Loading...
1/*
2 * Kernel-based Virtual Machine driver for Linux
3 *
4 * This module enables machines with Intel VT-x extensions to run virtual
5 * machines without emulation or binary translation.
6 *
7 * Copyright (C) 2006 Qumranet, Inc.
8 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
9 *
10 * Authors:
11 * Avi Kivity <avi@qumranet.com>
12 * Yaniv Kamay <yaniv@qumranet.com>
13 *
14 * This work is licensed under the terms of the GNU GPL, version 2. See
15 * the COPYING file in the top-level directory.
16 *
17 */
18
19#include "iodev.h"
20
21#include <linux/kvm_host.h>
22#include <linux/kvm.h>
23#include <linux/module.h>
24#include <linux/errno.h>
25#include <linux/percpu.h>
26#include <linux/mm.h>
27#include <linux/miscdevice.h>
28#include <linux/vmalloc.h>
29#include <linux/reboot.h>
30#include <linux/debugfs.h>
31#include <linux/highmem.h>
32#include <linux/file.h>
33#include <linux/syscore_ops.h>
34#include <linux/cpu.h>
35#include <linux/sched.h>
36#include <linux/cpumask.h>
37#include <linux/smp.h>
38#include <linux/anon_inodes.h>
39#include <linux/profile.h>
40#include <linux/kvm_para.h>
41#include <linux/pagemap.h>
42#include <linux/mman.h>
43#include <linux/swap.h>
44#include <linux/bitops.h>
45#include <linux/spinlock.h>
46#include <linux/compat.h>
47#include <linux/srcu.h>
48#include <linux/hugetlb.h>
49#include <linux/slab.h>
50
51#include <asm/processor.h>
52#include <asm/io.h>
53#include <asm/uaccess.h>
54#include <asm/pgtable.h>
55
56#include "coalesced_mmio.h"
57#include "async_pf.h"
58
59#define CREATE_TRACE_POINTS
60#include <trace/events/kvm.h>
61
62MODULE_AUTHOR("Qumranet");
63MODULE_LICENSE("GPL");
64
65/*
66 * Ordering of locks:
67 *
68 * kvm->lock --> kvm->slots_lock --> kvm->irq_lock
69 */
70
71DEFINE_RAW_SPINLOCK(kvm_lock);
72LIST_HEAD(vm_list);
73
74static cpumask_var_t cpus_hardware_enabled;
75static int kvm_usage_count = 0;
76static atomic_t hardware_enable_failed;
77
78struct kmem_cache *kvm_vcpu_cache;
79EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
80
81static __read_mostly struct preempt_ops kvm_preempt_ops;
82
83struct dentry *kvm_debugfs_dir;
84
85static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl,
86 unsigned long arg);
87#ifdef CONFIG_COMPAT
88static long kvm_vcpu_compat_ioctl(struct file *file, unsigned int ioctl,
89 unsigned long arg);
90#endif
91static int hardware_enable_all(void);
92static void hardware_disable_all(void);
93
94static void kvm_io_bus_destroy(struct kvm_io_bus *bus);
95
96bool kvm_rebooting;
97EXPORT_SYMBOL_GPL(kvm_rebooting);
98
99static bool largepages_enabled = true;
100
101static struct page *hwpoison_page;
102static pfn_t hwpoison_pfn;
103
104struct page *fault_page;
105pfn_t fault_pfn;
106
107inline int kvm_is_mmio_pfn(pfn_t pfn)
108{
109 if (pfn_valid(pfn)) {
110 int reserved;
111 struct page *tail = pfn_to_page(pfn);
112 struct page *head = compound_trans_head(tail);
113 reserved = PageReserved(head);
114 if (head != tail) {
115 /*
116 * "head" is not a dangling pointer
117 * (compound_trans_head takes care of that)
118 * but the hugepage may have been splitted
119 * from under us (and we may not hold a
120 * reference count on the head page so it can
121 * be reused before we run PageReferenced), so
122 * we've to check PageTail before returning
123 * what we just read.
124 */
125 smp_rmb();
126 if (PageTail(tail))
127 return reserved;
128 }
129 return PageReserved(tail);
130 }
131
132 return true;
133}
134
135/*
136 * Switches to specified vcpu, until a matching vcpu_put()
137 */
138void vcpu_load(struct kvm_vcpu *vcpu)
139{
140 int cpu;
141
142 mutex_lock(&vcpu->mutex);
143 if (unlikely(vcpu->pid != current->pids[PIDTYPE_PID].pid)) {
144 /* The thread running this VCPU changed. */
145 struct pid *oldpid = vcpu->pid;
146 struct pid *newpid = get_task_pid(current, PIDTYPE_PID);
147 rcu_assign_pointer(vcpu->pid, newpid);
148 synchronize_rcu();
149 put_pid(oldpid);
150 }
151 cpu = get_cpu();
152 preempt_notifier_register(&vcpu->preempt_notifier);
153 kvm_arch_vcpu_load(vcpu, cpu);
154 put_cpu();
155}
156
157void vcpu_put(struct kvm_vcpu *vcpu)
158{
159 preempt_disable();
160 kvm_arch_vcpu_put(vcpu);
161 preempt_notifier_unregister(&vcpu->preempt_notifier);
162 preempt_enable();
163 mutex_unlock(&vcpu->mutex);
164}
165
166static void ack_flush(void *_completed)
167{
168}
169
170static bool make_all_cpus_request(struct kvm *kvm, unsigned int req)
171{
172 int i, cpu, me;
173 cpumask_var_t cpus;
174 bool called = true;
175 struct kvm_vcpu *vcpu;
176
177 zalloc_cpumask_var(&cpus, GFP_ATOMIC);
178
179 me = get_cpu();
180 kvm_for_each_vcpu(i, vcpu, kvm) {
181 kvm_make_request(req, vcpu);
182 cpu = vcpu->cpu;
183
184 /* Set ->requests bit before we read ->mode */
185 smp_mb();
186
187 if (cpus != NULL && cpu != -1 && cpu != me &&
188 kvm_vcpu_exiting_guest_mode(vcpu) != OUTSIDE_GUEST_MODE)
189 cpumask_set_cpu(cpu, cpus);
190 }
191 if (unlikely(cpus == NULL))
192 smp_call_function_many(cpu_online_mask, ack_flush, NULL, 1);
193 else if (!cpumask_empty(cpus))
194 smp_call_function_many(cpus, ack_flush, NULL, 1);
195 else
196 called = false;
197 put_cpu();
198 free_cpumask_var(cpus);
199 return called;
200}
201
202void kvm_flush_remote_tlbs(struct kvm *kvm)
203{
204 int dirty_count = kvm->tlbs_dirty;
205
206 smp_mb();
207 if (make_all_cpus_request(kvm, KVM_REQ_TLB_FLUSH))
208 ++kvm->stat.remote_tlb_flush;
209 cmpxchg(&kvm->tlbs_dirty, dirty_count, 0);
210}
211
212void kvm_reload_remote_mmus(struct kvm *kvm)
213{
214 make_all_cpus_request(kvm, KVM_REQ_MMU_RELOAD);
215}
216
217int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
218{
219 struct page *page;
220 int r;
221
222 mutex_init(&vcpu->mutex);
223 vcpu->cpu = -1;
224 vcpu->kvm = kvm;
225 vcpu->vcpu_id = id;
226 vcpu->pid = NULL;
227 init_waitqueue_head(&vcpu->wq);
228 kvm_async_pf_vcpu_init(vcpu);
229
230 page = alloc_page(GFP_KERNEL | __GFP_ZERO);
231 if (!page) {
232 r = -ENOMEM;
233 goto fail;
234 }
235 vcpu->run = page_address(page);
236
237 r = kvm_arch_vcpu_init(vcpu);
238 if (r < 0)
239 goto fail_free_run;
240 return 0;
241
242fail_free_run:
243 free_page((unsigned long)vcpu->run);
244fail:
245 return r;
246}
247EXPORT_SYMBOL_GPL(kvm_vcpu_init);
248
249void kvm_vcpu_uninit(struct kvm_vcpu *vcpu)
250{
251 put_pid(vcpu->pid);
252 kvm_arch_vcpu_uninit(vcpu);
253 free_page((unsigned long)vcpu->run);
254}
255EXPORT_SYMBOL_GPL(kvm_vcpu_uninit);
256
257#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
258static inline struct kvm *mmu_notifier_to_kvm(struct mmu_notifier *mn)
259{
260 return container_of(mn, struct kvm, mmu_notifier);
261}
262
263static void kvm_mmu_notifier_invalidate_page(struct mmu_notifier *mn,
264 struct mm_struct *mm,
265 unsigned long address)
266{
267 struct kvm *kvm = mmu_notifier_to_kvm(mn);
268 int need_tlb_flush, idx;
269
270 /*
271 * When ->invalidate_page runs, the linux pte has been zapped
272 * already but the page is still allocated until
273 * ->invalidate_page returns. So if we increase the sequence
274 * here the kvm page fault will notice if the spte can't be
275 * established because the page is going to be freed. If
276 * instead the kvm page fault establishes the spte before
277 * ->invalidate_page runs, kvm_unmap_hva will release it
278 * before returning.
279 *
280 * The sequence increase only need to be seen at spin_unlock
281 * time, and not at spin_lock time.
282 *
283 * Increasing the sequence after the spin_unlock would be
284 * unsafe because the kvm page fault could then establish the
285 * pte after kvm_unmap_hva returned, without noticing the page
286 * is going to be freed.
287 */
288 idx = srcu_read_lock(&kvm->srcu);
289 spin_lock(&kvm->mmu_lock);
290 kvm->mmu_notifier_seq++;
291 need_tlb_flush = kvm_unmap_hva(kvm, address) | kvm->tlbs_dirty;
292 spin_unlock(&kvm->mmu_lock);
293 srcu_read_unlock(&kvm->srcu, idx);
294
295 /* we've to flush the tlb before the pages can be freed */
296 if (need_tlb_flush)
297 kvm_flush_remote_tlbs(kvm);
298
299}
300
301static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
302 struct mm_struct *mm,
303 unsigned long address,
304 pte_t pte)
305{
306 struct kvm *kvm = mmu_notifier_to_kvm(mn);
307 int idx;
308
309 idx = srcu_read_lock(&kvm->srcu);
310 spin_lock(&kvm->mmu_lock);
311 kvm->mmu_notifier_seq++;
312 kvm_set_spte_hva(kvm, address, pte);
313 spin_unlock(&kvm->mmu_lock);
314 srcu_read_unlock(&kvm->srcu, idx);
315}
316
317static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
318 struct mm_struct *mm,
319 unsigned long start,
320 unsigned long end)
321{
322 struct kvm *kvm = mmu_notifier_to_kvm(mn);
323 int need_tlb_flush = 0, idx;
324
325 idx = srcu_read_lock(&kvm->srcu);
326 spin_lock(&kvm->mmu_lock);
327 /*
328 * The count increase must become visible at unlock time as no
329 * spte can be established without taking the mmu_lock and
330 * count is also read inside the mmu_lock critical section.
331 */
332 kvm->mmu_notifier_count++;
333 for (; start < end; start += PAGE_SIZE)
334 need_tlb_flush |= kvm_unmap_hva(kvm, start);
335 need_tlb_flush |= kvm->tlbs_dirty;
336 spin_unlock(&kvm->mmu_lock);
337 srcu_read_unlock(&kvm->srcu, idx);
338
339 /* we've to flush the tlb before the pages can be freed */
340 if (need_tlb_flush)
341 kvm_flush_remote_tlbs(kvm);
342}
343
344static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
345 struct mm_struct *mm,
346 unsigned long start,
347 unsigned long end)
348{
349 struct kvm *kvm = mmu_notifier_to_kvm(mn);
350
351 spin_lock(&kvm->mmu_lock);
352 /*
353 * This sequence increase will notify the kvm page fault that
354 * the page that is going to be mapped in the spte could have
355 * been freed.
356 */
357 kvm->mmu_notifier_seq++;
358 /*
359 * The above sequence increase must be visible before the
360 * below count decrease but both values are read by the kvm
361 * page fault under mmu_lock spinlock so we don't need to add
362 * a smb_wmb() here in between the two.
363 */
364 kvm->mmu_notifier_count--;
365 spin_unlock(&kvm->mmu_lock);
366
367 BUG_ON(kvm->mmu_notifier_count < 0);
368}
369
370static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
371 struct mm_struct *mm,
372 unsigned long address)
373{
374 struct kvm *kvm = mmu_notifier_to_kvm(mn);
375 int young, idx;
376
377 idx = srcu_read_lock(&kvm->srcu);
378 spin_lock(&kvm->mmu_lock);
379 young = kvm_age_hva(kvm, address);
380 spin_unlock(&kvm->mmu_lock);
381 srcu_read_unlock(&kvm->srcu, idx);
382
383 if (young)
384 kvm_flush_remote_tlbs(kvm);
385
386 return young;
387}
388
389static int kvm_mmu_notifier_test_young(struct mmu_notifier *mn,
390 struct mm_struct *mm,
391 unsigned long address)
392{
393 struct kvm *kvm = mmu_notifier_to_kvm(mn);
394 int young, idx;
395
396 idx = srcu_read_lock(&kvm->srcu);
397 spin_lock(&kvm->mmu_lock);
398 young = kvm_test_age_hva(kvm, address);
399 spin_unlock(&kvm->mmu_lock);
400 srcu_read_unlock(&kvm->srcu, idx);
401
402 return young;
403}
404
405static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
406 struct mm_struct *mm)
407{
408 struct kvm *kvm = mmu_notifier_to_kvm(mn);
409 int idx;
410
411 idx = srcu_read_lock(&kvm->srcu);
412 kvm_arch_flush_shadow(kvm);
413 srcu_read_unlock(&kvm->srcu, idx);
414}
415
416static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
417 .invalidate_page = kvm_mmu_notifier_invalidate_page,
418 .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
419 .invalidate_range_end = kvm_mmu_notifier_invalidate_range_end,
420 .clear_flush_young = kvm_mmu_notifier_clear_flush_young,
421 .test_young = kvm_mmu_notifier_test_young,
422 .change_pte = kvm_mmu_notifier_change_pte,
423 .release = kvm_mmu_notifier_release,
424};
425
426static int kvm_init_mmu_notifier(struct kvm *kvm)
427{
428 kvm->mmu_notifier.ops = &kvm_mmu_notifier_ops;
429 return mmu_notifier_register(&kvm->mmu_notifier, current->mm);
430}
431
432#else /* !(CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER) */
433
434static int kvm_init_mmu_notifier(struct kvm *kvm)
435{
436 return 0;
437}
438
439#endif /* CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER */
440
441static struct kvm *kvm_create_vm(void)
442{
443 int r, i;
444 struct kvm *kvm = kvm_arch_alloc_vm();
445
446 if (!kvm)
447 return ERR_PTR(-ENOMEM);
448
449 r = kvm_arch_init_vm(kvm);
450 if (r)
451 goto out_err_nodisable;
452
453 r = hardware_enable_all();
454 if (r)
455 goto out_err_nodisable;
456
457#ifdef CONFIG_HAVE_KVM_IRQCHIP
458 INIT_HLIST_HEAD(&kvm->mask_notifier_list);
459 INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
460#endif
461
462 r = -ENOMEM;
463 kvm->memslots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
464 if (!kvm->memslots)
465 goto out_err_nosrcu;
466 if (init_srcu_struct(&kvm->srcu))
467 goto out_err_nosrcu;
468 for (i = 0; i < KVM_NR_BUSES; i++) {
469 kvm->buses[i] = kzalloc(sizeof(struct kvm_io_bus),
470 GFP_KERNEL);
471 if (!kvm->buses[i])
472 goto out_err;
473 }
474
475 spin_lock_init(&kvm->mmu_lock);
476 kvm->mm = current->mm;
477 atomic_inc(&kvm->mm->mm_count);
478 kvm_eventfd_init(kvm);
479 mutex_init(&kvm->lock);
480 mutex_init(&kvm->irq_lock);
481 mutex_init(&kvm->slots_lock);
482 atomic_set(&kvm->users_count, 1);
483
484 r = kvm_init_mmu_notifier(kvm);
485 if (r)
486 goto out_err;
487
488 raw_spin_lock(&kvm_lock);
489 list_add(&kvm->vm_list, &vm_list);
490 raw_spin_unlock(&kvm_lock);
491
492 return kvm;
493
494out_err:
495 cleanup_srcu_struct(&kvm->srcu);
496out_err_nosrcu:
497 hardware_disable_all();
498out_err_nodisable:
499 for (i = 0; i < KVM_NR_BUSES; i++)
500 kfree(kvm->buses[i]);
501 kfree(kvm->memslots);
502 kvm_arch_free_vm(kvm);
503 return ERR_PTR(r);
504}
505
506static void kvm_destroy_dirty_bitmap(struct kvm_memory_slot *memslot)
507{
508 if (!memslot->dirty_bitmap)
509 return;
510
511 if (2 * kvm_dirty_bitmap_bytes(memslot) > PAGE_SIZE)
512 vfree(memslot->dirty_bitmap_head);
513 else
514 kfree(memslot->dirty_bitmap_head);
515
516 memslot->dirty_bitmap = NULL;
517 memslot->dirty_bitmap_head = NULL;
518}
519
520/*
521 * Free any memory in @free but not in @dont.
522 */
523static void kvm_free_physmem_slot(struct kvm_memory_slot *free,
524 struct kvm_memory_slot *dont)
525{
526 int i;
527
528 if (!dont || free->rmap != dont->rmap)
529 vfree(free->rmap);
530
531 if (!dont || free->dirty_bitmap != dont->dirty_bitmap)
532 kvm_destroy_dirty_bitmap(free);
533
534
535 for (i = 0; i < KVM_NR_PAGE_SIZES - 1; ++i) {
536 if (!dont || free->lpage_info[i] != dont->lpage_info[i]) {
537 vfree(free->lpage_info[i]);
538 free->lpage_info[i] = NULL;
539 }
540 }
541
542 free->npages = 0;
543 free->rmap = NULL;
544}
545
546void kvm_free_physmem(struct kvm *kvm)
547{
548 int i;
549 struct kvm_memslots *slots = kvm->memslots;
550
551 for (i = 0; i < slots->nmemslots; ++i)
552 kvm_free_physmem_slot(&slots->memslots[i], NULL);
553
554 kfree(kvm->memslots);
555}
556
557static void kvm_destroy_vm(struct kvm *kvm)
558{
559 int i;
560 struct mm_struct *mm = kvm->mm;
561
562 kvm_arch_sync_events(kvm);
563 raw_spin_lock(&kvm_lock);
564 list_del(&kvm->vm_list);
565 raw_spin_unlock(&kvm_lock);
566 kvm_free_irq_routing(kvm);
567 for (i = 0; i < KVM_NR_BUSES; i++)
568 kvm_io_bus_destroy(kvm->buses[i]);
569 kvm_coalesced_mmio_free(kvm);
570#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
571 mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
572#else
573 kvm_arch_flush_shadow(kvm);
574#endif
575 kvm_arch_destroy_vm(kvm);
576 kvm_free_physmem(kvm);
577 cleanup_srcu_struct(&kvm->srcu);
578 kvm_arch_free_vm(kvm);
579 hardware_disable_all();
580 mmdrop(mm);
581}
582
583void kvm_get_kvm(struct kvm *kvm)
584{
585 atomic_inc(&kvm->users_count);
586}
587EXPORT_SYMBOL_GPL(kvm_get_kvm);
588
589void kvm_put_kvm(struct kvm *kvm)
590{
591 if (atomic_dec_and_test(&kvm->users_count))
592 kvm_destroy_vm(kvm);
593}
594EXPORT_SYMBOL_GPL(kvm_put_kvm);
595
596
597static int kvm_vm_release(struct inode *inode, struct file *filp)
598{
599 struct kvm *kvm = filp->private_data;
600
601 kvm_irqfd_release(kvm);
602
603 kvm_put_kvm(kvm);
604 return 0;
605}
606
607#ifndef CONFIG_S390
608/*
609 * Allocation size is twice as large as the actual dirty bitmap size.
610 * This makes it possible to do double buffering: see x86's
611 * kvm_vm_ioctl_get_dirty_log().
612 */
613static int kvm_create_dirty_bitmap(struct kvm_memory_slot *memslot)
614{
615 unsigned long dirty_bytes = 2 * kvm_dirty_bitmap_bytes(memslot);
616
617 if (dirty_bytes > PAGE_SIZE)
618 memslot->dirty_bitmap = vzalloc(dirty_bytes);
619 else
620 memslot->dirty_bitmap = kzalloc(dirty_bytes, GFP_KERNEL);
621
622 if (!memslot->dirty_bitmap)
623 return -ENOMEM;
624
625 memslot->dirty_bitmap_head = memslot->dirty_bitmap;
626 return 0;
627}
628#endif /* !CONFIG_S390 */
629
630/*
631 * Allocate some memory and give it an address in the guest physical address
632 * space.
633 *
634 * Discontiguous memory is allowed, mostly for framebuffers.
635 *
636 * Must be called holding mmap_sem for write.
637 */
638int __kvm_set_memory_region(struct kvm *kvm,
639 struct kvm_userspace_memory_region *mem,
640 int user_alloc)
641{
642 int r;
643 gfn_t base_gfn;
644 unsigned long npages;
645 unsigned long i;
646 struct kvm_memory_slot *memslot;
647 struct kvm_memory_slot old, new;
648 struct kvm_memslots *slots, *old_memslots;
649
650 r = -EINVAL;
651 /* General sanity checks */
652 if (mem->memory_size & (PAGE_SIZE - 1))
653 goto out;
654 if (mem->guest_phys_addr & (PAGE_SIZE - 1))
655 goto out;
656 /* We can read the guest memory with __xxx_user() later on. */
657 if (user_alloc &&
658 ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
659 !access_ok(VERIFY_WRITE,
660 (void __user *)(unsigned long)mem->userspace_addr,
661 mem->memory_size)))
662 goto out;
663 if (mem->slot >= KVM_MEMORY_SLOTS + KVM_PRIVATE_MEM_SLOTS)
664 goto out;
665 if (mem->guest_phys_addr + mem->memory_size < mem->guest_phys_addr)
666 goto out;
667
668 memslot = &kvm->memslots->memslots[mem->slot];
669 base_gfn = mem->guest_phys_addr >> PAGE_SHIFT;
670 npages = mem->memory_size >> PAGE_SHIFT;
671
672 r = -EINVAL;
673 if (npages > KVM_MEM_MAX_NR_PAGES)
674 goto out;
675
676 if (!npages)
677 mem->flags &= ~KVM_MEM_LOG_DIRTY_PAGES;
678
679 new = old = *memslot;
680
681 new.id = mem->slot;
682 new.base_gfn = base_gfn;
683 new.npages = npages;
684 new.flags = mem->flags;
685
686 /* Disallow changing a memory slot's size. */
687 r = -EINVAL;
688 if (npages && old.npages && npages != old.npages)
689 goto out_free;
690
691 /* Check for overlaps */
692 r = -EEXIST;
693 for (i = 0; i < KVM_MEMORY_SLOTS; ++i) {
694 struct kvm_memory_slot *s = &kvm->memslots->memslots[i];
695
696 if (s == memslot || !s->npages)
697 continue;
698 if (!((base_gfn + npages <= s->base_gfn) ||
699 (base_gfn >= s->base_gfn + s->npages)))
700 goto out_free;
701 }
702
703 /* Free page dirty bitmap if unneeded */
704 if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
705 new.dirty_bitmap = NULL;
706
707 r = -ENOMEM;
708
709 /* Allocate if a slot is being created */
710#ifndef CONFIG_S390
711 if (npages && !new.rmap) {
712 new.rmap = vzalloc(npages * sizeof(*new.rmap));
713
714 if (!new.rmap)
715 goto out_free;
716
717 new.user_alloc = user_alloc;
718 new.userspace_addr = mem->userspace_addr;
719 }
720 if (!npages)
721 goto skip_lpage;
722
723 for (i = 0; i < KVM_NR_PAGE_SIZES - 1; ++i) {
724 unsigned long ugfn;
725 unsigned long j;
726 int lpages;
727 int level = i + 2;
728
729 /* Avoid unused variable warning if no large pages */
730 (void)level;
731
732 if (new.lpage_info[i])
733 continue;
734
735 lpages = 1 + ((base_gfn + npages - 1)
736 >> KVM_HPAGE_GFN_SHIFT(level));
737 lpages -= base_gfn >> KVM_HPAGE_GFN_SHIFT(level);
738
739 new.lpage_info[i] = vzalloc(lpages * sizeof(*new.lpage_info[i]));
740
741 if (!new.lpage_info[i])
742 goto out_free;
743
744 if (base_gfn & (KVM_PAGES_PER_HPAGE(level) - 1))
745 new.lpage_info[i][0].write_count = 1;
746 if ((base_gfn+npages) & (KVM_PAGES_PER_HPAGE(level) - 1))
747 new.lpage_info[i][lpages - 1].write_count = 1;
748 ugfn = new.userspace_addr >> PAGE_SHIFT;
749 /*
750 * If the gfn and userspace address are not aligned wrt each
751 * other, or if explicitly asked to, disable large page
752 * support for this slot
753 */
754 if ((base_gfn ^ ugfn) & (KVM_PAGES_PER_HPAGE(level) - 1) ||
755 !largepages_enabled)
756 for (j = 0; j < lpages; ++j)
757 new.lpage_info[i][j].write_count = 1;
758 }
759
760skip_lpage:
761
762 /* Allocate page dirty bitmap if needed */
763 if ((new.flags & KVM_MEM_LOG_DIRTY_PAGES) && !new.dirty_bitmap) {
764 if (kvm_create_dirty_bitmap(&new) < 0)
765 goto out_free;
766 /* destroy any largepage mappings for dirty tracking */
767 }
768#else /* not defined CONFIG_S390 */
769 new.user_alloc = user_alloc;
770 if (user_alloc)
771 new.userspace_addr = mem->userspace_addr;
772#endif /* not defined CONFIG_S390 */
773
774 if (!npages) {
775 r = -ENOMEM;
776 slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
777 if (!slots)
778 goto out_free;
779 memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
780 if (mem->slot >= slots->nmemslots)
781 slots->nmemslots = mem->slot + 1;
782 slots->generation++;
783 slots->memslots[mem->slot].flags |= KVM_MEMSLOT_INVALID;
784
785 old_memslots = kvm->memslots;
786 rcu_assign_pointer(kvm->memslots, slots);
787 synchronize_srcu_expedited(&kvm->srcu);
788 /* From this point no new shadow pages pointing to a deleted
789 * memslot will be created.
790 *
791 * validation of sp->gfn happens in:
792 * - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
793 * - kvm_is_visible_gfn (mmu_check_roots)
794 */
795 kvm_arch_flush_shadow(kvm);
796 kfree(old_memslots);
797 }
798
799 r = kvm_arch_prepare_memory_region(kvm, &new, old, mem, user_alloc);
800 if (r)
801 goto out_free;
802
803 /* map the pages in iommu page table */
804 if (npages) {
805 r = kvm_iommu_map_pages(kvm, &new);
806 if (r)
807 goto out_free;
808 }
809
810 r = -ENOMEM;
811 slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
812 if (!slots)
813 goto out_free;
814 memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
815 if (mem->slot >= slots->nmemslots)
816 slots->nmemslots = mem->slot + 1;
817 slots->generation++;
818
819 /* actual memory is freed via old in kvm_free_physmem_slot below */
820 if (!npages) {
821 new.rmap = NULL;
822 new.dirty_bitmap = NULL;
823 for (i = 0; i < KVM_NR_PAGE_SIZES - 1; ++i)
824 new.lpage_info[i] = NULL;
825 }
826
827 slots->memslots[mem->slot] = new;
828 old_memslots = kvm->memslots;
829 rcu_assign_pointer(kvm->memslots, slots);
830 synchronize_srcu_expedited(&kvm->srcu);
831
832 kvm_arch_commit_memory_region(kvm, mem, old, user_alloc);
833
834 /*
835 * If the new memory slot is created, we need to clear all
836 * mmio sptes.
