arch/x86/kvm/svm.c

   1 /*
   2  * Kernel-based Virtual Machine driver for Linux
   3  *
   4  * AMD SVM support
   5  *
   6  * Copyright (C) 2006 Qumranet, Inc.
   7  * Copyright 2010 Red Hat, Inc. and/or its affiliates.
   8  *
   9  * Authors:
  10  *   Yaniv Kamay  <yaniv@qumranet.com>
  11  *   Avi Kivity   <avi@qumranet.com>
  12  *
  13  * This work is licensed under the terms of the GNU GPL, version 2.  See
  14  * the COPYING file in the top-level directory.
  15  *
  16  */
  17 #include <linux/kvm_host.h>
  18
  19 #include "irq.h"
  20 #include "mmu.h"
  21 #include "kvm_cache_regs.h"
  22 #include "x86.h"
  23 #include "cpuid.h"
  24
  25 #include <linux/module.h>
  26 #include <linux/mod_devicetable.h>
  27 #include <linux/kernel.h>
  28 #include <linux/vmalloc.h>
  29 #include <linux/highmem.h>
  30 #include <linux/sched.h>
  31 #include <linux/ftrace_event.h>
  32 #include <linux/slab.h>
  33
  34 #include <asm/perf_event.h>
  35 #include <asm/tlbflush.h>
  36 #include <asm/desc.h>
  37 #include <asm/kvm_para.h>
  38
  39 #include <asm/virtext.h>
  40 #include "trace.h"
  41
  42 #define __ex(x) __kvm_handle_fault_on_reboot(x)
  43
  44 MODULE_AUTHOR("Qumranet");
  45 MODULE_LICENSE("GPL");
  46
  47 static const struct x86_cpu_id svm_cpu_id[] = {
  48         X86_FEATURE_MATCH(X86_FEATURE_SVM),
  49         {}
  50 };
  51 MODULE_DEVICE_TABLE(x86cpu, svm_cpu_id);
  52
  53 #define IOPM_ALLOC_ORDER 2
  54 #define MSRPM_ALLOC_ORDER 1
  55
  56 #define SEG_TYPE_LDT 2
  57 #define SEG_TYPE_BUSY_TSS16 3
  58
  59 #define SVM_FEATURE_NPT            (1 <<  0)
  60 #define SVM_FEATURE_LBRV           (1 <<  1)
  61 #define SVM_FEATURE_SVML           (1 <<  2)
  62 #define SVM_FEATURE_NRIP           (1 <<  3)
  63 #define SVM_FEATURE_TSC_RATE       (1 <<  4)
  64 #define SVM_FEATURE_VMCB_CLEAN     (1 <<  5)
  65 #define SVM_FEATURE_FLUSH_ASID     (1 <<  6)
  66 #define SVM_FEATURE_DECODE_ASSIST  (1 <<  7)
  67 #define SVM_FEATURE_PAUSE_FILTER   (1 << 10)
  68
  69 #define NESTED_EXIT_HOST        0       /* Exit handled on host level */
  70 #define NESTED_EXIT_DONE        1       /* Exit caused nested vmexit  */
  71 #define NESTED_EXIT_CONTINUE    2       /* Further checks needed      */
  72
  73 #define DEBUGCTL_RESERVED_BITS (~(0x3fULL))
  74
  75 #define TSC_RATIO_RSVD          0xffffff0000000000ULL
  76 #define TSC_RATIO_MIN           0x0000000000000001ULL
  77 #define TSC_RATIO_MAX           0x000000ffffffffffULL
  78
  79 static bool erratum_383_found __read_mostly;
  80
  81 static const u32 host_save_user_msrs[] = {
  82 #ifdef CONFIG_X86_64
  83         MSR_STAR, MSR_LSTAR, MSR_CSTAR, MSR_SYSCALL_MASK, MSR_KERNEL_GS_BASE,
  84         MSR_FS_BASE,
  85 #endif
  86         MSR_IA32_SYSENTER_CS, MSR_IA32_SYSENTER_ESP, MSR_IA32_SYSENTER_EIP,
  87 };
  88
  89 #define NR_HOST_SAVE_USER_MSRS ARRAY_SIZE(host_save_user_msrs)
  90
  91 struct kvm_vcpu;
  92
  93 struct nested_state {
  94         struct vmcb *hsave;
  95         u64 hsave_msr;
  96         u64 vm_cr_msr;
  97         u64 vmcb;
  98
  99         /* These are the merged vectors */
 100         u32 *msrpm;
 101
 102         /* gpa pointers to the real vectors */
 103         u64 vmcb_msrpm;
 104         u64 vmcb_iopm;
 105
 106         /* A VMEXIT is required but not yet emulated */
 107         bool exit_required;
 108
 109         /* cache for intercepts of the guest */
 110         u32 intercept_cr;
 111         u32 intercept_dr;
 112         u32 intercept_exceptions;
 113         u64 intercept;
 114
 115         /* Nested Paging related state */
 116         u64 nested_cr3;
 117 };
 118
 119 #define MSRPM_OFFSETS   16
 120 static u32 msrpm_offsets[MSRPM_OFFSETS] __read_mostly;
 121
 122 /*
 123  * Set osvw_len to higher value when updated Revision Guides
 124  * are published and we know what the new status bits are
 125  */
 126 static uint64_t osvw_len = 4, osvw_status;
 127
 128 struct vcpu_svm {
 129         struct kvm_vcpu vcpu;
 130         struct vmcb *vmcb;
 131         unsigned long vmcb_pa;
 132         struct svm_cpu_data *svm_data;
 133         uint64_t asid_generation;
 134         uint64_t sysenter_esp;
 135         uint64_t sysenter_eip;
 136
 137         u64 next_rip;
 138
 139         u64 host_user_msrs[NR_HOST_SAVE_USER_MSRS];
 140         struct {
 141                 u16 fs;
 142                 u16 gs;
 143                 u16 ldt;
 144                 u64 gs_base;
 145         } host;
 146
 147         u32 *msrpm;
 148
 149         ulong nmi_iret_rip;
 150
 151         struct nested_state nested;
 152
 153         bool nmi_singlestep;
 154
 155         unsigned int3_injected;
 156         unsigned long int3_rip;
 157         u32 apf_reason;
 158
 159         u64  tsc_ratio;
 160 };
 161
 162 static DEFINE_PER_CPU(u64, current_tsc_ratio);
 163 #define TSC_RATIO_DEFAULT       0x0100000000ULL
 164
 165 #define MSR_INVALID                     0xffffffffU
 166
 167 static const struct svm_direct_access_msrs {
 168         u32 index;   /* Index of the MSR */
 169         bool always; /* True if intercept is always on */
 170 } direct_access_msrs[] = {
 171         { .index = MSR_STAR,                            .always = true  },
 172         { .index = MSR_IA32_SYSENTER_CS,                .always = true  },
 173 #ifdef CONFIG_X86_64
 174         { .index = MSR_GS_BASE,                         .always = true  },
 175         { .index = MSR_FS_BASE,                         .always = true  },
 176         { .index = MSR_KERNEL_GS_BASE,                  .always = true  },
 177         { .index = MSR_LSTAR,                           .always = true  },
 178         { .index = MSR_CSTAR,                           .always = true  },
 179         { .index = MSR_SYSCALL_MASK,                    .always = true  },
 180 #endif
 181         { .index = MSR_IA32_LASTBRANCHFROMIP,           .always = false },
 182         { .index = MSR_IA32_LASTBRANCHTOIP,             .always = false },
 183         { .index = MSR_IA32_LASTINTFROMIP,              .always = false },
 184         { .index = MSR_IA32_LASTINTTOIP,                .always = false },
 185         { .index = MSR_INVALID,                         .always = false },
 186 };
 187
 188 /* enable NPT for AMD64 and X86 with PAE */
 189 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
 190 static bool npt_enabled = true;
 191 #else
 192 static bool npt_enabled;
 193 #endif
 194
 195 /* allow nested paging (virtualized MMU) for all guests */
 196 static int npt = true;
 197 module_param(npt, int, S_IRUGO);
 198
 199 /* allow nested virtualization in KVM/SVM */
 200 static int nested = true;
 201 module_param(nested, int, S_IRUGO);
 202
 203 static void svm_flush_tlb(struct kvm_vcpu *vcpu);
 204 static void svm_complete_interrupts(struct vcpu_svm *svm);
 205
 206 static int nested_svm_exit_handled(struct vcpu_svm *svm);
 207 static int nested_svm_intercept(struct vcpu_svm *svm);
 208 static int nested_svm_vmexit(struct vcpu_svm *svm);
 209 static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
 210                                       bool has_error_code, u32 error_code);
 211 static u64 __scale_tsc(u64 ratio, u64 tsc);
 212
 213 enum {
 214         VMCB_INTERCEPTS, /* Intercept vectors, TSC offset,
 215                             pause filter count */
 216         VMCB_PERM_MAP,   /* IOPM Base and MSRPM Base */
 217         VMCB_ASID,       /* ASID */
 218         VMCB_INTR,       /* int_ctl, int_vector */
 219         VMCB_NPT,        /* npt_en, nCR3, gPAT */
 220         VMCB_CR,         /* CR0, CR3, CR4, EFER */
 221         VMCB_DR,         /* DR6, DR7 */
 222         VMCB_DT,         /* GDT, IDT */
 223         VMCB_SEG,        /* CS, DS, SS, ES, CPL */
 224         VMCB_CR2,        /* CR2 only */
 225         VMCB_LBR,        /* DBGCTL, BR_FROM, BR_TO, LAST_EX_FROM, LAST_EX_TO */
 226         VMCB_DIRTY_MAX,
 227 };
 228
 229 /* TPR and CR2 are always written before VMRUN */
 230 #define VMCB_ALWAYS_DIRTY_MASK  ((1U << VMCB_INTR) | (1U << VMCB_CR2))
 231
 232 static inline void mark_all_dirty(struct vmcb *vmcb)
 233 {
 234         vmcb->control.clean = 0;
 235 }
 236
 237 static inline void mark_all_clean(struct vmcb *vmcb)
 238 {
 239         vmcb->control.clean = ((1 << VMCB_DIRTY_MAX) - 1)
 240                                & ~VMCB_ALWAYS_DIRTY_MASK;
 241 }
 242
 243 static inline void mark_dirty(struct vmcb *vmcb, int bit)
 244 {
 245         vmcb->control.clean &= ~(1 << bit);
 246 }
 247
 248 static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
 249 {
 250         return container_of(vcpu, struct vcpu_svm, vcpu);
 251 }
 252
 253 static void recalc_intercepts(struct vcpu_svm *svm)
 254 {
 255         struct vmcb_control_area *c, *h;
 256         struct nested_state *g;
 257
 258         mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
 259
 260         if (!is_guest_mode(&svm->vcpu))
 261                 return;
 262
 263         c = &svm->vmcb->control;
 264         h = &svm->nested.hsave->control;
 265         g = &svm->nested;
 266
 267         c->intercept_cr = h->intercept_cr | g->intercept_cr;
 268         c->intercept_dr = h->intercept_dr | g->intercept_dr;
 269         c->intercept_exceptions = h->intercept_exceptions | g->intercept_exceptions;
 270         c->intercept = h->intercept | g->intercept;
 271 }
 272
 273 static inline struct vmcb *get_host_vmcb(struct vcpu_svm *svm)
 274 {
 275         if (is_guest_mode(&svm->vcpu))
 276                 return svm->nested.hsave;
 277         else
 278                 return svm->vmcb;
 279 }
 280
 281 static inline void set_cr_intercept(struct vcpu_svm *svm, int bit)
 282 {
 283         struct vmcb *vmcb = get_host_vmcb(svm);
 284
 285         vmcb->control.intercept_cr |= (1U << bit);
 286
 287         recalc_intercepts(svm);
 288 }
 289
 290 static inline void clr_cr_intercept(struct vcpu_svm *svm, int bit)
 291 {
 292         struct vmcb *vmcb = get_host_vmcb(svm);
 293
 294         vmcb->control.intercept_cr &= ~(1U << bit);
 295
 296         recalc_intercepts(svm);
 297 }
 298
 299 static inline bool is_cr_intercept(struct vcpu_svm *svm, int bit)
 300 {
 301         struct vmcb *vmcb = get_host_vmcb(svm);
 302
 303         return vmcb->control.intercept_cr & (1U << bit);
 304 }
 305
 306 static inline void set_dr_intercepts(struct vcpu_svm *svm)
 307 {
 308         struct vmcb *vmcb = get_host_vmcb(svm);
 309
 310         vmcb->control.intercept_dr = (1 << INTERCEPT_DR0_READ)
 311                 | (1 << INTERCEPT_DR1_READ)
 312                 | (1 << INTERCEPT_DR2_READ)
 313                 | (1 << INTERCEPT_DR3_READ)
 314                 | (1 << INTERCEPT_DR4_READ)
 315                 | (1 << INTERCEPT_DR5_READ)
 316                 | (1 << INTERCEPT_DR6_READ)
 317                 | (1 << INTERCEPT_DR7_READ)
 318                 | (1 << INTERCEPT_DR0_WRITE)
 319                 | (1 << INTERCEPT_DR1_WRITE)
 320                 | (1 << INTERCEPT_DR2_WRITE)
 321                 | (1 << INTERCEPT_DR3_WRITE)
 322                 | (1 << INTERCEPT_DR4_WRITE)
 323                 | (1 << INTERCEPT_DR5_WRITE)
 324                 | (1 << INTERCEPT_DR6_WRITE)
 325                 | (1 << INTERCEPT_DR7_WRITE);
 326
 327         recalc_intercepts(svm);
 328 }
 329
 330 static inline void clr_dr_intercepts(struct vcpu_svm *svm)
 331 {
 332         struct vmcb *vmcb = get_host_vmcb(svm);
 333
 334         vmcb->control.intercept_dr = 0;
 335
 336         recalc_intercepts(svm);
 337 }
 338
 339 static inline void set_exception_intercept(struct vcpu_svm *svm, int bit)
 340 {
 341         struct vmcb *vmcb = get_host_vmcb(svm);
 342
 343         vmcb->control.intercept_exceptions |= (1U << bit);
 344
 345         recalc_intercepts(svm);
 346 }
 347
 348 static inline void clr_exception_intercept(struct vcpu_svm *svm, int bit)
 349 {
 350         struct vmcb *vmcb = get_host_vmcb(svm);
 351
 352         vmcb->control.intercept_exceptions &= ~(1U << bit);
 353
 354         recalc_intercepts(svm);
 355 }
 356
 357 static inline void set_intercept(struct vcpu_svm *svm, int bit)
 358 {
 359         struct vmcb *vmcb = get_host_vmcb(svm);
 360
 361         vmcb->control.intercept |= (1ULL << bit);
 362
 363         recalc_intercepts(svm);
 364 }
 365
 366 static inline void clr_intercept(struct vcpu_svm *svm, int bit)
 367 {
 368         struct vmcb *vmcb = get_host_vmcb(svm);
 369
 370         vmcb->control.intercept &= ~(1ULL << bit);
 371
 372         recalc_intercepts(svm);
 373 }
 374
 375 static inline void enable_gif(struct vcpu_svm *svm)
 376 {
 377         svm->vcpu.arch.hflags |= HF_GIF_MASK;
 378 }
 379
 380 static inline void disable_gif(struct vcpu_svm *svm)
 381 {
 382         svm->vcpu.arch.hflags &= ~HF_GIF_MASK;
 383 }
 384
 385 static inline bool gif_set(struct vcpu_svm *svm)
 386 {
 387         return !!(svm->vcpu.arch.hflags & HF_GIF_MASK);
 388 }
 389
 390 static unsigned long iopm_base;
 391
 392 struct kvm_ldttss_desc {
 393         u16 limit0;
 394         u16 base0;
 395         unsigned base1:8, type:5, dpl:2, p:1;
 396         unsigned limit1:4, zero0:3, g:1, base2:8;
 397         u32 base3;
 398         u32 zero1;
 399 } __attribute__((packed));
 400
 401 struct svm_cpu_data {
 402         int cpu;
 403
 404         u64 asid_generation;
 405         u32 max_asid;
 406         u32 next_asid;
 407         struct kvm_ldttss_desc *tss_desc;
 408
 409         struct page *save_area;
 410 };
 411
 412 static DEFINE_PER_CPU(struct svm_cpu_data *, svm_data);
 413
 414 struct svm_init_data {
 415         int cpu;
 416         int r;
 417 };
 418
 419 static const u32 msrpm_ranges[] = {0, 0xc0000000, 0xc0010000};
 420
 421 #define NUM_MSR_MAPS ARRAY_SIZE(msrpm_ranges)
 422 #define MSRS_RANGE_SIZE 2048
 423 #define MSRS_IN_RANGE (MSRS_RANGE_SIZE * 8 / 2)
 424
 425 static u32 svm_msrpm_offset(u32 msr)
 426 {
 427         u32 offset;
 428         int i;
 429
 430         for (i = 0; i < NUM_MSR_MAPS; i++) {
 431                 if (msr < msrpm_ranges[i] ||
 432                     msr >= msrpm_ranges[i] + MSRS_IN_RANGE)
 433                         continue;
 434
 435                 offset  = (msr - msrpm_ranges[i]) / 4; /* 4 msrs per u8 */
 436                 offset += (i * MSRS_RANGE_SIZE);       /* add range offset */
 437
 438                 /* Now we have the u8 offset - but need the u32 offset */
 439                 return offset / 4;
 440         }
 441
 442         /* MSR not in any range */
 443         return MSR_INVALID;
 444 }
 445
 446 #define MAX_INST_SIZE 15
 447
 448 static inline void clgi(void)
 449 {
 450         asm volatile (__ex(SVM_CLGI));
 451 }
 452
 453 static inline void stgi(void)
 454 {
 455         asm volatile (__ex(SVM_STGI));
 456 }
 457
 458 static inline void invlpga(unsigned long addr, u32 asid)
 459 {
 460         asm volatile (__ex(SVM_INVLPGA) : : "a"(addr), "c"(asid));
 461 }
 462
 463 static int get_npt_level(void)
 464 {
 465 #ifdef CONFIG_X86_64
 466         return PT64_ROOT_LEVEL;
 467 #else
 468         return PT32E_ROOT_LEVEL;
 469 #endif
 470 }
 471
 472 static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
 473 {
 474         vcpu->arch.efer = efer;
 475         if (!npt_enabled && !(efer & EFER_LMA))
 476                 efer &= ~EFER_LME;
 477
 478         to_svm(vcpu)->vmcb->save.efer = efer | EFER_SVME;
 479         mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
 480 }
 481
 482 static int is_external_interrupt(u32 info)
 483 {
 484         info &= SVM_EVTINJ_TYPE_MASK | SVM_EVTINJ_VALID;
 485         return info == (SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR);
 486 }
 487
 488 static u32 svm_get_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
 489 {
 490         struct vcpu_svm *svm = to_svm(vcpu);
 491         u32 ret = 0;
 492
 493         if (svm->vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK)
 494                 ret |= KVM_X86_SHADOW_INT_STI | KVM_X86_SHADOW_INT_MOV_SS;
 495         return ret & mask;
 496 }
 497
 498 static void svm_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
 499 {
 500         struct vcpu_svm *svm = to_svm(vcpu);
 501
 502         if (mask == 0)
 503                 svm->vmcb->control.int_state &= ~SVM_INTERRUPT_SHADOW_MASK;
 504         else
 505                 svm->vmcb->control.int_state |= SVM_INTERRUPT_SHADOW_MASK;
 506
 507 }
 508
 509 static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
 510 {
 511         struct vcpu_svm *svm = to_svm(vcpu);
 512
 513         if (svm->vmcb->control.next_rip != 0)
 514                 svm->next_rip = svm->vmcb->control.next_rip;
 515
 516         if (!svm->next_rip) {
 517                 if (emulate_instruction(vcpu, EMULTYPE_SKIP) !=
 518                                 EMULATE_DONE)
 519                         printk(KERN_DEBUG "%s: NOP\n", __func__);
 520                 return;
 521         }
 522         if (svm->next_rip - kvm_rip_read(vcpu) > MAX_INST_SIZE)
 523                 printk(KERN_ERR "%s: ip 0x%lx next 0x%llx\n",
 524                        __func__, kvm_rip_read(vcpu), svm->next_rip);
 525
 526         kvm_rip_write(vcpu, svm->next_rip);
 527         svm_set_interrupt_shadow(vcpu, 0);
 528 }
 529
 530 static void svm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
 531                                 bool has_error_code, u32 error_code,
 532                                 bool reinject)
 533 {
 534         struct vcpu_svm *svm = to_svm(vcpu);
 535
 536         /*
 537          * If we are within a nested VM we'd better #VMEXIT and let the guest
 538          * handle the exception
 539          */
 540         if (!reinject &&
 541             nested_svm_check_exception(svm, nr, has_error_code, error_code))
 542                 return;
 543
 544         if (nr == BP_VECTOR && !static_cpu_has(X86_FEATURE_NRIPS)) {
 545                 unsigned long rip, old_rip = kvm_rip_read(&svm->vcpu);
 546
 547                 /*
 548                  * For guest debugging where we have to reinject #BP if some
 549                  * INT3 is guest-owned:
 550                  * Emulate nRIP by moving RIP forward. Will fail if injection
 551                  * raises a fault that is not intercepted. Still better than
 552                  * failing in all cases.
