Loading...
1/*
2 * Kernel-based Virtual Machine driver for Linux
3 *
4 * This module enables machines with Intel VT-x extensions to run virtual
5 * machines without emulation or binary translation.
6 *
7 * Copyright (C) 2006 Qumranet, Inc.
8 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
9 *
10 * Authors:
11 * Avi Kivity <avi@qumranet.com>
12 * Yaniv Kamay <yaniv@qumranet.com>
13 *
14 * This work is licensed under the terms of the GNU GPL, version 2. See
15 * the COPYING file in the top-level directory.
16 *
17 */
18
19#include <kvm/iodev.h>
20
21#include <linux/kvm_host.h>
22#include <linux/kvm.h>
23#include <linux/module.h>
24#include <linux/errno.h>
25#include <linux/percpu.h>
26#include <linux/mm.h>
27#include <linux/miscdevice.h>
28#include <linux/vmalloc.h>
29#include <linux/reboot.h>
30#include <linux/debugfs.h>
31#include <linux/highmem.h>
32#include <linux/file.h>
33#include <linux/syscore_ops.h>
34#include <linux/cpu.h>
35#include <linux/sched.h>
36#include <linux/cpumask.h>
37#include <linux/smp.h>
38#include <linux/anon_inodes.h>
39#include <linux/profile.h>
40#include <linux/kvm_para.h>
41#include <linux/pagemap.h>
42#include <linux/mman.h>
43#include <linux/swap.h>
44#include <linux/bitops.h>
45#include <linux/spinlock.h>
46#include <linux/compat.h>
47#include <linux/srcu.h>
48#include <linux/hugetlb.h>
49#include <linux/slab.h>
50#include <linux/sort.h>
51#include <linux/bsearch.h>
52
53#include <asm/processor.h>
54#include <asm/io.h>
55#include <asm/ioctl.h>
56#include <asm/uaccess.h>
57#include <asm/pgtable.h>
58
59#include "coalesced_mmio.h"
60#include "async_pf.h"
61#include "vfio.h"
62
63#define CREATE_TRACE_POINTS
64#include <trace/events/kvm.h>
65
66MODULE_AUTHOR("Qumranet");
67MODULE_LICENSE("GPL");
68
69/* Architectures should define their poll value according to the halt latency */
70static unsigned int halt_poll_ns = KVM_HALT_POLL_NS_DEFAULT;
71module_param(halt_poll_ns, uint, S_IRUGO | S_IWUSR);
72
73/* Default doubles per-vcpu halt_poll_ns. */
74static unsigned int halt_poll_ns_grow = 2;
75module_param(halt_poll_ns_grow, uint, S_IRUGO | S_IWUSR);
76
77/* Default resets per-vcpu halt_poll_ns . */
78static unsigned int halt_poll_ns_shrink;
79module_param(halt_poll_ns_shrink, uint, S_IRUGO | S_IWUSR);
80
81/*
82 * Ordering of locks:
83 *
84 * kvm->lock --> kvm->slots_lock --> kvm->irq_lock
85 */
86
87DEFINE_SPINLOCK(kvm_lock);
88static DEFINE_RAW_SPINLOCK(kvm_count_lock);
89LIST_HEAD(vm_list);
90
91static cpumask_var_t cpus_hardware_enabled;
92static int kvm_usage_count;
93static atomic_t hardware_enable_failed;
94
95struct kmem_cache *kvm_vcpu_cache;
96EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
97
98static __read_mostly struct preempt_ops kvm_preempt_ops;
99
100struct dentry *kvm_debugfs_dir;
101EXPORT_SYMBOL_GPL(kvm_debugfs_dir);
102
103static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl,
104 unsigned long arg);
105#ifdef CONFIG_KVM_COMPAT
106static long kvm_vcpu_compat_ioctl(struct file *file, unsigned int ioctl,
107 unsigned long arg);
108#endif
109static int hardware_enable_all(void);
110static void hardware_disable_all(void);
111
112static void kvm_io_bus_destroy(struct kvm_io_bus *bus);
113
114static void kvm_release_pfn_dirty(kvm_pfn_t pfn);
115static void mark_page_dirty_in_slot(struct kvm_memory_slot *memslot, gfn_t gfn);
116
117__visible bool kvm_rebooting;
118EXPORT_SYMBOL_GPL(kvm_rebooting);
119
120static bool largepages_enabled = true;
121
122bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
123{
124 if (pfn_valid(pfn))
125 return PageReserved(pfn_to_page(pfn));
126
127 return true;
128}
129
130/*
131 * Switches to specified vcpu, until a matching vcpu_put()
132 */
133int vcpu_load(struct kvm_vcpu *vcpu)
134{
135 int cpu;
136
137 if (mutex_lock_killable(&vcpu->mutex))
138 return -EINTR;
139 cpu = get_cpu();
140 preempt_notifier_register(&vcpu->preempt_notifier);
141 kvm_arch_vcpu_load(vcpu, cpu);
142 put_cpu();
143 return 0;
144}
145
146void vcpu_put(struct kvm_vcpu *vcpu)
147{
148 preempt_disable();
149 kvm_arch_vcpu_put(vcpu);
150 preempt_notifier_unregister(&vcpu->preempt_notifier);
151 preempt_enable();
152 mutex_unlock(&vcpu->mutex);
153}
154
155static void ack_flush(void *_completed)
156{
157}
158
159bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req)
160{
161 int i, cpu, me;
162 cpumask_var_t cpus;
163 bool called = true;
164 struct kvm_vcpu *vcpu;
165
166 zalloc_cpumask_var(&cpus, GFP_ATOMIC);
167
168 me = get_cpu();
169 kvm_for_each_vcpu(i, vcpu, kvm) {
170 kvm_make_request(req, vcpu);
171 cpu = vcpu->cpu;
172
173 /* Set ->requests bit before we read ->mode. */
174 smp_mb__after_atomic();
175
176 if (cpus != NULL && cpu != -1 && cpu != me &&
177 kvm_vcpu_exiting_guest_mode(vcpu) != OUTSIDE_GUEST_MODE)
178 cpumask_set_cpu(cpu, cpus);
179 }
180 if (unlikely(cpus == NULL))
181 smp_call_function_many(cpu_online_mask, ack_flush, NULL, 1);
182 else if (!cpumask_empty(cpus))
183 smp_call_function_many(cpus, ack_flush, NULL, 1);
184 else
185 called = false;
186 put_cpu();
187 free_cpumask_var(cpus);
188 return called;
189}
190
191#ifndef CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL
192void kvm_flush_remote_tlbs(struct kvm *kvm)
193{
194 /*
195 * Read tlbs_dirty before setting KVM_REQ_TLB_FLUSH in
196 * kvm_make_all_cpus_request.
197 */
198 long dirty_count = smp_load_acquire(&kvm->tlbs_dirty);
199
200 /*
201 * We want to publish modifications to the page tables before reading
202 * mode. Pairs with a memory barrier in arch-specific code.
203 * - x86: smp_mb__after_srcu_read_unlock in vcpu_enter_guest
204 * and smp_mb in walk_shadow_page_lockless_begin/end.
205 * - powerpc: smp_mb in kvmppc_prepare_to_enter.
206 *
207 * There is already an smp_mb__after_atomic() before
208 * kvm_make_all_cpus_request() reads vcpu->mode. We reuse that
209 * barrier here.
210 */
211 if (kvm_make_all_cpus_request(kvm, KVM_REQ_TLB_FLUSH))
212 ++kvm->stat.remote_tlb_flush;
213 cmpxchg(&kvm->tlbs_dirty, dirty_count, 0);
214}
215EXPORT_SYMBOL_GPL(kvm_flush_remote_tlbs);
216#endif
217
218void kvm_reload_remote_mmus(struct kvm *kvm)
219{
220 kvm_make_all_cpus_request(kvm, KVM_REQ_MMU_RELOAD);
221}
222
223int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
224{
225 struct page *page;
226 int r;
227
228 mutex_init(&vcpu->mutex);
229 vcpu->cpu = -1;
230 vcpu->kvm = kvm;
231 vcpu->vcpu_id = id;
232 vcpu->pid = NULL;
233 init_swait_queue_head(&vcpu->wq);
234 kvm_async_pf_vcpu_init(vcpu);
235
236 vcpu->pre_pcpu = -1;
237 INIT_LIST_HEAD(&vcpu->blocked_vcpu_list);
238
239 page = alloc_page(GFP_KERNEL | __GFP_ZERO);
240 if (!page) {
241 r = -ENOMEM;
242 goto fail;
243 }
244 vcpu->run = page_address(page);
245
246 kvm_vcpu_set_in_spin_loop(vcpu, false);
247 kvm_vcpu_set_dy_eligible(vcpu, false);
248 vcpu->preempted = false;
249
250 r = kvm_arch_vcpu_init(vcpu);
251 if (r < 0)
252 goto fail_free_run;
253 return 0;
254
255fail_free_run:
256 free_page((unsigned long)vcpu->run);
257fail:
258 return r;
259}
260EXPORT_SYMBOL_GPL(kvm_vcpu_init);
261
262void kvm_vcpu_uninit(struct kvm_vcpu *vcpu)
263{
264 put_pid(vcpu->pid);
265 kvm_arch_vcpu_uninit(vcpu);
266 free_page((unsigned long)vcpu->run);
267}
268EXPORT_SYMBOL_GPL(kvm_vcpu_uninit);
269
270#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
271static inline struct kvm *mmu_notifier_to_kvm(struct mmu_notifier *mn)
272{
273 return container_of(mn, struct kvm, mmu_notifier);
274}
275
276static void kvm_mmu_notifier_invalidate_page(struct mmu_notifier *mn,
277 struct mm_struct *mm,
278 unsigned long address)
279{
280 struct kvm *kvm = mmu_notifier_to_kvm(mn);
281 int need_tlb_flush, idx;
282
283 /*
284 * When ->invalidate_page runs, the linux pte has been zapped
285 * already but the page is still allocated until
286 * ->invalidate_page returns. So if we increase the sequence
287 * here the kvm page fault will notice if the spte can't be
288 * established because the page is going to be freed. If
289 * instead the kvm page fault establishes the spte before
290 * ->invalidate_page runs, kvm_unmap_hva will release it
291 * before returning.
292 *
293 * The sequence increase only need to be seen at spin_unlock
294 * time, and not at spin_lock time.
295 *
296 * Increasing the sequence after the spin_unlock would be
297 * unsafe because the kvm page fault could then establish the
298 * pte after kvm_unmap_hva returned, without noticing the page
299 * is going to be freed.
300 */
301 idx = srcu_read_lock(&kvm->srcu);
302 spin_lock(&kvm->mmu_lock);
303
304 kvm->mmu_notifier_seq++;
305 need_tlb_flush = kvm_unmap_hva(kvm, address) | kvm->tlbs_dirty;
306 /* we've to flush the tlb before the pages can be freed */
307 if (need_tlb_flush)
308 kvm_flush_remote_tlbs(kvm);
309
310 spin_unlock(&kvm->mmu_lock);
311
312 kvm_arch_mmu_notifier_invalidate_page(kvm, address);
313
314 srcu_read_unlock(&kvm->srcu, idx);
315}
316
317static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
318 struct mm_struct *mm,
319 unsigned long address,
320 pte_t pte)
321{
322 struct kvm *kvm = mmu_notifier_to_kvm(mn);
323 int idx;
324
325 idx = srcu_read_lock(&kvm->srcu);
326 spin_lock(&kvm->mmu_lock);
327 kvm->mmu_notifier_seq++;
328 kvm_set_spte_hva(kvm, address, pte);
329 spin_unlock(&kvm->mmu_lock);
330 srcu_read_unlock(&kvm->srcu, idx);
331}
332
333static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
334 struct mm_struct *mm,
335 unsigned long start,
336 unsigned long end)
337{
338 struct kvm *kvm = mmu_notifier_to_kvm(mn);
339 int need_tlb_flush = 0, idx;
340
341 idx = srcu_read_lock(&kvm->srcu);
342 spin_lock(&kvm->mmu_lock);
343 /*
344 * The count increase must become visible at unlock time as no
345 * spte can be established without taking the mmu_lock and
346 * count is also read inside the mmu_lock critical section.
347 */
348 kvm->mmu_notifier_count++;
349 need_tlb_flush = kvm_unmap_hva_range(kvm, start, end);
350 need_tlb_flush |= kvm->tlbs_dirty;
351 /* we've to flush the tlb before the pages can be freed */
352 if (need_tlb_flush)
353 kvm_flush_remote_tlbs(kvm);
354
355 spin_unlock(&kvm->mmu_lock);
356 srcu_read_unlock(&kvm->srcu, idx);
357}
358
359static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
360 struct mm_struct *mm,
361 unsigned long start,
362 unsigned long end)
363{
364 struct kvm *kvm = mmu_notifier_to_kvm(mn);
365
366 spin_lock(&kvm->mmu_lock);
367 /*
368 * This sequence increase will notify the kvm page fault that
369 * the page that is going to be mapped in the spte could have
370 * been freed.
371 */
372 kvm->mmu_notifier_seq++;
373 smp_wmb();
374 /*
375 * The above sequence increase must be visible before the
376 * below count decrease, which is ensured by the smp_wmb above
377 * in conjunction with the smp_rmb in mmu_notifier_retry().
378 */
379 kvm->mmu_notifier_count--;
380 spin_unlock(&kvm->mmu_lock);
381
382 BUG_ON(kvm->mmu_notifier_count < 0);
383}
384
385static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
386 struct mm_struct *mm,
387 unsigned long start,
388 unsigned long end)
389{
390 struct kvm *kvm = mmu_notifier_to_kvm(mn);
391 int young, idx;
392
393 idx = srcu_read_lock(&kvm->srcu);
394 spin_lock(&kvm->mmu_lock);
395
396 young = kvm_age_hva(kvm, start, end);
397 if (young)
398 kvm_flush_remote_tlbs(kvm);
399
400 spin_unlock(&kvm->mmu_lock);
401 srcu_read_unlock(&kvm->srcu, idx);
402
403 return young;
404}
405
406static int kvm_mmu_notifier_clear_young(struct mmu_notifier *mn,
407 struct mm_struct *mm,
408 unsigned long start,
409 unsigned long end)
410{
411 struct kvm *kvm = mmu_notifier_to_kvm(mn);
412 int young, idx;
413
414 idx = srcu_read_lock(&kvm->srcu);
415 spin_lock(&kvm->mmu_lock);
416 /*
417 * Even though we do not flush TLB, this will still adversely
418 * affect performance on pre-Haswell Intel EPT, where there is
419 * no EPT Access Bit to clear so that we have to tear down EPT
420 * tables instead. If we find this unacceptable, we can always
421 * add a parameter to kvm_age_hva so that it effectively doesn't
422 * do anything on clear_young.
423 *
424 * Also note that currently we never issue secondary TLB flushes
425 * from clear_young, leaving this job up to the regular system
426 * cadence. If we find this inaccurate, we might come up with a
427 * more sophisticated heuristic later.
428 */
429 young = kvm_age_hva(kvm, start, end);
430 spin_unlock(&kvm->mmu_lock);
431 srcu_read_unlock(&kvm->srcu, idx);
432
433 return young;
434}
435
436static int kvm_mmu_notifier_test_young(struct mmu_notifier *mn,
437 struct mm_struct *mm,
438 unsigned long address)
439{
440 struct kvm *kvm = mmu_notifier_to_kvm(mn);
441 int young, idx;
442
443 idx = srcu_read_lock(&kvm->srcu);
444 spin_lock(&kvm->mmu_lock);
445 young = kvm_test_age_hva(kvm, address);
446 spin_unlock(&kvm->mmu_lock);
447 srcu_read_unlock(&kvm->srcu, idx);
448
449 return young;
450}
451
452static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
453 struct mm_struct *mm)
454{
455 struct kvm *kvm = mmu_notifier_to_kvm(mn);
456 int idx;
457
458 idx = srcu_read_lock(&kvm->srcu);
459 kvm_arch_flush_shadow_all(kvm);
460 srcu_read_unlock(&kvm->srcu, idx);
461}
462
463static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
464 .invalidate_page = kvm_mmu_notifier_invalidate_page,
465 .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
466 .invalidate_range_end = kvm_mmu_notifier_invalidate_range_end,
467 .clear_flush_young = kvm_mmu_notifier_clear_flush_young,
468 .clear_young = kvm_mmu_notifier_clear_young,
469 .test_young = kvm_mmu_notifier_test_young,
470 .change_pte = kvm_mmu_notifier_change_pte,
471 .release = kvm_mmu_notifier_release,
472};
473
474static int kvm_init_mmu_notifier(struct kvm *kvm)
475{
476 kvm->mmu_notifier.ops = &kvm_mmu_notifier_ops;
477 return mmu_notifier_register(&kvm->mmu_notifier, current->mm);
478}
479
480#else /* !(CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER) */
481
482static int kvm_init_mmu_notifier(struct kvm *kvm)
483{
484 return 0;
485}
486
487#endif /* CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER */
488
489static struct kvm_memslots *kvm_alloc_memslots(void)
490{
491 int i;
492 struct kvm_memslots *slots;
493
494 slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
495 if (!slots)
496 return NULL;
497
498 /*
499 * Init kvm generation close to the maximum to easily test the
500 * code of handling generation number wrap-around.
501 */
502 slots->generation = -150;
503 for (i = 0; i < KVM_MEM_SLOTS_NUM; i++)
504 slots->id_to_index[i] = slots->memslots[i].id = i;
505
506 return slots;
507}
508
509static void kvm_destroy_dirty_bitmap(struct kvm_memory_slot *memslot)
510{
511 if (!memslot->dirty_bitmap)
512 return;
513
514 kvfree(memslot->dirty_bitmap);
515 memslot->dirty_bitmap = NULL;
516}
517
518/*
519 * Free any memory in @free but not in @dont.
520 */
521static void kvm_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
522 struct kvm_memory_slot *dont)
523{
524 if (!dont || free->dirty_bitmap != dont->dirty_bitmap)
525 kvm_destroy_dirty_bitmap(free);
526
527 kvm_arch_free_memslot(kvm, free, dont);
528
529 free->npages = 0;
530}
531
532static void kvm_free_memslots(struct kvm *kvm, struct kvm_memslots *slots)
533{
534 struct kvm_memory_slot *memslot;
535
536 if (!slots)
537 return;
538
539 kvm_for_each_memslot(memslot, slots)
540 kvm_free_memslot(kvm, memslot, NULL);
541
542 kvfree(slots);
543}
544
545static struct kvm *kvm_create_vm(unsigned long type)
546{
547 int r, i;
548 struct kvm *kvm = kvm_arch_alloc_vm();
549
550 if (!kvm)
551 return ERR_PTR(-ENOMEM);
552
553 spin_lock_init(&kvm->mmu_lock);
554 atomic_inc(¤t->mm->mm_count);
555 kvm->mm = current->mm;
556 kvm_eventfd_init(kvm);
557 mutex_init(&kvm->lock);
558 mutex_init(&kvm->irq_lock);
559 mutex_init(&kvm->slots_lock);
560 atomic_set(&kvm->users_count, 1);
561 INIT_LIST_HEAD(&kvm->devices);
562
563 r = kvm_arch_init_vm(kvm, type);
564 if (r)
565 goto out_err_no_disable;
566
567 r = hardware_enable_all();
568 if (r)
569 goto out_err_no_disable;
570
571#ifdef CONFIG_HAVE_KVM_IRQFD
572 INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
573#endif
574
575 BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
576
577 r = -ENOMEM;
578 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
579 kvm->memslots[i] = kvm_alloc_memslots();
580 if (!kvm->memslots[i])
581 goto out_err_no_srcu;
582 }
583
584 if (init_srcu_struct(&kvm->srcu))
585 goto out_err_no_srcu;
586 if (init_srcu_struct(&kvm->irq_srcu))
587 goto out_err_no_irq_srcu;
588 for (i = 0; i < KVM_NR_BUSES; i++) {
589 kvm->buses[i] = kzalloc(sizeof(struct kvm_io_bus),
590 GFP_KERNEL);
591 if (!kvm->buses[i])
592 goto out_err;
593 }
594
595 r = kvm_init_mmu_notifier(kvm);
596 if (r)
597 goto out_err;
598
599 spin_lock(&kvm_lock);
600 list_add(&kvm->vm_list, &vm_list);
601 spin_unlock(&kvm_lock);
602
603 preempt_notifier_inc();
604
605 return kvm;
606
607out_err:
608 cleanup_srcu_struct(&kvm->irq_srcu);
609out_err_no_irq_srcu:
610 cleanup_srcu_struct(&kvm->srcu);
611out_err_no_srcu:
612 hardware_disable_all();
613out_err_no_disable:
614 for (i = 0; i < KVM_NR_BUSES; i++)
615 kfree(kvm->buses[i]);
616 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
617 kvm_free_memslots(kvm, kvm->memslots[i]);
618 kvm_arch_free_vm(kvm);
619 mmdrop(current->mm);
620 return ERR_PTR(r);
621}
622
623/*
624 * Avoid using vmalloc for a small buffer.
625 * Should not be used when the size is statically known.
626 */
627void *kvm_kvzalloc(unsigned long size)
628{
629 if (size > PAGE_SIZE)
630 return vzalloc(size);
631 else
632 return kzalloc(size, GFP_KERNEL);
633}
634
635static void kvm_destroy_devices(struct kvm *kvm)
636{
637 struct kvm_device *dev, *tmp;
638
639 list_for_each_entry_safe(dev, tmp, &kvm->devices, vm_node) {
640 list_del(&dev->vm_node);
641 dev->ops->destroy(dev);
642 }
643}
644
645static void kvm_destroy_vm(struct kvm *kvm)
646{
647 int i;
648 struct mm_struct *mm = kvm->mm;
649
650 kvm_arch_sync_events(kvm);
651 spin_lock(&kvm_lock);
652 list_del(&kvm->vm_list);
653 spin_unlock(&kvm_lock);
654 kvm_free_irq_routing(kvm);
655 for (i = 0; i < KVM_NR_BUSES; i++)
656 kvm_io_bus_destroy(kvm->buses[i]);
657 kvm_coalesced_mmio_free(kvm);
658#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
659 mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
660#else
661 kvm_arch_flush_shadow_all(kvm);
662#endif
663 kvm_arch_destroy_vm(kvm);
664 kvm_destroy_devices(kvm);
665 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
666 kvm_free_memslots(kvm, kvm->memslots[i]);
667 cleanup_srcu_struct(&kvm->irq_srcu);
668 cleanup_srcu_struct(&kvm->srcu);
669 kvm_arch_free_vm(kvm);
670 preempt_notifier_dec();
671 hardware_disable_all();
672 mmdrop(mm);
673}
674
675void kvm_get_kvm(struct kvm *kvm)
676{
677 atomic_inc(&kvm->users_count);
678}
679EXPORT_SYMBOL_GPL(kvm_get_kvm);
680
681void kvm_put_kvm(struct kvm *kvm)
682{
683 if (atomic_dec_and_test(&kvm->users_count))
684 kvm_destroy_vm(kvm);
685}
686EXPORT_SYMBOL_GPL(kvm_put_kvm);
687
688
689static int kvm_vm_release(struct inode *inode, struct file *filp)
690{
691 struct kvm *kvm = filp->private_data;
692
693 kvm_irqfd_release(kvm);
694
695 kvm_put_kvm(kvm);
696 return 0;
697}
698
699/*
700 * Allocation size is twice as large as the actual dirty bitmap size.
701 * See x86's kvm_vm_ioctl_get_dirty_log() why this is needed.
702 */
703static int kvm_create_dirty_bitmap(struct kvm_memory_slot *memslot)
704{
705 unsigned long dirty_bytes = 2 * kvm_dirty_bitmap_bytes(memslot);
706
707 memslot->dirty_bitmap = kvm_kvzalloc(dirty_bytes);
708 if (!memslot->dirty_bitmap)
709 return -ENOMEM;
710
711 return 0;
712}
713
714/*
715 * Insert memslot and re-sort memslots based on their GFN,
716 * so binary search could be used to lookup GFN.
717 * Sorting algorithm takes advantage of having initially
718 * sorted array and known changed memslot position.
719 */
720static void update_memslots(struct kvm_memslots *slots,
721 struct kvm_memory_slot *new)
722{
723 int id = new->id;
724 int i = slots->id_to_index[id];
725 struct kvm_memory_slot *mslots = slots->memslots;
726
727 WARN_ON(mslots[i].id != id);
728 if (!new->npages) {
729 WARN_ON(!mslots[i].npages);
730 if (mslots[i].npages)
731 slots->used_slots--;
732 } else {
733 if (!mslots[i].npages)
734 slots->used_slots++;
735 }
736
737 while (i < KVM_MEM_SLOTS_NUM - 1 &&
738 new->base_gfn <= mslots[i + 1].base_gfn) {
739 if (!mslots[i + 1].npages)
740 break;
741 mslots[i] = mslots[i + 1];
742 slots->id_to_index[mslots[i].id] = i;
743 i++;
744 }
745
746 /*
747 * The ">=" is needed when creating a slot with base_gfn == 0,
748 * so that it moves before all those with base_gfn == npages == 0.
749 *
750 * On the other hand, if new->npages is zero, the above loop has
751 * already left i pointing to the beginning of the empty part of
752 * mslots, and the ">=" would move the hole backwards in this
753 * case---which is wrong. So skip the loop when deleting a slot.
754 */
755 if (new->npages) {
756 while (i > 0 &&
757 new->base_gfn >= mslots[i - 1].base_gfn) {
758 mslots[i] = mslots[i - 1];
759 slots->id_to_index[mslots[i].id] = i;
760 i--;
761 }
762 } else
763 WARN_ON_ONCE(i != slots->used_slots);
764
765 mslots[i] = *new;
766 slots->id_to_index[mslots[i].id] = i;
767}
768
769static int check_memory_region_flags(const struct kvm_userspace_memory_region *mem)
770{
771 u32 valid_flags = KVM_MEM_LOG_DIRTY_PAGES;
772
773#ifdef __KVM_HAVE_READONLY_MEM
774 valid_flags |= KVM_MEM_READONLY;
775#endif
776
777 if (mem->flags & ~valid_flags)
778 return -EINVAL;
779
780 return 0;
781}
782
783static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
784 int as_id, struct kvm_memslots *slots)
785{
786 struct kvm_memslots *old_memslots = __kvm_memslots(kvm, as_id);
787
788 /*
789 * Set the low bit in the generation, which disables SPTE caching
790 * until the end of synchronize_srcu_expedited.
791 */
792 WARN_ON(old_memslots->generation & 1);
793 slots->generation = old_memslots->generation + 1;
794
795 rcu_assign_pointer(kvm->memslots[as_id], slots);
796 synchronize_srcu_expedited(&kvm->srcu);
797
798 /*
799 * Increment the new memslot generation a second time. This prevents
800 * vm exits that race with memslot updates from caching a memslot
801 * generation that will (potentially) be valid forever.
802 */
803 slots->generation++;
804
805 kvm_arch_memslots_updated(kvm, slots);
806
807 return old_memslots;
808}
809
810/*
811 * Allocate some memory and give it an address in the guest physical address
812 * space.
813 *
814 * Discontiguous memory is allowed, mostly for framebuffers.
815 *
816 * Must be called holding kvm->slots_lock for write.
817 */
818int __kvm_set_memory_region(struct kvm *kvm,
819 const struct kvm_userspace_memory_region *mem)
820{
821 int r;
822 gfn_t base_gfn;
823 unsigned long npages;
824 struct kvm_memory_slot *slot;
825 struct kvm_memory_slot old, new;
826 struct kvm_memslots *slots = NULL, *old_memslots;
827 int as_id, id;
828 enum kvm_mr_change change;
829
830 r = check_memory_region_flags(mem);
831 if (r)
832 goto out;
833
834 r = -EINVAL;
835 as_id = mem->slot >> 16;
836 id = (u16)mem->slot;
837
838 /* General sanity checks */
839 if (mem->memory_size & (PAGE_SIZE - 1))
840 goto out;
841 if (mem->guest_phys_addr & (PAGE_SIZE - 1))
842 goto out;
843 /* We can read the guest memory with __xxx_user() later on. */
844 if ((id < KVM_USER_MEM_SLOTS) &&
845 ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
846 !access_ok(VERIFY_WRITE,
847 (void __user *)(unsigned long)mem->userspace_addr,
848 mem->memory_size)))
849 goto out;
850 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_MEM_SLOTS_NUM)
851 goto out;
852 if (mem->guest_phys_addr + mem->memory_size < mem->guest_phys_addr)
853 goto out;
854
855 slot = id_to_memslot(__kvm_memslots(kvm, as_id), id);
856 base_gfn = mem->guest_phys_addr >> PAGE_SHIFT;
857 npages = mem->memory_size >> PAGE_SHIFT;
858
859 if (npages > KVM_MEM_MAX_NR_PAGES)
860 goto out;
861
862 new = old = *slot;
863
864 new.id = id;
865 new.base_gfn = base_gfn;
866 new.npages = npages;
867 new.flags = mem->flags;
868
869 if (npages) {
870 if (!old.npages)
871 change = KVM_MR_CREATE;
872 else { /* Modify an existing slot. */
873 if ((mem->userspace_addr != old.userspace_addr) ||
874 (npages != old.npages) ||
875 ((new.flags ^ old.flags) & KVM_MEM_READONLY))
876 goto out;
877
878 if (base_gfn != old.base_gfn)
879 change = KVM_MR_MOVE;
880 else if (new.flags != old.flags)
881 change = KVM_MR_FLAGS_ONLY;
882 else { /* Nothing to change. */
883 r = 0;
884 goto out;
885 }
886 }
887 } else {
888 if (!old.npages)
889 goto out;
890
891 change = KVM_MR_DELETE;
892 new.base_gfn = 0;
893 new.flags = 0;
894 }
895
896 if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
897 /* Check for overlaps */
898 r = -EEXIST;
899 kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) {
900 if ((slot->id >= KVM_USER_MEM_SLOTS) ||
901 (slot->id == id))
902 continue;
903 if (!((base_gfn + npages <= slot->base_gfn) ||
904 (base_gfn >= slot->base_gfn + slot->npages)))
905 goto out;
906 }
907 }
908
909 /* Free page dirty bitmap if unneeded */
910 if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
911 new.dirty_bitmap = NULL;
912
913 r = -ENOMEM;
914 if (change == KVM_MR_CREATE) {
915 new.userspace_addr = mem->userspace_addr;
916
917 if (kvm_arch_create_memslot(kvm, &new, npages))
918 goto out_free;
919 }
920
921 /* Allocate page dirty bitmap if needed */
922 if ((new.flags & KVM_MEM_LOG_DIRTY_PAGES) && !new.dirty_bitmap) {
923 if (kvm_create_dirty_bitmap(&new) < 0)
924 goto out_free;
925 }
926
927 slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
928 if (!slots)
929 goto out_free;
930 memcpy(slots, __kvm_memslots(kvm, as_id), sizeof(struct kvm_memslots));
931
932 if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
933 slot = id_to_memslot(slots, id);
934 slot->flags |= KVM_MEMSLOT_INVALID;
935
936 old_memslots = install_new_memslots(kvm, as_id, slots);
937
938 /* slot was deleted or moved, clear iommu mapping */
939 kvm_iommu_unmap_pages(kvm, &old);
940 /* From this point no new shadow pages pointing to a deleted,
941 * or moved, memslot will be created.
