-20s%lld\n", "virt_ext:", control->virt_ext);
3222
	pr_err("%-20s%016llx\n", "next_rip:", control->next_rip);
3223 3224 3225
	pr_err("%-20s%016llx\n", "avic_backing_page:", control->avic_backing_page);
	pr_err("%-20s%016llx\n", "avic_logical_id:", control->avic_logical_id);
	pr_err("%-20s%016llx\n", "avic_physical_id:", control->avic_physical_id);
3226
	pr_err("%-20s%016llx\n", "vmsa_pa:", control->vmsa_pa);
3227
	pr_err("VMCB State Save Area:\n");
3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253 3254 3255 3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "es:",
	       save->es.selector, save->es.attrib,
	       save->es.limit, save->es.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "cs:",
	       save->cs.selector, save->cs.attrib,
	       save->cs.limit, save->cs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ss:",
	       save->ss.selector, save->ss.attrib,
	       save->ss.limit, save->ss.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ds:",
	       save->ds.selector, save->ds.attrib,
	       save->ds.limit, save->ds.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "fs:",
	       save->fs.selector, save->fs.attrib,
	       save->fs.limit, save->fs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "gs:",
	       save->gs.selector, save->gs.attrib,
	       save->gs.limit, save->gs.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "gdtr:",
	       save->gdtr.selector, save->gdtr.attrib,
	       save->gdtr.limit, save->gdtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "ldtr:",
	       save->ldtr.selector, save->ldtr.attrib,
	       save->ldtr.limit, save->ldtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "idtr:",
	       save->idtr.selector, save->idtr.attrib,
	       save->idtr.limit, save->idtr.base);
	pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
	       "tr:",
	       save->tr.selector, save->tr.attrib,
	       save->tr.limit, save->tr.base);
3268 3269
	pr_err("cpl:            %d                efer:         %016llx\n",
		save->cpl, save->efer);
3270 3271 3272 3273 3274 3275 3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cr0:", save->cr0, "cr2:", save->cr2);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cr3:", save->cr3, "cr4:", save->cr4);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "dr6:", save->dr6, "dr7:", save->dr7);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "rip:", save->rip, "rflags:", save->rflags);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "rsp:", save->rsp, "rax:", save->rax);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "star:", save->star, "lstar:", save->lstar);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "cstar:", save->cstar, "sfmask:", save->sfmask);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "kernel_gs_base:", save->kernel_gs_base,
	       "sysenter_cs:", save->sysenter_cs);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "sysenter_esp:", save->sysenter_esp,
	       "sysenter_eip:", save->sysenter_eip);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "gpat:", save->g_pat, "dbgctl:", save->dbgctl);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "br_from:", save->br_from, "br_to:", save->br_to);
	pr_err("%-15s %016llx %-13s %016llx\n",
	       "excp_from:", save->last_excp_from,
	       "excp_to:", save->last_excp_to);
3297 3298
}

3299 3300 3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315
static int svm_handle_invalid_exit(struct kvm_vcpu *vcpu, u64 exit_code)
{
	if (exit_code < ARRAY_SIZE(svm_exit_handlers) &&
	    svm_exit_handlers[exit_code])
		return 0;

	vcpu_unimpl(vcpu, "svm: unexpected exit reason 0x%llx\n", exit_code);
	dump_vmcb(vcpu);
	vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
	vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_UNEXPECTED_EXIT_REASON;
	vcpu->run->internal.ndata = 2;
	vcpu->run->internal.data[0] = exit_code;
	vcpu->run->internal.data[1] = vcpu->arch.last_vmentry_cpu;

	return -EINVAL;
}

3316
int svm_invoke_exit_handler(struct vcpu_svm *svm, u64 exit_code)
3317 3318 3319 3320 3321 3322 3323 3324 3325 3326 3327 3328 3329 3330 3331 3332 3333 3334 3335
{
	if (svm_handle_invalid_exit(&svm->vcpu, exit_code))
		return 0;

#ifdef CONFIG_RETPOLINE
	if (exit_code == SVM_EXIT_MSR)
		return msr_interception(svm);
	else if (exit_code == SVM_EXIT_VINTR)
		return interrupt_window_interception(svm);
	else if (exit_code == SVM_EXIT_INTR)
		return intr_interception(svm);
	else if (exit_code == SVM_EXIT_HLT)
		return halt_interception(svm);
	else if (exit_code == SVM_EXIT_NPF)
		return npf_interception(svm);
#endif
	return svm_exit_handlers[exit_code](svm);
}

3336 3337
static void svm_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2,
			      u32 *intr_info, u32 *error_code)
3338 3339 3340 3341 3342
{
	struct vmcb_control_area *control = &to_svm(vcpu)->vmcb->control;

	*info1 = control->exit_info_1;
	*info2 = control->exit_info_2;
3343 3344 3345 3346 3347 3348
	*intr_info = control->exit_int_info;
	if ((*intr_info & SVM_EXITINTINFO_VALID) &&
	    (*intr_info & SVM_EXITINTINFO_VALID_ERR))
		*error_code = control->exit_int_info_err;
	else
		*error_code = 0;
3349 3350
}

3351
static int handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath)
A
Avi Kivity 已提交
3352
{
3353
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
3354
	struct kvm_run *kvm_run = vcpu->run;
3355
	u32 exit_code = svm->vmcb->control.exit_code;
A
Avi Kivity 已提交
3356

3357 3358
	trace_kvm_exit(exit_code, vcpu, KVM_ISA_SVM);

3359 3360 3361 3362 3363 3364 3365
	/* SEV-ES guests must use the CR write traps to track CR registers. */
	if (!sev_es_guest(vcpu->kvm)) {
		if (!svm_is_intercept(svm, INTERCEPT_CR0_WRITE))
			vcpu->arch.cr0 = svm->vmcb->save.cr0;
		if (npt_enabled)
			vcpu->arch.cr3 = svm->vmcb->save.cr3;
	}
3366

3367
	if (is_guest_mode(vcpu)) {
3368 3369
		int vmexit;

3370
		trace_kvm_nested_vmexit(exit_code, vcpu, KVM_ISA_SVM);
3371

3372 3373 3374 3375 3376 3377
		vmexit = nested_svm_exit_special(svm);

		if (vmexit == NESTED_EXIT_CONTINUE)
			vmexit = nested_svm_exit_handled(svm);

		if (vmexit == NESTED_EXIT_DONE)
3378 3379 3380
			return 1;
	}

3381 3382 3383 3384
	if (svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
		kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
		kvm_run->fail_entry.hardware_entry_failure_reason
			= svm->vmcb->control.exit_code;
3385
		kvm_run->fail_entry.cpu = vcpu->arch.last_vmentry_cpu;
3386
		dump_vmcb(vcpu);
3387 3388 3389
		return 0;
	}

3390
	if (is_external_interrupt(svm->vmcb->control.exit_int_info) &&
3391
	    exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR &&
3392 3393
	    exit_code != SVM_EXIT_NPF && exit_code != SVM_EXIT_TASK_SWITCH &&
	    exit_code != SVM_EXIT_INTR && exit_code != SVM_EXIT_NMI)
3394
		printk(KERN_ERR "%s: unexpected exit_int_info 0x%x "
A
Avi Kivity 已提交
3395
		       "exit_code 0x%x\n",
3396
		       __func__, svm->vmcb->control.exit_int_info,
A
Avi Kivity 已提交
3397 3398
		       exit_code);

3399
	if (exit_fastpath != EXIT_FASTPATH_NONE)
3400
		return 1;
3401

3402
	return svm_invoke_exit_handler(svm, exit_code);
A
Avi Kivity 已提交
3403 3404 3405 3406
}

static void reload_tss(struct kvm_vcpu *vcpu)
{
3407
	struct svm_cpu_data *sd = per_cpu(svm_data, vcpu->cpu);
A
Avi Kivity 已提交
3408