 553                  */
 554                 skip_emulated_instruction(&svm->vcpu);
 555                 rip = kvm_rip_read(&svm->vcpu);
 556                 svm->int3_rip = rip + svm->vmcb->save.cs.base;
 557                 svm->int3_injected = rip - old_rip;
 558         }
 559
 560         svm->vmcb->control.event_inj = nr
 561                 | SVM_EVTINJ_VALID
 562                 | (has_error_code ? SVM_EVTINJ_VALID_ERR : 0)
 563                 | SVM_EVTINJ_TYPE_EXEPT;
 564         svm->vmcb->control.event_inj_err = error_code;
 565 }
 566
 567 static void svm_init_erratum_383(void)
 568 {
 569         u32 low, high;
 570         int err;
 571         u64 val;
 572
 573         if (!static_cpu_has_bug(X86_BUG_AMD_TLB_MMATCH))
 574                 return;
 575
 576         /* Use _safe variants to not break nested virtualization */
 577         val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
 578         if (err)
 579                 return;
 580
 581         val |= (1ULL << 47);
 582
 583         low  = lower_32_bits(val);
 584         high = upper_32_bits(val);
 585
 586         native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);
 587
 588         erratum_383_found = true;
 589 }
 590
 591 static void svm_init_osvw(struct kvm_vcpu *vcpu)
 592 {
 593         /*
 594          * Guests should see errata 400 and 415 as fixed (assuming that
 595          * HLT and IO instructions are intercepted).
 596          */
 597         vcpu->arch.osvw.length = (osvw_len >= 3) ? (osvw_len) : 3;
 598         vcpu->arch.osvw.status = osvw_status & ~(6ULL);
 599
 600         /*
 601          * By increasing VCPU's osvw.length to 3 we are telling the guest that
 602          * all osvw.status bits inside that length, including bit 0 (which is
 603          * reserved for erratum 298), are valid. However, if host processor's
 604          * osvw_len is 0 then osvw_status[0] carries no information. We need to
 605          * be conservative here and therefore we tell the guest that erratum 298
 606          * is present (because we really don't know).
 607          */
 608         if (osvw_len == 0 && boot_cpu_data.x86 == 0x10)
 609                 vcpu->arch.osvw.status |= 1;
 610 }
 611
 612 static int has_svm(void)
 613 {
 614         const char *msg;
 615
 616         if (!cpu_has_svm(&msg)) {
 617                 printk(KERN_INFO "has_svm: %s\n", msg);
 618                 return 0;
 619         }
 620
 621         return 1;
 622 }
 623
 624 static void svm_hardware_disable(void *garbage)
 625 {
 626         /* Make sure we clean up behind us */
 627         if (static_cpu_has(X86_FEATURE_TSCRATEMSR))
 628                 wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
 629
 630         cpu_svm_disable();
 631
 632         amd_pmu_disable_virt();
 633 }
 634
 635 static int svm_hardware_enable(void *garbage)
 636 {
 637
 638         struct svm_cpu_data *sd;
 639         uint64_t efer;
 640         struct desc_ptr gdt_descr;
 641         struct desc_struct *gdt;
 642         int me = raw_smp_processor_id();
 643
 644         rdmsrl(MSR_EFER, efer);
 645         if (efer & EFER_SVME)
 646                 return -EBUSY;
 647
 648         if (!has_svm()) {
 649                 pr_err("%s: err EOPNOTSUPP on %d\n", __func__, me);
 650                 return -EINVAL;
 651         }
 652         sd = per_cpu(svm_data, me);
 653         if (!sd) {
 654                 pr_err("%s: svm_data is NULL on %d\n", __func__, me);
 655                 return -EINVAL;
 656         }
 657
 658         sd->asid_generation = 1;
 659         sd->max_asid = cpuid_ebx(SVM_CPUID_FUNC) - 1;
 660         sd->next_asid = sd->max_asid + 1;
 661
 662         native_store_gdt(&gdt_descr);
 663         gdt = (struct desc_struct *)gdt_descr.address;
 664         sd->tss_desc = (struct kvm_ldttss_desc *)(gdt + GDT_ENTRY_TSS);
 665
 666         wrmsrl(MSR_EFER, efer | EFER_SVME);
 667
 668         wrmsrl(MSR_VM_HSAVE_PA, page_to_pfn(sd->save_area) << PAGE_SHIFT);
 669
 670         if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) {
 671                 wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
 672                 __get_cpu_var(current_tsc_ratio) = TSC_RATIO_DEFAULT;
 673         }
 674
 675
 676         /*
 677          * Get OSVW bits.
 678          *
 679          * Note that it is possible to have a system with mixed processor
 680          * revisions and therefore different OSVW bits. If bits are not the same
 681          * on different processors then choose the worst case (i.e. if erratum
 682          * is present on one processor and not on another then assume that the
 683          * erratum is present everywhere).
 684          */
 685         if (cpu_has(&boot_cpu_data, X86_FEATURE_OSVW)) {
 686                 uint64_t len, status = 0;
 687                 int err;
 688
 689                 len = native_read_msr_safe(MSR_AMD64_OSVW_ID_LENGTH, &err);
 690                 if (!err)
 691                         status = native_read_msr_safe(MSR_AMD64_OSVW_STATUS,
 692                                                       &err);
 693
 694                 if (err)
 695                         osvw_status = osvw_len = 0;
 696                 else {
 697                         if (len < osvw_len)
 698                                 osvw_len = len;
 699                         osvw_status |= status;
 700                         osvw_status &= (1ULL << osvw_len) - 1;
 701                 }
 702         } else
 703                 osvw_status = osvw_len = 0;
 704
 705         svm_init_erratum_383();
 706
 707         amd_pmu_enable_virt();
 708
 709         return 0;
 710 }
 711
 712 static void svm_cpu_uninit(int cpu)
 713 {
 714         struct svm_cpu_data *sd = per_cpu(svm_data, raw_smp_processor_id());
 715
 716         if (!sd)
 717                 return;
 718
 719         per_cpu(svm_data, raw_smp_processor_id()) = NULL;
 720         __free_page(sd->save_area);
 721         kfree(sd);
 722 }
 723
 724 static int svm_cpu_init(int cpu)
 725 {
 726         struct svm_cpu_data *sd;
 727         int r;
 728
 729         sd = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL);
 730         if (!sd)
 731                 return -ENOMEM;
 732         sd->cpu = cpu;
 733         sd->save_area = alloc_page(GFP_KERNEL);
 734         r = -ENOMEM;
 735         if (!sd->save_area)
 736                 goto err_1;
 737
 738         per_cpu(svm_data, cpu) = sd;
 739
 740         return 0;
 741
 742 err_1:
 743         kfree(sd);
 744         return r;
 745
 746 }
 747
 748 static bool valid_msr_intercept(u32 index)
 749 {
 750         int i;
 751
 752         for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++)
 753                 if (direct_access_msrs[i].index == index)
 754                         return true;
 755
 756         return false;
 757 }
 758
 759 static void set_msr_interception(u32 *msrpm, unsigned msr,
 760                                  int read, int write)
 761 {
 762         u8 bit_read, bit_write;
 763         unsigned long tmp;
 764         u32 offset;
 765
 766         /*
 767          * If this warning triggers extend the direct_access_msrs list at the
 768          * beginning of the file
 769          */
 770         WARN_ON(!valid_msr_intercept(msr));
 771
 772         offset    = svm_msrpm_offset(msr);
 773         bit_read  = 2 * (msr & 0x0f);
 774         bit_write = 2 * (msr & 0x0f) + 1;
 775         tmp       = msrpm[offset];
 776
 777         BUG_ON(offset == MSR_INVALID);
 778
 779         read  ? clear_bit(bit_read,  &tmp) : set_bit(bit_read,  &tmp);
 780         write ? clear_bit(bit_write, &tmp) : set_bit(bit_write, &tmp);
 781
 782         msrpm[offset] = tmp;
 783 }
 784
 785 static void svm_vcpu_init_msrpm(u32 *msrpm)
 786 {
 787         int i;
 788
 789         memset(msrpm, 0xff, PAGE_SIZE * (1 << MSRPM_ALLOC_ORDER));
 790
 791         for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
 792                 if (!direct_access_msrs[i].always)
 793                         continue;
 794
 795                 set_msr_interception(msrpm, direct_access_msrs[i].index, 1, 1);
 796         }
 797 }
 798
 799 static void add_msr_offset(u32 offset)
 800 {
 801         int i;
 802
 803         for (i = 0; i < MSRPM_OFFSETS; ++i) {
 804
 805                 /* Offset already in list? */
 806                 if (msrpm_offsets[i] == offset)
 807                         return;
 808
 809                 /* Slot used by another offset? */
 810                 if (msrpm_offsets[i] != MSR_INVALID)
 811                         continue;
 812
 813                 /* Add offset to list */
 814                 msrpm_offsets[i] = offset;
 815
 816                 return;
 817         }
 818
 819         /*
 820          * If this BUG triggers the msrpm_offsets table has an overflow. Just
 821          * increase MSRPM_OFFSETS in this case.
 822          */
 823         BUG();
 824 }
 825
 826 static void init_msrpm_offsets(void)
 827 {
 828         int i;
 829
 830         memset(msrpm_offsets, 0xff, sizeof(msrpm_offsets));
 831
 832         for (i = 0; direct_access_msrs[i].index != MSR_INVALID; i++) {
 833                 u32 offset;
 834
 835                 offset = svm_msrpm_offset(direct_access_msrs[i].index);
 836                 BUG_ON(offset == MSR_INVALID);
 837
 838                 add_msr_offset(offset);
 839         }
 840 }
 841
 842 static void svm_enable_lbrv(struct vcpu_svm *svm)
 843 {
 844         u32 *msrpm = svm->msrpm;
 845
 846         svm->vmcb->control.lbr_ctl = 1;
 847         set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
 848         set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
 849         set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
 850         set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 1, 1);
 851 }
 852
 853 static void svm_disable_lbrv(struct vcpu_svm *svm)
 854 {
 855         u32 *msrpm = svm->msrpm;
 856
 857         svm->vmcb->control.lbr_ctl = 0;
 858         set_msr_interception(msrpm, MSR_IA32_LASTBRANCHFROMIP, 0, 0);
 859         set_msr_interception(msrpm, MSR_IA32_LASTBRANCHTOIP, 0, 0);
 860         set_msr_interception(msrpm, MSR_IA32_LASTINTFROMIP, 0, 0);
 861         set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
 862 }
 863
 864 static __init int svm_hardware_setup(void)
 865 {
 866         int cpu;
 867         struct page *iopm_pages;
 868         void *iopm_va;
 869         int r;
 870
 871         iopm_pages = alloc_pages(GFP_KERNEL, IOPM_ALLOC_ORDER);
 872
 873         if (!iopm_pages)
 874                 return -ENOMEM;
 875
 876         iopm_va = page_address(iopm_pages);
 877         memset(iopm_va, 0xff, PAGE_SIZE * (1 << IOPM_ALLOC_ORDER));
 878         iopm_base = page_to_pfn(iopm_pages) << PAGE_SHIFT;
 879
 880         init_msrpm_offsets();
 881
 882         if (boot_cpu_has(X86_FEATURE_NX))
 883                 kvm_enable_efer_bits(EFER_NX);
 884
 885         if (boot_cpu_has(X86_FEATURE_FXSR_OPT))
 886                 kvm_enable_efer_bits(EFER_FFXSR);
 887
 888         if (boot_cpu_has(X86_FEATURE_TSCRATEMSR)) {
 889                 u64 max;
 890
 891                 kvm_has_tsc_control = true;
 892
 893                 /*
 894                  * Make sure the user can only configure tsc_khz values that
 895                  * fit into a signed integer.
 896                  * A min value is not calculated needed because it will always
 897                  * be 1 on all machines and a value of 0 is used to disable
 898                  * tsc-scaling for the vcpu.
 899                  */
 900                 max = min(0x7fffffffULL, __scale_tsc(tsc_khz, TSC_RATIO_MAX));
 901
 902                 kvm_max_guest_tsc_khz = max;
 903         }
 904
 905         if (nested) {
 906                 printk(KERN_INFO "kvm: Nested Virtualization enabled\n");
 907                 kvm_enable_efer_bits(EFER_SVME | EFER_LMSLE);
 908         }
 909
 910         for_each_possible_cpu(cpu) {
 911                 r = svm_cpu_init(cpu);
 912                 if (r)
 913                         goto err;
 914         }
 915
 916         if (!boot_cpu_has(X86_FEATURE_NPT))
 917                 npt_enabled = false;
 918
 919         if (npt_enabled && !npt) {
 920                 printk(KERN_INFO "kvm: Nested Paging disabled\n");
 921                 npt_enabled = false;
 922         }
 923
 924         if (npt_enabled) {
 925                 printk(KERN_INFO "kvm: Nested Paging enabled\n");
 926                 kvm_enable_tdp();
 927         } else
 928                 kvm_disable_tdp();
 929
 930         return 0;
 931
 932 err:
 933         __free_pages(iopm_pages, IOPM_ALLOC_ORDER);
 934         iopm_base = 0;
 935         return r;
 936 }
 937
 938 static __exit void svm_hardware_unsetup(void)
 939 {
 940         int cpu;
 941
 942         for_each_possible_cpu(cpu)
 943                 svm_cpu_uninit(cpu);
 944
 945         __free_pages(pfn_to_page(iopm_base >> PAGE_SHIFT), IOPM_ALLOC_ORDER);
 946         iopm_base = 0;
 947 }
 948
 949 static void init_seg(struct vmcb_seg *seg)
 950 {
 951         seg->selector = 0;
 952         seg->attrib = SVM_SELECTOR_P_MASK | SVM_SELECTOR_S_MASK |
 953                       SVM_SELECTOR_WRITE_MASK; /* Read/Write Data Segment */
 954         seg->limit = 0xffff;
 955         seg->base = 0;
 956 }
 957
 958 static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
 959 {
 960         seg->selector = 0;
 961         seg->attrib = SVM_SELECTOR_P_MASK | type;
 962         seg->limit = 0xffff;
 963         seg->base = 0;
 964 }
 965
 966 static u64 __scale_tsc(u64 ratio, u64 tsc)
 967 {
 968         u64 mult, frac, _tsc;
 969
 970         mult  = ratio >> 32;
 971         frac  = ratio & ((1ULL << 32) - 1);
 972
 973         _tsc  = tsc;
 974         _tsc *= mult;
 975         _tsc += (tsc >> 32) * frac;
 976         _tsc += ((tsc & ((1ULL << 32) - 1)) * frac) >> 32;
 977
 978         return _tsc;
 979 }
 980
 981 static u64 svm_scale_tsc(struct kvm_vcpu *vcpu, u64 tsc)
 982 {
 983         struct vcpu_svm *svm = to_svm(vcpu);
 984         u64 _tsc = tsc;
 985
 986         if (svm->tsc_ratio != TSC_RATIO_DEFAULT)
 987                 _tsc = __scale_tsc(svm->tsc_ratio, tsc);
 988
 989         return _tsc;
 990 }
 991
 992 static void svm_set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
 993 {
 994         struct vcpu_svm *svm = to_svm(vcpu);
 995         u64 ratio;
 996         u64 khz;
 997
 998         /* Guest TSC same frequency as host TSC? */
 999         if (!scale) {
1000                 svm->tsc_ratio = TSC_RATIO_DEFAULT;
1001                 return;
1002         }
1003
1004         /* TSC scaling supported? */
1005         if (!boot_cpu_has(X86_FEATURE_TSCRATEMSR)) {
1006                 if (user_tsc_khz > tsc_khz) {
1007                         vcpu->arch.tsc_catchup = 1;
1008                         vcpu->arch.tsc_always_catchup = 1;
1009                 } else
1010                         WARN(1, "user requested TSC rate below hardware speed\n");
1011                 return;
1012         }
1013
1014         khz = user_tsc_khz;
1015
1016         /* TSC scaling required  - calculate ratio */
1017         ratio = khz << 32;
1018         do_div(ratio, tsc_khz);
1019
1020         if (ratio == 0 || ratio & TSC_RATIO_RSVD) {
1021                 WARN_ONCE(1, "Invalid TSC ratio - virtual-tsc-khz=%u\n",
1022                                 user_tsc_khz);
1023                 return;
1024         }
1025         svm->tsc_ratio             = ratio;
1026 }
1027
1028 static u64 svm_read_tsc_offset(struct kvm_vcpu *vcpu)
1029 {
1030         struct vcpu_svm *svm = to_svm(vcpu);
1031
1032         return svm->vmcb->control.tsc_offset;
1033 }
1034
1035 static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
1036 {
1037         struct vcpu_svm *svm = to_svm(vcpu);
1038         u64 g_tsc_offset = 0;
1039
1040         if (is_guest_mode(vcpu)) {
1041                 g_tsc_offset = svm->vmcb->control.tsc_offset -
1042                                svm->nested.hsave->control.tsc_offset;
1043                 svm->nested.hsave->control.tsc_offset = offset;
1044         } else
1045                 trace_kvm_write_tsc_offset(vcpu->vcpu_id,
1046                                            svm->vmcb->control.tsc_offset,
1047                                            offset);
1048
1049         svm->vmcb->control.tsc_offset = offset + g_tsc_offset;
1050
1051         mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
1052 }
1053
1054 static void svm_adjust_tsc_offset(struct kvm_vcpu *vcpu, s64 adjustment, bool host)
1055 {
1056         struct vcpu_svm *svm = to_svm(vcpu);
1057
1058         WARN_ON(adjustment < 0);
1059         if (host)
1060                 adjustment = svm_scale_tsc(vcpu, adjustment);
1061
1062         svm->vmcb->control.tsc_offset += adjustment;
1063         if (is_guest_mode(vcpu))
1064                 svm->nested.hsave->control.tsc_offset += adjustment;
1065         else
1066                 trace_kvm_write_tsc_offset(vcpu->vcpu_id,
1067                                      svm->vmcb->control.tsc_offset - adjustment,
1068                                      svm->vmcb->control.tsc_offset);
1069
1070         mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
1071 }
1072
1073 static u64 svm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc)
1074 {
1075         u64 tsc;
1076
1077         tsc = svm_scale_tsc(vcpu, native_read_tsc());
1078
1079         return target_tsc - tsc;
1080 }
1081
1082 static void init_vmcb(struct vcpu_svm *svm)
1083 {
1084         struct vmcb_control_area *control = &svm->vmcb->control;
1085         struct vmcb_save_area *save = &svm->vmcb->save;
1086
1087         svm->vcpu.fpu_active = 1;
1088         svm->vcpu.arch.hflags = 0;
1089
1090         set_cr_intercept(svm, INTERCEPT_CR0_READ);
1091         set_cr_intercept(svm, INTERCEPT_CR3_READ);
1092         set_cr_intercept(svm, INTERCEPT_CR4_READ);
1093         set_cr_intercept(svm, INTERCEPT_CR0_WRITE);
1094         set_cr_intercept(svm, INTERCEPT_CR3_WRITE);
1095         set_cr_intercept(svm, INTERCEPT_CR4_WRITE);
1096         set_cr_intercept(svm, INTERCEPT_CR8_WRITE);
1097
1098         set_dr_intercepts(svm);
1099
1100         set_exception_intercept(svm, PF_VECTOR);
1101         set_exception_intercept(svm, UD_VECTOR);
1102         set_exception_intercept(svm, MC_VECTOR);
1103
1104         set_intercept(svm, INTERCEPT_INTR);
1105         set_intercept(svm, INTERCEPT_NMI);
1106         set_intercept(svm, INTERCEPT_SMI);
1107         set_intercept(svm, INTERCEPT_SELECTIVE_CR0);
1108         set_intercept(svm, INTERCEPT_RDPMC);
1109         set_intercept(svm, INTERCEPT_CPUID);
1110         set_intercept(svm, INTERCEPT_INVD);
1111         set_intercept(svm, INTERCEPT_HLT);
1112         set_intercept(svm, INTERCEPT_INVLPG);
1113         set_intercept(svm, INTERCEPT_INVLPGA);
1114         set_intercept(svm, INTERCEPT_IOIO_PROT);
1115         set_intercept(svm, INTERCEPT_MSR_PROT);
1116         set_intercept(svm, INTERCEPT_TASK_SWITCH);
1117         set_intercept(svm, INTERCEPT_SHUTDOWN);
1118         set_intercept(svm, INTERCEPT_VMRUN);
1119         set_intercept(svm, INTERCEPT_VMMCALL);
1120         set_intercept(svm, INTERCEPT_VMLOAD);
1121         set_intercept(svm, INTERCEPT_VMSAVE);
1122         set_intercept(svm, INTERCEPT_STGI);
1123         set_intercept(svm, INTERCEPT_CLGI);
1124         set_intercept(svm, INTERCEPT_SKINIT);
1125         set_intercept(svm, INTERCEPT_WBINVD);
1126         set_intercept(svm, INTERCEPT_MONITOR);
1127         set_intercept(svm, INTERCEPT_MWAIT);
1128         set_intercept(svm, INTERCEPT_XSETBV);
1129
1130         control->iopm_base_pa = iopm_base;
1131         control->msrpm_base_pa = __pa(svm->msrpm);
1132         control->int_ctl = V_INTR_MASKING_MASK;
1133
1134         init_seg(&save->es);
1135         init_seg(&save->ss);
1136         init_seg(&save->ds);
1137         init_seg(&save->fs);
1138         init_seg(&save->gs);
1139
1140         save->cs.selector = 0xf000;
1141         save->cs.base = 0xffff0000;
1142         /* Executable/Readable Code Segment */
1143         save->cs.attrib = SVM_SELECTOR_READ_MASK | SVM_SELECTOR_P_MASK |
1144                 SVM_SELECTOR_S_MASK | SVM_SELECTOR_CODE_MASK;
1145         save->cs.limit = 0xffff;
1146
1147         save->gdtr.limit = 0xffff;
1148         save->idtr.limit = 0xffff;
1149
1150         init_sys_seg(&save->ldtr, SEG_TYPE_LDT);
1151         init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16);
1152
1153         svm_set_efer(&svm->vcpu, 0);
1154         save->dr6 = 0xffff0ff0;
1155         kvm_set_rflags(&svm->vcpu, 2);
1156         save->rip = 0x0000fff0;
1157         svm->vcpu.arch.regs[VCPU_REGS_RIP] = save->rip;
1158
1159         /*
1160          * This is the guest-visible cr0 value.
1161          * svm_set_cr0() sets PG and WP and clears NW and CD on save->cr0.