942 *
943 * validation of sp->gfn happens in:
944 * - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
945 * - kvm_is_visible_gfn (mmu_check_roots)
946 */
947 kvm_arch_flush_shadow_memslot(kvm, slot);
948
949 /*
950 * We can re-use the old_memslots from above, the only difference
951 * from the currently installed memslots is the invalid flag. This
952 * will get overwritten by update_memslots anyway.
953 */
954 slots = old_memslots;
955 }
956
957 r = kvm_arch_prepare_memory_region(kvm, &new, mem, change);
958 if (r)
959 goto out_slots;
960
961 /* actual memory is freed via old in kvm_free_memslot below */
962 if (change == KVM_MR_DELETE) {
963 new.dirty_bitmap = NULL;
964 memset(&new.arch, 0, sizeof(new.arch));
965 }
966
967 update_memslots(slots, &new);
968 old_memslots = install_new_memslots(kvm, as_id, slots);
969
970 kvm_arch_commit_memory_region(kvm, mem, &old, &new, change);
971
972 kvm_free_memslot(kvm, &old, &new);
973 kvfree(old_memslots);
974
975 /*
976 * IOMMU mapping: New slots need to be mapped. Old slots need to be
977 * un-mapped and re-mapped if their base changes. Since base change
978 * unmapping is handled above with slot deletion, mapping alone is
979 * needed here. Anything else the iommu might care about for existing
980 * slots (size changes, userspace addr changes and read-only flag
981 * changes) is disallowed above, so any other attribute changes getting
982 * here can be skipped.
983 */
984 if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
985 r = kvm_iommu_map_pages(kvm, &new);
986 return r;
987 }
988
989 return 0;
990
991out_slots:
992 kvfree(slots);
993out_free:
994 kvm_free_memslot(kvm, &new, &old);
995out:
996 return r;
997}
998EXPORT_SYMBOL_GPL(__kvm_set_memory_region);
999
1000int kvm_set_memory_region(struct kvm *kvm,
1001 const struct kvm_userspace_memory_region *mem)
1002{
1003 int r;
1004
1005 mutex_lock(&kvm->slots_lock);
1006 r = __kvm_set_memory_region(kvm, mem);
1007 mutex_unlock(&kvm->slots_lock);
1008 return r;
1009}
1010EXPORT_SYMBOL_GPL(kvm_set_memory_region);
1011
1012static int kvm_vm_ioctl_set_memory_region(struct kvm *kvm,
1013 struct kvm_userspace_memory_region *mem)
1014{
1015 if ((u16)mem->slot >= KVM_USER_MEM_SLOTS)
1016 return -EINVAL;
1017
1018 return kvm_set_memory_region(kvm, mem);
1019}
1020
1021int kvm_get_dirty_log(struct kvm *kvm,
1022 struct kvm_dirty_log *log, int *is_dirty)
1023{
1024 struct kvm_memslots *slots;
1025 struct kvm_memory_slot *memslot;
1026 int r, i, as_id, id;
1027 unsigned long n;
1028 unsigned long any = 0;
1029
1030 r = -EINVAL;
1031 as_id = log->slot >> 16;
1032 id = (u16)log->slot;
1033 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_USER_MEM_SLOTS)
1034 goto out;
1035
1036 slots = __kvm_memslots(kvm, as_id);
1037 memslot = id_to_memslot(slots, id);
1038 r = -ENOENT;
1039 if (!memslot->dirty_bitmap)
1040 goto out;
1041
1042 n = kvm_dirty_bitmap_bytes(memslot);
1043
1044 for (i = 0; !any && i < n/sizeof(long); ++i)
1045 any = memslot->dirty_bitmap[i];
1046
1047 r = -EFAULT;
1048 if (copy_to_user(log->dirty_bitmap, memslot->dirty_bitmap, n))
1049 goto out;
1050
1051 if (any)
1052 *is_dirty = 1;
1053
1054 r = 0;
1055out:
1056 return r;
1057}
1058EXPORT_SYMBOL_GPL(kvm_get_dirty_log);
1059
1060#ifdef CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT
1061/**
1062 * kvm_get_dirty_log_protect - get a snapshot of dirty pages, and if any pages
1063 * are dirty write protect them for next write.
1064 * @kvm: pointer to kvm instance
1065 * @log: slot id and address to which we copy the log
1066 * @is_dirty: flag set if any page is dirty
1067 *
1068 * We need to keep it in mind that VCPU threads can write to the bitmap
1069 * concurrently. So, to avoid losing track of dirty pages we keep the
1070 * following order:
1071 *
1072 * 1. Take a snapshot of the bit and clear it if needed.
1073 * 2. Write protect the corresponding page.
1074 * 3. Copy the snapshot to the userspace.
1075 * 4. Upon return caller flushes TLB's if needed.
1076 *
1077 * Between 2 and 4, the guest may write to the page using the remaining TLB
1078 * entry. This is not a problem because the page is reported dirty using
1079 * the snapshot taken before and step 4 ensures that writes done after
1080 * exiting to userspace will be logged for the next call.
1081 *
1082 */
1083int kvm_get_dirty_log_protect(struct kvm *kvm,
1084 struct kvm_dirty_log *log, bool *is_dirty)
1085{
1086 struct kvm_memslots *slots;
1087 struct kvm_memory_slot *memslot;
1088 int r, i, as_id, id;
1089 unsigned long n;
1090 unsigned long *dirty_bitmap;
1091 unsigned long *dirty_bitmap_buffer;
1092
1093 r = -EINVAL;
1094 as_id = log->slot >> 16;
1095 id = (u16)log->slot;
1096 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_USER_MEM_SLOTS)
1097 goto out;
1098
1099 slots = __kvm_memslots(kvm, as_id);
1100 memslot = id_to_memslot(slots, id);
1101
1102 dirty_bitmap = memslot->dirty_bitmap;
1103 r = -ENOENT;
1104 if (!dirty_bitmap)
1105 goto out;
1106
1107 n = kvm_dirty_bitmap_bytes(memslot);
1108
1109 dirty_bitmap_buffer = dirty_bitmap + n / sizeof(long);
1110 memset(dirty_bitmap_buffer, 0, n);
1111
1112 spin_lock(&kvm->mmu_lock);
1113 *is_dirty = false;
1114 for (i = 0; i < n / sizeof(long); i++) {
1115 unsigned long mask;
1116 gfn_t offset;
1117
1118 if (!dirty_bitmap[i])
1119 continue;
1120
1121 *is_dirty = true;
1122
1123 mask = xchg(&dirty_bitmap[i], 0);
1124 dirty_bitmap_buffer[i] = mask;
1125
1126 if (mask) {
1127 offset = i * BITS_PER_LONG;
1128 kvm_arch_mmu_enable_log_dirty_pt_masked(kvm, memslot,
1129 offset, mask);
1130 }
1131 }
1132
1133 spin_unlock(&kvm->mmu_lock);
1134
1135 r = -EFAULT;
1136 if (copy_to_user(log->dirty_bitmap, dirty_bitmap_buffer, n))
1137 goto out;
1138
1139 r = 0;
1140out:
1141 return r;
1142}
1143EXPORT_SYMBOL_GPL(kvm_get_dirty_log_protect);
1144#endif
1145
1146bool kvm_largepages_enabled(void)
1147{
1148 return largepages_enabled;
1149}
1150
1151void kvm_disable_largepages(void)
1152{
1153 largepages_enabled = false;
1154}
1155EXPORT_SYMBOL_GPL(kvm_disable_largepages);
1156
1157struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn)
1158{
1159 return __gfn_to_memslot(kvm_memslots(kvm), gfn);
1160}
1161EXPORT_SYMBOL_GPL(gfn_to_memslot);
1162
1163struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn)
1164{
1165 return __gfn_to_memslot(kvm_vcpu_memslots(vcpu), gfn);
1166}
1167
1168bool kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn)
1169{
1170 struct kvm_memory_slot *memslot = gfn_to_memslot(kvm, gfn);
1171
1172 if (!memslot || memslot->id >= KVM_USER_MEM_SLOTS ||
1173 memslot->flags & KVM_MEMSLOT_INVALID)
1174 return false;
1175
1176 return true;
1177}
1178EXPORT_SYMBOL_GPL(kvm_is_visible_gfn);
1179
1180unsigned long kvm_host_page_size(struct kvm *kvm, gfn_t gfn)
1181{
1182 struct vm_area_struct *vma;
1183 unsigned long addr, size;
1184
1185 size = PAGE_SIZE;
1186
1187 addr = gfn_to_hva(kvm, gfn);
1188 if (kvm_is_error_hva(addr))
1189 return PAGE_SIZE;
1190
1191 down_read(¤t->mm->mmap_sem);
1192 vma = find_vma(current->mm, addr);
1193 if (!vma)
1194 goto out;
1195
1196 size = vma_kernel_pagesize(vma);
1197
1198out:
1199 up_read(¤t->mm->mmap_sem);
1200
1201 return size;
1202}
1203
1204static bool memslot_is_readonly(struct kvm_memory_slot *slot)
1205{
1206 return slot->flags & KVM_MEM_READONLY;
1207}
1208
1209static unsigned long __gfn_to_hva_many(struct kvm_memory_slot *slot, gfn_t gfn,
1210 gfn_t *nr_pages, bool write)
1211{
1212 if (!slot || slot->flags & KVM_MEMSLOT_INVALID)
1213 return KVM_HVA_ERR_BAD;
1214
1215 if (memslot_is_readonly(slot) && write)
1216 return KVM_HVA_ERR_RO_BAD;
1217
1218 if (nr_pages)
1219 *nr_pages = slot->npages - (gfn - slot->base_gfn);
1220
1221 return __gfn_to_hva_memslot(slot, gfn);
1222}
1223
1224static unsigned long gfn_to_hva_many(struct kvm_memory_slot *slot, gfn_t gfn,
1225 gfn_t *nr_pages)
1226{
1227 return __gfn_to_hva_many(slot, gfn, nr_pages, true);
1228}
1229
1230unsigned long gfn_to_hva_memslot(struct kvm_memory_slot *slot,
1231 gfn_t gfn)
1232{
1233 return gfn_to_hva_many(slot, gfn, NULL);
1234}
1235EXPORT_SYMBOL_GPL(gfn_to_hva_memslot);
1236
1237unsigned long gfn_to_hva(struct kvm *kvm, gfn_t gfn)
1238{
1239 return gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL);
1240}
1241EXPORT_SYMBOL_GPL(gfn_to_hva);
1242
1243unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn)
1244{
1245 return gfn_to_hva_many(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn, NULL);
1246}
1247EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_hva);
1248
1249/*
1250 * If writable is set to false, the hva returned by this function is only
1251 * allowed to be read.
1252 */
1253unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
1254 gfn_t gfn, bool *writable)
1255{
1256 unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);
1257
1258 if (!kvm_is_error_hva(hva) && writable)
1259 *writable = !memslot_is_readonly(slot);
1260
1261 return hva;
1262}
1263
1264unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
1265{
1266 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1267
1268 return gfn_to_hva_memslot_prot(slot, gfn, writable);
1269}
1270
1271unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable)
1272{
1273 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1274
1275 return gfn_to_hva_memslot_prot(slot, gfn, writable);
1276}
1277
1278static int get_user_page_nowait(unsigned long start, int write,
1279 struct page **page)
1280{
1281 int flags = FOLL_TOUCH | FOLL_NOWAIT | FOLL_HWPOISON | FOLL_GET;
1282
1283 if (write)
1284 flags |= FOLL_WRITE;
1285
1286 return __get_user_pages(current, current->mm, start, 1, flags, page,
1287 NULL, NULL);
1288}
1289
1290static inline int check_user_page_hwpoison(unsigned long addr)
1291{
1292 int rc, flags = FOLL_TOUCH | FOLL_HWPOISON | FOLL_WRITE;
1293
1294 rc = __get_user_pages(current, current->mm, addr, 1,
1295 flags, NULL, NULL, NULL);
1296 return rc == -EHWPOISON;
1297}
1298
1299/*
1300 * The atomic path to get the writable pfn which will be stored in @pfn,
1301 * true indicates success, otherwise false is returned.
1302 */
1303static bool hva_to_pfn_fast(unsigned long addr, bool atomic, bool *async,
1304 bool write_fault, bool *writable, kvm_pfn_t *pfn)
1305{
1306 struct page *page[1];
1307 int npages;
1308
1309 if (!(async || atomic))
1310 return false;
1311
1312 /*
1313 * Fast pin a writable pfn only if it is a write fault request
1314 * or the caller allows to map a writable pfn for a read fault
1315 * request.
1316 */
1317 if (!(write_fault || writable))
1318 return false;
1319
1320 npages = __get_user_pages_fast(addr, 1, 1, page);
1321 if (npages == 1) {
1322 *pfn = page_to_pfn(page[0]);
1323
1324 if (writable)
1325 *writable = true;
1326 return true;
1327 }
1328
1329 return false;
1330}
1331
1332/*
1333 * The slow path to get the pfn of the specified host virtual address,
1334 * 1 indicates success, -errno is returned if error is detected.
1335 */
1336static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault,
1337 bool *writable, kvm_pfn_t *pfn)
1338{
1339 struct page *page[1];
1340 int npages = 0;
1341
1342 might_sleep();
1343
1344 if (writable)
1345 *writable = write_fault;
1346
1347 if (async) {
1348 down_read(¤t->mm->mmap_sem);
1349 npages = get_user_page_nowait(addr, write_fault, page);
1350 up_read(¤t->mm->mmap_sem);
1351 } else
1352 npages = __get_user_pages_unlocked(current, current->mm, addr, 1,
1353 write_fault, 0, page,
1354 FOLL_TOUCH|FOLL_HWPOISON);
1355 if (npages != 1)
1356 return npages;
1357
1358 /* map read fault as writable if possible */
1359 if (unlikely(!write_fault) && writable) {
1360 struct page *wpage[1];
1361
1362 npages = __get_user_pages_fast(addr, 1, 1, wpage);
1363 if (npages == 1) {
1364 *writable = true;
1365 put_page(page[0]);
1366 page[0] = wpage[0];
1367 }
1368
1369 npages = 1;
1370 }
1371 *pfn = page_to_pfn(page[0]);
1372 return npages;
1373}
1374
1375static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
1376{
1377 if (unlikely(!(vma->vm_flags & VM_READ)))
1378 return false;
1379
1380 if (write_fault && (unlikely(!(vma->vm_flags & VM_WRITE))))
1381 return false;
1382
1383 return true;
1384}
1385
1386/*
1387 * Pin guest page in memory and return its pfn.
1388 * @addr: host virtual address which maps memory to the guest
1389 * @atomic: whether this function can sleep
1390 * @async: whether this function need to wait IO complete if the
1391 * host page is not in the memory
1392 * @write_fault: whether we should get a writable host page
1393 * @writable: whether it allows to map a writable host page for !@write_fault
1394 *
1395 * The function will map a writable host page for these two cases:
1396 * 1): @write_fault = true
1397 * 2): @write_fault = false && @writable, @writable will tell the caller
1398 * whether the mapping is writable.
1399 */
1400static kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async,
1401 bool write_fault, bool *writable)
1402{
1403 struct vm_area_struct *vma;
1404 kvm_pfn_t pfn = 0;
1405 int npages;
1406
1407 /* we can do it either atomically or asynchronously, not both */
1408 BUG_ON(atomic && async);
1409
1410 if (hva_to_pfn_fast(addr, atomic, async, write_fault, writable, &pfn))
1411 return pfn;
1412
1413 if (atomic)
1414 return KVM_PFN_ERR_FAULT;
1415
1416 npages = hva_to_pfn_slow(addr, async, write_fault, writable, &pfn);
1417 if (npages == 1)
1418 return pfn;
1419
1420 down_read(¤t->mm->mmap_sem);
1421 if (npages == -EHWPOISON ||
1422 (!async && check_user_page_hwpoison(addr))) {
1423 pfn = KVM_PFN_ERR_HWPOISON;
1424 goto exit;
1425 }
1426
1427 vma = find_vma_intersection(current->mm, addr, addr + 1);
1428
1429 if (vma == NULL)
1430 pfn = KVM_PFN_ERR_FAULT;
1431 else if ((vma->vm_flags & VM_PFNMAP)) {
1432 pfn = ((addr - vma->vm_start) >> PAGE_SHIFT) +
1433 vma->vm_pgoff;
1434 BUG_ON(!kvm_is_reserved_pfn(pfn));
1435 } else {
1436 if (async && vma_is_valid(vma, write_fault))
1437 *async = true;
1438 pfn = KVM_PFN_ERR_FAULT;
1439 }
1440exit:
1441 up_read(¤t->mm->mmap_sem);
1442 return pfn;
1443}
1444
1445kvm_pfn_t __gfn_to_pfn_memslot(struct kvm_memory_slot *slot, gfn_t gfn,
1446 bool atomic, bool *async, bool write_fault,
1447 bool *writable)
1448{
1449 unsigned long addr = __gfn_to_hva_many(slot, gfn, NULL, write_fault);
1450
1451 if (addr == KVM_HVA_ERR_RO_BAD) {
1452 if (writable)
1453 *writable = false;
1454 return KVM_PFN_ERR_RO_FAULT;
1455 }
1456
1457 if (kvm_is_error_hva(addr)) {
1458 if (writable)
1459 *writable = false;
1460 return KVM_PFN_NOSLOT;
1461 }
1462
1463 /* Do not map writable pfn in the readonly memslot. */
1464 if (writable && memslot_is_readonly(slot)) {
1465 *writable = false;
1466 writable = NULL;
1467 }
1468
1469 return hva_to_pfn(addr, atomic, async, write_fault,
1470 writable);
1471}
1472EXPORT_SYMBOL_GPL(__gfn_to_pfn_memslot);
1473
1474kvm_pfn_t gfn_to_pfn_prot(struct kvm *kvm, gfn_t gfn, bool write_fault,
1475 bool *writable)
1476{
1477 return __gfn_to_pfn_memslot(gfn_to_memslot(kvm, gfn), gfn, false, NULL,
1478 write_fault, writable);
1479}
1480EXPORT_SYMBOL_GPL(gfn_to_pfn_prot);
1481
1482kvm_pfn_t gfn_to_pfn_memslot(struct kvm_memory_slot *slot, gfn_t gfn)
1483{
1484 return __gfn_to_pfn_memslot(slot, gfn, false, NULL, true, NULL);
1485}
1486EXPORT_SYMBOL_GPL(gfn_to_pfn_memslot);
1487
1488kvm_pfn_t gfn_to_pfn_memslot_atomic(struct kvm_memory_slot *slot, gfn_t gfn)
1489{
1490 return __gfn_to_pfn_memslot(slot, gfn, true, NULL, true, NULL);
1491}
1492EXPORT_SYMBOL_GPL(gfn_to_pfn_memslot_atomic);
1493
1494kvm_pfn_t gfn_to_pfn_atomic(struct kvm *kvm, gfn_t gfn)
1495{
1496 return gfn_to_pfn_memslot_atomic(gfn_to_memslot(kvm, gfn), gfn);
1497}
1498EXPORT_SYMBOL_GPL(gfn_to_pfn_atomic);
1499
1500kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn)
1501{
1502 return gfn_to_pfn_memslot_atomic(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn);
1503}
1504EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_pfn_atomic);
1505
1506kvm_pfn_t gfn_to_pfn(struct kvm *kvm, gfn_t gfn)
1507{
1508 return gfn_to_pfn_memslot(gfn_to_memslot(kvm, gfn), gfn);
1509}
1510EXPORT_SYMBOL_GPL(gfn_to_pfn);
1511
1512kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn)
1513{
1514 return gfn_to_pfn_memslot(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn);
1515}
1516EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_pfn);
1517
1518int gfn_to_page_many_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
1519 struct page **pages, int nr_pages)
1520{
1521 unsigned long addr;
1522 gfn_t entry;
1523
1524 addr = gfn_to_hva_many(slot, gfn, &entry);
1525 if (kvm_is_error_hva(addr))
1526 return -1;
1527
1528 if (entry < nr_pages)
1529 return 0;
1530
1531 return __get_user_pages_fast(addr, nr_pages, 1, pages);
1532}
1533EXPORT_SYMBOL_GPL(gfn_to_page_many_atomic);
1534
1535static struct page *kvm_pfn_to_page(kvm_pfn_t pfn)
1536{
1537 if (is_error_noslot_pfn(pfn))
1538 return KVM_ERR_PTR_BAD_PAGE;
1539
1540 if (kvm_is_reserved_pfn(pfn)) {
1541 WARN_ON(1);
1542 return KVM_ERR_PTR_BAD_PAGE;
1543 }
1544
1545 return pfn_to_page(pfn);
1546}
1547
1548struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
1549{
1550 kvm_pfn_t pfn;
1551
1552 pfn = gfn_to_pfn(kvm, gfn);
1553
1554 return kvm_pfn_to_page(pfn);
1555}
1556EXPORT_SYMBOL_GPL(gfn_to_page);
1557
1558struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn)
1559{
1560 kvm_pfn_t pfn;
1561
1562 pfn = kvm_vcpu_gfn_to_pfn(vcpu, gfn);
1563
1564 return kvm_pfn_to_page(pfn);
1565}
1566EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_page);
1567
1568void kvm_release_page_clean(struct page *page)
1569{
1570 WARN_ON(is_error_page(page));
1571
1572 kvm_release_pfn_clean(page_to_pfn(page));
1573}
1574EXPORT_SYMBOL_GPL(kvm_release_page_clean);
1575
1576void kvm_release_pfn_clean(kvm_pfn_t pfn)
1577{
1578 if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn))
1579 put_page(pfn_to_page(pfn));
1580}
1581EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);
1582
1583void kvm_release_page_dirty(struct page *page)
1584{
1585 WARN_ON(is_error_page(page));
1586
1587 kvm_release_pfn_dirty(page_to_pfn(page));
1588}
1589EXPORT_SYMBOL_GPL(kvm_release_page_dirty);
1590
1591static void kvm_release_pfn_dirty(kvm_pfn_t pfn)
1592{
1593 kvm_set_pfn_dirty(pfn);
1594 kvm_release_pfn_clean(pfn);
1595}
1596
1597void kvm_set_pfn_dirty(kvm_pfn_t pfn)
1598{
1599 if (!kvm_is_reserved_pfn(pfn)) {
1600 struct page *page = pfn_to_page(pfn);
1601
1602 if (!PageReserved(page))
1603 SetPageDirty(page);
1604 }
1605}
1606EXPORT_SYMBOL_GPL(kvm_set_pfn_dirty);
1607
1608void kvm_set_pfn_accessed(kvm_pfn_t pfn)
1609{
1610 if (!kvm_is_reserved_pfn(pfn))
1611 mark_page_accessed(pfn_to_page(pfn));
1612}
1613EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);
1614
1615void kvm_get_pfn(kvm_pfn_t pfn)
1616{
1617 if (!kvm_is_reserved_pfn(pfn))
1618 get_page(pfn_to_page(pfn));
1619}
1620EXPORT_SYMBOL_GPL(kvm_get_pfn);
1621
1622static int next_segment(unsigned long len, int offset)
1623{
1624 if (len > PAGE_SIZE - offset)
1625 return PAGE_SIZE - offset;
1626 else
1627 return len;
1628}
1629
1630static int __kvm_read_guest_page(struct kvm_memory_slot *slot, gfn_t gfn,
1631 void *data, int offset, int len)
1632{
1633 int r;
1634 unsigned long addr;
1635
1636 addr = gfn_to_hva_memslot_prot(slot, gfn, NULL);
1637 if (kvm_is_error_hva(addr))
1638 return -EFAULT;
1639 r = __copy_from_user(data, (void __user *)addr + offset, len);
1640 if (r)
1641 return -EFAULT;
1642 return 0;
1643}
1644
1645int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
1646 int len)
1647{
1648 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1649
1650 return __kvm_read_guest_page(slot, gfn, data, offset, len);
1651}
1652EXPORT_SYMBOL_GPL(kvm_read_guest_page);
1653
1654int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data,
1655 int offset, int len)
1656{
1657 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1658
1659 return __kvm_read_guest_page(slot, gfn, data, offset, len);
1660}
1661EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest_page);
1662
1663int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len)
1664{
1665 gfn_t gfn = gpa >> PAGE_SHIFT;
1666 int seg;
1667 int offset = offset_in_page(gpa);
1668 int ret;
1669
1670 while ((seg = next_segment(len, offset)) != 0) {
1671 ret = kvm_read_guest_page(kvm, gfn, data, offset, seg);
1672 if (ret < 0)
1673 return ret;
1674 offset = 0;
1675 len -= seg;
1676 data += seg;
1677 ++gfn;
1678 }
1679 return 0;
1680}
1681EXPORT_SYMBOL_GPL(kvm_read_guest);
1682
1683int kvm_vcpu_read_guest(struct kvm_vcpu *vcpu, gpa_t gpa, void *data, unsigned long len)
1684{
1685 gfn_t gfn = gpa >> PAGE_SHIFT;
1686 int seg;
1687 int offset = offset_in_page(gpa);
1688 int ret;
1689
1690 while ((seg = next_segment(len, offset)) != 0) {
1691 ret = kvm_vcpu_read_guest_page(vcpu, gfn, data, offset, seg);
1692 if (ret < 0)
1693 return ret;
1694 offset = 0;
1695 len -= seg;
1696 data += seg;
1697 ++gfn;
1698 }
1699 return 0;
1700}
1701EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest);
1702
1703static int __kvm_read_guest_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
1704 void *data, int offset, unsigned long len)
1705{
1706 int r;
1707 unsigned long addr;
1708
1709 addr = gfn_to_hva_memslot_prot(slot, gfn, NULL);
1710 if (kvm_is_error_hva(addr))
1711 return -EFAULT;
1712 pagefault_disable();
1713 r = __copy_from_user_inatomic(data, (void __user *)addr + offset, len);
1714 pagefault_enable();
1715 if (r)
1716 return -EFAULT;
1717 return 0;
1718}
1719
1720int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
1721 unsigned long len)
1722{
1723 gfn_t gfn = gpa >> PAGE_SHIFT;
1724 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1725 int offset = offset_in_page(gpa);
1726
1727 return __kvm_read_guest_atomic(slot, gfn, data, offset, len);
1728}
1729EXPORT_SYMBOL_GPL(kvm_read_guest_atomic);
1730
1731int kvm_vcpu_read_guest_atomic(struct kvm_vcpu *vcpu, gpa_t gpa,
1732 void *data, unsigned long len)
1733{
1734 gfn_t gfn = gpa >> PAGE_SHIFT;
1735 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1736 int offset = offset_in_page(gpa);
1737
1738 return __kvm_read_guest_atomic(slot, gfn, data, offset, len);
1739}
1740EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest_atomic);
1741
1742static int __kvm_write_guest_page(struct kvm_memory_slot *memslot, gfn_t gfn,
1743 const void *data, int offset, int len)
1744{
1745 int r;
1746 unsigned long addr;
1747
1748 addr = gfn_to_hva_memslot(memslot, gfn);
1749 if (kvm_is_error_hva(addr))
1750 return -EFAULT;
1751 r = __copy_to_user((void __user *)addr + offset, data, len);
1752 if (r)
1753 return -EFAULT;
1754 mark_page_dirty_in_slot(memslot, gfn);
1755 return 0;
1756}
1757
1758int kvm_write_guest_page(struct kvm *kvm, gfn_t gfn,
1759 const void *data, int offset, int len)
1760{
1761 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1762
1763 return __kvm_write_guest_page(slot, gfn, data, offset, len);
1764}
1765EXPORT_SYMBOL_GPL(kvm_write_guest_page);
1766
1767int kvm_vcpu_write_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn,
1768 const void *data, int offset, int len)
1769{
1770 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1771
1772 return __kvm_write_guest_page(slot, gfn, data, offset, len);
1773}
1774EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest_page);
1775
1776int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
1777 unsigned long len)
1778{
1779 gfn_t gfn = gpa >> PAGE_SHIFT;
1780 int seg;
1781 int offset = offset_in_page(gpa);
1782 int ret;
1783
1784 while ((seg = next_segment(len, offset)) != 0) {
1785 ret = kvm_write_guest_page(kvm, gfn, data, offset, seg);
1786 if (ret < 0)
1787 return ret;
1788 offset = 0;
1789 len -= seg;
1790 data += seg;
1791 ++gfn;
1792 }
1793 return 0;
1794}
1795EXPORT_SYMBOL_GPL(kvm_write_guest);
1796
1797int kvm_vcpu_write_guest(struct kvm_vcpu *vcpu, gpa_t gpa, const void *data,
1798 unsigned long len)
1799{
1800 gfn_t gfn = gpa >> PAGE_SHIFT;
1801 int seg;
1802 int offset = offset_in_page(gpa);
1803 int ret;
1804
1805 while ((seg = next_segment(len, offset)) != 0) {
1806 ret = kvm_vcpu_write_guest_page(vcpu, gfn, data, offset, seg);
1807 if (ret < 0)
1808 return ret;
1809 offset = 0;
1810 len -= seg;
1811 data += seg;
1812 ++gfn;
1813 }
1814 return 0;
1815}
1816EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest);
1817
1818int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1819 gpa_t gpa, unsigned long len)
1820{
1821 struct kvm_memslots *slots = kvm_memslots(kvm);
1822 int offset = offset_in_page(gpa);
1823 gfn_t start_gfn = gpa >> PAGE_SHIFT;
1824 gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
1825 gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
1826 gfn_t nr_pages_avail;
1827
1828 ghc->gpa = gpa;
1829 ghc->generation = slots->generation;
1830 ghc->len = len;
1831 ghc->memslot = gfn_to_memslot(kvm, start_gfn);
1832 ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL);
1833 if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) {
1834 ghc->hva += offset;
1835 } else {
1836 /*
1837 * If the requested region crosses two memslots, we still
1838 * verify that the entire region is valid here.