3409
	sd->tss_desc->type = 9; /* available 32/64-bit TSS */
A
Avi Kivity 已提交
3410 3411 3412
	load_TR_desc();
}

R
Rusty Russell 已提交
3413
static void pre_svm_run(struct vcpu_svm *svm)
A
Avi Kivity 已提交
3414
{
3415
	struct svm_cpu_data *sd = per_cpu(svm_data, svm->vcpu.cpu);
A
Avi Kivity 已提交
3416

3417
	if (sev_guest(svm->vcpu.kvm))
3418
		return pre_sev_run(svm, svm->vcpu.cpu);
3419

3420
	/* FIXME: handle wraparound of asid_generation */
3421 3422
	if (svm->asid_generation != sd->asid_generation)
		new_asid(svm, sd);
A
Avi Kivity 已提交
3423 3424
}

3425 3426 3427 3428 3429 3430
static void svm_inject_nmi(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
	vcpu->arch.hflags |= HF_NMI_MASK;
3431 3432
	if (!sev_es_guest(svm->vcpu.kvm))
		svm_set_intercept(svm, INTERCEPT_IRET);
3433 3434
	++vcpu->stat.nmi_injections;
}
A
Avi Kivity 已提交
3435

3436
static void svm_set_irq(struct kvm_vcpu *vcpu)
E
Eddie Dong 已提交
3437 3438 3439
{
	struct vcpu_svm *svm = to_svm(vcpu);

3440
	BUG_ON(!(gif_set(svm)));
3441

3442 3443 3444
	trace_kvm_inj_virq(vcpu->arch.interrupt.nr);
	++vcpu->stat.irq_injections;

3445 3446
	svm->vmcb->control.event_inj = vcpu->arch.interrupt.nr |
		SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR;
E
Eddie Dong 已提交
3447 3448
}

3449
static void svm_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
3450 3451 3452
{
	struct vcpu_svm *svm = to_svm(vcpu);

3453 3454 3455 3456 3457 3458 3459
	/*
	 * SEV-ES guests must always keep the CR intercepts cleared. CR
	 * tracking is done using the CR write traps.
	 */
	if (sev_es_guest(vcpu->kvm))
		return;

3460
	if (nested_svm_virtualize_tpr(vcpu))
3461 3462
		return;

3463
	svm_clr_intercept(svm, INTERCEPT_CR8_WRITE);
3464

3465
	if (irr == -1)
3466 3467
		return;

3468
	if (tpr >= irr)
3469
		svm_set_intercept(svm, INTERCEPT_CR8_WRITE);
3470
}
3471

3472
bool svm_nmi_blocked(struct kvm_vcpu *vcpu)
3473 3474 3475
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
3476
	bool ret;
3477

3478
	if (!gif_set(svm))
3479 3480
		return true;

3481 3482 3483 3484 3485
	if (is_guest_mode(vcpu) && nested_exit_on_nmi(svm))
		return false;

	ret = (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK) ||
	      (svm->vcpu.arch.hflags & HF_NMI_MASK);
J
Joerg Roedel 已提交
3486 3487

	return ret;
3488 3489
}

3490
static int svm_nmi_allowed(struct kvm_vcpu *vcpu, bool for_injection)
3491 3492 3493
{
	struct vcpu_svm *svm = to_svm(vcpu);
	if (svm->nested.nested_run_pending)
3494
		return -EBUSY;
3495

3496 3497
	/* An NMI must not be injected into L2 if it's supposed to VM-Exit.  */
	if (for_injection && is_guest_mode(vcpu) && nested_exit_on_nmi(svm))
3498
		return -EBUSY;
3499 3500

	return !svm_nmi_blocked(vcpu);
3501 3502
}

J
Jan Kiszka 已提交
3503 3504 3505 3506 3507 3508 3509 3510 3511 3512 3513 3514 3515
static bool svm_get_nmi_mask(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	return !!(svm->vcpu.arch.hflags & HF_NMI_MASK);
}

static void svm_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (masked) {
		svm->vcpu.arch.hflags |= HF_NMI_MASK;
3516 3517
		if (!sev_es_guest(svm->vcpu.kvm))
			svm_set_intercept(svm, INTERCEPT_IRET);
J
Jan Kiszka 已提交
3518 3519
	} else {
		svm->vcpu.arch.hflags &= ~HF_NMI_MASK;
3520 3521
		if (!sev_es_guest(svm->vcpu.kvm))
			svm_clr_intercept(svm, INTERCEPT_IRET);
J
Jan Kiszka 已提交
3522 3523 3524
	}
}

3525
bool svm_interrupt_blocked(struct kvm_vcpu *vcpu)
3526 3527 3528
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
3529

3530
	if (!gif_set(svm))
3531
		return true;
3532

3533 3534 3535 3536 3537 3538 3539 3540
	if (sev_es_guest(svm->vcpu.kvm)) {
		/*
		 * SEV-ES guests to not expose RFLAGS. Use the VMCB interrupt mask
		 * bit to determine the state of the IF flag.
		 */
		if (!(vmcb->control.int_state & SVM_GUEST_INTERRUPT_MASK))
			return true;
	} else if (is_guest_mode(vcpu)) {
3541
		/* As long as interrupts are being delivered...  */
P
Paolo Bonzini 已提交
3542
		if ((svm->nested.ctl.int_ctl & V_INTR_MASKING_MASK)
P
Paolo Bonzini 已提交
3543
		    ? !(svm->nested.hsave->save.rflags & X86_EFLAGS_IF)
3544 3545 3546 3547 3548 3549 3550 3551 3552 3553 3554 3555
		    : !(kvm_get_rflags(vcpu) & X86_EFLAGS_IF))
			return true;

		/* ... vmexits aren't blocked by the interrupt shadow  */
		if (nested_exit_on_intr(svm))
			return false;
	} else {
		if (!(kvm_get_rflags(vcpu) & X86_EFLAGS_IF))
			return true;
	}

	return (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK);
3556 3557
}

3558
static int svm_interrupt_allowed(struct kvm_vcpu *vcpu, bool for_injection)
3559 3560 3561
{
	struct vcpu_svm *svm = to_svm(vcpu);
	if (svm->nested.nested_run_pending)
3562
		return -EBUSY;
3563

3564 3565 3566 3567 3568
	/*
	 * An IRQ must not be injected into L2 if it's supposed to VM-Exit,
	 * e.g. if the IRQ arrived asynchronously after checking nested events.
	 */
	if (for_injection && is_guest_mode(vcpu) && nested_exit_on_intr(svm))
3569
		return -EBUSY;
3570 3571

	return !svm_interrupt_blocked(vcpu);
3572 3573
}

3574
static void svm_enable_irq_window(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
3575
{
3576 3577
	struct vcpu_svm *svm = to_svm(vcpu);

J
Joerg Roedel 已提交
3578 3579 3580 3581
	/*
	 * In case GIF=0 we can't rely on the CPU to tell us when GIF becomes
	 * 1, because that's a separate STGI/VMRUN intercept.  The next time we
	 * get that intercept, this function will be called again though and
3582 3583 3584
	 * we'll get the vintr intercept. However, if the vGIF feature is
	 * enabled, the STGI interception will not occur. Enable the irq
	 * window under the assumption that the hardware will set the GIF.
J
Joerg Roedel 已提交
3585
	 */
3586
	if (vgif_enabled(svm) || gif_set(svm)) {
3587 3588 3589 3590 3591 3592 3593
		/*
		 * IRQ window is not needed when AVIC is enabled,
		 * unless we have pending ExtINT since it cannot be injected
		 * via AVIC. In such case, we need to temporarily disable AVIC,
		 * and fallback to injecting IRQ via V_IRQ.
		 */
		svm_toggle_avic_for_irq_window(vcpu, false);
3594 3595
		svm_set_vintr(svm);
	}
3596 3597
}