837 */
838 if (npages && old.base_gfn != mem->guest_phys_addr >> PAGE_SHIFT)
839 kvm_arch_flush_shadow(kvm);
840
841 kvm_free_physmem_slot(&old, &new);
842 kfree(old_memslots);
843
844 return 0;
845
846out_free:
847 kvm_free_physmem_slot(&new, &old);
848out:
849 return r;
850
851}
852EXPORT_SYMBOL_GPL(__kvm_set_memory_region);
853
854int kvm_set_memory_region(struct kvm *kvm,
855 struct kvm_userspace_memory_region *mem,
856 int user_alloc)
857{
858 int r;
859
860 mutex_lock(&kvm->slots_lock);
861 r = __kvm_set_memory_region(kvm, mem, user_alloc);
862 mutex_unlock(&kvm->slots_lock);
863 return r;
864}
865EXPORT_SYMBOL_GPL(kvm_set_memory_region);
866
867int kvm_vm_ioctl_set_memory_region(struct kvm *kvm,
868 struct
869 kvm_userspace_memory_region *mem,
870 int user_alloc)
871{
872 if (mem->slot >= KVM_MEMORY_SLOTS)
873 return -EINVAL;
874 return kvm_set_memory_region(kvm, mem, user_alloc);
875}
876
877int kvm_get_dirty_log(struct kvm *kvm,
878 struct kvm_dirty_log *log, int *is_dirty)
879{
880 struct kvm_memory_slot *memslot;
881 int r, i;
882 unsigned long n;
883 unsigned long any = 0;
884
885 r = -EINVAL;
886 if (log->slot >= KVM_MEMORY_SLOTS)
887 goto out;
888
889 memslot = &kvm->memslots->memslots[log->slot];
890 r = -ENOENT;
891 if (!memslot->dirty_bitmap)
892 goto out;
893
894 n = kvm_dirty_bitmap_bytes(memslot);
895
896 for (i = 0; !any && i < n/sizeof(long); ++i)
897 any = memslot->dirty_bitmap[i];
898
899 r = -EFAULT;
900 if (copy_to_user(log->dirty_bitmap, memslot->dirty_bitmap, n))
901 goto out;
902
903 if (any)
904 *is_dirty = 1;
905
906 r = 0;
907out:
908 return r;
909}
910
911void kvm_disable_largepages(void)
912{
913 largepages_enabled = false;
914}
915EXPORT_SYMBOL_GPL(kvm_disable_largepages);
916
917int is_error_page(struct page *page)
918{
919 return page == bad_page || page == hwpoison_page || page == fault_page;
920}
921EXPORT_SYMBOL_GPL(is_error_page);
922
923int is_error_pfn(pfn_t pfn)
924{
925 return pfn == bad_pfn || pfn == hwpoison_pfn || pfn == fault_pfn;
926}
927EXPORT_SYMBOL_GPL(is_error_pfn);
928
929int is_hwpoison_pfn(pfn_t pfn)
930{
931 return pfn == hwpoison_pfn;
932}
933EXPORT_SYMBOL_GPL(is_hwpoison_pfn);
934
935int is_fault_pfn(pfn_t pfn)
936{
937 return pfn == fault_pfn;
938}
939EXPORT_SYMBOL_GPL(is_fault_pfn);
940
941int is_noslot_pfn(pfn_t pfn)
942{
943 return pfn == bad_pfn;
944}
945EXPORT_SYMBOL_GPL(is_noslot_pfn);
946
947int is_invalid_pfn(pfn_t pfn)
948{
949 return pfn == hwpoison_pfn || pfn == fault_pfn;
950}
951EXPORT_SYMBOL_GPL(is_invalid_pfn);
952
953static inline unsigned long bad_hva(void)
954{
955 return PAGE_OFFSET;
956}
957
958int kvm_is_error_hva(unsigned long addr)
959{
960 return addr == bad_hva();
961}
962EXPORT_SYMBOL_GPL(kvm_is_error_hva);
963
964static struct kvm_memory_slot *__gfn_to_memslot(struct kvm_memslots *slots,
965 gfn_t gfn)
966{
967 int i;
968
969 for (i = 0; i < slots->nmemslots; ++i) {
970 struct kvm_memory_slot *memslot = &slots->memslots[i];
971
972 if (gfn >= memslot->base_gfn
973 && gfn < memslot->base_gfn + memslot->npages)
974 return memslot;
975 }
976 return NULL;
977}
978
979struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn)
980{
981 return __gfn_to_memslot(kvm_memslots(kvm), gfn);
982}
983EXPORT_SYMBOL_GPL(gfn_to_memslot);
984
985int kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn)
986{
987 int i;
988 struct kvm_memslots *slots = kvm_memslots(kvm);
989
990 for (i = 0; i < KVM_MEMORY_SLOTS; ++i) {
991 struct kvm_memory_slot *memslot = &slots->memslots[i];
992
993 if (memslot->flags & KVM_MEMSLOT_INVALID)
994 continue;
995
996 if (gfn >= memslot->base_gfn
997 && gfn < memslot->base_gfn + memslot->npages)
998 return 1;
999 }
1000 return 0;
1001}
1002EXPORT_SYMBOL_GPL(kvm_is_visible_gfn);
1003
1004unsigned long kvm_host_page_size(struct kvm *kvm, gfn_t gfn)
1005{
1006 struct vm_area_struct *vma;
1007 unsigned long addr, size;
1008
1009 size = PAGE_SIZE;
1010
1011 addr = gfn_to_hva(kvm, gfn);
1012 if (kvm_is_error_hva(addr))
1013 return PAGE_SIZE;
1014
1015 down_read(¤t->mm->mmap_sem);
1016 vma = find_vma(current->mm, addr);
1017 if (!vma)
1018 goto out;
1019
1020 size = vma_kernel_pagesize(vma);
1021
1022out:
1023 up_read(¤t->mm->mmap_sem);
1024
1025 return size;
1026}
1027
1028static unsigned long gfn_to_hva_many(struct kvm_memory_slot *slot, gfn_t gfn,
1029 gfn_t *nr_pages)
1030{
1031 if (!slot || slot->flags & KVM_MEMSLOT_INVALID)
1032 return bad_hva();
1033
1034 if (nr_pages)
1035 *nr_pages = slot->npages - (gfn - slot->base_gfn);
1036
1037 return gfn_to_hva_memslot(slot, gfn);
1038}
1039
1040unsigned long gfn_to_hva(struct kvm *kvm, gfn_t gfn)
1041{
1042 return gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL);
1043}
1044EXPORT_SYMBOL_GPL(gfn_to_hva);
1045
1046static pfn_t get_fault_pfn(void)
1047{
1048 get_page(fault_page);
1049 return fault_pfn;
1050}
1051
1052int get_user_page_nowait(struct task_struct *tsk, struct mm_struct *mm,
1053 unsigned long start, int write, struct page **page)
1054{
1055 int flags = FOLL_TOUCH | FOLL_NOWAIT | FOLL_HWPOISON | FOLL_GET;
1056
1057 if (write)
1058 flags |= FOLL_WRITE;
1059
1060 return __get_user_pages(tsk, mm, start, 1, flags, page, NULL, NULL);
1061}
1062
1063static inline int check_user_page_hwpoison(unsigned long addr)
1064{
1065 int rc, flags = FOLL_TOUCH | FOLL_HWPOISON | FOLL_WRITE;
1066
1067 rc = __get_user_pages(current, current->mm, addr, 1,
1068 flags, NULL, NULL, NULL);
1069 return rc == -EHWPOISON;
1070}
1071
1072static pfn_t hva_to_pfn(struct kvm *kvm, unsigned long addr, bool atomic,
1073 bool *async, bool write_fault, bool *writable)
1074{
1075 struct page *page[1];
1076 int npages = 0;
1077 pfn_t pfn;
1078
1079 /* we can do it either atomically or asynchronously, not both */
1080 BUG_ON(atomic && async);
1081
1082 BUG_ON(!write_fault && !writable);
1083
1084 if (writable)
1085 *writable = true;
1086
1087 if (atomic || async)
1088 npages = __get_user_pages_fast(addr, 1, 1, page);
1089
1090 if (unlikely(npages != 1) && !atomic) {
1091 might_sleep();
1092
1093 if (writable)
1094 *writable = write_fault;
1095
1096 if (async) {
1097 down_read(¤t->mm->mmap_sem);
1098 npages = get_user_page_nowait(current, current->mm,
1099 addr, write_fault, page);
1100 up_read(¤t->mm->mmap_sem);
1101 } else
1102 npages = get_user_pages_fast(addr, 1, write_fault,
1103 page);
1104
1105 /* map read fault as writable if possible */
1106 if (unlikely(!write_fault) && npages == 1) {
1107 struct page *wpage[1];
1108
1109 npages = __get_user_pages_fast(addr, 1, 1, wpage);
1110 if (npages == 1) {
1111 *writable = true;
1112 put_page(page[0]);
1113 page[0] = wpage[0];
1114 }
1115 npages = 1;
1116 }
1117 }
1118
1119 if (unlikely(npages != 1)) {
1120 struct vm_area_struct *vma;
1121
1122 if (atomic)
1123 return get_fault_pfn();
1124
1125 down_read(¤t->mm->mmap_sem);
1126 if (npages == -EHWPOISON ||
1127 (!async && check_user_page_hwpoison(addr))) {
1128 up_read(¤t->mm->mmap_sem);
1129 get_page(hwpoison_page);
1130 return page_to_pfn(hwpoison_page);
1131 }
1132
1133 vma = find_vma_intersection(current->mm, addr, addr+1);
1134
1135 if (vma == NULL)
1136 pfn = get_fault_pfn();
1137 else if ((vma->vm_flags & VM_PFNMAP)) {
1138 pfn = ((addr - vma->vm_start) >> PAGE_SHIFT) +
1139 vma->vm_pgoff;
1140 BUG_ON(!kvm_is_mmio_pfn(pfn));
1141 } else {
1142 if (async && (vma->vm_flags & VM_WRITE))
1143 *async = true;
1144 pfn = get_fault_pfn();
1145 }
1146 up_read(¤t->mm->mmap_sem);
1147 } else
1148 pfn = page_to_pfn(page[0]);
1149
1150 return pfn;
1151}
1152
1153pfn_t hva_to_pfn_atomic(struct kvm *kvm, unsigned long addr)
1154{
1155 return hva_to_pfn(kvm, addr, true, NULL, true, NULL);
1156}
1157EXPORT_SYMBOL_GPL(hva_to_pfn_atomic);
1158
1159static pfn_t __gfn_to_pfn(struct kvm *kvm, gfn_t gfn, bool atomic, bool *async,
1160 bool write_fault, bool *writable)
1161{
1162 unsigned long addr;
1163
1164 if (async)
1165 *async = false;
1166
1167 addr = gfn_to_hva(kvm, gfn);
1168 if (kvm_is_error_hva(addr)) {
1169 get_page(bad_page);
1170 return page_to_pfn(bad_page);
1171 }
1172
1173 return hva_to_pfn(kvm, addr, atomic, async, write_fault, writable);
1174}
1175
1176pfn_t gfn_to_pfn_atomic(struct kvm *kvm, gfn_t gfn)
1177{
1178 return __gfn_to_pfn(kvm, gfn, true, NULL, true, NULL);
1179}
1180EXPORT_SYMBOL_GPL(gfn_to_pfn_atomic);
1181
1182pfn_t gfn_to_pfn_async(struct kvm *kvm, gfn_t gfn, bool *async,
1183 bool write_fault, bool *writable)
1184{
1185 return __gfn_to_pfn(kvm, gfn, false, async, write_fault, writable);
1186}
1187EXPORT_SYMBOL_GPL(gfn_to_pfn_async);
1188
1189pfn_t gfn_to_pfn(struct kvm *kvm, gfn_t gfn)
1190{
1191 return __gfn_to_pfn(kvm, gfn, false, NULL, true, NULL);
1192}
1193EXPORT_SYMBOL_GPL(gfn_to_pfn);
1194
1195pfn_t gfn_to_pfn_prot(struct kvm *kvm, gfn_t gfn, bool write_fault,
1196 bool *writable)
1197{
1198 return __gfn_to_pfn(kvm, gfn, false, NULL, write_fault, writable);
1199}
1200EXPORT_SYMBOL_GPL(gfn_to_pfn_prot);
1201
1202pfn_t gfn_to_pfn_memslot(struct kvm *kvm,
1203 struct kvm_memory_slot *slot, gfn_t gfn)
1204{
1205 unsigned long addr = gfn_to_hva_memslot(slot, gfn);
1206 return hva_to_pfn(kvm, addr, false, NULL, true, NULL);
1207}
1208
1209int gfn_to_page_many_atomic(struct kvm *kvm, gfn_t gfn, struct page **pages,
1210 int nr_pages)
1211{
1212 unsigned long addr;
1213 gfn_t entry;
1214
1215 addr = gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, &entry);
1216 if (kvm_is_error_hva(addr))
1217 return -1;
1218
1219 if (entry < nr_pages)
1220 return 0;
1221
1222 return __get_user_pages_fast(addr, nr_pages, 1, pages);
1223}
1224EXPORT_SYMBOL_GPL(gfn_to_page_many_atomic);
1225
1226struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
1227{
1228 pfn_t pfn;
1229
1230 pfn = gfn_to_pfn(kvm, gfn);
1231 if (!kvm_is_mmio_pfn(pfn))
1232 return pfn_to_page(pfn);
1233
1234 WARN_ON(kvm_is_mmio_pfn(pfn));
1235
1236 get_page(bad_page);
1237 return bad_page;
1238}
1239
1240EXPORT_SYMBOL_GPL(gfn_to_page);
1241
1242void kvm_release_page_clean(struct page *page)
1243{
1244 kvm_release_pfn_clean(page_to_pfn(page));
1245}
1246EXPORT_SYMBOL_GPL(kvm_release_page_clean);
1247
1248void kvm_release_pfn_clean(pfn_t pfn)
1249{
1250 if (!kvm_is_mmio_pfn(pfn))
1251 put_page(pfn_to_page(pfn));
1252}
1253EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);
1254
1255void kvm_release_page_dirty(struct page *page)
1256{
1257 kvm_release_pfn_dirty(page_to_pfn(page));
1258}
1259EXPORT_SYMBOL_GPL(kvm_release_page_dirty);
1260
1261void kvm_release_pfn_dirty(pfn_t pfn)
1262{
1263 kvm_set_pfn_dirty(pfn);
1264 kvm_release_pfn_clean(pfn);
1265}
1266EXPORT_SYMBOL_GPL(kvm_release_pfn_dirty);
1267
1268void kvm_set_page_dirty(struct page *page)
1269{
1270 kvm_set_pfn_dirty(page_to_pfn(page));
1271}
1272EXPORT_SYMBOL_GPL(kvm_set_page_dirty);
1273
1274void kvm_set_pfn_dirty(pfn_t pfn)
1275{
1276 if (!kvm_is_mmio_pfn(pfn)) {
1277 struct page *page = pfn_to_page(pfn);
1278 if (!PageReserved(page))
1279 SetPageDirty(page);
1280 }
1281}
1282EXPORT_SYMBOL_GPL(kvm_set_pfn_dirty);
1283
1284void kvm_set_pfn_accessed(pfn_t pfn)
1285{
1286 if (!kvm_is_mmio_pfn(pfn))
1287 mark_page_accessed(pfn_to_page(pfn));
1288}
1289EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);
1290
1291void kvm_get_pfn(pfn_t pfn)
1292{
1293 if (!kvm_is_mmio_pfn(pfn))
1294 get_page(pfn_to_page(pfn));
1295}
1296EXPORT_SYMBOL_GPL(kvm_get_pfn);
1297
1298static int next_segment(unsigned long len, int offset)
1299{
1300 if (len > PAGE_SIZE - offset)
1301 return PAGE_SIZE - offset;
1302 else
1303 return len;
1304}
1305
1306int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
1307 int len)
1308{
1309 int r;
1310 unsigned long addr;
1311
1312 addr = gfn_to_hva(kvm, gfn);
1313 if (kvm_is_error_hva(addr))
1314 return -EFAULT;
1315 r = __copy_from_user(data, (void __user *)addr + offset, len);
1316 if (r)
1317 return -EFAULT;
1318 return 0;
1319}
1320EXPORT_SYMBOL_GPL(kvm_read_guest_page);
1321
1322int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len)
1323{
1324 gfn_t gfn = gpa >> PAGE_SHIFT;
1325 int seg;
1326 int offset = offset_in_page(gpa);
1327 int ret;
1328
1329 while ((seg = next_segment(len, offset)) != 0) {
1330 ret = kvm_read_guest_page(kvm, gfn, data, offset, seg);
1331 if (ret < 0)
1332 return ret;
1333 offset = 0;
1334 len -= seg;
1335 data += seg;
1336 ++gfn;
1337 }
1338 return 0;
1339}
1340EXPORT_SYMBOL_GPL(kvm_read_guest);
1341
1342int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
1343 unsigned long len)
1344{
1345 int r;
1346 unsigned long addr;
1347 gfn_t gfn = gpa >> PAGE_SHIFT;
1348 int offset = offset_in_page(gpa);
1349
1350 addr = gfn_to_hva(kvm, gfn);
1351 if (kvm_is_error_hva(addr))
1352 return -EFAULT;
1353 pagefault_disable();
1354 r = __copy_from_user_inatomic(data, (void __user *)addr + offset, len);
1355 pagefault_enable();
1356 if (r)
1357 return -EFAULT;
1358 return 0;
1359}
1360EXPORT_SYMBOL(kvm_read_guest_atomic);
1361
1362int kvm_write_guest_page(struct kvm *kvm, gfn_t gfn, const void *data,
1363 int offset, int len)
1364{
1365 int r;
1366 unsigned long addr;
1367
1368 addr = gfn_to_hva(kvm, gfn);
1369 if (kvm_is_error_hva(addr))
1370 return -EFAULT;
1371 r = __copy_to_user((void __user *)addr + offset, data, len);
1372 if (r)
1373 return -EFAULT;
1374 mark_page_dirty(kvm, gfn);
1375 return 0;
1376}
1377EXPORT_SYMBOL_GPL(kvm_write_guest_page);
1378
1379int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
1380 unsigned long len)
1381{
1382 gfn_t gfn = gpa >> PAGE_SHIFT;
1383 int seg;
1384 int offset = offset_in_page(gpa);
1385 int ret;
1386
1387 while ((seg = next_segment(len, offset)) != 0) {
1388 ret = kvm_write_guest_page(kvm, gfn, data, offset, seg);
1389 if (ret < 0)
1390 return ret;
1391 offset = 0;
1392 len -= seg;
1393 data += seg;
1394 ++gfn;
1395 }
1396 return 0;
1397}
1398
1399int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1400 gpa_t gpa)
1401{
1402 struct kvm_memslots *slots = kvm_memslots(kvm);
1403 int offset = offset_in_page(gpa);
1404 gfn_t gfn = gpa >> PAGE_SHIFT;
1405
1406 ghc->gpa = gpa;
1407 ghc->generation = slots->generation;
1408 ghc->memslot = __gfn_to_memslot(slots, gfn);
1409 ghc->hva = gfn_to_hva_many(ghc->memslot, gfn, NULL);
1410 if (!kvm_is_error_hva(ghc->hva))
1411 ghc->hva += offset;
1412 else
1413 return -EFAULT;
1414
1415 return 0;
1416}
1417EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
1418
1419int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1420 void *data, unsigned long len)
1421{
1422 struct kvm_memslots *slots = kvm_memslots(kvm);
1423 int r;
1424
1425 if (slots->generation != ghc->generation)
1426 kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
1427
1428 if (kvm_is_error_hva(ghc->hva))
1429 return -EFAULT;
1430
1431 r = __copy_to_user((void __user *)ghc->hva, data, len);
1432 if (r)
1433 return -EFAULT;
1434 mark_page_dirty_in_slot(kvm, ghc->memslot, ghc->gpa >> PAGE_SHIFT);
1435
1436 return 0;
1437}
1438EXPORT_SYMBOL_GPL(kvm_write_guest_cached);
1439
1440int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1441 void *data, unsigned long len)
1442{
1443 struct kvm_memslots *slots = kvm_memslots(kvm);
1444 int r;
1445
1446 if (slots->generation != ghc->generation)
1447 kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
1448
1449 if (kvm_is_error_hva(ghc->hva))
1450 return -EFAULT;
1451
1452 r = __copy_from_user(data, (void __user *)ghc->hva, len);
1453 if (r)
1454 return -EFAULT;
1455
1456 return 0;
1457}
1458EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
1459
1460int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
1461{
1462 return kvm_write_guest_page(kvm, gfn, (const void *) empty_zero_page,
1463 offset, len);
1464}
1465EXPORT_SYMBOL_GPL(kvm_clear_guest_page);
1466
1467int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len)
1468{
1469 gfn_t gfn = gpa >> PAGE_SHIFT;
1470 int seg;
1471 int offset = offset_in_page(gpa);
1472 int ret;
1473
1474 while ((seg = next_segment(len, offset)) != 0) {
1475 ret = kvm_clear_guest_page(kvm, gfn, offset, seg);
1476 if (ret < 0)
1477 return ret;
1478 offset = 0;
1479 len -= seg;
1480 ++gfn;
1481 }
1482 return 0;
1483}
1484EXPORT_SYMBOL_GPL(kvm_clear_guest);
1485
1486void mark_page_dirty_in_slot(struct kvm *kvm, struct kvm_memory_slot *memslot,
1487 gfn_t gfn)
1488{
1489 if (memslot && memslot->dirty_bitmap) {
1490 unsigned long rel_gfn = gfn - memslot->base_gfn;
1491
1492 __set_bit_le(rel_gfn, memslot->dirty_bitmap);
1493 }
1494}
1495
1496void mark_page_dirty(struct kvm *kvm, gfn_t gfn)
1497{
1498 struct kvm_memory_slot *memslot;
1499
1500 memslot = gfn_to_memslot(kvm, gfn);
1501 mark_page_dirty_in_slot(kvm, memslot, gfn);
1502}
1503
1504/*
1505 * The vCPU has executed a HLT instruction with in-kernel mode enabled.
1506 */
1507void kvm_vcpu_block(struct kvm_vcpu *vcpu)
1508{
1509 DEFINE_WAIT(wait);
1510
1511 for (;;) {
1512 prepare_to_wait(&vcpu->wq, &wait, TASK_INTERRUPTIBLE);
1513
1514 if (kvm_arch_vcpu_runnable(vcpu)) {
1515 kvm_make_request(KVM_REQ_UNHALT, vcpu);
1516 break;
1517 }
1518 if (kvm_cpu_has_pending_timer(vcpu))
1519 break;
1520 if (signal_pending(current))
1521 break;
1522
1523 schedule();
1524 }
1525
1526 finish_wait(&vcpu->wq, &wait);
1527}
1528
1529void kvm_resched(struct kvm_vcpu *vcpu)
1530{
1531 if (!need_resched())
1532 return;
1533 cond_resched();
1534}
1535EXPORT_SYMBOL_GPL(kvm_resched);
1536
1537void kvm_vcpu_on_spin(struct kvm_vcpu *me)
1538{
1539 struct kvm *kvm = me->kvm;
1540 struct kvm_vcpu *vcpu;
1541 int last_boosted_vcpu = me->kvm->last_boosted_vcpu;
1542 int yielded = 0;
1543 int pass;
1544 int i;
1545
1546 /*
1547 * We boost the priority of a VCPU that is runnable but not
1548 * currently running, because it got preempted by something
1549 * else and called schedule in __vcpu_run. Hopefully that
1550 * VCPU is holding the lock that we need and will release it.
1551 * We approximate round-robin by starting at the last boosted VCPU.
1552 */
1553 for (pass = 0; pass < 2 && !yielded; pass++) {
1554 kvm_for_each_vcpu(i, vcpu, kvm) {
1555 struct task_struct *task = NULL;
1556 struct pid *pid;
1557 if (!pass && i < last_boosted_vcpu) {
1558 i = last_boosted_vcpu;
1559 continue;
1560 } else if (pass && i > last_boosted_vcpu)
1561 break;
1562 if (vcpu == me)
1563 continue;
1564 if (waitqueue_active(&vcpu->wq))
1565 continue;
1566 rcu_read_lock();
1567 pid = rcu_dereference(vcpu->pid);
1568 if (pid)
1569 task = get_pid_task(vcpu->pid, PIDTYPE_PID);
1570 rcu_read_unlock();
1571 if (!task)
1572 continue;
1573 if (task->flags & PF_VCPU) {
1574 put_task_struct(task);
1575 continue;
1576 }
1577 if (yield_to(task, 1)) {
1578 put_task_struct(task);
1579 kvm->last_boosted_vcpu = i;
1580 yielded = 1;
1581 break;
1582 }
1583 put_task_struct(task);
1584 }
1585 }
1586}
1587EXPORT_SYMBOL_GPL(kvm_vcpu_on_spin);
1588
1589static int kvm_vcpu_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
1590{
1591 struct kvm_vcpu *vcpu = vma->vm_file->private_data;
1592 struct page *page;
1593
1594 if (vmf->pgoff == 0)
1595 page = virt_to_page(vcpu->run);
1596#ifdef CONFIG_X86
1597 else if (vmf->pgoff == KVM_PIO_PAGE_OFFSET)
1598 page = virt_to_page(vcpu->arch.pio_data);
1599#endif
1600#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
1601 else if (vmf->pgoff == KVM_COALESCED_MMIO_PAGE_OFFSET)
1602 page = virt_to_page(vcpu->kvm->coalesced_mmio_ring);
1603#endif
1604 else
1605 return VM_FAULT_SIGBUS;
1606 get_page(page);
1607 vmf->page = page;
1608 return 0;
1609}
1610
1611static const struct vm_operations_struct kvm_vcpu_vm_ops = {
1612 .fault = kvm_vcpu_fault,
1613};
1614
1615static int kvm_vcpu_mmap(struct file *file, struct vm_area_struct *vma)
1616{
1617 vma->vm_ops = &kvm_vcpu_vm_ops;
1618 return 0;
1619}
1620
1621static int kvm_vcpu_release(struct inode *inode, struct file *filp)
1622{
1623 struct kvm_vcpu *vcpu = filp->private_data;
1624
1625 kvm_put_kvm(vcpu->kvm);
1626 return 0;
1627}
1628
1629static struct file_operations kvm_vcpu_fops = {
1630 .release = kvm_vcpu_release,
1631 .unlocked_ioctl = kvm_vcpu_ioctl,
1632#ifdef CONFIG_COMPAT
1633 .compat_ioctl = kvm_vcpu_compat_ioctl,
1634#endif
1635 .mmap = kvm_vcpu_mmap,
1636 .llseek = noop_llseek,
1637};
1638
1639/*
1640 * Allocates an inode for the vcpu.
1641 */
1642static int create_vcpu_fd(struct kvm_vcpu *vcpu)
1643{
1644 return anon_inode_getfd("kvm-vcpu", &kvm_vcpu_fops, vcpu, O_RDWR);
1645}
1646
1647/*
1648 * Creates some virtual cpus. Good luck creating more than one.
1649 */
1650static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
1651{
1652 int r;
1653 struct kvm_vcpu *vcpu, *v;
1654
1655 vcpu = kvm_arch_vcpu_create(kvm, id);
1656 if (IS_ERR(vcpu))
1657 return PTR_ERR(vcpu);
1658
1659 preempt_notifier_init(&vcpu->preempt_notifier, &kvm_preempt_ops);
1660
1661 r = kvm_arch_vcpu_setup(vcpu);
1662 if (r)
1663 goto vcpu_destroy;
1664
1665 mutex_lock(&kvm->lock);
1666 if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
1667 r = -EINVAL;
1668 goto unlock_vcpu_destroy;
1669 }
1670
1671 kvm_for_each_vcpu(r, v, kvm)
1672 if (v->vcpu_id == id) {
1673 r = -EEXIST;
1674 goto unlock_vcpu_destroy;
1675 }
1676
1677 BUG_ON(kvm->vcpus[atomic_read(&kvm->online_vcpus)]);
1678
1679 /* Now it's all set up, let userspace reach it */
1680 kvm_get_kvm(kvm);
1681 r = create_vcpu_fd(vcpu);
1682 if (r < 0) {
1683 kvm_put_kvm(kvm);
1684 goto unlock_vcpu_destroy;
1685 }
1686
1687 kvm->vcpus[atomic_read(&kvm->online_vcpus)] = vcpu;
1688 smp_wmb();
1689 atomic_inc(&kvm->online_vcpus);
1690
1691#ifdef CONFIG_KVM_APIC_ARCHITECTURE
1692 if (kvm->bsp_vcpu_id == id)
1693 kvm->bsp_vcpu = vcpu;
1694#endif
1695 mutex_unlock(&kvm->lock);
1696 return r;
1697
1698unlock_vcpu_destroy:
1699 mutex_unlock(&kvm->lock);
1700vcpu_destroy:
1701 kvm_arch_vcpu_destroy(vcpu);
1702 return r;
1703}
1704
1705static int kvm_vcpu_ioctl_set_sigmask(struct kvm_vcpu *vcpu, sigset_t *sigset)
1706{
1707 if (sigset) {
1708 sigdelsetmask(sigset, sigmask(SIGKILL)|sigmask(SIGSTOP));
1709 vcpu->sigset_active = 1;
1710 vcpu->sigset = *sigset;
1711 } else
1712 vcpu->sigset_active = 0;
1713 return 0;
1714}
1715
1716static long kvm_vcpu_ioctl(struct file *filp,
1717 unsigned int ioctl, unsigned long arg)
1718{
1719 struct kvm_vcpu *vcpu = filp->private_data;
1720 void __user *argp = (void __user *)arg;
1721 int r;
1722 struct kvm_fpu *fpu = NULL;
1723 struct kvm_sregs *kvm_sregs = NULL;
1724
1725 if (vcpu->kvm->mm != current->mm)
1726 return -EIO;
1727
1728#if defined(CONFIG_S390) || defined(CONFIG_PPC)
1729 /*
1730 * Special cases: vcpu ioctls that are asynchronous to vcpu execution,
1731 * so vcpu_load() would break it.