1839 */
1840 while (start_gfn <= end_gfn) {
1841 ghc->memslot = gfn_to_memslot(kvm, start_gfn);
1842 ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
1843 &nr_pages_avail);
1844 if (kvm_is_error_hva(ghc->hva))
1845 return -EFAULT;
1846 start_gfn += nr_pages_avail;
1847 }
1848 /* Use the slow path for cross page reads and writes. */
1849 ghc->memslot = NULL;
1850 }
1851 return 0;
1852}
1853EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
1854
1855int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1856 void *data, unsigned long len)
1857{
1858 struct kvm_memslots *slots = kvm_memslots(kvm);
1859 int r;
1860
1861 BUG_ON(len > ghc->len);
1862
1863 if (slots->generation != ghc->generation)
1864 kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
1865
1866 if (unlikely(!ghc->memslot))
1867 return kvm_write_guest(kvm, ghc->gpa, data, len);
1868
1869 if (kvm_is_error_hva(ghc->hva))
1870 return -EFAULT;
1871
1872 r = __copy_to_user((void __user *)ghc->hva, data, len);
1873 if (r)
1874 return -EFAULT;
1875 mark_page_dirty_in_slot(ghc->memslot, ghc->gpa >> PAGE_SHIFT);
1876
1877 return 0;
1878}
1879EXPORT_SYMBOL_GPL(kvm_write_guest_cached);
1880
1881int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1882 void *data, unsigned long len)
1883{
1884 struct kvm_memslots *slots = kvm_memslots(kvm);
1885 int r;
1886
1887 BUG_ON(len > ghc->len);
1888
1889 if (slots->generation != ghc->generation)
1890 kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
1891
1892 if (unlikely(!ghc->memslot))
1893 return kvm_read_guest(kvm, ghc->gpa, data, len);
1894
1895 if (kvm_is_error_hva(ghc->hva))
1896 return -EFAULT;
1897
1898 r = __copy_from_user(data, (void __user *)ghc->hva, len);
1899 if (r)
1900 return -EFAULT;
1901
1902 return 0;
1903}
1904EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
1905
1906int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
1907{
1908 const void *zero_page = (const void *) __va(page_to_phys(ZERO_PAGE(0)));
1909
1910 return kvm_write_guest_page(kvm, gfn, zero_page, offset, len);
1911}
1912EXPORT_SYMBOL_GPL(kvm_clear_guest_page);
1913
1914int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len)
1915{
1916 gfn_t gfn = gpa >> PAGE_SHIFT;
1917 int seg;
1918 int offset = offset_in_page(gpa);
1919 int ret;
1920
1921 while ((seg = next_segment(len, offset)) != 0) {
1922 ret = kvm_clear_guest_page(kvm, gfn, offset, seg);
1923 if (ret < 0)
1924 return ret;
1925 offset = 0;
1926 len -= seg;
1927 ++gfn;
1928 }
1929 return 0;
1930}
1931EXPORT_SYMBOL_GPL(kvm_clear_guest);
1932
1933static void mark_page_dirty_in_slot(struct kvm_memory_slot *memslot,
1934 gfn_t gfn)
1935{
1936 if (memslot && memslot->dirty_bitmap) {
1937 unsigned long rel_gfn = gfn - memslot->base_gfn;
1938
1939 set_bit_le(rel_gfn, memslot->dirty_bitmap);
1940 }
1941}
1942
1943void mark_page_dirty(struct kvm *kvm, gfn_t gfn)
1944{
1945 struct kvm_memory_slot *memslot;
1946
1947 memslot = gfn_to_memslot(kvm, gfn);
1948 mark_page_dirty_in_slot(memslot, gfn);
1949}
1950EXPORT_SYMBOL_GPL(mark_page_dirty);
1951
1952void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu, gfn_t gfn)
1953{
1954 struct kvm_memory_slot *memslot;
1955
1956 memslot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1957 mark_page_dirty_in_slot(memslot, gfn);
1958}
1959EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty);
1960
1961static void grow_halt_poll_ns(struct kvm_vcpu *vcpu)
1962{
1963 unsigned int old, val, grow;
1964
1965 old = val = vcpu->halt_poll_ns;
1966 grow = READ_ONCE(halt_poll_ns_grow);
1967 /* 10us base */
1968 if (val == 0 && grow)
1969 val = 10000;
1970 else
1971 val *= grow;
1972
1973 if (val > halt_poll_ns)
1974 val = halt_poll_ns;
1975
1976 vcpu->halt_poll_ns = val;
1977 trace_kvm_halt_poll_ns_grow(vcpu->vcpu_id, val, old);
1978}
1979
1980static void shrink_halt_poll_ns(struct kvm_vcpu *vcpu)
1981{
1982 unsigned int old, val, shrink;
1983
1984 old = val = vcpu->halt_poll_ns;
1985 shrink = READ_ONCE(halt_poll_ns_shrink);
1986 if (shrink == 0)
1987 val = 0;
1988 else
1989 val /= shrink;
1990
1991 vcpu->halt_poll_ns = val;
1992 trace_kvm_halt_poll_ns_shrink(vcpu->vcpu_id, val, old);
1993}
1994
1995static int kvm_vcpu_check_block(struct kvm_vcpu *vcpu)
1996{
1997 if (kvm_arch_vcpu_runnable(vcpu)) {
1998 kvm_make_request(KVM_REQ_UNHALT, vcpu);
1999 return -EINTR;
2000 }
2001 if (kvm_cpu_has_pending_timer(vcpu))
2002 return -EINTR;
2003 if (signal_pending(current))
2004 return -EINTR;
2005
2006 return 0;
2007}
2008
2009/*
2010 * The vCPU has executed a HLT instruction with in-kernel mode enabled.
2011 */
2012void kvm_vcpu_block(struct kvm_vcpu *vcpu)
2013{
2014 ktime_t start, cur;
2015 DECLARE_SWAITQUEUE(wait);
2016 bool waited = false;
2017 u64 block_ns;
2018
2019 start = cur = ktime_get();
2020 if (vcpu->halt_poll_ns) {
2021 ktime_t stop = ktime_add_ns(ktime_get(), vcpu->halt_poll_ns);
2022
2023 ++vcpu->stat.halt_attempted_poll;
2024 do {
2025 /*
2026 * This sets KVM_REQ_UNHALT if an interrupt
2027 * arrives.
2028 */
2029 if (kvm_vcpu_check_block(vcpu) < 0) {
2030 ++vcpu->stat.halt_successful_poll;
2031 goto out;
2032 }
2033 cur = ktime_get();
2034 } while (single_task_running() && ktime_before(cur, stop));
2035 }
2036
2037 kvm_arch_vcpu_blocking(vcpu);
2038
2039 for (;;) {
2040 prepare_to_swait(&vcpu->wq, &wait, TASK_INTERRUPTIBLE);
2041
2042 if (kvm_vcpu_check_block(vcpu) < 0)
2043 break;
2044
2045 waited = true;
2046 schedule();
2047 }
2048
2049 finish_swait(&vcpu->wq, &wait);
2050 cur = ktime_get();
2051
2052 kvm_arch_vcpu_unblocking(vcpu);
2053out:
2054 block_ns = ktime_to_ns(cur) - ktime_to_ns(start);
2055
2056 if (halt_poll_ns) {
2057 if (block_ns <= vcpu->halt_poll_ns)
2058 ;
2059 /* we had a long block, shrink polling */
2060 else if (vcpu->halt_poll_ns && block_ns > halt_poll_ns)
2061 shrink_halt_poll_ns(vcpu);
2062 /* we had a short halt and our poll time is too small */
2063 else if (vcpu->halt_poll_ns < halt_poll_ns &&
2064 block_ns < halt_poll_ns)
2065 grow_halt_poll_ns(vcpu);
2066 } else
2067 vcpu->halt_poll_ns = 0;
2068
2069 trace_kvm_vcpu_wakeup(block_ns, waited);
2070}
2071EXPORT_SYMBOL_GPL(kvm_vcpu_block);
2072
2073#ifndef CONFIG_S390
2074/*
2075 * Kick a sleeping VCPU, or a guest VCPU in guest mode, into host kernel mode.
2076 */
2077void kvm_vcpu_kick(struct kvm_vcpu *vcpu)
2078{
2079 int me;
2080 int cpu = vcpu->cpu;
2081 struct swait_queue_head *wqp;
2082
2083 wqp = kvm_arch_vcpu_wq(vcpu);
2084 if (swait_active(wqp)) {
2085 swake_up(wqp);
2086 ++vcpu->stat.halt_wakeup;
2087 }
2088
2089 me = get_cpu();
2090 if (cpu != me && (unsigned)cpu < nr_cpu_ids && cpu_online(cpu))
2091 if (kvm_arch_vcpu_should_kick(vcpu))
2092 smp_send_reschedule(cpu);
2093 put_cpu();
2094}
2095EXPORT_SYMBOL_GPL(kvm_vcpu_kick);
2096#endif /* !CONFIG_S390 */
2097
2098int kvm_vcpu_yield_to(struct kvm_vcpu *target)
2099{
2100 struct pid *pid;
2101 struct task_struct *task = NULL;
2102 int ret = 0;
2103
2104 rcu_read_lock();
2105 pid = rcu_dereference(target->pid);
2106 if (pid)
2107 task = get_pid_task(pid, PIDTYPE_PID);
2108 rcu_read_unlock();
2109 if (!task)
2110 return ret;
2111 ret = yield_to(task, 1);
2112 put_task_struct(task);
2113
2114 return ret;
2115}
2116EXPORT_SYMBOL_GPL(kvm_vcpu_yield_to);
2117
2118/*
2119 * Helper that checks whether a VCPU is eligible for directed yield.
2120 * Most eligible candidate to yield is decided by following heuristics:
2121 *
2122 * (a) VCPU which has not done pl-exit or cpu relax intercepted recently
2123 * (preempted lock holder), indicated by @in_spin_loop.
2124 * Set at the beiginning and cleared at the end of interception/PLE handler.
2125 *
2126 * (b) VCPU which has done pl-exit/ cpu relax intercepted but did not get
2127 * chance last time (mostly it has become eligible now since we have probably
2128 * yielded to lockholder in last iteration. This is done by toggling
2129 * @dy_eligible each time a VCPU checked for eligibility.)
2130 *
2131 * Yielding to a recently pl-exited/cpu relax intercepted VCPU before yielding
2132 * to preempted lock-holder could result in wrong VCPU selection and CPU
2133 * burning. Giving priority for a potential lock-holder increases lock
2134 * progress.
2135 *
2136 * Since algorithm is based on heuristics, accessing another VCPU data without
2137 * locking does not harm. It may result in trying to yield to same VCPU, fail
2138 * and continue with next VCPU and so on.
2139 */
2140static bool kvm_vcpu_eligible_for_directed_yield(struct kvm_vcpu *vcpu)
2141{
2142#ifdef CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT
2143 bool eligible;
2144
2145 eligible = !vcpu->spin_loop.in_spin_loop ||
2146 vcpu->spin_loop.dy_eligible;
2147
2148 if (vcpu->spin_loop.in_spin_loop)
2149 kvm_vcpu_set_dy_eligible(vcpu, !vcpu->spin_loop.dy_eligible);
2150
2151 return eligible;
2152#else
2153 return true;
2154#endif
2155}
2156
2157void kvm_vcpu_on_spin(struct kvm_vcpu *me)
2158{
2159 struct kvm *kvm = me->kvm;
2160 struct kvm_vcpu *vcpu;
2161 int last_boosted_vcpu = me->kvm->last_boosted_vcpu;
2162 int yielded = 0;
2163 int try = 3;
2164 int pass;
2165 int i;
2166
2167 kvm_vcpu_set_in_spin_loop(me, true);
2168 /*
2169 * We boost the priority of a VCPU that is runnable but not
2170 * currently running, because it got preempted by something
2171 * else and called schedule in __vcpu_run. Hopefully that
2172 * VCPU is holding the lock that we need and will release it.
2173 * We approximate round-robin by starting at the last boosted VCPU.
2174 */
2175 for (pass = 0; pass < 2 && !yielded && try; pass++) {
2176 kvm_for_each_vcpu(i, vcpu, kvm) {
2177 if (!pass && i <= last_boosted_vcpu) {
2178 i = last_boosted_vcpu;
2179 continue;
2180 } else if (pass && i > last_boosted_vcpu)
2181 break;
2182 if (!ACCESS_ONCE(vcpu->preempted))
2183 continue;
2184 if (vcpu == me)
2185 continue;
2186 if (swait_active(&vcpu->wq) && !kvm_arch_vcpu_runnable(vcpu))
2187 continue;
2188 if (!kvm_vcpu_eligible_for_directed_yield(vcpu))
2189 continue;
2190
2191 yielded = kvm_vcpu_yield_to(vcpu);
2192 if (yielded > 0) {
2193 kvm->last_boosted_vcpu = i;
2194 break;
2195 } else if (yielded < 0) {
2196 try--;
2197 if (!try)
2198 break;
2199 }
2200 }
2201 }
2202 kvm_vcpu_set_in_spin_loop(me, false);
2203
2204 /* Ensure vcpu is not eligible during next spinloop */
2205 kvm_vcpu_set_dy_eligible(me, false);
2206}
2207EXPORT_SYMBOL_GPL(kvm_vcpu_on_spin);
2208
2209static int kvm_vcpu_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
2210{
2211 struct kvm_vcpu *vcpu = vma->vm_file->private_data;
2212 struct page *page;
2213
2214 if (vmf->pgoff == 0)
2215 page = virt_to_page(vcpu->run);
2216#ifdef CONFIG_X86
2217 else if (vmf->pgoff == KVM_PIO_PAGE_OFFSET)
2218 page = virt_to_page(vcpu->arch.pio_data);
2219#endif
2220#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2221 else if (vmf->pgoff == KVM_COALESCED_MMIO_PAGE_OFFSET)
2222 page = virt_to_page(vcpu->kvm->coalesced_mmio_ring);
2223#endif
2224 else
2225 return kvm_arch_vcpu_fault(vcpu, vmf);
2226 get_page(page);
2227 vmf->page = page;
2228 return 0;
2229}
2230
2231static const struct vm_operations_struct kvm_vcpu_vm_ops = {
2232 .fault = kvm_vcpu_fault,
2233};
2234
2235static int kvm_vcpu_mmap(struct file *file, struct vm_area_struct *vma)
2236{
2237 vma->vm_ops = &kvm_vcpu_vm_ops;
2238 return 0;
2239}
2240
2241static int kvm_vcpu_release(struct inode *inode, struct file *filp)
2242{
2243 struct kvm_vcpu *vcpu = filp->private_data;
2244
2245 kvm_put_kvm(vcpu->kvm);
2246 return 0;
2247}
2248
2249static struct file_operations kvm_vcpu_fops = {
2250 .release = kvm_vcpu_release,
2251 .unlocked_ioctl = kvm_vcpu_ioctl,
2252#ifdef CONFIG_KVM_COMPAT
2253 .compat_ioctl = kvm_vcpu_compat_ioctl,
2254#endif
2255 .mmap = kvm_vcpu_mmap,
2256 .llseek = noop_llseek,
2257};
2258
2259/*
2260 * Allocates an inode for the vcpu.
2261 */
2262static int create_vcpu_fd(struct kvm_vcpu *vcpu)
2263{
2264 return anon_inode_getfd("kvm-vcpu", &kvm_vcpu_fops, vcpu, O_RDWR | O_CLOEXEC);
2265}
2266
2267/*
2268 * Creates some virtual cpus. Good luck creating more than one.
2269 */
2270static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
2271{
2272 int r;
2273 struct kvm_vcpu *vcpu;
2274
2275 if (id >= KVM_MAX_VCPUS)
2276 return -EINVAL;
2277
2278 vcpu = kvm_arch_vcpu_create(kvm, id);
2279 if (IS_ERR(vcpu))
2280 return PTR_ERR(vcpu);
2281
2282 preempt_notifier_init(&vcpu->preempt_notifier, &kvm_preempt_ops);
2283
2284 r = kvm_arch_vcpu_setup(vcpu);
2285 if (r)
2286 goto vcpu_destroy;
2287
2288 mutex_lock(&kvm->lock);
2289 if (!kvm_vcpu_compatible(vcpu)) {
2290 r = -EINVAL;
2291 goto unlock_vcpu_destroy;
2292 }
2293 if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
2294 r = -EINVAL;
2295 goto unlock_vcpu_destroy;
2296 }
2297 if (kvm_get_vcpu_by_id(kvm, id)) {
2298 r = -EEXIST;
2299 goto unlock_vcpu_destroy;
2300 }
2301
2302 BUG_ON(kvm->vcpus[atomic_read(&kvm->online_vcpus)]);
2303
2304 /* Now it's all set up, let userspace reach it */
2305 kvm_get_kvm(kvm);
2306 r = create_vcpu_fd(vcpu);
2307 if (r < 0) {
2308 kvm_put_kvm(kvm);
2309 goto unlock_vcpu_destroy;
2310 }
2311
2312 kvm->vcpus[atomic_read(&kvm->online_vcpus)] = vcpu;
2313
2314 /*
2315 * Pairs with smp_rmb() in kvm_get_vcpu. Write kvm->vcpus
2316 * before kvm->online_vcpu's incremented value.
2317 */
2318 smp_wmb();
2319 atomic_inc(&kvm->online_vcpus);
2320
2321 mutex_unlock(&kvm->lock);
2322 kvm_arch_vcpu_postcreate(vcpu);
2323 return r;
2324
2325unlock_vcpu_destroy:
2326 mutex_unlock(&kvm->lock);
2327vcpu_destroy:
2328 kvm_arch_vcpu_destroy(vcpu);
2329 return r;
2330}
2331
2332static int kvm_vcpu_ioctl_set_sigmask(struct kvm_vcpu *vcpu, sigset_t *sigset)
2333{
2334 if (sigset) {
2335 sigdelsetmask(sigset, sigmask(SIGKILL)|sigmask(SIGSTOP));
2336 vcpu->sigset_active = 1;
2337 vcpu->sigset = *sigset;
2338 } else
2339 vcpu->sigset_active = 0;
2340 return 0;
2341}
2342
2343static long kvm_vcpu_ioctl(struct file *filp,
2344 unsigned int ioctl, unsigned long arg)
2345{
2346 struct kvm_vcpu *vcpu = filp->private_data;
2347 void __user *argp = (void __user *)arg;
2348 int r;
2349 struct kvm_fpu *fpu = NULL;
2350 struct kvm_sregs *kvm_sregs = NULL;
2351
2352 if (vcpu->kvm->mm != current->mm)
2353 return -EIO;
2354
2355 if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
2356 return -EINVAL;
2357
2358#if defined(CONFIG_S390) || defined(CONFIG_PPC) || defined(CONFIG_MIPS)
2359 /*
2360 * Special cases: vcpu ioctls that are asynchronous to vcpu execution,
2361 * so vcpu_load() would break it.
2362 */
2363 if (ioctl == KVM_S390_INTERRUPT || ioctl == KVM_S390_IRQ || ioctl == KVM_INTERRUPT)
2364 return kvm_arch_vcpu_ioctl(filp, ioctl, arg);
2365#endif
2366
2367
2368 r = vcpu_load(vcpu);
2369 if (r)
2370 return r;
2371 switch (ioctl) {
2372 case KVM_RUN:
2373 r = -EINVAL;
2374 if (arg)
2375 goto out;
2376 if (unlikely(vcpu->pid != current->pids[PIDTYPE_PID].pid)) {
2377 /* The thread running this VCPU changed. */
2378 struct pid *oldpid = vcpu->pid;
2379 struct pid *newpid = get_task_pid(current, PIDTYPE_PID);
2380
2381 rcu_assign_pointer(vcpu->pid, newpid);
2382 if (oldpid)
2383 synchronize_rcu();
2384 put_pid(oldpid);
2385 }
2386 r = kvm_arch_vcpu_ioctl_run(vcpu, vcpu->run);
2387 trace_kvm_userspace_exit(vcpu->run->exit_reason, r);
2388 break;
2389 case KVM_GET_REGS: {
2390 struct kvm_regs *kvm_regs;
2391
2392 r = -ENOMEM;
2393 kvm_regs = kzalloc(sizeof(struct kvm_regs), GFP_KERNEL);
2394 if (!kvm_regs)
2395 goto out;
2396 r = kvm_arch_vcpu_ioctl_get_regs(vcpu, kvm_regs);
2397 if (r)
2398 goto out_free1;
2399 r = -EFAULT;
2400 if (copy_to_user(argp, kvm_regs, sizeof(struct kvm_regs)))
2401 goto out_free1;
2402 r = 0;
2403out_free1:
2404 kfree(kvm_regs);
2405 break;
2406 }
2407 case KVM_SET_REGS: {
2408 struct kvm_regs *kvm_regs;
2409
2410 r = -ENOMEM;
2411 kvm_regs = memdup_user(argp, sizeof(*kvm_regs));
2412 if (IS_ERR(kvm_regs)) {
2413 r = PTR_ERR(kvm_regs);
2414 goto out;
2415 }
2416 r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs);
2417 kfree(kvm_regs);
2418 break;
2419 }
2420 case KVM_GET_SREGS: {
2421 kvm_sregs = kzalloc(sizeof(struct kvm_sregs), GFP_KERNEL);
2422 r = -ENOMEM;
2423 if (!kvm_sregs)
2424 goto out;
2425 r = kvm_arch_vcpu_ioctl_get_sregs(vcpu, kvm_sregs);
2426 if (r)
2427 goto out;
2428 r = -EFAULT;
2429 if (copy_to_user(argp, kvm_sregs, sizeof(struct kvm_sregs)))
2430 goto out;
2431 r = 0;
2432 break;
2433 }
2434 case KVM_SET_SREGS: {
2435 kvm_sregs = memdup_user(argp, sizeof(*kvm_sregs));
2436 if (IS_ERR(kvm_sregs)) {
2437 r = PTR_ERR(kvm_sregs);
2438 kvm_sregs = NULL;
2439 goto out;
2440 }
2441 r = kvm_arch_vcpu_ioctl_set_sregs(vcpu, kvm_sregs);
2442 break;
2443 }
2444 case KVM_GET_MP_STATE: {
2445 struct kvm_mp_state mp_state;
2446
2447 r = kvm_arch_vcpu_ioctl_get_mpstate(vcpu, &mp_state);
2448 if (r)
2449 goto out;
2450 r = -EFAULT;
2451 if (copy_to_user(argp, &mp_state, sizeof(mp_state)))
2452 goto out;
2453 r = 0;
2454 break;
2455 }
2456 case KVM_SET_MP_STATE: {
2457 struct kvm_mp_state mp_state;
2458
2459 r = -EFAULT;
2460 if (copy_from_user(&mp_state, argp, sizeof(mp_state)))
2461 goto out;
2462 r = kvm_arch_vcpu_ioctl_set_mpstate(vcpu, &mp_state);
2463 break;
2464 }
2465 case KVM_TRANSLATE: {
2466 struct kvm_translation tr;
2467
2468 r = -EFAULT;
2469 if (copy_from_user(&tr, argp, sizeof(tr)))
2470 goto out;
2471 r = kvm_arch_vcpu_ioctl_translate(vcpu, &tr);
2472 if (r)
2473 goto out;
2474 r = -EFAULT;
2475 if (copy_to_user(argp, &tr, sizeof(tr)))
2476 goto out;
2477 r = 0;
2478 break;
2479 }
2480 case KVM_SET_GUEST_DEBUG: {
2481 struct kvm_guest_debug dbg;
2482
2483 r = -EFAULT;
2484 if (copy_from_user(&dbg, argp, sizeof(dbg)))
2485 goto out;
2486 r = kvm_arch_vcpu_ioctl_set_guest_debug(vcpu, &dbg);
2487 break;
2488 }
2489 case KVM_SET_SIGNAL_MASK: {
2490 struct kvm_signal_mask __user *sigmask_arg = argp;
2491 struct kvm_signal_mask kvm_sigmask;
2492 sigset_t sigset, *p;
2493
2494 p = NULL;
2495 if (argp) {
2496 r = -EFAULT;
2497 if (copy_from_user(&kvm_sigmask, argp,
2498 sizeof(kvm_sigmask)))
2499 goto out;
2500 r = -EINVAL;
2501 if (kvm_sigmask.len != sizeof(sigset))
2502 goto out;
2503 r = -EFAULT;
2504 if (copy_from_user(&sigset, sigmask_arg->sigset,
2505 sizeof(sigset)))
2506 goto out;
2507 p = &sigset;
2508 }
2509 r = kvm_vcpu_ioctl_set_sigmask(vcpu, p);
2510 break;
2511 }
2512 case KVM_GET_FPU: {
2513 fpu = kzalloc(sizeof(struct kvm_fpu), GFP_KERNEL);
2514 r = -ENOMEM;
2515 if (!fpu)
2516 goto out;
2517 r = kvm_arch_vcpu_ioctl_get_fpu(vcpu, fpu);
2518 if (r)
2519 goto out;
2520 r = -EFAULT;
2521 if (copy_to_user(argp, fpu, sizeof(struct kvm_fpu)))
2522 goto out;
2523 r = 0;
2524 break;
2525 }
2526 case KVM_SET_FPU: {
2527 fpu = memdup_user(argp, sizeof(*fpu));
2528 if (IS_ERR(fpu)) {
2529 r = PTR_ERR(fpu);
2530 fpu = NULL;
2531 goto out;
2532 }
2533 r = kvm_arch_vcpu_ioctl_set_fpu(vcpu, fpu);
2534 break;
2535 }
2536 default:
2537 r = kvm_arch_vcpu_ioctl(filp, ioctl, arg);
2538 }
2539out:
2540 vcpu_put(vcpu);
2541 kfree(fpu);
2542 kfree(kvm_sregs);
2543 return r;
2544}
2545
2546#ifdef CONFIG_KVM_COMPAT
2547static long kvm_vcpu_compat_ioctl(struct file *filp,
2548 unsigned int ioctl, unsigned long arg)
2549{
2550 struct kvm_vcpu *vcpu = filp->private_data;
2551 void __user *argp = compat_ptr(arg);
2552 int r;
2553
2554 if (vcpu->kvm->mm != current->mm)
2555 return -EIO;
2556
2557 switch (ioctl) {
2558 case KVM_SET_SIGNAL_MASK: {
2559 struct kvm_signal_mask __user *sigmask_arg = argp;
2560 struct kvm_signal_mask kvm_sigmask;
2561 compat_sigset_t csigset;
2562 sigset_t sigset;
2563
2564 if (argp) {
2565 r = -EFAULT;
2566 if (copy_from_user(&kvm_sigmask, argp,
2567 sizeof(kvm_sigmask)))
2568 goto out;
2569 r = -EINVAL;
2570 if (kvm_sigmask.len != sizeof(csigset))
2571 goto out;
2572 r = -EFAULT;
2573 if (copy_from_user(&csigset, sigmask_arg->sigset,
2574 sizeof(csigset)))
2575 goto out;
2576 sigset_from_compat(&sigset, &csigset);
2577 r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
2578 } else
2579 r = kvm_vcpu_ioctl_set_sigmask(vcpu, NULL);
2580 break;
2581 }
2582 default:
2583 r = kvm_vcpu_ioctl(filp, ioctl, arg);
2584 }
2585
2586out:
2587 return r;
2588}
2589#endif
2590
2591static int kvm_device_ioctl_attr(struct kvm_device *dev,
2592 int (*accessor)(struct kvm_device *dev,
2593 struct kvm_device_attr *attr),
2594 unsigned long arg)
2595{
2596 struct kvm_device_attr attr;
2597
2598 if (!accessor)
2599 return -EPERM;
2600
2601 if (copy_from_user(&attr, (void __user *)arg, sizeof(attr)))
2602 return -EFAULT;
2603
2604 return accessor(dev, &attr);
2605}
2606
2607static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
2608 unsigned long arg)
2609{
2610 struct kvm_device *dev = filp->private_data;
2611
2612 switch (ioctl) {
2613 case KVM_SET_DEVICE_ATTR:
2614 return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);
2615 case KVM_GET_DEVICE_ATTR:
2616 return kvm_device_ioctl_attr(dev, dev->ops->get_attr, arg);
2617 case KVM_HAS_DEVICE_ATTR:
2618 return kvm_device_ioctl_attr(dev, dev->ops->has_attr, arg);
2619 default:
2620 if (dev->ops->ioctl)
2621 return dev->ops->ioctl(dev, ioctl, arg);
2622
2623 return -ENOTTY;
2624 }
2625}
2626
2627static int kvm_device_release(struct inode *inode, struct file *filp)
2628{
2629 struct kvm_device *dev = filp->private_data;
2630 struct kvm *kvm = dev->kvm;
2631
2632 kvm_put_kvm(kvm);
2633 return 0;
2634}
2635
2636static const struct file_operations kvm_device_fops = {
2637 .unlocked_ioctl = kvm_device_ioctl,
2638#ifdef CONFIG_KVM_COMPAT
2639 .compat_ioctl = kvm_device_ioctl,
2640#endif
2641 .release = kvm_device_release,
2642};
2643
2644struct kvm_device *kvm_device_from_filp(struct file *filp)
2645{
2646 if (filp->f_op != &kvm_device_fops)
2647 return NULL;
2648
2649 return filp->private_data;
2650}
2651
2652static struct kvm_device_ops *kvm_device_ops_table[KVM_DEV_TYPE_MAX] = {
2653#ifdef CONFIG_KVM_MPIC
2654 [KVM_DEV_TYPE_FSL_MPIC_20] = &kvm_mpic_ops,
2655 [KVM_DEV_TYPE_FSL_MPIC_42] = &kvm_mpic_ops,
2656#endif
2657
2658#ifdef CONFIG_KVM_XICS
2659 [KVM_DEV_TYPE_XICS] = &kvm_xics_ops,
2660#endif
2661};
2662
2663int kvm_register_device_ops(struct kvm_device_ops *ops, u32 type)
2664{
2665 if (type >= ARRAY_SIZE(kvm_device_ops_table))
2666 return -ENOSPC;
2667
2668 if (kvm_device_ops_table[type] != NULL)
2669 return -EEXIST;
2670
2671 kvm_device_ops_table[type] = ops;
2672 return 0;
2673}
2674
2675void kvm_unregister_device_ops(u32 type)
2676{
2677 if (kvm_device_ops_table[type] != NULL)
2678 kvm_device_ops_table[type] = NULL;
2679}
2680
2681static int kvm_ioctl_create_device(struct kvm *kvm,
2682 struct kvm_create_device *cd)
2683{
2684 struct kvm_device_ops *ops = NULL;
2685 struct kvm_device *dev;
2686 bool test = cd->flags & KVM_CREATE_DEVICE_TEST;
2687 int ret;
2688
2689 if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
2690 return -ENODEV;
2691
2692 ops = kvm_device_ops_table[cd->type];
2693 if (ops == NULL)
2694 return -ENODEV;
2695
2696 if (test)
2697 return 0;
2698
2699 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2700 if (!dev)
2701 return -ENOMEM;
2702
2703 dev->ops = ops;
2704 dev->kvm = kvm;
2705
2706 ret = ops->create(dev, cd->type);
2707 if (ret < 0) {
2708 kfree(dev);
2709 return ret;
2710 }
2711
2712 ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
2713 if (ret < 0) {
2714 ops->destroy(dev);
2715 return ret;
2716 }
2717
2718 list_add(&dev->vm_node, &kvm->devices);
2719 kvm_get_kvm(kvm);
2720 cd->fd = ret;
2721 return 0;
2722}
2723
2724static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
2725{
2726 switch (arg) {
2727 case KVM_CAP_USER_MEMORY:
2728 case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:
2729 case KVM_CAP_JOIN_MEMORY_REGIONS_WORKS:
2730 case KVM_CAP_INTERNAL_ERROR_DATA:
2731#ifdef CONFIG_HAVE_KVM_MSI
2732 case KVM_CAP_SIGNAL_MSI:
2733#endif
2734#ifdef CONFIG_HAVE_KVM_IRQFD
2735 case KVM_CAP_IRQFD:
2736 case KVM_CAP_IRQFD_RESAMPLE:
2737#endif
2738 case KVM_CAP_IOEVENTFD_ANY_LENGTH:
2739 case KVM_CAP_CHECK_EXTENSION_VM:
2740 return 1;
2741#ifdef CONFIG_HAVE_KVM_IRQ_ROUTING
2742 case KVM_CAP_IRQ_ROUTING:
2743 return KVM_MAX_IRQ_ROUTES;
2744#endif
2745#if KVM_ADDRESS_SPACE_NUM > 1
2746 case KVM_CAP_MULTI_ADDRESS_SPACE:
2747 return KVM_ADDRESS_SPACE_NUM;
2748#endif
2749 default:
2750 break;
2751 }
2752 return kvm_vm_ioctl_check_extension(kvm, arg);
2753}
2754
2755static long kvm_vm_ioctl(struct file *filp,
2756 unsigned int ioctl, unsigned long arg)
2757{
2758 struct kvm *kvm = filp->private_data;
2759 void __user *argp = (void __user *)arg;
2760 int r;
2761
2762 if (kvm->mm != current->mm)
2763 return -EIO;
2764 switch (ioctl) {
2765 case KVM_CREATE_VCPU:
2766 r = kvm_vm_ioctl_create_vcpu(kvm, arg);
2767 break;
2768 case KVM_SET_USER_MEMORY_REGION: {
2769 struct kvm_userspace_memory_region kvm_userspace_mem;
2770
2771 r = -EFAULT;
2772 if (copy_from_user(&kvm_userspace_mem, argp,
2773 sizeof(kvm_userspace_mem)))
2774 goto out;
2775
2776 r = kvm_vm_ioctl_set_memory_region(kvm, &kvm_userspace_mem);
2777 break;
2778 }
2779 case KVM_GET_DIRTY_LOG: {
2780 struct kvm_dirty_log log;
2781
2782 r = -EFAULT;
2783 if (copy_from_user(&log, argp, sizeof(log)))
2784 goto out;
2785 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
2786 break;
2787 }
2788#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2789 case KVM_REGISTER_COALESCED_MMIO: {
2790 struct kvm_coalesced_mmio_zone zone;
2791
2792 r = -EFAULT;
2793 if (copy_from_user(&zone, argp, sizeof(zone)))
2794 goto out;
2795 r = kvm_vm_ioctl_register_coalesced_mmio(kvm, &zone);
2796 break;
2797 }
2798 case KVM_UNREGISTER_COALESCED_MMIO: {
2799 struct kvm_coalesced_mmio_zone zone;
2800
2801 r = -EFAULT;
2802 if (copy_from_user(&zone, argp, sizeof(zone)))
2803 goto out;
2804 r = kvm_vm_ioctl_unregister_coalesced_mmio(kvm, &zone);
2805 break;
2806 }
2807#endif
2808 case KVM_IRQFD: {
2809 struct kvm_irqfd data;
2810
2811 r = -EFAULT;
2812 if (copy_from_user(&data, argp, sizeof(data)))
2813 goto out;
2814 r = kvm_irqfd(kvm, &data);
2815 break;
2816 }
2817 case KVM_IOEVENTFD: {
2818 struct kvm_ioeventfd data;
2819
2820 r = -EFAULT;
2821 if (copy_from_user(&data, argp, sizeof(data)))
2822 goto out;
2823 r = kvm_ioeventfd(kvm, &data);
2824 break;
2825 }
2826#ifdef CONFIG_HAVE_KVM_MSI
2827 case KVM_SIGNAL_MSI: {
2828 struct kvm_msi msi;
2829
2830 r = -EFAULT;
2831 if (copy_from_user(&msi, argp, sizeof(msi)))
2832 goto out;
2833 r = kvm_send_userspace_msi(kvm, &msi);
2834 break;
2835 }
2836#endif
2837#ifdef __KVM_HAVE_IRQ_LINE
2838 case KVM_IRQ_LINE_STATUS:
2839 case KVM_IRQ_LINE: {
2840 struct kvm_irq_level irq_event;
2841
2842 r = -EFAULT;
2843 if (copy_from_user(&irq_event, argp, sizeof(irq_event)))
2844 goto out;
2845
2846 r = kvm_vm_ioctl_irq_line(kvm, &irq_event,
2847 ioctl == KVM_IRQ_LINE_STATUS);
2848 if (r)
2849 goto out;
2850
2851 r = -EFAULT;
2852 if (ioctl == KVM_IRQ_LINE_STATUS) {
2853 if (copy_to_user(argp, &irq_event, sizeof(irq_event)))
2854 goto out;
2855 }
2856
2857 r = 0;
2858 break;
2859 }
2860#endif
2861#ifdef CONFIG_HAVE_KVM_IRQ_ROUTING
2862 case KVM_SET_GSI_ROUTING: {
2863 struct kvm_irq_routing routing;
2864 struct kvm_irq_routing __user *urouting;
2865 struct kvm_irq_routing_entry *entries;
2866
2867 r = -EFAULT;
2868 if (copy_from_user(&routing, argp, sizeof(routing)))
2869 goto out;
2870 r = -EINVAL;
2871 if (routing.nr >= KVM_MAX_IRQ_ROUTES)
2872 goto out;
2873 if (routing.flags)
2874 goto out;
2875 r = -ENOMEM;
2876 entries = vmalloc(routing.nr * sizeof(*entries));
2877 if (!entries)
2878 goto out;
2879 r = -EFAULT;
2880 urouting = argp;
2881 if (copy_from_user(entries, urouting->entries,
2882 routing.nr * sizeof(*entries)))
2883 goto out_free_irq_routing;
2884 r = kvm_set_irq_routing(kvm, entries, routing.nr,
2885 routing.flags);
2886out_free_irq_routing:
2887 vfree(entries);
2888 break;
2889 }
2890#endif /* CONFIG_HAVE_KVM_IRQ_ROUTING */
2891 case KVM_CREATE_DEVICE: {
2892 struct kvm_create_device cd;
2893
2894 r = -EFAULT;
2895 if (copy_from_user(&cd, argp, sizeof(cd)))
2896 goto out;
2897
2898 r = kvm_ioctl_create_device(kvm, &cd);
2899 if (r)
2900 goto out;
2901
2902 r = -EFAULT;
2903 if (copy_to_user(argp, &cd, sizeof(cd)))
2904 goto out;
2905
2906 r = 0;
2907 break;
2908 }
2909 case KVM_CHECK_EXTENSION:
2910 r = kvm_vm_ioctl_check_extension_generic(kvm, arg);
2911 break;
2912 default:
2913 r = kvm_arch_vm_ioctl(filp, ioctl, arg);
2914 }
2915out:
2916 return r;
2917}
2918
2919#ifdef CONFIG_KVM_COMPAT
2920struct compat_kvm_dirty_log {
2921 __u32 slot;
2922 __u32 padding1;
2923 union {
2924 compat_uptr_t dirty_bitmap; /* one bit per page */
2925 __u64 padding2;
2926 };
2927};
2928
2929static long kvm_vm_compat_ioctl(struct file *filp,
2930 unsigned int ioctl, unsigned long arg)
2931{
2932 struct kvm *kvm = filp->private_data;
2933 int r;
2934
2935 if (kvm->mm != current->mm)
2936 return -EIO;
2937 switch (ioctl) {
2938 case KVM_GET_DIRTY_LOG: {
2939 struct compat_kvm_dirty_log compat_log;
2940 struct kvm_dirty_log log;
2941
2942 r = -EFAULT;
2943 if (copy_from_user(&compat_log, (void __user *)arg,
2944 sizeof(compat_log)))
2945 goto out;
2946 log.slot = compat_log.slot;
2947 log.padding1 = compat_log.padding1;
2948 log.padding2 = compat_log.padding2;
2949 log.dirty_bitmap = compat_ptr(compat_log.dirty_bitmap);
2950
2951 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
2952 break;
2953 }
2954 default:
2955 r = kvm_vm_ioctl(filp, ioctl, arg);
2956 }
2957
2958out:
2959 return r;
2960}
2961#endif
2962
2963static struct file_operations kvm_vm_fops = {
2964 .release = kvm_vm_release,
2965 .unlocked_ioctl = kvm_vm_ioctl,
2966#ifdef CONFIG_KVM_COMPAT
2967 .compat_ioctl = kvm_vm_compat_ioctl,
2968#endif
2969 .llseek = noop_llseek,
2970};
2971
2972static int kvm_dev_ioctl_create_vm(unsigned long type)
2973{
2974 int r;
2975 struct kvm *kvm;
2976
2977 kvm = kvm_create_vm(type);
2978 if (IS_ERR(kvm))
2979 return PTR_ERR(kvm);
2980#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
2981 r = kvm_coalesced_mmio_init(kvm);
2982 if (r < 0) {
2983 kvm_put_kvm(kvm);
2984 return r;
2985 }
2986#endif
2987 r = anon_inode_getfd("kvm-vm", &kvm_vm_fops, kvm, O_RDWR | O_CLOEXEC);
2988 if (r < 0)
2989 kvm_put_kvm(kvm);
2990
2991 return r;
2992}
2993
2994static long kvm_dev_ioctl(struct file *filp,
2995 unsigned int ioctl, unsigned long arg)
2996{
2997 long r = -EINVAL;
2998
2999 switch (ioctl) {
3000 case KVM_GET_API_VERSION:
3001 if (arg)
3002 goto out;
3003 r = KVM_API_VERSION;
3004 break;
3005 case KVM_CREATE_VM:
3006 r = kvm_dev_ioctl_create_vm(arg);
3007 break;
3008 case KVM_CHECK_EXTENSION:
3009 r = kvm_vm_ioctl_check_extension_generic(NULL, arg);
3010 break;
3011 case KVM_GET_VCPU_MMAP_SIZE:
3012 if (arg)
3013 goto out;
3014 r = PAGE_SIZE; /* struct kvm_run */
3015#ifdef CONFIG_X86
3016 r += PAGE_SIZE; /* pio data page */
3017#endif
3018#ifdef KVM_COALESCED_MMIO_PAGE_OFFSET
3019 r += PAGE_SIZE; /* coalesced mmio ring page */
3020#endif
3021 break;
3022 case KVM_TRACE_ENABLE:
3023 case KVM_TRACE_PAUSE:
3024 case KVM_TRACE_DISABLE:
3025 r = -EOPNOTSUPP;
3026 break;
3027 default:
3028 return kvm_arch_dev_ioctl(filp, ioctl, arg);
3029 }
3030out:
3031 return r;
3032}
3033
3034static struct file_operations kvm_chardev_ops = {
3035 .unlocked_ioctl = kvm_dev_ioctl,
3036 .compat_ioctl = kvm_dev_ioctl,
3037 .llseek = noop_llseek,
3038};
3039
3040static struct miscdevice kvm_dev = {
3041 KVM_MINOR,
3042 "kvm",
3043 &kvm_chardev_ops,
3044};
3045
3046static void hardware_enable_nolock(void *junk)
3047{
3048 int cpu = raw_smp_processor_id();
3049 int r;
3050
3051 if (cpumask_test_cpu(cpu, cpus_hardware_enabled))
3052 return;
3053
3054 cpumask_set_cpu(cpu, cpus_hardware_enabled);
3055
3056 r = kvm_arch_hardware_enable();
3057
3058 if (r) {
3059 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
3060 atomic_inc(&hardware_enable_failed);
3061 pr_info("kvm: enabling virtualization on CPU%d failed\n", cpu);
3062 }
3063}
3064
3065static void hardware_enable(void)
3066{
3067 raw_spin_lock(&kvm_count_lock);
3068 if (kvm_usage_count)
3069 hardware_enable_nolock(NULL);
3070 raw_spin_unlock(&kvm_count_lock);
3071}
3072
3073static void hardware_disable_nolock(void *junk)
3074{
3075 int cpu = raw_smp_processor_id();
3076
3077 if (!cpumask_test_cpu(cpu, cpus_hardware_enabled))
3078 return;
3079 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
3080 kvm_arch_hardware_disable();
3081}
3082
3083static void hardware_disable(void)
3084{
3085 raw_spin_lock(&kvm_count_lock);
3086 if (kvm_usage_count)
3087 hardware_disable_nolock(NULL);
3088 raw_spin_unlock(&kvm_count_lock);
3089}
3090
3091static void hardware_disable_all_nolock(void)
3092{
3093 BUG_ON(!kvm_usage_count);
3094
3095 kvm_usage_count--;
3096 if (!kvm_usage_count)
3097 on_each_cpu(hardware_disable_nolock, NULL, 1);
3098}
3099
3100static void hardware_disable_all(void)
3101{
3102 raw_spin_lock(&kvm_count_lock);
3103 hardware_disable_all_nolock();
3104 raw_spin_unlock(&kvm_count_lock);
3105}
3106
3107static int hardware_enable_all(void)
3108{
3109 int r = 0;
3110
3111 raw_spin_lock(&kvm_count_lock);
3112
3113 kvm_usage_count++;
3114 if (kvm_usage_count == 1) {
3115 atomic_set(&hardware_enable_failed, 0);
3116 on_each_cpu(hardware_enable_nolock, NULL, 1);
3117
3118 if (atomic_read(&hardware_enable_failed)) {
3119 hardware_disable_all_nolock();
3120 r = -EBUSY;
3121 }
3122 }
3123
3124 raw_spin_unlock(&kvm_count_lock);
3125
3126 return r;
3127}
3128
3129static int kvm_cpu_hotplug(struct notifier_block *notifier, unsigned long val,
3130 void *v)
3131{
3132 val &= ~CPU_TASKS_FROZEN;
3133 switch (val) {
3134 case CPU_DYING:
3135 hardware_disable();
3136 break;
3137 case CPU_STARTING:
3138 hardware_enable();
3139 break;
3140 }
3141 return NOTIFY_OK;
3142}
3143
3144static int kvm_reboot(struct notifier_block *notifier, unsigned long val,
3145 void *v)
3146{
3147 /*
3148 * Some (well, at least mine) BIOSes hang on reboot if
3149 * in vmx root mode.
3150 *
3151 * And Intel TXT required VMX off for all cpu when system shutdown.
3152 */
3153 pr_info("kvm: exiting hardware virtualization\n");
3154 kvm_rebooting = true;
3155 on_each_cpu(hardware_disable_nolock, NULL, 1);
3156 return NOTIFY_OK;
3157}
3158
3159static struct notifier_block kvm_reboot_notifier = {
3160 .notifier_call = kvm_reboot,
3161 .priority = 0,
3162};
3163
3164static void kvm_io_bus_destroy(struct kvm_io_bus *bus)
3165{
3166 int i;
3167
3168 for (i = 0; i < bus->dev_count; i++) {
3169 struct kvm_io_device *pos = bus->range[i].dev;
3170
3171 kvm_iodevice_destructor(pos);
3172 }
3173 kfree(bus);
3174}
3175
3176static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1,
3177 const struct kvm_io_range *r2)
3178{
3179 gpa_t addr1 = r1->addr;
3180 gpa_t addr2 = r2->addr;
3181
3182 if (addr1 < addr2)
3183 return -1;
3184
3185 /* If r2->len == 0, match the exact address. If r2->len != 0,
3186 * accept any overlapping write. Any order is acceptable for
3187 * overlapping ranges, because kvm_io_bus_get_first_dev ensures
3188 * we process all of them.
3189 */
3190 if (r2->len) {
3191 addr1 += r1->len;
3192 addr2 += r2->len;
3193 }
3194
3195 if (addr1 > addr2)
3196 return 1;
3197
3198 return 0;
3199}
3200
3201static int kvm_io_bus_sort_cmp(const void *p1, const void *p2)
3202{
3203 return kvm_io_bus_cmp(p1, p2);
3204}
3205
3206static int kvm_io_bus_insert_dev(struct kvm_io_bus *bus, struct kvm_io_device *dev,
3207 gpa_t addr, int len)
3208{
3209 bus->range[bus->dev_count++] = (struct kvm_io_range) {
3210 .addr = addr,
3211 .len = len,
3212 .dev = dev,
3213 };
3214
3215 sort(bus->range, bus->dev_count, sizeof(struct kvm_io_range),
3216 kvm_io_bus_sort_cmp, NULL);
3217
3218 return 0;
3219}
3220
3221static int kvm_io_bus_get_first_dev(struct kvm_io_bus *bus,
3222 gpa_t addr, int len)
3223{
3224 struct kvm_io_range *range, key;
3225 int off;
3226
3227 key = (struct kvm_io_range) {
3228 .addr = addr,
3229 .len = len,
3230 };
3231
3232 range = bsearch(&key, bus->range, bus->dev_count,
3233 sizeof(struct kvm_io_range), kvm_io_bus_sort_cmp);
3234 if (range == NULL)
3235 return -ENOENT;
3236
3237 off = range - bus->range;
3238
3239 while (off > 0 && kvm_io_bus_cmp(&key, &bus->range[off-1]) == 0)
3240 off--;
3241
3242 return off;
3243}
3244
3245static int __kvm_io_bus_write(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
3246 struct kvm_io_range *range, const void *val)
3247{
3248 int idx;
3249
3250 idx = kvm_io_bus_get_first_dev(bus, range->addr, range->len);
3251 if (idx < 0)
3252 return -EOPNOTSUPP;
3253
3254 while (idx < bus->dev_count &&
3255 kvm_io_bus_cmp(range, &bus->range[idx]) == 0) {
3256 if (!kvm_iodevice_write(vcpu, bus->range[idx].dev, range->addr,
3257 range->len, val))
3258 return idx;
3259 idx++;
3260 }
3261
3262 return -EOPNOTSUPP;
3263}
3264
3265/* kvm_io_bus_write - called under kvm->slots_lock */
3266int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
3267 int len, const void *val)
3268{
3269 struct kvm_io_bus *bus;
3270 struct kvm_io_range range;
3271 int r;
3272
3273 range = (struct kvm_io_range) {
3274 .addr = addr,
3275 .len = len,
3276 };
3277
3278 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3279 r = __kvm_io_bus_write(vcpu, bus, &range, val);
3280 return r < 0 ? r : 0;
3281}
3282
3283/* kvm_io_bus_write_cookie - called under kvm->slots_lock */
3284int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
3285 gpa_t addr, int len, const void *val, long cookie)
3286{
3287 struct kvm_io_bus *bus;
3288 struct kvm_io_range range;
3289
3290 range = (struct kvm_io_range) {
3291 .addr = addr,
3292 .len = len,
3293 };
3294
3295 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3296
3297 /* First try the device referenced by cookie. */
3298 if ((cookie >= 0) && (cookie < bus->dev_count) &&
3299 (kvm_io_bus_cmp(&range, &bus->range[cookie]) == 0))
3300 if (!kvm_iodevice_write(vcpu, bus->range[cookie].dev, addr, len,
3301 val))
3302 return cookie;
3303
3304 /*
3305 * cookie contained garbage; fall back to search and return the
3306 * correct cookie value.
3307 */
3308 return __kvm_io_bus_write(vcpu, bus, &range, val);
3309}
3310
3311static int __kvm_io_bus_read(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
3312 struct kvm_io_range *range, void *val)
3313{
3314 int idx;
3315
3316 idx = kvm_io_bus_get_first_dev(bus, range->addr, range->len);
3317 if (idx < 0)
3318 return -EOPNOTSUPP;
3319
3320 while (idx < bus->dev_count &&
3321 kvm_io_bus_cmp(range, &bus->range[idx]) == 0) {
3322 if (!kvm_iodevice_read(vcpu, bus->range[idx].dev, range->addr,
3323 range->len, val))
3324 return idx;
3325 idx++;
3326 }
3327
3328 return -EOPNOTSUPP;
3329}
3330EXPORT_SYMBOL_GPL(kvm_io_bus_write);
3331
3332/* kvm_io_bus_read - called under kvm->slots_lock */
3333int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
3334 int len, void *val)
3335{
3336 struct kvm_io_bus *bus;
3337 struct kvm_io_range range;
3338 int r;
3339
3340 range = (struct kvm_io_range) {
3341 .addr = addr,
3342 .len = len,
3343 };
3344
3345 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3346 r = __kvm_io_bus_read(vcpu, bus, &range, val);
3347 return r < 0 ? r : 0;
3348}
3349
3350
3351/* Caller must hold slots_lock. */
3352int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
3353 int len, struct kvm_io_device *dev)
3354{
3355 struct kvm_io_bus *new_bus, *bus;
3356
3357 bus = kvm->buses[bus_idx];
3358 /* exclude ioeventfd which is limited by maximum fd */
3359 if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
3360 return -ENOSPC;
3361
3362 new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count + 1) *
3363 sizeof(struct kvm_io_range)), GFP_KERNEL);
3364 if (!new_bus)
3365 return -ENOMEM;
3366 memcpy(new_bus, bus, sizeof(*bus) + (bus->dev_count *
3367 sizeof(struct kvm_io_range)));
3368 kvm_io_bus_insert_dev(new_bus, dev, addr, len);
3369 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
3370 synchronize_srcu_expedited(&kvm->srcu);
3371 kfree(bus);
3372
3373 return 0;
3374}
3375
3376/* Caller must hold slots_lock. */
3377int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
3378 struct kvm_io_device *dev)
3379{
3380 int i, r;
3381 struct kvm_io_bus *new_bus, *bus;
3382
3383 bus = kvm->buses[bus_idx];
3384 r = -ENOENT;
3385 for (i = 0; i < bus->dev_count; i++)
3386 if (bus->range[i].dev == dev) {
3387 r = 0;
3388 break;
3389 }
3390
3391 if (r)
3392 return r;
3393
3394 new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
3395 sizeof(struct kvm_io_range)), GFP_KERNEL);
3396 if (!new_bus)
3397 return -ENOMEM;
3398
3399 memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
3400 new_bus->dev_count--;
3401 memcpy(new_bus->range + i, bus->range + i + 1,
3402 (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
3403
3404 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
3405 synchronize_srcu_expedited(&kvm->srcu);
3406 kfree(bus);
3407 return r;
3408}
3409
3410static struct notifier_block kvm_cpu_notifier = {
3411 .notifier_call = kvm_cpu_hotplug,
3412};
3413
3414static int vm_stat_get(void *_offset, u64 *val)
3415{
3416 unsigned offset = (long)_offset;
3417 struct kvm *kvm;
3418
3419 *val = 0;
3420 spin_lock(&kvm_lock);
3421 list_for_each_entry(kvm, &vm_list, vm_list)
3422 *val += *(u32 *)((void *)kvm + offset);
3423 spin_unlock(&kvm_lock);
3424 return 0;
3425}
3426
3427DEFINE_SIMPLE_ATTRIBUTE(vm_stat_fops, vm_stat_get, NULL, "%llu\n");
3428
3429static int vcpu_stat_get(void *_offset, u64 *val)
3430{
3431 unsigned offset = (long)_offset;
3432 struct kvm *kvm;
3433 struct kvm_vcpu *vcpu;
3434 int i;
3435
3436 *val = 0;
3437 spin_lock(&kvm_lock);
3438 list_for_each_entry(kvm, &vm_list, vm_list)
3439 kvm_for_each_vcpu(i, vcpu, kvm)
3440 *val += *(u32 *)((void *)vcpu + offset);
3441
3442 spin_unlock(&kvm_lock);
3443 return 0;
3444}
3445
3446DEFINE_SIMPLE_ATTRIBUTE(vcpu_stat_fops, vcpu_stat_get, NULL, "%llu\n");
3447
3448static const struct file_operations *stat_fops[] = {
3449 [KVM_STAT_VCPU] = &vcpu_stat_fops,
3450 [KVM_STAT_VM] = &vm_stat_fops,
3451};
3452
3453static int kvm_init_debug(void)
3454{
3455 int r = -EEXIST;
3456 struct kvm_stats_debugfs_item *p;
3457
3458 kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);
3459 if (kvm_debugfs_dir == NULL)
3460 goto out;
3461
3462 for (p = debugfs_entries; p->name; ++p) {
3463 if (!debugfs_create_file(p->name, 0444, kvm_debugfs_dir,
3464 (void *)(long)p->offset,
3465 stat_fops[p->kind]))
3466 goto out_dir;
3467 }
3468
3469 return 0;
3470
3471out_dir:
3472 debugfs_remove_recursive(kvm_debugfs_dir);
3473out:
3474 return r;
3475}
3476
3477static int kvm_suspend(void)
3478{
3479 if (kvm_usage_count)
3480 hardware_disable_nolock(NULL);
3481 return 0;
3482}
3483
3484static void kvm_resume(void)
3485{
3486 if (kvm_usage_count) {
3487 WARN_ON(raw_spin_is_locked(&kvm_count_lock));
3488 hardware_enable_nolock(NULL);
3489 }
3490}
3491
3492static struct syscore_ops kvm_syscore_ops = {
3493 .suspend = kvm_suspend,
3494 .resume = kvm_resume,
3495};
3496
3497static inline
3498struct kvm_vcpu *preempt_notifier_to_vcpu(struct preempt_notifier *pn)
3499{
3500 return container_of(pn, struct kvm_vcpu, preempt_notifier);
3501}
3502
3503static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
3504{
3505 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
3506
3507 if (vcpu->preempted)
3508 vcpu->preempted = false;
3509
3510 kvm_arch_sched_in(vcpu, cpu);
3511
3512 kvm_arch_vcpu_load(vcpu, cpu);
3513}
3514
3515static void kvm_sched_out(struct preempt_notifier *pn,
3516 struct task_struct *next)
3517{
3518 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
3519
3520 if (current->state == TASK_RUNNING)
3521 vcpu->preempted = true;
3522 kvm_arch_vcpu_put(vcpu);
3523}
3524
3525int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
3526 struct module *module)
3527{
3528 int r;
3529 int cpu;
3530
3531 r = kvm_arch_init(opaque);
3532 if (r)
3533 goto out_fail;
3534
3535 /*
3536 * kvm_arch_init makes sure there's at most one caller
3537 * for architectures that support multiple implementations,
3538 * like intel and amd on x86.
3539 * kvm_arch_init must be called before kvm_irqfd_init to avoid creating
3540 * conflicts in case kvm is already setup for another implementation.
3541 */
3542 r = kvm_irqfd_init();
3543 if (r)
3544 goto out_irqfd;
3545
3546 if (!zalloc_cpumask_var(&cpus_hardware_enabled, GFP_KERNEL)) {
3547 r = -ENOMEM;
3548 goto out_free_0;
3549 }
3550
3551 r = kvm_arch_hardware_setup();
3552 if (r < 0)
3553 goto out_free_0a;
3554
3555 for_each_online_cpu(cpu) {
3556 smp_call_function_single(cpu,
3557 kvm_arch_check_processor_compat,
3558 &r, 1);
3559 if (r < 0)
3560 goto out_free_1;
3561 }
3562
3563 r = register_cpu_notifier(&kvm_cpu_notifier);
3564 if (r)
3565 goto out_free_2;
3566 register_reboot_notifier(&kvm_reboot_notifier);
3567
3568 /* A kmem cache lets us meet the alignment requirements of fx_save. */
3569 if (!vcpu_align)
3570 vcpu_align = __alignof__(struct kvm_vcpu);
3571 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
3572 0, NULL);
3573 if (!kvm_vcpu_cache) {
3574 r = -ENOMEM;
3575 goto out_free_3;
3576 }
3577
3578 r = kvm_async_pf_init();
3579 if (r)
3580 goto out_free;
3581
3582 kvm_chardev_ops.owner = module;
3583 kvm_vm_fops.owner = module;
3584 kvm_vcpu_fops.owner = module;
3585
3586 r = misc_register(&kvm_dev);
3587 if (r) {
3588 pr_err("kvm: misc device register failed\n");
3589 goto out_unreg;
3590 }
3591
3592 register_syscore_ops(&kvm_syscore_ops);
3593
3594 kvm_preempt_ops.sched_in = kvm_sched_in;
3595 kvm_preempt_ops.sched_out = kvm_sched_out;
3596
3597 r = kvm_init_debug();
3598 if (r) {
3599 pr_err("kvm: create debugfs files failed\n");
3600 goto out_undebugfs;
3601 }
3602
3603 r = kvm_vfio_ops_init();
3604 WARN_ON(r);
3605
3606 return 0;
3607
3608out_undebugfs:
3609 unregister_syscore_ops(&kvm_syscore_ops);
3610 misc_deregister(&kvm_dev);
3611out_unreg:
3612 kvm_async_pf_deinit();
3613out_free:
3614 kmem_cache_destroy(kvm_vcpu_cache);
3615out_free_3:
3616 unregister_reboot_notifier(&kvm_reboot_notifier);
3617 unregister_cpu_notifier(&kvm_cpu_notifier);
3618out_free_2:
3619out_free_1:
3620 kvm_arch_hardware_unsetup();
3621out_free_0a:
3622 free_cpumask_var(cpus_hardware_enabled);
3623out_free_0:
3624 kvm_irqfd_exit();
3625out_irqfd:
3626 kvm_arch_exit();
3627out_fail:
3628 return r;
3629}
3630EXPORT_SYMBOL_GPL(kvm_init);
3631
3632void kvm_exit(void)
3633{
3634 debugfs_remove_recursive(kvm_debugfs_dir);
3635 misc_deregister(&kvm_dev);
3636 kmem_cache_destroy(kvm_vcpu_cache);
3637 kvm_async_pf_deinit();
3638 unregister_syscore_ops(&kvm_syscore_ops);
3639 unregister_reboot_notifier(&kvm_reboot_notifier);
3640 unregister_cpu_notifier(&kvm_cpu_notifier);
3641 on_each_cpu(hardware_disable_nolock, NULL, 1);
3642 kvm_arch_hardware_unsetup();
3643 kvm_arch_exit();
3644 kvm_irqfd_exit();
3645 free_cpumask_var(cpus_hardware_enabled);
3646 kvm_vfio_ops_exit();
3647}
3648EXPORT_SYMBOL_GPL(kvm_exit);
1/*
2 * Kernel-based Virtual Machine driver for Linux
3 *
4 * This module enables machines with Intel VT-x extensions to run virtual
5 * machines without emulation or binary translation.
6 *
7 * Copyright (C) 2006 Qumranet, Inc.
8 * Copyright 2010 Red Hat, Inc. and/or its affiliates.
9 *
10 * Authors:
11 * Avi Kivity <avi@qumranet.com>
12 * Yaniv Kamay <yaniv@qumranet.com>
13 *
14 * This work is licensed under the terms of the GNU GPL, version 2. See
15 * the COPYING file in the top-level directory.