3598
static void svm_enable_nmi_window(struct kvm_vcpu *vcpu)
3599
{
3600
	struct vcpu_svm *svm = to_svm(vcpu);
3601

3602 3603
	if ((svm->vcpu.arch.hflags & (HF_NMI_MASK | HF_IRET_MASK))
	    == HF_NMI_MASK)
3604
		return; /* IRET will cause a vm exit */
3605

3606 3607
	if (!gif_set(svm)) {
		if (vgif_enabled(svm))
3608
			svm_set_intercept(svm, INTERCEPT_STGI);
3609
		return; /* STGI will cause a vm exit */
3610
	}
3611

J
Joerg Roedel 已提交
3612 3613 3614 3615
	/*
	 * Something prevents NMI from been injected. Single step over possible
	 * problem (IRET or exception injection or interrupt shadow)
	 */
3616
	svm->nmi_singlestep_guest_rflags = svm_get_rflags(vcpu);
J
Jan Kiszka 已提交
3617
	svm->nmi_singlestep = true;
3618
	svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
3619 3620
}

3621 3622 3623 3624 3625
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
{
	return 0;
}

3626 3627 3628 3629 3630
static int svm_set_identity_map_addr(struct kvm *kvm, u64 ident_addr)
{
	return 0;
}

3631
void svm_flush_tlb(struct kvm_vcpu *vcpu)
3632
{
3633 3634
	struct vcpu_svm *svm = to_svm(vcpu);

3635 3636 3637 3638 3639 3640 3641
	/*
	 * Flush only the current ASID even if the TLB flush was invoked via
	 * kvm_flush_remote_tlbs().  Although flushing remote TLBs requires all
	 * ASIDs to be flushed, KVM uses a single ASID for L1 and L2, and
	 * unconditionally does a TLB flush on both nested VM-Enter and nested
	 * VM-Exit (via kvm_mmu_reset_context()).
	 */
3642 3643 3644 3645
	if (static_cpu_has(X86_FEATURE_FLUSHBYASID))
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ASID;
	else
		svm->asid_generation--;
3646 3647
}

3648 3649 3650 3651 3652 3653 3654
static void svm_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t gva)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	invlpga(gva, svm->vmcb->control.asid);
}

3655 3656 3657 3658
static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

3659
	if (nested_svm_virtualize_tpr(vcpu))
3660 3661
		return;

3662
	if (!svm_is_intercept(svm, INTERCEPT_CR8_WRITE)) {
3663
		int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK;
3664
		kvm_set_cr8(vcpu, cr8);
3665 3666 3667
	}
}

3668 3669 3670 3671 3672
static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 cr8;

3673
	if (nested_svm_virtualize_tpr(vcpu) ||
3674
	    kvm_vcpu_apicv_active(vcpu))
3675 3676
		return;

3677 3678 3679 3680 3681
	cr8 = kvm_get_cr8(vcpu);
	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
}

3682 3683 3684 3685 3686
static void svm_complete_interrupts(struct vcpu_svm *svm)
{
	u8 vector;
	int type;
	u32 exitintinfo = svm->vmcb->control.exit_int_info;
3687 3688 3689
	unsigned int3_injected = svm->int3_injected;

	svm->int3_injected = 0;
3690

3691 3692 3693 3694
	/*
	 * If we've made progress since setting HF_IRET_MASK, we've
	 * executed an IRET and can allow NMI injection.
	 */
3695 3696 3697
	if ((svm->vcpu.arch.hflags & HF_IRET_MASK) &&
	    (sev_es_guest(svm->vcpu.kvm) ||
	     kvm_rip_read(&svm->vcpu) != svm->nmi_iret_rip)) {
3698
		svm->vcpu.arch.hflags &= ~(HF_NMI_MASK | HF_IRET_MASK);
3699 3700
		kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
	}
3701

3702 3703 3704 3705 3706 3707 3708
	svm->vcpu.arch.nmi_injected = false;
	kvm_clear_exception_queue(&svm->vcpu);
	kvm_clear_interrupt_queue(&svm->vcpu);

	if (!(exitintinfo & SVM_EXITINTINFO_VALID))
		return;

3709 3710
	kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);

3711 3712 3713 3714 3715 3716 3717 3718
	vector = exitintinfo & SVM_EXITINTINFO_VEC_MASK;
	type = exitintinfo & SVM_EXITINTINFO_TYPE_MASK;

	switch (type) {
	case SVM_EXITINTINFO_TYPE_NMI:
		svm->vcpu.arch.nmi_injected = true;
		break;
	case SVM_EXITINTINFO_TYPE_EXEPT:
3719 3720 3721 3722 3723 3724
		/*
		 * Never re-inject a #VC exception.
		 */
		if (vector == X86_TRAP_VC)
			break;

3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735
		/*
		 * In case of software exceptions, do not reinject the vector,
		 * but re-execute the instruction instead. Rewind RIP first
		 * if we emulated INT3 before.
		 */
		if (kvm_exception_is_soft(vector)) {
			if (vector == BP_VECTOR && int3_injected &&
			    kvm_is_linear_rip(&svm->vcpu, svm->int3_rip))
				kvm_rip_write(&svm->vcpu,
					      kvm_rip_read(&svm->vcpu) -
					      int3_injected);
3736
			break;
3737
		}
3738 3739
		if (exitintinfo & SVM_EXITINTINFO_VALID_ERR) {
			u32 err = svm->vmcb->control.exit_int_info_err;
3740
			kvm_requeue_exception_e(&svm->vcpu, vector, err);
3741 3742

		} else
3743
			kvm_requeue_exception(&svm->vcpu, vector);
3744 3745
		break;
	case SVM_EXITINTINFO_TYPE_INTR:
3746
		kvm_queue_interrupt(&svm->vcpu, vector, false);
3747 3748 3749 3750 3751 3752
		break;
	default:
		break;
	}
}

A
Avi Kivity 已提交
3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763
static void svm_cancel_injection(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb_control_area *control = &svm->vmcb->control;

	control->exit_int_info = control->event_inj;
	control->exit_int_info_err = control->event_inj_err;
	control->event_inj = 0;
	svm_complete_interrupts(svm);
}

3764
static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
3765
{
3766
	if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR &&
3767 3768 3769 3770 3771 3772
	    to_svm(vcpu)->vmcb->control.exit_info_1)
		return handle_fastpath_set_msr_irqoff(vcpu);

	return EXIT_FASTPATH_NONE;
}

3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795
static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu,
					struct vcpu_svm *svm)
{
	/*
	 * VMENTER enables interrupts (host state), but the kernel state is
	 * interrupts disabled when this is invoked. Also tell RCU about
	 * it. This is the same logic as for exit_to_user_mode().
	 *
	 * This ensures that e.g. latency analysis on the host observes
	 * guest mode as interrupt enabled.
	 *
	 * guest_enter_irqoff() informs context tracking about the
	 * transition to guest mode and if enabled adjusts RCU state
	 * accordingly.
	 */
	instrumentation_begin();
	trace_hardirqs_on_prepare();
	lockdep_hardirqs_on_prepare(CALLER_ADDR0);
	instrumentation_end();

	guest_enter_irqoff();
	lockdep_hardirqs_on(CALLER_ADDR0);

3796 3797 3798
	if (sev_es_guest(svm->vcpu.kvm)) {
		__svm_sev_es_vcpu_run(svm->vmcb_pa);
	} else {
3799 3800
		struct svm_cpu_data *sd = per_cpu(svm_data, vcpu->cpu);

