svm.c 49.3 KB
Newer Older
A
Avi Kivity 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
/*
 * Kernel-based Virtual Machine driver for Linux
 *
 * AMD SVM support
 *
 * Copyright (C) 2006 Qumranet, Inc.
 *
 * Authors:
 *   Yaniv Kamay  <yaniv@qumranet.com>
 *   Avi Kivity   <avi@qumranet.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
16 17
#include <linux/kvm_host.h>

A
Avi Kivity 已提交
18
#include "kvm_svm.h"
19
#include "irq.h"
20
#include "mmu.h"
21
#include "kvm_cache_regs.h"
A
Avi Kivity 已提交
22

A
Avi Kivity 已提交
23
#include <linux/module.h>
24
#include <linux/kernel.h>
A
Avi Kivity 已提交
25 26
#include <linux/vmalloc.h>
#include <linux/highmem.h>
A
Alexey Dobriyan 已提交
27
#include <linux/sched.h>
A
Avi Kivity 已提交
28

A
Avi Kivity 已提交
29
#include <asm/desc.h>
A
Avi Kivity 已提交
30

31 32
#define __ex(x) __kvm_handle_fault_on_reboot(x)

A
Avi Kivity 已提交
33 34 35 36 37 38 39 40 41 42 43 44
MODULE_AUTHOR("Qumranet");
MODULE_LICENSE("GPL");

#define IOPM_ALLOC_ORDER 2
#define MSRPM_ALLOC_ORDER 1

#define DR7_GD_MASK (1 << 13)
#define DR6_BD_MASK (1 << 13)

#define SEG_TYPE_LDT 2
#define SEG_TYPE_BUSY_TSS16 3

45 46
#define SVM_FEATURE_NPT  (1 << 0)
#define SVM_FEATURE_LBRV (1 << 1)
A
Amit Shah 已提交
47
#define SVM_FEATURE_SVML (1 << 2)
48

49 50
#define DEBUGCTL_RESERVED_BITS (~(0x3fULL))

51 52 53 54
/* enable NPT for AMD64 and X86 with PAE */
#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
static bool npt_enabled = true;
#else
55
static bool npt_enabled = false;
56
#endif
57 58 59
static int npt = 1;

module_param(npt, int, S_IRUGO);
60

61
static void kvm_reput_irq(struct vcpu_svm *svm);
62
static void svm_flush_tlb(struct kvm_vcpu *vcpu);
63

64 65
static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
{
R
Rusty Russell 已提交
66
	return container_of(vcpu, struct vcpu_svm, vcpu);
67 68
}

69
static unsigned long iopm_base;
A
Avi Kivity 已提交
70 71 72 73 74 75 76 77 78 79 80 81 82

struct kvm_ldttss_desc {
	u16 limit0;
	u16 base0;
	unsigned base1 : 8, type : 5, dpl : 2, p : 1;
	unsigned limit1 : 4, zero0 : 3, g : 1, base2 : 8;
	u32 base3;
	u32 zero1;
} __attribute__((packed));

struct svm_cpu_data {
	int cpu;

A
Avi Kivity 已提交
83 84 85
	u64 asid_generation;
	u32 max_asid;
	u32 next_asid;
A
Avi Kivity 已提交
86 87 88 89 90 91
	struct kvm_ldttss_desc *tss_desc;

	struct page *save_area;
};

static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data);
92
static uint32_t svm_features;
A
Avi Kivity 已提交
93 94 95 96 97 98 99 100

struct svm_init_data {
	int cpu;
	int r;
};

static u32 msrpm_ranges[] = {0, 0xc0000000, 0xc0010000};

101
#define NUM_MSR_MAPS ARRAY_SIZE(msrpm_ranges)
A
Avi Kivity 已提交
102 103 104 105 106
#define MSRS_RANGE_SIZE 2048
#define MSRS_IN_RANGE (MSRS_RANGE_SIZE * 8 / 2)

#define MAX_INST_SIZE 15

107 108 109 110 111
static inline u32 svm_has(u32 feat)
{
	return svm_features & feat;
}

A
Avi Kivity 已提交
112 113
static inline u8 pop_irq(struct kvm_vcpu *vcpu)
{
114 115
	int word_index = __ffs(vcpu->arch.irq_summary);
	int bit_index = __ffs(vcpu->arch.irq_pending[word_index]);
A
Avi Kivity 已提交
116 117
	int irq = word_index * BITS_PER_LONG + bit_index;

118 119 120
	clear_bit(bit_index, &vcpu->arch.irq_pending[word_index]);
	if (!vcpu->arch.irq_pending[word_index])
		clear_bit(word_index, &vcpu->arch.irq_summary);
A
Avi Kivity 已提交
121 122 123 124 125
	return irq;
}

static inline void push_irq(struct kvm_vcpu *vcpu, u8 irq)
{
126 127
	set_bit(irq, vcpu->arch.irq_pending);
	set_bit(irq / BITS_PER_LONG, &vcpu->arch.irq_summary);
A
Avi Kivity 已提交
128 129 130 131
}

static inline void clgi(void)
{
132
	asm volatile (__ex(SVM_CLGI));
A
Avi Kivity 已提交
133 134 135 136
}

static inline void stgi(void)
{
137
	asm volatile (__ex(SVM_STGI));
A
Avi Kivity 已提交
138 139 140 141
}

static inline void invlpga(unsigned long addr, u32 asid)
{
142
	asm volatile (__ex(SVM_INVLPGA) :: "a"(addr), "c"(asid));
A
Avi Kivity 已提交
143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
}

static inline unsigned long kvm_read_cr2(void)
{
	unsigned long cr2;

	asm volatile ("mov %%cr2, %0" : "=r" (cr2));
	return cr2;
}

static inline void kvm_write_cr2(unsigned long val)
{
	asm volatile ("mov %0, %%cr2" :: "r" (val));
}

static inline unsigned long read_dr6(void)
{
	unsigned long dr6;

	asm volatile ("mov %%dr6, %0" : "=r" (dr6));
	return dr6;
}

static inline void write_dr6(unsigned long val)
{
	asm volatile ("mov %0, %%dr6" :: "r" (val));
}

static inline unsigned long read_dr7(void)
{
	unsigned long dr7;

	asm volatile ("mov %%dr7, %0" : "=r" (dr7));
	return dr7;
}

static inline void write_dr7(unsigned long val)
{
	asm volatile ("mov %0, %%dr7" :: "r" (val));
}

static inline void force_new_asid(struct kvm_vcpu *vcpu)
{
186
	to_svm(vcpu)->asid_generation--;
A
Avi Kivity 已提交
187 188 189 190 191 192 193 194 195
}

static inline void flush_guest_tlb(struct kvm_vcpu *vcpu)
{
	force_new_asid(vcpu);
}

static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
{
196
	if (!npt_enabled && !(efer & EFER_LMA))
197
		efer &= ~EFER_LME;
A
Avi Kivity 已提交
198

199
	to_svm(vcpu)->vmcb->save.efer = efer | MSR_EFER_SVME_MASK;
200
	vcpu->arch.shadow_efer = efer;
A
Avi Kivity 已提交
201 202
}

203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
static void svm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
				bool has_error_code, u32 error_code)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->control.event_inj = nr
		| SVM_EVTINJ_VALID
		| (has_error_code ? SVM_EVTINJ_VALID_ERR : 0)
		| SVM_EVTINJ_TYPE_EXEPT;
	svm->vmcb->control.event_inj_err = error_code;
}

static bool svm_exception_injected(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	return !(svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_VALID);
}

A
Avi Kivity 已提交
222 223 224 225 226 227 228 229
static int is_external_interrupt(u32 info)
{
	info &= SVM_EVTINJ_TYPE_MASK | SVM_EVTINJ_VALID;
	return info == (SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR);
}

static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
{
230 231 232
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!svm->next_rip) {
233
		printk(KERN_DEBUG "%s: NOP\n", __func__);
A
Avi Kivity 已提交
234 235
		return;
	}
236 237 238
	if (svm->next_rip - kvm_rip_read(vcpu) > MAX_INST_SIZE)
		printk(KERN_ERR "%s: ip 0x%lx next 0x%llx\n",
		       __func__, kvm_rip_read(vcpu), svm->next_rip);
A
Avi Kivity 已提交
239

240
	kvm_rip_write(vcpu, svm->next_rip);
241
	svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
242

243
	vcpu->arch.interrupt_window_open = 1;
A
Avi Kivity 已提交
244 245 246 247 248 249
}

static int has_svm(void)
{
	uint32_t eax, ebx, ecx, edx;

250
	if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
A
Avi Kivity 已提交
251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270
		printk(KERN_INFO "has_svm: not amd\n");
		return 0;
	}

	cpuid(0x80000000, &eax, &ebx, &ecx, &edx);
	if (eax < SVM_CPUID_FUNC) {
		printk(KERN_INFO "has_svm: can't execute cpuid_8000000a\n");
		return 0;
	}

	cpuid(0x80000001, &eax, &ebx, &ecx, &edx);
	if (!(ecx & (1 << SVM_CPUID_FEATURE_SHIFT))) {
		printk(KERN_DEBUG "has_svm: svm not available\n");
		return 0;
	}
	return 1;
}

static void svm_hardware_disable(void *garbage)
{
271
	uint64_t efer;
A
Avi Kivity 已提交
272

273 274 275
	wrmsrl(MSR_VM_HSAVE_PA, 0);
	rdmsrl(MSR_EFER, efer);
	wrmsrl(MSR_EFER, efer & ~MSR_EFER_SVME_MASK);
A
Avi Kivity 已提交
276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302
}

static void svm_hardware_enable(void *garbage)
{

	struct svm_cpu_data *svm_data;
	uint64_t efer;
	struct desc_ptr gdt_descr;
	struct desc_struct *gdt;
	int me = raw_smp_processor_id();

	if (!has_svm()) {
		printk(KERN_ERR "svm_cpu_init: err EOPNOTSUPP on %d\n", me);
		return;
	}
	svm_data = per_cpu(svm_data, me);

	if (!svm_data) {
		printk(KERN_ERR "svm_cpu_init: svm_data is NULL on %d\n",
		       me);
		return;
	}

	svm_data->asid_generation = 1;
	svm_data->max_asid = cpuid_ebx(SVM_CPUID_FUNC) - 1;
	svm_data->next_asid = svm_data->max_asid + 1;