16 *
17 */
18
19#include <kvm/iodev.h>
20
21#include <linux/kvm_host.h>
22#include <linux/kvm.h>
23#include <linux/module.h>
24#include <linux/errno.h>
25#include <linux/percpu.h>
26#include <linux/mm.h>
27#include <linux/miscdevice.h>
28#include <linux/vmalloc.h>
29#include <linux/reboot.h>
30#include <linux/debugfs.h>
31#include <linux/highmem.h>
32#include <linux/file.h>
33#include <linux/syscore_ops.h>
34#include <linux/cpu.h>
35#include <linux/sched/signal.h>
36#include <linux/sched/mm.h>
37#include <linux/sched/stat.h>
38#include <linux/cpumask.h>
39#include <linux/smp.h>
40#include <linux/anon_inodes.h>
41#include <linux/profile.h>
42#include <linux/kvm_para.h>
43#include <linux/pagemap.h>
44#include <linux/mman.h>
45#include <linux/swap.h>
46#include <linux/bitops.h>
47#include <linux/spinlock.h>
48#include <linux/compat.h>
49#include <linux/srcu.h>
50#include <linux/hugetlb.h>
51#include <linux/slab.h>
52#include <linux/sort.h>
53#include <linux/bsearch.h>
54
55#include <asm/processor.h>
56#include <asm/io.h>
57#include <asm/ioctl.h>
58#include <linux/uaccess.h>
59#include <asm/pgtable.h>
60
61#include "coalesced_mmio.h"
62#include "async_pf.h"
63#include "vfio.h"
64
65#define CREATE_TRACE_POINTS
66#include <trace/events/kvm.h>
67
68/* Worst case buffer size needed for holding an integer. */
69#define ITOA_MAX_LEN 12
70
71MODULE_AUTHOR("Qumranet");
72MODULE_LICENSE("GPL");
73
74/* Architectures should define their poll value according to the halt latency */
75unsigned int halt_poll_ns = KVM_HALT_POLL_NS_DEFAULT;
76module_param(halt_poll_ns, uint, 0644);
77EXPORT_SYMBOL_GPL(halt_poll_ns);
78
79/* Default doubles per-vcpu halt_poll_ns. */
80unsigned int halt_poll_ns_grow = 2;
81module_param(halt_poll_ns_grow, uint, 0644);
82EXPORT_SYMBOL_GPL(halt_poll_ns_grow);
83
84/* Default resets per-vcpu halt_poll_ns . */
85unsigned int halt_poll_ns_shrink;
86module_param(halt_poll_ns_shrink, uint, 0644);
87EXPORT_SYMBOL_GPL(halt_poll_ns_shrink);
88
89/*
90 * Ordering of locks:
91 *
92 * kvm->lock --> kvm->slots_lock --> kvm->irq_lock
93 */
94
95DEFINE_SPINLOCK(kvm_lock);
96static DEFINE_RAW_SPINLOCK(kvm_count_lock);
97LIST_HEAD(vm_list);
98
99static cpumask_var_t cpus_hardware_enabled;
100static int kvm_usage_count;
101static atomic_t hardware_enable_failed;
102
103struct kmem_cache *kvm_vcpu_cache;
104EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
105
106static __read_mostly struct preempt_ops kvm_preempt_ops;
107
108struct dentry *kvm_debugfs_dir;
109EXPORT_SYMBOL_GPL(kvm_debugfs_dir);
110
111static int kvm_debugfs_num_entries;
112static const struct file_operations *stat_fops_per_vm[];
113
114static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl,
115 unsigned long arg);
116#ifdef CONFIG_KVM_COMPAT
117static long kvm_vcpu_compat_ioctl(struct file *file, unsigned int ioctl,
118 unsigned long arg);
119#endif
120static int hardware_enable_all(void);
121static void hardware_disable_all(void);
122
123static void kvm_io_bus_destroy(struct kvm_io_bus *bus);
124
125static void mark_page_dirty_in_slot(struct kvm_memory_slot *memslot, gfn_t gfn);
126
127__visible bool kvm_rebooting;
128EXPORT_SYMBOL_GPL(kvm_rebooting);
129
130static bool largepages_enabled = true;
131
132#define KVM_EVENT_CREATE_VM 0
133#define KVM_EVENT_DESTROY_VM 1
134static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm);
135static unsigned long long kvm_createvm_count;
136static unsigned long long kvm_active_vms;
137
138__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
139 unsigned long start, unsigned long end)
140{
141}
142
143bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
144{
145 if (pfn_valid(pfn))
146 return PageReserved(pfn_to_page(pfn));
147
148 return true;
149}
150
151/*
152 * Switches to specified vcpu, until a matching vcpu_put()
153 */
154void vcpu_load(struct kvm_vcpu *vcpu)
155{
156 int cpu = get_cpu();
157 preempt_notifier_register(&vcpu->preempt_notifier);
158 kvm_arch_vcpu_load(vcpu, cpu);
159 put_cpu();
160}
161EXPORT_SYMBOL_GPL(vcpu_load);
162
163void vcpu_put(struct kvm_vcpu *vcpu)
164{
165 preempt_disable();
166 kvm_arch_vcpu_put(vcpu);
167 preempt_notifier_unregister(&vcpu->preempt_notifier);
168 preempt_enable();
169}
170EXPORT_SYMBOL_GPL(vcpu_put);
171
172/* TODO: merge with kvm_arch_vcpu_should_kick */
173static bool kvm_request_needs_ipi(struct kvm_vcpu *vcpu, unsigned req)
174{
175 int mode = kvm_vcpu_exiting_guest_mode(vcpu);
176
177 /*
178 * We need to wait for the VCPU to reenable interrupts and get out of
179 * READING_SHADOW_PAGE_TABLES mode.
180 */
181 if (req & KVM_REQUEST_WAIT)
182 return mode != OUTSIDE_GUEST_MODE;
183
184 /*
185 * Need to kick a running VCPU, but otherwise there is nothing to do.
186 */
187 return mode == IN_GUEST_MODE;
188}
189
190static void ack_flush(void *_completed)
191{
192}
193
194static inline bool kvm_kick_many_cpus(const struct cpumask *cpus, bool wait)
195{
196 if (unlikely(!cpus))
197 cpus = cpu_online_mask;
198
199 if (cpumask_empty(cpus))
200 return false;
201
202 smp_call_function_many(cpus, ack_flush, NULL, wait);
203 return true;
204}
205
206bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req)
207{
208 int i, cpu, me;
209 cpumask_var_t cpus;
210 bool called;
211 struct kvm_vcpu *vcpu;
212
213 zalloc_cpumask_var(&cpus, GFP_ATOMIC);
214
215 me = get_cpu();
216 kvm_for_each_vcpu(i, vcpu, kvm) {
217 kvm_make_request(req, vcpu);
218 cpu = vcpu->cpu;
219
220 if (!(req & KVM_REQUEST_NO_WAKEUP) && kvm_vcpu_wake_up(vcpu))
221 continue;
222
223 if (cpus != NULL && cpu != -1 && cpu != me &&
224 kvm_request_needs_ipi(vcpu, req))
225 __cpumask_set_cpu(cpu, cpus);
226 }
227 called = kvm_kick_many_cpus(cpus, !!(req & KVM_REQUEST_WAIT));
228 put_cpu();
229 free_cpumask_var(cpus);
230 return called;
231}
232
233#ifndef CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL
234void kvm_flush_remote_tlbs(struct kvm *kvm)
235{
236 /*
237 * Read tlbs_dirty before setting KVM_REQ_TLB_FLUSH in
238 * kvm_make_all_cpus_request.
239 */
240 long dirty_count = smp_load_acquire(&kvm->tlbs_dirty);
241
242 /*
243 * We want to publish modifications to the page tables before reading
244 * mode. Pairs with a memory barrier in arch-specific code.
245 * - x86: smp_mb__after_srcu_read_unlock in vcpu_enter_guest
246 * and smp_mb in walk_shadow_page_lockless_begin/end.
247 * - powerpc: smp_mb in kvmppc_prepare_to_enter.
248 *
249 * There is already an smp_mb__after_atomic() before
250 * kvm_make_all_cpus_request() reads vcpu->mode. We reuse that
251 * barrier here.
252 */
253 if (kvm_make_all_cpus_request(kvm, KVM_REQ_TLB_FLUSH))
254 ++kvm->stat.remote_tlb_flush;
255 cmpxchg(&kvm->tlbs_dirty, dirty_count, 0);
256}
257EXPORT_SYMBOL_GPL(kvm_flush_remote_tlbs);
258#endif
259
260void kvm_reload_remote_mmus(struct kvm *kvm)
261{
262 kvm_make_all_cpus_request(kvm, KVM_REQ_MMU_RELOAD);
263}
264
265int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
266{
267 struct page *page;
268 int r;
269
270 mutex_init(&vcpu->mutex);
271 vcpu->cpu = -1;
272 vcpu->kvm = kvm;
273 vcpu->vcpu_id = id;
274 vcpu->pid = NULL;
275 init_swait_queue_head(&vcpu->wq);
276 kvm_async_pf_vcpu_init(vcpu);
277
278 vcpu->pre_pcpu = -1;
279 INIT_LIST_HEAD(&vcpu->blocked_vcpu_list);
280
281 page = alloc_page(GFP_KERNEL | __GFP_ZERO);
282 if (!page) {
283 r = -ENOMEM;
284 goto fail;
285 }
286 vcpu->run = page_address(page);
287
288 kvm_vcpu_set_in_spin_loop(vcpu, false);
289 kvm_vcpu_set_dy_eligible(vcpu, false);
290 vcpu->preempted = false;
291
292 r = kvm_arch_vcpu_init(vcpu);
293 if (r < 0)
294 goto fail_free_run;
295 return 0;
296
297fail_free_run:
298 free_page((unsigned long)vcpu->run);
299fail:
300 return r;
301}
302EXPORT_SYMBOL_GPL(kvm_vcpu_init);
303
304void kvm_vcpu_uninit(struct kvm_vcpu *vcpu)
305{
306 /*
307 * no need for rcu_read_lock as VCPU_RUN is the only place that
308 * will change the vcpu->pid pointer and on uninit all file
309 * descriptors are already gone.
310 */
311 put_pid(rcu_dereference_protected(vcpu->pid, 1));
312 kvm_arch_vcpu_uninit(vcpu);
313 free_page((unsigned long)vcpu->run);
314}
315EXPORT_SYMBOL_GPL(kvm_vcpu_uninit);
316
317#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
318static inline struct kvm *mmu_notifier_to_kvm(struct mmu_notifier *mn)
319{
320 return container_of(mn, struct kvm, mmu_notifier);
321}
322
323static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
324 struct mm_struct *mm,
325 unsigned long address,
326 pte_t pte)
327{
328 struct kvm *kvm = mmu_notifier_to_kvm(mn);
329 int idx;
330
331 idx = srcu_read_lock(&kvm->srcu);
332 spin_lock(&kvm->mmu_lock);
333 kvm->mmu_notifier_seq++;
334 kvm_set_spte_hva(kvm, address, pte);
335 spin_unlock(&kvm->mmu_lock);
336 srcu_read_unlock(&kvm->srcu, idx);
337}
338
339static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
340 struct mm_struct *mm,
341 unsigned long start,
342 unsigned long end)
343{
344 struct kvm *kvm = mmu_notifier_to_kvm(mn);
345 int need_tlb_flush = 0, idx;
346
347 idx = srcu_read_lock(&kvm->srcu);
348 spin_lock(&kvm->mmu_lock);
349 /*
350 * The count increase must become visible at unlock time as no
351 * spte can be established without taking the mmu_lock and
352 * count is also read inside the mmu_lock critical section.
353 */
354 kvm->mmu_notifier_count++;
355 need_tlb_flush = kvm_unmap_hva_range(kvm, start, end);
356 need_tlb_flush |= kvm->tlbs_dirty;
357 /* we've to flush the tlb before the pages can be freed */
358 if (need_tlb_flush)
359 kvm_flush_remote_tlbs(kvm);
360
361 spin_unlock(&kvm->mmu_lock);
362
363 kvm_arch_mmu_notifier_invalidate_range(kvm, start, end);
364
365 srcu_read_unlock(&kvm->srcu, idx);
366}
367
368static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
369 struct mm_struct *mm,
370 unsigned long start,
371 unsigned long end)
372{
373 struct kvm *kvm = mmu_notifier_to_kvm(mn);
374
375 spin_lock(&kvm->mmu_lock);
376 /*
377 * This sequence increase will notify the kvm page fault that
378 * the page that is going to be mapped in the spte could have
379 * been freed.
380 */
381 kvm->mmu_notifier_seq++;
382 smp_wmb();
383 /*
384 * The above sequence increase must be visible before the
385 * below count decrease, which is ensured by the smp_wmb above
386 * in conjunction with the smp_rmb in mmu_notifier_retry().
387 */
388 kvm->mmu_notifier_count--;
389 spin_unlock(&kvm->mmu_lock);
390
391 BUG_ON(kvm->mmu_notifier_count < 0);
392}
393
394static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
395 struct mm_struct *mm,
396 unsigned long start,
397 unsigned long end)
398{
399 struct kvm *kvm = mmu_notifier_to_kvm(mn);
400 int young, idx;
401
402 idx = srcu_read_lock(&kvm->srcu);
403 spin_lock(&kvm->mmu_lock);
404
405 young = kvm_age_hva(kvm, start, end);
406 if (young)
407 kvm_flush_remote_tlbs(kvm);
408
409 spin_unlock(&kvm->mmu_lock);
410 srcu_read_unlock(&kvm->srcu, idx);
411
412 return young;
413}
414
415static int kvm_mmu_notifier_clear_young(struct mmu_notifier *mn,
416 struct mm_struct *mm,
417 unsigned long start,
418 unsigned long end)
419{
420 struct kvm *kvm = mmu_notifier_to_kvm(mn);
421 int young, idx;
422
423 idx = srcu_read_lock(&kvm->srcu);
424 spin_lock(&kvm->mmu_lock);
425 /*
426 * Even though we do not flush TLB, this will still adversely
427 * affect performance on pre-Haswell Intel EPT, where there is
428 * no EPT Access Bit to clear so that we have to tear down EPT
429 * tables instead. If we find this unacceptable, we can always
430 * add a parameter to kvm_age_hva so that it effectively doesn't
431 * do anything on clear_young.
432 *
433 * Also note that currently we never issue secondary TLB flushes
434 * from clear_young, leaving this job up to the regular system
435 * cadence. If we find this inaccurate, we might come up with a
436 * more sophisticated heuristic later.
437 */
438 young = kvm_age_hva(kvm, start, end);
439 spin_unlock(&kvm->mmu_lock);
440 srcu_read_unlock(&kvm->srcu, idx);
441
442 return young;
443}
444
445static int kvm_mmu_notifier_test_young(struct mmu_notifier *mn,
446 struct mm_struct *mm,
447 unsigned long address)
448{
449 struct kvm *kvm = mmu_notifier_to_kvm(mn);
450 int young, idx;
451
452 idx = srcu_read_lock(&kvm->srcu);
453 spin_lock(&kvm->mmu_lock);
454 young = kvm_test_age_hva(kvm, address);
455 spin_unlock(&kvm->mmu_lock);
456 srcu_read_unlock(&kvm->srcu, idx);
457
458 return young;
459}
460
461static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
462 struct mm_struct *mm)
463{
464 struct kvm *kvm = mmu_notifier_to_kvm(mn);
465 int idx;
466
467 idx = srcu_read_lock(&kvm->srcu);
468 kvm_arch_flush_shadow_all(kvm);
469 srcu_read_unlock(&kvm->srcu, idx);
470}
471
472static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
473 .flags = MMU_INVALIDATE_DOES_NOT_BLOCK,
474 .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
475 .invalidate_range_end = kvm_mmu_notifier_invalidate_range_end,
476 .clear_flush_young = kvm_mmu_notifier_clear_flush_young,
477 .clear_young = kvm_mmu_notifier_clear_young,
478 .test_young = kvm_mmu_notifier_test_young,
479 .change_pte = kvm_mmu_notifier_change_pte,
480 .release = kvm_mmu_notifier_release,
481};
482
483static int kvm_init_mmu_notifier(struct kvm *kvm)
484{
485 kvm->mmu_notifier.ops = &kvm_mmu_notifier_ops;
486 return mmu_notifier_register(&kvm->mmu_notifier, current->mm);
487}
488
489#else /* !(CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER) */
490
491static int kvm_init_mmu_notifier(struct kvm *kvm)
492{
493 return 0;
494}
495
496#endif /* CONFIG_MMU_NOTIFIER && KVM_ARCH_WANT_MMU_NOTIFIER */
497
498static struct kvm_memslots *kvm_alloc_memslots(void)
499{
500 int i;
501 struct kvm_memslots *slots;
502
503 slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
504 if (!slots)
505 return NULL;
506
507 for (i = 0; i < KVM_MEM_SLOTS_NUM; i++)
508 slots->id_to_index[i] = slots->memslots[i].id = i;
509
510 return slots;
511}
512
513static void kvm_destroy_dirty_bitmap(struct kvm_memory_slot *memslot)
514{
515 if (!memslot->dirty_bitmap)
516 return;
517
518 kvfree(memslot->dirty_bitmap);
519 memslot->dirty_bitmap = NULL;
520}
521
522/*
523 * Free any memory in @free but not in @dont.
524 */
525static void kvm_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
526 struct kvm_memory_slot *dont)
527{
528 if (!dont || free->dirty_bitmap != dont->dirty_bitmap)
529 kvm_destroy_dirty_bitmap(free);
530
531 kvm_arch_free_memslot(kvm, free, dont);
532
533 free->npages = 0;
534}
535
536static void kvm_free_memslots(struct kvm *kvm, struct kvm_memslots *slots)
537{
538 struct kvm_memory_slot *memslot;
539
540 if (!slots)
541 return;
542
543 kvm_for_each_memslot(memslot, slots)
544 kvm_free_memslot(kvm, memslot, NULL);
545
546 kvfree(slots);
547}
548
549static void kvm_destroy_vm_debugfs(struct kvm *kvm)
550{
551 int i;
552
553 if (!kvm->debugfs_dentry)
554 return;
555
556 debugfs_remove_recursive(kvm->debugfs_dentry);
557
558 if (kvm->debugfs_stat_data) {
559 for (i = 0; i < kvm_debugfs_num_entries; i++)
560 kfree(kvm->debugfs_stat_data[i]);
561 kfree(kvm->debugfs_stat_data);
562 }
563}
564
565static int kvm_create_vm_debugfs(struct kvm *kvm, int fd)
566{
567 char dir_name[ITOA_MAX_LEN * 2];
568 struct kvm_stat_data *stat_data;
569 struct kvm_stats_debugfs_item *p;
570
571 if (!debugfs_initialized())
572 return 0;
573
574 snprintf(dir_name, sizeof(dir_name), "%d-%d", task_pid_nr(current), fd);
575 kvm->debugfs_dentry = debugfs_create_dir(dir_name,
576 kvm_debugfs_dir);
577 if (!kvm->debugfs_dentry)
578 return -ENOMEM;
579
580 kvm->debugfs_stat_data = kcalloc(kvm_debugfs_num_entries,
581 sizeof(*kvm->debugfs_stat_data),
582 GFP_KERNEL);
583 if (!kvm->debugfs_stat_data)
584 return -ENOMEM;
585
586 for (p = debugfs_entries; p->name; p++) {
587 stat_data = kzalloc(sizeof(*stat_data), GFP_KERNEL);
588 if (!stat_data)
589 return -ENOMEM;
590
591 stat_data->kvm = kvm;
592 stat_data->offset = p->offset;
593 kvm->debugfs_stat_data[p - debugfs_entries] = stat_data;
594 if (!debugfs_create_file(p->name, 0644,
595 kvm->debugfs_dentry,
596 stat_data,
597 stat_fops_per_vm[p->kind]))
598 return -ENOMEM;
599 }
600 return 0;
601}
602
603static struct kvm *kvm_create_vm(unsigned long type)
604{
605 int r, i;
606 struct kvm *kvm = kvm_arch_alloc_vm();
607
608 if (!kvm)
609 return ERR_PTR(-ENOMEM);
610
611 spin_lock_init(&kvm->mmu_lock);
612 mmgrab(current->mm);
613 kvm->mm = current->mm;
614 kvm_eventfd_init(kvm);
615 mutex_init(&kvm->lock);
616 mutex_init(&kvm->irq_lock);
617 mutex_init(&kvm->slots_lock);
618 refcount_set(&kvm->users_count, 1);
619 INIT_LIST_HEAD(&kvm->devices);
620
621 r = kvm_arch_init_vm(kvm, type);
622 if (r)
623 goto out_err_no_disable;
624
625 r = hardware_enable_all();
626 if (r)
627 goto out_err_no_disable;
628
629#ifdef CONFIG_HAVE_KVM_IRQFD
630 INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list);
631#endif
632
633 BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
634
635 r = -ENOMEM;
636 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) {
637 struct kvm_memslots *slots = kvm_alloc_memslots();
638 if (!slots)
639 goto out_err_no_srcu;
640 /*
641 * Generations must be different for each address space.
642 * Init kvm generation close to the maximum to easily test the
643 * code of handling generation number wrap-around.
644 */
645 slots->generation = i * 2 - 150;
646 rcu_assign_pointer(kvm->memslots[i], slots);
647 }
648
649 if (init_srcu_struct(&kvm->srcu))
650 goto out_err_no_srcu;
651 if (init_srcu_struct(&kvm->irq_srcu))
652 goto out_err_no_irq_srcu;
653 for (i = 0; i < KVM_NR_BUSES; i++) {
654 rcu_assign_pointer(kvm->buses[i],
655 kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL));
656 if (!kvm->buses[i])
657 goto out_err;
658 }
659
660 r = kvm_init_mmu_notifier(kvm);
661 if (r)
662 goto out_err;
663
664 spin_lock(&kvm_lock);
665 list_add(&kvm->vm_list, &vm_list);
666 spin_unlock(&kvm_lock);
667
668 preempt_notifier_inc();
669
670 return kvm;
671
672out_err:
673 cleanup_srcu_struct(&kvm->irq_srcu);
674out_err_no_irq_srcu:
675 cleanup_srcu_struct(&kvm->srcu);
676out_err_no_srcu:
677 hardware_disable_all();
678out_err_no_disable:
679 refcount_set(&kvm->users_count, 0);
680 for (i = 0; i < KVM_NR_BUSES; i++)
681 kfree(kvm_get_bus(kvm, i));
682 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
683 kvm_free_memslots(kvm, __kvm_memslots(kvm, i));
684 kvm_arch_free_vm(kvm);
685 mmdrop(current->mm);
686 return ERR_PTR(r);
687}
688
689static void kvm_destroy_devices(struct kvm *kvm)
690{
691 struct kvm_device *dev, *tmp;
692
693 /*
694 * We do not need to take the kvm->lock here, because nobody else
695 * has a reference to the struct kvm at this point and therefore
696 * cannot access the devices list anyhow.
697 */
698 list_for_each_entry_safe(dev, tmp, &kvm->devices, vm_node) {
699 list_del(&dev->vm_node);
700 dev->ops->destroy(dev);
701 }
702}
703
704static void kvm_destroy_vm(struct kvm *kvm)
705{
706 int i;
707 struct mm_struct *mm = kvm->mm;
708
709 kvm_uevent_notify_change(KVM_EVENT_DESTROY_VM, kvm);
710 kvm_destroy_vm_debugfs(kvm);
711 kvm_arch_sync_events(kvm);
712 spin_lock(&kvm_lock);
713 list_del(&kvm->vm_list);
714 spin_unlock(&kvm_lock);
715 kvm_free_irq_routing(kvm);
716 for (i = 0; i < KVM_NR_BUSES; i++) {
717 struct kvm_io_bus *bus = kvm_get_bus(kvm, i);
718
719 if (bus)
720 kvm_io_bus_destroy(bus);
721 kvm->buses[i] = NULL;
722 }
723 kvm_coalesced_mmio_free(kvm);
724#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
725 mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
726#else
727 kvm_arch_flush_shadow_all(kvm);
728#endif
729 kvm_arch_destroy_vm(kvm);
730 kvm_destroy_devices(kvm);
731 for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)
732 kvm_free_memslots(kvm, __kvm_memslots(kvm, i));
733 cleanup_srcu_struct(&kvm->irq_srcu);
734 cleanup_srcu_struct(&kvm->srcu);
735 kvm_arch_free_vm(kvm);
736 preempt_notifier_dec();
737 hardware_disable_all();
738 mmdrop(mm);
739}
740
741void kvm_get_kvm(struct kvm *kvm)
742{
743 refcount_inc(&kvm->users_count);
744}
745EXPORT_SYMBOL_GPL(kvm_get_kvm);
746
747void kvm_put_kvm(struct kvm *kvm)
748{
749 if (refcount_dec_and_test(&kvm->users_count))
750 kvm_destroy_vm(kvm);
751}
752EXPORT_SYMBOL_GPL(kvm_put_kvm);
753
754
755static int kvm_vm_release(struct inode *inode, struct file *filp)
756{
757 struct kvm *kvm = filp->private_data;
758
759 kvm_irqfd_release(kvm);
760
761 kvm_put_kvm(kvm);
762 return 0;
763}
764
765/*
766 * Allocation size is twice as large as the actual dirty bitmap size.
767 * See x86's kvm_vm_ioctl_get_dirty_log() why this is needed.
768 */
769static int kvm_create_dirty_bitmap(struct kvm_memory_slot *memslot)
770{
771 unsigned long dirty_bytes = 2 * kvm_dirty_bitmap_bytes(memslot);
772
773 memslot->dirty_bitmap = kvzalloc(dirty_bytes, GFP_KERNEL);
774 if (!memslot->dirty_bitmap)
775 return -ENOMEM;
776
777 return 0;
778}
779
780/*
781 * Insert memslot and re-sort memslots based on their GFN,
782 * so binary search could be used to lookup GFN.
783 * Sorting algorithm takes advantage of having initially
784 * sorted array and known changed memslot position.
785 */
786static void update_memslots(struct kvm_memslots *slots,
787 struct kvm_memory_slot *new)
788{
789 int id = new->id;
790 int i = slots->id_to_index[id];
791 struct kvm_memory_slot *mslots = slots->memslots;
792
793 WARN_ON(mslots[i].id != id);
794 if (!new->npages) {
795 WARN_ON(!mslots[i].npages);
796 if (mslots[i].npages)
797 slots->used_slots--;
798 } else {
799 if (!mslots[i].npages)
800 slots->used_slots++;
801 }
802
803 while (i < KVM_MEM_SLOTS_NUM - 1 &&
804 new->base_gfn <= mslots[i + 1].base_gfn) {
805 if (!mslots[i + 1].npages)
806 break;
807 mslots[i] = mslots[i + 1];
808 slots->id_to_index[mslots[i].id] = i;
809 i++;
810 }
811
812 /*
813 * The ">=" is needed when creating a slot with base_gfn == 0,
814 * so that it moves before all those with base_gfn == npages == 0.
815 *
816 * On the other hand, if new->npages is zero, the above loop has
817 * already left i pointing to the beginning of the empty part of
818 * mslots, and the ">=" would move the hole backwards in this
819 * case---which is wrong. So skip the loop when deleting a slot.
820 */
821 if (new->npages) {
822 while (i > 0 &&
823 new->base_gfn >= mslots[i - 1].base_gfn) {
824 mslots[i] = mslots[i - 1];
825 slots->id_to_index[mslots[i].id] = i;
826 i--;
827 }
828 } else
829 WARN_ON_ONCE(i != slots->used_slots);
830
831 mslots[i] = *new;
832 slots->id_to_index[mslots[i].id] = i;
833}
834
835static int check_memory_region_flags(const struct kvm_userspace_memory_region *mem)
836{
837 u32 valid_flags = KVM_MEM_LOG_DIRTY_PAGES;
838
839#ifdef __KVM_HAVE_READONLY_MEM
840 valid_flags |= KVM_MEM_READONLY;
841#endif
842
843 if (mem->flags & ~valid_flags)
844 return -EINVAL;
845
846 return 0;
847}
848
849static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
850 int as_id, struct kvm_memslots *slots)
851{
852 struct kvm_memslots *old_memslots = __kvm_memslots(kvm, as_id);
853
854 /*
855 * Set the low bit in the generation, which disables SPTE caching
856 * until the end of synchronize_srcu_expedited.
857 */
858 WARN_ON(old_memslots->generation & 1);
859 slots->generation = old_memslots->generation + 1;
860
861 rcu_assign_pointer(kvm->memslots[as_id], slots);
862 synchronize_srcu_expedited(&kvm->srcu);
863
864 /*
865 * Increment the new memslot generation a second time. This prevents
866 * vm exits that race with memslot updates from caching a memslot
867 * generation that will (potentially) be valid forever.
868 *
869 * Generations must be unique even across address spaces. We do not need
870 * a global counter for that, instead the generation space is evenly split
871 * across address spaces. For example, with two address spaces, address
872 * space 0 will use generations 0, 4, 8, ... while * address space 1 will
873 * use generations 2, 6, 10, 14, ...
874 */
875 slots->generation += KVM_ADDRESS_SPACE_NUM * 2 - 1;
876
877 kvm_arch_memslots_updated(kvm, slots);
878
879 return old_memslots;
880}
881
882/*
883 * Allocate some memory and give it an address in the guest physical address
884 * space.
885 *
886 * Discontiguous memory is allowed, mostly for framebuffers.
887 *
888 * Must be called holding kvm->slots_lock for write.
889 */
890int __kvm_set_memory_region(struct kvm *kvm,
891 const struct kvm_userspace_memory_region *mem)
892{
893 int r;
894 gfn_t base_gfn;
895 unsigned long npages;
896 struct kvm_memory_slot *slot;
897 struct kvm_memory_slot old, new;
898 struct kvm_memslots *slots = NULL, *old_memslots;
899 int as_id, id;
900 enum kvm_mr_change change;
901
902 r = check_memory_region_flags(mem);
903 if (r)
904 goto out;
905
906 r = -EINVAL;
907 as_id = mem->slot >> 16;
908 id = (u16)mem->slot;
909
910 /* General sanity checks */
911 if (mem->memory_size & (PAGE_SIZE - 1))
912 goto out;
913 if (mem->guest_phys_addr & (PAGE_SIZE - 1))
914 goto out;
915 /* We can read the guest memory with __xxx_user() later on. */
916 if ((id < KVM_USER_MEM_SLOTS) &&
917 ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
918 !access_ok(VERIFY_WRITE,
919 (void __user *)(unsigned long)mem->userspace_addr,
920 mem->memory_size)))
921 goto out;
922 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_MEM_SLOTS_NUM)
923 goto out;
924 if (mem->guest_phys_addr + mem->memory_size < mem->guest_phys_addr)
925 goto out;
926
927 slot = id_to_memslot(__kvm_memslots(kvm, as_id), id);
928 base_gfn = mem->guest_phys_addr >> PAGE_SHIFT;
929 npages = mem->memory_size >> PAGE_SHIFT;
930
931 if (npages > KVM_MEM_MAX_NR_PAGES)
932 goto out;
933
934 new = old = *slot;
935
936 new.id = id;
937 new.base_gfn = base_gfn;
938 new.npages = npages;
939 new.flags = mem->flags;
940
941 if (npages) {
942 if (!old.npages)
943 change = KVM_MR_CREATE;
944 else { /* Modify an existing slot. */
945 if ((mem->userspace_addr != old.userspace_addr) ||
946 (npages != old.npages) ||
947 ((new.flags ^ old.flags) & KVM_MEM_READONLY))
948 goto out;
949
950 if (base_gfn != old.base_gfn)
951 change = KVM_MR_MOVE;
952 else if (new.flags != old.flags)
953 change = KVM_MR_FLAGS_ONLY;
954 else { /* Nothing to change. */
955 r = 0;
956 goto out;
957 }
958 }
959 } else {
960 if (!old.npages)
961 goto out;
962
963 change = KVM_MR_DELETE;
964 new.base_gfn = 0;
965 new.flags = 0;
966 }
967
968 if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
969 /* Check for overlaps */
970 r = -EEXIST;
971 kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) {
972 if (slot->id == id)
973 continue;
974 if (!((base_gfn + npages <= slot->base_gfn) ||
975 (base_gfn >= slot->base_gfn + slot->npages)))
976 goto out;
977 }
978 }
979
980 /* Free page dirty bitmap if unneeded */
981 if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
982 new.dirty_bitmap = NULL;
983
984 r = -ENOMEM;
985 if (change == KVM_MR_CREATE) {
986 new.userspace_addr = mem->userspace_addr;
987
988 if (kvm_arch_create_memslot(kvm, &new, npages))
989 goto out_free;
990 }
991
992 /* Allocate page dirty bitmap if needed */
993 if ((new.flags & KVM_MEM_LOG_DIRTY_PAGES) && !new.dirty_bitmap) {
994 if (kvm_create_dirty_bitmap(&new) < 0)
995 goto out_free;
996 }
997
998 slots = kvzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
999 if (!slots)
1000 goto out_free;
1001 memcpy(slots, __kvm_memslots(kvm, as_id), sizeof(struct kvm_memslots));
1002
1003 if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
1004 slot = id_to_memslot(slots, id);
1005 slot->flags |= KVM_MEMSLOT_INVALID;
1006
1007 old_memslots = install_new_memslots(kvm, as_id, slots);
1008
1009 /* From this point no new shadow pages pointing to a deleted,
1010 * or moved, memslot will be created.
1011 *
1012 * validation of sp->gfn happens in:
1013 * - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
1014 * - kvm_is_visible_gfn (mmu_check_roots)
1015 */
1016 kvm_arch_flush_shadow_memslot(kvm, slot);
1017
1018 /*
1019 * We can re-use the old_memslots from above, the only difference
1020 * from the currently installed memslots is the invalid flag. This
1021 * will get overwritten by update_memslots anyway.