3801
		__svm_vcpu_run(svm->vmcb_pa, (unsigned long *)&svm->vcpu.arch.regs);
3802

3803
		vmload(__sme_page_pa(sd->save_area));
3804
	}
3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825

	/*
	 * VMEXIT disables interrupts (host state), but tracing and lockdep
	 * have them in state 'on' as recorded before entering guest mode.
	 * Same as enter_from_user_mode().
	 *
	 * guest_exit_irqoff() restores host context and reinstates RCU if
	 * enabled and required.
	 *
	 * This needs to be done before the below as native_read_msr()
	 * contains a tracepoint and x86_spec_ctrl_restore_host() calls
	 * into world and some more.
	 */
	lockdep_hardirqs_off(CALLER_ADDR0);
	guest_exit_irqoff();

	instrumentation_begin();
	trace_hardirqs_off_finish();
	instrumentation_end();
}

3826
static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
3827
{
3828
	struct vcpu_svm *svm = to_svm(vcpu);
3829

3830 3831
	trace_kvm_entry(vcpu);

3832 3833 3834 3835
	svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
	svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
	svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];

3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851
	/*
	 * Disable singlestep if we're injecting an interrupt/exception.
	 * We don't want our modified rflags to be pushed on the stack where
	 * we might not be able to easily reset them if we disabled NMI
	 * singlestep later.
	 */
	if (svm->nmi_singlestep && svm->vmcb->control.event_inj) {
		/*
		 * Event injection happens before external interrupts cause a
		 * vmexit and interrupts are disabled here, so smp_send_reschedule
		 * is enough to force an immediate vmexit.
		 */
		disable_nmi_singlestep(svm);
		smp_send_reschedule(vcpu->cpu);
	}

R
Rusty Russell 已提交
3852
	pre_svm_run(svm);
A
Avi Kivity 已提交
3853

3854 3855
	sync_lapic_to_cr8(vcpu);

C
Cathy Avery 已提交
3856 3857 3858 3859
	if (unlikely(svm->asid != svm->vmcb->control.asid)) {
		svm->vmcb->control.asid = svm->asid;
		vmcb_mark_dirty(svm->vmcb, VMCB_ASID);
	}
3860
	svm->vmcb->save.cr2 = vcpu->arch.cr2;
A
Avi Kivity 已提交
3861

3862 3863 3864 3865 3866 3867 3868
	/*
	 * Run with all-zero DR6 unless needed, so that we can get the exact cause
	 * of a #DB.
	 */
	if (unlikely(svm->vcpu.arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))
		svm_set_dr6(svm, vcpu->arch.dr6);
	else
3869
		svm_set_dr6(svm, DR6_ACTIVE_LOW);
3870

3871
	clgi();
3872
	kvm_load_guest_xsave_state(vcpu);
3873

3874
	kvm_wait_lapic_expire(vcpu);
3875

3876 3877 3878 3879 3880 3881
	/*
	 * If this vCPU has touched SPEC_CTRL, restore the guest's value if
	 * it's non-zero. Since vmentry is serialising on affected CPUs, there
	 * is no need to worry about the conditional branch over the wrmsr
	 * being speculatively taken.
	 */
3882
	x86_spec_ctrl_set_guest(svm->spec_ctrl, svm->virt_spec_ctrl);
3883

3884
	svm_vcpu_enter_exit(vcpu, svm);
3885

3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900
	/*
	 * We do not use IBRS in the kernel. If this vCPU has used the
	 * SPEC_CTRL MSR it may have left it on; save the value and
	 * turn it off. This is much more efficient than blindly adding
	 * it to the atomic save/restore list. Especially as the former
	 * (Saving guest MSRs on vmexit) doesn't even exist in KVM.
	 *
	 * For non-nested case:
	 * If the L01 MSR bitmap does not intercept the MSR, then we need to
	 * save it.
	 *
	 * For nested case:
	 * If the L02 MSR bitmap does not intercept the MSR, then we need to
	 * save it.
	 */
3901
	if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
3902
		svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL);
3903

3904 3905
	if (!sev_es_guest(svm->vcpu.kvm))
		reload_tss(vcpu);
A
Avi Kivity 已提交
3906

3907 3908
	x86_spec_ctrl_restore_host(svm->spec_ctrl, svm->virt_spec_ctrl);

3909 3910 3911 3912 3913 3914
	if (!sev_es_guest(svm->vcpu.kvm)) {
		vcpu->arch.cr2 = svm->vmcb->save.cr2;
		vcpu->arch.regs[VCPU_REGS_RAX] = svm->vmcb->save.rax;
		vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
		vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
	}
3915

3916
	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
3917
		kvm_before_interrupt(&svm->vcpu);
3918

3919
	kvm_load_host_xsave_state(vcpu);
3920 3921 3922 3923 3924
	stgi();

	/* Any pending NMI will happen here */

	if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
3925
		kvm_after_interrupt(&svm->vcpu);
3926

3927 3928
	sync_cr8_to_lapic(vcpu);

3929
	svm->next_rip = 0;
3930 3931 3932 3933
	if (is_guest_mode(&svm->vcpu)) {
		sync_nested_vmcb_control(svm);
		svm->nested.nested_run_pending = 0;
	}
3934

3935
	svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
3936
	vmcb_mark_all_clean(svm->vmcb);
3937

G
Gleb Natapov 已提交
3938 3939
	/* if exit due to PF check for async PF */
	if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
3940 3941
		svm->vcpu.arch.apf.host_apf_flags =
			kvm_read_and_reset_apf_flags();
G
Gleb Natapov 已提交
3942

A
Avi Kivity 已提交
3943 3944 3945 3946
	if (npt_enabled) {
		vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
		vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
	}
3947 3948 3949 3950 3951 3952 3953 3954

	/*
	 * We need to handle MC intercepts here before the vcpu has a chance to
	 * change the physical cpu
	 */
	if (unlikely(svm->vmcb->control.exit_code ==
		     SVM_EXIT_EXCP_BASE + MC_VECTOR))
		svm_handle_mce(svm);
3955

3956
	svm_complete_interrupts(svm);
3957 3958 3959 3960 3961

	if (is_guest_mode(vcpu))
		return EXIT_FASTPATH_NONE;

	return svm_exit_handlers_fastpath(vcpu);
A
Avi Kivity 已提交
3962 3963
}

3964 3965
static void svm_load_mmu_pgd(struct kvm_vcpu *vcpu, unsigned long root,
			     int root_level)
A
Avi Kivity 已提交
3966
{
3967
	struct vcpu_svm *svm = to_svm(vcpu);
3968
	unsigned long cr3;
3969

3970 3971 3972
	cr3 = __sme_set(root);
	if (npt_enabled) {
		svm->vmcb->control.nested_cr3 = cr3;
3973
		vmcb_mark_dirty(svm->vmcb, VMCB_NPT);
3974

3975
		/* Loading L2's CR3 is handled by enter_svm_guest_mode.  */
3976 3977 3978
		if (!test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
			return;
		cr3 = vcpu->arch.cr3;
3979
	}
3980

3981
	svm->vmcb->save.cr3 = cr3;
3982
	vmcb_mark_dirty(svm->vmcb, VMCB_CR);
3983 3984
}

A
Avi Kivity 已提交
3985 3986
static int is_disabled(void)
{
3987 3988 3989 3990 3991 3992
	u64 vm_cr;

	rdmsrl(MSR_VM_CR, vm_cr);
	if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE))
		return 1;