1162          */
1163         svm->vcpu.arch.cr0 = 0;
1164         (void)kvm_set_cr0(&svm->vcpu, X86_CR0_NW | X86_CR0_CD | X86_CR0_ET);
1165
1166         save->cr4 = X86_CR4_PAE;
1167         /* rdx = ?? */
1168
1169         if (npt_enabled) {
1170                 /* Setup VMCB for Nested Paging */
1171                 control->nested_ctl = 1;
1172                 clr_intercept(svm, INTERCEPT_INVLPG);
1173                 clr_exception_intercept(svm, PF_VECTOR);
1174                 clr_cr_intercept(svm, INTERCEPT_CR3_READ);
1175                 clr_cr_intercept(svm, INTERCEPT_CR3_WRITE);
1176                 save->g_pat = 0x0007040600070406ULL;
1177                 save->cr3 = 0;
1178                 save->cr4 = 0;
1179         }
1180         svm->asid_generation = 0;
1181
1182         svm->nested.vmcb = 0;
1183         svm->vcpu.arch.hflags = 0;
1184
1185         if (boot_cpu_has(X86_FEATURE_PAUSEFILTER)) {
1186                 control->pause_filter_count = 3000;
1187                 set_intercept(svm, INTERCEPT_PAUSE);
1188         }
1189
1190         mark_all_dirty(svm->vmcb);
1191
1192         enable_gif(svm);
1193 }
1194
1195 static void svm_vcpu_reset(struct kvm_vcpu *vcpu)
1196 {
1197         struct vcpu_svm *svm = to_svm(vcpu);
1198         u32 dummy;
1199         u32 eax = 1;
1200
1201         init_vmcb(svm);
1202
1203         kvm_cpuid(vcpu, &eax, &dummy, &dummy, &dummy);
1204         kvm_register_write(vcpu, VCPU_REGS_RDX, eax);
1205 }
1206
1207 static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
1208 {
1209         struct vcpu_svm *svm;
1210         struct page *page;
1211         struct page *msrpm_pages;
1212         struct page *hsave_page;
1213         struct page *nested_msrpm_pages;
1214         int err;
1215
1216         svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
1217         if (!svm) {
1218                 err = -ENOMEM;
1219                 goto out;
1220         }
1221
1222         svm->tsc_ratio = TSC_RATIO_DEFAULT;
1223
1224         err = kvm_vcpu_init(&svm->vcpu, kvm, id);
1225         if (err)
1226                 goto free_svm;
1227
1228         err = -ENOMEM;
1229         page = alloc_page(GFP_KERNEL);
1230         if (!page)
1231                 goto uninit;
1232
1233         msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
1234         if (!msrpm_pages)
1235                 goto free_page1;
1236
1237         nested_msrpm_pages = alloc_pages(GFP_KERNEL, MSRPM_ALLOC_ORDER);
1238         if (!nested_msrpm_pages)
1239                 goto free_page2;
1240
1241         hsave_page = alloc_page(GFP_KERNEL);
1242         if (!hsave_page)
1243                 goto free_page3;
1244
1245         svm->nested.hsave = page_address(hsave_page);
1246
1247         svm->msrpm = page_address(msrpm_pages);
1248         svm_vcpu_init_msrpm(svm->msrpm);
1249
1250         svm->nested.msrpm = page_address(nested_msrpm_pages);
1251         svm_vcpu_init_msrpm(svm->nested.msrpm);
1252
1253         svm->vmcb = page_address(page);
1254         clear_page(svm->vmcb);
1255         svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
1256         svm->asid_generation = 0;
1257         init_vmcb(svm);
1258
1259         svm->vcpu.arch.apic_base = 0xfee00000 | MSR_IA32_APICBASE_ENABLE;
1260         if (kvm_vcpu_is_bsp(&svm->vcpu))
1261                 svm->vcpu.arch.apic_base |= MSR_IA32_APICBASE_BSP;
1262
1263         svm_init_osvw(&svm->vcpu);
1264
1265         return &svm->vcpu;
1266
1267 free_page3:
1268         __free_pages(nested_msrpm_pages, MSRPM_ALLOC_ORDER);
1269 free_page2:
1270         __free_pages(msrpm_pages, MSRPM_ALLOC_ORDER);
1271 free_page1:
1272         __free_page(page);
1273 uninit:
1274         kvm_vcpu_uninit(&svm->vcpu);
1275 free_svm:
1276         kmem_cache_free(kvm_vcpu_cache, svm);
1277 out:
1278         return ERR_PTR(err);
1279 }
1280
1281 static void svm_free_vcpu(struct kvm_vcpu *vcpu)
1282 {
1283         struct vcpu_svm *svm = to_svm(vcpu);
1284
1285         __free_page(pfn_to_page(svm->vmcb_pa >> PAGE_SHIFT));
1286         __free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
1287         __free_page(virt_to_page(svm->nested.hsave));
1288         __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
1289         kvm_vcpu_uninit(vcpu);
1290         kmem_cache_free(kvm_vcpu_cache, svm);
1291 }
1292
1293 static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
1294 {
1295         struct vcpu_svm *svm = to_svm(vcpu);
1296         int i;
1297
1298         if (unlikely(cpu != vcpu->cpu)) {
1299                 svm->asid_generation = 0;
1300                 mark_all_dirty(svm->vmcb);
1301         }
1302
1303 #ifdef CONFIG_X86_64
1304         rdmsrl(MSR_GS_BASE, to_svm(vcpu)->host.gs_base);
1305 #endif
1306         savesegment(fs, svm->host.fs);
1307         savesegment(gs, svm->host.gs);
1308         svm->host.ldt = kvm_read_ldt();
1309
1310         for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
1311                 rdmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
1312
1313         if (static_cpu_has(X86_FEATURE_TSCRATEMSR) &&
1314             svm->tsc_ratio != __get_cpu_var(current_tsc_ratio)) {
1315                 __get_cpu_var(current_tsc_ratio) = svm->tsc_ratio;
1316                 wrmsrl(MSR_AMD64_TSC_RATIO, svm->tsc_ratio);
1317         }
1318 }
1319
1320 static void svm_vcpu_put(struct kvm_vcpu *vcpu)
1321 {
1322         struct vcpu_svm *svm = to_svm(vcpu);
1323         int i;
1324
1325         ++vcpu->stat.host_state_reload;
1326         kvm_load_ldt(svm->host.ldt);
1327 #ifdef CONFIG_X86_64
1328         loadsegment(fs, svm->host.fs);
1329         wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gs);
1330         load_gs_index(svm->host.gs);
1331 #else
1332 #ifdef CONFIG_X86_32_LAZY_GS
1333         loadsegment(gs, svm->host.gs);
1334 #endif
1335 #endif
1336         for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
1337                 wrmsrl(host_save_user_msrs[i], svm->host_user_msrs[i]);
1338 }
1339
1340 static void svm_update_cpl(struct kvm_vcpu *vcpu)
1341 {
1342         struct vcpu_svm *svm = to_svm(vcpu);
1343         int cpl;
1344
1345         if (!is_protmode(vcpu))
1346                 cpl = 0;
1347         else if (svm->vmcb->save.rflags & X86_EFLAGS_VM)
1348                 cpl = 3;
1349         else
1350                 cpl = svm->vmcb->save.cs.selector & 0x3;
1351
1352         svm->vmcb->save.cpl = cpl;
1353 }
1354
1355 static unsigned long svm_get_rflags(struct kvm_vcpu *vcpu)
1356 {
1357         return to_svm(vcpu)->vmcb->save.rflags;
1358 }
1359
1360 static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
1361 {
1362         unsigned long old_rflags = to_svm(vcpu)->vmcb->save.rflags;
1363
1364         to_svm(vcpu)->vmcb->save.rflags = rflags;
1365         if ((old_rflags ^ rflags) & X86_EFLAGS_VM)
1366                 svm_update_cpl(vcpu);
1367 }
1368
1369 static void svm_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
1370 {
1371         switch (reg) {
1372         case VCPU_EXREG_PDPTR:
1373                 BUG_ON(!npt_enabled);
1374                 load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu));
1375                 break;
1376         default:
1377                 BUG();
1378         }
1379 }
1380
1381 static void svm_set_vintr(struct vcpu_svm *svm)
1382 {
1383         set_intercept(svm, INTERCEPT_VINTR);
1384 }
1385
1386 static void svm_clear_vintr(struct vcpu_svm *svm)
1387 {
1388         clr_intercept(svm, INTERCEPT_VINTR);
1389 }
1390
1391 static struct vmcb_seg *svm_seg(struct kvm_vcpu *vcpu, int seg)
1392 {
1393         struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
1394
1395         switch (seg) {
1396         case VCPU_SREG_CS: return &save->cs;
1397         case VCPU_SREG_DS: return &save->ds;
1398         case VCPU_SREG_ES: return &save->es;
1399         case VCPU_SREG_FS: return &save->fs;
1400         case VCPU_SREG_GS: return &save->gs;
1401         case VCPU_SREG_SS: return &save->ss;
1402         case VCPU_SREG_TR: return &save->tr;
1403         case VCPU_SREG_LDTR: return &save->ldtr;
1404         }
1405         BUG();
1406         return NULL;
1407 }
1408
1409 static u64 svm_get_segment_base(struct kvm_vcpu *vcpu, int seg)
1410 {
1411         struct vmcb_seg *s = svm_seg(vcpu, seg);
1412
1413         return s->base;
1414 }
1415
1416 static void svm_get_segment(struct kvm_vcpu *vcpu,
1417                             struct kvm_segment *var, int seg)
1418 {
1419         struct vmcb_seg *s = svm_seg(vcpu, seg);
1420
1421         var->base = s->base;
1422         var->limit = s->limit;
1423         var->selector = s->selector;
1424         var->type = s->attrib & SVM_SELECTOR_TYPE_MASK;
1425         var->s = (s->attrib >> SVM_SELECTOR_S_SHIFT) & 1;
1426         var->dpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
1427         var->present = (s->attrib >> SVM_SELECTOR_P_SHIFT) & 1;
1428         var->avl = (s->attrib >> SVM_SELECTOR_AVL_SHIFT) & 1;
1429         var->l = (s->attrib >> SVM_SELECTOR_L_SHIFT) & 1;
1430         var->db = (s->attrib >> SVM_SELECTOR_DB_SHIFT) & 1;
1431         var->g = (s->attrib >> SVM_SELECTOR_G_SHIFT) & 1;
1432
1433         /*
1434          * AMD's VMCB does not have an explicit unusable field, so emulate it
1435          * for cross vendor migration purposes by "not present"
1436          */
1437         var->unusable = !var->present || (var->type == 0);
1438
1439         switch (seg) {
1440         case VCPU_SREG_CS:
1441                 /*
1442                  * SVM always stores 0 for the 'G' bit in the CS selector in
1443                  * the VMCB on a VMEXIT. This hurts cross-vendor migration:
1444                  * Intel's VMENTRY has a check on the 'G' bit.
1445                  */
1446                 var->g = s->limit > 0xfffff;
1447                 break;
1448         case VCPU_SREG_TR:
1449                 /*
1450                  * Work around a bug where the busy flag in the tr selector
1451                  * isn't exposed
1452                  */
1453                 var->type |= 0x2;
1454                 break;
1455         case VCPU_SREG_DS:
1456         case VCPU_SREG_ES:
1457         case VCPU_SREG_FS:
1458         case VCPU_SREG_GS:
1459                 /*
1460                  * The accessed bit must always be set in the segment
1461                  * descriptor cache, although it can be cleared in the
1462                  * descriptor, the cached bit always remains at 1. Since
1463                  * Intel has a check on this, set it here to support
1464                  * cross-vendor migration.
1465                  */
1466                 if (!var->unusable)
1467                         var->type |= 0x1;
1468                 break;
1469         case VCPU_SREG_SS:
1470                 /*
1471                  * On AMD CPUs sometimes the DB bit in the segment
1472                  * descriptor is left as 1, although the whole segment has
1473                  * been made unusable. Clear it here to pass an Intel VMX
1474                  * entry check when cross vendor migrating.
1475                  */
1476                 if (var->unusable)
1477                         var->db = 0;
1478                 break;
1479         }
1480 }
1481
1482 static int svm_get_cpl(struct kvm_vcpu *vcpu)
1483 {
1484         struct vmcb_save_area *save = &to_svm(vcpu)->vmcb->save;
1485
1486         return save->cpl;
1487 }
1488
1489 static void svm_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
1490 {
1491         struct vcpu_svm *svm = to_svm(vcpu);
1492
1493         dt->size = svm->vmcb->save.idtr.limit;
1494         dt->address = svm->vmcb->save.idtr.base;
1495 }
1496
1497 static void svm_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
1498 {
1499         struct vcpu_svm *svm = to_svm(vcpu);
1500
1501         svm->vmcb->save.idtr.limit = dt->size;
1502         svm->vmcb->save.idtr.base = dt->address ;
1503         mark_dirty(svm->vmcb, VMCB_DT);
1504 }
1505
1506 static void svm_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
1507 {
1508         struct vcpu_svm *svm = to_svm(vcpu);
1509
1510         dt->size = svm->vmcb->save.gdtr.limit;
1511         dt->address = svm->vmcb->save.gdtr.base;
1512 }
1513
1514 static void svm_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
1515 {
1516         struct vcpu_svm *svm = to_svm(vcpu);
1517
1518         svm->vmcb->save.gdtr.limit = dt->size;
1519         svm->vmcb->save.gdtr.base = dt->address ;
1520         mark_dirty(svm->vmcb, VMCB_DT);
1521 }
1522
1523 static void svm_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
1524 {
1525 }
1526
1527 static void svm_decache_cr3(struct kvm_vcpu *vcpu)
1528 {
1529 }
1530
1531 static void svm_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
1532 {
1533 }
1534
1535 static void update_cr0_intercept(struct vcpu_svm *svm)
1536 {
1537         ulong gcr0 = svm->vcpu.arch.cr0;
1538         u64 *hcr0 = &svm->vmcb->save.cr0;
1539
1540         if (!svm->vcpu.fpu_active)
1541                 *hcr0 |= SVM_CR0_SELECTIVE_MASK;
1542         else
1543                 *hcr0 = (*hcr0 & ~SVM_CR0_SELECTIVE_MASK)
1544                         | (gcr0 & SVM_CR0_SELECTIVE_MASK);
1545
1546         mark_dirty(svm->vmcb, VMCB_CR);
1547
1548         if (gcr0 == *hcr0 && svm->vcpu.fpu_active) {
1549                 clr_cr_intercept(svm, INTERCEPT_CR0_READ);
1550                 clr_cr_intercept(svm, INTERCEPT_CR0_WRITE);
1551         } else {
1552                 set_cr_intercept(svm, INTERCEPT_CR0_READ);
1553                 set_cr_intercept(svm, INTERCEPT_CR0_WRITE);
1554         }
1555 }
1556
1557 static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
1558 {
1559         struct vcpu_svm *svm = to_svm(vcpu);
1560
1561 #ifdef CONFIG_X86_64
1562         if (vcpu->arch.efer & EFER_LME) {
1563                 if (!is_paging(vcpu) && (cr0 & X86_CR0_PG)) {
1564                         vcpu->arch.efer |= EFER_LMA;
1565                         svm->vmcb->save.efer |= EFER_LMA | EFER_LME;
1566                 }
1567
1568                 if (is_paging(vcpu) && !(cr0 & X86_CR0_PG)) {
1569                         vcpu->arch.efer &= ~EFER_LMA;
1570                         svm->vmcb->save.efer &= ~(EFER_LMA | EFER_LME);
1571                 }
1572         }
1573 #endif
1574         vcpu->arch.cr0 = cr0;
1575
1576         if (!npt_enabled)
1577                 cr0 |= X86_CR0_PG | X86_CR0_WP;
1578
1579         if (!vcpu->fpu_active)
1580                 cr0 |= X86_CR0_TS;
1581         /*
1582          * re-enable caching here because the QEMU bios
1583          * does not do it - this results in some delay at
1584          * reboot
1585          */
1586         cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
1587         svm->vmcb->save.cr0 = cr0;
1588         mark_dirty(svm->vmcb, VMCB_CR);
1589         update_cr0_intercept(svm);
1590 }
1591
1592 static int svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
1593 {
1594         unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
1595         unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;
1596
1597         if (cr4 & X86_CR4_VMXE)
1598                 return 1;
1599
1600         if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
1601                 svm_flush_tlb(vcpu);
1602
1603         vcpu->arch.cr4 = cr4;
1604         if (!npt_enabled)
1605                 cr4 |= X86_CR4_PAE;
1606         cr4 |= host_cr4_mce;
1607         to_svm(vcpu)->vmcb->save.cr4 = cr4;
1608         mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
1609         return 0;
1610 }
1611
1612 static void svm_set_segment(struct kvm_vcpu *vcpu,
1613                             struct kvm_segment *var, int seg)
1614 {
1615         struct vcpu_svm *svm = to_svm(vcpu);
1616         struct vmcb_seg *s = svm_seg(vcpu, seg);
1617
1618         s->base = var->base;
1619         s->limit = var->limit;
1620         s->selector = var->selector;
1621         if (var->unusable)
1622                 s->attrib = 0;
1623         else {
1624                 s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
1625                 s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
1626                 s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
1627                 s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
1628                 s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
1629                 s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
1630                 s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
1631                 s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
1632         }
1633         if (seg == VCPU_SREG_CS)
1634                 svm_update_cpl(vcpu);
1635
1636         mark_dirty(svm->vmcb, VMCB_SEG);
1637 }
1638
1639 static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
1640 {
1641         struct vcpu_svm *svm = to_svm(vcpu);
1642
1643         clr_exception_intercept(svm, DB_VECTOR);
1644         clr_exception_intercept(svm, BP_VECTOR);
1645
1646         if (svm->nmi_singlestep)
1647                 set_exception_intercept(svm, DB_VECTOR);
1648
1649         if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
1650                 if (vcpu->guest_debug &
1651                     (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
1652                         set_exception_intercept(svm, DB_VECTOR);
1653                 if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
1654                         set_exception_intercept(svm, BP_VECTOR);
1655         } else
1656                 vcpu->guest_debug = 0;
1657 }
1658
1659 static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
1660 {
1661         if (sd->next_asid > sd->max_asid) {
1662                 ++sd->asid_generation;
1663                 sd->next_asid = 1;
1664                 svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ALL_ASID;
1665         }
1666
1667         svm->asid_generation = sd->asid_generation;
1668         svm->vmcb->control.asid = sd->next_asid++;
1669
1670         mark_dirty(svm->vmcb, VMCB_ASID);
1671 }
1672
1673 static u64 svm_get_dr6(struct kvm_vcpu *vcpu)
1674 {
1675         return to_svm(vcpu)->vmcb->save.dr6;
1676 }
1677
1678 static void svm_set_dr6(struct kvm_vcpu *vcpu, unsigned long value)
1679 {
1680         struct vcpu_svm *svm = to_svm(vcpu);
1681
1682         svm->vmcb->save.dr6 = value;
1683         mark_dirty(svm->vmcb, VMCB_DR);
1684 }
1685
1686 static void svm_set_dr7(struct kvm_vcpu *vcpu, unsigned long value)
1687 {
1688         struct vcpu_svm *svm = to_svm(vcpu);
1689
1690         svm->vmcb->save.dr7 = value;
1691         mark_dirty(svm->vmcb, VMCB_DR);
1692 }
1693
1694 static int pf_interception(struct vcpu_svm *svm)
1695 {
1696         u64 fault_address = svm->vmcb->control.exit_info_2;
1697         u32 error_code;
1698         int r = 1;
1699
1700         switch (svm->apf_reason) {
1701         default:
1702                 error_code = svm->vmcb->control.exit_info_1;
1703
1704                 trace_kvm_page_fault(fault_address, error_code);
1705                 if (!npt_enabled && kvm_event_needs_reinjection(&svm->vcpu))
1706                         kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
1707                 r = kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code,
1708                         svm->vmcb->control.insn_bytes,
1709                         svm->vmcb->control.insn_len);
1710                 break;
1711         case KVM_PV_REASON_PAGE_NOT_PRESENT:
1712                 svm->apf_reason = 0;
1713                 local_irq_disable();
1714                 kvm_async_pf_task_wait(fault_address);
1715                 local_irq_enable();
1716                 break;
1717         case KVM_PV_REASON_PAGE_READY:
1718                 svm->apf_reason = 0;
1719                 local_irq_disable();
1720                 kvm_async_pf_task_wake(fault_address);
1721                 local_irq_enable();
1722                 break;
1723         }
1724         return r;
1725 }
1726
1727 static int db_interception(struct vcpu_svm *svm)
1728 {
1729         struct kvm_run *kvm_run = svm->vcpu.run;
1730
1731         if (!(svm->vcpu.guest_debug &
1732               (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
1733                 !svm->nmi_singlestep) {
1734                 kvm_queue_exception(&svm->vcpu, DB_VECTOR);
1735                 return 1;
1736         }
1737
1738         if (svm->nmi_singlestep) {
1739                 svm->nmi_singlestep = false;
1740                 if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
1741                         svm->vmcb->save.rflags &=
1742                                 ~(X86_EFLAGS_TF | X86_EFLAGS_RF);
1743                 update_db_bp_intercept(&svm->vcpu);
1744         }
1745
1746         if (svm->vcpu.guest_debug &
1747             (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) {
1748                 kvm_run->exit_reason = KVM_EXIT_DEBUG;
1749                 kvm_run->debug.arch.pc =
1750                         svm->vmcb->save.cs.base + svm->vmcb->save.rip;
1751                 kvm_run->debug.arch.exception = DB_VECTOR;
1752                 return 0;
1753         }
1754
1755         return 1;
1756 }
1757
1758 static int bp_interception(struct vcpu_svm *svm)
1759 {
1760         struct kvm_run *kvm_run = svm->vcpu.run;
1761
1762         kvm_run->exit_reason = KVM_EXIT_DEBUG;
1763         kvm_run->debug.arch.pc = svm->vmcb->save.cs.base + svm->vmcb->save.rip;
1764         kvm_run->debug.arch.exception = BP_VECTOR;
1765         return 0;
1766 }
1767
1768 static int ud_interception(struct vcpu_svm *svm)
1769 {
1770         int er;
1771
1772         er = emulate_instruction(&svm->vcpu, EMULTYPE_TRAP_UD);
1773         if (er != EMULATE_DONE)
1774                 kvm_queue_exception(&svm->vcpu, UD_VECTOR);
1775         return 1;
1776 }
1777
1778 static void svm_fpu_activate(struct kvm_vcpu *vcpu)
1779 {
1780         struct vcpu_svm *svm = to_svm(vcpu);
1781
1782         clr_exception_intercept(svm, NM_VECTOR);
1783
1784         svm->vcpu.fpu_active = 1;
1785         update_cr0_intercept(svm);
1786 }
1787
1788 static int nm_interception(struct vcpu_svm *svm)
1789 {
1790         svm_fpu_activate(&svm->vcpu);
1791         return 1;
1792 }
1793
1794 static bool is_erratum_383(void)
1795 {
1796         int err, i;
1797         u64 value;
1798
1799         if (!erratum_383_found)
1800                 return false;
1801
1802         value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
1803         if (err)
1804                 return false;
1805
1806         /* Bit 62 may or may not be set for this mce */
1807         value &= ~(1ULL << 62);
1808
1809         if (value != 0xb600000000010015ULL)
1810                 return false;
1811
1812         /* Clear MCi_STATUS registers */
1813         for (i = 0; i < 6; ++i)
1814                 native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);
1815
1816         value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
1817         if (!err) {
1818                 u32 low, high;
1819
1820                 value &= ~(1ULL << 2);
1821                 low    = lower_32_bits(value);
1822                 high   = upper_32_bits(value);
1823
1824                 native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
1825         }
1826
1827         /* Flush tlb to evict multi-match entries */
1828         __flush_tlb_all();
1829
1830         return true;
1831 }
1832
1833 static void svm_handle_mce(struct vcpu_svm *svm)
1834 {
1835         if (is_erratum_383()) {
1836                 /*
1837                  * Erratum 383 triggered. Guest state is corrupt so kill the
1838                  * guest.