M
Mike Day 已提交
303
	asm volatile ("sgdt %0" : "=m"(gdt_descr));
A
Avi Kivity 已提交
304 305 306 307 308 309 310 311 312 313
	gdt = (struct desc_struct *)gdt_descr.address;
	svm_data->tss_desc = (struct kvm_ldttss_desc *)(gdt + GDT_ENTRY_TSS);

	rdmsrl(MSR_EFER, efer);
	wrmsrl(MSR_EFER, efer | MSR_EFER_SVME_MASK);

	wrmsrl(MSR_VM_HSAVE_PA,
	       page_to_pfn(svm_data->save_area) << PAGE_SHIFT);
}

314 315 316 317 318 319 320 321 322 323 324 325 326
static void svm_cpu_uninit(int cpu)
{
	struct svm_cpu_data *svm_data
		= per_cpu(svm_data, raw_smp_processor_id());

	if (!svm_data)
		return;

	per_cpu(svm_data, raw_smp_processor_id()) = NULL;
	__free_page(svm_data->save_area);
	kfree(svm_data);
}

A
Avi Kivity 已提交
327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350
static int svm_cpu_init(int cpu)
{
	struct svm_cpu_data *svm_data;
	int r;

	svm_data = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL);
	if (!svm_data)
		return -ENOMEM;
	svm_data->cpu = cpu;
	svm_data->save_area = alloc_page(GFP_KERNEL);
	r = -ENOMEM;
	if (!svm_data->save_area)
		goto err_1;

	per_cpu(svm_data, cpu) = svm_data;

	return 0;

err_1:
	kfree(svm_data);
	return r;

}

351 352
static void set_msr_interception(u32 *msrpm, unsigned msr,
				 int read, int write)
A
Avi Kivity 已提交
353 354 355 356 357 358 359 360 361 362 363 364 365 366
{
	int i;

	for (i = 0; i < NUM_MSR_MAPS; i++) {
		if (msr >= msrpm_ranges[i] &&
		    msr < msrpm_ranges[i] + MSRS_IN_RANGE) {
			u32 msr_offset = (i * MSRS_IN_RANGE + msr -
					  msrpm_ranges[i]) * 2;

			u32 *base = msrpm + (msr_offset / 32);
			u32 msr_shift = msr_offset % 32;
			u32 mask = ((write) ? 0 : 2) | ((read) ? 0 : 1);
			*base = (*base & ~(0x3 << msr_shift)) |
				(mask << msr_shift);
367
			return;
A
Avi Kivity 已提交
368 369
		}
	}
370
	BUG();
A
Avi Kivity 已提交
371 372
}

373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390
static void svm_vcpu_init_msrpm(u32 *msrpm)
{
	memset(msrpm, 0xff, PAGE_SIZE * (1 << MSRPM_ALLOC_ORDER));

#ifdef CONFIG_X86_64
	set_msr_interception(msrpm, MSR_GS_BASE, 1, 1);
	set_msr_interception(msrpm, MSR_FS_BASE, 1, 1);
	set_msr_interception(msrpm, MSR_KERNEL_GS_BASE, 1, 1);
	set_msr_interception(msrpm, MSR_LSTAR, 1, 1);
	set_msr_interception(msrpm, MSR_CSTAR, 1, 1);
	set_msr_interception(msrpm, MSR_SYSCALL_MASK, 1, 1);
#endif
	set_msr_interception(msrpm, MSR_K6_STAR, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_SYSENTER_CS, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_SYSENTER_ESP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_SYSENTER_EIP, 1, 1);
}

391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412
static void svm_enable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 1;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
}

static void svm_disable_lbrv(struct vcpu_svm *svm)
{
	u32 *msrpm = svm->msrpm;

	svm->vmcb->control.lbr_ctl = 0;
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 0, 0);
	set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
}

A
Avi Kivity 已提交
413 414 415 416
static __init int svm_hardware_setup(void)
{
	int cpu;
	struct page *iopm_pages;
417
	void *iopm_va;
A
Avi Kivity 已提交
418 419 420 421 422 423
	int r;

	iopm_pages = alloc_pages(GFP_KERNEL, IOPM_ALLOC_ORDER);

	if (!iopm_pages)
		return -ENOMEM;
424 425 426 427

	iopm_va = page_address(iopm_pages);
	memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
	clear_bit(0x80, iopm_va); /* allow direct access to PC debug port */
A
Avi Kivity 已提交
428 429
	iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;

430 431 432
	if (boot_cpu_has(X86_FEATURE_NX))
		kvm_enable_efer_bits(EFER_NX);

A
Avi Kivity 已提交
433 434 435
	for_each_online_cpu(cpu) {
		r = svm_cpu_init(cpu);
		if (r)
436
			goto err;
A
Avi Kivity 已提交
437
	}
438 439 440

	svm_features = cpuid_edx(SVM_CPUID_FUNC);

441 442 443
	if (!svm_has(SVM_FEATURE_NPT))
		npt_enabled = false;

444 445 446 447 448
	if (npt_enabled && !npt) {
		printk(KERN_INFO "kvm: Nested Paging disabled\n");
		npt_enabled = false;
	}

449
	if (npt_enabled) {
450
		printk(KERN_INFO "kvm: Nested Paging enabled\n");
451
		kvm_enable_tdp();
452 453
	} else
		kvm_disable_tdp();
454

A
Avi Kivity 已提交
455 456
	return 0;

457
err:
A
Avi Kivity 已提交
458 459 460 461 462 463 464
	__free_pages(iopm_pages, IOPM_ALLOC_ORDER);
	iopm_base = 0;
	return r;
}

static __exit void svm_hardware_unsetup(void)
{
465 466 467 468 469
	int cpu;

	for_each_online_cpu(cpu)
		svm_cpu_uninit(cpu);

A
Avi Kivity 已提交
470
	__free_pages(pfn_to_page(iopm_base >> PAGE_SHIFT), IOPM_ALLOC_ORDER);
471
	iopm_base = 0;
A
Avi Kivity 已提交
472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490
}

static void init_seg(struct vmcb_seg *seg)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | SVM_SELECTOR_S_MASK |
		SVM_SELECTOR_WRITE_MASK; /* Read/Write Data Segment */
	seg->limit = 0xffff;
	seg->base = 0;
}

static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
{
	seg->selector = 0;
	seg->attrib = SVM_SELECTOR_P_MASK | type;
	seg->limit = 0xffff;
	seg->base = 0;
}

491
static void init_vmcb(struct vcpu_svm *svm)
A
Avi Kivity 已提交
492
{
493 494
	struct vmcb_control_area *control = &svm->vmcb->control;
	struct vmcb_save_area *save = &svm->vmcb->save;
A
Avi Kivity 已提交
495 496 497

	control->intercept_cr_read = 	INTERCEPT_CR0_MASK |
					INTERCEPT_CR3_MASK |
498
					INTERCEPT_CR4_MASK;
A
Avi Kivity 已提交
499 500 501

	control->intercept_cr_write = 	INTERCEPT_CR0_MASK |
					INTERCEPT_CR3_MASK |
502 503
					INTERCEPT_CR4_MASK |
					INTERCEPT_CR8_MASK;
A
Avi Kivity 已提交
504 505 506 507 508 509 510 511 512 513 514 515 516

	control->intercept_dr_read = 	INTERCEPT_DR0_MASK |
					INTERCEPT_DR1_MASK |
					INTERCEPT_DR2_MASK |
					INTERCEPT_DR3_MASK;

	control->intercept_dr_write = 	INTERCEPT_DR0_MASK |
					INTERCEPT_DR1_MASK |
					INTERCEPT_DR2_MASK |
					INTERCEPT_DR3_MASK |
					INTERCEPT_DR5_MASK |
					INTERCEPT_DR7_MASK;

517
	control->intercept_exceptions = (1 << PF_VECTOR) |
518 519
					(1 << UD_VECTOR) |
					(1 << MC_VECTOR);
A
Avi Kivity 已提交
520 521 522 523


	control->intercept = 	(1ULL << INTERCEPT_INTR) |
				(1ULL << INTERCEPT_NMI) |
524
				(1ULL << INTERCEPT_SMI) |
A
Avi Kivity 已提交
525
				(1ULL << INTERCEPT_CPUID) |
526
				(1ULL << INTERCEPT_INVD) |
A
Avi Kivity 已提交
527
				(1ULL << INTERCEPT_HLT) |
M
Marcelo Tosatti 已提交
528
				(1ULL << INTERCEPT_INVLPG) |
A
Avi Kivity 已提交
529 530 531 532
				(1ULL << INTERCEPT_INVLPGA) |
				(1ULL << INTERCEPT_IOIO_PROT) |
				(1ULL << INTERCEPT_MSR_PROT) |
				(1ULL << INTERCEPT_TASK_SWITCH) |
533
				(1ULL << INTERCEPT_SHUTDOWN) |
A
Avi Kivity 已提交
534 535 536 537 538 539
				(1ULL << INTERCEPT_VMRUN) |
				(1ULL << INTERCEPT_VMMCALL) |
				(1ULL << INTERCEPT_VMLOAD) |
				(1ULL << INTERCEPT_VMSAVE) |
				(1ULL << INTERCEPT_STGI) |
				(1ULL << INTERCEPT_CLGI) |
540
				(1ULL << INTERCEPT_SKINIT) |
541
				(1ULL << INTERCEPT_WBINVD) |
542 543
				(1ULL << INTERCEPT_MONITOR) |
				(1ULL << INTERCEPT_MWAIT);
A
Avi Kivity 已提交
544 545

	control->iopm_base_pa = iopm_base;
546
	control->msrpm_base_pa = __pa(svm->msrpm);
547
	control->tsc_offset = 0;
A
Avi Kivity 已提交
548 549 550 551 552 553 554 555 556 557 558 559 560
	control->int_ctl = V_INTR_MASKING_MASK;

	init_seg(&save->es);
	init_seg(&save->ss);
	init_seg(&save->ds);
	init_seg(&save->fs);
	init_seg(&save->gs);

	save->cs.selector = 0xf000;
	/* Executable/Readable Code Segment */
	save->cs.attrib = SVM_SELECTOR_READ_MASK | SVM_SELECTOR_P_MASK |
		SVM_SELECTOR_S_MASK | SVM_SELECTOR_CODE_MASK;
	save->cs.limit = 0xffff;
561 562 563 564 565 566 567
	/*
	 * cs.base should really be 0xffff0000, but vmx can't handle that, so
	 * be consistent with it.
	 *
	 * Replace when we have real mode working for vmx.
	 */
	save->cs.base = 0xf0000;
A
Avi Kivity 已提交
568 569 570 571 572 573 574 575

	save->gdtr.limit = 0xffff;
	save->idtr.limit = 0xffff;

	init_sys_seg(&save->ldtr, SEG_TYPE_LDT);
	init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16);

	save->efer = MSR_EFER_SVME_MASK;
M
Mike Day 已提交
576
	save->dr6 = 0xffff0ff0;
A
Avi Kivity 已提交
577 578 579
	save->dr7 = 0x400;
	save->rflags = 2;
	save->rip = 0x0000fff0;
580
	svm->vcpu.arch.regs[VCPU_REGS_RIP] = save->rip;
A
Avi Kivity 已提交
581 582 583 584 585