1732 */
1733 if (ioctl == KVM_S390_INTERRUPT || ioctl == KVM_INTERRUPT)
1734 return kvm_arch_vcpu_ioctl(filp, ioctl, arg);
1735#endif
1736
1737
1738 vcpu_load(vcpu);
1739 switch (ioctl) {
1740 case KVM_RUN:
1741 r = -EINVAL;
1742 if (arg)
1743 goto out;
1744 r = kvm_arch_vcpu_ioctl_run(vcpu, vcpu->run);
1745 trace_kvm_userspace_exit(vcpu->run->exit_reason, r);
1746 break;
1747 case KVM_GET_REGS: {
1748 struct kvm_regs *kvm_regs;
1749
1750 r = -ENOMEM;
1751 kvm_regs = kzalloc(sizeof(struct kvm_regs), GFP_KERNEL);
1752 if (!kvm_regs)
1753 goto out;
1754 r = kvm_arch_vcpu_ioctl_get_regs(vcpu, kvm_regs);
1755 if (r)
1756 goto out_free1;
1757 r = -EFAULT;
1758 if (copy_to_user(argp, kvm_regs, sizeof(struct kvm_regs)))
1759 goto out_free1;
1760 r = 0;
1761out_free1:
1762 kfree(kvm_regs);
1763 break;
1764 }
1765 case KVM_SET_REGS: {
1766 struct kvm_regs *kvm_regs;
1767
1768 r = -ENOMEM;
1769 kvm_regs = kzalloc(sizeof(struct kvm_regs), GFP_KERNEL);
1770 if (!kvm_regs)
1771 goto out;
1772 r = -EFAULT;
1773 if (copy_from_user(kvm_regs, argp, sizeof(struct kvm_regs)))
1774 goto out_free2;
1775 r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs);
1776 if (r)
1777 goto out_free2;
1778 r = 0;
1779out_free2:
1780 kfree(kvm_regs);
1781 break;
1782 }
1783 case KVM_GET_SREGS: {
1784 kvm_sregs = kzalloc(sizeof(struct kvm_sregs), GFP_KERNEL);
1785 r = -ENOMEM;
1786 if (!kvm_sregs)
1787 goto out;
1788 r = kvm_arch_vcpu_ioctl_get_sregs(vcpu, kvm_sregs);
1789 if (r)
1790 goto out;
1791 r = -EFAULT;
1792 if (copy_to_user(argp, kvm_sregs, sizeof(struct kvm_sregs)))
1793 goto out;
1794 r = 0;
1795 break;
1796 }
1797 case KVM_SET_SREGS: {
1798 kvm_sregs = kmalloc(sizeof(struct kvm_sregs), GFP_KERNEL);
1799 r = -ENOMEM;
1800 if (!kvm_sregs)
1801 goto out;
1802 r = -EFAULT;
1803 if (copy_from_user(kvm_sregs, argp, sizeof(struct kvm_sregs)))
1804 goto out;
1805 r = kvm_arch_vcpu_ioctl_set_sregs(vcpu, kvm_sregs);
1806 if (r)
1807 goto out;
1808 r = 0;
1809 break;
1810 }
1811 case KVM_GET_MP_STATE: {
1812 struct kvm_mp_state mp_state;
1813
1814 r = kvm_arch_vcpu_ioctl_get_mpstate(vcpu, &mp_state);
1815 if (r)
1816 goto out;
1817 r = -EFAULT;
1818 if (copy_to_user(argp, &mp_state, sizeof mp_state))
1819 goto out;
1820 r = 0;
1821 break;
1822 }
1823 case KVM_SET_MP_STATE: {
1824 struct kvm_mp_state mp_state;
1825
1826 r = -EFAULT;
1827 if (copy_from_user(&mp_state, argp, sizeof mp_state))
1828 goto out;
1829 r = kvm_arch_vcpu_ioctl_set_mpstate(vcpu, &mp_state);
1830 if (r)
1831 goto out;
1832 r = 0;
1833 break;
1834 }
1835 case KVM_TRANSLATE: {
1836 struct kvm_translation tr;
1837
1838 r = -EFAULT;
1839 if (copy_from_user(&tr, argp, sizeof tr))
1840 goto out;
1841 r = kvm_arch_vcpu_ioctl_translate(vcpu, &tr);
1842 if (r)
1843 goto out;
1844 r = -EFAULT;
1845 if (copy_to_user(argp, &tr, sizeof tr))
1846 goto out;
1847 r = 0;
1848 break;
1849 }
1850 case KVM_SET_GUEST_DEBUG: {
1851 struct kvm_guest_debug dbg;
1852
1853 r = -EFAULT;
1854 if (copy_from_user(&dbg, argp, sizeof dbg))
1855 goto out;
1856 r = kvm_arch_vcpu_ioctl_set_guest_debug(vcpu, &dbg);
1857 if (r)
1858 goto out;
1859 r = 0;
1860 break;
1861 }
1862 case KVM_SET_SIGNAL_MASK: {
1863 struct kvm_signal_mask __user *sigmask_arg = argp;
1864 struct kvm_signal_mask kvm_sigmask;
1865 sigset_t sigset, *p;
1866
1867 p = NULL;
1868 if (argp) {
1869 r = -EFAULT;
1870 if (copy_from_user(&kvm_sigmask, argp,
1871 sizeof kvm_sigmask))
1872 goto out;
1873 r = -EINVAL;
1874 if (kvm_sigmask.len != sizeof sigset)
1875 goto out;
1876 r = -EFAULT;
1877 if (copy_from_user(&sigset, sigmask_arg->sigset,
1878 sizeof sigset))
1879 goto out;
1880 p = &sigset;
1881 }
1882 r = kvm_vcpu_ioctl_set_sigmask(vcpu, p);
1883 break;
1884 }
1885 case KVM_GET_FPU: {
1886 fpu = kzalloc(sizeof(struct kvm_fpu), GFP_KERNEL);
1887 r = -ENOMEM;
1888 if (!fpu)
1889 goto out;
1890 r = kvm_arch_vcpu_ioctl_get_fpu(vcpu, fpu);
1891 if (r)
1892 goto out;
1893 r = -EFAULT;
1894 if (copy_to_user(argp, fpu, sizeof(struct kvm_fpu)))
1895 goto out;
1896 r = 0;
1897 break;
1898 }
1899 case KVM_SET_FPU: {
1900 fpu = kmalloc(sizeof(struct kvm_fpu), GFP_KERNEL);
1901 r = -ENOMEM;
1902 if (!fpu)
1903 goto out;
1904 r = -EFAULT;
1905 if (copy_from_user(fpu, argp, sizeof(struct kvm_fpu)))
1906 goto out;
1907 r = kvm_arch_vcpu_ioctl_set_fpu(vcpu, fpu);
1908 if (r)
1909 goto out;
1910 r = 0;
1911 break;
1912 }
1913 default:
1914 r = kvm_arch_vcpu_ioctl(filp, ioctl, arg);
1915 }
1916out:
1917 vcpu_put(vcpu);
1918 kfree(fpu);
1919 kfree(kvm_sregs);
1920 return r;
1921}
1922
1923#ifdef CONFIG_COMPAT
1924static long kvm_vcpu_compat_ioctl(struct file *filp,
1925 unsigned int ioctl, unsigned long arg)
1926{
1927 struct kvm_vcpu *vcpu = filp->private_data;
1928 void __user *argp = compat_ptr(arg);
1929 int r;
1930
1931 if (vcpu->kvm->mm != current->mm)
1932 return -EIO;
1933
1934 switch (ioctl) {
1935 case KVM_SET_SIGNAL_MASK: {
1936 struct kvm_signal_mask __user *sigmask_arg = argp;
1937 struct kvm_signal_mask kvm_sigmask;
1938 compat_sigset_t csigset;
1939 sigset_t sigset;
1940
1941 if (argp) {
1942 r = -EFAULT;
1943 if (copy_from_user(&kvm_sigmask, argp,
1944 sizeof kvm_sigmask))
1945 goto out;
1946 r = -EINVAL;
1947 if (kvm_sigmask.len != sizeof csigset)
1948 goto out;
1949 r = -EFAULT;
1950 if (copy_from_user(&csigset, sigmask_arg->sigset,
1951 sizeof csigset))
1952 goto out;
1953 }
1954 sigset_from_compat(&sigset, &csigset);
1955 r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
1956 break;
1957 }
1958 default:
1959 r = kvm_vcpu_ioctl(filp, ioctl, arg);
1960 }
1961
1962out:
1963 return r;
1964}
1965#endif
1966
1967static long kvm_vm_ioctl(struct file *filp,
1968 unsigned int ioctl, unsigned long arg)
1969{
1970 struct kvm *kvm = filp->private_data;
1971 void __user *argp = (void __user *)arg;
1972 int r;
1973
1974 if (kvm->mm != current->mm)
1975 return -EIO;
1976 switch (ioctl) {
1977 case KVM_CREATE_VCPU:
1978 r = kvm_vm_ioctl_create_vcpu(kvm, arg);
1979 if (r < 0)
1980 goto out;
1981 break;
1982 case KVM_SET_USER_MEMORY_REGION: {
1983 struct kvm_userspace_memory_region kvm_userspace_mem;
1984
1985 r = -EFAULT;
1986 if (copy_from_user(&kvm_userspace_mem, argp,
1987 sizeof kvm_userspace_mem))
1988 goto out;
1989
1990 r = kvm_vm_ioctl_set_memory_region(kvm, &kvm_userspace_mem, 1);
1991 if (r)
1992 goto out;
1993 break;
1994 }
1995 case KVM_GET_DIRTY_LOG: {
1996 struct kvm_dirty_log log;
1997
1998 r = -EFAULT;
1999 if (copy_from_user(&log, argp, sizeof log))
2000 goto out;
2001 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
2002 if (r)
2003 goto out;
2004 break;
2005 }
2006#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2007 case KVM_REGISTER_COALESCED_MMIO: {
2008 struct kvm_coalesced_mmio_zone zone;
2009 r = -EFAULT;
2010 if (copy_from_user(&zone, argp, sizeof zone))
2011 goto out;
2012 r = kvm_vm_ioctl_register_coalesced_mmio(kvm, &zone);
2013 if (r)
2014 goto out;
2015 r = 0;
2016 break;
2017 }
2018 case KVM_UNREGISTER_COALESCED_MMIO: {
2019 struct kvm_coalesced_mmio_zone zone;
2020 r = -EFAULT;
2021 if (copy_from_user(&zone, argp, sizeof zone))
2022 goto out;
2023 r = kvm_vm_ioctl_unregister_coalesced_mmio(kvm, &zone);
2024 if (r)
2025 goto out;
2026 r = 0;
2027 break;
2028 }
2029#endif
2030 case KVM_IRQFD: {
2031 struct kvm_irqfd data;
2032
2033 r = -EFAULT;
2034 if (copy_from_user(&data, argp, sizeof data))
2035 goto out;
2036 r = kvm_irqfd(kvm, data.fd, data.gsi, data.flags);
2037 break;
2038 }
2039 case KVM_IOEVENTFD: {
2040 struct kvm_ioeventfd data;
2041
2042 r = -EFAULT;
2043 if (copy_from_user(&data, argp, sizeof data))
2044 goto out;
2045 r = kvm_ioeventfd(kvm, &data);
2046 break;
2047 }
2048#ifdef CONFIG_KVM_APIC_ARCHITECTURE
2049 case KVM_SET_BOOT_CPU_ID:
2050 r = 0;
2051 mutex_lock(&kvm->lock);
2052 if (atomic_read(&kvm->online_vcpus) != 0)
2053 r = -EBUSY;
2054 else
2055 kvm->bsp_vcpu_id = arg;
2056 mutex_unlock(&kvm->lock);
2057 break;
2058#endif
2059 default:
2060 r = kvm_arch_vm_ioctl(filp, ioctl, arg);
2061 if (r == -ENOTTY)
2062 r = kvm_vm_ioctl_assigned_device(kvm, ioctl, arg);
2063 }
2064out:
2065 return r;
2066}
2067
2068#ifdef CONFIG_COMPAT
2069struct compat_kvm_dirty_log {
2070 __u32 slot;
2071 __u32 padding1;
2072 union {
2073 compat_uptr_t dirty_bitmap; /* one bit per page */
2074 __u64 padding2;
2075 };
2076};
2077
2078static long kvm_vm_compat_ioctl(struct file *filp,
2079 unsigned int ioctl, unsigned long arg)
2080{
2081 struct kvm *kvm = filp->private_data;
2082 int r;
2083
2084 if (kvm->mm != current->mm)
2085 return -EIO;
2086 switch (ioctl) {
2087 case KVM_GET_DIRTY_LOG: {
2088 struct compat_kvm_dirty_log compat_log;
2089 struct kvm_dirty_log log;
2090
2091 r = -EFAULT;
2092 if (copy_from_user(&compat_log, (void __user *)arg,
2093 sizeof(compat_log)))
2094 goto out;
2095 log.slot = compat_log.slot;
2096 log.padding1 = compat_log.padding1;
2097 log.padding2 = compat_log.padding2;
2098 log.dirty_bitmap = compat_ptr(compat_log.dirty_bitmap);
2099
2100 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
2101 if (r)
2102 goto out;
2103 break;
2104 }
2105 default:
2106 r = kvm_vm_ioctl(filp, ioctl, arg);
2107 }
2108
2109out:
2110 return r;
2111}
2112#endif
2113
2114static int kvm_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
2115{
2116 struct page *page[1];
2117 unsigned long addr;
2118 int npages;
2119 gfn_t gfn = vmf->pgoff;
2120 struct kvm *kvm = vma->vm_file->private_data;
2121
2122 addr = gfn_to_hva(kvm, gfn);
2123 if (kvm_is_error_hva(addr))
2124 return VM_FAULT_SIGBUS;
2125
2126 npages = get_user_pages(current, current->mm, addr, 1, 1, 0, page,
2127 NULL);
2128 if (unlikely(npages != 1))
2129 return VM_FAULT_SIGBUS;
2130
2131 vmf->page = page[0];
2132 return 0;
2133}
2134
2135static const struct vm_operations_struct kvm_vm_vm_ops = {
2136 .fault = kvm_vm_fault,
2137};
2138
2139static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
2140{
2141 vma->vm_ops = &kvm_vm_vm_ops;
2142 return 0;
2143}
2144
2145static struct file_operations kvm_vm_fops = {
2146 .release = kvm_vm_release,
2147 .unlocked_ioctl = kvm_vm_ioctl,
2148#ifdef CONFIG_COMPAT
2149 .compat_ioctl = kvm_vm_compat_ioctl,
2150#endif
2151 .mmap = kvm_vm_mmap,
2152 .llseek = noop_llseek,
2153};
2154
2155static int kvm_dev_ioctl_create_vm(void)
2156{
2157 int r;
2158 struct kvm *kvm;
2159
2160 kvm = kvm_create_vm();
2161 if (IS_ERR(kvm))
2162 return PTR_ERR(kvm);
2163#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2164 r = kvm_coalesced_mmio_init(kvm);
2165 if (r < 0) {
2166 kvm_put_kvm(kvm);
2167 return r;
2168 }
2169#endif
2170 r = anon_inode_getfd("kvm-vm", &kvm_vm_fops, kvm, O_RDWR);
2171 if (r < 0)
2172 kvm_put_kvm(kvm);
2173
2174 return r;
2175}
2176
2177static long kvm_dev_ioctl_check_extension_generic(long arg)
2178{
2179 switch (arg) {
2180 case KVM_CAP_USER_MEMORY:
2181 case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:
2182 case KVM_CAP_JOIN_MEMORY_REGIONS_WORKS:
2183#ifdef CONFIG_KVM_APIC_ARCHITECTURE
2184 case KVM_CAP_SET_BOOT_CPU_ID:
2185#endif
2186 case KVM_CAP_INTERNAL_ERROR_DATA:
2187 return 1;
2188#ifdef CONFIG_HAVE_KVM_IRQCHIP
2189 case KVM_CAP_IRQ_ROUTING:
2190 return KVM_MAX_IRQ_ROUTES;
2191#endif
2192 default:
2193 break;
2194 }
2195 return kvm_dev_ioctl_check_extension(arg);
2196}
2197
2198static long kvm_dev_ioctl(struct file *filp,
2199 unsigned int ioctl, unsigned long arg)
2200{
2201 long r = -EINVAL;
2202
2203 switch (ioctl) {
2204 case KVM_GET_API_VERSION:
2205 r = -EINVAL;
2206 if (arg)
2207 goto out;
2208 r = KVM_API_VERSION;
2209 break;
2210 case KVM_CREATE_VM:
2211 r = -EINVAL;
2212 if (arg)
2213 goto out;
2214 r = kvm_dev_ioctl_create_vm();
2215 break;
2216 case KVM_CHECK_EXTENSION:
2217 r = kvm_dev_ioctl_check_extension_generic(arg);
2218 break;
2219 case KVM_GET_VCPU_MMAP_SIZE:
2220 r = -EINVAL;
2221 if (arg)
2222 goto out;
2223 r = PAGE_SIZE; /* struct kvm_run */
2224#ifdef CONFIG_X86
2225 r += PAGE_SIZE; /* pio data page */
2226#endif
2227#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2228 r += PAGE_SIZE; /* coalesced mmio ring page */
2229#endif
2230 break;
2231 case KVM_TRACE_ENABLE:
2232 case KVM_TRACE_PAUSE:
2233 case KVM_TRACE_DISABLE:
2234 r = -EOPNOTSUPP;
2235 break;
2236 default:
2237 return kvm_arch_dev_ioctl(filp, ioctl, arg);
2238 }
2239out:
2240 return r;
2241}
2242
2243static struct file_operations kvm_chardev_ops = {
2244 .unlocked_ioctl = kvm_dev_ioctl,
2245 .compat_ioctl = kvm_dev_ioctl,
2246 .llseek = noop_llseek,
2247};
2248
2249static struct miscdevice kvm_dev = {
2250 KVM_MINOR,
2251 "kvm",
2252 &kvm_chardev_ops,
2253};
2254
2255static void hardware_enable_nolock(void *junk)
2256{
2257 int cpu = raw_smp_processor_id();
2258 int r;
2259
2260 if (cpumask_test_cpu(cpu, cpus_hardware_enabled))
2261 return;
2262
2263 cpumask_set_cpu(cpu, cpus_hardware_enabled);
2264
2265 r = kvm_arch_hardware_enable(NULL);
2266
2267 if (r) {
2268 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
2269 atomic_inc(&hardware_enable_failed);
2270 printk(KERN_INFO "kvm: enabling virtualization on "
2271 "CPU%d failed\n", cpu);
2272 }
2273}
2274
2275static void hardware_enable(void *junk)
2276{
2277 raw_spin_lock(&kvm_lock);
2278 hardware_enable_nolock(junk);
2279 raw_spin_unlock(&kvm_lock);
2280}
2281
2282static void hardware_disable_nolock(void *junk)
2283{
2284 int cpu = raw_smp_processor_id();
2285
2286 if (!cpumask_test_cpu(cpu, cpus_hardware_enabled))
2287 return;
2288 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
2289 kvm_arch_hardware_disable(NULL);
2290}
2291
2292static void hardware_disable(void *junk)
2293{
2294 raw_spin_lock(&kvm_lock);
2295 hardware_disable_nolock(junk);
2296 raw_spin_unlock(&kvm_lock);
2297}
2298
2299static void hardware_disable_all_nolock(void)
2300{
2301 BUG_ON(!kvm_usage_count);
2302
2303 kvm_usage_count--;
2304 if (!kvm_usage_count)
2305 on_each_cpu(hardware_disable_nolock, NULL, 1);
2306}
2307
2308static void hardware_disable_all(void)
2309{
2310 raw_spin_lock(&kvm_lock);
2311 hardware_disable_all_nolock();
2312 raw_spin_unlock(&kvm_lock);
2313}
2314
2315static int hardware_enable_all(void)
2316{
2317 int r = 0;
2318
2319 raw_spin_lock(&kvm_lock);
2320
2321 kvm_usage_count++;
2322 if (kvm_usage_count == 1) {
2323 atomic_set(&hardware_enable_failed, 0);
2324 on_each_cpu(hardware_enable_nolock, NULL, 1);
2325
2326 if (atomic_read(&hardware_enable_failed)) {
2327 hardware_disable_all_nolock();
2328 r = -EBUSY;
2329 }
2330 }
2331
2332 raw_spin_unlock(&kvm_lock);
2333
2334 return r;
2335}
2336
2337static int kvm_cpu_hotplug(struct notifier_block *notifier, unsigned long val,
2338 void *v)
2339{
2340 int cpu = (long)v;
2341
2342 if (!kvm_usage_count)
2343 return NOTIFY_OK;
2344
2345 val &= ~CPU_TASKS_FROZEN;
2346 switch (val) {
2347 case CPU_DYING:
2348 printk(KERN_INFO "kvm: disabling virtualization on CPU%d\n",
2349 cpu);
2350 hardware_disable(NULL);
2351 break;
2352 case CPU_STARTING:
2353 printk(KERN_INFO "kvm: enabling virtualization on CPU%d\n",
2354 cpu);
2355 hardware_enable(NULL);
2356 break;
2357 }
2358 return NOTIFY_OK;
2359}
2360
2361
2362asmlinkage void kvm_spurious_fault(void)
2363{
2364 /* Fault while not rebooting. We want the trace. */
2365 BUG();
2366}
2367EXPORT_SYMBOL_GPL(kvm_spurious_fault);
2368
2369static int kvm_reboot(struct notifier_block *notifier, unsigned long val,
2370 void *v)
2371{
2372 /*
2373 * Some (well, at least mine) BIOSes hang on reboot if
2374 * in vmx root mode.
2375 *
2376 * And Intel TXT required VMX off for all cpu when system shutdown.
2377 */
2378 printk(KERN_INFO "kvm: exiting hardware virtualization\n");
2379 kvm_rebooting = true;
2380 on_each_cpu(hardware_disable_nolock, NULL, 1);
2381 return NOTIFY_OK;
2382}
2383
2384static struct notifier_block kvm_reboot_notifier = {
2385 .notifier_call = kvm_reboot,
2386 .priority = 0,
2387};
2388
2389static void kvm_io_bus_destroy(struct kvm_io_bus *bus)
2390{
2391 int i;
2392
2393 for (i = 0; i < bus->dev_count; i++) {
2394 struct kvm_io_device *pos = bus->devs[i];
2395
2396 kvm_iodevice_destructor(pos);
2397 }
2398 kfree(bus);
2399}
2400
2401/* kvm_io_bus_write - called under kvm->slots_lock */
2402int kvm_io_bus_write(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
2403 int len, const void *val)
2404{
2405 int i;
2406 struct kvm_io_bus *bus;
2407
2408 bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
2409 for (i = 0; i < bus->dev_count; i++)
2410 if (!kvm_iodevice_write(bus->devs[i], addr, len, val))
2411 return 0;
2412 return -EOPNOTSUPP;
2413}
2414
2415/* kvm_io_bus_read - called under kvm->slots_lock */
2416int kvm_io_bus_read(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
2417 int len, void *val)
2418{
2419 int i;
2420 struct kvm_io_bus *bus;
2421
2422 bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
2423 for (i = 0; i < bus->dev_count; i++)
2424 if (!kvm_iodevice_read(bus->devs[i], addr, len, val))
2425 return 0;
2426 return -EOPNOTSUPP;
2427}
2428
2429/* Caller must hold slots_lock. */
2430int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx,
2431 struct kvm_io_device *dev)
2432{
2433 struct kvm_io_bus *new_bus, *bus;
2434
2435 bus = kvm->buses[bus_idx];
2436 if (bus->dev_count > NR_IOBUS_DEVS-1)
2437 return -ENOSPC;
2438
2439 new_bus = kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL);
2440 if (!new_bus)
2441 return -ENOMEM;
2442 memcpy(new_bus, bus, sizeof(struct kvm_io_bus));
2443 new_bus->devs[new_bus->dev_count++] = dev;
2444 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
2445 synchronize_srcu_expedited(&kvm->srcu);
2446 kfree(bus);
2447
2448 return 0;
2449}
2450
2451/* Caller must hold slots_lock. */
2452int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
2453 struct kvm_io_device *dev)
2454{
2455 int i, r;
2456 struct kvm_io_bus *new_bus, *bus;
2457
2458 new_bus = kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL);
2459 if (!new_bus)
2460 return -ENOMEM;
2461
2462 bus = kvm->buses[bus_idx];
2463 memcpy(new_bus, bus, sizeof(struct kvm_io_bus));
2464
2465 r = -ENOENT;
2466 for (i = 0; i < new_bus->dev_count; i++)
2467 if (new_bus->devs[i] == dev) {
2468 r = 0;
2469 new_bus->devs[i] = new_bus->devs[--new_bus->dev_count];
2470 break;
2471 }
2472
2473 if (r) {
2474 kfree(new_bus);
2475 return r;
2476 }
2477
2478 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
2479 synchronize_srcu_expedited(&kvm->srcu);
2480 kfree(bus);
2481 return r;
2482}
2483
2484static struct notifier_block kvm_cpu_notifier = {
2485 .notifier_call = kvm_cpu_hotplug,
2486};
2487
2488static int vm_stat_get(void *_offset, u64 *val)
2489{
2490 unsigned offset = (long)_offset;
2491 struct kvm *kvm;
2492
2493 *val = 0;
2494 raw_spin_lock(&kvm_lock);
2495 list_for_each_entry(kvm, &vm_list, vm_list)
2496 *val += *(u32 *)((void *)kvm + offset);
2497 raw_spin_unlock(&kvm_lock);
2498 return 0;
2499}
2500
2501DEFINE_SIMPLE_ATTRIBUTE(vm_stat_fops, vm_stat_get, NULL, "%llu\n");
2502
2503static int vcpu_stat_get(void *_offset, u64 *val)
2504{
2505 unsigned offset = (long)_offset;
2506 struct kvm *kvm;
2507 struct kvm_vcpu *vcpu;
2508 int i;
2509
2510 *val = 0;
2511 raw_spin_lock(&kvm_lock);
2512 list_for_each_entry(kvm, &vm_list, vm_list)
2513 kvm_for_each_vcpu(i, vcpu, kvm)
2514 *val += *(u32 *)((void *)vcpu + offset);
2515
2516 raw_spin_unlock(&kvm_lock);
2517 return 0;
2518}
2519
2520DEFINE_SIMPLE_ATTRIBUTE(vcpu_stat_fops, vcpu_stat_get, NULL, "%llu\n");
2521
2522static const struct file_operations *stat_fops[] = {
2523 [KVM_STAT_VCPU] = &vcpu_stat_fops,
2524 [KVM_STAT_VM] = &vm_stat_fops,
2525};
2526
2527static void kvm_init_debug(void)
2528{
2529 struct kvm_stats_debugfs_item *p;
2530
2531 kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);
2532 for (p = debugfs_entries; p->name; ++p)
2533 p->dentry = debugfs_create_file(p->name, 0444, kvm_debugfs_dir,
2534 (void *)(long)p->offset,
2535 stat_fops[p->kind]);
2536}
2537
2538static void kvm_exit_debug(void)
2539{
2540 struct kvm_stats_debugfs_item *p;
2541
2542 for (p = debugfs_entries; p->name; ++p)
2543 debugfs_remove(p->dentry);
2544 debugfs_remove(kvm_debugfs_dir);
2545}
2546
2547static int kvm_suspend(void)
2548{
2549 if (kvm_usage_count)
2550 hardware_disable_nolock(NULL);
2551 return 0;
2552}
2553
2554static void kvm_resume(void)
2555{
2556 if (kvm_usage_count) {
2557 WARN_ON(raw_spin_is_locked(&kvm_lock));
2558 hardware_enable_nolock(NULL);
2559 }
2560}
2561
2562static struct syscore_ops kvm_syscore_ops = {
2563 .suspend = kvm_suspend,
2564 .resume = kvm_resume,
2565};
2566
2567struct page *bad_page;
2568pfn_t bad_pfn;
2569
2570static inline
2571struct kvm_vcpu *preempt_notifier_to_vcpu(struct preempt_notifier *pn)
2572{
2573 return container_of(pn, struct kvm_vcpu, preempt_notifier);
2574}
2575
2576static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
2577{
2578 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
2579
2580 kvm_arch_vcpu_load(vcpu, cpu);
2581}
2582
2583static void kvm_sched_out(struct preempt_notifier *pn,
2584 struct task_struct *next)
2585{
2586 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
2587
2588 kvm_arch_vcpu_put(vcpu);
2589}
2590
2591int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
2592 struct module *module)
2593{
2594 int r;
2595 int cpu;
2596
2597 r = kvm_arch_init(opaque);
2598 if (r)
2599 goto out_fail;
2600
2601 bad_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
2602
2603 if (bad_page == NULL) {
2604 r = -ENOMEM;
2605 goto out;
2606 }
2607
2608 bad_pfn = page_to_pfn(bad_page);
2609
2610 hwpoison_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
2611
2612 if (hwpoison_page == NULL) {
2613 r = -ENOMEM;
2614 goto out_free_0;
2615 }
2616
2617 hwpoison_pfn = page_to_pfn(hwpoison_page);
2618
2619 fault_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
2620
2621 if (fault_page == NULL) {
2622 r = -ENOMEM;
2623 goto out_free_0;
2624 }
2625
2626 fault_pfn = page_to_pfn(fault_page);
2627
2628 if (!zalloc_cpumask_var(&cpus_hardware_enabled, GFP_KERNEL)) {
2629 r = -ENOMEM;
2630 goto out_free_0;
2631 }
2632
2633 r = kvm_arch_hardware_setup();
2634 if (r < 0)
2635 goto out_free_0a;
2636
2637 for_each_online_cpu(cpu) {
2638 smp_call_function_single(cpu,
2639 kvm_arch_check_processor_compat,
2640 &r, 1);
2641 if (r < 0)
2642 goto out_free_1;
2643 }
2644
2645 r = register_cpu_notifier(&kvm_cpu_notifier);
2646 if (r)
2647 goto out_free_2;
2648 register_reboot_notifier(&kvm_reboot_notifier);
2649
2650 /* A kmem cache lets us meet the alignment requirements of fx_save. */
2651 if (!vcpu_align)
2652 vcpu_align = __alignof__(struct kvm_vcpu);
2653 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
2654 0, NULL);
2655 if (!kvm_vcpu_cache) {
2656 r = -ENOMEM;
2657 goto out_free_3;
2658 }
2659
2660 r = kvm_async_pf_init();
2661 if (r)
2662 goto out_free;
2663
2664 kvm_chardev_ops.owner = module;
2665 kvm_vm_fops.owner = module;
2666 kvm_vcpu_fops.owner = module;
2667
2668 r = misc_register(&kvm_dev);
2669 if (r) {
2670 printk(KERN_ERR "kvm: misc device register failed\n");
2671 goto out_unreg;
2672 }
2673
2674 register_syscore_ops(&kvm_syscore_ops);
2675
2676 kvm_preempt_ops.sched_in = kvm_sched_in;
2677 kvm_preempt_ops.sched_out = kvm_sched_out;
2678
2679 kvm_init_debug();
2680
2681 return 0;
2682
2683out_unreg:
2684 kvm_async_pf_deinit();
2685out_free:
2686 kmem_cache_destroy(kvm_vcpu_cache);
2687out_free_3:
2688 unregister_reboot_notifier(&kvm_reboot_notifier);
2689 unregister_cpu_notifier(&kvm_cpu_notifier);
2690out_free_2:
2691out_free_1:
2692 kvm_arch_hardware_unsetup();
2693out_free_0a:
2694 free_cpumask_var(cpus_hardware_enabled);
2695out_free_0:
2696 if (fault_page)
2697 __free_page(fault_page);
2698 if (hwpoison_page)
2699 __free_page(hwpoison_page);
2700 __free_page(bad_page);
2701out:
2702 kvm_arch_exit();
2703out_fail:
2704 return r;
2705}
2706EXPORT_SYMBOL_GPL(kvm_init);
2707
2708void kvm_exit(void)
2709{
2710 kvm_exit_debug();
2711 misc_deregister(&kvm_dev);
2712 kmem_cache_destroy(kvm_vcpu_cache);
2713 kvm_async_pf_deinit();
2714 unregister_syscore_ops(&kvm_syscore_ops);
2715 unregister_reboot_notifier(&kvm_reboot_notifier);
2716 unregister_cpu_notifier(&kvm_cpu_notifier);
2717 on_each_cpu(hardware_disable_nolock, NULL, 1);
2718 kvm_arch_hardware_unsetup();
2719 kvm_arch_exit();
2720 free_cpumask_var(cpus_hardware_enabled);
2721 __free_page(hwpoison_page);
2722 __free_page(bad_page);
2723}
2724EXPORT_SYMBOL_GPL(kvm_exit);
1/*
2 * Kernel-based Virtual Machine driver for Linux
3 *
4 * This module enables machines with Intel VT-x extensions to run virtual
5 * machines without emulation or binary translation.