1022 */
1023 slots = old_memslots;
1024 }
1025
1026 r = kvm_arch_prepare_memory_region(kvm, &new, mem, change);
1027 if (r)
1028 goto out_slots;
1029
1030 /* actual memory is freed via old in kvm_free_memslot below */
1031 if (change == KVM_MR_DELETE) {
1032 new.dirty_bitmap = NULL;
1033 memset(&new.arch, 0, sizeof(new.arch));
1034 }
1035
1036 update_memslots(slots, &new);
1037 old_memslots = install_new_memslots(kvm, as_id, slots);
1038
1039 kvm_arch_commit_memory_region(kvm, mem, &old, &new, change);
1040
1041 kvm_free_memslot(kvm, &old, &new);
1042 kvfree(old_memslots);
1043 return 0;
1044
1045out_slots:
1046 kvfree(slots);
1047out_free:
1048 kvm_free_memslot(kvm, &new, &old);
1049out:
1050 return r;
1051}
1052EXPORT_SYMBOL_GPL(__kvm_set_memory_region);
1053
1054int kvm_set_memory_region(struct kvm *kvm,
1055 const struct kvm_userspace_memory_region *mem)
1056{
1057 int r;
1058
1059 mutex_lock(&kvm->slots_lock);
1060 r = __kvm_set_memory_region(kvm, mem);
1061 mutex_unlock(&kvm->slots_lock);
1062 return r;
1063}
1064EXPORT_SYMBOL_GPL(kvm_set_memory_region);
1065
1066static int kvm_vm_ioctl_set_memory_region(struct kvm *kvm,
1067 struct kvm_userspace_memory_region *mem)
1068{
1069 if ((u16)mem->slot >= KVM_USER_MEM_SLOTS)
1070 return -EINVAL;
1071
1072 return kvm_set_memory_region(kvm, mem);
1073}
1074
1075int kvm_get_dirty_log(struct kvm *kvm,
1076 struct kvm_dirty_log *log, int *is_dirty)
1077{
1078 struct kvm_memslots *slots;
1079 struct kvm_memory_slot *memslot;
1080 int i, as_id, id;
1081 unsigned long n;
1082 unsigned long any = 0;
1083
1084 as_id = log->slot >> 16;
1085 id = (u16)log->slot;
1086 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_USER_MEM_SLOTS)
1087 return -EINVAL;
1088
1089 slots = __kvm_memslots(kvm, as_id);
1090 memslot = id_to_memslot(slots, id);
1091 if (!memslot->dirty_bitmap)
1092 return -ENOENT;
1093
1094 n = kvm_dirty_bitmap_bytes(memslot);
1095
1096 for (i = 0; !any && i < n/sizeof(long); ++i)
1097 any = memslot->dirty_bitmap[i];
1098
1099 if (copy_to_user(log->dirty_bitmap, memslot->dirty_bitmap, n))
1100 return -EFAULT;
1101
1102 if (any)
1103 *is_dirty = 1;
1104 return 0;
1105}
1106EXPORT_SYMBOL_GPL(kvm_get_dirty_log);
1107
1108#ifdef CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT
1109/**
1110 * kvm_get_dirty_log_protect - get a snapshot of dirty pages, and if any pages
1111 * are dirty write protect them for next write.
1112 * @kvm: pointer to kvm instance
1113 * @log: slot id and address to which we copy the log
1114 * @is_dirty: flag set if any page is dirty
1115 *
1116 * We need to keep it in mind that VCPU threads can write to the bitmap
1117 * concurrently. So, to avoid losing track of dirty pages we keep the
1118 * following order:
1119 *
1120 * 1. Take a snapshot of the bit and clear it if needed.
1121 * 2. Write protect the corresponding page.
1122 * 3. Copy the snapshot to the userspace.
1123 * 4. Upon return caller flushes TLB's if needed.
1124 *
1125 * Between 2 and 4, the guest may write to the page using the remaining TLB
1126 * entry. This is not a problem because the page is reported dirty using
1127 * the snapshot taken before and step 4 ensures that writes done after
1128 * exiting to userspace will be logged for the next call.
1129 *
1130 */
1131int kvm_get_dirty_log_protect(struct kvm *kvm,
1132 struct kvm_dirty_log *log, bool *is_dirty)
1133{
1134 struct kvm_memslots *slots;
1135 struct kvm_memory_slot *memslot;
1136 int i, as_id, id;
1137 unsigned long n;
1138 unsigned long *dirty_bitmap;
1139 unsigned long *dirty_bitmap_buffer;
1140
1141 as_id = log->slot >> 16;
1142 id = (u16)log->slot;
1143 if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_USER_MEM_SLOTS)
1144 return -EINVAL;
1145
1146 slots = __kvm_memslots(kvm, as_id);
1147 memslot = id_to_memslot(slots, id);
1148
1149 dirty_bitmap = memslot->dirty_bitmap;
1150 if (!dirty_bitmap)
1151 return -ENOENT;
1152
1153 n = kvm_dirty_bitmap_bytes(memslot);
1154
1155 dirty_bitmap_buffer = dirty_bitmap + n / sizeof(long);
1156 memset(dirty_bitmap_buffer, 0, n);
1157
1158 spin_lock(&kvm->mmu_lock);
1159 *is_dirty = false;
1160 for (i = 0; i < n / sizeof(long); i++) {
1161 unsigned long mask;
1162 gfn_t offset;
1163
1164 if (!dirty_bitmap[i])
1165 continue;
1166
1167 *is_dirty = true;
1168
1169 mask = xchg(&dirty_bitmap[i], 0);
1170 dirty_bitmap_buffer[i] = mask;
1171
1172 if (mask) {
1173 offset = i * BITS_PER_LONG;
1174 kvm_arch_mmu_enable_log_dirty_pt_masked(kvm, memslot,
1175 offset, mask);
1176 }
1177 }
1178
1179 spin_unlock(&kvm->mmu_lock);
1180 if (copy_to_user(log->dirty_bitmap, dirty_bitmap_buffer, n))
1181 return -EFAULT;
1182 return 0;
1183}
1184EXPORT_SYMBOL_GPL(kvm_get_dirty_log_protect);
1185#endif
1186
1187bool kvm_largepages_enabled(void)
1188{
1189 return largepages_enabled;
1190}
1191
1192void kvm_disable_largepages(void)
1193{
1194 largepages_enabled = false;
1195}
1196EXPORT_SYMBOL_GPL(kvm_disable_largepages);
1197
1198struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn)
1199{
1200 return __gfn_to_memslot(kvm_memslots(kvm), gfn);
1201}
1202EXPORT_SYMBOL_GPL(gfn_to_memslot);
1203
1204struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn)
1205{
1206 return __gfn_to_memslot(kvm_vcpu_memslots(vcpu), gfn);
1207}
1208
1209bool kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn)
1210{
1211 struct kvm_memory_slot *memslot = gfn_to_memslot(kvm, gfn);
1212
1213 if (!memslot || memslot->id >= KVM_USER_MEM_SLOTS ||
1214 memslot->flags & KVM_MEMSLOT_INVALID)
1215 return false;
1216
1217 return true;
1218}
1219EXPORT_SYMBOL_GPL(kvm_is_visible_gfn);
1220
1221unsigned long kvm_host_page_size(struct kvm *kvm, gfn_t gfn)
1222{
1223 struct vm_area_struct *vma;
1224 unsigned long addr, size;
1225
1226 size = PAGE_SIZE;
1227
1228 addr = gfn_to_hva(kvm, gfn);
1229 if (kvm_is_error_hva(addr))
1230 return PAGE_SIZE;
1231
1232 down_read(¤t->mm->mmap_sem);
1233 vma = find_vma(current->mm, addr);
1234 if (!vma)
1235 goto out;
1236
1237 size = vma_kernel_pagesize(vma);
1238
1239out:
1240 up_read(¤t->mm->mmap_sem);
1241
1242 return size;
1243}
1244
1245static bool memslot_is_readonly(struct kvm_memory_slot *slot)
1246{
1247 return slot->flags & KVM_MEM_READONLY;
1248}
1249
1250static unsigned long __gfn_to_hva_many(struct kvm_memory_slot *slot, gfn_t gfn,
1251 gfn_t *nr_pages, bool write)
1252{
1253 if (!slot || slot->flags & KVM_MEMSLOT_INVALID)
1254 return KVM_HVA_ERR_BAD;
1255
1256 if (memslot_is_readonly(slot) && write)
1257 return KVM_HVA_ERR_RO_BAD;
1258
1259 if (nr_pages)
1260 *nr_pages = slot->npages - (gfn - slot->base_gfn);
1261
1262 return __gfn_to_hva_memslot(slot, gfn);
1263}
1264
1265static unsigned long gfn_to_hva_many(struct kvm_memory_slot *slot, gfn_t gfn,
1266 gfn_t *nr_pages)
1267{
1268 return __gfn_to_hva_many(slot, gfn, nr_pages, true);
1269}
1270
1271unsigned long gfn_to_hva_memslot(struct kvm_memory_slot *slot,
1272 gfn_t gfn)
1273{
1274 return gfn_to_hva_many(slot, gfn, NULL);
1275}
1276EXPORT_SYMBOL_GPL(gfn_to_hva_memslot);
1277
1278unsigned long gfn_to_hva(struct kvm *kvm, gfn_t gfn)
1279{
1280 return gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL);
1281}
1282EXPORT_SYMBOL_GPL(gfn_to_hva);
1283
1284unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn)
1285{
1286 return gfn_to_hva_many(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn, NULL);
1287}
1288EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_hva);
1289
1290/*
1291 * If writable is set to false, the hva returned by this function is only
1292 * allowed to be read.
1293 */
1294unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
1295 gfn_t gfn, bool *writable)
1296{
1297 unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);
1298
1299 if (!kvm_is_error_hva(hva) && writable)
1300 *writable = !memslot_is_readonly(slot);
1301
1302 return hva;
1303}
1304
1305unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
1306{
1307 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1308
1309 return gfn_to_hva_memslot_prot(slot, gfn, writable);
1310}
1311
1312unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable)
1313{
1314 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1315
1316 return gfn_to_hva_memslot_prot(slot, gfn, writable);
1317}
1318
1319static inline int check_user_page_hwpoison(unsigned long addr)
1320{
1321 int rc, flags = FOLL_HWPOISON | FOLL_WRITE;
1322
1323 rc = get_user_pages(addr, 1, flags, NULL, NULL);
1324 return rc == -EHWPOISON;
1325}
1326
1327/*
1328 * The atomic path to get the writable pfn which will be stored in @pfn,
1329 * true indicates success, otherwise false is returned.
1330 */
1331static bool hva_to_pfn_fast(unsigned long addr, bool atomic, bool *async,
1332 bool write_fault, bool *writable, kvm_pfn_t *pfn)
1333{
1334 struct page *page[1];
1335 int npages;
1336
1337 if (!(async || atomic))
1338 return false;
1339
1340 /*
1341 * Fast pin a writable pfn only if it is a write fault request
1342 * or the caller allows to map a writable pfn for a read fault
1343 * request.
1344 */
1345 if (!(write_fault || writable))
1346 return false;
1347
1348 npages = __get_user_pages_fast(addr, 1, 1, page);
1349 if (npages == 1) {
1350 *pfn = page_to_pfn(page[0]);
1351
1352 if (writable)
1353 *writable = true;
1354 return true;
1355 }
1356
1357 return false;
1358}
1359
1360/*
1361 * The slow path to get the pfn of the specified host virtual address,
1362 * 1 indicates success, -errno is returned if error is detected.
1363 */
1364static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault,
1365 bool *writable, kvm_pfn_t *pfn)
1366{
1367 unsigned int flags = FOLL_HWPOISON;
1368 struct page *page;
1369 int npages = 0;
1370
1371 might_sleep();
1372
1373 if (writable)
1374 *writable = write_fault;
1375
1376 if (write_fault)
1377 flags |= FOLL_WRITE;
1378 if (async)
1379 flags |= FOLL_NOWAIT;
1380
1381 npages = get_user_pages_unlocked(addr, 1, &page, flags);
1382 if (npages != 1)
1383 return npages;
1384
1385 /* map read fault as writable if possible */
1386 if (unlikely(!write_fault) && writable) {
1387 struct page *wpage;
1388
1389 if (__get_user_pages_fast(addr, 1, 1, &wpage) == 1) {
1390 *writable = true;
1391 put_page(page);
1392 page = wpage;
1393 }
1394 }
1395 *pfn = page_to_pfn(page);
1396 return npages;
1397}
1398
1399static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
1400{
1401 if (unlikely(!(vma->vm_flags & VM_READ)))
1402 return false;
1403
1404 if (write_fault && (unlikely(!(vma->vm_flags & VM_WRITE))))
1405 return false;
1406
1407 return true;
1408}
1409
1410static int hva_to_pfn_remapped(struct vm_area_struct *vma,
1411 unsigned long addr, bool *async,
1412 bool write_fault, bool *writable,
1413 kvm_pfn_t *p_pfn)
1414{
1415 unsigned long pfn;
1416 int r;
1417
1418 r = follow_pfn(vma, addr, &pfn);
1419 if (r) {
1420 /*
1421 * get_user_pages fails for VM_IO and VM_PFNMAP vmas and does
1422 * not call the fault handler, so do it here.
1423 */
1424 bool unlocked = false;
1425 r = fixup_user_fault(current, current->mm, addr,
1426 (write_fault ? FAULT_FLAG_WRITE : 0),
1427 &unlocked);
1428 if (unlocked)
1429 return -EAGAIN;
1430 if (r)
1431 return r;
1432
1433 r = follow_pfn(vma, addr, &pfn);
1434 if (r)
1435 return r;
1436
1437 }
1438
1439 if (writable)
1440 *writable = true;
1441
1442 /*
1443 * Get a reference here because callers of *hva_to_pfn* and
1444 * *gfn_to_pfn* ultimately call kvm_release_pfn_clean on the
1445 * returned pfn. This is only needed if the VMA has VM_MIXEDMAP
1446 * set, but the kvm_get_pfn/kvm_release_pfn_clean pair will
1447 * simply do nothing for reserved pfns.
1448 *
1449 * Whoever called remap_pfn_range is also going to call e.g.
1450 * unmap_mapping_range before the underlying pages are freed,
1451 * causing a call to our MMU notifier.
1452 */
1453 kvm_get_pfn(pfn);
1454
1455 *p_pfn = pfn;
1456 return 0;
1457}
1458
1459/*
1460 * Pin guest page in memory and return its pfn.
1461 * @addr: host virtual address which maps memory to the guest
1462 * @atomic: whether this function can sleep
1463 * @async: whether this function need to wait IO complete if the
1464 * host page is not in the memory
1465 * @write_fault: whether we should get a writable host page
1466 * @writable: whether it allows to map a writable host page for !@write_fault
1467 *
1468 * The function will map a writable host page for these two cases:
1469 * 1): @write_fault = true
1470 * 2): @write_fault = false && @writable, @writable will tell the caller
1471 * whether the mapping is writable.
1472 */
1473static kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async,
1474 bool write_fault, bool *writable)
1475{
1476 struct vm_area_struct *vma;
1477 kvm_pfn_t pfn = 0;
1478 int npages, r;
1479
1480 /* we can do it either atomically or asynchronously, not both */
1481 BUG_ON(atomic && async);
1482
1483 if (hva_to_pfn_fast(addr, atomic, async, write_fault, writable, &pfn))
1484 return pfn;
1485
1486 if (atomic)
1487 return KVM_PFN_ERR_FAULT;
1488
1489 npages = hva_to_pfn_slow(addr, async, write_fault, writable, &pfn);
1490 if (npages == 1)
1491 return pfn;
1492
1493 down_read(¤t->mm->mmap_sem);
1494 if (npages == -EHWPOISON ||
1495 (!async && check_user_page_hwpoison(addr))) {
1496 pfn = KVM_PFN_ERR_HWPOISON;
1497 goto exit;
1498 }
1499
1500retry:
1501 vma = find_vma_intersection(current->mm, addr, addr + 1);
1502
1503 if (vma == NULL)
1504 pfn = KVM_PFN_ERR_FAULT;
1505 else if (vma->vm_flags & (VM_IO | VM_PFNMAP)) {
1506 r = hva_to_pfn_remapped(vma, addr, async, write_fault, writable, &pfn);
1507 if (r == -EAGAIN)
1508 goto retry;
1509 if (r < 0)
1510 pfn = KVM_PFN_ERR_FAULT;
1511 } else {
1512 if (async && vma_is_valid(vma, write_fault))
1513 *async = true;
1514 pfn = KVM_PFN_ERR_FAULT;
1515 }
1516exit:
1517 up_read(¤t->mm->mmap_sem);
1518 return pfn;
1519}
1520
1521kvm_pfn_t __gfn_to_pfn_memslot(struct kvm_memory_slot *slot, gfn_t gfn,
1522 bool atomic, bool *async, bool write_fault,
1523 bool *writable)
1524{
1525 unsigned long addr = __gfn_to_hva_many(slot, gfn, NULL, write_fault);
1526
1527 if (addr == KVM_HVA_ERR_RO_BAD) {
1528 if (writable)
1529 *writable = false;
1530 return KVM_PFN_ERR_RO_FAULT;
1531 }
1532
1533 if (kvm_is_error_hva(addr)) {
1534 if (writable)
1535 *writable = false;
1536 return KVM_PFN_NOSLOT;
1537 }
1538
1539 /* Do not map writable pfn in the readonly memslot. */
1540 if (writable && memslot_is_readonly(slot)) {
1541 *writable = false;
1542 writable = NULL;
1543 }
1544
1545 return hva_to_pfn(addr, atomic, async, write_fault,
1546 writable);
1547}
1548EXPORT_SYMBOL_GPL(__gfn_to_pfn_memslot);
1549
1550kvm_pfn_t gfn_to_pfn_prot(struct kvm *kvm, gfn_t gfn, bool write_fault,
1551 bool *writable)
1552{
1553 return __gfn_to_pfn_memslot(gfn_to_memslot(kvm, gfn), gfn, false, NULL,
1554 write_fault, writable);
1555}
1556EXPORT_SYMBOL_GPL(gfn_to_pfn_prot);
1557
1558kvm_pfn_t gfn_to_pfn_memslot(struct kvm_memory_slot *slot, gfn_t gfn)
1559{
1560 return __gfn_to_pfn_memslot(slot, gfn, false, NULL, true, NULL);
1561}
1562EXPORT_SYMBOL_GPL(gfn_to_pfn_memslot);
1563
1564kvm_pfn_t gfn_to_pfn_memslot_atomic(struct kvm_memory_slot *slot, gfn_t gfn)
1565{
1566 return __gfn_to_pfn_memslot(slot, gfn, true, NULL, true, NULL);
1567}
1568EXPORT_SYMBOL_GPL(gfn_to_pfn_memslot_atomic);
1569
1570kvm_pfn_t gfn_to_pfn_atomic(struct kvm *kvm, gfn_t gfn)
1571{
1572 return gfn_to_pfn_memslot_atomic(gfn_to_memslot(kvm, gfn), gfn);
1573}
1574EXPORT_SYMBOL_GPL(gfn_to_pfn_atomic);
1575
1576kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn)
1577{
1578 return gfn_to_pfn_memslot_atomic(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn);
1579}
1580EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_pfn_atomic);
1581
1582kvm_pfn_t gfn_to_pfn(struct kvm *kvm, gfn_t gfn)
1583{
1584 return gfn_to_pfn_memslot(gfn_to_memslot(kvm, gfn), gfn);
1585}
1586EXPORT_SYMBOL_GPL(gfn_to_pfn);
1587
1588kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn)
1589{
1590 return gfn_to_pfn_memslot(kvm_vcpu_gfn_to_memslot(vcpu, gfn), gfn);
1591}
1592EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_pfn);
1593
1594int gfn_to_page_many_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
1595 struct page **pages, int nr_pages)
1596{
1597 unsigned long addr;
1598 gfn_t entry = 0;
1599
1600 addr = gfn_to_hva_many(slot, gfn, &entry);
1601 if (kvm_is_error_hva(addr))
1602 return -1;
1603
1604 if (entry < nr_pages)
1605 return 0;
1606
1607 return __get_user_pages_fast(addr, nr_pages, 1, pages);
1608}
1609EXPORT_SYMBOL_GPL(gfn_to_page_many_atomic);
1610
1611static struct page *kvm_pfn_to_page(kvm_pfn_t pfn)
1612{
1613 if (is_error_noslot_pfn(pfn))
1614 return KVM_ERR_PTR_BAD_PAGE;
1615
1616 if (kvm_is_reserved_pfn(pfn)) {
1617 WARN_ON(1);
1618 return KVM_ERR_PTR_BAD_PAGE;
1619 }
1620
1621 return pfn_to_page(pfn);
1622}
1623
1624struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
1625{
1626 kvm_pfn_t pfn;
1627
1628 pfn = gfn_to_pfn(kvm, gfn);
1629
1630 return kvm_pfn_to_page(pfn);
1631}
1632EXPORT_SYMBOL_GPL(gfn_to_page);
1633
1634struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn)
1635{
1636 kvm_pfn_t pfn;
1637
1638 pfn = kvm_vcpu_gfn_to_pfn(vcpu, gfn);
1639
1640 return kvm_pfn_to_page(pfn);
1641}
1642EXPORT_SYMBOL_GPL(kvm_vcpu_gfn_to_page);
1643
1644void kvm_release_page_clean(struct page *page)
1645{
1646 WARN_ON(is_error_page(page));
1647
1648 kvm_release_pfn_clean(page_to_pfn(page));
1649}
1650EXPORT_SYMBOL_GPL(kvm_release_page_clean);
1651
1652void kvm_release_pfn_clean(kvm_pfn_t pfn)
1653{
1654 if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn))
1655 put_page(pfn_to_page(pfn));
1656}
1657EXPORT_SYMBOL_GPL(kvm_release_pfn_clean);
1658
1659void kvm_release_page_dirty(struct page *page)
1660{
1661 WARN_ON(is_error_page(page));
1662
1663 kvm_release_pfn_dirty(page_to_pfn(page));
1664}
1665EXPORT_SYMBOL_GPL(kvm_release_page_dirty);
1666
1667void kvm_release_pfn_dirty(kvm_pfn_t pfn)
1668{
1669 kvm_set_pfn_dirty(pfn);
1670 kvm_release_pfn_clean(pfn);
1671}
1672EXPORT_SYMBOL_GPL(kvm_release_pfn_dirty);
1673
1674void kvm_set_pfn_dirty(kvm_pfn_t pfn)
1675{
1676 if (!kvm_is_reserved_pfn(pfn)) {
1677 struct page *page = pfn_to_page(pfn);
1678
1679 if (!PageReserved(page))
1680 SetPageDirty(page);
1681 }
1682}
1683EXPORT_SYMBOL_GPL(kvm_set_pfn_dirty);
1684
1685void kvm_set_pfn_accessed(kvm_pfn_t pfn)
1686{
1687 if (!kvm_is_reserved_pfn(pfn))
1688 mark_page_accessed(pfn_to_page(pfn));
1689}
1690EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);
1691
1692void kvm_get_pfn(kvm_pfn_t pfn)
1693{
1694 if (!kvm_is_reserved_pfn(pfn))
1695 get_page(pfn_to_page(pfn));
1696}
1697EXPORT_SYMBOL_GPL(kvm_get_pfn);
1698
1699static int next_segment(unsigned long len, int offset)
1700{
1701 if (len > PAGE_SIZE - offset)
1702 return PAGE_SIZE - offset;
1703 else
1704 return len;
1705}
1706
1707static int __kvm_read_guest_page(struct kvm_memory_slot *slot, gfn_t gfn,
1708 void *data, int offset, int len)
1709{
1710 int r;
1711 unsigned long addr;
1712
1713 addr = gfn_to_hva_memslot_prot(slot, gfn, NULL);
1714 if (kvm_is_error_hva(addr))
1715 return -EFAULT;
1716 r = __copy_from_user(data, (void __user *)addr + offset, len);
1717 if (r)
1718 return -EFAULT;
1719 return 0;
1720}
1721
1722int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
1723 int len)
1724{
1725 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1726
1727 return __kvm_read_guest_page(slot, gfn, data, offset, len);
1728}
1729EXPORT_SYMBOL_GPL(kvm_read_guest_page);
1730
1731int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data,
1732 int offset, int len)
1733{
1734 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1735
1736 return __kvm_read_guest_page(slot, gfn, data, offset, len);
1737}
1738EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest_page);
1739
1740int kvm_read_guest(struct kvm *kvm, gpa_t gpa, void *data, unsigned long len)
1741{
1742 gfn_t gfn = gpa >> PAGE_SHIFT;
1743 int seg;
1744 int offset = offset_in_page(gpa);
1745 int ret;
1746
1747 while ((seg = next_segment(len, offset)) != 0) {
1748 ret = kvm_read_guest_page(kvm, gfn, data, offset, seg);
1749 if (ret < 0)
1750 return ret;
1751 offset = 0;
1752 len -= seg;
1753 data += seg;
1754 ++gfn;
1755 }
1756 return 0;
1757}
1758EXPORT_SYMBOL_GPL(kvm_read_guest);
1759
1760int kvm_vcpu_read_guest(struct kvm_vcpu *vcpu, gpa_t gpa, void *data, unsigned long len)
1761{
1762 gfn_t gfn = gpa >> PAGE_SHIFT;
1763 int seg;
1764 int offset = offset_in_page(gpa);
1765 int ret;
1766
1767 while ((seg = next_segment(len, offset)) != 0) {
1768 ret = kvm_vcpu_read_guest_page(vcpu, gfn, data, offset, seg);
1769 if (ret < 0)
1770 return ret;
1771 offset = 0;
1772 len -= seg;
1773 data += seg;
1774 ++gfn;
1775 }
1776 return 0;
1777}
1778EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest);
1779
1780static int __kvm_read_guest_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
1781 void *data, int offset, unsigned long len)
1782{
1783 int r;
1784 unsigned long addr;
1785
1786 addr = gfn_to_hva_memslot_prot(slot, gfn, NULL);
1787 if (kvm_is_error_hva(addr))
1788 return -EFAULT;
1789 pagefault_disable();
1790 r = __copy_from_user_inatomic(data, (void __user *)addr + offset, len);
1791 pagefault_enable();
1792 if (r)
1793 return -EFAULT;
1794 return 0;
1795}
1796
1797int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
1798 unsigned long len)
1799{
1800 gfn_t gfn = gpa >> PAGE_SHIFT;
1801 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1802 int offset = offset_in_page(gpa);
1803
1804 return __kvm_read_guest_atomic(slot, gfn, data, offset, len);
1805}
1806EXPORT_SYMBOL_GPL(kvm_read_guest_atomic);
1807
1808int kvm_vcpu_read_guest_atomic(struct kvm_vcpu *vcpu, gpa_t gpa,
1809 void *data, unsigned long len)
1810{
1811 gfn_t gfn = gpa >> PAGE_SHIFT;
1812 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1813 int offset = offset_in_page(gpa);
1814
1815 return __kvm_read_guest_atomic(slot, gfn, data, offset, len);
1816}
1817EXPORT_SYMBOL_GPL(kvm_vcpu_read_guest_atomic);
1818
1819static int __kvm_write_guest_page(struct kvm_memory_slot *memslot, gfn_t gfn,
1820 const void *data, int offset, int len)
1821{
1822 int r;
1823 unsigned long addr;
1824
1825 addr = gfn_to_hva_memslot(memslot, gfn);
1826 if (kvm_is_error_hva(addr))
1827 return -EFAULT;
1828 r = __copy_to_user((void __user *)addr + offset, data, len);
1829 if (r)
1830 return -EFAULT;
1831 mark_page_dirty_in_slot(memslot, gfn);
1832 return 0;
1833}
1834
1835int kvm_write_guest_page(struct kvm *kvm, gfn_t gfn,
1836 const void *data, int offset, int len)
1837{
1838 struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
1839
1840 return __kvm_write_guest_page(slot, gfn, data, offset, len);
1841}
1842EXPORT_SYMBOL_GPL(kvm_write_guest_page);
1843
1844int kvm_vcpu_write_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn,
1845 const void *data, int offset, int len)
1846{
1847 struct kvm_memory_slot *slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
1848
1849 return __kvm_write_guest_page(slot, gfn, data, offset, len);
1850}
1851EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest_page);
1852
1853int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
1854 unsigned long len)
1855{
1856 gfn_t gfn = gpa >> PAGE_SHIFT;
1857 int seg;
1858 int offset = offset_in_page(gpa);
1859 int ret;
1860
1861 while ((seg = next_segment(len, offset)) != 0) {
1862 ret = kvm_write_guest_page(kvm, gfn, data, offset, seg);
1863 if (ret < 0)
1864 return ret;
1865 offset = 0;
1866 len -= seg;
1867 data += seg;
1868 ++gfn;
1869 }
1870 return 0;
1871}
1872EXPORT_SYMBOL_GPL(kvm_write_guest);
1873
1874int kvm_vcpu_write_guest(struct kvm_vcpu *vcpu, gpa_t gpa, const void *data,
1875 unsigned long len)
1876{
1877 gfn_t gfn = gpa >> PAGE_SHIFT;
1878 int seg;
1879 int offset = offset_in_page(gpa);
1880 int ret;
1881
1882 while ((seg = next_segment(len, offset)) != 0) {
1883 ret = kvm_vcpu_write_guest_page(vcpu, gfn, data, offset, seg);
1884 if (ret < 0)
1885 return ret;
1886 offset = 0;
1887 len -= seg;
1888 data += seg;
1889 ++gfn;
1890 }
1891 return 0;
1892}
1893EXPORT_SYMBOL_GPL(kvm_vcpu_write_guest);
1894
1895static int __kvm_gfn_to_hva_cache_init(struct kvm_memslots *slots,
1896 struct gfn_to_hva_cache *ghc,
1897 gpa_t gpa, unsigned long len)
1898{
1899 int offset = offset_in_page(gpa);
1900 gfn_t start_gfn = gpa >> PAGE_SHIFT;
1901 gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
1902 gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
1903 gfn_t nr_pages_avail;
1904
1905 ghc->gpa = gpa;
1906 ghc->generation = slots->generation;
1907 ghc->len = len;
1908 ghc->memslot = __gfn_to_memslot(slots, start_gfn);
1909 ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, NULL);
1910 if (!kvm_is_error_hva(ghc->hva) && nr_pages_needed <= 1) {
1911 ghc->hva += offset;
1912 } else {
1913 /*
1914 * If the requested region crosses two memslots, we still
1915 * verify that the entire region is valid here.