	/*
	 * cr0 val on cpu init should be 0x60000010, we enable cpu
	 * cache by default. the orderly way is to enable cache in bios.
	 */
586
	save->cr0 = 0x00000010 | X86_CR0_PG | X86_CR0_WP;
587
	save->cr4 = X86_CR4_PAE;
A
Avi Kivity 已提交
588
	/* rdx = ?? */
589 590 591 592

	if (npt_enabled) {
		/* Setup VMCB for Nested Paging */
		control->nested_ctl = 1;
M
Marcelo Tosatti 已提交
593 594
		control->intercept &= ~((1ULL << INTERCEPT_TASK_SWITCH) |
					(1ULL << INTERCEPT_INVLPG));
595 596 597 598 599 600 601 602 603 604 605
		control->intercept_exceptions &= ~(1 << PF_VECTOR);
		control->intercept_cr_read &= ~(INTERCEPT_CR0_MASK|
						INTERCEPT_CR3_MASK);
		control->intercept_cr_write &= ~(INTERCEPT_CR0_MASK|
						 INTERCEPT_CR3_MASK);
		save->g_pat = 0x0007040600070406ULL;
		/* enable caching because the QEMU Bios doesn't enable it */
		save->cr0 = X86_CR0_ET;
		save->cr3 = 0;
		save->cr4 = 0;
	}
606
	force_new_asid(&svm->vcpu);
A
Avi Kivity 已提交
607 608
}

609
static int svm_vcpu_reset(struct kvm_vcpu *vcpu)
610 611 612
{
	struct vcpu_svm *svm = to_svm(vcpu);

613
	init_vmcb(svm);
A
Avi Kivity 已提交
614 615

	if (vcpu->vcpu_id != 0) {
616
		kvm_rip_write(vcpu, 0);
617 618
		svm->vmcb->save.cs.base = svm->vcpu.arch.sipi_vector << 12;
		svm->vmcb->save.cs.selector = svm->vcpu.arch.sipi_vector << 8;
A
Avi Kivity 已提交
619
	}
620 621
	vcpu->arch.regs_avail = ~0;
	vcpu->arch.regs_dirty = ~0;
622 623

	return 0;
624 625
}

R
Rusty Russell 已提交
626
static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
A
Avi Kivity 已提交
627
{
628
	struct vcpu_svm *svm;
A
Avi Kivity 已提交
629
	struct page *page;
630
	struct page *msrpm_pages;
R
Rusty Russell 已提交
631
	int err;
A
Avi Kivity 已提交
632

633
	svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
R
Rusty Russell 已提交
634 635 636 637 638 639 640 641 642
	if (!svm) {
		err = -ENOMEM;
		goto out;
	}

	err = kvm_vcpu_init(&svm->vcpu, kvm, id);
	if (err)
		goto free_svm;

A
Avi Kivity 已提交
643
	page = alloc_page(GFP_KERNEL);
R
Rusty Russell 已提交
644 645 646 647
	if (!page) {
		err = -ENOMEM;
		goto uninit;
	}
A
Avi Kivity 已提交
648

649 650 651 652 653 654 655
	err = -ENOMEM;
	msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
	if (!msrpm_pages)
		goto uninit;
	svm->msrpm = page_address(msrpm_pages);
	svm_vcpu_init_msrpm(svm->msrpm);

656 657 658 659 660
	svm->vmcb = page_address(page);
	clear_page(svm->vmcb);
	svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
	svm->asid_generation = 0;
	memset(svm->db_regs, 0, sizeof(svm->db_regs));
661
	init_vmcb(svm);
662

R
Rusty Russell 已提交
663 664
	fx_init(&svm->vcpu);
	svm->vcpu.fpu_active = 1;
665
	svm->vcpu.arch.apic_base = 0xfee00000 | MSR_IA32_APICBASE_ENABLE;
R
Rusty Russell 已提交
666
	if (svm->vcpu.vcpu_id == 0)
667
		svm->vcpu.arch.apic_base |= MSR_IA32_APICBASE_BSP;
A
Avi Kivity 已提交
668

R
Rusty Russell 已提交
669
	return &svm->vcpu;
670

R
Rusty Russell 已提交
671 672 673
uninit:
	kvm_vcpu_uninit(&svm->vcpu);
free_svm:
674
	kmem_cache_free(kvm_vcpu_cache, svm);
R
Rusty Russell 已提交
675 676
out:
	return ERR_PTR(err);
A
Avi Kivity 已提交
677 678 679 680
}

static void svm_free_vcpu(struct kvm_vcpu *vcpu)
{
681 682
	struct vcpu_svm *svm = to_svm(vcpu);

R
Rusty Russell 已提交
683
	__free_page(pfn_to_page(svm->vmcb_pa >> PAGE_SHIFT));
684
	__free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
R
Rusty Russell 已提交
685
	kvm_vcpu_uninit(vcpu);
686
	kmem_cache_free(kvm_vcpu_cache, svm);
A
Avi Kivity 已提交
687 688
}

689
static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
A
Avi Kivity 已提交
690
{
691
	struct vcpu_svm *svm = to_svm(vcpu);
692
	int i;
693 694 695 696 697 698 699 700 701

	if (unlikely(cpu != vcpu->cpu)) {
		u64 tsc_this, delta;

		/*
		 * Make sure that the guest sees a monotonically
		 * increasing TSC.
		 */
		rdtscll(tsc_this);
702
		delta = vcpu->arch.host_tsc - tsc_this;
703
		svm->vmcb->control.tsc_offset += delta;
704
		vcpu->cpu = cpu;
M
Marcelo Tosatti 已提交
705
		kvm_migrate_timers(vcpu);
706
	}
707 708

	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
709
		rdmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
A
Avi Kivity 已提交
710 711 712 713
}

static void svm_vcpu_put(struct kvm_vcpu *vcpu)
{
714
	struct vcpu_svm *svm = to_svm(vcpu);
715 716
	int i;

717
	++vcpu->stat.host_state_reload;
718
	for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
719
		wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
720

721
	rdtscll(vcpu->arch.host_tsc);
A
Avi Kivity 已提交
722 723 724 725
}

static unsigned long svm_get_rflags(struct kvm_vcpu *vcpu)
{
726
	return to_svm(vcpu)->vmcb->save.rflags;
A
Avi Kivity 已提交
727 728 729 730
}

static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
{
731
	to_svm(vcpu)->vmcb->save.rflags = rflags;
A
Avi Kivity 已提交
732 733 734 735
}

static struct vmcb_seg *svm_seg(struct kvm_vcpu *vcpu, int seg)
{
736
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
A
Avi Kivity 已提交
737 738 739 740 741 742 743 744 745 746 747 748

	switch (seg) {
	case VCPU_SREG_CS: return &save->cs;
	case VCPU_SREG_DS: return &save->ds;
	case VCPU_SREG_ES: return &save->es;
	case VCPU_SREG_FS: return &save->fs;
	case VCPU_SREG_GS: return &save->gs;
	case VCPU_SREG_SS: return &save->ss;
	case VCPU_SREG_TR: return &save->tr;
	case VCPU_SREG_LDTR: return &save->ldtr;
	}
	BUG();
A
Al Viro 已提交
749
	return NULL;
A
Avi Kivity 已提交
750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777
}

static u64 svm_get_segment_base(struct kvm_vcpu *vcpu, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	return s->base;
}

static void svm_get_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	var->base = s->base;
	var->limit = s->limit;
	var->selector = s->selector;
	var->type = s->attrib & SVM_SELECTOR_TYPE_MASK;
	var->s = (s->attrib >> SVM_SELECTOR_S_SHIFT) & 1;
	var->dpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
	var->present = (s->attrib >> SVM_SELECTOR_P_SHIFT) & 1;
	var->avl = (s->attrib >> SVM_SELECTOR_AVL_SHIFT) & 1;
	var->l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
	var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
	var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
	var->unusable = !var->present;
}

778 779 780 781 782 783 784
static int svm_get_cpl(struct kvm_vcpu *vcpu)
{
	struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;

	return save->cpl;
}

A
Avi Kivity 已提交
785 786
static void svm_get_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
787 788 789 790
	struct vcpu_svm *svm = to_svm(vcpu);

	dt->limit = svm->vmcb->save.idtr.limit;
	dt->base = svm->vmcb->save.idtr.base;
A
Avi Kivity 已提交
791 792 793 794
}

static void svm_set_idt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
795 796 797 798
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.idtr.limit = dt->limit;
	svm->vmcb->save.idtr.base = dt->base ;
A
Avi Kivity 已提交
799 800 801 802
}

static void svm_get_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
803 804 805 806
	struct vcpu_svm *svm = to_svm(vcpu);

	dt->limit = svm->vmcb->save.gdtr.limit;
	dt->base = svm->vmcb->save.gdtr.base;
A
Avi Kivity 已提交
807 808 809 810
}

static void svm_set_gdt(struct kvm_vcpu *vcpu, struct descriptor_table *dt)
{
811 812 813 814
	struct vcpu_svm *svm = to_svm(vcpu);

	svm->vmcb->save.gdtr.limit = dt->limit;
	svm->vmcb->save.gdtr.base = dt->base ;
A
Avi Kivity 已提交
815 816
}

817
static void svm_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
818 819 820
{
}

A
Avi Kivity 已提交
821 822
static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
{
823 824
	struct vcpu_svm *svm = to_svm(vcpu);

825
#ifdef CONFIG_X86_64
826
	if (vcpu->arch.shadow_efer & EFER_LME) {
827
		if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
828
			vcpu->arch.shadow_efer |= EFER_LMA;
829
			svm->vmcb->save.efer |= EFER_LMA | EFER_LME;
A
Avi Kivity 已提交
830 831
		}