A
Avi Kivity 已提交
3993 3994 3995
	return 0;
}

I
Ingo Molnar 已提交
3996 3997 3998 3999 4000 4001 4002 4003 4004 4005 4006
static void
svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
{
	/*
	 * Patch in the VMMCALL instruction:
	 */
	hypercall[0] = 0x0f;
	hypercall[1] = 0x01;
	hypercall[2] = 0xd9;
}

4007
static int __init svm_check_processor_compat(void)
Y
Yang, Sheng 已提交
4008
{
4009
	return 0;
Y
Yang, Sheng 已提交
4010 4011
}

4012 4013 4014 4015 4016
static bool svm_cpu_has_accelerated_tpr(void)
{
	return false;
}

4017 4018 4019 4020 4021
/*
 * The kvm parameter can be NULL (module initialization, or invocation before
 * VM creation). Be sure to check the kvm parameter before using it.
 */
static bool svm_has_emulated_msr(struct kvm *kvm, u32 index)
4022
{
4023 4024
	switch (index) {
	case MSR_IA32_MCG_EXT_CTL:
4025
	case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
4026
		return false;
4027 4028 4029 4030 4031
	case MSR_IA32_SMBASE:
		/* SEV-ES guests do not support SMM, so report false */
		if (kvm && sev_es_guest(kvm))
			return false;
		break;
4032 4033 4034 4035
	default:
		break;
	}

4036 4037 4038
	return true;
}

4039 4040 4041 4042 4043
static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
{
	return 0;
}

4044
static void svm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu)
4045
{
4046
	struct vcpu_svm *svm = to_svm(vcpu);
4047
	struct kvm_cpuid_entry2 *best;
4048

4049
	vcpu->arch.xsaves_enabled = guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
4050
				    boot_cpu_has(X86_FEATURE_XSAVE) &&
4051 4052
				    boot_cpu_has(X86_FEATURE_XSAVES);

4053
	/* Update nrips enabled cache */
4054 4055
	svm->nrips_enabled = kvm_cpu_cap_has(X86_FEATURE_NRIPS) &&
			     guest_cpuid_has(&svm->vcpu, X86_FEATURE_NRIPS);
4056

4057 4058 4059
	/* Check again if INVPCID interception if required */
	svm_check_invpcid(svm);

4060 4061 4062 4063 4064 4065 4066
	/* For sev guests, the memory encryption bit is not reserved in CR3.  */
	if (sev_guest(vcpu->kvm)) {
		best = kvm_find_cpuid_entry(vcpu, 0x8000001F, 0);
		if (best)
			vcpu->arch.cr3_lm_rsvd_bits &= ~(1UL << (best->ebx & 0x3f));
	}

4067 4068 4069
	if (!kvm_vcpu_apicv_active(vcpu))
		return;

4070 4071 4072 4073 4074 4075 4076
	/*
	 * AVIC does not work with an x2APIC mode guest. If the X2APIC feature
	 * is exposed to the guest, disable AVIC.
	 */
	if (guest_cpuid_has(vcpu, X86_FEATURE_X2APIC))
		kvm_request_apicv_update(vcpu->kvm, false,
					 APICV_INHIBIT_REASON_X2APIC);
4077 4078 4079 4080 4081 4082 4083 4084

	/*
	 * Currently, AVIC does not work with nested virtualization.
	 * So, we disable AVIC when cpuid for SVM is set in the L1 guest.
	 */
	if (nested && guest_cpuid_has(vcpu, X86_FEATURE_SVM))
		kvm_request_apicv_update(vcpu->kvm, false,
					 APICV_INHIBIT_REASON_NESTED);
4085 4086
}

4087 4088 4089 4090 4091
static bool svm_has_wbinvd_exit(void)
{
	return true;
}

4092
#define PRE_EX(exit)  { .exit_code = (exit), \
4093
			.stage = X86_ICPT_PRE_EXCEPT, }
4094
#define POST_EX(exit) { .exit_code = (exit), \
4095
			.stage = X86_ICPT_POST_EXCEPT, }
4096
#define POST_MEM(exit) { .exit_code = (exit), \
4097
			.stage = X86_ICPT_POST_MEMACCESS, }
4098

4099
static const struct __x86_intercept {
4100 4101 4102 4103 4104 4105 4106 4107
	u32 exit_code;
	enum x86_intercept_stage stage;
} x86_intercept_map[] = {
	[x86_intercept_cr_read]		= POST_EX(SVM_EXIT_READ_CR0),
	[x86_intercept_cr_write]	= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_clts]		= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_lmsw]		= POST_EX(SVM_EXIT_WRITE_CR0),
	[x86_intercept_smsw]		= POST_EX(SVM_EXIT_READ_CR0),
4108 4109
	[x86_intercept_dr_read]		= POST_EX(SVM_EXIT_READ_DR0),
	[x86_intercept_dr_write]	= POST_EX(SVM_EXIT_WRITE_DR0),
4110 4111 4112 4113 4114 4115 4116 4117
	[x86_intercept_sldt]		= POST_EX(SVM_EXIT_LDTR_READ),
	[x86_intercept_str]		= POST_EX(SVM_EXIT_TR_READ),
	[x86_intercept_lldt]		= POST_EX(SVM_EXIT_LDTR_WRITE),
	[x86_intercept_ltr]		= POST_EX(SVM_EXIT_TR_WRITE),
	[x86_intercept_sgdt]		= POST_EX(SVM_EXIT_GDTR_READ),
	[x86_intercept_sidt]		= POST_EX(SVM_EXIT_IDTR_READ),
	[x86_intercept_lgdt]		= POST_EX(SVM_EXIT_GDTR_WRITE),
	[x86_intercept_lidt]		= POST_EX(SVM_EXIT_IDTR_WRITE),
4118 4119 4120 4121 4122 4123 4124 4125
	[x86_intercept_vmrun]		= POST_EX(SVM_EXIT_VMRUN),
	[x86_intercept_vmmcall]		= POST_EX(SVM_EXIT_VMMCALL),
	[x86_intercept_vmload]		= POST_EX(SVM_EXIT_VMLOAD),
	[x86_intercept_vmsave]		= POST_EX(SVM_EXIT_VMSAVE),
	[x86_intercept_stgi]		= POST_EX(SVM_EXIT_STGI),
	[x86_intercept_clgi]		= POST_EX(SVM_EXIT_CLGI),
	[x86_intercept_skinit]		= POST_EX(SVM_EXIT_SKINIT),
	[x86_intercept_invlpga]		= POST_EX(SVM_EXIT_INVLPGA),
4126 4127 4128
	[x86_intercept_rdtscp]		= POST_EX(SVM_EXIT_RDTSCP),
	[x86_intercept_monitor]		= POST_MEM(SVM_EXIT_MONITOR),
	[x86_intercept_mwait]		= POST_EX(SVM_EXIT_MWAIT),
4129 4130 4131 4132 4133 4134 4135 4136 4137
	[x86_intercept_invlpg]		= POST_EX(SVM_EXIT_INVLPG),
	[x86_intercept_invd]		= POST_EX(SVM_EXIT_INVD),
	[x86_intercept_wbinvd]		= POST_EX(SVM_EXIT_WBINVD),
	[x86_intercept_wrmsr]		= POST_EX(SVM_EXIT_MSR),
	[x86_intercept_rdtsc]		= POST_EX(SVM_EXIT_RDTSC),
	[x86_intercept_rdmsr]		= POST_EX(SVM_EXIT_MSR),
	[x86_intercept_rdpmc]		= POST_EX(SVM_EXIT_RDPMC),
	[x86_intercept_cpuid]		= PRE_EX(SVM_EXIT_CPUID),
	[x86_intercept_rsm]		= PRE_EX(SVM_EXIT_RSM),
4138 4139 4140 4141 4142 4143 4144
	[x86_intercept_pause]		= PRE_EX(SVM_EXIT_PAUSE),
	[x86_intercept_pushf]		= PRE_EX(SVM_EXIT_PUSHF),
	[x86_intercept_popf]		= PRE_EX(SVM_EXIT_POPF),
	[x86_intercept_intn]		= PRE_EX(SVM_EXIT_SWINT),
	[x86_intercept_iret]		= PRE_EX(SVM_EXIT_IRET),
	[x86_intercept_icebp]		= PRE_EX(SVM_EXIT_ICEBP),
	[x86_intercept_hlt]		= POST_EX(SVM_EXIT_HLT),
4145 4146 4147 4148
	[x86_intercept_in]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_ins]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_out]		= POST_EX(SVM_EXIT_IOIO),
	[x86_intercept_outs]		= POST_EX(SVM_EXIT_IOIO),
4149
	[x86_intercept_xsetbv]		= PRE_EX(SVM_EXIT_XSETBV),
4150 4151
};