1839                  */
1840                 pr_err("KVM: Guest triggered AMD Erratum 383\n");
1841
1842                 kvm_make_request(KVM_REQ_TRIPLE_FAULT, &svm->vcpu);
1843
1844                 return;
1845         }
1846
1847         /*
1848          * On an #MC intercept the MCE handler is not called automatically in
1849          * the host. So do it by hand here.
1850          */
1851         asm volatile (
1852                 "int $0x12\n");
1853         /* not sure if we ever come back to this point */
1854
1855         return;
1856 }
1857
1858 static int mc_interception(struct vcpu_svm *svm)
1859 {
1860         return 1;
1861 }
1862
1863 static int shutdown_interception(struct vcpu_svm *svm)
1864 {
1865         struct kvm_run *kvm_run = svm->vcpu.run;
1866
1867         /*
1868          * VMCB is undefined after a SHUTDOWN intercept
1869          * so reinitialize it.
1870          */
1871         clear_page(svm->vmcb);
1872         init_vmcb(svm);
1873
1874         kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
1875         return 0;
1876 }
1877
1878 static int io_interception(struct vcpu_svm *svm)
1879 {
1880         struct kvm_vcpu *vcpu = &svm->vcpu;
1881         u32 io_info = svm->vmcb->control.exit_info_1; /* address size bug? */
1882         int size, in, string;
1883         unsigned port;
1884
1885         ++svm->vcpu.stat.io_exits;
1886         string = (io_info & SVM_IOIO_STR_MASK) != 0;
1887         in = (io_info & SVM_IOIO_TYPE_MASK) != 0;
1888         if (string || in)
1889                 return emulate_instruction(vcpu, 0) == EMULATE_DONE;
1890
1891         port = io_info >> 16;
1892         size = (io_info & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT;
1893         svm->next_rip = svm->vmcb->control.exit_info_2;
1894         skip_emulated_instruction(&svm->vcpu);
1895
1896         return kvm_fast_pio_out(vcpu, size, port);
1897 }
1898
1899 static int nmi_interception(struct vcpu_svm *svm)
1900 {
1901         return 1;
1902 }
1903
1904 static int intr_interception(struct vcpu_svm *svm)
1905 {
1906         ++svm->vcpu.stat.irq_exits;
1907         return 1;
1908 }
1909
1910 static int nop_on_interception(struct vcpu_svm *svm)
1911 {
1912         return 1;
1913 }
1914
1915 static int halt_interception(struct vcpu_svm *svm)
1916 {
1917         svm->next_rip = kvm_rip_read(&svm->vcpu) + 1;
1918         skip_emulated_instruction(&svm->vcpu);
1919         return kvm_emulate_halt(&svm->vcpu);
1920 }
1921
1922 static int vmmcall_interception(struct vcpu_svm *svm)
1923 {
1924         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
1925         skip_emulated_instruction(&svm->vcpu);
1926         kvm_emulate_hypercall(&svm->vcpu);
1927         return 1;
1928 }
1929
1930 static unsigned long nested_svm_get_tdp_cr3(struct kvm_vcpu *vcpu)
1931 {
1932         struct vcpu_svm *svm = to_svm(vcpu);
1933
1934         return svm->nested.nested_cr3;
1935 }
1936
1937 static u64 nested_svm_get_tdp_pdptr(struct kvm_vcpu *vcpu, int index)
1938 {
1939         struct vcpu_svm *svm = to_svm(vcpu);
1940         u64 cr3 = svm->nested.nested_cr3;
1941         u64 pdpte;
1942         int ret;
1943
1944         ret = kvm_read_guest_page(vcpu->kvm, gpa_to_gfn(cr3), &pdpte,
1945                                   offset_in_page(cr3) + index * 8, 8);
1946         if (ret)
1947                 return 0;
1948         return pdpte;
1949 }
1950
1951 static void nested_svm_set_tdp_cr3(struct kvm_vcpu *vcpu,
1952                                    unsigned long root)
1953 {
1954         struct vcpu_svm *svm = to_svm(vcpu);
1955
1956         svm->vmcb->control.nested_cr3 = root;
1957         mark_dirty(svm->vmcb, VMCB_NPT);
1958         svm_flush_tlb(vcpu);
1959 }
1960
1961 static void nested_svm_inject_npf_exit(struct kvm_vcpu *vcpu,
1962                                        struct x86_exception *fault)
1963 {
1964         struct vcpu_svm *svm = to_svm(vcpu);
1965
1966         svm->vmcb->control.exit_code = SVM_EXIT_NPF;
1967         svm->vmcb->control.exit_code_hi = 0;
1968         svm->vmcb->control.exit_info_1 = fault->error_code;
1969         svm->vmcb->control.exit_info_2 = fault->address;
1970
1971         nested_svm_vmexit(svm);
1972 }
1973
1974 static void nested_svm_init_mmu_context(struct kvm_vcpu *vcpu)
1975 {
1976         kvm_init_shadow_mmu(vcpu, &vcpu->arch.mmu);
1977
1978         vcpu->arch.mmu.set_cr3           = nested_svm_set_tdp_cr3;
1979         vcpu->arch.mmu.get_cr3           = nested_svm_get_tdp_cr3;
1980         vcpu->arch.mmu.get_pdptr         = nested_svm_get_tdp_pdptr;
1981         vcpu->arch.mmu.inject_page_fault = nested_svm_inject_npf_exit;
1982         vcpu->arch.mmu.shadow_root_level = get_npt_level();
1983         vcpu->arch.walk_mmu              = &vcpu->arch.nested_mmu;
1984 }
1985
1986 static void nested_svm_uninit_mmu_context(struct kvm_vcpu *vcpu)
1987 {
1988         vcpu->arch.walk_mmu = &vcpu->arch.mmu;
1989 }
1990
1991 static int nested_svm_check_permissions(struct vcpu_svm *svm)
1992 {
1993         if (!(svm->vcpu.arch.efer & EFER_SVME)
1994             || !is_paging(&svm->vcpu)) {
1995                 kvm_queue_exception(&svm->vcpu, UD_VECTOR);
1996                 return 1;
1997         }
1998
1999         if (svm->vmcb->save.cpl) {
2000                 kvm_inject_gp(&svm->vcpu, 0);
2001                 return 1;
2002         }
2003
2004        return 0;
2005 }
2006
2007 static int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
2008                                       bool has_error_code, u32 error_code)
2009 {
2010         int vmexit;
2011
2012         if (!is_guest_mode(&svm->vcpu))
2013                 return 0;
2014
2015         svm->vmcb->control.exit_code = SVM_EXIT_EXCP_BASE + nr;
2016         svm->vmcb->control.exit_code_hi = 0;
2017         svm->vmcb->control.exit_info_1 = error_code;
2018         svm->vmcb->control.exit_info_2 = svm->vcpu.arch.cr2;
2019
2020         vmexit = nested_svm_intercept(svm);
2021         if (vmexit == NESTED_EXIT_DONE)
2022                 svm->nested.exit_required = true;
2023
2024         return vmexit;
2025 }
2026
2027 /* This function returns true if it is save to enable the irq window */
2028 static inline bool nested_svm_intr(struct vcpu_svm *svm)
2029 {
2030         if (!is_guest_mode(&svm->vcpu))
2031                 return true;
2032
2033         if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK))
2034                 return true;
2035
2036         if (!(svm->vcpu.arch.hflags & HF_HIF_MASK))
2037                 return false;
2038
2039         /*
2040          * if vmexit was already requested (by intercepted exception
2041          * for instance) do not overwrite it with "external interrupt"
2042          * vmexit.
2043          */
2044         if (svm->nested.exit_required)
2045                 return false;
2046
2047         svm->vmcb->control.exit_code   = SVM_EXIT_INTR;
2048         svm->vmcb->control.exit_info_1 = 0;
2049         svm->vmcb->control.exit_info_2 = 0;
2050
2051         if (svm->nested.intercept & 1ULL) {
2052                 /*
2053                  * The #vmexit can't be emulated here directly because this
2054                  * code path runs with irqs and preemption disabled. A
2055                  * #vmexit emulation might sleep. Only signal request for
2056                  * the #vmexit here.
2057                  */
2058                 svm->nested.exit_required = true;
2059                 trace_kvm_nested_intr_vmexit(svm->vmcb->save.rip);
2060                 return false;
2061         }
2062
2063         return true;
2064 }
2065
2066 /* This function returns true if it is save to enable the nmi window */
2067 static inline bool nested_svm_nmi(struct vcpu_svm *svm)
2068 {
2069         if (!is_guest_mode(&svm->vcpu))
2070                 return true;
2071
2072         if (!(svm->nested.intercept & (1ULL << INTERCEPT_NMI)))
2073                 return true;
2074
2075         svm->vmcb->control.exit_code = SVM_EXIT_NMI;
2076         svm->nested.exit_required = true;
2077
2078         return false;
2079 }
2080
2081 static void *nested_svm_map(struct vcpu_svm *svm, u64 gpa, struct page **_page)
2082 {
2083         struct page *page;
2084
2085         might_sleep();
2086
2087         page = gfn_to_page(svm->vcpu.kvm, gpa >> PAGE_SHIFT);
2088         if (is_error_page(page))
2089                 goto error;
2090
2091         *_page = page;
2092
2093         return kmap(page);
2094
2095 error:
2096         kvm_inject_gp(&svm->vcpu, 0);
2097
2098         return NULL;
2099 }
2100
2101 static void nested_svm_unmap(struct page *page)
2102 {
2103         kunmap(page);
2104         kvm_release_page_dirty(page);
2105 }
2106
2107 static int nested_svm_intercept_ioio(struct vcpu_svm *svm)
2108 {
2109         unsigned port;
2110         u8 val, bit;
2111         u64 gpa;
2112
2113         if (!(svm->nested.intercept & (1ULL << INTERCEPT_IOIO_PROT)))
2114                 return NESTED_EXIT_HOST;
2115
2116         port = svm->vmcb->control.exit_info_1 >> 16;
2117         gpa  = svm->nested.vmcb_iopm + (port / 8);
2118         bit  = port % 8;
2119         val  = 0;
2120
2121         if (kvm_read_guest(svm->vcpu.kvm, gpa, &val, 1))
2122                 val &= (1 << bit);
2123
2124         return val ? NESTED_EXIT_DONE : NESTED_EXIT_HOST;
2125 }
2126
2127 static int nested_svm_exit_handled_msr(struct vcpu_svm *svm)
2128 {
2129         u32 offset, msr, value;
2130         int write, mask;
2131
2132         if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
2133                 return NESTED_EXIT_HOST;
2134
2135         msr    = svm->vcpu.arch.regs[VCPU_REGS_RCX];
2136         offset = svm_msrpm_offset(msr);
2137         write  = svm->vmcb->control.exit_info_1 & 1;
2138         mask   = 1 << ((2 * (msr & 0xf)) + write);
2139
2140         if (offset == MSR_INVALID)
2141                 return NESTED_EXIT_DONE;
2142
2143         /* Offset is in 32 bit units but need in 8 bit units */
2144         offset *= 4;
2145
2146         if (kvm_read_guest(svm->vcpu.kvm, svm->nested.vmcb_msrpm + offset, &value, 4))
2147                 return NESTED_EXIT_DONE;
2148
2149         return (value & mask) ? NESTED_EXIT_DONE : NESTED_EXIT_HOST;
2150 }
2151
2152 static int nested_svm_exit_special(struct vcpu_svm *svm)
2153 {
2154         u32 exit_code = svm->vmcb->control.exit_code;
2155
2156         switch (exit_code) {
2157         case SVM_EXIT_INTR:
2158         case SVM_EXIT_NMI:
2159         case SVM_EXIT_EXCP_BASE + MC_VECTOR:
2160                 return NESTED_EXIT_HOST;
2161         case SVM_EXIT_NPF:
2162                 /* For now we are always handling NPFs when using them */
2163                 if (npt_enabled)
2164                         return NESTED_EXIT_HOST;
2165                 break;
2166         case SVM_EXIT_EXCP_BASE + PF_VECTOR:
2167                 /* When we're shadowing, trap PFs, but not async PF */
2168                 if (!npt_enabled && svm->apf_reason == 0)
2169                         return NESTED_EXIT_HOST;
2170                 break;
2171         case SVM_EXIT_EXCP_BASE + NM_VECTOR:
2172                 nm_interception(svm);
2173                 break;
2174         default:
2175                 break;
2176         }
2177
2178         return NESTED_EXIT_CONTINUE;
2179 }
2180
2181 /*
2182  * If this function returns true, this #vmexit was already handled
2183  */
2184 static int nested_svm_intercept(struct vcpu_svm *svm)
2185 {
2186         u32 exit_code = svm->vmcb->control.exit_code;
2187         int vmexit = NESTED_EXIT_HOST;
2188
2189         switch (exit_code) {
2190         case SVM_EXIT_MSR:
2191                 vmexit = nested_svm_exit_handled_msr(svm);
2192                 break;
2193         case SVM_EXIT_IOIO:
2194                 vmexit = nested_svm_intercept_ioio(svm);
2195                 break;
2196         case SVM_EXIT_READ_CR0 ... SVM_EXIT_WRITE_CR8: {
2197                 u32 bit = 1U << (exit_code - SVM_EXIT_READ_CR0);
2198                 if (svm->nested.intercept_cr & bit)
2199                         vmexit = NESTED_EXIT_DONE;
2200                 break;
2201         }
2202         case SVM_EXIT_READ_DR0 ... SVM_EXIT_WRITE_DR7: {
2203                 u32 bit = 1U << (exit_code - SVM_EXIT_READ_DR0);
2204                 if (svm->nested.intercept_dr & bit)
2205                         vmexit = NESTED_EXIT_DONE;
2206                 break;
2207         }
2208         case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 0x1f: {
2209                 u32 excp_bits = 1 << (exit_code - SVM_EXIT_EXCP_BASE);
2210                 if (svm->nested.intercept_exceptions & excp_bits)
2211                         vmexit = NESTED_EXIT_DONE;
2212                 /* async page fault always cause vmexit */
2213                 else if ((exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR) &&
2214                          svm->apf_reason != 0)
2215                         vmexit = NESTED_EXIT_DONE;
2216                 break;
2217         }
2218         case SVM_EXIT_ERR: {
2219                 vmexit = NESTED_EXIT_DONE;
2220                 break;
2221         }
2222         default: {
2223                 u64 exit_bits = 1ULL << (exit_code - SVM_EXIT_INTR);
2224                 if (svm->nested.intercept & exit_bits)
2225                         vmexit = NESTED_EXIT_DONE;
2226         }
2227         }
2228
2229         return vmexit;
2230 }
2231
2232 static int nested_svm_exit_handled(struct vcpu_svm *svm)
2233 {
2234         int vmexit;
2235
2236         vmexit = nested_svm_intercept(svm);
2237
2238         if (vmexit == NESTED_EXIT_DONE)
2239                 nested_svm_vmexit(svm);
2240
2241         return vmexit;
2242 }
2243
2244 static inline void copy_vmcb_control_area(struct vmcb *dst_vmcb, struct vmcb *from_vmcb)
2245 {
2246         struct vmcb_control_area *dst  = &dst_vmcb->control;
2247         struct vmcb_control_area *from = &from_vmcb->control;
2248
2249         dst->intercept_cr         = from->intercept_cr;
2250         dst->intercept_dr         = from->intercept_dr;
2251         dst->intercept_exceptions = from->intercept_exceptions;
2252         dst->intercept            = from->intercept;
2253         dst->iopm_base_pa         = from->iopm_base_pa;
2254         dst->msrpm_base_pa        = from->msrpm_base_pa;
2255         dst->tsc_offset           = from->tsc_offset;
2256         dst->asid                 = from->asid;
2257         dst->tlb_ctl              = from->tlb_ctl;
2258         dst->int_ctl              = from->int_ctl;
2259         dst->int_vector           = from->int_vector;
2260         dst->int_state            = from->int_state;
2261         dst->exit_code            = from->exit_code;
2262         dst->exit_code_hi         = from->exit_code_hi;
2263         dst->exit_info_1          = from->exit_info_1;
2264         dst->exit_info_2          = from->exit_info_2;
2265         dst->exit_int_info        = from->exit_int_info;
2266         dst->exit_int_info_err    = from->exit_int_info_err;
2267         dst->nested_ctl           = from->nested_ctl;
2268         dst->event_inj            = from->event_inj;
2269         dst->event_inj_err        = from->event_inj_err;
2270         dst->nested_cr3           = from->nested_cr3;
2271         dst->lbr_ctl              = from->lbr_ctl;
2272 }
2273
2274 static int nested_svm_vmexit(struct vcpu_svm *svm)
2275 {
2276         struct vmcb *nested_vmcb;
2277         struct vmcb *hsave = svm->nested.hsave;
2278         struct vmcb *vmcb = svm->vmcb;
2279         struct page *page;
2280
2281         trace_kvm_nested_vmexit_inject(vmcb->control.exit_code,
2282                                        vmcb->control.exit_info_1,
2283                                        vmcb->control.exit_info_2,
2284                                        vmcb->control.exit_int_info,
2285                                        vmcb->control.exit_int_info_err,
2286                                        KVM_ISA_SVM);
2287
2288         nested_vmcb = nested_svm_map(svm, svm->nested.vmcb, &page);
2289         if (!nested_vmcb)
2290                 return 1;
2291
2292         /* Exit Guest-Mode */
2293         leave_guest_mode(&svm->vcpu);
2294         svm->nested.vmcb = 0;
2295
2296         /* Give the current vmcb to the guest */
2297         disable_gif(svm);
2298
2299         nested_vmcb->save.es     = vmcb->save.es;
2300         nested_vmcb->save.cs     = vmcb->save.cs;
2301         nested_vmcb->save.ss     = vmcb->save.ss;
2302         nested_vmcb->save.ds     = vmcb->save.ds;
2303         nested_vmcb->save.gdtr   = vmcb->save.gdtr;
2304         nested_vmcb->save.idtr   = vmcb->save.idtr;
2305         nested_vmcb->save.efer   = svm->vcpu.arch.efer;
2306         nested_vmcb->save.cr0    = kvm_read_cr0(&svm->vcpu);
2307         nested_vmcb->save.cr3    = kvm_read_cr3(&svm->vcpu);
2308         nested_vmcb->save.cr2    = vmcb->save.cr2;
2309         nested_vmcb->save.cr4    = svm->vcpu.arch.cr4;
2310         nested_vmcb->save.rflags = kvm_get_rflags(&svm->vcpu);
2311         nested_vmcb->save.rip    = vmcb->save.rip;
2312         nested_vmcb->save.rsp    = vmcb->save.rsp;
2313         nested_vmcb->save.rax    = vmcb->save.rax;
2314         nested_vmcb->save.dr7    = vmcb->save.dr7;
2315         nested_vmcb->save.dr6    = vmcb->save.dr6;
2316         nested_vmcb->save.cpl    = vmcb->save.cpl;
2317
2318         nested_vmcb->control.int_ctl           = vmcb->control.int_ctl;
2319         nested_vmcb->control.int_vector        = vmcb->control.int_vector;
2320         nested_vmcb->control.int_state         = vmcb->control.int_state;
2321         nested_vmcb->control.exit_code         = vmcb->control.exit_code;
2322         nested_vmcb->control.exit_code_hi      = vmcb->control.exit_code_hi;
2323         nested_vmcb->control.exit_info_1       = vmcb->control.exit_info_1;
2324         nested_vmcb->control.exit_info_2       = vmcb->control.exit_info_2;
2325         nested_vmcb->control.exit_int_info     = vmcb->control.exit_int_info;
2326         nested_vmcb->control.exit_int_info_err = vmcb->control.exit_int_info_err;
2327         nested_vmcb->control.next_rip          = vmcb->control.next_rip;
2328
2329         /*
2330          * If we emulate a VMRUN/#VMEXIT in the same host #vmexit cycle we have
2331          * to make sure that we do not lose injected events. So check event_inj
2332          * here and copy it to exit_int_info if it is valid.