6 *
7 * Copyright (C) 2006 Qumranet, Inc.
8 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
9 *
10 * Authors:
11 * Avi Kivity <avi@qumranet.com>
12 * Yaniv Kamay <yaniv@qumranet.com>
13 *
14 * This work is licensed under the terms of the GNU GPL, version 2. See
15 * the COPYING file in the top-level directory.
16 *
17 */
18
19#include <kvm/iodev.h>
20
21#include <linux/kvm_host.h>
22#include <linux/kvm.h>
23#include <linux/module.h>
24#include <linux/errno.h>
25#include <linux/percpu.h>
26#include <linux/mm.h>
27#include <linux/miscdevice.h>
28#include <linux/vmalloc.h>
29#include <linux/reboot.h>
30#include <linux/debugfs.h>
31#include <linux/highmem.h>
32#include <linux/file.h>
33#include <linux/syscore_ops.h>
34#include <linux/cpu.h>
35#include <linux/sched.h>
36#include <linux/cpumask.h>
37#include <linux/smp.h>
38#include <linux/anon_inodes.h>
39#include <linux/profile.h>
40#include <linux/kvm_para.h>
41#include <linux/pagemap.h>
42#include <linux/mman.h>
43#include <linux/swap.h>
44#include <linux/bitops.h>
45#include <linux/spinlock.h>
46#include <linux/compat.h>
47#include <linux/srcu.h>
48#include <linux/hugetlb.h>
49#include <linux/slab.h>
50#include <linux/sort.h>
51#include <linux/bsearch.h>
52
53#include <asm/processor.h>
54#include <asm/io.h>
55#include <asm/ioctl.h>
56#include <linux/uaccess.h>
57#include <asm/pgtable.h>
58
59#include "coalesced_mmio.h"
60#include "async_pf.h"
61#include "vfio.h"
62
63#define CREATE_TRACE_POINTS
64#include <trace/events/kvm.h>
65
66/* Worst case buffer size needed for holding an integer. */
67#define ITOA_MAX_LEN 12
68
69MODULE_AUTHOR("Qumranet");
70MODULE_LICENSE("GPL");
71
72/* Architectures should define their poll value according to the halt latency */
73unsigned int halt_poll_ns = KVM_HALT_POLL_NS_DEFAULT;
74module_param(halt_poll_ns, uint, S_IRUGO | S_IWUSR);
75EXPORT_SYMBOL_GPL(halt_poll_ns);
76
77/* Default doubles per-vcpu halt_poll_ns. */
78unsigned int halt_poll_ns_grow = 2;
79module_param(halt_poll_ns_grow, uint, S_IRUGO | S_IWUSR);
80EXPORT_SYMBOL_GPL(halt_poll_ns_grow);
81
82/* Default resets per-vcpu halt_poll_ns . */
83unsigned int halt_poll_ns_shrink;
84module_param(halt_poll_ns_shrink, uint, S_IRUGO | S_IWUSR);
85EXPORT_SYMBOL_GPL(halt_poll_ns_shrink);
86
87/*
88 * Ordering of locks:
89 *
90 * kvm->lock --> kvm->slots_lock --> kvm->irq_lock
91 */
92
93DEFINE_SPINLOCK(kvm_lock);
94static DEFINE_RAW_SPINLOCK(kvm_count_lock);
95LIST_HEAD(vm_list);
96
97static cpumask_var_t cpus_hardware_enabled;
98static int kvm_usage_count;
99static atomic_t hardware_enable_failed;
100
101struct kmem_cache *kvm_vcpu_cache;
102EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
103
104static __read_mostly struct preempt_ops kvm_preempt_ops;
105
106struct dentry *kvm_debugfs_dir;
107EXPORT_SYMBOL_GPL(kvm_debugfs_dir);
108
109static int kvm_debugfs_num_entries;
110static const struct file_operations *stat_fops_per_vm[];
111
112static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl,
113 unsigned long arg);
114#ifdef CONFIG_KVM_COMPAT
115static long kvm_vcpu_compat_ioctl(struct file *file, unsigned int ioctl,
116 unsigned long arg);
117#endif
118static int hardware_enable_all(void);
119static void hardware_disable_all(void);
120
121static void kvm_io_bus_destroy(struct kvm_io_bus *bus);
122
123static void kvm_release_pfn_dirty(kvm_pfn_t pfn);
124static void mark_page_dirty_in_slot(struct kvm_memory_slot *memslot, gfn_t gfn);
125
126__visible bool kvm_rebooting;
127EXPORT_SYMBOL_GPL(kvm_rebooting);
128
129static bool largepages_enabled = true;
130
131bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
132{
133 if (pfn_valid(pfn))
134 return PageReserved(pfn_to_page(pfn));
135
136 return true;
137}
138
139/*
140 * Switches to specified vcpu, until a matching vcpu_put()
141 */
142int vcpu_load(struct kvm_vcpu *vcpu)
143{
144 int cpu;
145
146 if (mutex_lock_killable(&vcpu->mutex))
147 return -EINTR;
148 cpu = get_cpu();
149 preempt_notifier_register(&vcpu->preempt_notifier);
150 kvm_arch_vcpu_load(vcpu, cpu);
151 put_cpu();
152 return 0;
153}
154EXPORT_SYMBOL_GPL(vcpu_load);
155
156void vcpu_put(struct kvm_vcpu *vcpu)
157{
158 preempt_disable();
159 kvm_arch_vcpu_put(vcpu);
160 preempt_notifier_unregister(&vcpu->preempt_notifier);
161 preempt_enable();
162 mutex_unlock(&vcpu->mutex);
163}
164EXPORT_SYMBOL_GPL(vcpu_put);
165
166static void ack_flush(void *_completed)
167{
168}
169
170bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req)
171{
172 int i, cpu, me;
173 cpumask_var_t cpus;
174 bool called = true;
175 struct kvm_vcpu *vcpu;
176
177 zalloc_cpumask_var(&cpus, GFP_ATOMIC);
178
179 me = get_cpu();
180 kvm_for_each_vcpu(i, vcpu, kvm) {
181 kvm_make_request(req, vcpu);
182 cpu = vcpu->cpu;
183
184 /* Set ->requests bit before we read ->mode. */
185 smp_mb__after_atomic();
186
187 if (cpus != NULL && cpu != -1 && cpu != me &&
188 kvm_vcpu_exiting_guest_mode(vcpu) != OUTSIDE_GUEST_MODE)
189 cpumask_set_cpu(cpu, cpus);
190 }
191 if (unlikely(cpus == NULL))
192 smp_call_function_many(cpu_online_mask, ack_flush, NULL, 1);
193 else if (!cpumask_empty(cpus))
194 smp_call_function_many(cpus, ack_flush, NULL, 1);
195 else
196 called = false;
197 put_cpu();
198 free_cpumask_var(cpus);
199 return called;
200}
201
202#ifndef CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL
203void kvm_flush_remote_tlbs(struct kvm *kvm)
204{
205 /*
206 * Read tlbs_dirty before setting KVM_REQ_TLB_FLUSH in
207 * kvm_make_all_cpus_request.
208 */
209 long dirty_count = smp_load_acquire(&kvm->tlbs_dirty);
210
211 /*
212 * We want to publish modifications to the page tables before reading
213 * mode. Pairs with a memory barrier in arch-specific code.
214 * - x86: smp_mb__after_srcu_read_unlock in vcpu_enter_guest
215 * and smp_mb in walk_shadow_page_lockless_begin/end.
216 * - powerpc: smp_mb in kvmppc_prepare_to_enter.
217 *
218 * There is already an smp_mb__after_atomic() before
219 * kvm_make_all_cpus_request() reads vcpu->mode. We reuse that
220 * barrier here.
221 */
222 if (kvm_make_all_cpus_request(kvm, KVM_REQ_TLB_FLUSH))
223 ++kvm->stat.remote_tlb_flush;
224 cmpxchg(&kvm->tlbs_dirty, dirty_count, 0);
225}
226EXPORT_SYMBOL_GPL(kvm_flush_remote_tlbs);
227#endif
228
229void kvm_reload_remote_mmus(struct kvm *kvm)
230{
231 kvm_make_all_cpus_request(kvm, KVM_REQ_MMU_RELOAD);
232}
233
234int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
235{
236 struct page *page;
237 int r;
238
239 mutex_init(&vcpu->mutex);
240 vcpu->cpu = -1;
241 vcpu->kvm = kvm;
242 vcpu->vcpu_id = id;
243 vcpu->pid = NULL;
244 init_swait_queue_head(&vcpu->wq);
245 kvm_async_pf_vcpu_init(vcpu);
246
247 vcpu->pre_pcpu = -1;
248 INIT_LIST_HEAD(&vcpu->blocked_vcpu_list);
249
250 page = alloc_page(GFP_KERNEL | __GFP_ZERO);
251 if (!page) {
252 r = -ENOMEM;
253 goto fail;
254 }
255 vcpu->run = page_address(page);
256
257 kvm_vcpu_set_in_spin_loop(vcpu, false);
258 kvm_vcpu_set_dy_eligible(vcpu, false);
259 vcpu->preempted = false;
260
261 r = kvm_arch_vcpu_init(vcpu);
262 if (r < 0)
263 goto fail_free_run;
264 return 0;
265
266fail_free_run:
267 free_page((unsigned long)vcpu->run);
268fail:
269 return r;
270}
271EXPORT_SYMBOL_GPL(kvm_vcpu_init);
272
273void kvm_vcpu_uninit(struct kvm_vcpu *vcpu)
274{
275 put_pid(vcpu->pid);
276 kvm_arch_vcpu_uninit(vcpu);
277 free_page((unsigned long)vcpu->run);
278}
279EXPORT_SYMBOL_GPL(kvm_vcpu_uninit);
280
281#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
282static inline struct kvm *mmu_notifier_to_kvm(struct mmu_notifier *mn)
283{
284 return container_of(mn, struct kvm, mmu_notifier);
285}
286
287static void kvm_mmu_notifier_invalidate_page(struct mmu_notifier *mn,
288 struct mm_struct *mm,
289 unsigned long address)
290{
291 struct kvm *kvm = mmu_notifier_to_kvm(mn);
292 int need_tlb_flush, idx;
293
294 /*
295 * When ->invalidate_page runs, the linux pte has been zapped
296 * already but the page is still allocated until
297 * ->invalidate_page returns. So if we increase the sequence
298 * here the kvm page fault will notice if the spte can't be
299 * established because the page is going to be freed. If
300 * instead the kvm page fault establishes the spte before
301 * ->invalidate_page runs, kvm_unmap_hva will release it
302 * before returning.
303 *
304 * The sequence increase only need to be seen at spin_unlock
305 * time, and not at spin_lock time.
306 *
307 * Increasing the sequence after the spin_unlock would be
308 * unsafe because the kvm page fault could then establish the
309 * pte after kvm_unmap_hva returned, without noticing the page
310 * is going to be freed.
311 */
312 idx = srcu_read_lock(&kvm->srcu);
313 spin_lock(&kvm->mmu_lock);
314
315 kvm->mmu_notifier_seq++;
316 need_tlb_flush = kvm_unmap_hva(kvm, address) | kvm->tlbs_dirty;
317 /* we've to flush the tlb before the pages can be freed */
318 if (need_tlb_flush)
319 kvm_flush_remote_tlbs(kvm);
320
321 spin_unlock(&kvm->mmu_lock);
322
323 kvm_arch_mmu_notifier_invalidate_page(kvm, address);
324
325 srcu_read_unlock(&kvm->srcu, idx);
326}
327
328static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
329 struct mm_struct *mm,
330 unsigned long address,
331 pte_t pte)
332{
333 struct kvm *kvm = mmu_notifier_to_kvm(mn);
334 int idx;
335
336 idx = srcu_read_lock(&kvm->srcu);
337 spin_lock(&kvm->mmu_lock);
338 kvm->mmu_notifier_seq++;
339 kvm_set_spte_hva(kvm, address, pte);
340 spin_unlock(&kvm->mmu_lock);
341 srcu_read_unlock(&kvm->srcu, idx);
342}
343
344static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
345 struct mm_struct *mm,
346 unsigned long start,
347 unsigned long end)
348{
349 struct kvm *kvm = mmu_notifier_to_kvm(mn);
350 int need_tlb_flush = 0, idx;
351
352 idx = srcu_read_lock(&kvm->srcu);
353 spin_lock(&kvm->mmu_lock);
354 /*
355 * The count increase must become visible at unlock time as no
356 * spte can be established without taking the mmu_lock and
357 * count is also read inside the mmu_lock critical section.
358 */
359 kvm->mmu_notifier_count++;
360 need_tlb_flush = kvm_unmap_hva_range(kvm, start, end);
361 need_tlb_flush |= kvm->tlbs_dirty;
362 /* we've to flush the tlb before the pages can be freed */
363 if (need_tlb_flush)
364 kvm_flush_remote_tlbs(kvm);
365
366 spin_unlock(&kvm->mmu_lock);
367 srcu_read_unlock(&kvm->srcu, idx);
368}
369
370static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
371 struct mm_struct *mm,
372 unsigned long start,
373 unsigned long end)
374{
375 struct kvm *kvm = mmu_notifier_to_kvm(mn);
376
377 spin_lock(&kvm->mmu_lock);
378 /*
379 * This sequence increase will notify the kvm page fault that
380 * the page that is going to be mapped in the spte could have
381 * been freed.
382 */
383 kvm->mmu_notifier_seq++;
384 smp_wmb();
385 /*
386 * The above sequence increase must be visible before the
387 * below count decrease, which is ensured by the smp_wmb above
388 * in conjunction with the smp_rmb in mmu_notifier_retry().
389 */
390 kvm->mmu_notifier_count--;
391 spin_unlock(&kvm->mmu_lock);
392
393 BUG_ON(kvm->mmu_notifier_count < 0);
394}
395
396static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
397 struct mm_struct *mm,
398 unsigned long start,
399 unsigned long end)
400{
401 struct kvm *kvm = mmu_notifier_to_kvm(mn);
402 int young, idx;
403
404 idx = srcu_read_lock(&kvm->srcu);
405 spin_lock(&kvm->mmu_lock);
406
407 young = kvm_age_hva(kvm, start, end);
408 if (young)
409 kvm_flush_remote_tlbs(kvm);
410
411 spin_unlock(&kvm->mmu_lock);
412 srcu_read_unlock(&kvm->srcu, idx);
413
414 return young;
415}
416
417static int kvm_mmu_notifier_clear_young(struct mmu_notifier *mn,
418 struct mm_struct *mm,
419 unsigned long start,
420 unsigned long end)
421{
422 struct kvm *kvm = mmu_notifier_to_kvm(mn);
423 int young, idx;
424
425 idx = srcu_read_lock(&kvm->srcu);
426 spin_lock(&kvm->mmu_lock);
427 /*
428 * Even though we do not flush TLB, this will still adversely
429 * affect performance on pre-Haswell Intel EPT, where there is
430 * no EPT Access Bit to clear so that we have to tear down EPT
431 * tables instead. If we find this unacceptable, we can always
432 * add a parameter to kvm_age_hva so that it effectively doesn't
433 * do anything on clear_young.
434 *
435 * Also note that currently we never issue secondary TLB flushes
436 * from clear_young, leaving this job up to the regular system
437 * cadence. If we find this inaccurate, we might come up with a
438 * more sophisticated heuristic later.
439 */
440 young = kvm_age_hva(kvm, start, end);
441 spin_unlock(&kvm->mmu_lock);
442 srcu_read_unlock(&kvm->srcu, idx);
443
444 return young;
445}
446
447static int kvm_mmu_notifier_test_young(struct mmu_notifier *mn,
448 struct mm_struct *mm,
449 unsigned long address)
450{
451 struct kvm *kvm = mmu_notifier_to_kvm(mn);
452 int young, idx;
453
454 idx = srcu_read_lock(&kvm->srcu);
455 spin_lock(&kvm->mmu_lock);
456 young = kvm_test_age_hva(kvm, address);
457 spin_unlock(&kvm->mmu_lock);
458 srcu_read_unlock(&kvm->srcu, idx);
459
460 return young;
461}
462
463static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
464 struct mm_struct *mm)
465{
466 struct kvm *kvm = mmu_notifier_to_kvm(mn);
467 int idx;
468
469 idx = srcu_read_lock(&kvm->srcu);
470 kvm_arch_flush_shadow_all(kvm);
471 srcu_read_unlock(&kvm->srcu, idx);
472}
473
474static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
475 .invalidate_page = kvm_mmu_notifier_invalidate_page,
476 .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
477 .invalidate_range_end = kvm_mmu_notifier_invalidate_range_end,
478 .clear_flush_young = kvm_mmu_notifier_clear_flush_young,
479 .clear_young = kvm_mmu_notifier_clear_young,
480 .test_young = kvm_mmu_notifier_test_young,
481 .change_pte = kvm_mmu_notifier_change_pte,
482 .release = kvm_mmu_notifier_release,
483};
484
485static int kvm_init_mmu_notifier(struct kvm *kvm)
486{
487 kvm->mmu_notifier.ops = &kvm_mmu_notifier_ops;
488 return mmu_notifier_register(&kvm->mmu_notifier, current->mm);
489}
490
491#else /* !(CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER) */
492
493static int kvm_init_mmu_notifier(struct kvm *kvm)
494{
495 return 0;
496}
497
498#endif /* CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER */
499
500static struct kvm_memslots *kvm_alloc_memslots(void)
501{
502 int i;
503 struct kvm_memslots *slots;
504
505 slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
506 if (!slots)
507 return NULL;
508
509 /*
510 * Init kvm generation close to the maximum to easily test the
511 * code of handling generation number wrap-around.
512 */
513 slots->generation = -150;
514 for (i = 0; i < KVM_MEM_SLOTS_NUM; i++)
515 slots->id_to_index[i] = slots->memslots[i].id = i;
516
517 return slots;
518}
519
520static void kvm_destroy_dirty_bitmap(struct kvm_memory_slot *memslot)
521{
522 if (!memslot->dirty_bitmap)
523 return;
524
525 kvfree(memslot->dirty_bitmap);
526 memslot->dirty_bitmap = NULL;
527}
528
529/*
530 * Free any memory in @free but not in @dont.
531 */
532static void kvm_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
533 struct kvm_memory_slot *dont)
534{
535 if (!dont || free->dirty_bitmap != dont->dirty_bitmap)
536 kvm_destroy_dirty_bitmap(free);
537
538 kvm_arch_free_memslot(kvm, free, dont);
539
540 free->npages = 0;
541}
542
543static void kvm_free_memslots(struct kvm *kvm, struct kvm_memslots *slots)
544{
545 struct kvm_memory_slot *memslot;
546
547 if (!slots)
548 return;
549
550 kvm_for_each_memslot(memslot, slots)
551 kvm_free_memslot(kvm, memslot, NULL);
552
553 kvfree(slots);
554}
555
556static void kvm_destroy_vm_debugfs(struct kvm *kvm)
557{
558 int i;
559
560 if (!kvm->debugfs_dentry)
561 return;
562
563 debugfs_remove_recursive(kvm->debugfs_dentry);
564
565 if (kvm->debugfs_stat_data) {
566 for (i = 0; i < kvm_debugfs_num_entries; i++)
567 kfree(kvm->debugfs_stat_data[i]);
568 kfree(kvm->debugfs_stat_data);
569 }
570}
571
572static int kvm_create_vm_debugfs(struct kvm *kvm, int fd)
573{
574 char dir_name[ITOA_MAX_LEN * 2];
575 struct kvm_stat_data *stat_data;
576 struct kvm_stats_debugfs_item *p;
577
578 if (!debugfs_initialized())
579 return 0;
580
581 snprintf(dir_name, sizeof(dir_name), "%d-%d", task_pid_nr(current), fd);
582 kvm->debugfs_dentry = debugfs_create_dir(dir_name,
583 kvm_debugfs_dir);
584 if (!kvm->debugfs_dentry)
585 return -ENOMEM;
586
587 kvm->debugfs_stat_data = kcalloc(kvm_debugfs_num_entries,
588 sizeof(*kvm->debugfs_stat_data),
589 GFP_KERNEL);
590 if (!kvm->debugfs_stat_data)
591 return -ENOMEM;
592
593 for (p = debugfs_entries; p->name; p++) {
594 stat_data = kzalloc(sizeof(*stat_data), GFP_KERNEL);
595 if (!stat_data)
596 return -ENOMEM;
597
598 stat_data->kvm = kvm;
599 stat_data->offset = p->offset;
600 kvm->debugfs_stat_data[p - debugfs_entries] = stat_data;
601 if (!debugfs_create_file(p->name, 0644,
602 kvm->debugfs_dentry,
603 stat_data,
604 stat_fops_per_vm[p->kind]))
605 return -ENOMEM;
606 }
607 return 0;
608}
609
610static struct kvm *kvm_create_vm(unsigned long type)
611{
612 int r, i;
613 struct kvm *kvm = kvm_arch_alloc_vm();
614
615 if (!kvm)
616 return ERR_PTR(-ENOMEM);
617
618 spin_lock_init(&kvm->mmu_lock);
619 atomic_inc(¤t->mm->mm_count);
620 kvm->mm = current->mm;
621 kvm_eventfd_init(kvm);
622 mutex_init(&kvm->lock);
623 mutex_init(&kvm->irq_lock);
624 mutex_init(&kvm->slots_lock);
625 atomic_set(&kvm->users_count, 1);
626 INIT_LIST_HEAD(&kvm->devices);
627
628 r = kvm_arch_init_vm(kvm, type);
629 if (r)
630 goto out_err_no_disable;
631
632 r = hardware_enable_all();
633 if (r)
634 goto out_err_no_disable;
635
636#ifdef CONFIG_HAVE_KVM_IRQFD
637 INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
638#endif
639
640 BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
641
642 r = -ENOMEM;
643 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
644 kvm->memslots[i] = kvm_alloc_memslots();
645 if (!kvm->memslots[i])
646 goto out_err_no_srcu;
647 }
648
649 if (init_srcu_struct(&kvm->srcu))
650 goto out_err_no_srcu;
651 if (init_srcu_struct(&kvm->irq_srcu))
652 goto out_err_no_irq_srcu;
653 for (i = 0; i < KVM_NR_BUSES; i++) {
654 kvm->buses[i] = kzalloc(sizeof(struct kvm_io_bus),
655 GFP_KERNEL);
656 if (!kvm->buses[i])
657 goto out_err;
658 }
659
660 r = kvm_init_mmu_notifier(kvm);
661 if (r)
662 goto out_err;
663
664 spin_lock(&kvm_lock);
665 list_add(&kvm->vm_list, &vm_list);
666 spin_unlock(&kvm_lock);
667
668 preempt_notifier_inc();
669
670 return kvm;
671
672out_err:
673 cleanup_srcu_struct(&kvm->irq_srcu);
674out_err_no_irq_srcu:
675 cleanup_srcu_struct(&kvm->srcu);
676out_err_no_srcu:
677 hardware_disable_all();
678out_err_no_disable:
679 for (i = 0; i < KVM_NR_BUSES; i++)
680 kfree(kvm->buses[i]);
681 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
682 kvm_free_memslots(kvm, kvm->memslots[i]);
683 kvm_arch_free_vm(kvm);
684 mmdrop(current->mm);
685 return ERR_PTR(r);
686}
687
688/*
689 * Avoid using vmalloc for a small buffer.