M
Mike Day 已提交
832
		if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) {
833
			vcpu->arch.shadow_efer &= ~EFER_LMA;
834
			svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME);
A
Avi Kivity 已提交
835 836 837
		}
	}
#endif
838 839 840
	if (npt_enabled)
		goto set;

841
	if ((vcpu->arch.cr0 & X86_CR0_TS) && !(cr0 & X86_CR0_TS)) {
842
		svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
A
Anthony Liguori 已提交
843 844 845
		vcpu->fpu_active = 1;
	}

846
	vcpu->arch.cr0 = cr0;
847
	cr0 |= X86_CR0_PG | X86_CR0_WP;
848 849
	if (!vcpu->fpu_active) {
		svm->vmcb->control.intercept_exceptions |= (1 << NM_VECTOR);
J
Joerg Roedel 已提交
850
		cr0 |= X86_CR0_TS;
851
	}
852 853 854 855 856 857 858
set:
	/*
	 * re-enable caching here because the QEMU bios
	 * does not do it - this results in some delay at
	 * reboot
	 */
	cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
859
	svm->vmcb->save.cr0 = cr0;
A
Avi Kivity 已提交
860 861 862 863
}

static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
{
864
	unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
865 866 867 868
	unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;

	if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
		force_new_asid(vcpu);
869

870 871 872
	vcpu->arch.cr4 = cr4;
	if (!npt_enabled)
		cr4 |= X86_CR4_PAE;
873
	cr4 |= host_cr4_mce;
874
	to_svm(vcpu)->vmcb->save.cr4 = cr4;
A
Avi Kivity 已提交
875 876 877 878 879
}

static void svm_set_segment(struct kvm_vcpu *vcpu,
			    struct kvm_segment *var, int seg)
{
880
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898
	struct vmcb_seg *s = svm_seg(vcpu, seg);

	s->base = var->base;
	s->limit = var->limit;
	s->selector = var->selector;
	if (var->unusable)
		s->attrib = 0;
	else {
		s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
		s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
		s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
		s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
		s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
		s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
		s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
		s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
	}
	if (seg == VCPU_SREG_CS)
899 900
		svm->vmcb->save.cpl
			= (svm->vmcb->save.cs.attrib
A
Avi Kivity 已提交
901 902 903 904 905 906 907 908 909
			   >> SVM_SELECTOR_DPL_SHIFT) & 3;

}

static int svm_guest_debug(struct kvm_vcpu *vcpu, struct kvm_debug_guest *dbg)
{
	return -EOPNOTSUPP;
}

E
Eddie Dong 已提交
910 911 912 913 914 915 916 917 918 919
static int svm_get_irq(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u32 exit_int_info = svm->vmcb->control.exit_int_info;

	if (is_external_interrupt(exit_int_info))
		return exit_int_info & SVM_EVTINJ_VEC_MASK;
	return -1;
}

A
Avi Kivity 已提交
920 921
static void load_host_msrs(struct kvm_vcpu *vcpu)
{
922
#ifdef CONFIG_X86_64
923
	wrmsrl(MSR_GS_BASE, to_svm(vcpu)->host_gs_base);
924
#endif
A
Avi Kivity 已提交
925 926 927 928
}

static void save_host_msrs(struct kvm_vcpu *vcpu)
{
929
#ifdef CONFIG_X86_64
930
	rdmsrl(MSR_GS_BASE, to_svm(vcpu)->host_gs_base);
931
#endif
A
Avi Kivity 已提交
932 933
}

R
Rusty Russell 已提交
934
static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *svm_data)
A
Avi Kivity 已提交
935 936 937 938
{
	if (svm_data->next_asid > svm_data->max_asid) {
		++svm_data->asid_generation;
		svm_data->next_asid = 1;
939
		svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
A
Avi Kivity 已提交
940 941
	}

R
Rusty Russell 已提交
942
	svm->vcpu.cpu = svm_data->cpu;
943 944
	svm->asid_generation = svm_data->asid_generation;
	svm->vmcb->control.asid = svm_data->next_asid++;
A
Avi Kivity 已提交
945 946 947 948
}

static unsigned long svm_get_dr(struct kvm_vcpu *vcpu, int dr)
{
949 950 951
	unsigned long val = to_svm(vcpu)->db_regs[dr];
	KVMTRACE_2D(DR_READ, vcpu, (u32)dr, (u32)val, handler);
	return val;
A
Avi Kivity 已提交
952 953 954 955 956
}

static void svm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long value,
		       int *exception)
{
957 958
	struct vcpu_svm *svm = to_svm(vcpu);

A
Avi Kivity 已提交
959 960
	*exception = 0;

961 962 963
	if (svm->vmcb->save.dr7 & DR7_GD_MASK) {
		svm->vmcb->save.dr7 &= ~DR7_GD_MASK;
		svm->vmcb->save.dr6 |= DR6_BD_MASK;
A
Avi Kivity 已提交
964 965 966 967 968 969
		*exception = DB_VECTOR;
		return;
	}

	switch (dr) {
	case 0 ... 3:
970
		svm->db_regs[dr] = value;
A
Avi Kivity 已提交
971 972
		return;
	case 4 ... 5:
973
		if (vcpu->arch.cr4 & X86_CR4_DE) {
A
Avi Kivity 已提交
974 975 976 977 978 979 980 981
			*exception = UD_VECTOR;
			return;
		}
	case 7: {
		if (value & ~((1ULL << 32) - 1)) {
			*exception = GP_VECTOR;
			return;
		}
982
		svm->vmcb->save.dr7 = value;
A
Avi Kivity 已提交
983 984 985 986
		return;
	}
	default:
		printk(KERN_DEBUG "%s: unexpected dr %u\n",
987
		       __func__, dr);
A
Avi Kivity 已提交
988 989 990 991 992
		*exception = UD_VECTOR;
		return;
	}
}

R
Rusty Russell 已提交
993
static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
994
{
995
	u32 exit_int_info = svm->vmcb->control.exit_int_info;
R
Rusty Russell 已提交
996
	struct kvm *kvm = svm->vcpu.kvm;
A
Avi Kivity 已提交
997 998
	u64 fault_address;
	u32 error_code;
999
	bool event_injection = false;
A
Avi Kivity 已提交
1000

1001
	if (!irqchip_in_kernel(kvm) &&
1002 1003
	    is_external_interrupt(exit_int_info)) {
		event_injection = true;
R
Rusty Russell 已提交
1004
		push_irq(&svm->vcpu, exit_int_info & SVM_EVTINJ_VEC_MASK);
1005
	}
A
Avi Kivity 已提交
1006

1007 1008
	fault_address  = svm->vmcb->control.exit_info_2;
	error_code = svm->vmcb->control.exit_info_1;
1009 1010 1011 1012 1013

	if (!npt_enabled)
		KVMTRACE_3D(PAGE_FAULT, &svm->vcpu, error_code,
			    (u32)fault_address, (u32)(fault_address >> 32),
			    handler);
1014 1015 1016 1017
	else
		KVMTRACE_3D(TDP_FAULT, &svm->vcpu, error_code,
			    (u32)fault_address, (u32)(fault_address >> 32),
			    handler);
1018 1019 1020 1021 1022 1023 1024
	/*
	 * FIXME: Tis shouldn't be necessary here, but there is a flush
	 * missing in the MMU code. Until we find this bug, flush the
	 * complete TLB here on an NPF
	 */
	if (npt_enabled)
		svm_flush_tlb(&svm->vcpu);
1025

1026
	if (!npt_enabled && event_injection)
1027
		kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
1028
	return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
A
Avi Kivity 已提交
1029 1030
}

1031 1032 1033 1034
static int ud_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	int er;

1035
	er = emulate_instruction(&svm->vcpu, kvm_run, 0, 0, EMULTYPE_TRAP_UD);
1036
	if (er != EMULATE_DONE)
1037
		kvm_queue_exception(&svm->vcpu, UD_VECTOR);
1038 1039 1040
	return 1;
}

R
Rusty Russell 已提交
1041
static int nm_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Anthony Liguori 已提交
1042
{
1043
	svm->vmcb->control.intercept_exceptions &= ~(1 << NM_VECTOR);
1044
	if (!(svm->vcpu.arch.cr0 & X86_CR0_TS))
1045
		svm->vmcb->save.cr0 &= ~X86_CR0_TS;
R
Rusty Russell 已提交
1046
	svm->vcpu.fpu_active = 1;
1047 1048

	return 1;
A
Anthony Liguori 已提交
1049 1050
}

1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063
static int mc_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	/*
	 * On an #MC intercept the MCE handler is not called automatically in
	 * the host. So do it by hand here.
	 */
	asm volatile (
		"int $0x12\n");
	/* not sure if we ever come back to this point */

	return 1;
}

R
Rusty Russell 已提交
1064
static int shutdown_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
1065 1066 1067 1068 1069
{
	/*
	 * VMCB is undefined after a SHUTDOWN intercept
	 * so reinitialize it.
	 */
1070
	clear_page(svm->vmcb);
1071
	init_vmcb(svm);
1072 1073 1074 1075 1076

	kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
	return 0;
}

R
Rusty Russell 已提交
1077
static int io_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1078
{
M
Mike Day 已提交
1079
	u32 io_info = svm->vmcb->control.exit_info_1; /* address size bug? */
1080 1081
	int size, down, in, string, rep;
	unsigned port;
A
Avi Kivity 已提交
1082

R
Rusty Russell 已提交
1083
	++svm->vcpu.stat.io_exits;
A
Avi Kivity 已提交
1084

1085
	svm->next_rip = svm->vmcb->control.exit_info_2;
A
Avi Kivity 已提交
1086

1087 1088 1089
	string = (io_info & SVM_IOIO_STR_MASK) != 0;

	if (string) {
1090 1091
		if (emulate_instruction(&svm->vcpu,
					kvm_run, 0, 0, 0) == EMULATE_DO_MMIO)
1092 1093 1094 1095
			return 0;
		return 1;
	}

1096 1097 1098 1099
	in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
	port = io_info >> 16;
	size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
	rep = (io_info & SVM_IOIO_REP_MASK) != 0;
1100
	down = (svm->vmcb->save.rflags & X86_EFLAGS_DF) != 0;
A
Avi Kivity 已提交
1101