2333          * Exit_int_info and event_inj can't be both valid because the case
2334          * below only happens on a VMRUN instruction intercept which has
2335          * no valid exit_int_info set.
2336          */
2337         if (vmcb->control.event_inj & SVM_EVTINJ_VALID) {
2338                 struct vmcb_control_area *nc = &nested_vmcb->control;
2339
2340                 nc->exit_int_info     = vmcb->control.event_inj;
2341                 nc->exit_int_info_err = vmcb->control.event_inj_err;
2342         }
2343
2344         nested_vmcb->control.tlb_ctl           = 0;
2345         nested_vmcb->control.event_inj         = 0;
2346         nested_vmcb->control.event_inj_err     = 0;
2347
2348         /* We always set V_INTR_MASKING and remember the old value in hflags */
2349         if (!(svm->vcpu.arch.hflags & HF_VINTR_MASK))
2350                 nested_vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
2351
2352         /* Restore the original control entries */
2353         copy_vmcb_control_area(vmcb, hsave);
2354
2355         kvm_clear_exception_queue(&svm->vcpu);
2356         kvm_clear_interrupt_queue(&svm->vcpu);
2357
2358         svm->nested.nested_cr3 = 0;
2359
2360         /* Restore selected save entries */
2361         svm->vmcb->save.es = hsave->save.es;
2362         svm->vmcb->save.cs = hsave->save.cs;
2363         svm->vmcb->save.ss = hsave->save.ss;
2364         svm->vmcb->save.ds = hsave->save.ds;
2365         svm->vmcb->save.gdtr = hsave->save.gdtr;
2366         svm->vmcb->save.idtr = hsave->save.idtr;
2367         kvm_set_rflags(&svm->vcpu, hsave->save.rflags);
2368         svm_set_efer(&svm->vcpu, hsave->save.efer);
2369         svm_set_cr0(&svm->vcpu, hsave->save.cr0 | X86_CR0_PE);
2370         svm_set_cr4(&svm->vcpu, hsave->save.cr4);
2371         if (npt_enabled) {
2372                 svm->vmcb->save.cr3 = hsave->save.cr3;
2373                 svm->vcpu.arch.cr3 = hsave->save.cr3;
2374         } else {
2375                 (void)kvm_set_cr3(&svm->vcpu, hsave->save.cr3);
2376         }
2377         kvm_register_write(&svm->vcpu, VCPU_REGS_RAX, hsave->save.rax);
2378         kvm_register_write(&svm->vcpu, VCPU_REGS_RSP, hsave->save.rsp);
2379         kvm_register_write(&svm->vcpu, VCPU_REGS_RIP, hsave->save.rip);
2380         svm->vmcb->save.dr7 = 0;
2381         svm->vmcb->save.cpl = 0;
2382         svm->vmcb->control.exit_int_info = 0;
2383
2384         mark_all_dirty(svm->vmcb);
2385
2386         nested_svm_unmap(page);
2387
2388         nested_svm_uninit_mmu_context(&svm->vcpu);
2389         kvm_mmu_reset_context(&svm->vcpu);
2390         kvm_mmu_load(&svm->vcpu);
2391
2392         return 0;
2393 }
2394
2395 static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
2396 {
2397         /*
2398          * This function merges the msr permission bitmaps of kvm and the
2399          * nested vmcb. It is optimized in that it only merges the parts where
2400          * the kvm msr permission bitmap may contain zero bits
2401          */
2402         int i;
2403
2404         if (!(svm->nested.intercept & (1ULL << INTERCEPT_MSR_PROT)))
2405                 return true;
2406
2407         for (i = 0; i < MSRPM_OFFSETS; i++) {
2408                 u32 value, p;
2409                 u64 offset;
2410
2411                 if (msrpm_offsets[i] == 0xffffffff)
2412                         break;
2413
2414                 p      = msrpm_offsets[i];
2415                 offset = svm->nested.vmcb_msrpm + (p * 4);
2416
2417                 if (kvm_read_guest(svm->vcpu.kvm, offset, &value, 4))
2418                         return false;
2419
2420                 svm->nested.msrpm[p] = svm->msrpm[p] | value;
2421         }
2422
2423         svm->vmcb->control.msrpm_base_pa = __pa(svm->nested.msrpm);
2424
2425         return true;
2426 }
2427
2428 static bool nested_vmcb_checks(struct vmcb *vmcb)
2429 {
2430         if ((vmcb->control.intercept & (1ULL << INTERCEPT_VMRUN)) == 0)
2431                 return false;
2432
2433         if (vmcb->control.asid == 0)
2434                 return false;
2435
2436         if (vmcb->control.nested_ctl && !npt_enabled)
2437                 return false;
2438
2439         return true;
2440 }
2441
2442 static bool nested_svm_vmrun(struct vcpu_svm *svm)
2443 {
2444         struct vmcb *nested_vmcb;
2445         struct vmcb *hsave = svm->nested.hsave;
2446         struct vmcb *vmcb = svm->vmcb;
2447         struct page *page;
2448         u64 vmcb_gpa;
2449
2450         vmcb_gpa = svm->vmcb->save.rax;
2451
2452         nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
2453         if (!nested_vmcb)
2454                 return false;
2455
2456         if (!nested_vmcb_checks(nested_vmcb)) {
2457                 nested_vmcb->control.exit_code    = SVM_EXIT_ERR;
2458                 nested_vmcb->control.exit_code_hi = 0;
2459                 nested_vmcb->control.exit_info_1  = 0;
2460                 nested_vmcb->control.exit_info_2  = 0;
2461
2462                 nested_svm_unmap(page);
2463
2464                 return false;
2465         }
2466
2467         trace_kvm_nested_vmrun(svm->vmcb->save.rip, vmcb_gpa,
2468                                nested_vmcb->save.rip,
2469                                nested_vmcb->control.int_ctl,
2470                                nested_vmcb->control.event_inj,
2471                                nested_vmcb->control.nested_ctl);
2472
2473         trace_kvm_nested_intercepts(nested_vmcb->control.intercept_cr & 0xffff,
2474                                     nested_vmcb->control.intercept_cr >> 16,
2475                                     nested_vmcb->control.intercept_exceptions,
2476                                     nested_vmcb->control.intercept);
2477
2478         /* Clear internal status */
2479         kvm_clear_exception_queue(&svm->vcpu);
2480         kvm_clear_interrupt_queue(&svm->vcpu);
2481
2482         /*
2483          * Save the old vmcb, so we don't need to pick what we save, but can
2484          * restore everything when a VMEXIT occurs
2485          */
2486         hsave->save.es     = vmcb->save.es;
2487         hsave->save.cs     = vmcb->save.cs;
2488         hsave->save.ss     = vmcb->save.ss;
2489         hsave->save.ds     = vmcb->save.ds;
2490         hsave->save.gdtr   = vmcb->save.gdtr;
2491         hsave->save.idtr   = vmcb->save.idtr;
2492         hsave->save.efer   = svm->vcpu.arch.efer;
2493         hsave->save.cr0    = kvm_read_cr0(&svm->vcpu);
2494         hsave->save.cr4    = svm->vcpu.arch.cr4;
2495         hsave->save.rflags = kvm_get_rflags(&svm->vcpu);
2496         hsave->save.rip    = kvm_rip_read(&svm->vcpu);
2497         hsave->save.rsp    = vmcb->save.rsp;
2498         hsave->save.rax    = vmcb->save.rax;
2499         if (npt_enabled)
2500                 hsave->save.cr3    = vmcb->save.cr3;
2501         else
2502                 hsave->save.cr3    = kvm_read_cr3(&svm->vcpu);
2503
2504         copy_vmcb_control_area(hsave, vmcb);
2505
2506         if (kvm_get_rflags(&svm->vcpu) & X86_EFLAGS_IF)
2507                 svm->vcpu.arch.hflags |= HF_HIF_MASK;
2508         else
2509                 svm->vcpu.arch.hflags &= ~HF_HIF_MASK;
2510
2511         if (nested_vmcb->control.nested_ctl) {
2512                 kvm_mmu_unload(&svm->vcpu);
2513                 svm->nested.nested_cr3 = nested_vmcb->control.nested_cr3;
2514                 nested_svm_init_mmu_context(&svm->vcpu);
2515         }
2516
2517         /* Load the nested guest state */
2518         svm->vmcb->save.es = nested_vmcb->save.es;
2519         svm->vmcb->save.cs = nested_vmcb->save.cs;
2520         svm->vmcb->save.ss = nested_vmcb->save.ss;
2521         svm->vmcb->save.ds = nested_vmcb->save.ds;
2522         svm->vmcb->save.gdtr = nested_vmcb->save.gdtr;
2523         svm->vmcb->save.idtr = nested_vmcb->save.idtr;
2524         kvm_set_rflags(&svm->vcpu, nested_vmcb->save.rflags);
2525         svm_set_efer(&svm->vcpu, nested_vmcb->save.efer);
2526         svm_set_cr0(&svm->vcpu, nested_vmcb->save.cr0);
2527         svm_set_cr4(&svm->vcpu, nested_vmcb->save.cr4);
2528         if (npt_enabled) {
2529                 svm->vmcb->save.cr3 = nested_vmcb->save.cr3;
2530                 svm->vcpu.arch.cr3 = nested_vmcb->save.cr3;
2531         } else
2532                 (void)kvm_set_cr3(&svm->vcpu, nested_vmcb->save.cr3);
2533
2534         /* Guest paging mode is active - reset mmu */
2535         kvm_mmu_reset_context(&svm->vcpu);
2536
2537         svm->vmcb->save.cr2 = svm->vcpu.arch.cr2 = nested_vmcb->save.cr2;
2538         kvm_register_write(&svm->vcpu, VCPU_REGS_RAX, nested_vmcb->save.rax);
2539         kvm_register_write(&svm->vcpu, VCPU_REGS_RSP, nested_vmcb->save.rsp);
2540         kvm_register_write(&svm->vcpu, VCPU_REGS_RIP, nested_vmcb->save.rip);
2541
2542         /* In case we don't even reach vcpu_run, the fields are not updated */
2543         svm->vmcb->save.rax = nested_vmcb->save.rax;
2544         svm->vmcb->save.rsp = nested_vmcb->save.rsp;
2545         svm->vmcb->save.rip = nested_vmcb->save.rip;
2546         svm->vmcb->save.dr7 = nested_vmcb->save.dr7;
2547         svm->vmcb->save.dr6 = nested_vmcb->save.dr6;
2548         svm->vmcb->save.cpl = nested_vmcb->save.cpl;
2549
2550         svm->nested.vmcb_msrpm = nested_vmcb->control.msrpm_base_pa & ~0x0fffULL;
2551         svm->nested.vmcb_iopm  = nested_vmcb->control.iopm_base_pa  & ~0x0fffULL;
2552
2553         /* cache intercepts */
2554         svm->nested.intercept_cr         = nested_vmcb->control.intercept_cr;
2555         svm->nested.intercept_dr         = nested_vmcb->control.intercept_dr;
2556         svm->nested.intercept_exceptions = nested_vmcb->control.intercept_exceptions;
2557         svm->nested.intercept            = nested_vmcb->control.intercept;
2558
2559         svm_flush_tlb(&svm->vcpu);
2560         svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK;
2561         if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK)
2562                 svm->vcpu.arch.hflags |= HF_VINTR_MASK;
2563         else
2564                 svm->vcpu.arch.hflags &= ~HF_VINTR_MASK;
2565
2566         if (svm->vcpu.arch.hflags & HF_VINTR_MASK) {
2567                 /* We only want the cr8 intercept bits of the guest */
2568                 clr_cr_intercept(svm, INTERCEPT_CR8_READ);
2569                 clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
2570         }
2571
2572         /* We don't want to see VMMCALLs from a nested guest */
2573         clr_intercept(svm, INTERCEPT_VMMCALL);
2574
2575         svm->vmcb->control.lbr_ctl = nested_vmcb->control.lbr_ctl;
2576         svm->vmcb->control.int_vector = nested_vmcb->control.int_vector;
2577         svm->vmcb->control.int_state = nested_vmcb->control.int_state;
2578         svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset;
2579         svm->vmcb->control.event_inj = nested_vmcb->control.event_inj;
2580         svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err;
2581
2582         nested_svm_unmap(page);
2583
2584         /* Enter Guest-Mode */
2585         enter_guest_mode(&svm->vcpu);
2586
2587         /*
2588          * Merge guest and host intercepts - must be called  with vcpu in
2589          * guest-mode to take affect here
2590          */
2591         recalc_intercepts(svm);
2592
2593         svm->nested.vmcb = vmcb_gpa;
2594
2595         enable_gif(svm);
2596
2597         mark_all_dirty(svm->vmcb);
2598
2599         return true;
2600 }
2601
2602 static void nested_svm_vmloadsave(struct vmcb *from_vmcb, struct vmcb *to_vmcb)
2603 {
2604         to_vmcb->save.fs = from_vmcb->save.fs;
2605         to_vmcb->save.gs = from_vmcb->save.gs;
2606         to_vmcb->save.tr = from_vmcb->save.tr;
2607         to_vmcb->save.ldtr = from_vmcb->save.ldtr;
2608         to_vmcb->save.kernel_gs_base = from_vmcb->save.kernel_gs_base;
2609         to_vmcb->save.star = from_vmcb->save.star;
2610         to_vmcb->save.lstar = from_vmcb->save.lstar;
2611         to_vmcb->save.cstar = from_vmcb->save.cstar;
2612         to_vmcb->save.sfmask = from_vmcb->save.sfmask;
2613         to_vmcb->save.sysenter_cs = from_vmcb->save.sysenter_cs;
2614         to_vmcb->save.sysenter_esp = from_vmcb->save.sysenter_esp;
2615         to_vmcb->save.sysenter_eip = from_vmcb->save.sysenter_eip;
2616 }
2617
2618 static int vmload_interception(struct vcpu_svm *svm)
2619 {
2620         struct vmcb *nested_vmcb;
2621         struct page *page;
2622
2623         if (nested_svm_check_permissions(svm))
2624                 return 1;
2625
2626         nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
2627         if (!nested_vmcb)
2628                 return 1;
2629
2630         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2631         skip_emulated_instruction(&svm->vcpu);
2632
2633         nested_svm_vmloadsave(nested_vmcb, svm->vmcb);
2634         nested_svm_unmap(page);
2635
2636         return 1;
2637 }
2638
2639 static int vmsave_interception(struct vcpu_svm *svm)
2640 {
2641         struct vmcb *nested_vmcb;
2642         struct page *page;
2643
2644         if (nested_svm_check_permissions(svm))
2645                 return 1;
2646
2647         nested_vmcb = nested_svm_map(svm, svm->vmcb->save.rax, &page);
2648         if (!nested_vmcb)
2649                 return 1;
2650
2651         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2652         skip_emulated_instruction(&svm->vcpu);
2653
2654         nested_svm_vmloadsave(svm->vmcb, nested_vmcb);
2655         nested_svm_unmap(page);
2656
2657         return 1;
2658 }
2659
2660 static int vmrun_interception(struct vcpu_svm *svm)
2661 {
2662         if (nested_svm_check_permissions(svm))
2663                 return 1;
2664
2665         /* Save rip after vmrun instruction */
2666         kvm_rip_write(&svm->vcpu, kvm_rip_read(&svm->vcpu) + 3);
2667
2668         if (!nested_svm_vmrun(svm))
2669                 return 1;
2670
2671         if (!nested_svm_vmrun_msrpm(svm))
2672                 goto failed;
2673
2674         return 1;
2675
2676 failed:
2677
2678         svm->vmcb->control.exit_code    = SVM_EXIT_ERR;
2679         svm->vmcb->control.exit_code_hi = 0;
2680         svm->vmcb->control.exit_info_1  = 0;
2681         svm->vmcb->control.exit_info_2  = 0;
2682
2683         nested_svm_vmexit(svm);
2684
2685         return 1;
2686 }
2687
2688 static int stgi_interception(struct vcpu_svm *svm)
2689 {
2690         if (nested_svm_check_permissions(svm))
2691                 return 1;
2692
2693         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2694         skip_emulated_instruction(&svm->vcpu);
2695         kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
2696
2697         enable_gif(svm);
2698
2699         return 1;
2700 }
2701
2702 static int clgi_interception(struct vcpu_svm *svm)
2703 {
2704         if (nested_svm_check_permissions(svm))
2705                 return 1;
2706
2707         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2708         skip_emulated_instruction(&svm->vcpu);
2709
2710         disable_gif(svm);
2711
2712         /* After a CLGI no interrupts should come */
2713         svm_clear_vintr(svm);
2714         svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
2715
2716         mark_dirty(svm->vmcb, VMCB_INTR);
2717
2718         return 1;
2719 }
2720
2721 static int invlpga_interception(struct vcpu_svm *svm)
2722 {
2723         struct kvm_vcpu *vcpu = &svm->vcpu;
2724
2725         trace_kvm_invlpga(svm->vmcb->save.rip, vcpu->arch.regs[VCPU_REGS_RCX],
2726                           vcpu->arch.regs[VCPU_REGS_RAX]);
2727
2728         /* Let's treat INVLPGA the same as INVLPG (can be optimized!) */
2729         kvm_mmu_invlpg(vcpu, vcpu->arch.regs[VCPU_REGS_RAX]);
2730
2731         svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2732         skip_emulated_instruction(&svm->vcpu);
2733         return 1;
2734 }
2735
2736 static int skinit_interception(struct vcpu_svm *svm)
2737 {
2738         trace_kvm_skinit(svm->vmcb->save.rip, svm->vcpu.arch.regs[VCPU_REGS_RAX]);
2739
2740         kvm_queue_exception(&svm->vcpu, UD_VECTOR);
2741         return 1;
2742 }
2743
2744 static int xsetbv_interception(struct vcpu_svm *svm)
2745 {
2746         u64 new_bv = kvm_read_edx_eax(&svm->vcpu);
2747         u32 index = kvm_register_read(&svm->vcpu, VCPU_REGS_RCX);
2748
2749         if (kvm_set_xcr(&svm->vcpu, index, new_bv) == 0) {
2750                 svm->next_rip = kvm_rip_read(&svm->vcpu) + 3;
2751                 skip_emulated_instruction(&svm->vcpu);
2752         }
2753
2754         return 1;
2755 }
2756
2757 static int invalid_op_interception(struct vcpu_svm *svm)
2758 {
2759         kvm_queue_exception(&svm->vcpu, UD_VECTOR);
2760         return 1;
2761 }
2762
2763 static int task_switch_interception(struct vcpu_svm *svm)
2764 {
2765         u16 tss_selector;
2766         int reason;
2767         int int_type = svm->vmcb->control.exit_int_info &
2768                 SVM_EXITINTINFO_TYPE_MASK;
2769         int int_vec = svm->vmcb->control.exit_int_info & SVM_EVTINJ_VEC_MASK;
2770         uint32_t type =
2771                 svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_TYPE_MASK;
2772         uint32_t idt_v =
2773                 svm->vmcb->control.exit_int_info & SVM_EXITINTINFO_VALID;
2774         bool has_error_code = false;
2775         u32 error_code = 0;
2776
2777         tss_selector = (u16)svm->vmcb->control.exit_info_1;
2778
2779         if (svm->vmcb->control.exit_info_2 &
2780             (1ULL << SVM_EXITINFOSHIFT_TS_REASON_IRET))
2781                 reason = TASK_SWITCH_IRET;
2782         else if (svm->vmcb->control.exit_info_2 &
2783                  (1ULL << SVM_EXITINFOSHIFT_TS_REASON_JMP))
2784                 reason = TASK_SWITCH_JMP;
2785         else if (idt_v)
2786                 reason = TASK_SWITCH_GATE;
2787         else
2788                 reason = TASK_SWITCH_CALL;
2789
2790         if (reason == TASK_SWITCH_GATE) {
2791                 switch (type) {
2792                 case SVM_EXITINTINFO_TYPE_NMI:
2793                         svm->vcpu.arch.nmi_injected = false;
2794                         break;
2795                 case SVM_EXITINTINFO_TYPE_EXEPT:
2796                         if (svm->vmcb->control.exit_info_2 &
2797                             (1ULL << SVM_EXITINFOSHIFT_TS_HAS_ERROR_CODE)) {
2798                                 has_error_code = true;
2799                                 error_code =
2800                                         (u32)svm->vmcb->control.exit_info_2;
2801                         }
2802                         kvm_clear_exception_queue(&svm->vcpu);
2803                         break;
2804                 case SVM_EXITINTINFO_TYPE_INTR:
2805                         kvm_clear_interrupt_queue(&svm->vcpu);
2806                         break;
2807                 default:
2808                         break;
2809                 }
2810         }
2811
2812         if (reason != TASK_SWITCH_GATE ||
2813             int_type == SVM_EXITINTINFO_TYPE_SOFT ||
2814             (int_type == SVM_EXITINTINFO_TYPE_EXEPT &&
2815              (int_vec == OF_VECTOR || int_vec == BP_VECTOR)))
2816                 skip_emulated_instruction(&svm->vcpu);
2817
2818         if (int_type != SVM_EXITINTINFO_TYPE_SOFT)
2819                 int_vec = -1;
2820
2821         if (kvm_task_switch(&svm->vcpu, tss_selector, int_vec, reason,
2822                                 has_error_code, error_code) == EMULATE_FAIL) {
2823                 svm->vcpu.run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
2824                 svm->vcpu.run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
2825                 svm->vcpu.run->internal.ndata = 0;
2826                 return 0;
2827         }
2828         return 1;
2829 }
2830
2831 static int cpuid_interception(struct vcpu_svm *svm)
2832 {
2833         svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