690 * Should not be used when the size is statically known.
691 */
692void *kvm_kvzalloc(unsigned long size)
693{
694 if (size > PAGE_SIZE)
695 return vzalloc(size);
696 else
697 return kzalloc(size, GFP_KERNEL);
698}
699
700static void kvm_destroy_devices(struct kvm *kvm)
701{
702 struct kvm_device *dev, *tmp;
703
704 /*
705 * We do not need to take the kvm->lock here, because nobody else
706 * has a reference to the struct kvm at this point and therefore
707 * cannot access the devices list anyhow.
708 */
709 list_for_each_entry_safe(dev, tmp, &kvm->devices, vm_node) {
710 list_del(&dev->vm_node);
711 dev->ops->destroy(dev);
712 }
713}
714
715static void kvm_destroy_vm(struct kvm *kvm)
716{
717 int i;
718 struct mm_struct *mm = kvm->mm;
719
720 kvm_destroy_vm_debugfs(kvm);
721 kvm_arch_sync_events(kvm);
722 spin_lock(&kvm_lock);
723 list_del(&kvm->vm_list);
724 spin_unlock(&kvm_lock);
725 kvm_free_irq_routing(kvm);
726 for (i = 0; i < KVM_NR_BUSES; i++) {
727 if (kvm->buses[i])
728 kvm_io_bus_destroy(kvm->buses[i]);
729 kvm->buses[i] = NULL;
730 }
731 kvm_coalesced_mmio_free(kvm);
732#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
733 mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
734#else
735 kvm_arch_flush_shadow_all(kvm);
736#endif
737 kvm_arch_destroy_vm(kvm);
738 kvm_destroy_devices(kvm);
739 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
740 kvm_free_memslots(kvm, kvm->memslots[i]);
741 cleanup_srcu_struct(&kvm->irq_srcu);
742 cleanup_srcu_struct(&kvm->srcu);
743 kvm_arch_free_vm(kvm);
744 preempt_notifier_dec();
745 hardware_disable_all();
746 mmdrop(mm);
747}
748
749void kvm_get_kvm(struct kvm *kvm)
750{
751 atomic_inc(&kvm->users_count);
752}
753EXPORT_SYMBOL_GPL(kvm_get_kvm);
754
755void kvm_put_kvm(struct kvm *kvm)
756{
757 if (atomic_dec_and_test(&kvm->users_count))
758 kvm_destroy_vm(kvm);
759}
760EXPORT_SYMBOL_GPL(kvm_put_kvm);
761
762
763static int kvm_vm_release(struct inode *inode, struct file *filp)
764{
765 struct kvm *kvm = filp->private_data;
766
767 kvm_irqfd_release(kvm);
768
769 kvm_put_kvm(kvm);
770 return 0;
771}
772
773/*
774 * Allocation size is twice as large as the actual dirty bitmap size.
775 * See x86's kvm_vm_ioctl_get_dirty_log() why this is needed.
776 */
777static int kvm_create_dirty_bitmap(struct kvm_memory_slot *memslot)
778{
779 unsigned long dirty_bytes = 2 * kvm_dirty_bitmap_bytes(memslot);
780
781 memslot->dirty_bitmap = kvm_kvzalloc(dirty_bytes);
782 if (!memslot->dirty_bitmap)
783 return -ENOMEM;
784
785 return 0;
786}
787
788/*
789 * Insert memslot and re-sort memslots based on their GFN,
790 * so binary search could be used to lookup GFN.
791 * Sorting algorithm takes advantage of having initially
792 * sorted array and known changed memslot position.
793 */
794static void update_memslots(struct kvm_memslots *slots,
795 struct kvm_memory_slot *new)
796{
797 int id = new->id;
798 int i = slots->id_to_index[id];
799 struct kvm_memory_slot *mslots = slots->memslots;
800
801 WARN_ON(mslots[i].id != id);
802 if (!new->npages) {
803 WARN_ON(!mslots[i].npages);
804 if (mslots[i].npages)
805 slots->used_slots--;
806 } else {
807 if (!mslots[i].npages)
808 slots->used_slots++;
809 }
810
811 while (i < KVM_MEM_SLOTS_NUM - 1 &&
812 new->base_gfn <= mslots[i + 1].base_gfn) {
813 if (!mslots[i + 1].npages)
814 break;
815 mslots[i] = mslots[i + 1];
816 slots->id_to_index[mslots[i].id] = i;
817 i++;
818 }
819
820 /*
821 * The ">=" is needed when creating a slot with base_gfn == 0,
822 * so that it moves before all those with base_gfn == npages == 0.
823 *
824 * On the other hand, if new->npages is zero, the above loop has
825 * already left i pointing to the beginning of the empty part of
826 * mslots, and the ">=" would move the hole backwards in this
827 * case---which is wrong. So skip the loop when deleting a slot.
828 */
829 if (new->npages) {
830 while (i > 0 &&
831 new->base_gfn >= mslots[i - 1].base_gfn) {
832 mslots[i] = mslots[i - 1];
833 slots->id_to_index[mslots[i].id] = i;
834 i--;
835 }
836 } else
837 WARN_ON_ONCE(i != slots->used_slots);
838
839 mslots[i] = *new;
840 slots->id_to_index[mslots[i].id] = i;
841}
842
843static int check_memory_region_flags(const struct kvm_userspace_memory_region *mem)
844{
845 u32 valid_flags = KVM_MEM_LOG_DIRTY_PAGES;
846
847#ifdef __KVM_HAVE_READONLY_MEM
848 valid_flags |= KVM_MEM_READONLY;
849#endif
850
851 if (mem->flags & ~valid_flags)
852 return -EINVAL;
853
854 return 0;
855}
856
857static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
858 int as_id, struct kvm_memslots *slots)
859{
860 struct kvm_memslots *old_memslots = __kvm_memslots(kvm, as_id);
861
862 /*
863 * Set the low bit in the generation, which disables SPTE caching
864 * until the end of synchronize_srcu_expedited.
865 */
866 WARN_ON(old_memslots->generation & 1);
867 slots->generation = old_memslots->generation + 1;
868
869 rcu_assign_pointer(kvm->memslots[as_id], slots);
870 synchronize_srcu_expedited(&kvm->srcu);
871
872 /*
873 * Increment the new memslot generation a second time. This prevents
874 * vm exits that race with memslot updates from caching a memslot
875 * generation that will (potentially) be valid forever.
876 */
877 slots->generation++;
878
879 kvm_arch_memslots_updated(kvm, slots);
880
881 return old_memslots;
882}
883
884/*
885 * Allocate some memory and give it an address in the guest physical address
886 * space.
887 *
888 * Discontiguous memory is allowed, mostly for framebuffers.
889 *
890 * Must be called holding kvm->slots_lock for write.
891 */
892int __kvm_set_memory_region(struct kvm *kvm,
893 const struct kvm_userspace_memory_region *mem)
894{
895 int r;
896 gfn_t base_gfn;
897 unsigned long npages;
898 struct kvm_memory_slot *slot;
899 struct kvm_memory_slot old, new;
900 struct kvm_memslots *slots = NULL, *old_memslots;
901 int as_id, id;
902 enum kvm_mr_change change;
903
904 r = check_memory_region_flags(mem);
905 if (r)
906 goto out;
907
908 r = -EINVAL;
909 as_id = mem->slot >> 16;
910 id = (u16)mem->slot;
911
912 /* General sanity checks */
913 if (mem->memory_size & (PAGE_SIZE - 1))
914 goto out;
915 if (mem->guest_phys_addr & (PAGE_SIZE - 1))
916 goto out;
917 /* We can read the guest memory with __xxx_user() later on. */
918 if ((id < KVM_USER_MEM_SLOTS) &&
919 ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
920 !access_ok(VERIFY_WRITE,
921 (void __user *)(unsigned long)mem->userspace_addr,
922 mem->memory_size)))
923 goto out;
924 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_MEM_SLOTS_NUM)
925 goto out;
926 if (mem->guest_phys_addr + mem->memory_size < mem->guest_phys_addr)
927 goto out;
928
929 slot = id_to_memslot(__kvm_memslots(kvm, as_id), id);
930 base_gfn = mem->guest_phys_addr >> PAGE_SHIFT;
931 npages = mem->memory_size >> PAGE_SHIFT;
932
933 if (npages > KVM_MEM_MAX_NR_PAGES)
934 goto out;
935
936 new = old = *slot;
937
938 new.id = id;
939 new.base_gfn = base_gfn;
940 new.npages = npages;
941 new.flags = mem->flags;
942
943 if (npages) {
944 if (!old.npages)
945 change = KVM_MR_CREATE;
946 else { /* Modify an existing slot. */
947 if ((mem->userspace_addr != old.userspace_addr) ||
948 (npages != old.npages) ||
949 ((new.flags ^ old.flags) & KVM_MEM_READONLY))
950 goto out;
951
952 if (base_gfn != old.base_gfn)
953 change = KVM_MR_MOVE;
954 else if (new.flags != old.flags)
955 change = KVM_MR_FLAGS_ONLY;
956 else { /* Nothing to change. */
957 r = 0;
958 goto out;
959 }
960 }
961 } else {
962 if (!old.npages)
963 goto out;
964
965 change = KVM_MR_DELETE;
966 new.base_gfn = 0;
967 new.flags = 0;
968 }
969
970 if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
971 /* Check for overlaps */
972 r = -EEXIST;
973 kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) {
974 if ((slot->id >= KVM_USER_MEM_SLOTS) ||
975 (slot->id == id))
976 continue;
977 if (!((base_gfn + npages <= slot->base_gfn) ||
978 (base_gfn >= slot->base_gfn + slot->npages)))
979 goto out;
980 }
981 }
982
983 /* Free page dirty bitmap if unneeded */
984 if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
985 new.dirty_bitmap = NULL;
986
987 r = -ENOMEM;
988 if (change == KVM_MR_CREATE) {
989 new.userspace_addr = mem->userspace_addr;
990
991 if (kvm_arch_create_memslot(kvm, &new, npages))
992 goto out_free;
993 }
994
995 /* Allocate page dirty bitmap if needed */
996 if ((new.flags & KVM_MEM_LOG_DIRTY_PAGES) && !new.dirty_bitmap) {
997 if (kvm_create_dirty_bitmap(&new) < 0)
998 goto out_free;
999 }
1000
1001 slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
1002 if (!slots)
1003 goto out_free;
1004 memcpy(slots, __kvm_memslots(kvm, as_id), sizeof(struct kvm_memslots));
1005
1006 if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
1007 slot = id_to_memslot(slots, id);
1008 slot->flags |= KVM_MEMSLOT_INVALID;
1009
1010 old_memslots = install_new_memslots(kvm, as_id, slots);
1011
1012 /* slot was deleted or moved, clear iommu mapping */
1013 kvm_iommu_unmap_pages(kvm, &old);
1014 /* From this point no new shadow pages pointing to a deleted,
1015 * or moved, memslot will be created.
1016 *
1017 * validation of sp->gfn happens in:
1018 * - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
1019 * - kvm_is_visible_gfn (mmu_check_roots)
1020 */
1021 kvm_arch_flush_shadow_memslot(kvm, slot);
1022
1023 /*
1024 * We can re-use the old_memslots from above, the only difference
1025 * from the currently installed memslots is the invalid flag. This
1026 * will get overwritten by update_memslots anyway.
1027 */
1028 slots = old_memslots;
1029 }
1030
1031 r = kvm_arch_prepare_memory_region(kvm, &new, mem, change);
1032 if (r)
1033 goto out_slots;
1034
1035 /* actual memory is freed via old in kvm_free_memslot below */
1036 if (change == KVM_MR_DELETE) {
1037 new.dirty_bitmap = NULL;
1038 memset(&new.arch, 0, sizeof(new.arch));
1039 }
1040
1041 update_memslots(slots, &new);
1042 old_memslots = install_new_memslots(kvm, as_id, slots);
1043
1044 kvm_arch_commit_memory_region(kvm, mem, &old, &new, change);
1045
1046 kvm_free_memslot(kvm, &old, &new);
1047 kvfree(old_memslots);
1048
1049 /*
1050 * IOMMU mapping: New slots need to be mapped. Old slots need to be
1051 * un-mapped and re-mapped if their base changes. Since base change
1052 * unmapping is handled above with slot deletion, mapping alone is
1053 * needed here. Anything else the iommu might care about for existing
1054 * slots (size changes, userspace addr changes and read-only flag
1055 * changes) is disallowed above, so any other attribute changes getting
1056 * here can be skipped.
1057 */
1058 if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
1059 r = kvm_iommu_map_pages(kvm, &new);
1060 return r;
1061 }
1062
1063 return 0;
1064
1065out_slots:
1066 kvfree(slots);
1067out_free:
1068 kvm_free_memslot(kvm, &new, &old);
1069out:
1070 return r;
1071}
1072EXPORT_SYMBOL_GPL(__kvm_set_memory_region);
1073
1074int kvm_set_memory_region(struct kvm *kvm,
1075 const struct kvm_userspace_memory_region *mem)
1076{
1077 int r;
1078
1079 mutex_lock(&kvm->slots_lock);
1080 r = __kvm_set_memory_region(kvm, mem);
1081 mutex_unlock(&kvm->slots_lock);
1082 return r;
1083}
1084EXPORT_SYMBOL_GPL(kvm_set_memory_region);
1085
1086static int kvm_vm_ioctl_set_memory_region(struct kvm *kvm,
1087 struct kvm_userspace_memory_region *mem)
1088{
1089 if ((u16)mem->slot >= KVM_USER_MEM_SLOTS)
1090 return -EINVAL;
1091
1092 return kvm_set_memory_region(kvm, mem);
1093}
1094
1095int kvm_get_dirty_log(struct kvm *kvm,
1096 struct kvm_dirty_log *log, int *is_dirty)
1097{
1098 struct kvm_memslots *slots;
1099 struct kvm_memory_slot *memslot;
1100 int r, i, as_id, id;
1101 unsigned long n;
1102 unsigned long any = 0;
1103
1104 r = -EINVAL;
1105 as_id = log->slot >> 16;
1106 id = (u16)log->slot;
1107 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_USER_MEM_SLOTS)
1108 goto out;
1109
1110 slots = __kvm_memslots(kvm, as_id);
1111 memslot = id_to_memslot(slots, id);
1112 r = -ENOENT;
1113 if (!memslot->dirty_bitmap)
1114 goto out;
1115
1116 n = kvm_dirty_bitmap_bytes(memslot);
1117
1118 for (i = 0; !any && i < n/sizeof(long); ++i)
1119 any = memslot->dirty_bitmap[i];
1120
1121 r = -EFAULT;
1122 if (copy_to_user(log->dirty_bitmap, memslot->dirty_bitmap, n))
1123 goto out;
1124
1125 if (any)
1126 *is_dirty = 1;
1127
1128 r = 0;
1129out:
1130 return r;
1131}
1132EXPORT_SYMBOL_GPL(kvm_get_dirty_log);
1133
1134#ifdef CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT
1135/**
1136 * kvm_get_dirty_log_protect - get a snapshot of dirty pages, and if any pages
1137 * are dirty write protect them for next write.
1138 * @kvm: pointer to kvm instance
1139 * @log: slot id and address to which we copy the log
1140 * @is_dirty: flag set if any page is dirty
1141 *
1142 * We need to keep it in mind that VCPU threads can write to the bitmap
1143 * concurrently. So, to avoid losing track of dirty pages we keep the
1144 * following order:
1145 *
1146 * 1. Take a snapshot of the bit and clear it if needed.
1147 * 2. Write protect the corresponding page.
1148 * 3. Copy the snapshot to the userspace.
1149 * 4. Upon return caller flushes TLB's if needed.
1150 *
1151 * Between 2 and 4, the guest may write to the page using the remaining TLB
1152 * entry. This is not a problem because the page is reported dirty using
1153 * the snapshot taken before and step 4 ensures that writes done after
1154 * exiting to userspace will be logged for the next call.
1155 *
1156 */
1157int kvm_get_dirty_log_protect(struct kvm *kvm,
1158 struct kvm_dirty_log *log, bool *is_dirty)
1159{
1160 struct kvm_memslots *slots;
1161 struct kvm_memory_slot *memslot;
1162 int r, i, as_id, id;
1163 unsigned long n;
1164 unsigned long *dirty_bitmap;
1165 unsigned long *dirty_bitmap_buffer;
1166
1167 r = -EINVAL;
1168 as_id = log->slot >> 16;
1169 id = (u16)log->slot;
1170 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_USER_MEM_SLOTS)
1171 goto out;
1172
1173 slots = __kvm_memslots(kvm, as_id);
1174 memslot = id_to_memslot(slots, id);
1175
1176 dirty_bitmap = memslot->dirty_bitmap;
1177 r = -ENOENT;
1178 if (!dirty_bitmap)
1179 goto out;
1180
1181 n = kvm_dirty_bitmap_bytes(memslot);
1182
1183 dirty_bitmap_buffer = dirty_bitmap + n / sizeof(long);
1184 memset(dirty_bitmap_buffer, 0, n);
1185
1186 spin_lock(&kvm->mmu_lock);
1187 *is_dirty = false;
1188 for (i = 0; i < n / sizeof(long); i++) {
1189 unsigned long mask;
1190 gfn_t offset;
1191
1192 if (!dirty_bitmap[i])
1193 continue;
1194
1195 *is_dirty = true;
1196
1197 mask = xchg(&dirty_bitmap[i], 0);
1198 dirty_bitmap_buffer[i] = mask;
1199
1200 if (mask) {
1201 offset = i * BITS_PER_LONG;
1202 kvm_arch_mmu_enable_log_dirty_pt_masked(kvm, memslot,
1203 offset, mask);
1204 }
1205 }
1206
1207 spin_unlock(&kvm->mmu_lock);
1208
1209 r = -EFAULT;
1210 if (copy_to_user(log->dirty_bitmap, dirty_bitmap_buffer, n))
1211 goto out;
1212
1213 r = 0;
1214out:
1215 return r;
1216}
1217EXPORT_SYMBOL_GPL(kvm_get_dirty_log_protect);
1218#endif
1219
1220bool kvm_largepages_enabled(void)
1221{
1222 return largepages_enabled;
1223}
1224
1225void kvm_disable_largepages(void)
1226{
1227 largepages_enabled = false;
1228}
1229EXPORT_SYMBOL_GPL(kvm_disable_largepages);
1230
1231struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn)
1232{
1233 return __gfn_to_memslot(kvm_memslots(kvm), gfn);
1234}
1235EXPORT_SYMBOL_GPL(gfn_to_memslot);
1236
1237struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn)
1238{
1239 return __gfn_to_memslot(kvm_vcpu_memslots(vcpu), gfn);
1240}
1241
1242bool kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn)
1243{
1244 struct kvm_memory_slot *memslot = gfn_to_memslot(kvm, gfn);
1245
1246 if (!memslot || memslot->id >= KVM_USER_MEM_SLOTS ||
1247 memslot->flags & KVM_MEMSLOT_INVALID)
1248 return false;
1249
1250 return true;
1251}
1252EXPORT_SYMBOL_GPL(kvm_is_visible_gfn);
1253
1254unsigned long kvm_host_page_size(struct kvm *kvm, gfn_t gfn)
1255{
1256 struct vm_area_struct *vma;
1257 unsigned long addr, size;
1258
1259 size = PAGE_SIZE;
1260
1261 addr = gfn_to_hva(kvm, gfn);
1262 if (kvm_is_error_hva(addr))
1263 return PAGE_SIZE;
1264
1265 down_read(¤t->mm->mmap_sem);
1266 vma = find_vma(current->mm, addr);
1267 if (!vma)
1268 goto out;
1269
1270 size = vma_kernel_pagesize(vma);
1271
1272out:
1273 up_read(¤t->mm->mmap_sem);
1274
1275 return size;
1276}
1277
1278static bool memslot_is_readonly(struct kvm_memory_slot *slot)
1279{
1280 return slot->flags & KVM_MEM_READONLY;
1281}
1282
1283static unsigned long __gfn_to_hva_many(struct kvm_memory_slot *slot, gfn_t gfn,
1284 gfn_t *nr_pages, bool write)
1285{
1286 if (!slot || slot->flags & KVM_MEMSLOT_INVALID)
1287 return KVM_HVA_ERR_BAD;
1288
1289 if (memslot_is_readonly(slot) && write)
1290 return KVM_HVA_ERR_RO_BAD;
1291
1292 if (nr_pages)
1293 *nr_pages = slot->npages - (gfn - slot->base_gfn);
1294
1295 return __gfn_to_hva_memslot(slot, gfn);
1296}
1297
1298static unsigned long gfn_to_hva_many(struct kvm_memory_slot *slot, gfn_t gfn,
1299 gfn_t *nr_pages)
1300{
1301 return __gfn_to_hva_many(slot, gfn, nr_pages, true);
1302}
1303
1304unsigned long gfn_to_hva_memslot(struct kvm_memory_slot *slot,
1305 gfn_t gfn)
1306{
1307 return gfn_to_hva_many(slot, gfn, NULL);
1308}
1309EXPORT_SYMBOL_GPL(gfn_to_hva_memslot);
1310
1311unsigned long gfn_to_hva(struct kvm *kvm, gfn_t gfn)
1312{
1313 return gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL);
1314}
1315EXPORT_SYMBOL_GPL(gfn_to_hva);
1316
1317unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn)
1318{
1319 return gfn_to_hva_many(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn, NULL);
1320}
1321EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_hva);
1322
1323/*
1324 * If writable is set to false, the hva returned by this function is only
1325 * allowed to be read.
1326 */
1327unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
1328 gfn_t gfn, bool *writable)
1329{
1330 unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);
1331
1332 if (!kvm_is_error_hva(hva) && writable)
1333 *writable = !memslot_is_readonly(slot);
1334
1335 return hva;
1336}
1337
1338unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
1339{
1340 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1341
1342 return gfn_to_hva_memslot_prot(slot, gfn, writable);
1343}
1344
1345unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable)
1346{
1347 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1348
1349 return gfn_to_hva_memslot_prot(slot, gfn, writable);
1350}
1351
1352static int get_user_page_nowait(unsigned long start, int write,
1353 struct page **page)
1354{
1355 int flags = FOLL_NOWAIT | FOLL_HWPOISON;
1356
1357 if (write)
1358 flags |= FOLL_WRITE;
1359
1360 return get_user_pages(start, 1, flags, page, NULL);
1361}
1362
1363static inline int check_user_page_hwpoison(unsigned long addr)
1364{
1365 int rc, flags = FOLL_HWPOISON | FOLL_WRITE;
1366
1367 rc = get_user_pages(addr, 1, flags, NULL, NULL);
1368 return rc == -EHWPOISON;
1369}
1370
1371/*
1372 * The atomic path to get the writable pfn which will be stored in @pfn,
1373 * true indicates success, otherwise false is returned.
1374 */
1375static bool hva_to_pfn_fast(unsigned long addr, bool atomic, bool *async,
1376 bool write_fault, bool *writable, kvm_pfn_t *pfn)
1377{
1378 struct page *page[1];
1379 int npages;
1380
1381 if (!(async || atomic))
1382 return false;
1383
1384 /*
1385 * Fast pin a writable pfn only if it is a write fault request
1386 * or the caller allows to map a writable pfn for a read fault
1387 * request.
1388 */
1389 if (!(write_fault || writable))
1390 return false;
1391
1392 npages = __get_user_pages_fast(addr, 1, 1, page);
1393 if (npages == 1) {
1394 *pfn = page_to_pfn(page[0]);
1395
1396 if (writable)
1397 *writable = true;
1398 return true;
1399 }
1400
1401 return false;
1402}
1403
1404/*
1405 * The slow path to get the pfn of the specified host virtual address,
1406 * 1 indicates success, -errno is returned if error is detected.
1407 */
1408static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault,
1409 bool *writable, kvm_pfn_t *pfn)
1410{
1411 struct page *page[1];
1412 int npages = 0;
1413
1414 might_sleep();
1415
1416 if (writable)
1417 *writable = write_fault;
1418
1419 if (async) {
1420 down_read(¤t->mm->mmap_sem);
1421 npages = get_user_page_nowait(addr, write_fault, page);
1422 up_read(¤t->mm->mmap_sem);
1423 } else {
1424 unsigned int flags = FOLL_HWPOISON;
1425
1426 if (write_fault)
1427 flags |= FOLL_WRITE;
1428
1429 npages = get_user_pages_unlocked(addr, 1, page, flags);
1430 }
1431 if (npages != 1)
1432 return npages;
1433
1434 /* map read fault as writable if possible */
1435 if (unlikely(!write_fault) && writable) {
1436 struct page *wpage[1];
1437
1438 npages = __get_user_pages_fast(addr, 1, 1, wpage);
1439 if (npages == 1) {
1440 *writable = true;
1441 put_page(page[0]);
1442 page[0] = wpage[0];
1443 }
1444
1445 npages = 1;
1446 }
1447 *pfn = page_to_pfn(page[0]);
1448 return npages;
1449}
1450
1451static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
1452{
1453 if (unlikely(!(vma->vm_flags & VM_READ)))
1454 return false;
1455
1456 if (write_fault && (unlikely(!(vma->vm_flags & VM_WRITE))))
1457 return false;
1458
1459 return true;
1460}
1461
1462static int hva_to_pfn_remapped(struct vm_area_struct *vma,
1463 unsigned long addr, bool *async,
1464 bool write_fault, kvm_pfn_t *p_pfn)
1465{
1466 unsigned long pfn;
1467 int r;
1468
1469 r = follow_pfn(vma, addr, &pfn);
1470 if (r) {
1471 /*
1472 * get_user_pages fails for VM_IO and VM_PFNMAP vmas and does
1473 * not call the fault handler, so do it here.
1474 */
1475 bool unlocked = false;
1476 r = fixup_user_fault(current, current->mm, addr,
1477 (write_fault ? FAULT_FLAG_WRITE : 0),
1478 &unlocked);
1479 if (unlocked)
1480 return -EAGAIN;
1481 if (r)
1482 return r;
1483
1484 r = follow_pfn(vma, addr, &pfn);
1485 if (r)
1486 return r;
1487
1488 }
1489
1490
1491 /*
1492 * Get a reference here because callers of *hva_to_pfn* and
1493 * *gfn_to_pfn* ultimately call kvm_release_pfn_clean on the
1494 * returned pfn. This is only needed if the VMA has VM_MIXEDMAP
1495 * set, but the kvm_get_pfn/kvm_release_pfn_clean pair will
1496 * simply do nothing for reserved pfns.
1497 *
1498 * Whoever called remap_pfn_range is also going to call e.g.
1499 * unmap_mapping_range before the underlying pages are freed,
1500 * causing a call to our MMU notifier.
1501 */
1502 kvm_get_pfn(pfn);
1503
1504 *p_pfn = pfn;
1505 return 0;
1506}
1507
1508/*
1509 * Pin guest page in memory and return its pfn.
1510 * @addr: host virtual address which maps memory to the guest
1511 * @atomic: whether this function can sleep
1512 * @async: whether this function need to wait IO complete if the
1513 * host page is not in the memory
1514 * @write_fault: whether we should get a writable host page
1515 * @writable: whether it allows to map a writable host page for !@write_fault
1516 *
1517 * The function will map a writable host page for these two cases:
1518 * 1): @write_fault = true
1519 * 2): @write_fault = false && @writable, @writable will tell the caller
1520 * whether the mapping is writable.