L
Laurent Vivier 已提交
1102
	return kvm_emulate_pio(&svm->vcpu, kvm_run, in, size, port);
A
Avi Kivity 已提交
1103 1104
}

1105 1106
static int nmi_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
1107
	KVMTRACE_0D(NMI, &svm->vcpu, handler);
1108 1109 1110
	return 1;
}

1111 1112 1113
static int intr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	++svm->vcpu.stat.irq_exits;
1114
	KVMTRACE_0D(INTR, &svm->vcpu, handler);
1115 1116 1117
	return 1;
}

R
Rusty Russell 已提交
1118
static int nop_on_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1119 1120 1121 1122
{
	return 1;
}

R
Rusty Russell 已提交
1123
static int halt_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1124
{
1125
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 1;
R
Rusty Russell 已提交
1126 1127
	skip_emulated_instruction(&svm->vcpu);
	return kvm_emulate_halt(&svm->vcpu);
A
Avi Kivity 已提交
1128 1129
}

R
Rusty Russell 已提交
1130
static int vmmcall_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
1131
{
1132
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
R
Rusty Russell 已提交
1133
	skip_emulated_instruction(&svm->vcpu);
1134 1135
	kvm_emulate_hypercall(&svm->vcpu);
	return 1;
1136 1137
}

R
Rusty Russell 已提交
1138 1139
static int invalid_op_interception(struct vcpu_svm *svm,
				   struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1140
{
1141
	kvm_queue_exception(&svm->vcpu, UD_VECTOR);
A
Avi Kivity 已提交
1142 1143 1144
	return 1;
}

R
Rusty Russell 已提交
1145 1146
static int task_switch_interception(struct vcpu_svm *svm,
				    struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1147
{
1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159
	u16 tss_selector;

	tss_selector = (u16)svm->vmcb->control.exit_info_1;
	if (svm->vmcb->control.exit_info_2 &
	    (1ULL << SVM_EXITINFOSHIFT_TS_REASON_IRET))
		return kvm_task_switch(&svm->vcpu, tss_selector,
				       TASK_SWITCH_IRET);
	if (svm->vmcb->control.exit_info_2 &
	    (1ULL << SVM_EXITINFOSHIFT_TS_REASON_JMP))
		return kvm_task_switch(&svm->vcpu, tss_selector,
				       TASK_SWITCH_JMP);
	return kvm_task_switch(&svm->vcpu, tss_selector, TASK_SWITCH_CALL);
A
Avi Kivity 已提交
1160 1161
}

R
Rusty Russell 已提交
1162
static int cpuid_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1163
{
1164
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
1165
	kvm_emulate_cpuid(&svm->vcpu);
1166
	return 1;
A
Avi Kivity 已提交
1167 1168
}

M
Marcelo Tosatti 已提交
1169 1170 1171 1172 1173 1174 1175
static int invlpg_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	if (emulate_instruction(&svm->vcpu, kvm_run, 0, 0, 0) != EMULATE_DONE)
		pr_unimpl(&svm->vcpu, "%s: failed\n", __func__);
	return 1;
}

R
Rusty Russell 已提交
1176 1177
static int emulate_on_interception(struct vcpu_svm *svm,
				   struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1178
{
1179
	if (emulate_instruction(&svm->vcpu, NULL, 0, 0, 0) != EMULATE_DONE)
1180
		pr_unimpl(&svm->vcpu, "%s: failed\n", __func__);
A
Avi Kivity 已提交
1181 1182 1183
	return 1;
}

1184 1185 1186 1187 1188 1189 1190 1191 1192
static int cr8_write_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
{
	emulate_instruction(&svm->vcpu, NULL, 0, 0, 0);
	if (irqchip_in_kernel(svm->vcpu.kvm))
		return 1;
	kvm_run->exit_reason = KVM_EXIT_SET_TPR;
	return 0;
}

A
Avi Kivity 已提交
1193 1194
static int svm_get_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 *data)
{
1195 1196
	struct vcpu_svm *svm = to_svm(vcpu);

A
Avi Kivity 已提交
1197 1198 1199 1200 1201
	switch (ecx) {
	case MSR_IA32_TIME_STAMP_COUNTER: {
		u64 tsc;

		rdtscll(tsc);
1202
		*data = svm->vmcb->control.tsc_offset + tsc;
A
Avi Kivity 已提交
1203 1204
		break;
	}
1205
	case MSR_K6_STAR:
1206
		*data = svm->vmcb->save.star;
A
Avi Kivity 已提交
1207
		break;
1208
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
1209
	case MSR_LSTAR:
1210
		*data = svm->vmcb->save.lstar;
A
Avi Kivity 已提交
1211 1212
		break;
	case MSR_CSTAR:
1213
		*data = svm->vmcb->save.cstar;
A
Avi Kivity 已提交
1214 1215
		break;
	case MSR_KERNEL_GS_BASE:
1216
		*data = svm->vmcb->save.kernel_gs_base;
A
Avi Kivity 已提交
1217 1218
		break;
	case MSR_SYSCALL_MASK:
1219
		*data = svm->vmcb->save.sfmask;
A
Avi Kivity 已提交
1220 1221 1222
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
1223
		*data = svm->vmcb->save.sysenter_cs;
A
Avi Kivity 已提交
1224 1225
		break;
	case MSR_IA32_SYSENTER_EIP:
1226
		*data = svm->vmcb->save.sysenter_eip;
A
Avi Kivity 已提交
1227 1228
		break;
	case MSR_IA32_SYSENTER_ESP:
1229
		*data = svm->vmcb->save.sysenter_esp;
A
Avi Kivity 已提交
1230
		break;
1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248
	/* Nobody will change the following 5 values in the VMCB so
	   we can safely return them on rdmsr. They will always be 0
	   until LBRV is implemented. */
	case MSR_IA32_DEBUGCTLMSR:
		*data = svm->vmcb->save.dbgctl;
		break;
	case MSR_IA32_LASTBRANCHFROMIP:
		*data = svm->vmcb->save.br_from;
		break;
	case MSR_IA32_LASTBRANCHTOIP:
		*data = svm->vmcb->save.br_to;
		break;
	case MSR_IA32_LASTINTFROMIP:
		*data = svm->vmcb->save.last_excp_from;
		break;
	case MSR_IA32_LASTINTTOIP:
		*data = svm->vmcb->save.last_excp_to;
		break;
A
Avi Kivity 已提交
1249
	default:
1250
		return kvm_get_msr_common(vcpu, ecx, data);
A
Avi Kivity 已提交
1251 1252 1253 1254
	}
	return 0;
}

R
Rusty Russell 已提交
1255
static int rdmsr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1256
{
1257
	u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
A
Avi Kivity 已提交
1258 1259
	u64 data;

R
Rusty Russell 已提交
1260
	if (svm_get_msr(&svm->vcpu, ecx, &data))
1261
		kvm_inject_gp(&svm->vcpu, 0);
A
Avi Kivity 已提交
1262
	else {
1263 1264 1265
		KVMTRACE_3D(MSR_READ, &svm->vcpu, ecx, (u32)data,
			    (u32)(data >> 32), handler);

1266
		svm->vcpu.arch.regs[VCPU_REGS_RAX] = data & 0xffffffff;
1267
		svm->vcpu.arch.regs[VCPU_REGS_RDX] = data >> 32;
1268
		svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
1269
		skip_emulated_instruction(&svm->vcpu);
A
Avi Kivity 已提交
1270 1271 1272 1273 1274 1275
	}
	return 1;
}

static int svm_set_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 data)
{
1276 1277
	struct vcpu_svm *svm = to_svm(vcpu);

A
Avi Kivity 已提交
1278 1279 1280 1281 1282
	switch (ecx) {
	case MSR_IA32_TIME_STAMP_COUNTER: {
		u64 tsc;

		rdtscll(tsc);
1283
		svm->vmcb->control.tsc_offset = data - tsc;
A
Avi Kivity 已提交
1284 1285
		break;
	}
1286
	case MSR_K6_STAR:
1287
		svm->vmcb->save.star = data;
A
Avi Kivity 已提交
1288
		break;
1289
#ifdef CONFIG_X86_64
A
Avi Kivity 已提交
1290
	case MSR_LSTAR:
1291
		svm->vmcb->save.lstar = data;
A
Avi Kivity 已提交
1292 1293
		break;
	case MSR_CSTAR:
1294
		svm->vmcb->save.cstar = data;
A
Avi Kivity 已提交
1295 1296
		break;
	case MSR_KERNEL_GS_BASE:
1297
		svm->vmcb->save.kernel_gs_base = data;
A
Avi Kivity 已提交
1298 1299
		break;
	case MSR_SYSCALL_MASK:
1300
		svm->vmcb->save.sfmask = data;
A
Avi Kivity 已提交
1301 1302 1303
		break;
#endif
	case MSR_IA32_SYSENTER_CS:
1304
		svm->vmcb->save.sysenter_cs = data;
A
Avi Kivity 已提交
1305 1306
		break;
	case MSR_IA32_SYSENTER_EIP:
1307
		svm->vmcb->save.sysenter_eip = data;
A
Avi Kivity 已提交
1308 1309
		break;
	case MSR_IA32_SYSENTER_ESP:
1310
		svm->vmcb->save.sysenter_esp = data;
A
Avi Kivity 已提交
1311
		break;
1312
	case MSR_IA32_DEBUGCTLMSR:
1313 1314
		if (!svm_has(SVM_FEATURE_LBRV)) {
			pr_unimpl(vcpu, "%s: MSR_IA32_DEBUGCTL 0x%llx, nop\n",
1315
					__func__, data);
1316 1317 1318 1319 1320 1321 1322 1323 1324 1325
			break;
		}
		if (data & DEBUGCTL_RESERVED_BITS)
			return 1;

		svm->vmcb->save.dbgctl = data;
		if (data & (1ULL<<0))
			svm_enable_lbrv(svm);
		else
			svm_disable_lbrv(svm);
1326
		break;
1327 1328 1329 1330
	case MSR_K7_EVNTSEL0:
	case MSR_K7_EVNTSEL1:
	case MSR_K7_EVNTSEL2:
	case MSR_K7_EVNTSEL3:
1331 1332 1333 1334
	case MSR_K7_PERFCTR0:
	case MSR_K7_PERFCTR1:
	case MSR_K7_PERFCTR2:
	case MSR_K7_PERFCTR3:
1335
		/*
1336 1337 1338
		 * Just discard all writes to the performance counters; this
		 * should keep both older linux and windows 64-bit guests
		 * happy
1339
		 */
1340 1341
		pr_unimpl(vcpu, "unimplemented perfctr wrmsr: 0x%x data 0x%llx\n", ecx, data);