1916 */
1917 while (start_gfn <= end_gfn) {
1918 nr_pages_avail = 0;
1919 ghc->memslot = __gfn_to_memslot(slots, start_gfn);
1920 ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
1921 &nr_pages_avail);
1922 if (kvm_is_error_hva(ghc->hva))
1923 return -EFAULT;
1924 start_gfn += nr_pages_avail;
1925 }
1926 /* Use the slow path for cross page reads and writes. */
1927 ghc->memslot = NULL;
1928 }
1929 return 0;
1930}
1931
1932int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1933 gpa_t gpa, unsigned long len)
1934{
1935 struct kvm_memslots *slots = kvm_memslots(kvm);
1936 return __kvm_gfn_to_hva_cache_init(slots, ghc, gpa, len);
1937}
1938EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
1939
1940int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1941 void *data, int offset, unsigned long len)
1942{
1943 struct kvm_memslots *slots = kvm_memslots(kvm);
1944 int r;
1945 gpa_t gpa = ghc->gpa + offset;
1946
1947 BUG_ON(len + offset > ghc->len);
1948
1949 if (slots->generation != ghc->generation)
1950 __kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len);
1951
1952 if (unlikely(!ghc->memslot))
1953 return kvm_write_guest(kvm, gpa, data, len);
1954
1955 if (kvm_is_error_hva(ghc->hva))
1956 return -EFAULT;
1957
1958 r = __copy_to_user((void __user *)ghc->hva + offset, data, len);
1959 if (r)
1960 return -EFAULT;
1961 mark_page_dirty_in_slot(ghc->memslot, gpa >> PAGE_SHIFT);
1962
1963 return 0;
1964}
1965EXPORT_SYMBOL_GPL(kvm_write_guest_offset_cached);
1966
1967int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1968 void *data, unsigned long len)
1969{
1970 return kvm_write_guest_offset_cached(kvm, ghc, data, 0, len);
1971}
1972EXPORT_SYMBOL_GPL(kvm_write_guest_cached);
1973
1974int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
1975 void *data, unsigned long len)
1976{
1977 struct kvm_memslots *slots = kvm_memslots(kvm);
1978 int r;
1979
1980 BUG_ON(len > ghc->len);
1981
1982 if (slots->generation != ghc->generation)
1983 __kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len);
1984
1985 if (unlikely(!ghc->memslot))
1986 return kvm_read_guest(kvm, ghc->gpa, data, len);
1987
1988 if (kvm_is_error_hva(ghc->hva))
1989 return -EFAULT;
1990
1991 r = __copy_from_user(data, (void __user *)ghc->hva, len);
1992 if (r)
1993 return -EFAULT;
1994
1995 return 0;
1996}
1997EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
1998
1999int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
2000{
2001 const void *zero_page = (const void *) __va(page_to_phys(ZERO_PAGE(0)));
2002
2003 return kvm_write_guest_page(kvm, gfn, zero_page, offset, len);
2004}
2005EXPORT_SYMBOL_GPL(kvm_clear_guest_page);
2006
2007int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len)
2008{
2009 gfn_t gfn = gpa >> PAGE_SHIFT;
2010 int seg;
2011 int offset = offset_in_page(gpa);
2012 int ret;
2013
2014 while ((seg = next_segment(len, offset)) != 0) {
2015 ret = kvm_clear_guest_page(kvm, gfn, offset, seg);
2016 if (ret < 0)
2017 return ret;
2018 offset = 0;
2019 len -= seg;
2020 ++gfn;
2021 }
2022 return 0;
2023}
2024EXPORT_SYMBOL_GPL(kvm_clear_guest);
2025
2026static void mark_page_dirty_in_slot(struct kvm_memory_slot *memslot,
2027 gfn_t gfn)
2028{
2029 if (memslot && memslot->dirty_bitmap) {
2030 unsigned long rel_gfn = gfn - memslot->base_gfn;
2031
2032 set_bit_le(rel_gfn, memslot->dirty_bitmap);
2033 }
2034}
2035
2036void mark_page_dirty(struct kvm *kvm, gfn_t gfn)
2037{
2038 struct kvm_memory_slot *memslot;
2039
2040 memslot = gfn_to_memslot(kvm, gfn);
2041 mark_page_dirty_in_slot(memslot, gfn);
2042}
2043EXPORT_SYMBOL_GPL(mark_page_dirty);
2044
2045void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu, gfn_t gfn)
2046{
2047 struct kvm_memory_slot *memslot;
2048
2049 memslot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
2050 mark_page_dirty_in_slot(memslot, gfn);
2051}
2052EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty);
2053
2054void kvm_sigset_activate(struct kvm_vcpu *vcpu)
2055{
2056 if (!vcpu->sigset_active)
2057 return;
2058
2059 /*
2060 * This does a lockless modification of ->real_blocked, which is fine
2061 * because, only current can change ->real_blocked and all readers of
2062 * ->real_blocked don't care as long ->real_blocked is always a subset
2063 * of ->blocked.
2064 */
2065 sigprocmask(SIG_SETMASK, &vcpu->sigset, ¤t->real_blocked);
2066}
2067
2068void kvm_sigset_deactivate(struct kvm_vcpu *vcpu)
2069{
2070 if (!vcpu->sigset_active)
2071 return;
2072
2073 sigprocmask(SIG_SETMASK, ¤t->real_blocked, NULL);
2074 sigemptyset(¤t->real_blocked);
2075}
2076
2077static void grow_halt_poll_ns(struct kvm_vcpu *vcpu)
2078{
2079 unsigned int old, val, grow;
2080
2081 old = val = vcpu->halt_poll_ns;
2082 grow = READ_ONCE(halt_poll_ns_grow);
2083 /* 10us base */
2084 if (val == 0 && grow)
2085 val = 10000;
2086 else
2087 val *= grow;
2088
2089 if (val > halt_poll_ns)
2090 val = halt_poll_ns;
2091
2092 vcpu->halt_poll_ns = val;
2093 trace_kvm_halt_poll_ns_grow(vcpu->vcpu_id, val, old);
2094}
2095
2096static void shrink_halt_poll_ns(struct kvm_vcpu *vcpu)
2097{
2098 unsigned int old, val, shrink;
2099
2100 old = val = vcpu->halt_poll_ns;
2101 shrink = READ_ONCE(halt_poll_ns_shrink);
2102 if (shrink == 0)
2103 val = 0;
2104 else
2105 val /= shrink;
2106
2107 vcpu->halt_poll_ns = val;
2108 trace_kvm_halt_poll_ns_shrink(vcpu->vcpu_id, val, old);
2109}
2110
2111static int kvm_vcpu_check_block(struct kvm_vcpu *vcpu)
2112{
2113 if (kvm_arch_vcpu_runnable(vcpu)) {
2114 kvm_make_request(KVM_REQ_UNHALT, vcpu);
2115 return -EINTR;
2116 }
2117 if (kvm_cpu_has_pending_timer(vcpu))
2118 return -EINTR;
2119 if (signal_pending(current))
2120 return -EINTR;
2121
2122 return 0;
2123}
2124
2125/*
2126 * The vCPU has executed a HLT instruction with in-kernel mode enabled.
2127 */
2128void kvm_vcpu_block(struct kvm_vcpu *vcpu)
2129{
2130 ktime_t start, cur;
2131 DECLARE_SWAITQUEUE(wait);
2132 bool waited = false;
2133 u64 block_ns;
2134
2135 start = cur = ktime_get();
2136 if (vcpu->halt_poll_ns) {
2137 ktime_t stop = ktime_add_ns(ktime_get(), vcpu->halt_poll_ns);
2138
2139 ++vcpu->stat.halt_attempted_poll;
2140 do {
2141 /*
2142 * This sets KVM_REQ_UNHALT if an interrupt
2143 * arrives.
2144 */
2145 if (kvm_vcpu_check_block(vcpu) < 0) {
2146 ++vcpu->stat.halt_successful_poll;
2147 if (!vcpu_valid_wakeup(vcpu))
2148 ++vcpu->stat.halt_poll_invalid;
2149 goto out;
2150 }
2151 cur = ktime_get();
2152 } while (single_task_running() && ktime_before(cur, stop));
2153 }
2154
2155 kvm_arch_vcpu_blocking(vcpu);
2156
2157 for (;;) {
2158 prepare_to_swait(&vcpu->wq, &wait, TASK_INTERRUPTIBLE);
2159
2160 if (kvm_vcpu_check_block(vcpu) < 0)
2161 break;
2162
2163 waited = true;
2164 schedule();
2165 }
2166
2167 finish_swait(&vcpu->wq, &wait);
2168 cur = ktime_get();
2169
2170 kvm_arch_vcpu_unblocking(vcpu);
2171out:
2172 block_ns = ktime_to_ns(cur) - ktime_to_ns(start);
2173
2174 if (!vcpu_valid_wakeup(vcpu))
2175 shrink_halt_poll_ns(vcpu);
2176 else if (halt_poll_ns) {
2177 if (block_ns <= vcpu->halt_poll_ns)
2178 ;
2179 /* we had a long block, shrink polling */
2180 else if (vcpu->halt_poll_ns && block_ns > halt_poll_ns)
2181 shrink_halt_poll_ns(vcpu);
2182 /* we had a short halt and our poll time is too small */
2183 else if (vcpu->halt_poll_ns < halt_poll_ns &&
2184 block_ns < halt_poll_ns)
2185 grow_halt_poll_ns(vcpu);
2186 } else
2187 vcpu->halt_poll_ns = 0;
2188
2189 trace_kvm_vcpu_wakeup(block_ns, waited, vcpu_valid_wakeup(vcpu));
2190 kvm_arch_vcpu_block_finish(vcpu);
2191}
2192EXPORT_SYMBOL_GPL(kvm_vcpu_block);
2193
2194bool kvm_vcpu_wake_up(struct kvm_vcpu *vcpu)
2195{
2196 struct swait_queue_head *wqp;
2197
2198 wqp = kvm_arch_vcpu_wq(vcpu);
2199 if (swq_has_sleeper(wqp)) {
2200 swake_up(wqp);
2201 ++vcpu->stat.halt_wakeup;
2202 return true;
2203 }
2204
2205 return false;
2206}
2207EXPORT_SYMBOL_GPL(kvm_vcpu_wake_up);
2208
2209#ifndef CONFIG_S390
2210/*
2211 * Kick a sleeping VCPU, or a guest VCPU in guest mode, into host kernel mode.
2212 */
2213void kvm_vcpu_kick(struct kvm_vcpu *vcpu)
2214{
2215 int me;
2216 int cpu = vcpu->cpu;
2217
2218 if (kvm_vcpu_wake_up(vcpu))
2219 return;
2220
2221 me = get_cpu();
2222 if (cpu != me && (unsigned)cpu < nr_cpu_ids && cpu_online(cpu))
2223 if (kvm_arch_vcpu_should_kick(vcpu))
2224 smp_send_reschedule(cpu);
2225 put_cpu();
2226}
2227EXPORT_SYMBOL_GPL(kvm_vcpu_kick);
2228#endif /* !CONFIG_S390 */
2229
2230int kvm_vcpu_yield_to(struct kvm_vcpu *target)
2231{
2232 struct pid *pid;
2233 struct task_struct *task = NULL;
2234 int ret = 0;
2235
2236 rcu_read_lock();
2237 pid = rcu_dereference(target->pid);
2238 if (pid)
2239 task = get_pid_task(pid, PIDTYPE_PID);
2240 rcu_read_unlock();
2241 if (!task)
2242 return ret;
2243 ret = yield_to(task, 1);
2244 put_task_struct(task);
2245
2246 return ret;
2247}
2248EXPORT_SYMBOL_GPL(kvm_vcpu_yield_to);
2249
2250/*
2251 * Helper that checks whether a VCPU is eligible for directed yield.
2252 * Most eligible candidate to yield is decided by following heuristics:
2253 *
2254 * (a) VCPU which has not done pl-exit or cpu relax intercepted recently
2255 * (preempted lock holder), indicated by @in_spin_loop.
2256 * Set at the beiginning and cleared at the end of interception/PLE handler.
2257 *
2258 * (b) VCPU which has done pl-exit/ cpu relax intercepted but did not get
2259 * chance last time (mostly it has become eligible now since we have probably
2260 * yielded to lockholder in last iteration. This is done by toggling
2261 * @dy_eligible each time a VCPU checked for eligibility.)
2262 *
2263 * Yielding to a recently pl-exited/cpu relax intercepted VCPU before yielding
2264 * to preempted lock-holder could result in wrong VCPU selection and CPU
2265 * burning. Giving priority for a potential lock-holder increases lock
2266 * progress.
2267 *
2268 * Since algorithm is based on heuristics, accessing another VCPU data without
2269 * locking does not harm. It may result in trying to yield to same VCPU, fail
2270 * and continue with next VCPU and so on.
2271 */
2272static bool kvm_vcpu_eligible_for_directed_yield(struct kvm_vcpu *vcpu)
2273{
2274#ifdef CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT
2275 bool eligible;
2276
2277 eligible = !vcpu->spin_loop.in_spin_loop ||
2278 vcpu->spin_loop.dy_eligible;
2279
2280 if (vcpu->spin_loop.in_spin_loop)
2281 kvm_vcpu_set_dy_eligible(vcpu, !vcpu->spin_loop.dy_eligible);
2282
2283 return eligible;
2284#else
2285 return true;
2286#endif
2287}
2288
2289void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
2290{
2291 struct kvm *kvm = me->kvm;
2292 struct kvm_vcpu *vcpu;
2293 int last_boosted_vcpu = me->kvm->last_boosted_vcpu;
2294 int yielded = 0;
2295 int try = 3;
2296 int pass;
2297 int i;
2298
2299 kvm_vcpu_set_in_spin_loop(me, true);
2300 /*
2301 * We boost the priority of a VCPU that is runnable but not
2302 * currently running, because it got preempted by something
2303 * else and called schedule in __vcpu_run. Hopefully that
2304 * VCPU is holding the lock that we need and will release it.
2305 * We approximate round-robin by starting at the last boosted VCPU.
2306 */
2307 for (pass = 0; pass < 2 && !yielded && try; pass++) {
2308 kvm_for_each_vcpu(i, vcpu, kvm) {
2309 if (!pass && i <= last_boosted_vcpu) {
2310 i = last_boosted_vcpu;
2311 continue;
2312 } else if (pass && i > last_boosted_vcpu)
2313 break;
2314 if (!READ_ONCE(vcpu->preempted))
2315 continue;
2316 if (vcpu == me)
2317 continue;
2318 if (swait_active(&vcpu->wq) && !kvm_arch_vcpu_runnable(vcpu))
2319 continue;
2320 if (yield_to_kernel_mode && !kvm_arch_vcpu_in_kernel(vcpu))
2321 continue;
2322 if (!kvm_vcpu_eligible_for_directed_yield(vcpu))
2323 continue;
2324
2325 yielded = kvm_vcpu_yield_to(vcpu);
2326 if (yielded > 0) {
2327 kvm->last_boosted_vcpu = i;
2328 break;
2329 } else if (yielded < 0) {
2330 try--;
2331 if (!try)
2332 break;
2333 }
2334 }
2335 }
2336 kvm_vcpu_set_in_spin_loop(me, false);
2337
2338 /* Ensure vcpu is not eligible during next spinloop */
2339 kvm_vcpu_set_dy_eligible(me, false);
2340}
2341EXPORT_SYMBOL_GPL(kvm_vcpu_on_spin);
2342
2343static int kvm_vcpu_fault(struct vm_fault *vmf)
2344{
2345 struct kvm_vcpu *vcpu = vmf->vma->vm_file->private_data;
2346 struct page *page;
2347
2348 if (vmf->pgoff == 0)
2349 page = virt_to_page(vcpu->run);
2350#ifdef CONFIG_X86
2351 else if (vmf->pgoff == KVM_PIO_PAGE_OFFSET)
2352 page = virt_to_page(vcpu->arch.pio_data);
2353#endif
2354#ifdef CONFIG_KVM_MMIO
2355 else if (vmf->pgoff == KVM_COALESCED_MMIO_PAGE_OFFSET)
2356 page = virt_to_page(vcpu->kvm->coalesced_mmio_ring);
2357#endif
2358 else
2359 return kvm_arch_vcpu_fault(vcpu, vmf);
2360 get_page(page);
2361 vmf->page = page;
2362 return 0;
2363}
2364
2365static const struct vm_operations_struct kvm_vcpu_vm_ops = {
2366 .fault = kvm_vcpu_fault,
2367};
2368
2369static int kvm_vcpu_mmap(struct file *file, struct vm_area_struct *vma)
2370{
2371 vma->vm_ops = &kvm_vcpu_vm_ops;
2372 return 0;
2373}
2374
2375static int kvm_vcpu_release(struct inode *inode, struct file *filp)
2376{
2377 struct kvm_vcpu *vcpu = filp->private_data;
2378
2379 debugfs_remove_recursive(vcpu->debugfs_dentry);
2380 kvm_put_kvm(vcpu->kvm);
2381 return 0;
2382}
2383
2384static struct file_operations kvm_vcpu_fops = {
2385 .release = kvm_vcpu_release,
2386 .unlocked_ioctl = kvm_vcpu_ioctl,
2387#ifdef CONFIG_KVM_COMPAT
2388 .compat_ioctl = kvm_vcpu_compat_ioctl,
2389#endif
2390 .mmap = kvm_vcpu_mmap,
2391 .llseek = noop_llseek,
2392};
2393
2394/*
2395 * Allocates an inode for the vcpu.
2396 */
2397static int create_vcpu_fd(struct kvm_vcpu *vcpu)
2398{
2399 char name[8 + 1 + ITOA_MAX_LEN + 1];
2400
2401 snprintf(name, sizeof(name), "kvm-vcpu:%d", vcpu->vcpu_id);
2402 return anon_inode_getfd(name, &kvm_vcpu_fops, vcpu, O_RDWR | O_CLOEXEC);
2403}
2404
2405static int kvm_create_vcpu_debugfs(struct kvm_vcpu *vcpu)
2406{
2407 char dir_name[ITOA_MAX_LEN * 2];
2408 int ret;
2409
2410 if (!kvm_arch_has_vcpu_debugfs())
2411 return 0;
2412
2413 if (!debugfs_initialized())
2414 return 0;
2415
2416 snprintf(dir_name, sizeof(dir_name), "vcpu%d", vcpu->vcpu_id);
2417 vcpu->debugfs_dentry = debugfs_create_dir(dir_name,
2418 vcpu->kvm->debugfs_dentry);
2419 if (!vcpu->debugfs_dentry)
2420 return -ENOMEM;
2421
2422 ret = kvm_arch_create_vcpu_debugfs(vcpu);
2423 if (ret < 0) {
2424 debugfs_remove_recursive(vcpu->debugfs_dentry);
2425 return ret;
2426 }
2427
2428 return 0;
2429}
2430
2431/*
2432 * Creates some virtual cpus. Good luck creating more than one.
2433 */
2434static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
2435{
2436 int r;
2437 struct kvm_vcpu *vcpu;
2438
2439 if (id >= KVM_MAX_VCPU_ID)
2440 return -EINVAL;
2441
2442 mutex_lock(&kvm->lock);
2443 if (kvm->created_vcpus == KVM_MAX_VCPUS) {
2444 mutex_unlock(&kvm->lock);
2445 return -EINVAL;
2446 }
2447
2448 kvm->created_vcpus++;
2449 mutex_unlock(&kvm->lock);
2450
2451 vcpu = kvm_arch_vcpu_create(kvm, id);
2452 if (IS_ERR(vcpu)) {
2453 r = PTR_ERR(vcpu);
2454 goto vcpu_decrement;
2455 }
2456
2457 preempt_notifier_init(&vcpu->preempt_notifier, &kvm_preempt_ops);
2458
2459 r = kvm_arch_vcpu_setup(vcpu);
2460 if (r)
2461 goto vcpu_destroy;
2462
2463 r = kvm_create_vcpu_debugfs(vcpu);
2464 if (r)
2465 goto vcpu_destroy;
2466
2467 mutex_lock(&kvm->lock);
2468 if (kvm_get_vcpu_by_id(kvm, id)) {
2469 r = -EEXIST;
2470 goto unlock_vcpu_destroy;
2471 }
2472
2473 BUG_ON(kvm->vcpus[atomic_read(&kvm->online_vcpus)]);
2474
2475 /* Now it's all set up, let userspace reach it */
2476 kvm_get_kvm(kvm);
2477 r = create_vcpu_fd(vcpu);
2478 if (r < 0) {
2479 kvm_put_kvm(kvm);
2480 goto unlock_vcpu_destroy;
2481 }
2482
2483 kvm->vcpus[atomic_read(&kvm->online_vcpus)] = vcpu;
2484
2485 /*
2486 * Pairs with smp_rmb() in kvm_get_vcpu. Write kvm->vcpus
2487 * before kvm->online_vcpu's incremented value.
2488 */
2489 smp_wmb();
2490 atomic_inc(&kvm->online_vcpus);
2491
2492 mutex_unlock(&kvm->lock);
2493 kvm_arch_vcpu_postcreate(vcpu);
2494 return r;
2495
2496unlock_vcpu_destroy:
2497 mutex_unlock(&kvm->lock);
2498 debugfs_remove_recursive(vcpu->debugfs_dentry);
2499vcpu_destroy:
2500 kvm_arch_vcpu_destroy(vcpu);
2501vcpu_decrement:
2502 mutex_lock(&kvm->lock);
2503 kvm->created_vcpus--;
2504 mutex_unlock(&kvm->lock);
2505 return r;
2506}
2507
2508static int kvm_vcpu_ioctl_set_sigmask(struct kvm_vcpu *vcpu, sigset_t *sigset)
2509{
2510 if (sigset) {
2511 sigdelsetmask(sigset, sigmask(SIGKILL)|sigmask(SIGSTOP));
2512 vcpu->sigset_active = 1;
2513 vcpu->sigset = *sigset;
2514 } else
2515 vcpu->sigset_active = 0;
2516 return 0;
2517}
2518
2519static long kvm_vcpu_ioctl(struct file *filp,
2520 unsigned int ioctl, unsigned long arg)
2521{
2522 struct kvm_vcpu *vcpu = filp->private_data;
2523 void __user *argp = (void __user *)arg;
2524 int r;
2525 struct kvm_fpu *fpu = NULL;
2526 struct kvm_sregs *kvm_sregs = NULL;
2527
2528 if (vcpu->kvm->mm != current->mm)
2529 return -EIO;
2530
2531 if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
2532 return -EINVAL;
2533
2534 /*
2535 * Some architectures have vcpu ioctls that are asynchronous to vcpu
2536 * execution; mutex_lock() would break them.
2537 */
2538 r = kvm_arch_vcpu_async_ioctl(filp, ioctl, arg);
2539 if (r != -ENOIOCTLCMD)
2540 return r;
2541
2542 if (mutex_lock_killable(&vcpu->mutex))
2543 return -EINTR;
2544 switch (ioctl) {
2545 case KVM_RUN: {
2546 struct pid *oldpid;
2547 r = -EINVAL;
2548 if (arg)
2549 goto out;
2550 oldpid = rcu_access_pointer(vcpu->pid);
2551 if (unlikely(oldpid != current->pids[PIDTYPE_PID].pid)) {
2552 /* The thread running this VCPU changed. */
2553 struct pid *newpid = get_task_pid(current, PIDTYPE_PID);
2554
2555 rcu_assign_pointer(vcpu->pid, newpid);
2556 if (oldpid)
2557 synchronize_rcu();
2558 put_pid(oldpid);
2559 }
2560 r = kvm_arch_vcpu_ioctl_run(vcpu, vcpu->run);
2561 trace_kvm_userspace_exit(vcpu->run->exit_reason, r);
2562 break;
2563 }
2564 case KVM_GET_REGS: {
2565 struct kvm_regs *kvm_regs;
2566
2567 r = -ENOMEM;
2568 kvm_regs = kzalloc(sizeof(struct kvm_regs), GFP_KERNEL);
2569 if (!kvm_regs)
2570 goto out;
2571 r = kvm_arch_vcpu_ioctl_get_regs(vcpu, kvm_regs);
2572 if (r)
2573 goto out_free1;
2574 r = -EFAULT;
2575 if (copy_to_user(argp, kvm_regs, sizeof(struct kvm_regs)))
2576 goto out_free1;
2577 r = 0;
2578out_free1:
2579 kfree(kvm_regs);
2580 break;
2581 }
2582 case KVM_SET_REGS: {
2583 struct kvm_regs *kvm_regs;
2584
2585 r = -ENOMEM;
2586 kvm_regs = memdup_user(argp, sizeof(*kvm_regs));
2587 if (IS_ERR(kvm_regs)) {
2588 r = PTR_ERR(kvm_regs);
2589 goto out;
2590 }
2591 r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs);
2592 kfree(kvm_regs);
2593 break;
2594 }
2595 case KVM_GET_SREGS: {
2596 kvm_sregs = kzalloc(sizeof(struct kvm_sregs), GFP_KERNEL);
2597 r = -ENOMEM;
2598 if (!kvm_sregs)
2599 goto out;
2600 r = kvm_arch_vcpu_ioctl_get_sregs(vcpu, kvm_sregs);
2601 if (r)
2602 goto out;
2603 r = -EFAULT;
2604 if (copy_to_user(argp, kvm_sregs, sizeof(struct kvm_sregs)))
2605 goto out;
2606 r = 0;
2607 break;
2608 }
2609 case KVM_SET_SREGS: {
2610 kvm_sregs = memdup_user(argp, sizeof(*kvm_sregs));
2611 if (IS_ERR(kvm_sregs)) {
2612 r = PTR_ERR(kvm_sregs);
2613 kvm_sregs = NULL;
2614 goto out;
2615 }
2616 r = kvm_arch_vcpu_ioctl_set_sregs(vcpu, kvm_sregs);
2617 break;
2618 }
2619 case KVM_GET_MP_STATE: {
2620 struct kvm_mp_state mp_state;
2621
2622 r = kvm_arch_vcpu_ioctl_get_mpstate(vcpu, &mp_state);
2623 if (r)
2624 goto out;
2625 r = -EFAULT;
2626 if (copy_to_user(argp, &mp_state, sizeof(mp_state)))
2627 goto out;
2628 r = 0;
2629 break;
2630 }
2631 case KVM_SET_MP_STATE: {
2632 struct kvm_mp_state mp_state;
2633
2634 r = -EFAULT;
2635 if (copy_from_user(&mp_state, argp, sizeof(mp_state)))
2636 goto out;
2637 r = kvm_arch_vcpu_ioctl_set_mpstate(vcpu, &mp_state);
2638 break;
2639 }
2640 case KVM_TRANSLATE: {
2641 struct kvm_translation tr;
2642
2643 r = -EFAULT;
2644 if (copy_from_user(&tr, argp, sizeof(tr)))
2645 goto out;
2646 r = kvm_arch_vcpu_ioctl_translate(vcpu, &tr);
2647 if (r)
2648 goto out;
2649 r = -EFAULT;
2650 if (copy_to_user(argp, &tr, sizeof(tr)))
2651 goto out;
2652 r = 0;
2653 break;
2654 }
2655 case KVM_SET_GUEST_DEBUG: {
2656 struct kvm_guest_debug dbg;
2657
2658 r = -EFAULT;
2659 if (copy_from_user(&dbg, argp, sizeof(dbg)))
2660 goto out;
2661 r = kvm_arch_vcpu_ioctl_set_guest_debug(vcpu, &dbg);
2662 break;
2663 }
2664 case KVM_SET_SIGNAL_MASK: {
2665 struct kvm_signal_mask __user *sigmask_arg = argp;
2666 struct kvm_signal_mask kvm_sigmask;
2667 sigset_t sigset, *p;
2668
2669 p = NULL;
2670 if (argp) {
2671 r = -EFAULT;
2672 if (copy_from_user(&kvm_sigmask, argp,
2673 sizeof(kvm_sigmask)))
2674 goto out;
2675 r = -EINVAL;
2676 if (kvm_sigmask.len != sizeof(sigset))
2677 goto out;
2678 r = -EFAULT;
2679 if (copy_from_user(&sigset, sigmask_arg->sigset,
2680 sizeof(sigset)))
2681 goto out;
2682 p = &sigset;
2683 }
2684 r = kvm_vcpu_ioctl_set_sigmask(vcpu, p);
2685 break;
2686 }
2687 case KVM_GET_FPU: {
2688 fpu = kzalloc(sizeof(struct kvm_fpu), GFP_KERNEL);
2689 r = -ENOMEM;
2690 if (!fpu)
2691 goto out;
2692 r = kvm_arch_vcpu_ioctl_get_fpu(vcpu, fpu);
2693 if (r)
2694 goto out;
2695 r = -EFAULT;
2696 if (copy_to_user(argp, fpu, sizeof(struct kvm_fpu)))
2697 goto out;
2698 r = 0;
2699 break;
2700 }
2701 case KVM_SET_FPU: {
2702 fpu = memdup_user(argp, sizeof(*fpu));
2703 if (IS_ERR(fpu)) {
2704 r = PTR_ERR(fpu);
2705 fpu = NULL;
2706 goto out;
2707 }
2708 r = kvm_arch_vcpu_ioctl_set_fpu(vcpu, fpu);
2709 break;
2710 }
2711 default:
2712 r = kvm_arch_vcpu_ioctl(filp, ioctl, arg);
2713 }
2714out:
2715 mutex_unlock(&vcpu->mutex);
2716 kfree(fpu);
2717 kfree(kvm_sregs);
2718 return r;
2719}
2720
2721#ifdef CONFIG_KVM_COMPAT
2722static long kvm_vcpu_compat_ioctl(struct file *filp,
2723 unsigned int ioctl, unsigned long arg)
2724{
2725 struct kvm_vcpu *vcpu = filp->private_data;
2726 void __user *argp = compat_ptr(arg);
2727 int r;
2728
2729 if (vcpu->kvm->mm != current->mm)
2730 return -EIO;
2731
2732 switch (ioctl) {
2733 case KVM_SET_SIGNAL_MASK: {
2734 struct kvm_signal_mask __user *sigmask_arg = argp;
2735 struct kvm_signal_mask kvm_sigmask;
2736 sigset_t sigset;
2737
2738 if (argp) {
2739 r = -EFAULT;
2740 if (copy_from_user(&kvm_sigmask, argp,
2741 sizeof(kvm_sigmask)))
2742 goto out;
2743 r = -EINVAL;
2744 if (kvm_sigmask.len != sizeof(compat_sigset_t))
2745 goto out;
2746 r = -EFAULT;
2747 if (get_compat_sigset(&sigset, (void *)sigmask_arg->sigset))
2748 goto out;
2749 r = kvm_vcpu_ioctl_set_sigmask(vcpu, &sigset);
2750 } else
2751 r = kvm_vcpu_ioctl_set_sigmask(vcpu, NULL);
2752 break;
2753 }
2754 default:
2755 r = kvm_vcpu_ioctl(filp, ioctl, arg);
2756 }
2757
2758out:
2759 return r;
2760}
2761#endif
2762
2763static int kvm_device_ioctl_attr(struct kvm_device *dev,
2764 int (*accessor)(struct kvm_device *dev,
2765 struct kvm_device_attr *attr),
2766 unsigned long arg)
2767{
2768 struct kvm_device_attr attr;
2769
2770 if (!accessor)
2771 return -EPERM;
2772
2773 if (copy_from_user(&attr, (void __user *)arg, sizeof(attr)))
2774 return -EFAULT;
2775
2776 return accessor(dev, &attr);
2777}
2778
2779static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
2780 unsigned long arg)
2781{
2782 struct kvm_device *dev = filp->private_data;
2783
2784 switch (ioctl) {
2785 case KVM_SET_DEVICE_ATTR:
2786 return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);
2787 case KVM_GET_DEVICE_ATTR:
2788 return kvm_device_ioctl_attr(dev, dev->ops->get_attr, arg);
2789 case KVM_HAS_DEVICE_ATTR:
2790 return kvm_device_ioctl_attr(dev, dev->ops->has_attr, arg);
2791 default:
2792 if (dev->ops->ioctl)
2793 return dev->ops->ioctl(dev, ioctl, arg);
2794
2795 return -ENOTTY;
2796 }
2797}
2798
2799static int kvm_device_release(struct inode *inode, struct file *filp)
2800{
2801 struct kvm_device *dev = filp->private_data;
2802 struct kvm *kvm = dev->kvm;
2803
2804 kvm_put_kvm(kvm);
2805 return 0;
2806}
2807
2808static const struct file_operations kvm_device_fops = {
2809 .unlocked_ioctl = kvm_device_ioctl,
2810#ifdef CONFIG_KVM_COMPAT
2811 .compat_ioctl = kvm_device_ioctl,
2812#endif
2813 .release = kvm_device_release,
2814};
2815
2816struct kvm_device *kvm_device_from_filp(struct file *filp)