4152
#undef PRE_EX
4153
#undef POST_EX
4154
#undef POST_MEM
4155

4156 4157
static int svm_check_intercept(struct kvm_vcpu *vcpu,
			       struct x86_instruction_info *info,
4158 4159
			       enum x86_intercept_stage stage,
			       struct x86_exception *exception)
4160
{
4161 4162 4163 4164 4165 4166 4167 4168 4169 4170
	struct vcpu_svm *svm = to_svm(vcpu);
	int vmexit, ret = X86EMUL_CONTINUE;
	struct __x86_intercept icpt_info;
	struct vmcb *vmcb = svm->vmcb;

	if (info->intercept >= ARRAY_SIZE(x86_intercept_map))
		goto out;

	icpt_info = x86_intercept_map[info->intercept];

4171
	if (stage != icpt_info.stage)
4172 4173 4174 4175 4176 4177 4178 4179 4180 4181 4182 4183 4184
		goto out;

	switch (icpt_info.exit_code) {
	case SVM_EXIT_READ_CR0:
		if (info->intercept == x86_intercept_cr_read)
			icpt_info.exit_code += info->modrm_reg;
		break;
	case SVM_EXIT_WRITE_CR0: {
		unsigned long cr0, val;

		if (info->intercept == x86_intercept_cr_write)
			icpt_info.exit_code += info->modrm_reg;

4185 4186
		if (icpt_info.exit_code != SVM_EXIT_WRITE_CR0 ||
		    info->intercept == x86_intercept_clts)
4187 4188
			break;

4189 4190
		if (!(vmcb_is_intercept(&svm->nested.ctl,
					INTERCEPT_SELECTIVE_CR0)))
4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206 4207 4208
			break;

		cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
		val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;

		if (info->intercept == x86_intercept_lmsw) {
			cr0 &= 0xfUL;
			val &= 0xfUL;
			/* lmsw can't clear PE - catch this here */
			if (cr0 & X86_CR0_PE)
				val |= X86_CR0_PE;
		}

		if (cr0 ^ val)
			icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;

		break;
	}
4209 4210 4211 4212
	case SVM_EXIT_READ_DR0:
	case SVM_EXIT_WRITE_DR0:
		icpt_info.exit_code += info->modrm_reg;
		break;
4213 4214 4215 4216 4217 4218
	case SVM_EXIT_MSR:
		if (info->intercept == x86_intercept_wrmsr)
			vmcb->control.exit_info_1 = 1;
		else
			vmcb->control.exit_info_1 = 0;
		break;
4219 4220 4221 4222 4223 4224 4225
	case SVM_EXIT_PAUSE:
		/*
		 * We get this for NOP only, but pause
		 * is rep not, check this here
		 */
		if (info->rep_prefix != REPE_PREFIX)
			goto out;
4226
		break;
4227 4228 4229 4230 4231 4232
	case SVM_EXIT_IOIO: {
		u64 exit_info;
		u32 bytes;

		if (info->intercept == x86_intercept_in ||
		    info->intercept == x86_intercept_ins) {
4233 4234
			exit_info = ((info->src_val & 0xffff) << 16) |
				SVM_IOIO_TYPE_MASK;
4235
			bytes = info->dst_bytes;
4236
		} else {
4237
			exit_info = (info->dst_val & 0xffff) << 16;
4238
			bytes = info->src_bytes;
4239 4240 4241 4242 4243 4244 4245 4246 4247 4248 4249 4250 4251 4252 4253 4254 4255 4256 4257 4258
		}

		if (info->intercept == x86_intercept_outs ||
		    info->intercept == x86_intercept_ins)
			exit_info |= SVM_IOIO_STR_MASK;

		if (info->rep_prefix)
			exit_info |= SVM_IOIO_REP_MASK;

		bytes = min(bytes, 4u);

		exit_info |= bytes << SVM_IOIO_SIZE_SHIFT;

		exit_info |= (u32)info->ad_bytes << (SVM_IOIO_ASIZE_SHIFT - 1);

		vmcb->control.exit_info_1 = exit_info;
		vmcb->control.exit_info_2 = info->next_rip;

		break;
	}
4259 4260 4261 4262
	default:
		break;
	}

4263 4264 4265
	/* TODO: Advertise NRIPS to guest hypervisor unconditionally */
	if (static_cpu_has(X86_FEATURE_NRIPS))
		vmcb->control.next_rip  = info->next_rip;
4266 4267 4268 4269 4270 4271 4272 4273
	vmcb->control.exit_code = icpt_info.exit_code;
	vmexit = nested_svm_exit_handled(svm);

	ret = (vmexit == NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED
					   : X86EMUL_CONTINUE;

out:
	return ret;
4274 4275
}

4276
static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu)
4277 4278 4279
{
}

4280 4281
static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
{
4282
	if (!kvm_pause_in_guest(vcpu->kvm))
4283
		shrink_ple_window(vcpu);
4284 4285
}

4286 4287 4288 4289 4290 4291
static void svm_setup_mce(struct kvm_vcpu *vcpu)
{
	/* [63:9] are reserved. */
	vcpu->arch.mcg_cap &= 0x1ff;
}

4292
bool svm_smi_blocked(struct kvm_vcpu *vcpu)
4293
{
4294 4295 4296 4297
	struct vcpu_svm *svm = to_svm(vcpu);

	/* Per APM Vol.2 15.22.2 "Response to SMI" */
	if (!gif_set(svm))
4298 4299 4300 4301 4302
		return true;

	return is_smm(vcpu);
}

4303
static int svm_smi_allowed(struct kvm_vcpu *vcpu, bool for_injection)
4304 4305 4306
{
	struct vcpu_svm *svm = to_svm(vcpu);
	if (svm->nested.nested_run_pending)
4307
		return -EBUSY;
4308

4309 4310
	/* An SMI must not be injected into L2 if it's supposed to VM-Exit.  */
	if (for_injection && is_guest_mode(vcpu) && nested_exit_on_smi(svm))
4311
		return -EBUSY;
4312

4313
	return !svm_smi_blocked(vcpu);
4314 4315
}

4316 4317
static int svm_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
{
4318 4319 4320 4321 4322 4323 4324
	struct vcpu_svm *svm = to_svm(vcpu);
	int ret;

	if (is_guest_mode(vcpu)) {
		/* FED8h - SVM Guest */
		put_smstate(u64, smstate, 0x7ed8, 1);
		/* FEE0h - SVM Guest VMCB Physical Address */
4325
		put_smstate(u64, smstate, 0x7ee0, svm->nested.vmcb12_gpa);
4326 4327 4328 4329 4330 4331 4332 4333 4334

		svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
		svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
		svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];

		ret = nested_svm_vmexit(svm);
		if (ret)
			return ret;
	}
4335 4336 4337
	return 0;
}