1342
		break;
A
Avi Kivity 已提交
1343
	default:
1344
		return kvm_set_msr_common(vcpu, ecx, data);
A
Avi Kivity 已提交
1345 1346 1347 1348
	}
	return 0;
}

R
Rusty Russell 已提交
1349
static int wrmsr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1350
{
1351
	u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
1352
	u64 data = (svm->vcpu.arch.regs[VCPU_REGS_RAX] & -1u)
1353
		| ((u64)(svm->vcpu.arch.regs[VCPU_REGS_RDX] & -1u) << 32);
1354 1355 1356 1357

	KVMTRACE_3D(MSR_WRITE, &svm->vcpu, ecx, (u32)data, (u32)(data >> 32),
		    handler);

1358
	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
R
Rusty Russell 已提交
1359
	if (svm_set_msr(&svm->vcpu, ecx, data))
1360
		kvm_inject_gp(&svm->vcpu, 0);
A
Avi Kivity 已提交
1361
	else
R
Rusty Russell 已提交
1362
		skip_emulated_instruction(&svm->vcpu);
A
Avi Kivity 已提交
1363 1364 1365
	return 1;
}

R
Rusty Russell 已提交
1366
static int msr_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1367
{
R
Rusty Russell 已提交
1368 1369
	if (svm->vmcb->control.exit_info_1)
		return wrmsr_interception(svm, kvm_run);
A
Avi Kivity 已提交
1370
	else
R
Rusty Russell 已提交
1371
		return rdmsr_interception(svm, kvm_run);
A
Avi Kivity 已提交
1372 1373
}

R
Rusty Russell 已提交
1374
static int interrupt_window_interception(struct vcpu_svm *svm,
1375 1376
				   struct kvm_run *kvm_run)
{
1377 1378
	KVMTRACE_0D(PEND_INTR, &svm->vcpu, handler);

1379 1380
	svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_VINTR);
	svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
1381 1382 1383 1384 1385
	/*
	 * If the user space waits to inject interrupts, exit as soon as
	 * possible
	 */
	if (kvm_run->request_interrupt_window &&
1386
	    !svm->vcpu.arch.irq_summary) {
R
Rusty Russell 已提交
1387
		++svm->vcpu.stat.irq_window_exits;
1388 1389 1390 1391 1392 1393 1394
		kvm_run->exit_reason = KVM_EXIT_IRQ_WINDOW_OPEN;
		return 0;
	}

	return 1;
}

R
Rusty Russell 已提交
1395
static int (*svm_exit_handlers[])(struct vcpu_svm *svm,
A
Avi Kivity 已提交
1396 1397 1398 1399
				      struct kvm_run *kvm_run) = {
	[SVM_EXIT_READ_CR0]           		= emulate_on_interception,
	[SVM_EXIT_READ_CR3]           		= emulate_on_interception,
	[SVM_EXIT_READ_CR4]           		= emulate_on_interception,
1400
	[SVM_EXIT_READ_CR8]           		= emulate_on_interception,
A
Avi Kivity 已提交
1401 1402 1403 1404
	/* for now: */
	[SVM_EXIT_WRITE_CR0]          		= emulate_on_interception,
	[SVM_EXIT_WRITE_CR3]          		= emulate_on_interception,
	[SVM_EXIT_WRITE_CR4]          		= emulate_on_interception,
1405
	[SVM_EXIT_WRITE_CR8]          		= cr8_write_interception,
A
Avi Kivity 已提交
1406 1407 1408 1409 1410 1411 1412 1413 1414 1415
	[SVM_EXIT_READ_DR0] 			= emulate_on_interception,
	[SVM_EXIT_READ_DR1]			= emulate_on_interception,
	[SVM_EXIT_READ_DR2]			= emulate_on_interception,
	[SVM_EXIT_READ_DR3]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR0]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR1]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR2]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR3]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR5]			= emulate_on_interception,
	[SVM_EXIT_WRITE_DR7]			= emulate_on_interception,
1416
	[SVM_EXIT_EXCP_BASE + UD_VECTOR]	= ud_interception,
A
Avi Kivity 已提交
1417
	[SVM_EXIT_EXCP_BASE + PF_VECTOR] 	= pf_interception,
A
Anthony Liguori 已提交
1418
	[SVM_EXIT_EXCP_BASE + NM_VECTOR] 	= nm_interception,
1419
	[SVM_EXIT_EXCP_BASE + MC_VECTOR] 	= mc_interception,
1420
	[SVM_EXIT_INTR] 			= intr_interception,
1421
	[SVM_EXIT_NMI]				= nmi_interception,
A
Avi Kivity 已提交
1422 1423
	[SVM_EXIT_SMI]				= nop_on_interception,
	[SVM_EXIT_INIT]				= nop_on_interception,
1424
	[SVM_EXIT_VINTR]			= interrupt_window_interception,
A
Avi Kivity 已提交
1425 1426
	/* [SVM_EXIT_CR0_SEL_WRITE]		= emulate_on_interception, */
	[SVM_EXIT_CPUID]			= cpuid_interception,
1427
	[SVM_EXIT_INVD]                         = emulate_on_interception,
A
Avi Kivity 已提交
1428
	[SVM_EXIT_HLT]				= halt_interception,
M
Marcelo Tosatti 已提交
1429
	[SVM_EXIT_INVLPG]			= invlpg_interception,
A
Avi Kivity 已提交
1430 1431 1432 1433
	[SVM_EXIT_INVLPGA]			= invalid_op_interception,
	[SVM_EXIT_IOIO] 		  	= io_interception,
	[SVM_EXIT_MSR]				= msr_interception,
	[SVM_EXIT_TASK_SWITCH]			= task_switch_interception,
1434
	[SVM_EXIT_SHUTDOWN]			= shutdown_interception,
A
Avi Kivity 已提交
1435
	[SVM_EXIT_VMRUN]			= invalid_op_interception,
1436
	[SVM_EXIT_VMMCALL]			= vmmcall_interception,
A
Avi Kivity 已提交
1437 1438 1439 1440 1441
	[SVM_EXIT_VMLOAD]			= invalid_op_interception,
	[SVM_EXIT_VMSAVE]			= invalid_op_interception,
	[SVM_EXIT_STGI]				= invalid_op_interception,
	[SVM_EXIT_CLGI]				= invalid_op_interception,
	[SVM_EXIT_SKINIT]			= invalid_op_interception,
1442
	[SVM_EXIT_WBINVD]                       = emulate_on_interception,
1443 1444
	[SVM_EXIT_MONITOR]			= invalid_op_interception,
	[SVM_EXIT_MWAIT]			= invalid_op_interception,
1445
	[SVM_EXIT_NPF]				= pf_interception,
A
Avi Kivity 已提交
1446 1447
};

1448
static int handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1449
{
1450
	struct vcpu_svm *svm = to_svm(vcpu);
1451
	u32 exit_code = svm->vmcb->control.exit_code;
A
Avi Kivity 已提交
1452

1453 1454 1455
	KVMTRACE_3D(VMEXIT, vcpu, exit_code, (u32)svm->vmcb->save.rip,
		    (u32)((u64)svm->vmcb->save.rip >> 32), entryexit);

1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475
	if (npt_enabled) {
		int mmu_reload = 0;
		if ((vcpu->arch.cr0 ^ svm->vmcb->save.cr0) & X86_CR0_PG) {
			svm_set_cr0(vcpu, svm->vmcb->save.cr0);
			mmu_reload = 1;
		}
		vcpu->arch.cr0 = svm->vmcb->save.cr0;
		vcpu->arch.cr3 = svm->vmcb->save.cr3;
		if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
			if (!load_pdptrs(vcpu, vcpu->arch.cr3)) {
				kvm_inject_gp(vcpu, 0);
				return 1;
			}
		}
		if (mmu_reload) {
			kvm_mmu_reset_context(vcpu);
			kvm_mmu_load(vcpu);
		}
	}

1476 1477 1478 1479 1480 1481 1482 1483 1484
	kvm_reput_irq(svm);

	if (svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
		kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
		kvm_run->fail_entry.hardware_entry_failure_reason
			= svm->vmcb->control.exit_code;
		return 0;
	}

1485
	if (is_external_interrupt(svm->vmcb->control.exit_int_info) &&
1486 1487
	    exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR &&
	    exit_code != SVM_EXIT_NPF)
A
Avi Kivity 已提交
1488 1489
		printk(KERN_ERR "%s: unexpected exit_ini_info 0x%x "
		       "exit_code 0x%x\n",
1490
		       __func__, svm->vmcb->control.exit_int_info,
A
Avi Kivity 已提交
1491 1492
		       exit_code);

1493
	if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
J
Joe Perches 已提交
1494
	    || !svm_exit_handlers[exit_code]) {
A
Avi Kivity 已提交
1495
		kvm_run->exit_reason = KVM_EXIT_UNKNOWN;
1496
		kvm_run->hw.hardware_exit_reason = exit_code;
A
Avi Kivity 已提交
1497 1498 1499
		return 0;
	}

R
Rusty Russell 已提交
1500
	return svm_exit_handlers[exit_code](svm, kvm_run);
A
Avi Kivity 已提交
1501 1502 1503 1504 1505 1506 1507
}

static void reload_tss(struct kvm_vcpu *vcpu)
{
	int cpu = raw_smp_processor_id();

	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
M
Mike Day 已提交
1508
	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
A
Avi Kivity 已提交
1509 1510 1511
	load_TR_desc();
}

R
Rusty Russell 已提交
1512
static void pre_svm_run(struct vcpu_svm *svm)
A
Avi Kivity 已提交
1513 1514 1515 1516 1517
{
	int cpu = raw_smp_processor_id();

	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);

1518
	svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
R
Rusty Russell 已提交
1519
	if (svm->vcpu.cpu != cpu ||
1520
	    svm->asid_generation != svm_data->asid_generation)
R
Rusty Russell 已提交
1521
		new_asid(svm, svm_data);
A
Avi Kivity 已提交
1522 1523 1524
}


1525
static inline void svm_inject_irq(struct vcpu_svm *svm, int irq)
A
Avi Kivity 已提交
1526 1527 1528
{
	struct vmcb_control_area *control;