2834         kvm_emulate_cpuid(&svm->vcpu);
2835         return 1;
2836 }
2837
2838 static int iret_interception(struct vcpu_svm *svm)
2839 {
2840         ++svm->vcpu.stat.nmi_window_exits;
2841         clr_intercept(svm, INTERCEPT_IRET);
2842         svm->vcpu.arch.hflags |= HF_IRET_MASK;
2843         svm->nmi_iret_rip = kvm_rip_read(&svm->vcpu);
2844         kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
2845         return 1;
2846 }
2847
2848 static int invlpg_interception(struct vcpu_svm *svm)
2849 {
2850         if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
2851                 return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
2852
2853         kvm_mmu_invlpg(&svm->vcpu, svm->vmcb->control.exit_info_1);
2854         skip_emulated_instruction(&svm->vcpu);
2855         return 1;
2856 }
2857
2858 static int emulate_on_interception(struct vcpu_svm *svm)
2859 {
2860         return emulate_instruction(&svm->vcpu, 0) == EMULATE_DONE;
2861 }
2862
2863 static int rdpmc_interception(struct vcpu_svm *svm)
2864 {
2865         int err;
2866
2867         if (!static_cpu_has(X86_FEATURE_NRIPS))
2868                 return emulate_on_interception(svm);
2869
2870         err = kvm_rdpmc(&svm->vcpu);
2871         kvm_complete_insn_gp(&svm->vcpu, err);
2872
2873         return 1;
2874 }
2875
2876 bool check_selective_cr0_intercepted(struct vcpu_svm *svm, unsigned long val)
2877 {
2878         unsigned long cr0 = svm->vcpu.arch.cr0;
2879         bool ret = false;
2880         u64 intercept;
2881
2882         intercept = svm->nested.intercept;
2883
2884         if (!is_guest_mode(&svm->vcpu) ||
2885             (!(intercept & (1ULL << INTERCEPT_SELECTIVE_CR0))))
2886                 return false;
2887
2888         cr0 &= ~SVM_CR0_SELECTIVE_MASK;
2889         val &= ~SVM_CR0_SELECTIVE_MASK;
2890
2891         if (cr0 ^ val) {
2892                 svm->vmcb->control.exit_code = SVM_EXIT_CR0_SEL_WRITE;
2893                 ret = (nested_svm_exit_handled(svm) == NESTED_EXIT_DONE);
2894         }
2895
2896         return ret;
2897 }
2898
2899 #define CR_VALID (1ULL << 63)
2900
2901 static int cr_interception(struct vcpu_svm *svm)
2902 {
2903         int reg, cr;
2904         unsigned long val;
2905         int err;
2906
2907         if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
2908                 return emulate_on_interception(svm);
2909
2910         if (unlikely((svm->vmcb->control.exit_info_1 & CR_VALID) == 0))
2911                 return emulate_on_interception(svm);
2912
2913         reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
2914         cr = svm->vmcb->control.exit_code - SVM_EXIT_READ_CR0;
2915
2916         err = 0;
2917         if (cr >= 16) { /* mov to cr */
2918                 cr -= 16;
2919                 val = kvm_register_read(&svm->vcpu, reg);
2920                 switch (cr) {
2921                 case 0:
2922                         if (!check_selective_cr0_intercepted(svm, val))
2923                                 err = kvm_set_cr0(&svm->vcpu, val);
2924                         else
2925                                 return 1;
2926
2927                         break;
2928                 case 3:
2929                         err = kvm_set_cr3(&svm->vcpu, val);
2930                         break;
2931                 case 4:
2932                         err = kvm_set_cr4(&svm->vcpu, val);
2933                         break;
2934                 case 8:
2935                         err = kvm_set_cr8(&svm->vcpu, val);
2936                         break;
2937                 default:
2938                         WARN(1, "unhandled write to CR%d", cr);
2939                         kvm_queue_exception(&svm->vcpu, UD_VECTOR);
2940                         return 1;
2941                 }
2942         } else { /* mov from cr */
2943                 switch (cr) {
2944                 case 0:
2945                         val = kvm_read_cr0(&svm->vcpu);
2946                         break;
2947                 case 2:
2948                         val = svm->vcpu.arch.cr2;
2949                         break;
2950                 case 3:
2951                         val = kvm_read_cr3(&svm->vcpu);
2952                         break;
2953                 case 4:
2954                         val = kvm_read_cr4(&svm->vcpu);
2955                         break;
2956                 case 8:
2957                         val = kvm_get_cr8(&svm->vcpu);
2958                         break;
2959                 default:
2960                         WARN(1, "unhandled read from CR%d", cr);
2961                         kvm_queue_exception(&svm->vcpu, UD_VECTOR);
2962                         return 1;
2963                 }
2964                 kvm_register_write(&svm->vcpu, reg, val);
2965         }
2966         kvm_complete_insn_gp(&svm->vcpu, err);
2967
2968         return 1;
2969 }
2970
2971 static int dr_interception(struct vcpu_svm *svm)
2972 {
2973         int reg, dr;
2974         unsigned long val;
2975         int err;
2976
2977         if (!boot_cpu_has(X86_FEATURE_DECODEASSISTS))
2978                 return emulate_on_interception(svm);
2979
2980         reg = svm->vmcb->control.exit_info_1 & SVM_EXITINFO_REG_MASK;
2981         dr = svm->vmcb->control.exit_code - SVM_EXIT_READ_DR0;
2982
2983         if (dr >= 16) { /* mov to DRn */
2984                 val = kvm_register_read(&svm->vcpu, reg);
2985                 kvm_set_dr(&svm->vcpu, dr - 16, val);
2986         } else {
2987                 err = kvm_get_dr(&svm->vcpu, dr, &val);
2988                 if (!err)
2989                         kvm_register_write(&svm->vcpu, reg, val);
2990         }
2991
2992         skip_emulated_instruction(&svm->vcpu);
2993
2994         return 1;
2995 }
2996
2997 static int cr8_write_interception(struct vcpu_svm *svm)
2998 {
2999         struct kvm_run *kvm_run = svm->vcpu.run;
3000         int r;
3001
3002         u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
3003         /* instruction emulation calls kvm_set_cr8() */
3004         r = cr_interception(svm);
3005         if (irqchip_in_kernel(svm->vcpu.kvm)) {
3006                 clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
3007                 return r;
3008         }
3009         if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
3010                 return r;
3011         kvm_run->exit_reason = KVM_EXIT_SET_TPR;
3012         return 0;
3013 }
3014
3015 u64 svm_read_l1_tsc(struct kvm_vcpu *vcpu, u64 host_tsc)
3016 {
3017         struct vmcb *vmcb = get_host_vmcb(to_svm(vcpu));
3018         return vmcb->control.tsc_offset +
3019                 svm_scale_tsc(vcpu, host_tsc);
3020 }
3021
3022 static int svm_get_msr(struct kvm_vcpu *vcpu, unsigned ecx, u64 *data)
3023 {
3024         struct vcpu_svm *svm = to_svm(vcpu);
3025
3026         switch (ecx) {
3027         case MSR_IA32_TSC: {
3028                 *data = svm->vmcb->control.tsc_offset +
3029                         svm_scale_tsc(vcpu, native_read_tsc());
3030
3031                 break;
3032         }
3033         case MSR_STAR:
3034                 *data = svm->vmcb->save.star;
3035                 break;
3036 #ifdef CONFIG_X86_64
3037         case MSR_LSTAR:
3038                 *data = svm->vmcb->save.lstar;
3039                 break;
3040         case MSR_CSTAR:
3041                 *data = svm->vmcb->save.cstar;
3042                 break;
3043         case MSR_KERNEL_GS_BASE:
3044                 *data = svm->vmcb->save.kernel_gs_base;
3045                 break;
3046         case MSR_SYSCALL_MASK:
3047                 *data = svm->vmcb->save.sfmask;
3048                 break;
3049 #endif
3050         case MSR_IA32_SYSENTER_CS:
3051                 *data = svm->vmcb->save.sysenter_cs;
3052                 break;
3053         case MSR_IA32_SYSENTER_EIP:
3054                 *data = svm->sysenter_eip;
3055                 break;
3056         case MSR_IA32_SYSENTER_ESP:
3057                 *data = svm->sysenter_esp;
3058                 break;
3059         /*
3060          * Nobody will change the following 5 values in the VMCB so we can
3061          * safely return them on rdmsr. They will always be 0 until LBRV is
3062          * implemented.
3063          */
3064         case MSR_IA32_DEBUGCTLMSR:
3065                 *data = svm->vmcb->save.dbgctl;
3066                 break;
3067         case MSR_IA32_LASTBRANCHFROMIP:
3068                 *data = svm->vmcb->save.br_from;
3069                 break;
3070         case MSR_IA32_LASTBRANCHTOIP:
3071                 *data = svm->vmcb->save.br_to;
3072                 break;
3073         case MSR_IA32_LASTINTFROMIP:
3074                 *data = svm->vmcb->save.last_excp_from;
3075                 break;
3076         case MSR_IA32_LASTINTTOIP:
3077                 *data = svm->vmcb->save.last_excp_to;
3078                 break;
3079         case MSR_VM_HSAVE_PA:
3080                 *data = svm->nested.hsave_msr;
3081                 break;
3082         case MSR_VM_CR:
3083                 *data = svm->nested.vm_cr_msr;
3084                 break;
3085         case MSR_IA32_UCODE_REV:
3086                 *data = 0x01000065;
3087                 break;
3088         default:
3089                 return kvm_get_msr_common(vcpu, ecx, data);
3090         }
3091         return 0;
3092 }
3093
3094 static int rdmsr_interception(struct vcpu_svm *svm)
3095 {
3096         u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
3097         u64 data;
3098
3099         if (svm_get_msr(&svm->vcpu, ecx, &data)) {
3100                 trace_kvm_msr_read_ex(ecx);
3101                 kvm_inject_gp(&svm->vcpu, 0);
3102         } else {
3103                 trace_kvm_msr_read(ecx, data);
3104
3105                 svm->vcpu.arch.regs[VCPU_REGS_RAX] = data & 0xffffffff;
3106                 svm->vcpu.arch.regs[VCPU_REGS_RDX] = data >> 32;
3107                 svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
3108                 skip_emulated_instruction(&svm->vcpu);
3109         }
3110         return 1;
3111 }
3112
3113 static int svm_set_vm_cr(struct kvm_vcpu *vcpu, u64 data)
3114 {
3115         struct vcpu_svm *svm = to_svm(vcpu);
3116         int svm_dis, chg_mask;
3117
3118         if (data & ~SVM_VM_CR_VALID_MASK)
3119                 return 1;
3120
3121         chg_mask = SVM_VM_CR_VALID_MASK;
3122
3123         if (svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK)
3124                 chg_mask &= ~(SVM_VM_CR_SVM_LOCK_MASK | SVM_VM_CR_SVM_DIS_MASK);
3125
3126         svm->nested.vm_cr_msr &= ~chg_mask;
3127         svm->nested.vm_cr_msr |= (data & chg_mask);
3128
3129         svm_dis = svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK;
3130
3131         /* check for svm_disable while efer.svme is set */
3132         if (svm_dis && (vcpu->arch.efer & EFER_SVME))
3133                 return 1;
3134
3135         return 0;
3136 }
3137
3138 static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
3139 {
3140         struct vcpu_svm *svm = to_svm(vcpu);
3141
3142         u32 ecx = msr->index;
3143         u64 data = msr->data;
3144         switch (ecx) {
3145         case MSR_IA32_TSC:
3146                 kvm_write_tsc(vcpu, msr);
3147                 break;
3148         case MSR_STAR:
3149                 svm->vmcb->save.star = data;
3150                 break;
3151 #ifdef CONFIG_X86_64
3152         case MSR_LSTAR:
3153                 svm->vmcb->save.lstar = data;
3154                 break;
3155         case MSR_CSTAR:
3156                 svm->vmcb->save.cstar = data;
3157                 break;
3158         case MSR_KERNEL_GS_BASE:
3159                 svm->vmcb->save.kernel_gs_base = data;
3160                 break;
3161         case MSR_SYSCALL_MASK:
3162                 svm->vmcb->save.sfmask = data;
3163                 break;
3164 #endif
3165         case MSR_IA32_SYSENTER_CS:
3166                 svm->vmcb->save.sysenter_cs = data;
3167                 break;
3168         case MSR_IA32_SYSENTER_EIP:
3169                 svm->sysenter_eip = data;
3170                 svm->vmcb->save.sysenter_eip = data;
3171                 break;
3172         case MSR_IA32_SYSENTER_ESP:
3173                 svm->sysenter_esp = data;
3174                 svm->vmcb->save.sysenter_esp = data;
3175                 break;
3176         case MSR_IA32_DEBUGCTLMSR:
3177                 if (!boot_cpu_has(X86_FEATURE_LBRV)) {
3178                         vcpu_unimpl(vcpu, "%s: MSR_IA32_DEBUGCTL 0x%llx, nop\n",
3179                                     __func__, data);
3180                         break;
3181                 }
3182                 if (data & DEBUGCTL_RESERVED_BITS)
3183                         return 1;
3184
3185                 svm->vmcb->save.dbgctl = data;
3186                 mark_dirty(svm->vmcb, VMCB_LBR);
3187                 if (data & (1ULL<<0))
3188                         svm_enable_lbrv(svm);
3189                 else
3190                         svm_disable_lbrv(svm);
3191                 break;
3192         case MSR_VM_HSAVE_PA:
3193                 svm->nested.hsave_msr = data;
3194                 break;
3195         case MSR_VM_CR:
3196                 return svm_set_vm_cr(vcpu, data);
3197         case MSR_VM_IGNNE:
3198                 vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
3199                 break;
3200         default:
3201                 return kvm_set_msr_common(vcpu, msr);
3202         }
3203         return 0;
3204 }
3205
3206 static int wrmsr_interception(struct vcpu_svm *svm)
3207 {
3208         struct msr_data msr;
3209         u32 ecx = svm->vcpu.arch.regs[VCPU_REGS_RCX];
3210         u64 data = (svm->vcpu.arch.regs[VCPU_REGS_RAX] & -1u)
3211                 | ((u64)(svm->vcpu.arch.regs[VCPU_REGS_RDX] & -1u) << 32);
3212
3213         msr.data = data;
3214         msr.index = ecx;
3215         msr.host_initiated = false;
3216
3217         svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
3218         if (svm_set_msr(&svm->vcpu, &msr)) {
3219                 trace_kvm_msr_write_ex(ecx, data);
3220                 kvm_inject_gp(&svm->vcpu, 0);
3221         } else {
3222                 trace_kvm_msr_write(ecx, data);
3223                 skip_emulated_instruction(&svm->vcpu);
3224         }
3225         return 1;
3226 }
3227
3228 static int msr_interception(struct vcpu_svm *svm)
3229 {
3230         if (svm->vmcb->control.exit_info_1)
3231                 return wrmsr_interception(svm);
3232         else
3233                 return rdmsr_interception(svm);
3234 }
3235
3236 static int interrupt_window_interception(struct vcpu_svm *svm)
3237 {
3238         struct kvm_run *kvm_run = svm->vcpu.run;
3239
3240         kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3241         svm_clear_vintr(svm);
3242         svm->vmcb->control.int_ctl &= ~V_IRQ_MASK;
3243         mark_dirty(svm->vmcb, VMCB_INTR);
3244         ++svm->vcpu.stat.irq_window_exits;
3245         /*
3246          * If the user space waits to inject interrupts, exit as soon as
3247          * possible
3248          */
3249         if (!irqchip_in_kernel(svm->vcpu.kvm) &&
3250             kvm_run->request_interrupt_window &&
3251             !kvm_cpu_has_interrupt(&svm->vcpu)) {
3252                 kvm_run->exit_reason = KVM_EXIT_IRQ_WINDOW_OPEN;
3253                 return 0;
3254         }
3255
3256         return 1;
3257 }
3258
3259 static int pause_interception(struct vcpu_svm *svm)
3260 {
3261         kvm_vcpu_on_spin(&(svm->vcpu));
3262         return 1;
3263 }
3264
3265 static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
3266         [SVM_EXIT_READ_CR0]                     = cr_interception,
3267         [SVM_EXIT_READ_CR3]                     = cr_interception,
3268         [SVM_EXIT_READ_CR4]                     = cr_interception,
3269         [SVM_EXIT_READ_CR8]                     = cr_interception,
3270         [SVM_EXIT_CR0_SEL_WRITE]                = emulate_on_interception,
3271         [SVM_EXIT_WRITE_CR0]                    = cr_interception,
3272         [SVM_EXIT_WRITE_CR3]                    = cr_interception,
3273         [SVM_EXIT_WRITE_CR4]                    = cr_interception,
3274         [SVM_EXIT_WRITE_CR8]                    = cr8_write_interception,
3275         [SVM_EXIT_READ_DR0]                     = dr_interception,
3276         [SVM_EXIT_READ_DR1]                     = dr_interception,
3277         [SVM_EXIT_READ_DR2]                     = dr_interception,
3278         [SVM_EXIT_READ_DR3]                     = dr_interception,
3279         [SVM_EXIT_READ_DR4]                     = dr_interception,
3280         [SVM_EXIT_READ_DR5]                     = dr_interception,
3281         [SVM_EXIT_READ_DR6]                     = dr_interception,
3282         [SVM_EXIT_READ_DR7]                     = dr_interception,
3283         [SVM_EXIT_WRITE_DR0]                    = dr_interception,
3284         [SVM_EXIT_WRITE_DR1]                    = dr_interception,
3285         [SVM_EXIT_WRITE_DR2]                    = dr_interception,
3286         [SVM_EXIT_WRITE_DR3]                    = dr_interception,
3287         [SVM_EXIT_WRITE_DR4]                    = dr_interception,
3288         [SVM_EXIT_WRITE_DR5]                    = dr_interception,
3289         [SVM_EXIT_WRITE_DR6]                    = dr_interception,
3290         [SVM_EXIT_WRITE_DR7]                    = dr_interception,
3291         [SVM_EXIT_EXCP_BASE + DB_VECTOR]        = db_interception,
3292         [SVM_EXIT_EXCP_BASE + BP_VECTOR]        = bp_interception,
3293         [SVM_EXIT_EXCP_BASE + UD_VECTOR]        = ud_interception,
3294         [SVM_EXIT_EXCP_BASE + PF_VECTOR]        = pf_interception,
3295         [SVM_EXIT_EXCP_BASE + NM_VECTOR]        = nm_interception,
3296         [SVM_EXIT_EXCP_BASE + MC_VECTOR]        = mc_interception,
3297         [SVM_EXIT_INTR]                         = intr_interception,
3298         [SVM_EXIT_NMI]                          = nmi_interception,
3299         [SVM_EXIT_SMI]                          = nop_on_interception,
3300         [SVM_EXIT_INIT]                         = nop_on_interception,
3301         [SVM_EXIT_VINTR]                        = interrupt_window_interception,
3302         [SVM_EXIT_RDPMC]                        = rdpmc_interception,
3303         [SVM_EXIT_CPUID]                        = cpuid_interception,
3304         [SVM_EXIT_IRET]                         = iret_interception,
3305         [SVM_EXIT_INVD]                         = emulate_on_interception,
3306         [SVM_EXIT_PAUSE]                        = pause_interception,
3307         [SVM_EXIT_HLT]                          = halt_interception,
3308         [SVM_EXIT_INVLPG]                       = invlpg_interception,
3309         [SVM_EXIT_INVLPGA]                      = invlpga_interception,
3310         [SVM_EXIT_IOIO]                         = io_interception,
3311         [SVM_EXIT_MSR]                          = msr_interception,
3312         [SVM_EXIT_TASK_SWITCH]                  = task_switch_interception,
3313         [SVM_EXIT_SHUTDOWN]                     = shutdown_interception,
3314         [SVM_EXIT_VMRUN]                        = vmrun_interception,
3315         [SVM_EXIT_VMMCALL]                      = vmmcall_interception,
3316         [SVM_EXIT_VMLOAD]                       = vmload_interception,
3317         [SVM_EXIT_VMSAVE]                       = vmsave_interception,
3318         [SVM_EXIT_STGI]                         = stgi_interception,
3319         [SVM_EXIT_CLGI]                         = clgi_interception,
3320         [SVM_EXIT_SKINIT]                       = skinit_interception,
3321         [SVM_EXIT_WBINVD]                       = emulate_on_interception,
3322         [SVM_EXIT_MONITOR]                      = invalid_op_interception,