1521 */
1522static kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async,
1523 bool write_fault, bool *writable)
1524{
1525 struct vm_area_struct *vma;
1526 kvm_pfn_t pfn = 0;
1527 int npages, r;
1528
1529 /* we can do it either atomically or asynchronously, not both */
1530 BUG_ON(atomic && async);
1531
1532 if (hva_to_pfn_fast(addr, atomic, async, write_fault, writable, &pfn))
1533 return pfn;
1534
1535 if (atomic)
1536 return KVM_PFN_ERR_FAULT;
1537
1538 npages = hva_to_pfn_slow(addr, async, write_fault, writable, &pfn);
1539 if (npages == 1)
1540 return pfn;
1541
1542 down_read(¤t->mm->mmap_sem);
1543 if (npages == -EHWPOISON ||
1544 (!async && check_user_page_hwpoison(addr))) {
1545 pfn = KVM_PFN_ERR_HWPOISON;
1546 goto exit;
1547 }
1548
1549retry:
1550 vma = find_vma_intersection(current->mm, addr, addr + 1);
1551
1552 if (vma == NULL)
1553 pfn = KVM_PFN_ERR_FAULT;
1554 else if (vma->vm_flags & (VM_IO | VM_PFNMAP)) {
1555 r = hva_to_pfn_remapped(vma, addr, async, write_fault, &pfn);
1556 if (r == -EAGAIN)
1557 goto retry;
1558 if (r < 0)
1559 pfn = KVM_PFN_ERR_FAULT;
1560 } else {
1561 if (async && vma_is_valid(vma, write_fault))
1562 *async = true;
1563 pfn = KVM_PFN_ERR_FAULT;
1564 }
1565exit:
1566 up_read(¤t->mm->mmap_sem);
1567 return pfn;
1568}
1569
1570kvm_pfn_t __gfn_to_pfn_memslot(struct kvm_memory_slot *slot, gfn_t gfn,
1571 bool atomic, bool *async, bool write_fault,
1572 bool *writable)
1573{
1574 unsigned long addr = __gfn_to_hva_many(slot, gfn, NULL, write_fault);
1575
1576 if (addr == KVM_HVA_ERR_RO_BAD) {
1577 if (writable)
1578 *writable = false;
1579 return KVM_PFN_ERR_RO_FAULT;
1580 }
1581
1582 if (kvm_is_error_hva(addr)) {
1583 if (writable)
1584 *writable = false;
1585 return KVM_PFN_NOSLOT;
1586 }
1587
1588 /* Do not map writable pfn in the readonly memslot. */
1589 if (writable && memslot_is_readonly(slot)) {
1590 *writable = false;
1591 writable = NULL;
1592 }
1593
1594 return hva_to_pfn(addr, atomic, async, write_fault,
1595 writable);
1596}
1597EXPORT_SYMBOL_GPL(__gfn_to_pfn_memslot);
1598
1599kvm_pfn_t gfn_to_pfn_prot(struct kvm *kvm, gfn_t gfn, bool write_fault,
1600 bool *writable)
1601{
1602 return __gfn_to_pfn_memslot(gfn_to_memslot(kvm, gfn), gfn, false, NULL,
1603 write_fault, writable);
1604}
1605EXPORT_SYMBOL_GPL(gfn_to_pfn_prot);
1606
1607kvm_pfn_t gfn_to_pfn_memslot(struct kvm_memory_slot *slot, gfn_t gfn)
1608{
1609 return __gfn_to_pfn_memslot(slot, gfn, false, NULL, true, NULL);
1610}
1611EXPORT_SYMBOL_GPL(gfn_to_pfn_memslot);
1612
1613kvm_pfn_t gfn_to_pfn_memslot_atomic(struct kvm_memory_slot *slot, gfn_t gfn)
1614{
1615 return __gfn_to_pfn_memslot(slot, gfn, true, NULL, true, NULL);
1616}
1617EXPORT_SYMBOL_GPL(gfn_to_pfn_memslot_atomic);
1618
1619kvm_pfn_t gfn_to_pfn_atomic(struct kvm *kvm, gfn_t gfn)
1620{
1621 return gfn_to_pfn_memslot_atomic(gfn_to_memslot(kvm, gfn), gfn);
1622}
1623EXPORT_SYMBOL_GPL(gfn_to_pfn_atomic);
1624
1625kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn)
1626{
1627 return gfn_to_pfn_memslot_atomic(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn);
1628}
1629EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_pfn_atomic);
1630
1631kvm_pfn_t gfn_to_pfn(struct kvm *kvm, gfn_t gfn)
1632{
1633 return gfn_to_pfn_memslot(gfn_to_memslot(kvm, gfn), gfn);
1634}
1635EXPORT_SYMBOL_GPL(gfn_to_pfn);
1636
1637kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn)
1638{
1639 return gfn_to_pfn_memslot(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn);
1640}
1641EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_pfn);
1642
1643int gfn_to_page_many_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
1644 struct page **pages, int nr_pages)
1645{
1646 unsigned long addr;
1647 gfn_t entry;
1648
1649 addr = gfn_to_hva_many(slot, gfn, &entry);
1650 if (kvm_is_error_hva(addr))
1651 return -1;
1652
1653 if (entry < nr_pages)
1654 return 0;
1655
1656 return __get_user_pages_fast(addr, nr_pages, 1, pages);
1657}
1658EXPORT_SYMBOL_GPL(gfn_to_page_many_atomic);
1659
1660static struct page *kvm_pfn_to_page(kvm_pfn_t pfn)
1661{
1662 if (is_error_noslot_pfn(pfn))
1663 return KVM_ERR_PTR_BAD_PAGE;
1664
1665 if (kvm_is_reserved_pfn(pfn)) {
1666 WARN_ON(1);
1667 return KVM_ERR_PTR_BAD_PAGE;
1668 }
1669
1670 return pfn_to_page(pfn);
1671}
1672
1673struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
1674{
1675 kvm_pfn_t pfn;
1676
1677 pfn = gfn_to_pfn(kvm, gfn);
1678
1679 return kvm_pfn_to_page(pfn);
1680}
1681EXPORT_SYMBOL_GPL(gfn_to_page);
1682
1683struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn)
1684{
1685 kvm_pfn_t pfn;
1686
1687 pfn = kvm_vcpu_gfn_to_pfn(vcpu, gfn);
1688
1689 return kvm_pfn_to_page(pfn);
1690}
1691EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_page);
1692
1693void kvm_release_page_clean(struct page *page)
1694{
1695 WARN_ON(is_error_page(page));
1696
1697 kvm_release_pfn_clean(page_to_pfn(page));
1698}
1699EXPORT_SYMBOL_GPL(kvm_release_page_clean);
1700
1701void kvm_release_pfn_clean(kvm_pfn_t pfn)
1702{
1703 if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn))
1704 put_page(pfn_to_page(pfn));
1705}
1706EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);
1707
1708void kvm_release_page_dirty(struct page *page)
1709{
1710 WARN_ON(is_error_page(page));
1711
1712 kvm_release_pfn_dirty(page_to_pfn(page));
1713}
1714EXPORT_SYMBOL_GPL(kvm_release_page_dirty);
1715
1716static void kvm_release_pfn_dirty(kvm_pfn_t pfn)
1717{
1718 kvm_set_pfn_dirty(pfn);
1719 kvm_release_pfn_clean(pfn);
1720}
1721
1722void kvm_set_pfn_dirty(kvm_pfn_t pfn)
1723{
1724 if (!kvm_is_reserved_pfn(pfn)) {
1725 struct page *page = pfn_to_page(pfn);
1726
1727 if (!PageReserved(page))
1728 SetPageDirty(page);
1729 }
1730}
1731EXPORT_SYMBOL_GPL(kvm_set_pfn_dirty);
1732
1733void kvm_set_pfn_accessed(kvm_pfn_t pfn)
1734{
1735 if (!kvm_is_reserved_pfn(pfn))
1736 mark_page_accessed(pfn_to_page(pfn));
1737}
1738EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);
1739
1740void kvm_get_pfn(kvm_pfn_t pfn)
1741{
1742 if (!kvm_is_reserved_pfn(pfn))
1743 get_page(pfn_to_page(pfn));
1744}
1745EXPORT_SYMBOL_GPL(kvm_get_pfn);
1746
1747static int next_segment(unsigned long len, int offset)
1748{
1749 if (len > PAGE_SIZE - offset)
1750 return PAGE_SIZE - offset;
1751 else
1752 return len;
1753}
1754
1755static int __kvm_read_guest_page(struct kvm_memory_slot *slot, gfn_t gfn,
1756 void *data, int offset, int len)
1757{
1758 int r;
1759 unsigned long addr;
1760
1761 addr = gfn_to_hva_memslot_prot(slot, gfn, NULL);
1762 if (kvm_is_error_hva(addr))
1763 return -EFAULT;
1764 r = __copy_from_user(data, (void __user *)addr + offset, len);
1765 if (r)
1766 return -EFAULT;
1767 return 0;
1768}
1769
1770int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
1771 int len)
1772{
1773 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1774
1775 return __kvm_read_guest_page(slot, gfn, data, offset, len);
1776}
1777EXPORT_SYMBOL_GPL(kvm_read_guest_page);
1778
1779int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data,
1780 int offset, int len)
1781{
1782 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1783
1784 return __kvm_read_guest_page(slot, gfn, data, offset, len);
1785}
1786EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest_page);
1787
1788int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len)
1789{
1790 gfn_t gfn = gpa >> PAGE_SHIFT;
1791 int seg;
1792 int offset = offset_in_page(gpa);
1793 int ret;
1794
1795 while ((seg = next_segment(len, offset)) != 0) {
1796 ret = kvm_read_guest_page(kvm, gfn, data, offset, seg);
1797 if (ret < 0)
1798 return ret;
1799 offset = 0;
1800 len -= seg;
1801 data += seg;
1802 ++gfn;
1803 }
1804 return 0;
1805}
1806EXPORT_SYMBOL_GPL(kvm_read_guest);
1807
1808int kvm_vcpu_read_guest(struct kvm_vcpu *vcpu, gpa_t gpa, void *data, unsigned long len)
1809{
1810 gfn_t gfn = gpa >> PAGE_SHIFT;
1811 int seg;
1812 int offset = offset_in_page(gpa);
1813 int ret;
1814
1815 while ((seg = next_segment(len, offset)) != 0) {
1816 ret = kvm_vcpu_read_guest_page(vcpu, gfn, data, offset, seg);
1817 if (ret < 0)
1818 return ret;
1819 offset = 0;
1820 len -= seg;
1821 data += seg;
1822 ++gfn;
1823 }
1824 return 0;
1825}
1826EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest);
1827
1828static int __kvm_read_guest_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
1829 void *data, int offset, unsigned long len)
1830{
1831 int r;
1832 unsigned long addr;
1833
1834 addr = gfn_to_hva_memslot_prot(slot, gfn, NULL);
1835 if (kvm_is_error_hva(addr))
1836 return -EFAULT;
1837 pagefault_disable();
1838 r = __copy_from_user_inatomic(data, (void __user *)addr + offset, len);
1839 pagefault_enable();
1840 if (r)
1841 return -EFAULT;
1842 return 0;
1843}
1844
1845int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
1846 unsigned long len)
1847{
1848 gfn_t gfn = gpa >> PAGE_SHIFT;
1849 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1850 int offset = offset_in_page(gpa);
1851
1852 return __kvm_read_guest_atomic(slot, gfn, data, offset, len);
1853}
1854EXPORT_SYMBOL_GPL(kvm_read_guest_atomic);
1855
1856int kvm_vcpu_read_guest_atomic(struct kvm_vcpu *vcpu, gpa_t gpa,
1857 void *data, unsigned long len)
1858{
1859 gfn_t gfn = gpa >> PAGE_SHIFT;
1860 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1861 int offset = offset_in_page(gpa);
1862
1863 return __kvm_read_guest_atomic(slot, gfn, data, offset, len);
1864}
1865EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest_atomic);
1866
1867static int __kvm_write_guest_page(struct kvm_memory_slot *memslot, gfn_t gfn,
1868 const void *data, int offset, int len)
1869{
1870 int r;
1871 unsigned long addr;
1872
1873 addr = gfn_to_hva_memslot(memslot, gfn);
1874 if (kvm_is_error_hva(addr))
1875 return -EFAULT;
1876 r = __copy_to_user((void __user *)addr + offset, data, len);
1877 if (r)
1878 return -EFAULT;
1879 mark_page_dirty_in_slot(memslot, gfn);
1880 return 0;
1881}
1882
1883int kvm_write_guest_page(struct kvm *kvm, gfn_t gfn,
1884 const void *data, int offset, int len)
1885{
1886 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1887
1888 return __kvm_write_guest_page(slot, gfn, data, offset, len);
1889}
1890EXPORT_SYMBOL_GPL(kvm_write_guest_page);
1891
1892int kvm_vcpu_write_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn,
1893 const void *data, int offset, int len)
1894{
1895 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1896
1897 return __kvm_write_guest_page(slot, gfn, data, offset, len);
1898}
1899EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest_page);
1900
1901int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
1902 unsigned long len)
1903{
1904 gfn_t gfn = gpa >> PAGE_SHIFT;
1905 int seg;
1906 int offset = offset_in_page(gpa);
1907 int ret;
1908
1909 while ((seg = next_segment(len, offset)) != 0) {
1910 ret = kvm_write_guest_page(kvm, gfn, data, offset, seg);
1911 if (ret < 0)
1912 return ret;
1913 offset = 0;
1914 len -= seg;
1915 data += seg;
1916 ++gfn;
1917 }
1918 return 0;
1919}
1920EXPORT_SYMBOL_GPL(kvm_write_guest);
1921
1922int kvm_vcpu_write_guest(struct kvm_vcpu *vcpu, gpa_t gpa, const void *data,
1923 unsigned long len)
1924{
1925 gfn_t gfn = gpa >> PAGE_SHIFT;
1926 int seg;
1927 int offset = offset_in_page(gpa);
1928 int ret;
1929
1930 while ((seg = next_segment(len, offset)) != 0) {
1931 ret = kvm_vcpu_write_guest_page(vcpu, gfn, data, offset, seg);
1932 if (ret < 0)
1933 return ret;
1934 offset = 0;
1935 len -= seg;
1936 data += seg;
1937 ++gfn;
1938 }
1939 return 0;
1940}
1941EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest);
1942
1943int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1944 gpa_t gpa, unsigned long len)
1945{
1946 struct kvm_memslots *slots = kvm_memslots(kvm);
1947 int offset = offset_in_page(gpa);
1948 gfn_t start_gfn = gpa >> PAGE_SHIFT;
1949 gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
1950 gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
1951 gfn_t nr_pages_avail;
1952
1953 ghc->gpa = gpa;
1954 ghc->generation = slots->generation;
1955 ghc->len = len;
1956 ghc->memslot = gfn_to_memslot(kvm, start_gfn);
1957 ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL);
1958 if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) {
1959 ghc->hva += offset;
1960 } else {
1961 /*
1962 * If the requested region crosses two memslots, we still
1963 * verify that the entire region is valid here.
1964 */
1965 while (start_gfn <= end_gfn) {
1966 ghc->memslot = gfn_to_memslot(kvm, start_gfn);
1967 ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
1968 &nr_pages_avail);
1969 if (kvm_is_error_hva(ghc->hva))
1970 return -EFAULT;
1971 start_gfn += nr_pages_avail;
1972 }
1973 /* Use the slow path for cross page reads and writes. */
1974 ghc->memslot = NULL;
1975 }
1976 return 0;
1977}
1978EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
1979
1980int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1981 void *data, int offset, unsigned long len)
1982{
1983 struct kvm_memslots *slots = kvm_memslots(kvm);
1984 int r;
1985 gpa_t gpa = ghc->gpa + offset;
1986
1987 BUG_ON(len + offset > ghc->len);
1988
1989 if (slots->generation != ghc->generation)
1990 kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
1991
1992 if (unlikely(!ghc->memslot))
1993 return kvm_write_guest(kvm, gpa, data, len);
1994
1995 if (kvm_is_error_hva(ghc->hva))
1996 return -EFAULT;
1997
1998 r = __copy_to_user((void __user *)ghc->hva + offset, data, len);
1999 if (r)
2000 return -EFAULT;
2001 mark_page_dirty_in_slot(ghc->memslot, gpa >> PAGE_SHIFT);
2002
2003 return 0;
2004}
2005EXPORT_SYMBOL_GPL(kvm_write_guest_offset_cached);
2006
2007int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
2008 void *data, unsigned long len)
2009{
2010 return kvm_write_guest_offset_cached(kvm, ghc, data, 0, len);
2011}
2012EXPORT_SYMBOL_GPL(kvm_write_guest_cached);
2013
2014int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
2015 void *data, unsigned long len)
2016{
2017 struct kvm_memslots *slots = kvm_memslots(kvm);
2018 int r;
2019
2020 BUG_ON(len > ghc->len);
2021
2022 if (slots->generation != ghc->generation)
2023 kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
2024
2025 if (unlikely(!ghc->memslot))
2026 return kvm_read_guest(kvm, ghc->gpa, data, len);
2027
2028 if (kvm_is_error_hva(ghc->hva))
2029 return -EFAULT;
2030
2031 r = __copy_from_user(data, (void __user *)ghc->hva, len);
2032 if (r)
2033 return -EFAULT;
2034
2035 return 0;
2036}
2037EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
2038
2039int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
2040{
2041 const void *zero_page = (const void *) __va(page_to_phys(ZERO_PAGE(0)));
2042
2043 return kvm_write_guest_page(kvm, gfn, zero_page, offset, len);
2044}
2045EXPORT_SYMBOL_GPL(kvm_clear_guest_page);
2046
2047int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len)
2048{
2049 gfn_t gfn = gpa >> PAGE_SHIFT;
2050 int seg;
2051 int offset = offset_in_page(gpa);
2052 int ret;
2053
2054 while ((seg = next_segment(len, offset)) != 0) {
2055 ret = kvm_clear_guest_page(kvm, gfn, offset, seg);
2056 if (ret < 0)
2057 return ret;
2058 offset = 0;
2059 len -= seg;
2060 ++gfn;
2061 }
2062 return 0;
2063}
2064EXPORT_SYMBOL_GPL(kvm_clear_guest);
2065
2066static void mark_page_dirty_in_slot(struct kvm_memory_slot *memslot,
2067 gfn_t gfn)
2068{
2069 if (memslot && memslot->dirty_bitmap) {
2070 unsigned long rel_gfn = gfn - memslot->base_gfn;
2071
2072 set_bit_le(rel_gfn, memslot->dirty_bitmap);
2073 }
2074}
2075
2076void mark_page_dirty(struct kvm *kvm, gfn_t gfn)
2077{
2078 struct kvm_memory_slot *memslot;
2079
2080 memslot = gfn_to_memslot(kvm, gfn);
2081 mark_page_dirty_in_slot(memslot, gfn);
2082}
2083EXPORT_SYMBOL_GPL(mark_page_dirty);
2084
2085void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu, gfn_t gfn)
2086{
2087 struct kvm_memory_slot *memslot;
2088
2089 memslot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
2090 mark_page_dirty_in_slot(memslot, gfn);
2091}
2092EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty);
2093
2094static void grow_halt_poll_ns(struct kvm_vcpu *vcpu)
2095{
2096 unsigned int old, val, grow;
2097
2098 old = val = vcpu->halt_poll_ns;
2099 grow = READ_ONCE(halt_poll_ns_grow);
2100 /* 10us base */
2101 if (val == 0 && grow)
2102 val = 10000;
2103 else
2104 val *= grow;
2105
2106 if (val > halt_poll_ns)
2107 val = halt_poll_ns;
2108
2109 vcpu->halt_poll_ns = val;
2110 trace_kvm_halt_poll_ns_grow(vcpu->vcpu_id, val, old);
2111}
2112
2113static void shrink_halt_poll_ns(struct kvm_vcpu *vcpu)
2114{
2115 unsigned int old, val, shrink;
2116
2117 old = val = vcpu->halt_poll_ns;
2118 shrink = READ_ONCE(halt_poll_ns_shrink);
2119 if (shrink == 0)
2120 val = 0;
2121 else
2122 val /= shrink;
2123
2124 vcpu->halt_poll_ns = val;
2125 trace_kvm_halt_poll_ns_shrink(vcpu->vcpu_id, val, old);
2126}
2127
2128static int kvm_vcpu_check_block(struct kvm_vcpu *vcpu)
2129{
2130 if (kvm_arch_vcpu_runnable(vcpu)) {
2131 kvm_make_request(KVM_REQ_UNHALT, vcpu);
2132 return -EINTR;
2133 }
2134 if (kvm_cpu_has_pending_timer(vcpu))
2135 return -EINTR;
2136 if (signal_pending(current))
2137 return -EINTR;
2138
2139 return 0;
2140}
2141
2142/*
2143 * The vCPU has executed a HLT instruction with in-kernel mode enabled.
2144 */
2145void kvm_vcpu_block(struct kvm_vcpu *vcpu)
2146{
2147 ktime_t start, cur;
2148 DECLARE_SWAITQUEUE(wait);
2149 bool waited = false;
2150 u64 block_ns;
2151
2152 start = cur = ktime_get();
2153 if (vcpu->halt_poll_ns) {
2154 ktime_t stop = ktime_add_ns(ktime_get(), vcpu->halt_poll_ns);
2155
2156 ++vcpu->stat.halt_attempted_poll;
2157 do {
2158 /*
2159 * This sets KVM_REQ_UNHALT if an interrupt
2160 * arrives.
2161 */
2162 if (kvm_vcpu_check_block(vcpu) < 0) {
2163 ++vcpu->stat.halt_successful_poll;
2164 if (!vcpu_valid_wakeup(vcpu))
2165 ++vcpu->stat.halt_poll_invalid;
2166 goto out;
2167 }
2168 cur = ktime_get();
2169 } while (single_task_running() && ktime_before(cur, stop));
2170 }
2171
2172 kvm_arch_vcpu_blocking(vcpu);
2173
2174 for (;;) {
2175 prepare_to_swait(&vcpu->wq, &wait, TASK_INTERRUPTIBLE);
2176
2177 if (kvm_vcpu_check_block(vcpu) < 0)
2178 break;
2179
2180 waited = true;
2181 schedule();
2182 }
2183
2184 finish_swait(&vcpu->wq, &wait);
2185 cur = ktime_get();
2186
2187 kvm_arch_vcpu_unblocking(vcpu);
2188out:
2189 block_ns = ktime_to_ns(cur) - ktime_to_ns(start);
2190
2191 if (!vcpu_valid_wakeup(vcpu))
2192 shrink_halt_poll_ns(vcpu);
2193 else if (halt_poll_ns) {
2194 if (block_ns <= vcpu->halt_poll_ns)
2195 ;
2196 /* we had a long block, shrink polling */
2197 else if (vcpu->halt_poll_ns && block_ns > halt_poll_ns)
2198 shrink_halt_poll_ns(vcpu);
2199 /* we had a short halt and our poll time is too small */
2200 else if (vcpu->halt_poll_ns < halt_poll_ns &&
2201 block_ns < halt_poll_ns)
2202 grow_halt_poll_ns(vcpu);
2203 } else
2204 vcpu->halt_poll_ns = 0;
2205
2206 trace_kvm_vcpu_wakeup(block_ns, waited, vcpu_valid_wakeup(vcpu));
2207 kvm_arch_vcpu_block_finish(vcpu);
2208}
2209EXPORT_SYMBOL_GPL(kvm_vcpu_block);
2210
2211#ifndef CONFIG_S390
2212void kvm_vcpu_wake_up(struct kvm_vcpu *vcpu)
2213{
2214 struct swait_queue_head *wqp;
2215
2216 wqp = kvm_arch_vcpu_wq(vcpu);
2217 if (swait_active(wqp)) {
2218 swake_up(wqp);
2219 ++vcpu->stat.halt_wakeup;
2220 }
2221
2222}
2223EXPORT_SYMBOL_GPL(kvm_vcpu_wake_up);
2224
2225/*
2226 * Kick a sleeping VCPU, or a guest VCPU in guest mode, into host kernel mode.
2227 */
2228void kvm_vcpu_kick(struct kvm_vcpu *vcpu)
2229{
2230 int me;
2231 int cpu = vcpu->cpu;
2232
2233 kvm_vcpu_wake_up(vcpu);
2234 me = get_cpu();
2235 if (cpu != me && (unsigned)cpu < nr_cpu_ids && cpu_online(cpu))
2236 if (kvm_arch_vcpu_should_kick(vcpu))
2237 smp_send_reschedule(cpu);
2238 put_cpu();
2239}
2240EXPORT_SYMBOL_GPL(kvm_vcpu_kick);
2241#endif /* !CONFIG_S390 */
2242
2243int kvm_vcpu_yield_to(struct kvm_vcpu *target)
2244{
2245 struct pid *pid;
2246 struct task_struct *task = NULL;
2247 int ret = 0;
2248
2249 rcu_read_lock();
2250 pid = rcu_dereference(target->pid);
2251 if (pid)
2252 task = get_pid_task(pid, PIDTYPE_PID);
2253 rcu_read_unlock();
2254 if (!task)
2255 return ret;
2256 ret = yield_to(task, 1);
2257 put_task_struct(task);
2258
2259 return ret;
2260}
2261EXPORT_SYMBOL_GPL(kvm_vcpu_yield_to);
2262
2263/*
2264 * Helper that checks whether a VCPU is eligible for directed yield.
2265 * Most eligible candidate to yield is decided by following heuristics:
2266 *
2267 * (a) VCPU which has not done pl-exit or cpu relax intercepted recently
2268 * (preempted lock holder), indicated by @in_spin_loop.
2269 * Set at the beiginning and cleared at the end of interception/PLE handler.
2270 *
2271 * (b) VCPU which has done pl-exit/ cpu relax intercepted but did not get
2272 * chance last time (mostly it has become eligible now since we have probably
2273 * yielded to lockholder in last iteration. This is done by toggling
2274 * @dy_eligible each time a VCPU checked for eligibility.)
2275 *
2276 * Yielding to a recently pl-exited/cpu relax intercepted VCPU before yielding
2277 * to preempted lock-holder could result in wrong VCPU selection and CPU
2278 * burning. Giving priority for a potential lock-holder increases lock
2279 * progress.
2280 *
2281 * Since algorithm is based on heuristics, accessing another VCPU data without
2282 * locking does not harm. It may result in trying to yield to same VCPU, fail
2283 * and continue with next VCPU and so on.
2284 */
2285static bool kvm_vcpu_eligible_for_directed_yield(struct kvm_vcpu *vcpu)
2286{
2287#ifdef CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT
2288 bool eligible;
2289
2290 eligible = !vcpu->spin_loop.in_spin_loop ||
2291 vcpu->spin_loop.dy_eligible;
2292
2293 if (vcpu->spin_loop.in_spin_loop)
2294 kvm_vcpu_set_dy_eligible(vcpu, !vcpu->spin_loop.dy_eligible);
2295
2296 return eligible;
2297#else
2298 return true;
2299#endif
2300}
2301
2302void kvm_vcpu_on_spin(struct kvm_vcpu *me)
2303{
2304 struct kvm *kvm = me->kvm;
2305 struct kvm_vcpu *vcpu;
2306 int last_boosted_vcpu = me->kvm->last_boosted_vcpu;
2307 int yielded = 0;
2308 int try = 3;
2309 int pass;
2310 int i;
2311
2312 kvm_vcpu_set_in_spin_loop(me, true);
2313 /*
2314 * We boost the priority of a VCPU that is runnable but not
2315 * currently running, because it got preempted by something
2316 * else and called schedule in __vcpu_run. Hopefully that
2317 * VCPU is holding the lock that we need and will release it.
2318 * We approximate round-robin by starting at the last boosted VCPU.