1529 1530
	KVMTRACE_1D(INJ_VIRQ, &svm->vcpu, (u32)irq, handler);

1531
	++svm->vcpu.stat.irq_injections;
R
Rusty Russell 已提交
1532
	control = &svm->vmcb->control;
1533
	control->int_vector = irq;
A
Avi Kivity 已提交
1534 1535 1536 1537 1538
	control->int_ctl &= ~V_INTR_PRIO_MASK;
	control->int_ctl |= V_IRQ_MASK |
		((/*control->int_vector >> 4*/ 0xf) << V_INTR_PRIO_SHIFT);
}

E
Eddie Dong 已提交
1539 1540 1541 1542 1543 1544 1545
static void svm_set_irq(struct kvm_vcpu *vcpu, int irq)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	svm_inject_irq(svm, irq);
}

1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566
static void update_cr8_intercept(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	struct vmcb *vmcb = svm->vmcb;
	int max_irr, tpr;

	if (!irqchip_in_kernel(vcpu->kvm) || vcpu->arch.apic->vapic_addr)
		return;

	vmcb->control.intercept_cr_write &= ~INTERCEPT_CR8_MASK;

	max_irr = kvm_lapic_find_highest_irr(vcpu);
	if (max_irr == -1)
		return;

	tpr = kvm_lapic_get_cr8(vcpu) << 4;

	if (tpr >= (max_irr & 0xf0))
		vmcb->control.intercept_cr_write |= INTERCEPT_CR8_MASK;
}

1567
static void svm_intr_assist(struct kvm_vcpu *vcpu)
A
Avi Kivity 已提交
1568
{
1569
	struct vcpu_svm *svm = to_svm(vcpu);
1570 1571 1572 1573 1574 1575 1576 1577 1578
	struct vmcb *vmcb = svm->vmcb;
	int intr_vector = -1;

	if ((vmcb->control.exit_int_info & SVM_EVTINJ_VALID) &&
	    ((vmcb->control.exit_int_info & SVM_EVTINJ_TYPE_MASK) == 0)) {
		intr_vector = vmcb->control.exit_int_info &
			      SVM_EVTINJ_VEC_MASK;
		vmcb->control.exit_int_info = 0;
		svm_inject_irq(svm, intr_vector);
1579
		goto out;
1580 1581 1582
	}

	if (vmcb->control.int_ctl & V_IRQ_MASK)
1583
		goto out;
1584

1585
	if (!kvm_cpu_has_interrupt(vcpu))
1586
		goto out;
1587 1588 1589 1590 1591 1592 1593

	if (!(vmcb->save.rflags & X86_EFLAGS_IF) ||
	    (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK) ||
	    (vmcb->control.event_inj & SVM_EVTINJ_VALID)) {
		/* unable to deliver irq, set pending irq */
		vmcb->control.intercept |= (1ULL << INTERCEPT_VINTR);
		svm_inject_irq(svm, 0x0);
1594
		goto out;
1595 1596
	}
	/* Okay, we can deliver the interrupt: grab it and update PIC state. */
1597
	intr_vector = kvm_cpu_get_interrupt(vcpu);
1598
	svm_inject_irq(svm, intr_vector);
1599
	kvm_timer_intr_post(vcpu, intr_vector);
1600 1601
out:
	update_cr8_intercept(vcpu);
1602 1603 1604 1605
}

static void kvm_reput_irq(struct vcpu_svm *svm)
{
R
Rusty Russell 已提交
1606
	struct vmcb_control_area *control = &svm->vmcb->control;
A
Avi Kivity 已提交
1607

1608 1609
	if ((control->int_ctl & V_IRQ_MASK)
	    && !irqchip_in_kernel(svm->vcpu.kvm)) {
A
Avi Kivity 已提交
1610
		control->int_ctl &= ~V_IRQ_MASK;
R
Rusty Russell 已提交
1611
		push_irq(&svm->vcpu, control->int_vector);
A
Avi Kivity 已提交
1612
	}
1613

1614
	svm->vcpu.arch.interrupt_window_open =
1615 1616 1617
		!(control->int_state & SVM_INTERRUPT_SHADOW_MASK);
}

1618 1619 1620
static void svm_do_inject_vector(struct vcpu_svm *svm)
{
	struct kvm_vcpu *vcpu = &svm->vcpu;
1621 1622
	int word_index = __ffs(vcpu->arch.irq_summary);
	int bit_index = __ffs(vcpu->arch.irq_pending[word_index]);
1623 1624
	int irq = word_index * BITS_PER_LONG + bit_index;

1625 1626 1627
	clear_bit(bit_index, &vcpu->arch.irq_pending[word_index]);
	if (!vcpu->arch.irq_pending[word_index])
		clear_bit(word_index, &vcpu->arch.irq_summary);
1628 1629 1630
	svm_inject_irq(svm, irq);
}

1631
static void do_interrupt_requests(struct kvm_vcpu *vcpu,
1632 1633
				       struct kvm_run *kvm_run)
{
1634
	struct vcpu_svm *svm = to_svm(vcpu);
1635
	struct vmcb_control_area *control = &svm->vmcb->control;
1636

1637
	svm->vcpu.arch.interrupt_window_open =
1638
		(!(control->int_state & SVM_INTERRUPT_SHADOW_MASK) &&
1639
		 (svm->vmcb->save.rflags & X86_EFLAGS_IF));
1640

1641
	if (svm->vcpu.arch.interrupt_window_open && svm->vcpu.arch.irq_summary)
1642 1643 1644
		/*
		 * If interrupts enabled, and not blocked by sti or mov ss. Good.
		 */
1645
		svm_do_inject_vector(svm);
1646 1647 1648 1649

	/*
	 * Interrupts blocked.  Wait for unblock.
	 */
1650 1651
	if (!svm->vcpu.arch.interrupt_window_open &&
	    (svm->vcpu.arch.irq_summary || kvm_run->request_interrupt_window))
1652
		control->intercept |= 1ULL << INTERCEPT_VINTR;
M
Mike Day 已提交
1653
	 else
1654 1655 1656
		control->intercept &= ~(1ULL << INTERCEPT_VINTR);
}

1657 1658 1659 1660 1661
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
{
	return 0;
}

A
Avi Kivity 已提交
1662 1663
static void save_db_regs(unsigned long *db_regs)
{
1664 1665 1666 1667
	asm volatile ("mov %%dr0, %0" : "=r"(db_regs[0]));
	asm volatile ("mov %%dr1, %0" : "=r"(db_regs[1]));
	asm volatile ("mov %%dr2, %0" : "=r"(db_regs[2]));
	asm volatile ("mov %%dr3, %0" : "=r"(db_regs[3]));
A
Avi Kivity 已提交
1668 1669 1670 1671
}

static void load_db_regs(unsigned long *db_regs)
{
1672 1673 1674 1675
	asm volatile ("mov %0, %%dr0" : : "r"(db_regs[0]));
	asm volatile ("mov %0, %%dr1" : : "r"(db_regs[1]));
	asm volatile ("mov %0, %%dr2" : : "r"(db_regs[2]));
	asm volatile ("mov %0, %%dr3" : : "r"(db_regs[3]));
A
Avi Kivity 已提交
1676 1677
}

1678 1679 1680 1681 1682
static void svm_flush_tlb(struct kvm_vcpu *vcpu)
{
	force_new_asid(vcpu);
}

1683 1684 1685 1686
static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
{
}

1687 1688 1689 1690 1691 1692 1693 1694 1695 1696
static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);

	if (!(svm->vmcb->control.intercept_cr_write & INTERCEPT_CR8_MASK)) {
		int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK;
		kvm_lapic_set_tpr(vcpu, cr8);
	}
}

1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709
static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
{
	struct vcpu_svm *svm = to_svm(vcpu);
	u64 cr8;

	if (!irqchip_in_kernel(vcpu->kvm))
		return;

	cr8 = kvm_get_cr8(vcpu);
	svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
	svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
}

1710 1711 1712 1713 1714 1715
#ifdef CONFIG_X86_64
#define R "r"
#else
#define R "e"
#endif

1716
static void svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
A
Avi Kivity 已提交
1717
{
1718
	struct vcpu_svm *svm = to_svm(vcpu);
A
Avi Kivity 已提交
1719 1720 1721
	u16 fs_selector;
	u16 gs_selector;
	u16 ldt_selector;
1722

1723 1724 1725 1726
	svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
	svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
	svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];

R
Rusty Russell 已提交
1727
	pre_svm_run(svm);
A
Avi Kivity 已提交
1728

1729 1730
	sync_lapic_to_cr8(vcpu);

A
Avi Kivity 已提交
1731
	save_host_msrs(vcpu);
1732 1733 1734
	fs_selector = kvm_read_fs();
	gs_selector = kvm_read_gs();
	ldt_selector = kvm_read_ldt();
1735 1736 1737
	svm->host_cr2 = kvm_read_cr2();
	svm->host_dr6 = read_dr6();
	svm->host_dr7 = read_dr7();
1738
	svm->vmcb->save.cr2 = vcpu->arch.cr2;
1739 1740 1741
	/* required for live migration with NPT */
	if (npt_enabled)
		svm->vmcb->save.cr3 = vcpu->arch.cr3;
A
Avi Kivity 已提交
1742

1743
	if (svm->vmcb->save.dr7 & 0xff) {
A
Avi Kivity 已提交
1744
		write_dr7(0);
1745 1746
		save_db_regs(svm->host_db_regs);
		load_db_regs(svm->db_regs);
A
Avi Kivity 已提交
1747
	}
1748

1749 1750 1751
	clgi();

	local_irq_enable();
1752

A
Avi Kivity 已提交
1753
	asm volatile (
1754 1755 1756 1757 1758 1759 1760
		"push %%"R"bp; \n\t"
		"mov %c[rbx](%[svm]), %%"R"bx \n\t"
		"mov %c[rcx](%[svm]), %%"R"cx \n\t"
		"mov %c[rdx](%[svm]), %%"R"dx \n\t"
		"mov %c[rsi](%[svm]), %%"R"si \n\t"
		"mov %c[rdi](%[svm]), %%"R"di \n\t"
		"mov %c[rbp](%[svm]), %%"R"bp \n\t"
1761
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
1762 1763 1764 1765 1766 1767 1768 1769
		"mov %c[r8](%[svm]),  %%r8  \n\t"
		"mov %c[r9](%[svm]),  %%r9  \n\t"
		"mov %c[r10](%[svm]), %%r10 \n\t"
		"mov %c[r11](%[svm]), %%r11 \n\t"
		"mov %c[r12](%[svm]), %%r12 \n\t"
		"mov %c[r13](%[svm]), %%r13 \n\t"
		"mov %c[r14](%[svm]), %%r14 \n\t"
		"mov %c[r15](%[svm]), %%r15 \n\t"
A
Avi Kivity 已提交
1770 1771 1772
#endif