3323         [SVM_EXIT_MWAIT]                        = invalid_op_interception,
3324         [SVM_EXIT_XSETBV]                       = xsetbv_interception,
3325         [SVM_EXIT_NPF]                          = pf_interception,
3326 };
3327
3328 static void dump_vmcb(struct kvm_vcpu *vcpu)
3329 {
3330         struct vcpu_svm *svm = to_svm(vcpu);
3331         struct vmcb_control_area *control = &svm->vmcb->control;
3332         struct vmcb_save_area *save = &svm->vmcb->save;
3333
3334         pr_err("VMCB Control Area:\n");
3335         pr_err("%-20s%04x\n", "cr_read:", control->intercept_cr & 0xffff);
3336         pr_err("%-20s%04x\n", "cr_write:", control->intercept_cr >> 16);
3337         pr_err("%-20s%04x\n", "dr_read:", control->intercept_dr & 0xffff);
3338         pr_err("%-20s%04x\n", "dr_write:", control->intercept_dr >> 16);
3339         pr_err("%-20s%08x\n", "exceptions:", control->intercept_exceptions);
3340         pr_err("%-20s%016llx\n", "intercepts:", control->intercept);
3341         pr_err("%-20s%d\n", "pause filter count:", control->pause_filter_count);
3342         pr_err("%-20s%016llx\n", "iopm_base_pa:", control->iopm_base_pa);
3343         pr_err("%-20s%016llx\n", "msrpm_base_pa:", control->msrpm_base_pa);
3344         pr_err("%-20s%016llx\n", "tsc_offset:", control->tsc_offset);
3345         pr_err("%-20s%d\n", "asid:", control->asid);
3346         pr_err("%-20s%d\n", "tlb_ctl:", control->tlb_ctl);
3347         pr_err("%-20s%08x\n", "int_ctl:", control->int_ctl);
3348         pr_err("%-20s%08x\n", "int_vector:", control->int_vector);
3349         pr_err("%-20s%08x\n", "int_state:", control->int_state);
3350         pr_err("%-20s%08x\n", "exit_code:", control->exit_code);
3351         pr_err("%-20s%016llx\n", "exit_info1:", control->exit_info_1);
3352         pr_err("%-20s%016llx\n", "exit_info2:", control->exit_info_2);
3353         pr_err("%-20s%08x\n", "exit_int_info:", control->exit_int_info);
3354         pr_err("%-20s%08x\n", "exit_int_info_err:", control->exit_int_info_err);
3355         pr_err("%-20s%lld\n", "nested_ctl:", control->nested_ctl);
3356         pr_err("%-20s%016llx\n", "nested_cr3:", control->nested_cr3);
3357         pr_err("%-20s%08x\n", "event_inj:", control->event_inj);
3358         pr_err("%-20s%08x\n", "event_inj_err:", control->event_inj_err);
3359         pr_err("%-20s%lld\n", "lbr_ctl:", control->lbr_ctl);
3360         pr_err("%-20s%016llx\n", "next_rip:", control->next_rip);
3361         pr_err("VMCB State Save Area:\n");
3362         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3363                "es:",
3364                save->es.selector, save->es.attrib,
3365                save->es.limit, save->es.base);
3366         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3367                "cs:",
3368                save->cs.selector, save->cs.attrib,
3369                save->cs.limit, save->cs.base);
3370         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3371                "ss:",
3372                save->ss.selector, save->ss.attrib,
3373                save->ss.limit, save->ss.base);
3374         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3375                "ds:",
3376                save->ds.selector, save->ds.attrib,
3377                save->ds.limit, save->ds.base);
3378         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3379                "fs:",
3380                save->fs.selector, save->fs.attrib,
3381                save->fs.limit, save->fs.base);
3382         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3383                "gs:",
3384                save->gs.selector, save->gs.attrib,
3385                save->gs.limit, save->gs.base);
3386         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3387                "gdtr:",
3388                save->gdtr.selector, save->gdtr.attrib,
3389                save->gdtr.limit, save->gdtr.base);
3390         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3391                "ldtr:",
3392                save->ldtr.selector, save->ldtr.attrib,
3393                save->ldtr.limit, save->ldtr.base);
3394         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3395                "idtr:",
3396                save->idtr.selector, save->idtr.attrib,
3397                save->idtr.limit, save->idtr.base);
3398         pr_err("%-5s s: %04x a: %04x l: %08x b: %016llx\n",
3399                "tr:",
3400                save->tr.selector, save->tr.attrib,
3401                save->tr.limit, save->tr.base);
3402         pr_err("cpl:            %d                efer:         %016llx\n",
3403                 save->cpl, save->efer);
3404         pr_err("%-15s %016llx %-13s %016llx\n",
3405                "cr0:", save->cr0, "cr2:", save->cr2);
3406         pr_err("%-15s %016llx %-13s %016llx\n",
3407                "cr3:", save->cr3, "cr4:", save->cr4);
3408         pr_err("%-15s %016llx %-13s %016llx\n",
3409                "dr6:", save->dr6, "dr7:", save->dr7);
3410         pr_err("%-15s %016llx %-13s %016llx\n",
3411                "rip:", save->rip, "rflags:", save->rflags);
3412         pr_err("%-15s %016llx %-13s %016llx\n",
3413                "rsp:", save->rsp, "rax:", save->rax);
3414         pr_err("%-15s %016llx %-13s %016llx\n",
3415                "star:", save->star, "lstar:", save->lstar);
3416         pr_err("%-15s %016llx %-13s %016llx\n",
3417                "cstar:", save->cstar, "sfmask:", save->sfmask);
3418         pr_err("%-15s %016llx %-13s %016llx\n",
3419                "kernel_gs_base:", save->kernel_gs_base,
3420                "sysenter_cs:", save->sysenter_cs);
3421         pr_err("%-15s %016llx %-13s %016llx\n",
3422                "sysenter_esp:", save->sysenter_esp,
3423                "sysenter_eip:", save->sysenter_eip);
3424         pr_err("%-15s %016llx %-13s %016llx\n",
3425                "gpat:", save->g_pat, "dbgctl:", save->dbgctl);
3426         pr_err("%-15s %016llx %-13s %016llx\n",
3427                "br_from:", save->br_from, "br_to:", save->br_to);
3428         pr_err("%-15s %016llx %-13s %016llx\n",
3429                "excp_from:", save->last_excp_from,
3430                "excp_to:", save->last_excp_to);
3431 }
3432
3433 static void svm_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
3434 {
3435         struct vmcb_control_area *control = &to_svm(vcpu)->vmcb->control;
3436
3437         *info1 = control->exit_info_1;
3438         *info2 = control->exit_info_2;
3439 }
3440
3441 static int handle_exit(struct kvm_vcpu *vcpu)
3442 {
3443         struct vcpu_svm *svm = to_svm(vcpu);
3444         struct kvm_run *kvm_run = vcpu->run;
3445         u32 exit_code = svm->vmcb->control.exit_code;
3446
3447         if (!is_cr_intercept(svm, INTERCEPT_CR0_WRITE))
3448                 vcpu->arch.cr0 = svm->vmcb->save.cr0;
3449         if (npt_enabled)
3450                 vcpu->arch.cr3 = svm->vmcb->save.cr3;
3451
3452         if (unlikely(svm->nested.exit_required)) {
3453                 nested_svm_vmexit(svm);
3454                 svm->nested.exit_required = false;
3455
3456                 return 1;
3457         }
3458
3459         if (is_guest_mode(vcpu)) {
3460                 int vmexit;
3461
3462                 trace_kvm_nested_vmexit(svm->vmcb->save.rip, exit_code,
3463                                         svm->vmcb->control.exit_info_1,
3464                                         svm->vmcb->control.exit_info_2,
3465                                         svm->vmcb->control.exit_int_info,
3466                                         svm->vmcb->control.exit_int_info_err,
3467                                         KVM_ISA_SVM);
3468
3469                 vmexit = nested_svm_exit_special(svm);
3470
3471                 if (vmexit == NESTED_EXIT_CONTINUE)
3472                         vmexit = nested_svm_exit_handled(svm);
3473
3474                 if (vmexit == NESTED_EXIT_DONE)
3475                         return 1;
3476         }
3477
3478         svm_complete_interrupts(svm);
3479
3480         if (svm->vmcb->control.exit_code == SVM_EXIT_ERR) {
3481                 kvm_run->exit_reason = KVM_EXIT_FAIL_ENTRY;
3482                 kvm_run->fail_entry.hardware_entry_failure_reason
3483                         = svm->vmcb->control.exit_code;
3484                 pr_err("KVM: FAILED VMRUN WITH VMCB:\n");
3485                 dump_vmcb(vcpu);
3486                 return 0;
3487         }
3488
3489         if (is_external_interrupt(svm->vmcb->control.exit_int_info) &&
3490             exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR &&
3491             exit_code != SVM_EXIT_NPF && exit_code != SVM_EXIT_TASK_SWITCH &&
3492             exit_code != SVM_EXIT_INTR && exit_code != SVM_EXIT_NMI)
3493                 printk(KERN_ERR "%s: unexpected exit_int_info 0x%x "
3494                        "exit_code 0x%x\n",
3495                        __func__, svm->vmcb->control.exit_int_info,
3496                        exit_code);
3497
3498         if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
3499             || !svm_exit_handlers[exit_code]) {
3500                 kvm_run->exit_reason = KVM_EXIT_UNKNOWN;
3501                 kvm_run->hw.hardware_exit_reason = exit_code;
3502                 return 0;
3503         }
3504
3505         return svm_exit_handlers[exit_code](svm);
3506 }
3507
3508 static void reload_tss(struct kvm_vcpu *vcpu)
3509 {
3510         int cpu = raw_smp_processor_id();
3511
3512         struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
3513         sd->tss_desc->type = 9; /* available 32/64-bit TSS */
3514         load_TR_desc();
3515 }
3516
3517 static void pre_svm_run(struct vcpu_svm *svm)
3518 {
3519         int cpu = raw_smp_processor_id();
3520
3521         struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
3522
3523         /* FIXME: handle wraparound of asid_generation */
3524         if (svm->asid_generation != sd->asid_generation)
3525                 new_asid(svm, sd);
3526 }
3527
3528 static void svm_inject_nmi(struct kvm_vcpu *vcpu)
3529 {
3530         struct vcpu_svm *svm = to_svm(vcpu);
3531
3532         svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
3533         vcpu->arch.hflags |= HF_NMI_MASK;
3534         set_intercept(svm, INTERCEPT_IRET);
3535         ++vcpu->stat.nmi_injections;
3536 }
3537
3538 static inline void svm_inject_irq(struct vcpu_svm *svm, int irq)
3539 {
3540         struct vmcb_control_area *control;
3541
3542         control = &svm->vmcb->control;
3543         control->int_vector = irq;
3544         control->int_ctl &= ~V_INTR_PRIO_MASK;
3545         control->int_ctl |= V_IRQ_MASK |
3546                 ((/*control->int_vector >> 4*/ 0xf) << V_INTR_PRIO_SHIFT);
3547         mark_dirty(svm->vmcb, VMCB_INTR);
3548 }
3549
3550 static void svm_set_irq(struct kvm_vcpu *vcpu)
3551 {
3552         struct vcpu_svm *svm = to_svm(vcpu);
3553
3554         BUG_ON(!(gif_set(svm)));
3555
3556         trace_kvm_inj_virq(vcpu->arch.interrupt.nr);
3557         ++vcpu->stat.irq_injections;
3558
3559         svm->vmcb->control.event_inj = vcpu->arch.interrupt.nr |
3560                 SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR;
3561 }
3562
3563 static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
3564 {
3565         struct vcpu_svm *svm = to_svm(vcpu);
3566
3567         if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
3568                 return;
3569
3570         if (irr == -1)
3571                 return;
3572
3573         if (tpr >= irr)
3574                 set_cr_intercept(svm, INTERCEPT_CR8_WRITE);
3575 }
3576
3577 static void svm_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
3578 {
3579         return;
3580 }
3581
3582 static int svm_vm_has_apicv(struct kvm *kvm)
3583 {
3584         return 0;
3585 }
3586
3587 static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
3588 {
3589         return;
3590 }
3591
3592 static void svm_hwapic_isr_update(struct kvm *kvm, int isr)
3593 {
3594         return;
3595 }
3596
3597 static void svm_sync_pir_to_irr(struct kvm_vcpu *vcpu)
3598 {
3599         return;
3600 }
3601
3602 static int svm_nmi_allowed(struct kvm_vcpu *vcpu)
3603 {
3604         struct vcpu_svm *svm = to_svm(vcpu);
3605         struct vmcb *vmcb = svm->vmcb;
3606         int ret;
3607         ret = !(vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK) &&
3608               !(svm->vcpu.arch.hflags & HF_NMI_MASK);
3609         ret = ret && gif_set(svm) && nested_svm_nmi(svm);
3610
3611         return ret;
3612 }
3613
3614 static bool svm_get_nmi_mask(struct kvm_vcpu *vcpu)
3615 {
3616         struct vcpu_svm *svm = to_svm(vcpu);
3617
3618         return !!(svm->vcpu.arch.hflags & HF_NMI_MASK);
3619 }
3620
3621 static void svm_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
3622 {
3623         struct vcpu_svm *svm = to_svm(vcpu);
3624
3625         if (masked) {
3626                 svm->vcpu.arch.hflags |= HF_NMI_MASK;
3627                 set_intercept(svm, INTERCEPT_IRET);
3628         } else {
3629                 svm->vcpu.arch.hflags &= ~HF_NMI_MASK;
3630                 clr_intercept(svm, INTERCEPT_IRET);
3631         }
3632 }
3633
3634 static int svm_interrupt_allowed(struct kvm_vcpu *vcpu)
3635 {
3636         struct vcpu_svm *svm = to_svm(vcpu);
3637         struct vmcb *vmcb = svm->vmcb;
3638         int ret;
3639
3640         if (!gif_set(svm) ||
3641              (vmcb->control.int_state & SVM_INTERRUPT_SHADOW_MASK))
3642                 return 0;
3643
3644         ret = !!(kvm_get_rflags(vcpu) & X86_EFLAGS_IF);
3645
3646         if (is_guest_mode(vcpu))
3647                 return ret && !(svm->vcpu.arch.hflags & HF_VINTR_MASK);
3648
3649         return ret;
3650 }
3651
3652 static void enable_irq_window(struct kvm_vcpu *vcpu)
3653 {
3654         struct vcpu_svm *svm = to_svm(vcpu);
3655
3656         /*
3657          * In case GIF=0 we can't rely on the CPU to tell us when GIF becomes
3658          * 1, because that's a separate STGI/VMRUN intercept.  The next time we
3659          * get that intercept, this function will be called again though and
3660          * we'll get the vintr intercept.
3661          */
3662         if (gif_set(svm) && nested_svm_intr(svm)) {
3663                 svm_set_vintr(svm);
3664                 svm_inject_irq(svm, 0x0);
3665         }
3666 }
3667
3668 static void enable_nmi_window(struct kvm_vcpu *vcpu)
3669 {
3670         struct vcpu_svm *svm = to_svm(vcpu);
3671
3672         if ((svm->vcpu.arch.hflags & (HF_NMI_MASK | HF_IRET_MASK))
3673             == HF_NMI_MASK)
3674                 return; /* IRET will cause a vm exit */
3675
3676         /*
3677          * Something prevents NMI from been injected. Single step over possible
3678          * problem (IRET or exception injection or interrupt shadow)
3679          */
3680         svm->nmi_singlestep = true;
3681         svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
3682         update_db_bp_intercept(vcpu);
3683 }
3684
3685 static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
3686 {
3687         return 0;
3688 }
3689
3690 static void svm_flush_tlb(struct kvm_vcpu *vcpu)
3691 {
3692         struct vcpu_svm *svm = to_svm(vcpu);
3693
3694         if (static_cpu_has(X86_FEATURE_FLUSHBYASID))
3695                 svm->vmcb->control.tlb_ctl = TLB_CONTROL_FLUSH_ASID;
3696         else
3697                 svm->asid_generation--;
3698 }
3699
3700 static void svm_prepare_guest_switch(struct kvm_vcpu *vcpu)
3701 {
3702 }
3703
3704 static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
3705 {
3706         struct vcpu_svm *svm = to_svm(vcpu);
3707
3708         if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
3709                 return;
3710
3711         if (!is_cr_intercept(svm, INTERCEPT_CR8_WRITE)) {
3712                 int cr8 = svm->vmcb->control.int_ctl & V_TPR_MASK;
3713                 kvm_set_cr8(vcpu, cr8);
3714         }
3715 }
3716
3717 static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu)
3718 {
3719         struct vcpu_svm *svm = to_svm(vcpu);
3720         u64 cr8;
3721
3722         if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
3723                 return;
3724
3725         cr8 = kvm_get_cr8(vcpu);
3726         svm->vmcb->control.int_ctl &= ~V_TPR_MASK;
3727         svm->vmcb->control.int_ctl |= cr8 & V_TPR_MASK;
3728 }
3729
3730 static void svm_complete_interrupts(struct vcpu_svm *svm)
3731 {
3732         u8 vector;
3733         int type;
3734         u32 exitintinfo = svm->vmcb->control.exit_int_info;
3735         unsigned int3_injected = svm->int3_injected;
3736
3737         svm->int3_injected = 0;
3738
3739         /*
3740          * If we've made progress since setting HF_IRET_MASK, we've
3741          * executed an IRET and can allow NMI injection.
3742          */
3743         if ((svm->vcpu.arch.hflags & HF_IRET_MASK)
3744             && kvm_rip_read(&svm->vcpu) != svm->nmi_iret_rip) {
3745                 svm->vcpu.arch.hflags &= ~(HF_NMI_MASK | HF_IRET_MASK);
3746                 kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3747         }
3748
3749         svm->vcpu.arch.nmi_injected = false;
3750         kvm_clear_exception_queue(&svm->vcpu);
3751         kvm_clear_interrupt_queue(&svm->vcpu);
3752
3753         if (!(exitintinfo & SVM_EXITINTINFO_VALID))
3754                 return;
3755
3756         kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
3757
3758         vector = exitintinfo & SVM_EXITINTINFO_VEC_MASK;
3759         type = exitintinfo & SVM_EXITINTINFO_TYPE_MASK;
3760
3761         switch (type) {
3762         case SVM_EXITINTINFO_TYPE_NMI:
3763                 svm->vcpu.arch.nmi_injected = true;
3764                 break;
3765         case SVM_EXITINTINFO_TYPE_EXEPT:
3766                 /*
3767                  * In case of software exceptions, do not reinject the vector,
3768                  * but re-execute the instruction instead. Rewind RIP first
3769                  * if we emulated INT3 before.
3770                  */
3771                 if (kvm_exception_is_soft(vector)) {
3772                         if (vector == BP_VECTOR && int3_injected &&
3773                             kvm_is_linear_rip(&svm->vcpu, svm->int3_rip))
3774                                 kvm_rip_write(&svm->vcpu,
3775                                               kvm_rip_read(&svm->vcpu) -
3776                                               int3_injected);
3777                         break;
3778                 }
3779                 if (exitintinfo & SVM_EXITINTINFO_VALID_ERR) {
3780                         u32 err = svm->vmcb->control.exit_int_info_err;
3781                         kvm_requeue_exception_e(&svm->vcpu, vector, err);
3782
3783                 } else
3784                         kvm_requeue_exception(&svm->vcpu, vector);
3785                 break;
3786         case SVM_EXITINTINFO_TYPE_INTR:
3787                 kvm_queue_interrupt(&svm->vcpu, vector, false);
3788                 break;
3789         default:
3790                 break;
3791         }
3792 }
3793
3794 static void svm_cancel_injection(struct kvm_vcpu *vcpu)
3795 {
3796         struct vcpu_svm *svm = to_svm(vcpu);
3797         struct vmcb_control_area *control = &svm->vmcb->control;
3798
3799         control->exit_int_info = control->event_inj;
3800         control->exit_int_info_err = control->event_inj_err;
3801         control->event_inj = 0;
3802         svm_complete_interrupts(svm);
3803 }
3804
3805 static void svm_vcpu_run(struct kvm_vcpu *vcpu)
3806 {
3807         struct vcpu_svm *svm = to_svm(vcpu);
3808
3809         svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
3810         svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
3811         svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];
3812
3813         /*
3814          * A vmexit emulation is required before the vcpu can be executed
3815          * again.