2319 */
2320 for (pass = 0; pass < 2 && !yielded && try; pass++) {
2321 kvm_for_each_vcpu(i, vcpu, kvm) {
2322 if (!pass && i <= last_boosted_vcpu) {
2323 i = last_boosted_vcpu;
2324 continue;
2325 } else if (pass && i > last_boosted_vcpu)
2326 break;
2327 if (!ACCESS_ONCE(vcpu->preempted))
2328 continue;
2329 if (vcpu == me)
2330 continue;
2331 if (swait_active(&vcpu->wq) && !kvm_arch_vcpu_runnable(vcpu))
2332 continue;
2333 if (!kvm_vcpu_eligible_for_directed_yield(vcpu))
2334 continue;
2335
2336 yielded = kvm_vcpu_yield_to(vcpu);
2337 if (yielded > 0) {
2338 kvm->last_boosted_vcpu = i;
2339 break;
2340 } else if (yielded < 0) {
2341 try--;
2342 if (!try)
2343 break;
2344 }
2345 }
2346 }
2347 kvm_vcpu_set_in_spin_loop(me, false);
2348
2349 /* Ensure vcpu is not eligible during next spinloop */
2350 kvm_vcpu_set_dy_eligible(me, false);
2351}
2352EXPORT_SYMBOL_GPL(kvm_vcpu_on_spin);
2353
2354static int kvm_vcpu_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
2355{
2356 struct kvm_vcpu *vcpu = vma->vm_file->private_data;
2357 struct page *page;
2358
2359 if (vmf->pgoff == 0)
2360 page = virt_to_page(vcpu->run);
2361#ifdef CONFIG_X86
2362 else if (vmf->pgoff == KVM_PIO_PAGE_OFFSET)
2363 page = virt_to_page(vcpu->arch.pio_data);
2364#endif
2365#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2366 else if (vmf->pgoff == KVM_COALESCED_MMIO_PAGE_OFFSET)
2367 page = virt_to_page(vcpu->kvm->coalesced_mmio_ring);
2368#endif
2369 else
2370 return kvm_arch_vcpu_fault(vcpu, vmf);
2371 get_page(page);
2372 vmf->page = page;
2373 return 0;
2374}
2375
2376static const struct vm_operations_struct kvm_vcpu_vm_ops = {
2377 .fault = kvm_vcpu_fault,
2378};
2379
2380static int kvm_vcpu_mmap(struct file *file, struct vm_area_struct *vma)
2381{
2382 vma->vm_ops = &kvm_vcpu_vm_ops;
2383 return 0;
2384}
2385
2386static int kvm_vcpu_release(struct inode *inode, struct file *filp)
2387{
2388 struct kvm_vcpu *vcpu = filp->private_data;
2389
2390 debugfs_remove_recursive(vcpu->debugfs_dentry);
2391 kvm_put_kvm(vcpu->kvm);
2392 return 0;
2393}
2394
2395static struct file_operations kvm_vcpu_fops = {
2396 .release = kvm_vcpu_release,
2397 .unlocked_ioctl = kvm_vcpu_ioctl,
2398#ifdef CONFIG_KVM_COMPAT
2399 .compat_ioctl = kvm_vcpu_compat_ioctl,
2400#endif
2401 .mmap = kvm_vcpu_mmap,
2402 .llseek = noop_llseek,
2403};
2404
2405/*
2406 * Allocates an inode for the vcpu.
2407 */
2408static int create_vcpu_fd(struct kvm_vcpu *vcpu)
2409{
2410 return anon_inode_getfd("kvm-vcpu", &kvm_vcpu_fops, vcpu, O_RDWR | O_CLOEXEC);
2411}
2412
2413static int kvm_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
2414{
2415 char dir_name[ITOA_MAX_LEN * 2];
2416 int ret;
2417
2418 if (!kvm_arch_has_vcpu_debugfs())
2419 return 0;
2420
2421 if (!debugfs_initialized())
2422 return 0;
2423
2424 snprintf(dir_name, sizeof(dir_name), "vcpu%d", vcpu->vcpu_id);
2425 vcpu->debugfs_dentry = debugfs_create_dir(dir_name,
2426 vcpu->kvm->debugfs_dentry);
2427 if (!vcpu->debugfs_dentry)
2428 return -ENOMEM;
2429
2430 ret = kvm_arch_create_vcpu_debugfs(vcpu);
2431 if (ret < 0) {
2432 debugfs_remove_recursive(vcpu->debugfs_dentry);
2433 return ret;
2434 }
2435
2436 return 0;
2437}
2438
2439/*
2440 * Creates some virtual cpus. Good luck creating more than one.
2441 */
2442static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
2443{
2444 int r;
2445 struct kvm_vcpu *vcpu;
2446
2447 if (id >= KVM_MAX_VCPU_ID)
2448 return -EINVAL;
2449
2450 mutex_lock(&kvm->lock);
2451 if (kvm->created_vcpus == KVM_MAX_VCPUS) {
2452 mutex_unlock(&kvm->lock);
2453 return -EINVAL;
2454 }
2455
2456 kvm->created_vcpus++;
2457 mutex_unlock(&kvm->lock);
2458
2459 vcpu = kvm_arch_vcpu_create(kvm, id);
2460 if (IS_ERR(vcpu)) {
2461 r = PTR_ERR(vcpu);
2462 goto vcpu_decrement;
2463 }
2464
2465 preempt_notifier_init(&vcpu->preempt_notifier, &kvm_preempt_ops);
2466
2467 r = kvm_arch_vcpu_setup(vcpu);
2468 if (r)
2469 goto vcpu_destroy;
2470
2471 r = kvm_create_vcpu_debugfs(vcpu);
2472 if (r)
2473 goto vcpu_destroy;
2474
2475 mutex_lock(&kvm->lock);
2476 if (kvm_get_vcpu_by_id(kvm, id)) {
2477 r = -EEXIST;
2478 goto unlock_vcpu_destroy;
2479 }
2480
2481 BUG_ON(kvm->vcpus[atomic_read(&kvm->online_vcpus)]);
2482
2483 /* Now it's all set up, let userspace reach it */
2484 kvm_get_kvm(kvm);
2485 r = create_vcpu_fd(vcpu);
2486 if (r < 0) {
2487 kvm_put_kvm(kvm);
2488 goto unlock_vcpu_destroy;
2489 }
2490
2491 kvm->vcpus[atomic_read(&kvm->online_vcpus)] = vcpu;
2492
2493 /*
2494 * Pairs with smp_rmb() in kvm_get_vcpu. Write kvm->vcpus
2495 * before kvm->online_vcpu's incremented value.
2496 */
2497 smp_wmb();
2498 atomic_inc(&kvm->online_vcpus);
2499
2500 mutex_unlock(&kvm->lock);
2501 kvm_arch_vcpu_postcreate(vcpu);
2502 return r;
2503
2504unlock_vcpu_destroy:
2505 mutex_unlock(&kvm->lock);
2506 debugfs_remove_recursive(vcpu->debugfs_dentry);
2507vcpu_destroy:
2508 kvm_arch_vcpu_destroy(vcpu);
2509vcpu_decrement:
2510 mutex_lock(&kvm->lock);
2511 kvm->created_vcpus--;
2512 mutex_unlock(&kvm->lock);
2513 return r;
2514}
2515
2516static int kvm_vcpu_ioctl_set_sigmask(struct kvm_vcpu *vcpu, sigset_t *sigset)
2517{
2518 if (sigset) {
2519 sigdelsetmask(sigset, sigmask(SIGKILL)|sigmask(SIGSTOP));
2520 vcpu->sigset_active = 1;
2521 vcpu->sigset = *sigset;
2522 } else
2523 vcpu->sigset_active = 0;
2524 return 0;
2525}
2526
2527static long kvm_vcpu_ioctl(struct file *filp,
2528 unsigned int ioctl, unsigned long arg)
2529{
2530 struct kvm_vcpu *vcpu = filp->private_data;
2531 void __user *argp = (void __user *)arg;
2532 int r;
2533 struct kvm_fpu *fpu = NULL;
2534 struct kvm_sregs *kvm_sregs = NULL;
2535
2536 if (vcpu->kvm->mm != current->mm)
2537 return -EIO;
2538
2539 if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
2540 return -EINVAL;
2541
2542#if defined(CONFIG_S390) || defined(CONFIG_PPC) || defined(CONFIG_MIPS)
2543 /*
2544 * Special cases: vcpu ioctls that are asynchronous to vcpu execution,
2545 * so vcpu_load() would break it.
2546 */
2547 if (ioctl == KVM_S390_INTERRUPT || ioctl == KVM_S390_IRQ || ioctl == KVM_INTERRUPT)
2548 return kvm_arch_vcpu_ioctl(filp, ioctl, arg);
2549#endif
2550
2551
2552 r = vcpu_load(vcpu);
2553 if (r)
2554 return r;
2555 switch (ioctl) {
2556 case KVM_RUN:
2557 r = -EINVAL;
2558 if (arg)
2559 goto out;
2560 if (unlikely(vcpu->pid != current->pids[PIDTYPE_PID].pid)) {
2561 /* The thread running this VCPU changed. */
2562 struct pid *oldpid = vcpu->pid;
2563 struct pid *newpid = get_task_pid(current, PIDTYPE_PID);
2564
2565 rcu_assign_pointer(vcpu->pid, newpid);
2566 if (oldpid)
2567 synchronize_rcu();
2568 put_pid(oldpid);
2569 }
2570 r = kvm_arch_vcpu_ioctl_run(vcpu, vcpu->run);
2571 trace_kvm_userspace_exit(vcpu->run->exit_reason, r);
2572 break;
2573 case KVM_GET_REGS: {
2574 struct kvm_regs *kvm_regs;
2575
2576 r = -ENOMEM;
2577 kvm_regs = kzalloc(sizeof(struct kvm_regs), GFP_KERNEL);
2578 if (!kvm_regs)
2579 goto out;
2580 r = kvm_arch_vcpu_ioctl_get_regs(vcpu, kvm_regs);
2581 if (r)
2582 goto out_free1;
2583 r = -EFAULT;
2584 if (copy_to_user(argp, kvm_regs, sizeof(struct kvm_regs)))
2585 goto out_free1;
2586 r = 0;
2587out_free1:
2588 kfree(kvm_regs);
2589 break;
2590 }
2591 case KVM_SET_REGS: {
2592 struct kvm_regs *kvm_regs;
2593
2594 r = -ENOMEM;
2595 kvm_regs = memdup_user(argp, sizeof(*kvm_regs));
2596 if (IS_ERR(kvm_regs)) {
2597 r = PTR_ERR(kvm_regs);
2598 goto out;
2599 }
2600 r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs);
2601 kfree(kvm_regs);
2602 break;
2603 }
2604 case KVM_GET_SREGS: {
2605 kvm_sregs = kzalloc(sizeof(struct kvm_sregs), GFP_KERNEL);
2606 r = -ENOMEM;
2607 if (!kvm_sregs)
2608 goto out;
2609 r = kvm_arch_vcpu_ioctl_get_sregs(vcpu, kvm_sregs);
2610 if (r)
2611 goto out;
2612 r = -EFAULT;
2613 if (copy_to_user(argp, kvm_sregs, sizeof(struct kvm_sregs)))
2614 goto out;
2615 r = 0;
2616 break;
2617 }
2618 case KVM_SET_SREGS: {
2619 kvm_sregs = memdup_user(argp, sizeof(*kvm_sregs));
2620 if (IS_ERR(kvm_sregs)) {
2621 r = PTR_ERR(kvm_sregs);
2622 kvm_sregs = NULL;
2623 goto out;
2624 }
2625 r = kvm_arch_vcpu_ioctl_set_sregs(vcpu, kvm_sregs);
2626 break;
2627 }
2628 case KVM_GET_MP_STATE: {
2629 struct kvm_mp_state mp_state;
2630
2631 r = kvm_arch_vcpu_ioctl_get_mpstate(vcpu, &mp_state);
2632 if (r)
2633 goto out;
2634 r = -EFAULT;
2635 if (copy_to_user(argp, &mp_state, sizeof(mp_state)))
2636 goto out;
2637 r = 0;
2638 break;
2639 }
2640 case KVM_SET_MP_STATE: {
2641 struct kvm_mp_state mp_state;
2642
2643 r = -EFAULT;
2644 if (copy_from_user(&mp_state, argp, sizeof(mp_state)))
2645 goto out;
2646 r = kvm_arch_vcpu_ioctl_set_mpstate(vcpu, &mp_state);
2647 break;
2648 }
2649 case KVM_TRANSLATE: {
2650 struct kvm_translation tr;
2651
2652 r = -EFAULT;
2653 if (copy_from_user(&tr, argp, sizeof(tr)))
2654 goto out;
2655 r = kvm_arch_vcpu_ioctl_translate(vcpu, &tr);
2656 if (r)
2657 goto out;
2658 r = -EFAULT;
2659 if (copy_to_user(argp, &tr, sizeof(tr)))
2660 goto out;
2661 r = 0;
2662 break;
2663 }
2664 case KVM_SET_GUEST_DEBUG: {
2665 struct kvm_guest_debug dbg;
2666
2667 r = -EFAULT;
2668 if (copy_from_user(&dbg, argp, sizeof(dbg)))
2669 goto out;
2670 r = kvm_arch_vcpu_ioctl_set_guest_debug(vcpu, &dbg);
2671 break;
2672 }
2673 case KVM_SET_SIGNAL_MASK: {
2674 struct kvm_signal_mask __user *sigmask_arg = argp;
2675 struct kvm_signal_mask kvm_sigmask;
2676 sigset_t sigset, *p;
2677
2678 p = NULL;
2679 if (argp) {
2680 r = -EFAULT;
2681 if (copy_from_user(&kvm_sigmask, argp,
2682 sizeof(kvm_sigmask)))
2683 goto out;
2684 r = -EINVAL;
2685 if (kvm_sigmask.len != sizeof(sigset))
2686 goto out;
2687 r = -EFAULT;
2688 if (copy_from_user(&sigset, sigmask_arg->sigset,
2689 sizeof(sigset)))
2690 goto out;
2691 p = &sigset;
2692 }
2693 r = kvm_vcpu_ioctl_set_sigmask(vcpu, p);
2694 break;
2695 }
2696 case KVM_GET_FPU: {
2697 fpu = kzalloc(sizeof(struct kvm_fpu), GFP_KERNEL);
2698 r = -ENOMEM;
2699 if (!fpu)
2700 goto out;
2701 r = kvm_arch_vcpu_ioctl_get_fpu(vcpu, fpu);
2702 if (r)
2703 goto out;
2704 r = -EFAULT;
2705 if (copy_to_user(argp, fpu, sizeof(struct kvm_fpu)))
2706 goto out;
2707 r = 0;
2708 break;
2709 }
2710 case KVM_SET_FPU: {
2711 fpu = memdup_user(argp, sizeof(*fpu));
2712 if (IS_ERR(fpu)) {
2713 r = PTR_ERR(fpu);
2714 fpu = NULL;
2715 goto out;
2716 }
2717 r = kvm_arch_vcpu_ioctl_set_fpu(vcpu, fpu);
2718 break;
2719 }
2720 default:
2721 r = kvm_arch_vcpu_ioctl(filp, ioctl, arg);
2722 }
2723out:
2724 vcpu_put(vcpu);
2725 kfree(fpu);
2726 kfree(kvm_sregs);
2727 return r;
2728}
2729
2730#ifdef CONFIG_KVM_COMPAT
2731static long kvm_vcpu_compat_ioctl(struct file *filp,
2732 unsigned int ioctl, unsigned long arg)
2733{
2734 struct kvm_vcpu *vcpu = filp->private_data;
2735 void __user *argp = compat_ptr(arg);
2736 int r;
2737
2738 if (vcpu->kvm->mm != current->mm)
2739 return -EIO;
2740
2741 switch (ioctl) {
2742 case KVM_SET_SIGNAL_MASK: {
2743 struct kvm_signal_mask __user *sigmask_arg = argp;
2744 struct kvm_signal_mask kvm_sigmask;
2745 compat_sigset_t csigset;
2746 sigset_t sigset;
2747
2748 if (argp) {
2749 r = -EFAULT;
2750 if (copy_from_user(&kvm_sigmask, argp,
2751 sizeof(kvm_sigmask)))
2752 goto out;
2753 r = -EINVAL;
2754 if (kvm_sigmask.len != sizeof(csigset))
2755 goto out;
2756 r = -EFAULT;
2757 if (copy_from_user(&csigset, sigmask_arg->sigset,
2758 sizeof(csigset)))
2759 goto out;
2760 sigset_from_compat(&sigset, &csigset);
2761 r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
2762 } else
2763 r = kvm_vcpu_ioctl_set_sigmask(vcpu, NULL);
2764 break;
2765 }
2766 default:
2767 r = kvm_vcpu_ioctl(filp, ioctl, arg);
2768 }
2769
2770out:
2771 return r;
2772}
2773#endif
2774
2775static int kvm_device_ioctl_attr(struct kvm_device *dev,
2776 int (*accessor)(struct kvm_device *dev,
2777 struct kvm_device_attr *attr),
2778 unsigned long arg)
2779{
2780 struct kvm_device_attr attr;
2781
2782 if (!accessor)
2783 return -EPERM;
2784
2785 if (copy_from_user(&attr, (void __user *)arg, sizeof(attr)))
2786 return -EFAULT;
2787
2788 return accessor(dev, &attr);
2789}
2790
2791static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
2792 unsigned long arg)
2793{
2794 struct kvm_device *dev = filp->private_data;
2795
2796 switch (ioctl) {
2797 case KVM_SET_DEVICE_ATTR:
2798 return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);
2799 case KVM_GET_DEVICE_ATTR:
2800 return kvm_device_ioctl_attr(dev, dev->ops->get_attr, arg);
2801 case KVM_HAS_DEVICE_ATTR:
2802 return kvm_device_ioctl_attr(dev, dev->ops->has_attr, arg);
2803 default:
2804 if (dev->ops->ioctl)
2805 return dev->ops->ioctl(dev, ioctl, arg);
2806
2807 return -ENOTTY;
2808 }
2809}
2810
2811static int kvm_device_release(struct inode *inode, struct file *filp)
2812{
2813 struct kvm_device *dev = filp->private_data;
2814 struct kvm *kvm = dev->kvm;
2815
2816 kvm_put_kvm(kvm);
2817 return 0;
2818}
2819
2820static const struct file_operations kvm_device_fops = {
2821 .unlocked_ioctl = kvm_device_ioctl,
2822#ifdef CONFIG_KVM_COMPAT
2823 .compat_ioctl = kvm_device_ioctl,
2824#endif
2825 .release = kvm_device_release,
2826};
2827
2828struct kvm_device *kvm_device_from_filp(struct file *filp)
2829{
2830 if (filp->f_op != &kvm_device_fops)
2831 return NULL;
2832
2833 return filp->private_data;
2834}
2835
2836static struct kvm_device_ops *kvm_device_ops_table[KVM_DEV_TYPE_MAX] = {
2837#ifdef CONFIG_KVM_MPIC
2838 [KVM_DEV_TYPE_FSL_MPIC_20] = &kvm_mpic_ops,
2839 [KVM_DEV_TYPE_FSL_MPIC_42] = &kvm_mpic_ops,
2840#endif
2841
2842#ifdef CONFIG_KVM_XICS
2843 [KVM_DEV_TYPE_XICS] = &kvm_xics_ops,
2844#endif
2845};
2846
2847int kvm_register_device_ops(struct kvm_device_ops *ops, u32 type)
2848{
2849 if (type >= ARRAY_SIZE(kvm_device_ops_table))
2850 return -ENOSPC;
2851
2852 if (kvm_device_ops_table[type] != NULL)
2853 return -EEXIST;
2854
2855 kvm_device_ops_table[type] = ops;
2856 return 0;
2857}
2858
2859void kvm_unregister_device_ops(u32 type)
2860{
2861 if (kvm_device_ops_table[type] != NULL)
2862 kvm_device_ops_table[type] = NULL;
2863}
2864
2865static int kvm_ioctl_create_device(struct kvm *kvm,
2866 struct kvm_create_device *cd)
2867{
2868 struct kvm_device_ops *ops = NULL;
2869 struct kvm_device *dev;
2870 bool test = cd->flags & KVM_CREATE_DEVICE_TEST;
2871 int ret;
2872
2873 if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
2874 return -ENODEV;
2875
2876 ops = kvm_device_ops_table[cd->type];
2877 if (ops == NULL)
2878 return -ENODEV;
2879
2880 if (test)
2881 return 0;
2882
2883 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2884 if (!dev)
2885 return -ENOMEM;
2886
2887 dev->ops = ops;
2888 dev->kvm = kvm;
2889
2890 mutex_lock(&kvm->lock);
2891 ret = ops->create(dev, cd->type);
2892 if (ret < 0) {
2893 mutex_unlock(&kvm->lock);
2894 kfree(dev);
2895 return ret;
2896 }
2897 list_add(&dev->vm_node, &kvm->devices);
2898 mutex_unlock(&kvm->lock);
2899
2900 if (ops->init)
2901 ops->init(dev);
2902
2903 ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
2904 if (ret < 0) {
2905 mutex_lock(&kvm->lock);
2906 list_del(&dev->vm_node);
2907 mutex_unlock(&kvm->lock);
2908 ops->destroy(dev);
2909 return ret;
2910 }
2911
2912 kvm_get_kvm(kvm);
2913 cd->fd = ret;
2914 return 0;
2915}
2916
2917static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
2918{
2919 switch (arg) {
2920 case KVM_CAP_USER_MEMORY:
2921 case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:
2922 case KVM_CAP_JOIN_MEMORY_REGIONS_WORKS:
2923 case KVM_CAP_INTERNAL_ERROR_DATA:
2924#ifdef CONFIG_HAVE_KVM_MSI
2925 case KVM_CAP_SIGNAL_MSI:
2926#endif
2927#ifdef CONFIG_HAVE_KVM_IRQFD
2928 case KVM_CAP_IRQFD:
2929 case KVM_CAP_IRQFD_RESAMPLE:
2930#endif
2931 case KVM_CAP_IOEVENTFD_ANY_LENGTH:
2932 case KVM_CAP_CHECK_EXTENSION_VM:
2933 return 1;
2934#ifdef CONFIG_HAVE_KVM_IRQ_ROUTING
2935 case KVM_CAP_IRQ_ROUTING:
2936 return KVM_MAX_IRQ_ROUTES;
2937#endif
2938#if KVM_ADDRESS_SPACE_NUM > 1
2939 case KVM_CAP_MULTI_ADDRESS_SPACE:
2940 return KVM_ADDRESS_SPACE_NUM;
2941#endif
2942 case KVM_CAP_MAX_VCPU_ID:
2943 return KVM_MAX_VCPU_ID;
2944 default:
2945 break;
2946 }
2947 return kvm_vm_ioctl_check_extension(kvm, arg);
2948}
2949
2950static long kvm_vm_ioctl(struct file *filp,
2951 unsigned int ioctl, unsigned long arg)
2952{
2953 struct kvm *kvm = filp->private_data;
2954 void __user *argp = (void __user *)arg;
2955 int r;
2956
2957 if (kvm->mm != current->mm)
2958 return -EIO;
2959 switch (ioctl) {
2960 case KVM_CREATE_VCPU:
2961 r = kvm_vm_ioctl_create_vcpu(kvm, arg);
2962 break;
2963 case KVM_SET_USER_MEMORY_REGION: {
2964 struct kvm_userspace_memory_region kvm_userspace_mem;
2965
2966 r = -EFAULT;
2967 if (copy_from_user(&kvm_userspace_mem, argp,
2968 sizeof(kvm_userspace_mem)))
2969 goto out;
2970
2971 r = kvm_vm_ioctl_set_memory_region(kvm, &kvm_userspace_mem);
2972 break;
2973 }
2974 case KVM_GET_DIRTY_LOG: {
2975 struct kvm_dirty_log log;
2976
2977 r = -EFAULT;
2978 if (copy_from_user(&log, argp, sizeof(log)))
2979 goto out;
2980 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
2981 break;
2982 }
2983#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2984 case KVM_REGISTER_COALESCED_MMIO: {
2985 struct kvm_coalesced_mmio_zone zone;
2986
2987 r = -EFAULT;
2988 if (copy_from_user(&zone, argp, sizeof(zone)))
2989 goto out;
2990 r = kvm_vm_ioctl_register_coalesced_mmio(kvm, &zone);
2991 break;
2992 }
2993 case KVM_UNREGISTER_COALESCED_MMIO: {
2994 struct kvm_coalesced_mmio_zone zone;
2995
2996 r = -EFAULT;
2997 if (copy_from_user(&zone, argp, sizeof(zone)))
2998 goto out;
2999 r = kvm_vm_ioctl_unregister_coalesced_mmio(kvm, &zone);
3000 break;
3001 }
3002#endif
3003 case KVM_IRQFD: {
3004 struct kvm_irqfd data;
3005
3006 r = -EFAULT;
3007 if (copy_from_user(&data, argp, sizeof(data)))
3008 goto out;
3009 r = kvm_irqfd(kvm, &data);
3010 break;
3011 }
3012 case KVM_IOEVENTFD: {
3013 struct kvm_ioeventfd data;
3014
3015 r = -EFAULT;
3016 if (copy_from_user(&data, argp, sizeof(data)))
3017 goto out;
3018 r = kvm_ioeventfd(kvm, &data);
3019 break;
3020 }
3021#ifdef CONFIG_HAVE_KVM_MSI
3022 case KVM_SIGNAL_MSI: {
3023 struct kvm_msi msi;
3024
3025 r = -EFAULT;
3026 if (copy_from_user(&msi, argp, sizeof(msi)))
3027 goto out;
3028 r = kvm_send_userspace_msi(kvm, &msi);
3029 break;
3030 }
3031#endif
3032#ifdef __KVM_HAVE_IRQ_LINE
3033 case KVM_IRQ_LINE_STATUS:
3034 case KVM_IRQ_LINE: {
3035 struct kvm_irq_level irq_event;
3036
3037 r = -EFAULT;
3038 if (copy_from_user(&irq_event, argp, sizeof(irq_event)))
3039 goto out;
3040
3041 r = kvm_vm_ioctl_irq_line(kvm, &irq_event,
3042 ioctl == KVM_IRQ_LINE_STATUS);
3043 if (r)
3044 goto out;
3045
3046 r = -EFAULT;
3047 if (ioctl == KVM_IRQ_LINE_STATUS) {
3048 if (copy_to_user(argp, &irq_event, sizeof(irq_event)))
3049 goto out;
3050 }
3051
3052 r = 0;
3053 break;
3054 }
3055#endif
3056#ifdef CONFIG_HAVE_KVM_IRQ_ROUTING
3057 case KVM_SET_GSI_ROUTING: {
3058 struct kvm_irq_routing routing;
3059 struct kvm_irq_routing __user *urouting;
3060 struct kvm_irq_routing_entry *entries = NULL;
3061
3062 r = -EFAULT;
3063 if (copy_from_user(&routing, argp, sizeof(routing)))
3064 goto out;
3065 r = -EINVAL;
3066 if (routing.nr > KVM_MAX_IRQ_ROUTES)
3067 goto out;
3068 if (routing.flags)
3069 goto out;
3070 if (routing.nr) {
3071 r = -ENOMEM;
3072 entries = vmalloc(routing.nr * sizeof(*entries));
3073 if (!entries)
3074 goto out;
3075 r = -EFAULT;
3076 urouting = argp;
3077 if (copy_from_user(entries, urouting->entries,
3078 routing.nr * sizeof(*entries)))
3079 goto out_free_irq_routing;
3080 }
3081 r = kvm_set_irq_routing(kvm, entries, routing.nr,
3082 routing.flags);
3083out_free_irq_routing:
3084 vfree(entries);
3085 break;
3086 }
3087#endif /* CONFIG_HAVE_KVM_IRQ_ROUTING */
3088 case KVM_CREATE_DEVICE: {
3089 struct kvm_create_device cd;
3090
3091 r = -EFAULT;
3092 if (copy_from_user(&cd, argp, sizeof(cd)))
3093 goto out;
3094
3095 r = kvm_ioctl_create_device(kvm, &cd);
3096 if (r)
3097 goto out;
3098
3099 r = -EFAULT;
3100 if (copy_to_user(argp, &cd, sizeof(cd)))
3101 goto out;
3102
3103 r = 0;
3104 break;
3105 }
3106 case KVM_CHECK_EXTENSION:
3107 r = kvm_vm_ioctl_check_extension_generic(kvm, arg);
3108 break;
3109 default:
3110 r = kvm_arch_vm_ioctl(filp, ioctl, arg);
3111 }
3112out:
3113 return r;
3114}
3115
3116#ifdef CONFIG_KVM_COMPAT
3117struct compat_kvm_dirty_log {
3118 __u32 slot;
3119 __u32 padding1;
3120 union {
3121 compat_uptr_t dirty_bitmap; /* one bit per page */
3122 __u64 padding2;
3123 };
3124};
3125
3126static long kvm_vm_compat_ioctl(struct file *filp,
3127 unsigned int ioctl, unsigned long arg)
3128{
3129 struct kvm *kvm = filp->private_data;
3130 int r;
3131
3132 if (kvm->mm != current->mm)
3133 return -EIO;
3134 switch (ioctl) {
3135 case KVM_GET_DIRTY_LOG: {
3136 struct compat_kvm_dirty_log compat_log;
3137 struct kvm_dirty_log log;
3138
3139 r = -EFAULT;
3140 if (copy_from_user(&compat_log, (void __user *)arg,
3141 sizeof(compat_log)))
3142 goto out;
3143 log.slot = compat_log.slot;
3144 log.padding1 = compat_log.padding1;
3145 log.padding2 = compat_log.padding2;
3146 log.dirty_bitmap = compat_ptr(compat_log.dirty_bitmap);
3147
3148 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
3149 break;
3150 }
3151 default:
3152 r = kvm_vm_ioctl(filp, ioctl, arg);
3153 }
3154
3155out:
3156 return r;
3157}
3158#endif
3159
3160static struct file_operations kvm_vm_fops = {
3161 .release = kvm_vm_release,
3162 .unlocked_ioctl = kvm_vm_ioctl,
3163#ifdef CONFIG_KVM_COMPAT
3164 .compat_ioctl = kvm_vm_compat_ioctl,
3165#endif
3166 .llseek = noop_llseek,
3167};
3168
3169static int kvm_dev_ioctl_create_vm(unsigned long type)
3170{
3171 int r;
3172 struct kvm *kvm;
3173 struct file *file;
3174
3175 kvm = kvm_create_vm(type);
3176 if (IS_ERR(kvm))
3177 return PTR_ERR(kvm);
3178#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
3179 r = kvm_coalesced_mmio_init(kvm);
3180 if (r < 0) {
3181 kvm_put_kvm(kvm);
3182 return r;
3183 }
3184#endif
3185 r = get_unused_fd_flags(O_CLOEXEC);
3186 if (r < 0) {
3187 kvm_put_kvm(kvm);
3188 return r;
3189 }
3190 file = anon_inode_getfile("kvm-vm", &kvm_vm_fops, kvm, O_RDWR);
3191 if (IS_ERR(file)) {
3192 put_unused_fd(r);
3193 kvm_put_kvm(kvm);
3194 return PTR_ERR(file);
3195 }
3196
3197 if (kvm_create_vm_debugfs(kvm, r) < 0) {
3198 put_unused_fd(r);
3199 fput(file);
3200 return -ENOMEM;
3201 }
3202
3203 fd_install(r, file);
3204 return r;
3205}
3206
3207static long kvm_dev_ioctl(struct file *filp,
3208 unsigned int ioctl, unsigned long arg)
3209{
3210 long r = -EINVAL;
3211
3212 switch (ioctl) {
3213 case KVM_GET_API_VERSION:
3214 if (arg)
3215 goto out;
3216 r = KVM_API_VERSION;
3217 break;
3218 case KVM_CREATE_VM:
3219 r = kvm_dev_ioctl_create_vm(arg);
3220 break;
3221 case KVM_CHECK_EXTENSION:
3222 r = kvm_vm_ioctl_check_extension_generic(NULL, arg);
3223 break;
3224 case KVM_GET_VCPU_MMAP_SIZE:
3225 if (arg)
3226 goto out;
3227 r = PAGE_SIZE; /* struct kvm_run */
3228#ifdef CONFIG_X86
3229 r += PAGE_SIZE; /* pio data page */
3230#endif
3231#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
3232 r += PAGE_SIZE; /* coalesced mmio ring page */
3233#endif
3234 break;
3235 case KVM_TRACE_ENABLE:
3236 case KVM_TRACE_PAUSE:
3237 case KVM_TRACE_DISABLE:
3238 r = -EOPNOTSUPP;
3239 break;
3240 default:
3241 return kvm_arch_dev_ioctl(filp, ioctl, arg);
3242 }
3243out:
3244 return r;
3245}
3246
3247static struct file_operations kvm_chardev_ops = {
3248 .unlocked_ioctl = kvm_dev_ioctl,
3249 .compat_ioctl = kvm_dev_ioctl,
3250 .llseek = noop_llseek,
3251};
3252
3253static struct miscdevice kvm_dev = {
3254 KVM_MINOR,
3255 "kvm",
3256 &kvm_chardev_ops,
3257};
3258
3259static void hardware_enable_nolock(void *junk)
3260{
3261 int cpu = raw_smp_processor_id();
3262 int r;
3263
3264 if (cpumask_test_cpu(cpu, cpus_hardware_enabled))
3265 return;
3266
3267 cpumask_set_cpu(cpu, cpus_hardware_enabled);
3268
3269 r = kvm_arch_hardware_enable();
3270
3271 if (r) {
3272 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
3273 atomic_inc(&hardware_enable_failed);
3274 pr_info("kvm: enabling virtualization on CPU%d failed\n", cpu);
3275 }
3276}
3277
3278static int kvm_starting_cpu(unsigned int cpu)
3279{
3280 raw_spin_lock(&kvm_count_lock);
3281 if (kvm_usage_count)
3282 hardware_enable_nolock(NULL);
3283 raw_spin_unlock(&kvm_count_lock);
3284 return 0;
3285}
3286
3287static void hardware_disable_nolock(void *junk)
3288{
3289 int cpu = raw_smp_processor_id();
3290
3291 if (!cpumask_test_cpu(cpu, cpus_hardware_enabled))
3292 return;
3293 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
3294 kvm_arch_hardware_disable();
3295}
3296
3297static int kvm_dying_cpu(unsigned int cpu)
3298{
3299 raw_spin_lock(&kvm_count_lock);
3300 if (kvm_usage_count)
3301 hardware_disable_nolock(NULL);
3302 raw_spin_unlock(&kvm_count_lock);
3303 return 0;
3304}
3305
3306static void hardware_disable_all_nolock(void)
3307{
3308 BUG_ON(!kvm_usage_count);
3309
3310 kvm_usage_count--;
3311 if (!kvm_usage_count)
3312 on_each_cpu(hardware_disable_nolock, NULL, 1);
3313}
3314
3315static void hardware_disable_all(void)
3316{
3317 raw_spin_lock(&kvm_count_lock);
3318 hardware_disable_all_nolock();
3319 raw_spin_unlock(&kvm_count_lock);
3320}
3321
3322static int hardware_enable_all(void)
3323{
3324 int r = 0;
3325
3326 raw_spin_lock(&kvm_count_lock);
3327
3328 kvm_usage_count++;
3329 if (kvm_usage_count == 1) {
3330 atomic_set(&hardware_enable_failed, 0);
3331 on_each_cpu(hardware_enable_nolock, NULL, 1);
3332
3333 if (atomic_read(&hardware_enable_failed)) {
3334 hardware_disable_all_nolock();
3335 r = -EBUSY;
3336 }
3337 }
3338
3339 raw_spin_unlock(&kvm_count_lock);
3340
3341 return r;
3342}
3343
3344static int kvm_reboot(struct notifier_block *notifier, unsigned long val,
3345 void *v)
3346{
3347 /*
3348 * Some (well, at least mine) BIOSes hang on reboot if
3349 * in vmx root mode.