		/* Enter guest mode */
1773 1774
		"push %%"R"ax \n\t"
		"mov %c[vmcb](%[svm]), %%"R"ax \n\t"
1775 1776 1777
		__ex(SVM_VMLOAD) "\n\t"
		__ex(SVM_VMRUN) "\n\t"
		__ex(SVM_VMSAVE) "\n\t"
1778
		"pop %%"R"ax \n\t"
A
Avi Kivity 已提交
1779 1780

		/* Save guest registers, load host registers */
1781 1782 1783 1784 1785 1786
		"mov %%"R"bx, %c[rbx](%[svm]) \n\t"
		"mov %%"R"cx, %c[rcx](%[svm]) \n\t"
		"mov %%"R"dx, %c[rdx](%[svm]) \n\t"
		"mov %%"R"si, %c[rsi](%[svm]) \n\t"
		"mov %%"R"di, %c[rdi](%[svm]) \n\t"
		"mov %%"R"bp, %c[rbp](%[svm]) \n\t"
1787
#ifdef CONFIG_X86_64
R
Rusty Russell 已提交
1788 1789 1790 1791 1792 1793 1794 1795
		"mov %%r8,  %c[r8](%[svm]) \n\t"
		"mov %%r9,  %c[r9](%[svm]) \n\t"
		"mov %%r10, %c[r10](%[svm]) \n\t"
		"mov %%r11, %c[r11](%[svm]) \n\t"
		"mov %%r12, %c[r12](%[svm]) \n\t"
		"mov %%r13, %c[r13](%[svm]) \n\t"
		"mov %%r14, %c[r14](%[svm]) \n\t"
		"mov %%r15, %c[r15](%[svm]) \n\t"
A
Avi Kivity 已提交
1796
#endif
1797
		"pop %%"R"bp"
A
Avi Kivity 已提交
1798
		:
R
Rusty Russell 已提交
1799
		: [svm]"a"(svm),
A
Avi Kivity 已提交
1800
		  [vmcb]"i"(offsetof(struct vcpu_svm, vmcb_pa)),
1801 1802 1803 1804 1805 1806
		  [rbx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBX])),
		  [rcx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RCX])),
		  [rdx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDX])),
		  [rsi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RSI])),
		  [rdi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDI])),
		  [rbp]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBP]))
1807
#ifdef CONFIG_X86_64
1808 1809 1810 1811 1812 1813 1814 1815
		  , [r8]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R8])),
		  [r9]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R9])),
		  [r10]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R10])),
		  [r11]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R11])),
		  [r12]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R12])),
		  [r13]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R13])),
		  [r14]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R14])),
		  [r15]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R15]))
A
Avi Kivity 已提交
1816
#endif
1817
		: "cc", "memory"
1818
		, R"bx", R"cx", R"dx", R"si", R"di"
1819 1820 1821 1822
#ifdef CONFIG_X86_64
		, "r8", "r9", "r10", "r11" , "r12", "r13", "r14", "r15"
#endif
		);
A
Avi Kivity 已提交
1823

1824 1825
	if ((svm->vmcb->save.dr7 & 0xff))
		load_db_regs(svm->host_db_regs);
A
Avi Kivity 已提交
1826

1827
	vcpu->arch.cr2 = svm->vmcb->save.cr2;
1828 1829 1830
	vcpu->arch.regs[VCPU_REGS_RAX] = svm->vmcb->save.rax;
	vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
	vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
A
Avi Kivity 已提交
1831

1832 1833 1834
	write_dr6(svm->host_dr6);
	write_dr7(svm->host_dr7);
	kvm_write_cr2(svm->host_cr2);
A
Avi Kivity 已提交
1835

1836 1837 1838
	kvm_load_fs(fs_selector);
	kvm_load_gs(gs_selector);
	kvm_load_ldt(ldt_selector);
A
Avi Kivity 已提交
1839 1840 1841 1842
	load_host_msrs(vcpu);

	reload_tss(vcpu);

1843 1844 1845 1846
	local_irq_disable();

	stgi();

1847 1848
	sync_cr8_to_lapic(vcpu);

1849
	svm->next_rip = 0;
A
Avi Kivity 已提交
1850 1851
}

1852 1853
#undef R

A
Avi Kivity 已提交
1854 1855
static void svm_set_cr3(struct kvm_vcpu *vcpu, unsigned long root)
{
1856 1857
	struct vcpu_svm *svm = to_svm(vcpu);

1858 1859 1860 1861 1862 1863
	if (npt_enabled) {
		svm->vmcb->control.nested_cr3 = root;
		force_new_asid(vcpu);
		return;
	}

1864
	svm->vmcb->save.cr3 = root;
A
Avi Kivity 已提交
1865
	force_new_asid(vcpu);
A
Anthony Liguori 已提交
1866 1867

	if (vcpu->fpu_active) {
1868 1869
		svm->vmcb->control.intercept_exceptions |= (1 << NM_VECTOR);
		svm->vmcb->save.cr0 |= X86_CR0_TS;
A
Anthony Liguori 已提交
1870 1871
		vcpu->fpu_active = 0;
	}
A
Avi Kivity 已提交
1872 1873 1874 1875
}

static int is_disabled(void)
{
1876 1877 1878 1879 1880 1881
	u64 vm_cr;

	rdmsrl(MSR_VM_CR, vm_cr);
	if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE))
		return 1;

A
Avi Kivity 已提交
1882 1883 1884
	return 0;
}

I
Ingo Molnar 已提交
1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895
static void
svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
{
	/*
	 * Patch in the VMMCALL instruction:
	 */
	hypercall[0] = 0x0f;
	hypercall[1] = 0x01;
	hypercall[2] = 0xd9;
}

Y
Yang, Sheng 已提交
1896 1897 1898 1899 1900
static void svm_check_processor_compat(void *rtn)
{
	*(int *)rtn = 0;
}

1901 1902 1903 1904 1905
static bool svm_cpu_has_accelerated_tpr(void)
{
	return false;
}

1906 1907 1908 1909 1910 1911 1912 1913 1914
static int get_npt_level(void)
{
#ifdef CONFIG_X86_64
	return PT64_ROOT_LEVEL;
#else
	return PT32E_ROOT_LEVEL;
#endif
}

S
Sheng Yang 已提交
1915 1916 1917 1918 1919
static int svm_get_mt_mask_shift(void)
{
	return 0;
}

1920
static struct kvm_x86_ops svm_x86_ops = {
A
Avi Kivity 已提交
1921 1922 1923 1924
	.cpu_has_kvm_support = has_svm,
	.disabled_by_bios = is_disabled,
	.hardware_setup = svm_hardware_setup,
	.hardware_unsetup = svm_hardware_unsetup,
Y
Yang, Sheng 已提交
1925
	.check_processor_compatibility = svm_check_processor_compat,
A
Avi Kivity 已提交
1926 1927
	.hardware_enable = svm_hardware_enable,
	.hardware_disable = svm_hardware_disable,
1928
	.cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr,
A
Avi Kivity 已提交
1929 1930 1931

	.vcpu_create = svm_create_vcpu,
	.vcpu_free = svm_free_vcpu,
1932
	.vcpu_reset = svm_vcpu_reset,
A
Avi Kivity 已提交
1933

1934
	.prepare_guest_switch = svm_prepare_guest_switch,
A
Avi Kivity 已提交
1935 1936 1937 1938 1939 1940 1941 1942 1943
	.vcpu_load = svm_vcpu_load,
	.vcpu_put = svm_vcpu_put,

	.set_guest_debug = svm_guest_debug,
	.get_msr = svm_get_msr,
	.set_msr = svm_set_msr,
	.get_segment_base = svm_get_segment_base,
	.get_segment = svm_get_segment,
	.set_segment = svm_set_segment,
1944
	.get_cpl = svm_get_cpl,
1945
	.get_cs_db_l_bits = kvm_get_cs_db_l_bits,
1946
	.decache_cr4_guest_bits = svm_decache_cr4_guest_bits,
A
Avi Kivity 已提交
1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962
	.set_cr0 = svm_set_cr0,
	.set_cr3 = svm_set_cr3,
	.set_cr4 = svm_set_cr4,
	.set_efer = svm_set_efer,
	.get_idt = svm_get_idt,
	.set_idt = svm_set_idt,
	.get_gdt = svm_get_gdt,
	.set_gdt = svm_set_gdt,
	.get_dr = svm_get_dr,
	.set_dr = svm_set_dr,
	.get_rflags = svm_get_rflags,
	.set_rflags = svm_set_rflags,

	.tlb_flush = svm_flush_tlb,

	.run = svm_vcpu_run,
1963
	.handle_exit = handle_exit,
A
Avi Kivity 已提交
1964
	.skip_emulated_instruction = skip_emulated_instruction,
I
Ingo Molnar 已提交
1965
	.patch_hypercall = svm_patch_hypercall,
E
Eddie Dong 已提交
1966 1967
	.get_irq = svm_get_irq,
	.set_irq = svm_set_irq,
1968 1969
	.queue_exception = svm_queue_exception,
	.exception_injected = svm_exception_injected,
1970 1971
	.inject_pending_irq = svm_intr_assist,
	.inject_pending_vectors = do_interrupt_requests,
1972 1973

	.set_tss_addr = svm_set_tss_addr,
1974
	.get_tdp_level = get_npt_level,
S
Sheng Yang 已提交
1975
	.get_mt_mask_shift = svm_get_mt_mask_shift,
A
Avi Kivity 已提交
1976 1977 1978 1979
};

static int __init svm_init(void)
{
1980
	return kvm_init(&svm_x86_ops, sizeof(struct vcpu_svm),
1981
			      THIS_MODULE);
A
Avi Kivity 已提交
1982 1983 1984 1985
}

static void __exit svm_exit(void)
{
1986
	kvm_exit();
A
Avi Kivity 已提交
1987 1988 1989 1990
}

module_init(svm_init)
module_exit(svm_exit)