3816          */
3817         if (unlikely(svm->nested.exit_required))
3818                 return;
3819
3820         pre_svm_run(svm);
3821
3822         sync_lapic_to_cr8(vcpu);
3823
3824         svm->vmcb->save.cr2 = vcpu->arch.cr2;
3825
3826         clgi();
3827
3828         local_irq_enable();
3829
3830         asm volatile (
3831                 "push %%" _ASM_BP "; \n\t"
3832                 "mov %c[rbx](%[svm]), %%" _ASM_BX " \n\t"
3833                 "mov %c[rcx](%[svm]), %%" _ASM_CX " \n\t"
3834                 "mov %c[rdx](%[svm]), %%" _ASM_DX " \n\t"
3835                 "mov %c[rsi](%[svm]), %%" _ASM_SI " \n\t"
3836                 "mov %c[rdi](%[svm]), %%" _ASM_DI " \n\t"
3837                 "mov %c[rbp](%[svm]), %%" _ASM_BP " \n\t"
3838 #ifdef CONFIG_X86_64
3839                 "mov %c[r8](%[svm]),  %%r8  \n\t"
3840                 "mov %c[r9](%[svm]),  %%r9  \n\t"
3841                 "mov %c[r10](%[svm]), %%r10 \n\t"
3842                 "mov %c[r11](%[svm]), %%r11 \n\t"
3843                 "mov %c[r12](%[svm]), %%r12 \n\t"
3844                 "mov %c[r13](%[svm]), %%r13 \n\t"
3845                 "mov %c[r14](%[svm]), %%r14 \n\t"
3846                 "mov %c[r15](%[svm]), %%r15 \n\t"
3847 #endif
3848
3849                 /* Enter guest mode */
3850                 "push %%" _ASM_AX " \n\t"
3851                 "mov %c[vmcb](%[svm]), %%" _ASM_AX " \n\t"
3852                 __ex(SVM_VMLOAD) "\n\t"
3853                 __ex(SVM_VMRUN) "\n\t"
3854                 __ex(SVM_VMSAVE) "\n\t"
3855                 "pop %%" _ASM_AX " \n\t"
3856
3857                 /* Save guest registers, load host registers */
3858                 "mov %%" _ASM_BX ", %c[rbx](%[svm]) \n\t"
3859                 "mov %%" _ASM_CX ", %c[rcx](%[svm]) \n\t"
3860                 "mov %%" _ASM_DX ", %c[rdx](%[svm]) \n\t"
3861                 "mov %%" _ASM_SI ", %c[rsi](%[svm]) \n\t"
3862                 "mov %%" _ASM_DI ", %c[rdi](%[svm]) \n\t"
3863                 "mov %%" _ASM_BP ", %c[rbp](%[svm]) \n\t"
3864 #ifdef CONFIG_X86_64
3865                 "mov %%r8,  %c[r8](%[svm]) \n\t"
3866                 "mov %%r9,  %c[r9](%[svm]) \n\t"
3867                 "mov %%r10, %c[r10](%[svm]) \n\t"
3868                 "mov %%r11, %c[r11](%[svm]) \n\t"
3869                 "mov %%r12, %c[r12](%[svm]) \n\t"
3870                 "mov %%r13, %c[r13](%[svm]) \n\t"
3871                 "mov %%r14, %c[r14](%[svm]) \n\t"
3872                 "mov %%r15, %c[r15](%[svm]) \n\t"
3873 #endif
3874                 "pop %%" _ASM_BP
3875                 :
3876                 : [svm]"a"(svm),
3877                   [vmcb]"i"(offsetof(struct vcpu_svm, vmcb_pa)),
3878                   [rbx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBX])),
3879                   [rcx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RCX])),
3880                   [rdx]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDX])),
3881                   [rsi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RSI])),
3882                   [rdi]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RDI])),
3883                   [rbp]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_RBP]))
3884 #ifdef CONFIG_X86_64
3885                   , [r8]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R8])),
3886                   [r9]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R9])),
3887                   [r10]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R10])),
3888                   [r11]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R11])),
3889                   [r12]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R12])),
3890                   [r13]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R13])),
3891                   [r14]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R14])),
3892                   [r15]"i"(offsetof(struct vcpu_svm, vcpu.arch.regs[VCPU_REGS_R15]))
3893 #endif
3894                 : "cc", "memory"
3895 #ifdef CONFIG_X86_64
3896                 , "rbx", "rcx", "rdx", "rsi", "rdi"
3897                 , "r8", "r9", "r10", "r11" , "r12", "r13", "r14", "r15"
3898 #else
3899                 , "ebx", "ecx", "edx", "esi", "edi"
3900 #endif
3901                 );
3902
3903 #ifdef CONFIG_X86_64
3904         wrmsrl(MSR_GS_BASE, svm->host.gs_base);
3905 #else
3906         loadsegment(fs, svm->host.fs);
3907 #ifndef CONFIG_X86_32_LAZY_GS
3908         loadsegment(gs, svm->host.gs);
3909 #endif
3910 #endif
3911
3912         reload_tss(vcpu);
3913
3914         local_irq_disable();
3915
3916         vcpu->arch.cr2 = svm->vmcb->save.cr2;
3917         vcpu->arch.regs[VCPU_REGS_RAX] = svm->vmcb->save.rax;
3918         vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
3919         vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
3920
3921         trace_kvm_exit(svm->vmcb->control.exit_code, vcpu, KVM_ISA_SVM);
3922
3923         if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
3924                 kvm_before_handle_nmi(&svm->vcpu);
3925
3926         stgi();
3927
3928         /* Any pending NMI will happen here */
3929
3930         if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
3931                 kvm_after_handle_nmi(&svm->vcpu);
3932
3933         sync_cr8_to_lapic(vcpu);
3934
3935         svm->next_rip = 0;
3936
3937         svm->vmcb->control.tlb_ctl = TLB_CONTROL_DO_NOTHING;
3938
3939         /* if exit due to PF check for async PF */
3940         if (svm->vmcb->control.exit_code == SVM_EXIT_EXCP_BASE + PF_VECTOR)
3941                 svm->apf_reason = kvm_read_and_reset_pf_reason();
3942
3943         if (npt_enabled) {
3944                 vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
3945                 vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
3946         }
3947
3948         /*
3949          * We need to handle MC intercepts here before the vcpu has a chance to
3950          * change the physical cpu
3951          */
3952         if (unlikely(svm->vmcb->control.exit_code ==
3953                      SVM_EXIT_EXCP_BASE + MC_VECTOR))
3954                 svm_handle_mce(svm);
3955
3956         mark_all_clean(svm->vmcb);
3957 }
3958
3959 static void svm_set_cr3(struct kvm_vcpu *vcpu, unsigned long root)
3960 {
3961         struct vcpu_svm *svm = to_svm(vcpu);
3962
3963         svm->vmcb->save.cr3 = root;
3964         mark_dirty(svm->vmcb, VMCB_CR);
3965         svm_flush_tlb(vcpu);
3966 }
3967
3968 static void set_tdp_cr3(struct kvm_vcpu *vcpu, unsigned long root)
3969 {
3970         struct vcpu_svm *svm = to_svm(vcpu);
3971
3972         svm->vmcb->control.nested_cr3 = root;
3973         mark_dirty(svm->vmcb, VMCB_NPT);
3974
3975         /* Also sync guest cr3 here in case we live migrate */
3976         svm->vmcb->save.cr3 = kvm_read_cr3(vcpu);
3977         mark_dirty(svm->vmcb, VMCB_CR);
3978
3979         svm_flush_tlb(vcpu);
3980 }
3981
3982 static int is_disabled(void)
3983 {
3984         u64 vm_cr;
3985
3986         rdmsrl(MSR_VM_CR, vm_cr);
3987         if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE))
3988                 return 1;
3989
3990         return 0;
3991 }
3992
3993 static void
3994 svm_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
3995 {
3996         /*
3997          * Patch in the VMMCALL instruction:
3998          */
3999         hypercall[0] = 0x0f;
4000         hypercall[1] = 0x01;
4001         hypercall[2] = 0xd9;
4002 }
4003
4004 static void svm_check_processor_compat(void *rtn)
4005 {
4006         *(int *)rtn = 0;
4007 }
4008
4009 static bool svm_cpu_has_accelerated_tpr(void)
4010 {
4011         return false;
4012 }
4013
4014 static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
4015 {
4016         return 0;
4017 }
4018
4019 static void svm_cpuid_update(struct kvm_vcpu *vcpu)
4020 {
4021 }
4022
4023 static void svm_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
4024 {
4025         switch (func) {
4026         case 0x80000001:
4027                 if (nested)
4028                         entry->ecx |= (1 << 2); /* Set SVM bit */
4029                 break;
4030         case 0x8000000A:
4031                 entry->eax = 1; /* SVM revision 1 */
4032                 entry->ebx = 8; /* Lets support 8 ASIDs in case we add proper
4033                                    ASID emulation to nested SVM */
4034                 entry->ecx = 0; /* Reserved */
4035                 entry->edx = 0; /* Per default do not support any
4036                                    additional features */
4037
4038                 /* Support next_rip if host supports it */
4039                 if (boot_cpu_has(X86_FEATURE_NRIPS))
4040                         entry->edx |= SVM_FEATURE_NRIP;
4041
4042                 /* Support NPT for the guest if enabled */
4043                 if (npt_enabled)
4044                         entry->edx |= SVM_FEATURE_NPT;
4045
4046                 break;
4047         }
4048 }
4049
4050 static int svm_get_lpage_level(void)
4051 {
4052         return PT_PDPE_LEVEL;
4053 }
4054
4055 static bool svm_rdtscp_supported(void)
4056 {
4057         return false;
4058 }
4059
4060 static bool svm_invpcid_supported(void)
4061 {
4062         return false;
4063 }
4064
4065 static bool svm_has_wbinvd_exit(void)
4066 {
4067         return true;
4068 }
4069
4070 static void svm_fpu_deactivate(struct kvm_vcpu *vcpu)
4071 {
4072         struct vcpu_svm *svm = to_svm(vcpu);
4073
4074         set_exception_intercept(svm, NM_VECTOR);
4075         update_cr0_intercept(svm);
4076 }
4077
4078 #define PRE_EX(exit)  { .exit_code = (exit), \
4079                         .stage = X86_ICPT_PRE_EXCEPT, }
4080 #define POST_EX(exit) { .exit_code = (exit), \
4081                         .stage = X86_ICPT_POST_EXCEPT, }
4082 #define POST_MEM(exit) { .exit_code = (exit), \
4083                         .stage = X86_ICPT_POST_MEMACCESS, }
4084
4085 static const struct __x86_intercept {
4086         u32 exit_code;
4087         enum x86_intercept_stage stage;
4088 } x86_intercept_map[] = {
4089         [x86_intercept_cr_read]         = POST_EX(SVM_EXIT_READ_CR0),
4090         [x86_intercept_cr_write]        = POST_EX(SVM_EXIT_WRITE_CR0),
4091         [x86_intercept_clts]            = POST_EX(SVM_EXIT_WRITE_CR0),
4092         [x86_intercept_lmsw]            = POST_EX(SVM_EXIT_WRITE_CR0),
4093         [x86_intercept_smsw]            = POST_EX(SVM_EXIT_READ_CR0),
4094         [x86_intercept_dr_read]         = POST_EX(SVM_EXIT_READ_DR0),
4095         [x86_intercept_dr_write]        = POST_EX(SVM_EXIT_WRITE_DR0),
4096         [x86_intercept_sldt]            = POST_EX(SVM_EXIT_LDTR_READ),
4097         [x86_intercept_str]             = POST_EX(SVM_EXIT_TR_READ),
4098         [x86_intercept_lldt]            = POST_EX(SVM_EXIT_LDTR_WRITE),
4099         [x86_intercept_ltr]             = POST_EX(SVM_EXIT_TR_WRITE),
4100         [x86_intercept_sgdt]            = POST_EX(SVM_EXIT_GDTR_READ),
4101         [x86_intercept_sidt]            = POST_EX(SVM_EXIT_IDTR_READ),
4102         [x86_intercept_lgdt]            = POST_EX(SVM_EXIT_GDTR_WRITE),
4103         [x86_intercept_lidt]            = POST_EX(SVM_EXIT_IDTR_WRITE),
4104         [x86_intercept_vmrun]           = POST_EX(SVM_EXIT_VMRUN),
4105         [x86_intercept_vmmcall]         = POST_EX(SVM_EXIT_VMMCALL),
4106         [x86_intercept_vmload]          = POST_EX(SVM_EXIT_VMLOAD),
4107         [x86_intercept_vmsave]          = POST_EX(SVM_EXIT_VMSAVE),
4108         [x86_intercept_stgi]            = POST_EX(SVM_EXIT_STGI),
4109         [x86_intercept_clgi]            = POST_EX(SVM_EXIT_CLGI),
4110         [x86_intercept_skinit]          = POST_EX(SVM_EXIT_SKINIT),
4111         [x86_intercept_invlpga]         = POST_EX(SVM_EXIT_INVLPGA),
4112         [x86_intercept_rdtscp]          = POST_EX(SVM_EXIT_RDTSCP),
4113         [x86_intercept_monitor]         = POST_MEM(SVM_EXIT_MONITOR),
4114         [x86_intercept_mwait]           = POST_EX(SVM_EXIT_MWAIT),
4115         [x86_intercept_invlpg]          = POST_EX(SVM_EXIT_INVLPG),
4116         [x86_intercept_invd]            = POST_EX(SVM_EXIT_INVD),
4117         [x86_intercept_wbinvd]          = POST_EX(SVM_EXIT_WBINVD),
4118         [x86_intercept_wrmsr]           = POST_EX(SVM_EXIT_MSR),
4119         [x86_intercept_rdtsc]           = POST_EX(SVM_EXIT_RDTSC),
4120         [x86_intercept_rdmsr]           = POST_EX(SVM_EXIT_MSR),
4121         [x86_intercept_rdpmc]           = POST_EX(SVM_EXIT_RDPMC),
4122         [x86_intercept_cpuid]           = PRE_EX(SVM_EXIT_CPUID),
4123         [x86_intercept_rsm]             = PRE_EX(SVM_EXIT_RSM),
4124         [x86_intercept_pause]           = PRE_EX(SVM_EXIT_PAUSE),
4125         [x86_intercept_pushf]           = PRE_EX(SVM_EXIT_PUSHF),
4126         [x86_intercept_popf]            = PRE_EX(SVM_EXIT_POPF),
4127         [x86_intercept_intn]            = PRE_EX(SVM_EXIT_SWINT),
4128         [x86_intercept_iret]            = PRE_EX(SVM_EXIT_IRET),
4129         [x86_intercept_icebp]           = PRE_EX(SVM_EXIT_ICEBP),
4130         [x86_intercept_hlt]             = POST_EX(SVM_EXIT_HLT),
4131         [x86_intercept_in]              = POST_EX(SVM_EXIT_IOIO),
4132         [x86_intercept_ins]             = POST_EX(SVM_EXIT_IOIO),
4133         [x86_intercept_out]             = POST_EX(SVM_EXIT_IOIO),
4134         [x86_intercept_outs]            = POST_EX(SVM_EXIT_IOIO),
4135 };
4136
4137 #undef PRE_EX
4138 #undef POST_EX
4139 #undef POST_MEM
4140
4141 static int svm_check_intercept(struct kvm_vcpu *vcpu,
4142                                struct x86_instruction_info *info,
4143                                enum x86_intercept_stage stage)
4144 {
4145         struct vcpu_svm *svm = to_svm(vcpu);
4146         int vmexit, ret = X86EMUL_CONTINUE;
4147         struct __x86_intercept icpt_info;
4148         struct vmcb *vmcb = svm->vmcb;
4149
4150         if (info->intercept >= ARRAY_SIZE(x86_intercept_map))
4151                 goto out;
4152
4153         icpt_info = x86_intercept_map[info->intercept];
4154
4155         if (stage != icpt_info.stage)
4156                 goto out;
4157
4158         switch (icpt_info.exit_code) {
4159         case SVM_EXIT_READ_CR0:
4160                 if (info->intercept == x86_intercept_cr_read)
4161                         icpt_info.exit_code += info->modrm_reg;
4162                 break;
4163         case SVM_EXIT_WRITE_CR0: {
4164                 unsigned long cr0, val;
4165                 u64 intercept;
4166
4167                 if (info->intercept == x86_intercept_cr_write)
4168                         icpt_info.exit_code += info->modrm_reg;
4169
4170                 if (icpt_info.exit_code != SVM_EXIT_WRITE_CR0)
4171                         break;
4172
4173                 intercept = svm->nested.intercept;
4174
4175                 if (!(intercept & (1ULL << INTERCEPT_SELECTIVE_CR0)))
4176                         break;
4177
4178                 cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
4179                 val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;
4180
4181                 if (info->intercept == x86_intercept_lmsw) {
4182                         cr0 &= 0xfUL;
4183                         val &= 0xfUL;
4184                         /* lmsw can't clear PE - catch this here */
4185                         if (cr0 & X86_CR0_PE)
4186                                 val |= X86_CR0_PE;
4187                 }
4188
4189                 if (cr0 ^ val)
4190                         icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;
4191
4192                 break;
4193         }
4194         case SVM_EXIT_READ_DR0:
4195         case SVM_EXIT_WRITE_DR0:
4196                 icpt_info.exit_code += info->modrm_reg;
4197                 break;
4198         case SVM_EXIT_MSR:
4199                 if (info->intercept == x86_intercept_wrmsr)
4200                         vmcb->control.exit_info_1 = 1;
4201                 else
4202                         vmcb->control.exit_info_1 = 0;
4203                 break;
4204         case SVM_EXIT_PAUSE:
4205                 /*
4206                  * We get this for NOP only, but pause
4207                  * is rep not, check this here
4208                  */
4209                 if (info->rep_prefix != REPE_PREFIX)
4210                         goto out;
4211         case SVM_EXIT_IOIO: {
4212                 u64 exit_info;
4213                 u32 bytes;
4214
4215                 exit_info = (vcpu->arch.regs[VCPU_REGS_RDX] & 0xffff) << 16;
4216
4217                 if (info->intercept == x86_intercept_in ||
4218                     info->intercept == x86_intercept_ins) {
4219                         exit_info |= SVM_IOIO_TYPE_MASK;
4220                         bytes = info->src_bytes;
4221                 } else {
4222                         bytes = info->dst_bytes;
4223                 }
4224
4225                 if (info->intercept == x86_intercept_outs ||
4226                     info->intercept == x86_intercept_ins)
4227                         exit_info |= SVM_IOIO_STR_MASK;
4228
4229                 if (info->rep_prefix)
4230                         exit_info |= SVM_IOIO_REP_MASK;
4231
4232                 bytes = min(bytes, 4u);
4233
4234                 exit_info |= bytes << SVM_IOIO_SIZE_SHIFT;
4235
4236                 exit_info |= (u32)info->ad_bytes << (SVM_IOIO_ASIZE_SHIFT - 1);
4237
4238                 vmcb->control.exit_info_1 = exit_info;
4239                 vmcb->control.exit_info_2 = info->next_rip;
4240
4241                 break;
4242         }
4243         default:
4244                 break;
4245         }
4246
4247         vmcb->control.next_rip  = info->next_rip;
4248         vmcb->control.exit_code = icpt_info.exit_code;
4249         vmexit = nested_svm_exit_handled(svm);
4250
4251         ret = (vmexit == NESTED_EXIT_DONE) ? X86EMUL_INTERCEPTED
4252                                            : X86EMUL_CONTINUE;
4253
4254 out:
4255         return ret;
4256 }
4257
4258 static void svm_handle_external_intr(struct kvm_vcpu *vcpu)
4259 {
4260         local_irq_enable();
4261 }
4262
4263 static struct kvm_x86_ops svm_x86_ops = {
4264         .cpu_has_kvm_support = has_svm,
4265         .disabled_by_bios = is_disabled,
4266         .hardware_setup = svm_hardware_setup,
4267         .hardware_unsetup = svm_hardware_unsetup,
4268         .check_processor_compatibility = svm_check_processor_compat,
4269         .hardware_enable = svm_hardware_enable,
4270         .hardware_disable = svm_hardware_disable,
4271         .cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr,
4272
4273         .vcpu_create = svm_create_vcpu,
4274         .vcpu_free = svm_free_vcpu,
4275         .vcpu_reset = svm_vcpu_reset,
4276
4277         .prepare_guest_switch = svm_prepare_guest_switch,
4278         .vcpu_load = svm_vcpu_load,
4279         .vcpu_put = svm_vcpu_put,
4280
4281         .update_db_bp_intercept = update_db_bp_intercept,
4282         .get_msr = svm_get_msr,
4283         .set_msr = svm_set_msr,
4284         .get_segment_base = svm_get_segment_base,
4285         .get_segment = svm_get_segment,
4286         .set_segment = svm_set_segment,
4287         .get_cpl = svm_get_cpl,
4288         .get_cs_db_l_bits = kvm_get_cs_db_l_bits,
4289         .decache_cr0_guest_bits = svm_decache_cr0_guest_bits,
4290         .decache_cr3 = svm_decache_cr3,
4291         .decache_cr4_guest_bits = svm_decache_cr4_guest_bits,
4292         .set_cr0 = svm_set_cr0,
4293         .set_cr3 = svm_set_cr3,
4294         .set_cr4 = svm_set_cr4,
4295         .set_efer = svm_set_efer,
4296         .get_idt = svm_get_idt,
4297         .set_idt = svm_set_idt,
4298         .get_gdt = svm_get_gdt,
4299         .set_gdt = svm_set_gdt,
4300         .get_dr6 = svm_get_dr6,
4301         .set_dr6 = svm_set_dr6,
4302         .set_dr7 = svm_set_dr7,
4303         .cache_reg = svm_cache_reg,
4304         .get_rflags = svm_get_rflags,
4305         .set_rflags = svm_set_rflags,
4306         .fpu_activate = svm_fpu_activate,
4307         .fpu_deactivate = svm_fpu_deactivate,
4308
4309         .tlb_flush = svm_flush_tlb,
4310
4311         .run = svm_vcpu_run,
4312         .handle_exit = handle_exit,
4313         .skip_emulated_instruction = skip_emulated_instruction,
4314         .set_interrupt_shadow = svm_set_interrupt_shadow,
4315         .get_interrupt_shadow = svm_get_interrupt_shadow,
4316         .patch_hypercall = svm_patch_hypercall,
4317         .set_irq = svm_set_irq,
4318         .set_nmi = svm_inject_nmi,
4319         .queue_exception = svm_queue_exception,
4320         .cancel_injection = svm_cancel_injection,
4321         .interrupt_allowed = svm_interrupt_allowed,
4322         .nmi_allowed = svm_nmi_allowed,
4323         .get_nmi_mask = svm_get_nmi_mask,
4324         .set_nmi_mask = svm_set_nmi_mask,
4325         .enable_nmi_window = enable_nmi_window,
4326         .enable_irq_window = enable_irq_window,
4327         .update_cr8_intercept = update_cr8_intercept,
4328         .set_virtual_x2apic_mode = svm_set_virtual_x2apic_mode,
4329         .vm_has_apicv = svm_vm_has_apicv,
4330         .load_eoi_exitmap = svm_load_eoi_exitmap,
4331         .hwapic_isr_update = svm_hwapic_isr_update,
4332         .sync_pir_to_irr = svm_sync_pir_to_irr,
4333
4334         .set_tss_addr = svm_set_tss_addr,
4335         .get_tdp_level = get_npt_level,
4336         .get_mt_mask = svm_get_mt_mask,
4337
4338         .get_exit_info = svm_get_exit_info,
4339
4340         .get_lpage_level = svm_get_lpage_level,
4341
4342         .cpuid_update = svm_cpuid_update,
4343
4344         .rdtscp_supported = svm_rdtscp_supported,
4345         .invpcid_supported = svm_invpcid_supported,
4346
4347         .set_supported_cpuid = svm_set_supported_cpuid,
4348
4349         .has_wbinvd_exit = svm_has_wbinvd_exit,
4350
4351         .set_tsc_khz = svm_set_tsc_khz,
4352         .read_tsc_offset = svm_read_tsc_offset,
4353         .write_tsc_offset = svm_write_tsc_offset,
4354         .adjust_tsc_offset = svm_adjust_tsc_offset,
4355         .compute_tsc_offset = svm_compute_tsc_offset,
4356         .read_l1_tsc = svm_read_l1_tsc,
4357
4358         .set_tdp_cr3 = set_tdp_cr3,
4359
4360         .check_intercept = svm_check_intercept,
4361         .handle_external_intr = svm_handle_external_intr,
4362 };
4363
4364 static int __init svm_init(void)
4365 {
4366         return kvm_init(&svm_x86_ops, sizeof(struct vcpu_svm),
4367                         __alignof__(struct vcpu_svm), THIS_MODULE);
4368 }
4369
4370 static void __exit svm_exit(void)
4371 {
4372         kvm_exit();
4373 }
4374
4375 module_init(svm_init)
4376 module_exit(svm_exit)