3350 *
3351 * And Intel TXT required VMX off for all cpu when system shutdown.
3352 */
3353 pr_info("kvm: exiting hardware virtualization\n");
3354 kvm_rebooting = true;
3355 on_each_cpu(hardware_disable_nolock, NULL, 1);
3356 return NOTIFY_OK;
3357}
3358
3359static struct notifier_block kvm_reboot_notifier = {
3360 .notifier_call = kvm_reboot,
3361 .priority = 0,
3362};
3363
3364static void kvm_io_bus_destroy(struct kvm_io_bus *bus)
3365{
3366 int i;
3367
3368 for (i = 0; i < bus->dev_count; i++) {
3369 struct kvm_io_device *pos = bus->range[i].dev;
3370
3371 kvm_iodevice_destructor(pos);
3372 }
3373 kfree(bus);
3374}
3375
3376static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1,
3377 const struct kvm_io_range *r2)
3378{
3379 gpa_t addr1 = r1->addr;
3380 gpa_t addr2 = r2->addr;
3381
3382 if (addr1 < addr2)
3383 return -1;
3384
3385 /* If r2->len == 0, match the exact address. If r2->len != 0,
3386 * accept any overlapping write. Any order is acceptable for
3387 * overlapping ranges, because kvm_io_bus_get_first_dev ensures
3388 * we process all of them.
3389 */
3390 if (r2->len) {
3391 addr1 += r1->len;
3392 addr2 += r2->len;
3393 }
3394
3395 if (addr1 > addr2)
3396 return 1;
3397
3398 return 0;
3399}
3400
3401static int kvm_io_bus_sort_cmp(const void *p1, const void *p2)
3402{
3403 return kvm_io_bus_cmp(p1, p2);
3404}
3405
3406static int kvm_io_bus_insert_dev(struct kvm_io_bus *bus, struct kvm_io_device *dev,
3407 gpa_t addr, int len)
3408{
3409 bus->range[bus->dev_count++] = (struct kvm_io_range) {
3410 .addr = addr,
3411 .len = len,
3412 .dev = dev,
3413 };
3414
3415 sort(bus->range, bus->dev_count, sizeof(struct kvm_io_range),
3416 kvm_io_bus_sort_cmp, NULL);
3417
3418 return 0;
3419}
3420
3421static int kvm_io_bus_get_first_dev(struct kvm_io_bus *bus,
3422 gpa_t addr, int len)
3423{
3424 struct kvm_io_range *range, key;
3425 int off;
3426
3427 key = (struct kvm_io_range) {
3428 .addr = addr,
3429 .len = len,
3430 };
3431
3432 range = bsearch(&key, bus->range, bus->dev_count,
3433 sizeof(struct kvm_io_range), kvm_io_bus_sort_cmp);
3434 if (range == NULL)
3435 return -ENOENT;
3436
3437 off = range - bus->range;
3438
3439 while (off > 0 && kvm_io_bus_cmp(&key, &bus->range[off-1]) == 0)
3440 off--;
3441
3442 return off;
3443}
3444
3445static int __kvm_io_bus_write(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
3446 struct kvm_io_range *range, const void *val)
3447{
3448 int idx;
3449
3450 idx = kvm_io_bus_get_first_dev(bus, range->addr, range->len);
3451 if (idx < 0)
3452 return -EOPNOTSUPP;
3453
3454 while (idx < bus->dev_count &&
3455 kvm_io_bus_cmp(range, &bus->range[idx]) == 0) {
3456 if (!kvm_iodevice_write(vcpu, bus->range[idx].dev, range->addr,
3457 range->len, val))
3458 return idx;
3459 idx++;
3460 }
3461
3462 return -EOPNOTSUPP;
3463}
3464
3465/* kvm_io_bus_write - called under kvm->slots_lock */
3466int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
3467 int len, const void *val)
3468{
3469 struct kvm_io_bus *bus;
3470 struct kvm_io_range range;
3471 int r;
3472
3473 range = (struct kvm_io_range) {
3474 .addr = addr,
3475 .len = len,
3476 };
3477
3478 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3479 if (!bus)
3480 return -ENOMEM;
3481 r = __kvm_io_bus_write(vcpu, bus, &range, val);
3482 return r < 0 ? r : 0;
3483}
3484
3485/* kvm_io_bus_write_cookie - called under kvm->slots_lock */
3486int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
3487 gpa_t addr, int len, const void *val, long cookie)
3488{
3489 struct kvm_io_bus *bus;
3490 struct kvm_io_range range;
3491
3492 range = (struct kvm_io_range) {
3493 .addr = addr,
3494 .len = len,
3495 };
3496
3497 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3498 if (!bus)
3499 return -ENOMEM;
3500
3501 /* First try the device referenced by cookie. */
3502 if ((cookie >= 0) && (cookie < bus->dev_count) &&
3503 (kvm_io_bus_cmp(&range, &bus->range[cookie]) == 0))
3504 if (!kvm_iodevice_write(vcpu, bus->range[cookie].dev, addr, len,
3505 val))
3506 return cookie;
3507
3508 /*
3509 * cookie contained garbage; fall back to search and return the
3510 * correct cookie value.
3511 */
3512 return __kvm_io_bus_write(vcpu, bus, &range, val);
3513}
3514
3515static int __kvm_io_bus_read(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
3516 struct kvm_io_range *range, void *val)
3517{
3518 int idx;
3519
3520 idx = kvm_io_bus_get_first_dev(bus, range->addr, range->len);
3521 if (idx < 0)
3522 return -EOPNOTSUPP;
3523
3524 while (idx < bus->dev_count &&
3525 kvm_io_bus_cmp(range, &bus->range[idx]) == 0) {
3526 if (!kvm_iodevice_read(vcpu, bus->range[idx].dev, range->addr,
3527 range->len, val))
3528 return idx;
3529 idx++;
3530 }
3531
3532 return -EOPNOTSUPP;
3533}
3534EXPORT_SYMBOL_GPL(kvm_io_bus_write);
3535
3536/* kvm_io_bus_read - called under kvm->slots_lock */
3537int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
3538 int len, void *val)
3539{
3540 struct kvm_io_bus *bus;
3541 struct kvm_io_range range;
3542 int r;
3543
3544 range = (struct kvm_io_range) {
3545 .addr = addr,
3546 .len = len,
3547 };
3548
3549 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3550 if (!bus)
3551 return -ENOMEM;
3552 r = __kvm_io_bus_read(vcpu, bus, &range, val);
3553 return r < 0 ? r : 0;
3554}
3555
3556
3557/* Caller must hold slots_lock. */
3558int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
3559 int len, struct kvm_io_device *dev)
3560{
3561 struct kvm_io_bus *new_bus, *bus;
3562
3563 bus = kvm->buses[bus_idx];
3564 if (!bus)
3565 return -ENOMEM;
3566
3567 /* exclude ioeventfd which is limited by maximum fd */
3568 if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
3569 return -ENOSPC;
3570
3571 new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count + 1) *
3572 sizeof(struct kvm_io_range)), GFP_KERNEL);
3573 if (!new_bus)
3574 return -ENOMEM;
3575 memcpy(new_bus, bus, sizeof(*bus) + (bus->dev_count *
3576 sizeof(struct kvm_io_range)));
3577 kvm_io_bus_insert_dev(new_bus, dev, addr, len);
3578 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
3579 synchronize_srcu_expedited(&kvm->srcu);
3580 kfree(bus);
3581
3582 return 0;
3583}
3584
3585/* Caller must hold slots_lock. */
3586void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
3587 struct kvm_io_device *dev)
3588{
3589 int i;
3590 struct kvm_io_bus *new_bus, *bus;
3591
3592 bus = kvm->buses[bus_idx];
3593 if (!bus)
3594 return;
3595
3596 for (i = 0; i < bus->dev_count; i++)
3597 if (bus->range[i].dev == dev) {
3598 break;
3599 }
3600
3601 if (i == bus->dev_count)
3602 return;
3603
3604 new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
3605 sizeof(struct kvm_io_range)), GFP_KERNEL);
3606 if (!new_bus) {
3607 pr_err("kvm: failed to shrink bus, removing it completely\n");
3608 goto broken;
3609 }
3610
3611 memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
3612 new_bus->dev_count--;
3613 memcpy(new_bus->range + i, bus->range + i + 1,
3614 (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
3615
3616broken:
3617 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
3618 synchronize_srcu_expedited(&kvm->srcu);
3619 kfree(bus);
3620 return;
3621}
3622
3623struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
3624 gpa_t addr)
3625{
3626 struct kvm_io_bus *bus;
3627 int dev_idx, srcu_idx;
3628 struct kvm_io_device *iodev = NULL;
3629
3630 srcu_idx = srcu_read_lock(&kvm->srcu);
3631
3632 bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
3633 if (!bus)
3634 goto out_unlock;
3635
3636 dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
3637 if (dev_idx < 0)
3638 goto out_unlock;
3639
3640 iodev = bus->range[dev_idx].dev;
3641
3642out_unlock:
3643 srcu_read_unlock(&kvm->srcu, srcu_idx);
3644
3645 return iodev;
3646}
3647EXPORT_SYMBOL_GPL(kvm_io_bus_get_dev);
3648
3649static int kvm_debugfs_open(struct inode *inode, struct file *file,
3650 int (*get)(void *, u64 *), int (*set)(void *, u64),
3651 const char *fmt)
3652{
3653 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)
3654 inode->i_private;
3655
3656 /* The debugfs files are a reference to the kvm struct which
3657 * is still valid when kvm_destroy_vm is called.
3658 * To avoid the race between open and the removal of the debugfs
3659 * directory we test against the users count.
3660 */
3661 if (!atomic_add_unless(&stat_data->kvm->users_count, 1, 0))
3662 return -ENOENT;
3663
3664 if (simple_attr_open(inode, file, get, set, fmt)) {
3665 kvm_put_kvm(stat_data->kvm);
3666 return -ENOMEM;
3667 }
3668
3669 return 0;
3670}
3671
3672static int kvm_debugfs_release(struct inode *inode, struct file *file)
3673{
3674 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)
3675 inode->i_private;
3676
3677 simple_attr_release(inode, file);
3678 kvm_put_kvm(stat_data->kvm);
3679
3680 return 0;
3681}
3682
3683static int vm_stat_get_per_vm(void *data, u64 *val)
3684{
3685 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3686
3687 *val = *(ulong *)((void *)stat_data->kvm + stat_data->offset);
3688
3689 return 0;
3690}
3691
3692static int vm_stat_clear_per_vm(void *data, u64 val)
3693{
3694 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3695
3696 if (val)
3697 return -EINVAL;
3698
3699 *(ulong *)((void *)stat_data->kvm + stat_data->offset) = 0;
3700
3701 return 0;
3702}
3703
3704static int vm_stat_get_per_vm_open(struct inode *inode, struct file *file)
3705{
3706 __simple_attr_check_format("%llu\n", 0ull);
3707 return kvm_debugfs_open(inode, file, vm_stat_get_per_vm,
3708 vm_stat_clear_per_vm, "%llu\n");
3709}
3710
3711static const struct file_operations vm_stat_get_per_vm_fops = {
3712 .owner = THIS_MODULE,
3713 .open = vm_stat_get_per_vm_open,
3714 .release = kvm_debugfs_release,
3715 .read = simple_attr_read,
3716 .write = simple_attr_write,
3717 .llseek = generic_file_llseek,
3718};
3719
3720static int vcpu_stat_get_per_vm(void *data, u64 *val)
3721{
3722 int i;
3723 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3724 struct kvm_vcpu *vcpu;
3725
3726 *val = 0;
3727
3728 kvm_for_each_vcpu(i, vcpu, stat_data->kvm)
3729 *val += *(u64 *)((void *)vcpu + stat_data->offset);
3730
3731 return 0;
3732}
3733
3734static int vcpu_stat_clear_per_vm(void *data, u64 val)
3735{
3736 int i;
3737 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3738 struct kvm_vcpu *vcpu;
3739
3740 if (val)
3741 return -EINVAL;
3742
3743 kvm_for_each_vcpu(i, vcpu, stat_data->kvm)
3744 *(u64 *)((void *)vcpu + stat_data->offset) = 0;
3745
3746 return 0;
3747}
3748
3749static int vcpu_stat_get_per_vm_open(struct inode *inode, struct file *file)
3750{
3751 __simple_attr_check_format("%llu\n", 0ull);
3752 return kvm_debugfs_open(inode, file, vcpu_stat_get_per_vm,
3753 vcpu_stat_clear_per_vm, "%llu\n");
3754}
3755
3756static const struct file_operations vcpu_stat_get_per_vm_fops = {
3757 .owner = THIS_MODULE,
3758 .open = vcpu_stat_get_per_vm_open,
3759 .release = kvm_debugfs_release,
3760 .read = simple_attr_read,
3761 .write = simple_attr_write,
3762 .llseek = generic_file_llseek,
3763};
3764
3765static const struct file_operations *stat_fops_per_vm[] = {
3766 [KVM_STAT_VCPU] = &vcpu_stat_get_per_vm_fops,
3767 [KVM_STAT_VM] = &vm_stat_get_per_vm_fops,
3768};
3769
3770static int vm_stat_get(void *_offset, u64 *val)
3771{
3772 unsigned offset = (long)_offset;
3773 struct kvm *kvm;
3774 struct kvm_stat_data stat_tmp = {.offset = offset};
3775 u64 tmp_val;
3776
3777 *val = 0;
3778 spin_lock(&kvm_lock);
3779 list_for_each_entry(kvm, &vm_list, vm_list) {
3780 stat_tmp.kvm = kvm;
3781 vm_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
3782 *val += tmp_val;
3783 }
3784 spin_unlock(&kvm_lock);
3785 return 0;
3786}
3787
3788static int vm_stat_clear(void *_offset, u64 val)
3789{
3790 unsigned offset = (long)_offset;
3791 struct kvm *kvm;
3792 struct kvm_stat_data stat_tmp = {.offset = offset};
3793
3794 if (val)
3795 return -EINVAL;
3796
3797 spin_lock(&kvm_lock);
3798 list_for_each_entry(kvm, &vm_list, vm_list) {
3799 stat_tmp.kvm = kvm;
3800 vm_stat_clear_per_vm((void *)&stat_tmp, 0);
3801 }
3802 spin_unlock(&kvm_lock);
3803
3804 return 0;
3805}
3806
3807DEFINE_SIMPLE_ATTRIBUTE(vm_stat_fops, vm_stat_get, vm_stat_clear, "%llu\n");
3808
3809static int vcpu_stat_get(void *_offset, u64 *val)
3810{
3811 unsigned offset = (long)_offset;
3812 struct kvm *kvm;
3813 struct kvm_stat_data stat_tmp = {.offset = offset};
3814 u64 tmp_val;
3815
3816 *val = 0;
3817 spin_lock(&kvm_lock);
3818 list_for_each_entry(kvm, &vm_list, vm_list) {
3819 stat_tmp.kvm = kvm;
3820 vcpu_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
3821 *val += tmp_val;
3822 }
3823 spin_unlock(&kvm_lock);
3824 return 0;
3825}
3826
3827static int vcpu_stat_clear(void *_offset, u64 val)
3828{
3829 unsigned offset = (long)_offset;
3830 struct kvm *kvm;
3831 struct kvm_stat_data stat_tmp = {.offset = offset};
3832
3833 if (val)
3834 return -EINVAL;
3835
3836 spin_lock(&kvm_lock);
3837 list_for_each_entry(kvm, &vm_list, vm_list) {
3838 stat_tmp.kvm = kvm;
3839 vcpu_stat_clear_per_vm((void *)&stat_tmp, 0);
3840 }
3841 spin_unlock(&kvm_lock);
3842
3843 return 0;
3844}
3845
3846DEFINE_SIMPLE_ATTRIBUTE(vcpu_stat_fops, vcpu_stat_get, vcpu_stat_clear,
3847 "%llu\n");
3848
3849static const struct file_operations *stat_fops[] = {
3850 [KVM_STAT_VCPU] = &vcpu_stat_fops,
3851 [KVM_STAT_VM] = &vm_stat_fops,
3852};
3853
3854static int kvm_init_debug(void)
3855{
3856 int r = -EEXIST;
3857 struct kvm_stats_debugfs_item *p;
3858
3859 kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);
3860 if (kvm_debugfs_dir == NULL)
3861 goto out;
3862
3863 kvm_debugfs_num_entries = 0;
3864 for (p = debugfs_entries; p->name; ++p, kvm_debugfs_num_entries++) {
3865 if (!debugfs_create_file(p->name, 0644, kvm_debugfs_dir,
3866 (void *)(long)p->offset,
3867 stat_fops[p->kind]))
3868 goto out_dir;
3869 }
3870
3871 return 0;
3872
3873out_dir:
3874 debugfs_remove_recursive(kvm_debugfs_dir);
3875out:
3876 return r;
3877}
3878
3879static int kvm_suspend(void)
3880{
3881 if (kvm_usage_count)
3882 hardware_disable_nolock(NULL);
3883 return 0;
3884}
3885
3886static void kvm_resume(void)
3887{
3888 if (kvm_usage_count) {
3889 WARN_ON(raw_spin_is_locked(&kvm_count_lock));
3890 hardware_enable_nolock(NULL);
3891 }
3892}
3893
3894static struct syscore_ops kvm_syscore_ops = {
3895 .suspend = kvm_suspend,
3896 .resume = kvm_resume,
3897};
3898
3899static inline
3900struct kvm_vcpu *preempt_notifier_to_vcpu(struct preempt_notifier *pn)
3901{
3902 return container_of(pn, struct kvm_vcpu, preempt_notifier);
3903}
3904
3905static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
3906{
3907 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
3908
3909 if (vcpu->preempted)
3910 vcpu->preempted = false;
3911
3912 kvm_arch_sched_in(vcpu, cpu);
3913
3914 kvm_arch_vcpu_load(vcpu, cpu);
3915}
3916
3917static void kvm_sched_out(struct preempt_notifier *pn,
3918 struct task_struct *next)
3919{
3920 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
3921
3922 if (current->state == TASK_RUNNING)
3923 vcpu->preempted = true;
3924 kvm_arch_vcpu_put(vcpu);
3925}
3926
3927int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
3928 struct module *module)
3929{
3930 int r;
3931 int cpu;
3932
3933 r = kvm_arch_init(opaque);
3934 if (r)
3935 goto out_fail;
3936
3937 /*
3938 * kvm_arch_init makes sure there's at most one caller
3939 * for architectures that support multiple implementations,
3940 * like intel and amd on x86.
3941 * kvm_arch_init must be called before kvm_irqfd_init to avoid creating
3942 * conflicts in case kvm is already setup for another implementation.
3943 */
3944 r = kvm_irqfd_init();
3945 if (r)
3946 goto out_irqfd;
3947
3948 if (!zalloc_cpumask_var(&cpus_hardware_enabled, GFP_KERNEL)) {
3949 r = -ENOMEM;
3950 goto out_free_0;
3951 }
3952
3953 r = kvm_arch_hardware_setup();
3954 if (r < 0)
3955 goto out_free_0a;
3956
3957 for_each_online_cpu(cpu) {
3958 smp_call_function_single(cpu,
3959 kvm_arch_check_processor_compat,
3960 &r, 1);
3961 if (r < 0)
3962 goto out_free_1;
3963 }
3964
3965 r = cpuhp_setup_state_nocalls(CPUHP_AP_KVM_STARTING, "kvm/cpu:starting",
3966 kvm_starting_cpu, kvm_dying_cpu);
3967 if (r)
3968 goto out_free_2;
3969 register_reboot_notifier(&kvm_reboot_notifier);
3970
3971 /* A kmem cache lets us meet the alignment requirements of fx_save. */
3972 if (!vcpu_align)
3973 vcpu_align = __alignof__(struct kvm_vcpu);
3974 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
3975 0, NULL);
3976 if (!kvm_vcpu_cache) {
3977 r = -ENOMEM;
3978 goto out_free_3;
3979 }
3980
3981 r = kvm_async_pf_init();
3982 if (r)
3983 goto out_free;
3984
3985 kvm_chardev_ops.owner = module;
3986 kvm_vm_fops.owner = module;
3987 kvm_vcpu_fops.owner = module;
3988
3989 r = misc_register(&kvm_dev);
3990 if (r) {
3991 pr_err("kvm: misc device register failed\n");
3992 goto out_unreg;
3993 }
3994
3995 register_syscore_ops(&kvm_syscore_ops);
3996
3997 kvm_preempt_ops.sched_in = kvm_sched_in;
3998 kvm_preempt_ops.sched_out = kvm_sched_out;
3999
4000 r = kvm_init_debug();
4001 if (r) {
4002 pr_err("kvm: create debugfs files failed\n");
4003 goto out_undebugfs;
4004 }
4005
4006 r = kvm_vfio_ops_init();
4007 WARN_ON(r);
4008
4009 return 0;
4010
4011out_undebugfs:
4012 unregister_syscore_ops(&kvm_syscore_ops);
4013 misc_deregister(&kvm_dev);
4014out_unreg:
4015 kvm_async_pf_deinit();
4016out_free:
4017 kmem_cache_destroy(kvm_vcpu_cache);
4018out_free_3:
4019 unregister_reboot_notifier(&kvm_reboot_notifier);
4020 cpuhp_remove_state_nocalls(CPUHP_AP_KVM_STARTING);
4021out_free_2:
4022out_free_1:
4023 kvm_arch_hardware_unsetup();
4024out_free_0a:
4025 free_cpumask_var(cpus_hardware_enabled);
4026out_free_0:
4027 kvm_irqfd_exit();
4028out_irqfd:
4029 kvm_arch_exit();
4030out_fail:
4031 return r;
4032}
4033EXPORT_SYMBOL_GPL(kvm_init);
4034
4035void kvm_exit(void)
4036{
4037 debugfs_remove_recursive(kvm_debugfs_dir);
4038 misc_deregister(&kvm_dev);
4039 kmem_cache_destroy(kvm_vcpu_cache);
4040 kvm_async_pf_deinit();
4041 unregister_syscore_ops(&kvm_syscore_ops);
4042 unregister_reboot_notifier(&kvm_reboot_notifier);
4043 cpuhp_remove_state_nocalls(CPUHP_AP_KVM_STARTING);
4044 on_each_cpu(hardware_disable_nolock, NULL, 1);
4045 kvm_arch_hardware_unsetup();
4046 kvm_arch_exit();
4047 kvm_irqfd_exit();
4048 free_cpumask_var(cpus_hardware_enabled);
4049 kvm_vfio_ops_exit();
4050}
4051EXPORT_SYMBOL_GPL(kvm_exit);