4338
static int svm_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
4339
{
4340
	struct vcpu_svm *svm = to_svm(vcpu);
4341
	struct kvm_host_map map;
4342
	int ret = 0;
4343

4344 4345 4346
	if (guest_cpuid_has(vcpu, X86_FEATURE_LM)) {
		u64 saved_efer = GET_SMSTATE(u64, smstate, 0x7ed0);
		u64 guest = GET_SMSTATE(u64, smstate, 0x7ed8);
4347
		u64 vmcb12_gpa = GET_SMSTATE(u64, smstate, 0x7ee0);
4348

4349 4350 4351 4352 4353 4354 4355 4356
		if (guest) {
			if (!guest_cpuid_has(vcpu, X86_FEATURE_SVM))
				return 1;

			if (!(saved_efer & EFER_SVME))
				return 1;

			if (kvm_vcpu_map(&svm->vcpu,
4357
					 gpa_to_gfn(vmcb12_gpa), &map) == -EINVAL)
4358 4359
				return 1;

4360
			if (svm_allocate_nested(svm))
4361 4362
				return 1;

4363
			ret = enter_svm_guest_mode(svm, vmcb12_gpa, map.hva);
4364 4365
			kvm_vcpu_unmap(&svm->vcpu, &map, true);
		}
4366
	}
4367 4368

	return ret;
4369 4370
}

4371
static void svm_enable_smi_window(struct kvm_vcpu *vcpu)
4372 4373 4374 4375 4376
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!gif_set(svm)) {
		if (vgif_enabled(svm))
4377
			svm_set_intercept(svm, INTERCEPT_STGI);
4378
		/* STGI will cause a vm exit */
4379 4380
	} else {
		/* We must be in SMM; RSM will cause a vmexit anyway.  */
4381 4382 4383
	}
}

4384
static bool svm_can_emulate_instruction(struct kvm_vcpu *vcpu, void *insn, int insn_len)
4385
{
4386 4387
	bool smep, smap, is_user;
	unsigned long cr4;
4388

4389 4390 4391 4392 4393 4394
	/*
	 * When the guest is an SEV-ES guest, emulation is not possible.
	 */
	if (sev_es_guest(vcpu->kvm))
		return false;

4395
	/*
4396 4397 4398 4399 4400 4401 4402 4403 4404 4405 4406 4407 4408 4409 4410 4411 4412 4413 4414 4415 4416 4417 4418 4419 4420 4421 4422 4423 4424
	 * Detect and workaround Errata 1096 Fam_17h_00_0Fh.
	 *
	 * Errata:
	 * When CPU raise #NPF on guest data access and vCPU CR4.SMAP=1, it is
	 * possible that CPU microcode implementing DecodeAssist will fail
	 * to read bytes of instruction which caused #NPF. In this case,
	 * GuestIntrBytes field of the VMCB on a VMEXIT will incorrectly
	 * return 0 instead of the correct guest instruction bytes.
	 *
	 * This happens because CPU microcode reading instruction bytes
	 * uses a special opcode which attempts to read data using CPL=0
	 * priviledges. The microcode reads CS:RIP and if it hits a SMAP
	 * fault, it gives up and returns no instruction bytes.
	 *
	 * Detection:
	 * We reach here in case CPU supports DecodeAssist, raised #NPF and
	 * returned 0 in GuestIntrBytes field of the VMCB.
	 * First, errata can only be triggered in case vCPU CR4.SMAP=1.
	 * Second, if vCPU CR4.SMEP=1, errata could only be triggered
	 * in case vCPU CPL==3 (Because otherwise guest would have triggered
	 * a SMEP fault instead of #NPF).
	 * Otherwise, vCPU CR4.SMEP=0, errata could be triggered by any vCPU CPL.
	 * As most guests enable SMAP if they have also enabled SMEP, use above
	 * logic in order to attempt minimize false-positive of detecting errata
	 * while still preserving all cases semantic correctness.
	 *
	 * Workaround:
	 * To determine what instruction the guest was executing, the hypervisor
	 * will have to decode the instruction at the instruction pointer.
4425 4426 4427 4428 4429 4430 4431 4432 4433 4434
	 *
	 * In non SEV guest, hypervisor will be able to read the guest
	 * memory to decode the instruction pointer when insn_len is zero
	 * so we return true to indicate that decoding is possible.
	 *
	 * But in the SEV guest, the guest memory is encrypted with the
	 * guest specific key and hypervisor will not be able to decode the
	 * instruction pointer so we will not able to workaround it. Lets
	 * print the error and request to kill the guest.
	 */
4435 4436 4437 4438 4439 4440 4441 4442 4443 4444 4445 4446 4447 4448
	if (likely(!insn || insn_len))
		return true;

	/*
	 * If RIP is invalid, go ahead with emulation which will cause an
	 * internal error exit.
	 */
	if (!kvm_vcpu_gfn_to_memslot(vcpu, kvm_rip_read(vcpu) >> PAGE_SHIFT))
		return true;

	cr4 = kvm_read_cr4(vcpu);
	smep = cr4 & X86_CR4_SMEP;
	smap = cr4 & X86_CR4_SMAP;
	is_user = svm_get_cpl(vcpu) == 3;
4449
	if (smap && (!smep || is_user)) {
4450 4451 4452
		if (!sev_guest(vcpu->kvm))
			return true;

4453
		pr_err_ratelimited("KVM: SEV Guest triggered AMD Erratum 1096\n");
4454 4455 4456 4457 4458 4459
		kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
	}

	return false;
}

4460 4461 4462 4463 4464 4465 4466
static bool svm_apic_init_signal_blocked(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	/*
	 * TODO: Last condition latch INIT signals on vCPU when
	 * vCPU is in guest-mode and vmcb12 defines intercept on INIT.
4467 4468 4469
	 * To properly emulate the INIT intercept,
	 * svm_check_nested_events() should call nested_svm_vmexit()
	 * if an INIT signal is pending.
4470 4471
	 */
	return !gif_set(svm) ||
4472
		   (vmcb_is_intercept(&svm->vmcb->control, INTERCEPT_INIT));
4473 4474
}

4475 4476 4477 4478 4479 4480 4481 4482
static void svm_vcpu_deliver_sipi_vector(struct kvm_vcpu *vcpu, u8 vector)
{
	if (!sev_es_guest(vcpu->kvm))
		return kvm_vcpu_deliver_sipi_vector(vcpu, vector);

	sev_vcpu_deliver_sipi_vector(vcpu, vector);
}

4483 4484 4485 4486 4487 4488 4489 4490
static void svm_vm_destroy(struct kvm *kvm)
{
	avic_vm_destroy(kvm);
	sev_vm_destroy(kvm);
}

static int svm_vm_init(struct kvm *kvm)
{
4491 4492 4493
	if (!pause_filter_count || !pause_filter_thresh)
		kvm->arch.pause_in_guest = true;

4494 4495 4496 4497 4498 4499 4500 4501 4502 4503
	if (avic) {
		int ret = avic_vm_init(kvm);
		if (ret)
			return ret;
	}

	kvm_apicv_init(kvm, avic);
	return 0;
}

4504
static struct kvm_x86_ops svm_x86_ops __initdata = {
4505
	.hardware_unsetup = svm_hardware_teardown,
A
Avi Kivity 已提交
4506 4507
	.hardware_enable = svm_hardware_enable,
	.hardware_disable = svm_hardware_disable,
4508
	.cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr,
4509
	.has_emulated_msr = svm_has_emulated_msr,
A
Avi Kivity 已提交
4510 4511 4512

	.vcpu_create = svm_create_vcpu,
	.vcpu_free = svm_free_vcpu,
4513
	.vcpu_reset = svm_vcpu_reset,
A
Avi Kivity 已提交
4514

4515
	.vm_size = sizeof(struct kvm_svm),
4516
	.vm_init = svm_vm_init,
B
Brijesh Singh 已提交
4517
	.vm_destroy = svm_vm_destroy,
4518

4519
	.prepare_guest_switch = svm_prepare_guest_switch,
A
Avi Kivity 已提交
4520 4521
	.vcpu_load = svm_vcpu_load,
	.vcpu_put = svm_vcpu_put,
4522 4523
	.vcpu_blocking = svm_vcpu_blocking,
	.vcpu_unblocking = svm_vcpu_unblocking,
A
Avi Kivity 已提交
4524

4525
	.update_exception_bitmap = svm_update_exception_bitmap,
4526
	.get_msr_feature = svm_get_msr_feature,
A
Avi Kivity 已提交
4527 4528 4529 4530 4531
	.get_msr = svm_get_msr,
	.set_msr = svm_set_msr,
	.get_segment_base = svm_get_segment_base,
	.get_segment = svm_get_segment,
	.set_segment = svm_set_segment,
4532
	.get_cpl = svm_get_cpl,
4533
	.get_cs_db_l_bits = kvm_get_cs_db_l_bits,
A
Avi Kivity 已提交
4534
	.set_cr0 = svm_set_cr0,
4535
	.is_valid_cr4 = svm_is_valid_cr4,
A
Avi Kivity 已提交
4536 4537 4538 4539 4540 4541
	.set_cr4 = svm_set_cr4,
	.set_efer = svm_set_efer,
	.get_idt = svm_get_idt,
	.set_idt = svm_set_idt,
	.get_gdt = svm_get_gdt,
	.set_gdt = svm_set_gdt,
4542
	.set_dr7 = svm_set_dr7,
4543
	.sync_dirty_debug_regs = svm_sync_dirty_debug_regs,
A
Avi Kivity 已提交
4544
	.cache_reg = svm_cache_reg,
A
Avi Kivity 已提交
4545 4546
	.get_rflags = svm_get_rflags,
	.set_rflags = svm_set_rflags,
4547

4548
	.tlb_flush_all = svm_flush_tlb,
4549
	.tlb_flush_current = svm_flush_tlb,
4550
	.tlb_flush_gva = svm_flush_tlb_gva,
4551
	.tlb_flush_guest = svm_flush_tlb,
A
Avi Kivity 已提交
4552 4553

	.run = svm_vcpu_run,
4554
	.handle_exit = handle_exit,
A
Avi Kivity 已提交
4555
	.skip_emulated_instruction = skip_emulated_instruction,
4556
	.update_emulated_instruction = NULL,
4557 4558
	.set_interrupt_shadow = svm_set_interrupt_shadow,
	.get_interrupt_shadow = svm_get_interrupt_shadow,
I
Ingo Molnar 已提交
4559
	.patch_hypercall = svm_patch_hypercall,
E
Eddie Dong 已提交
4560
	.set_irq = svm_set_irq,
4561
	.set_nmi = svm_inject_nmi,
4562
	.queue_exception = svm_queue_exception,
A
Avi Kivity 已提交
4563
	.cancel_injection = svm_cancel_injection,
4564
	.interrupt_allowed = svm_interrupt_allowed,
4565
	.nmi_allowed = svm_nmi_allowed,
J
Jan Kiszka 已提交
4566 4567
	.get_nmi_mask = svm_get_nmi_mask,
	.set_nmi_mask = svm_set_nmi_mask,
4568 4569 4570
	.enable_nmi_window = svm_enable_nmi_window,
	.enable_irq_window = svm_enable_irq_window,
	.update_cr8_intercept = svm_update_cr8_intercept,
4571
	.set_virtual_apic_mode = svm_set_virtual_apic_mode,
4572
	.refresh_apicv_exec_ctrl = svm_refresh_apicv_exec_ctrl,
4573
	.check_apicv_inhibit_reasons = svm_check_apicv_inhibit_reasons,
4574
	.pre_update_apicv_exec_ctrl = svm_pre_update_apicv_exec_ctrl,
4575
	.load_eoi_exitmap = svm_load_eoi_exitmap,
4576 4577
	.hwapic_irr_update = svm_hwapic_irr_update,
	.hwapic_isr_update = svm_hwapic_isr_update,
4578
	.sync_pir_to_irr = kvm_lapic_find_highest_irr,
4579
	.apicv_post_state_restore = avic_post_state_restore,
4580 4581

	.set_tss_addr = svm_set_tss_addr,
4582
	.set_identity_map_addr = svm_set_identity_map_addr,
4583
	.get_mt_mask = svm_get_mt_mask,
4584

4585 4586
	.get_exit_info = svm_get_exit_info,

4587
	.vcpu_after_set_cpuid = svm_vcpu_after_set_cpuid,
4588

4589
	.has_wbinvd_exit = svm_has_wbinvd_exit,
4590

4591
	.write_l1_tsc_offset = svm_write_l1_tsc_offset,
4592

4593
	.load_mmu_pgd = svm_load_mmu_pgd,
4594 4595

	.check_intercept = svm_check_intercept,
4596
	.handle_exit_irqoff = svm_handle_exit_irqoff,
4597

4598 4599
	.request_immediate_exit = __kvm_request_immediate_exit,

4600
	.sched_in = svm_sched_in,
4601 4602

	.pmu_ops = &amd_pmu_ops,
4603 4604
	.nested_ops = &svm_nested_ops,

4605
	.deliver_posted_interrupt = svm_deliver_avic_intr,
4606
	.dy_apicv_has_pending_interrupt = svm_dy_apicv_has_pending_interrupt,
4607
	.update_pi_irte = svm_update_pi_irte,
4608
	.setup_mce = svm_setup_mce,
4609

4610
	.smi_allowed = svm_smi_allowed,
4611 4612
	.pre_enter_smm = svm_pre_enter_smm,
	.pre_leave_smm = svm_pre_leave_smm,
4613
	.enable_smi_window = svm_enable_smi_window,
B
Brijesh Singh 已提交
4614 4615

	.mem_enc_op = svm_mem_enc_op,
4616 4617
	.mem_enc_reg_region = svm_register_enc_region,
	.mem_enc_unreg_region = svm_unregister_enc_region,
4618

4619
	.can_emulate_instruction = svm_can_emulate_instruction,
4620 4621

	.apic_init_signal_blocked = svm_apic_init_signal_blocked,
4622 4623

	.msr_filter_changed = svm_msr_filter_changed,
4624
	.complete_emulated_msr = svm_complete_emulated_msr,
4625 4626

	.vcpu_deliver_sipi_vector = svm_vcpu_deliver_sipi_vector,
A
Avi Kivity 已提交
4627 4628
};

4629 4630 4631 4632 4633 4634 4635
static struct kvm_x86_init_ops svm_init_ops __initdata = {
	.cpu_has_kvm_support = has_svm,
	.disabled_by_bios = is_disabled,
	.hardware_setup = svm_hardware_setup,
	.check_processor_compatibility = svm_check_processor_compat,

	.runtime_ops = &svm_x86_ops,
A
Avi Kivity 已提交
4636 4637 4638 4639
};

static int __init svm_init(void)
{
T
Tom Lendacky 已提交
4640 4641
	__unused_size_checks();

4642
	return kvm_init(&svm_init_ops, sizeof(struct vcpu_svm),
4643
			__alignof__(struct vcpu_svm), THIS_MODULE);
A
Avi Kivity 已提交
4644 4645 4646 4647
}

static void __exit svm_exit(void)
{
4648
	kvm_exit();
A
Avi Kivity 已提交
4649 4650 4651 4652
}

module_init(svm_init)
module_exit(svm_exit)