2817{
2818 if (filp->f_op != &kvm_device_fops)
2819 return NULL;
2820
2821 return filp->private_data;
2822}
2823
2824static struct kvm_device_ops *kvm_device_ops_table[KVM_DEV_TYPE_MAX] = {
2825#ifdef CONFIG_KVM_MPIC
2826 [KVM_DEV_TYPE_FSL_MPIC_20] = &kvm_mpic_ops,
2827 [KVM_DEV_TYPE_FSL_MPIC_42] = &kvm_mpic_ops,
2828#endif
2829};
2830
2831int kvm_register_device_ops(struct kvm_device_ops *ops, u32 type)
2832{
2833 if (type >= ARRAY_SIZE(kvm_device_ops_table))
2834 return -ENOSPC;
2835
2836 if (kvm_device_ops_table[type] != NULL)
2837 return -EEXIST;
2838
2839 kvm_device_ops_table[type] = ops;
2840 return 0;
2841}
2842
2843void kvm_unregister_device_ops(u32 type)
2844{
2845 if (kvm_device_ops_table[type] != NULL)
2846 kvm_device_ops_table[type] = NULL;
2847}
2848
2849static int kvm_ioctl_create_device(struct kvm *kvm,
2850 struct kvm_create_device *cd)
2851{
2852 struct kvm_device_ops *ops = NULL;
2853 struct kvm_device *dev;
2854 bool test = cd->flags & KVM_CREATE_DEVICE_TEST;
2855 int ret;
2856
2857 if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
2858 return -ENODEV;
2859
2860 ops = kvm_device_ops_table[cd->type];
2861 if (ops == NULL)
2862 return -ENODEV;
2863
2864 if (test)
2865 return 0;
2866
2867 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
2868 if (!dev)
2869 return -ENOMEM;
2870
2871 dev->ops = ops;
2872 dev->kvm = kvm;
2873
2874 mutex_lock(&kvm->lock);
2875 ret = ops->create(dev, cd->type);
2876 if (ret < 0) {
2877 mutex_unlock(&kvm->lock);
2878 kfree(dev);
2879 return ret;
2880 }
2881 list_add(&dev->vm_node, &kvm->devices);
2882 mutex_unlock(&kvm->lock);
2883
2884 if (ops->init)
2885 ops->init(dev);
2886
2887 ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
2888 if (ret < 0) {
2889 mutex_lock(&kvm->lock);
2890 list_del(&dev->vm_node);
2891 mutex_unlock(&kvm->lock);
2892 ops->destroy(dev);
2893 return ret;
2894 }
2895
2896 kvm_get_kvm(kvm);
2897 cd->fd = ret;
2898 return 0;
2899}
2900
2901static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
2902{
2903 switch (arg) {
2904 case KVM_CAP_USER_MEMORY:
2905 case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:
2906 case KVM_CAP_JOIN_MEMORY_REGIONS_WORKS:
2907 case KVM_CAP_INTERNAL_ERROR_DATA:
2908#ifdef CONFIG_HAVE_KVM_MSI
2909 case KVM_CAP_SIGNAL_MSI:
2910#endif
2911#ifdef CONFIG_HAVE_KVM_IRQFD
2912 case KVM_CAP_IRQFD:
2913 case KVM_CAP_IRQFD_RESAMPLE:
2914#endif
2915 case KVM_CAP_IOEVENTFD_ANY_LENGTH:
2916 case KVM_CAP_CHECK_EXTENSION_VM:
2917 return 1;
2918#ifdef CONFIG_KVM_MMIO
2919 case KVM_CAP_COALESCED_MMIO:
2920 return KVM_COALESCED_MMIO_PAGE_OFFSET;
2921#endif
2922#ifdef CONFIG_HAVE_KVM_IRQ_ROUTING
2923 case KVM_CAP_IRQ_ROUTING:
2924 return KVM_MAX_IRQ_ROUTES;
2925#endif
2926#if KVM_ADDRESS_SPACE_NUM > 1
2927 case KVM_CAP_MULTI_ADDRESS_SPACE:
2928 return KVM_ADDRESS_SPACE_NUM;
2929#endif
2930 case KVM_CAP_MAX_VCPU_ID:
2931 return KVM_MAX_VCPU_ID;
2932 default:
2933 break;
2934 }
2935 return kvm_vm_ioctl_check_extension(kvm, arg);
2936}
2937
2938static long kvm_vm_ioctl(struct file *filp,
2939 unsigned int ioctl, unsigned long arg)
2940{
2941 struct kvm *kvm = filp->private_data;
2942 void __user *argp = (void __user *)arg;
2943 int r;
2944
2945 if (kvm->mm != current->mm)
2946 return -EIO;
2947 switch (ioctl) {
2948 case KVM_CREATE_VCPU:
2949 r = kvm_vm_ioctl_create_vcpu(kvm, arg);
2950 break;
2951 case KVM_SET_USER_MEMORY_REGION: {
2952 struct kvm_userspace_memory_region kvm_userspace_mem;
2953
2954 r = -EFAULT;
2955 if (copy_from_user(&kvm_userspace_mem, argp,
2956 sizeof(kvm_userspace_mem)))
2957 goto out;
2958
2959 r = kvm_vm_ioctl_set_memory_region(kvm, &kvm_userspace_mem);
2960 break;
2961 }
2962 case KVM_GET_DIRTY_LOG: {
2963 struct kvm_dirty_log log;
2964
2965 r = -EFAULT;
2966 if (copy_from_user(&log, argp, sizeof(log)))
2967 goto out;
2968 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
2969 break;
2970 }
2971#ifdef CONFIG_KVM_MMIO
2972 case KVM_REGISTER_COALESCED_MMIO: {
2973 struct kvm_coalesced_mmio_zone zone;
2974
2975 r = -EFAULT;
2976 if (copy_from_user(&zone, argp, sizeof(zone)))
2977 goto out;
2978 r = kvm_vm_ioctl_register_coalesced_mmio(kvm, &zone);
2979 break;
2980 }
2981 case KVM_UNREGISTER_COALESCED_MMIO: {
2982 struct kvm_coalesced_mmio_zone zone;
2983
2984 r = -EFAULT;
2985 if (copy_from_user(&zone, argp, sizeof(zone)))
2986 goto out;
2987 r = kvm_vm_ioctl_unregister_coalesced_mmio(kvm, &zone);
2988 break;
2989 }
2990#endif
2991 case KVM_IRQFD: {
2992 struct kvm_irqfd data;
2993
2994 r = -EFAULT;
2995 if (copy_from_user(&data, argp, sizeof(data)))
2996 goto out;
2997 r = kvm_irqfd(kvm, &data);
2998 break;
2999 }
3000 case KVM_IOEVENTFD: {
3001 struct kvm_ioeventfd data;
3002
3003 r = -EFAULT;
3004 if (copy_from_user(&data, argp, sizeof(data)))
3005 goto out;
3006 r = kvm_ioeventfd(kvm, &data);
3007 break;
3008 }
3009#ifdef CONFIG_HAVE_KVM_MSI
3010 case KVM_SIGNAL_MSI: {
3011 struct kvm_msi msi;
3012
3013 r = -EFAULT;
3014 if (copy_from_user(&msi, argp, sizeof(msi)))
3015 goto out;
3016 r = kvm_send_userspace_msi(kvm, &msi);
3017 break;
3018 }
3019#endif
3020#ifdef __KVM_HAVE_IRQ_LINE
3021 case KVM_IRQ_LINE_STATUS:
3022 case KVM_IRQ_LINE: {
3023 struct kvm_irq_level irq_event;
3024
3025 r = -EFAULT;
3026 if (copy_from_user(&irq_event, argp, sizeof(irq_event)))
3027 goto out;
3028
3029 r = kvm_vm_ioctl_irq_line(kvm, &irq_event,
3030 ioctl == KVM_IRQ_LINE_STATUS);
3031 if (r)
3032 goto out;
3033
3034 r = -EFAULT;
3035 if (ioctl == KVM_IRQ_LINE_STATUS) {
3036 if (copy_to_user(argp, &irq_event, sizeof(irq_event)))
3037 goto out;
3038 }
3039
3040 r = 0;
3041 break;
3042 }
3043#endif
3044#ifdef CONFIG_HAVE_KVM_IRQ_ROUTING
3045 case KVM_SET_GSI_ROUTING: {
3046 struct kvm_irq_routing routing;
3047 struct kvm_irq_routing __user *urouting;
3048 struct kvm_irq_routing_entry *entries = NULL;
3049
3050 r = -EFAULT;
3051 if (copy_from_user(&routing, argp, sizeof(routing)))
3052 goto out;
3053 r = -EINVAL;
3054 if (!kvm_arch_can_set_irq_routing(kvm))
3055 goto out;
3056 if (routing.nr > KVM_MAX_IRQ_ROUTES)
3057 goto out;
3058 if (routing.flags)
3059 goto out;
3060 if (routing.nr) {
3061 r = -ENOMEM;
3062 entries = vmalloc(routing.nr * sizeof(*entries));
3063 if (!entries)
3064 goto out;
3065 r = -EFAULT;
3066 urouting = argp;
3067 if (copy_from_user(entries, urouting->entries,
3068 routing.nr * sizeof(*entries)))
3069 goto out_free_irq_routing;
3070 }
3071 r = kvm_set_irq_routing(kvm, entries, routing.nr,
3072 routing.flags);
3073out_free_irq_routing:
3074 vfree(entries);
3075 break;
3076 }
3077#endif /* CONFIG_HAVE_KVM_IRQ_ROUTING */
3078 case KVM_CREATE_DEVICE: {
3079 struct kvm_create_device cd;
3080
3081 r = -EFAULT;
3082 if (copy_from_user(&cd, argp, sizeof(cd)))
3083 goto out;
3084
3085 r = kvm_ioctl_create_device(kvm, &cd);
3086 if (r)
3087 goto out;
3088
3089 r = -EFAULT;
3090 if (copy_to_user(argp, &cd, sizeof(cd)))
3091 goto out;
3092
3093 r = 0;
3094 break;
3095 }
3096 case KVM_CHECK_EXTENSION:
3097 r = kvm_vm_ioctl_check_extension_generic(kvm, arg);
3098 break;
3099 default:
3100 r = kvm_arch_vm_ioctl(filp, ioctl, arg);
3101 }
3102out:
3103 return r;
3104}
3105
3106#ifdef CONFIG_KVM_COMPAT
3107struct compat_kvm_dirty_log {
3108 __u32 slot;
3109 __u32 padding1;
3110 union {
3111 compat_uptr_t dirty_bitmap; /* one bit per page */
3112 __u64 padding2;
3113 };
3114};
3115
3116static long kvm_vm_compat_ioctl(struct file *filp,
3117 unsigned int ioctl, unsigned long arg)
3118{
3119 struct kvm *kvm = filp->private_data;
3120 int r;
3121
3122 if (kvm->mm != current->mm)
3123 return -EIO;
3124 switch (ioctl) {
3125 case KVM_GET_DIRTY_LOG: {
3126 struct compat_kvm_dirty_log compat_log;
3127 struct kvm_dirty_log log;
3128
3129 if (copy_from_user(&compat_log, (void __user *)arg,
3130 sizeof(compat_log)))
3131 return -EFAULT;
3132 log.slot = compat_log.slot;
3133 log.padding1 = compat_log.padding1;
3134 log.padding2 = compat_log.padding2;
3135 log.dirty_bitmap = compat_ptr(compat_log.dirty_bitmap);
3136
3137 r = kvm_vm_ioctl_get_dirty_log(kvm, &log);
3138 break;
3139 }
3140 default:
3141 r = kvm_vm_ioctl(filp, ioctl, arg);
3142 }
3143 return r;
3144}
3145#endif
3146
3147static struct file_operations kvm_vm_fops = {
3148 .release = kvm_vm_release,
3149 .unlocked_ioctl = kvm_vm_ioctl,
3150#ifdef CONFIG_KVM_COMPAT
3151 .compat_ioctl = kvm_vm_compat_ioctl,
3152#endif
3153 .llseek = noop_llseek,
3154};
3155
3156static int kvm_dev_ioctl_create_vm(unsigned long type)
3157{
3158 int r;
3159 struct kvm *kvm;
3160 struct file *file;
3161
3162 kvm = kvm_create_vm(type);
3163 if (IS_ERR(kvm))
3164 return PTR_ERR(kvm);
3165#ifdef CONFIG_KVM_MMIO
3166 r = kvm_coalesced_mmio_init(kvm);
3167 if (r < 0)
3168 goto put_kvm;
3169#endif
3170 r = get_unused_fd_flags(O_CLOEXEC);
3171 if (r < 0)
3172 goto put_kvm;
3173
3174 file = anon_inode_getfile("kvm-vm", &kvm_vm_fops, kvm, O_RDWR);
3175 if (IS_ERR(file)) {
3176 put_unused_fd(r);
3177 r = PTR_ERR(file);
3178 goto put_kvm;
3179 }
3180
3181 /*
3182 * Don't call kvm_put_kvm anymore at this point; file->f_op is
3183 * already set, with ->release() being kvm_vm_release(). In error
3184 * cases it will be called by the final fput(file) and will take
3185 * care of doing kvm_put_kvm(kvm).
3186 */
3187 if (kvm_create_vm_debugfs(kvm, r) < 0) {
3188 put_unused_fd(r);
3189 fput(file);
3190 return -ENOMEM;
3191 }
3192 kvm_uevent_notify_change(KVM_EVENT_CREATE_VM, kvm);
3193
3194 fd_install(r, file);
3195 return r;
3196
3197put_kvm:
3198 kvm_put_kvm(kvm);
3199 return r;
3200}
3201
3202static long kvm_dev_ioctl(struct file *filp,
3203 unsigned int ioctl, unsigned long arg)
3204{
3205 long r = -EINVAL;
3206
3207 switch (ioctl) {
3208 case KVM_GET_API_VERSION:
3209 if (arg)
3210 goto out;
3211 r = KVM_API_VERSION;
3212 break;
3213 case KVM_CREATE_VM:
3214 r = kvm_dev_ioctl_create_vm(arg);
3215 break;
3216 case KVM_CHECK_EXTENSION:
3217 r = kvm_vm_ioctl_check_extension_generic(NULL, arg);
3218 break;
3219 case KVM_GET_VCPU_MMAP_SIZE:
3220 if (arg)
3221 goto out;
3222 r = PAGE_SIZE; /* struct kvm_run */
3223#ifdef CONFIG_X86
3224 r += PAGE_SIZE; /* pio data page */
3225#endif
3226#ifdef CONFIG_KVM_MMIO
3227 r += PAGE_SIZE; /* coalesced mmio ring page */
3228#endif
3229 break;
3230 case KVM_TRACE_ENABLE:
3231 case KVM_TRACE_PAUSE:
3232 case KVM_TRACE_DISABLE:
3233 r = -EOPNOTSUPP;
3234 break;
3235 default:
3236 return kvm_arch_dev_ioctl(filp, ioctl, arg);
3237 }
3238out:
3239 return r;
3240}
3241
3242static struct file_operations kvm_chardev_ops = {
3243 .unlocked_ioctl = kvm_dev_ioctl,
3244 .compat_ioctl = kvm_dev_ioctl,
3245 .llseek = noop_llseek,
3246};
3247
3248static struct miscdevice kvm_dev = {
3249 KVM_MINOR,
3250 "kvm",
3251 &kvm_chardev_ops,
3252};
3253
3254static void hardware_enable_nolock(void *junk)
3255{
3256 int cpu = raw_smp_processor_id();
3257 int r;
3258
3259 if (cpumask_test_cpu(cpu, cpus_hardware_enabled))
3260 return;
3261
3262 cpumask_set_cpu(cpu, cpus_hardware_enabled);
3263
3264 r = kvm_arch_hardware_enable();
3265
3266 if (r) {
3267 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
3268 atomic_inc(&hardware_enable_failed);
3269 pr_info("kvm: enabling virtualization on CPU%d failed\n", cpu);
3270 }
3271}
3272
3273static int kvm_starting_cpu(unsigned int cpu)
3274{
3275 raw_spin_lock(&kvm_count_lock);
3276 if (kvm_usage_count)
3277 hardware_enable_nolock(NULL);
3278 raw_spin_unlock(&kvm_count_lock);
3279 return 0;
3280}
3281
3282static void hardware_disable_nolock(void *junk)
3283{
3284 int cpu = raw_smp_processor_id();
3285
3286 if (!cpumask_test_cpu(cpu, cpus_hardware_enabled))
3287 return;
3288 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
3289 kvm_arch_hardware_disable();
3290}
3291
3292static int kvm_dying_cpu(unsigned int cpu)
3293{
3294 raw_spin_lock(&kvm_count_lock);
3295 if (kvm_usage_count)
3296 hardware_disable_nolock(NULL);
3297 raw_spin_unlock(&kvm_count_lock);
3298 return 0;
3299}
3300
3301static void hardware_disable_all_nolock(void)
3302{
3303 BUG_ON(!kvm_usage_count);
3304
3305 kvm_usage_count--;
3306 if (!kvm_usage_count)
3307 on_each_cpu(hardware_disable_nolock, NULL, 1);
3308}
3309
3310static void hardware_disable_all(void)
3311{
3312 raw_spin_lock(&kvm_count_lock);
3313 hardware_disable_all_nolock();
3314 raw_spin_unlock(&kvm_count_lock);
3315}
3316
3317static int hardware_enable_all(void)
3318{
3319 int r = 0;
3320
3321 raw_spin_lock(&kvm_count_lock);
3322
3323 kvm_usage_count++;
3324 if (kvm_usage_count == 1) {
3325 atomic_set(&hardware_enable_failed, 0);
3326 on_each_cpu(hardware_enable_nolock, NULL, 1);
3327
3328 if (atomic_read(&hardware_enable_failed)) {
3329 hardware_disable_all_nolock();
3330 r = -EBUSY;
3331 }
3332 }
3333
3334 raw_spin_unlock(&kvm_count_lock);
3335
3336 return r;
3337}
3338
3339static int kvm_reboot(struct notifier_block *notifier, unsigned long val,
3340 void *v)
3341{
3342 /*
3343 * Some (well, at least mine) BIOSes hang on reboot if
3344 * in vmx root mode.
3345 *
3346 * And Intel TXT required VMX off for all cpu when system shutdown.
3347 */
3348 pr_info("kvm: exiting hardware virtualization\n");
3349 kvm_rebooting = true;
3350 on_each_cpu(hardware_disable_nolock, NULL, 1);
3351 return NOTIFY_OK;
3352}
3353
3354static struct notifier_block kvm_reboot_notifier = {
3355 .notifier_call = kvm_reboot,
3356 .priority = 0,
3357};
3358
3359static void kvm_io_bus_destroy(struct kvm_io_bus *bus)
3360{
3361 int i;
3362
3363 for (i = 0; i < bus->dev_count; i++) {
3364 struct kvm_io_device *pos = bus->range[i].dev;
3365
3366 kvm_iodevice_destructor(pos);
3367 }
3368 kfree(bus);
3369}
3370
3371static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1,
3372 const struct kvm_io_range *r2)
3373{
3374 gpa_t addr1 = r1->addr;
3375 gpa_t addr2 = r2->addr;
3376
3377 if (addr1 < addr2)
3378 return -1;
3379
3380 /* If r2->len == 0, match the exact address. If r2->len != 0,
3381 * accept any overlapping write. Any order is acceptable for
3382 * overlapping ranges, because kvm_io_bus_get_first_dev ensures
3383 * we process all of them.
3384 */
3385 if (r2->len) {
3386 addr1 += r1->len;
3387 addr2 += r2->len;
3388 }
3389
3390 if (addr1 > addr2)
3391 return 1;
3392
3393 return 0;
3394}
3395
3396static int kvm_io_bus_sort_cmp(const void *p1, const void *p2)
3397{
3398 return kvm_io_bus_cmp(p1, p2);
3399}
3400
3401static int kvm_io_bus_get_first_dev(struct kvm_io_bus *bus,
3402 gpa_t addr, int len)
3403{
3404 struct kvm_io_range *range, key;
3405 int off;
3406
3407 key = (struct kvm_io_range) {
3408 .addr = addr,
3409 .len = len,
3410 };
3411
3412 range = bsearch(&key, bus->range, bus->dev_count,
3413 sizeof(struct kvm_io_range), kvm_io_bus_sort_cmp);
3414 if (range == NULL)
3415 return -ENOENT;
3416
3417 off = range - bus->range;
3418
3419 while (off > 0 && kvm_io_bus_cmp(&key, &bus->range[off-1]) == 0)
3420 off--;
3421
3422 return off;
3423}
3424
3425static int __kvm_io_bus_write(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
3426 struct kvm_io_range *range, const void *val)
3427{
3428 int idx;
3429
3430 idx = kvm_io_bus_get_first_dev(bus, range->addr, range->len);
3431 if (idx < 0)
3432 return -EOPNOTSUPP;
3433
3434 while (idx < bus->dev_count &&
3435 kvm_io_bus_cmp(range, &bus->range[idx]) == 0) {
3436 if (!kvm_iodevice_write(vcpu, bus->range[idx].dev, range->addr,
3437 range->len, val))
3438 return idx;
3439 idx++;
3440 }
3441
3442 return -EOPNOTSUPP;
3443}
3444
3445/* kvm_io_bus_write - called under kvm->slots_lock */
3446int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
3447 int len, const void *val)
3448{
3449 struct kvm_io_bus *bus;
3450 struct kvm_io_range range;
3451 int r;
3452
3453 range = (struct kvm_io_range) {
3454 .addr = addr,
3455 .len = len,
3456 };
3457
3458 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3459 if (!bus)
3460 return -ENOMEM;
3461 r = __kvm_io_bus_write(vcpu, bus, &range, val);
3462 return r < 0 ? r : 0;
3463}
3464
3465/* kvm_io_bus_write_cookie - called under kvm->slots_lock */
3466int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
3467 gpa_t addr, int len, const void *val, long cookie)
3468{
3469 struct kvm_io_bus *bus;
3470 struct kvm_io_range range;
3471
3472 range = (struct kvm_io_range) {
3473 .addr = addr,
3474 .len = len,
3475 };
3476
3477 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3478 if (!bus)
3479 return -ENOMEM;
3480
3481 /* First try the device referenced by cookie. */
3482 if ((cookie >= 0) && (cookie < bus->dev_count) &&
3483 (kvm_io_bus_cmp(&range, &bus->range[cookie]) == 0))
3484 if (!kvm_iodevice_write(vcpu, bus->range[cookie].dev, addr, len,
3485 val))
3486 return cookie;
3487
3488 /*
3489 * cookie contained garbage; fall back to search and return the
3490 * correct cookie value.
3491 */
3492 return __kvm_io_bus_write(vcpu, bus, &range, val);
3493}
3494
3495static int __kvm_io_bus_read(struct kvm_vcpu *vcpu, struct kvm_io_bus *bus,
3496 struct kvm_io_range *range, void *val)
3497{
3498 int idx;
3499
3500 idx = kvm_io_bus_get_first_dev(bus, range->addr, range->len);
3501 if (idx < 0)
3502 return -EOPNOTSUPP;
3503
3504 while (idx < bus->dev_count &&
3505 kvm_io_bus_cmp(range, &bus->range[idx]) == 0) {
3506 if (!kvm_iodevice_read(vcpu, bus->range[idx].dev, range->addr,
3507 range->len, val))
3508 return idx;
3509 idx++;
3510 }
3511
3512 return -EOPNOTSUPP;
3513}
3514EXPORT_SYMBOL_GPL(kvm_io_bus_write);
3515
3516/* kvm_io_bus_read - called under kvm->slots_lock */
3517int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
3518 int len, void *val)
3519{
3520 struct kvm_io_bus *bus;
3521 struct kvm_io_range range;
3522 int r;
3523
3524 range = (struct kvm_io_range) {
3525 .addr = addr,
3526 .len = len,
3527 };
3528
3529 bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
3530 if (!bus)
3531 return -ENOMEM;
3532 r = __kvm_io_bus_read(vcpu, bus, &range, val);
3533 return r < 0 ? r : 0;
3534}
3535
3536
3537/* Caller must hold slots_lock. */
3538int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
3539 int len, struct kvm_io_device *dev)
3540{
3541 int i;
3542 struct kvm_io_bus *new_bus, *bus;
3543 struct kvm_io_range range;
3544
3545 bus = kvm_get_bus(kvm, bus_idx);
3546 if (!bus)
3547 return -ENOMEM;
3548
3549 /* exclude ioeventfd which is limited by maximum fd */
3550 if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
3551 return -ENOSPC;
3552
3553 new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count + 1) *
3554 sizeof(struct kvm_io_range)), GFP_KERNEL);
3555 if (!new_bus)
3556 return -ENOMEM;
3557
3558 range = (struct kvm_io_range) {
3559 .addr = addr,
3560 .len = len,
3561 .dev = dev,
3562 };
3563
3564 for (i = 0; i < bus->dev_count; i++)
3565 if (kvm_io_bus_cmp(&bus->range[i], &range) > 0)
3566 break;
3567
3568 memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
3569 new_bus->dev_count++;
3570 new_bus->range[i] = range;
3571 memcpy(new_bus->range + i + 1, bus->range + i,
3572 (bus->dev_count - i) * sizeof(struct kvm_io_range));
3573 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
3574 synchronize_srcu_expedited(&kvm->srcu);
3575 kfree(bus);
3576
3577 return 0;
3578}
3579
3580/* Caller must hold slots_lock. */
3581void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
3582 struct kvm_io_device *dev)
3583{
3584 int i;
3585 struct kvm_io_bus *new_bus, *bus;
3586
3587 bus = kvm_get_bus(kvm, bus_idx);
3588 if (!bus)
3589 return;
3590
3591 for (i = 0; i < bus->dev_count; i++)
3592 if (bus->range[i].dev == dev) {
3593 break;
3594 }
3595
3596 if (i == bus->dev_count)
3597 return;
3598
3599 new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
3600 sizeof(struct kvm_io_range)), GFP_KERNEL);
3601 if (!new_bus) {
3602 pr_err("kvm: failed to shrink bus, removing it completely\n");
3603 goto broken;
3604 }
3605
3606 memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
3607 new_bus->dev_count--;
3608 memcpy(new_bus->range + i, bus->range + i + 1,
3609 (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
3610
3611broken:
3612 rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
3613 synchronize_srcu_expedited(&kvm->srcu);
3614 kfree(bus);
3615 return;
3616}
3617
3618struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
3619 gpa_t addr)
3620{
3621 struct kvm_io_bus *bus;
3622 int dev_idx, srcu_idx;
3623 struct kvm_io_device *iodev = NULL;
3624
3625 srcu_idx = srcu_read_lock(&kvm->srcu);
3626
3627 bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
3628 if (!bus)
3629 goto out_unlock;
3630
3631 dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
3632 if (dev_idx < 0)
3633 goto out_unlock;
3634
3635 iodev = bus->range[dev_idx].dev;
3636
3637out_unlock:
3638 srcu_read_unlock(&kvm->srcu, srcu_idx);
3639
3640 return iodev;
3641}
3642EXPORT_SYMBOL_GPL(kvm_io_bus_get_dev);
3643
3644static int kvm_debugfs_open(struct inode *inode, struct file *file,
3645 int (*get)(void *, u64 *), int (*set)(void *, u64),
3646 const char *fmt)
3647{
3648 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)
3649 inode->i_private;
3650
3651 /* The debugfs files are a reference to the kvm struct which
3652 * is still valid when kvm_destroy_vm is called.
3653 * To avoid the race between open and the removal of the debugfs
3654 * directory we test against the users count.
3655 */
3656 if (!refcount_inc_not_zero(&stat_data->kvm->users_count))
3657 return -ENOENT;
3658
3659 if (simple_attr_open(inode, file, get, set, fmt)) {
3660 kvm_put_kvm(stat_data->kvm);
3661 return -ENOMEM;
3662 }
3663
3664 return 0;
3665}
3666
3667static int kvm_debugfs_release(struct inode *inode, struct file *file)
3668{
3669 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)
3670 inode->i_private;
3671
3672 simple_attr_release(inode, file);
3673 kvm_put_kvm(stat_data->kvm);
3674
3675 return 0;
3676}
3677
3678static int vm_stat_get_per_vm(void *data, u64 *val)
3679{
3680 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3681
3682 *val = *(ulong *)((void *)stat_data->kvm + stat_data->offset);
3683
3684 return 0;
3685}
3686
3687static int vm_stat_clear_per_vm(void *data, u64 val)
3688{
3689 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3690
3691 if (val)
3692 return -EINVAL;
3693
3694 *(ulong *)((void *)stat_data->kvm + stat_data->offset) = 0;
3695
3696 return 0;
3697}
3698
3699static int vm_stat_get_per_vm_open(struct inode *inode, struct file *file)
3700{
3701 __simple_attr_check_format("%llu\n", 0ull);
3702 return kvm_debugfs_open(inode, file, vm_stat_get_per_vm,
3703 vm_stat_clear_per_vm, "%llu\n");
3704}
3705
3706static const struct file_operations vm_stat_get_per_vm_fops = {
3707 .owner = THIS_MODULE,
3708 .open = vm_stat_get_per_vm_open,
3709 .release = kvm_debugfs_release,
3710 .read = simple_attr_read,
3711 .write = simple_attr_write,
3712 .llseek = no_llseek,
3713};
3714
3715static int vcpu_stat_get_per_vm(void *data, u64 *val)
3716{
3717 int i;
3718 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3719 struct kvm_vcpu *vcpu;
3720
3721 *val = 0;
3722
3723 kvm_for_each_vcpu(i, vcpu, stat_data->kvm)
3724 *val += *(u64 *)((void *)vcpu + stat_data->offset);
3725
3726 return 0;
3727}
3728
3729static int vcpu_stat_clear_per_vm(void *data, u64 val)
3730{
3731 int i;
3732 struct kvm_stat_data *stat_data = (struct kvm_stat_data *)data;
3733 struct kvm_vcpu *vcpu;
3734
3735 if (val)
3736 return -EINVAL;
3737
3738 kvm_for_each_vcpu(i, vcpu, stat_data->kvm)
3739 *(u64 *)((void *)vcpu + stat_data->offset) = 0;
3740
3741 return 0;
3742}
3743
3744static int vcpu_stat_get_per_vm_open(struct inode *inode, struct file *file)
3745{
3746 __simple_attr_check_format("%llu\n", 0ull);
3747 return kvm_debugfs_open(inode, file, vcpu_stat_get_per_vm,
3748 vcpu_stat_clear_per_vm, "%llu\n");
3749}
3750
3751static const struct file_operations vcpu_stat_get_per_vm_fops = {
3752 .owner = THIS_MODULE,
3753 .open = vcpu_stat_get_per_vm_open,
3754 .release = kvm_debugfs_release,
3755 .read = simple_attr_read,
3756 .write = simple_attr_write,
3757 .llseek = no_llseek,
3758};
3759
3760static const struct file_operations *stat_fops_per_vm[] = {
3761 [KVM_STAT_VCPU] = &vcpu_stat_get_per_vm_fops,
3762 [KVM_STAT_VM] = &vm_stat_get_per_vm_fops,
3763};
3764
3765static int vm_stat_get(void *_offset, u64 *val)
3766{
3767 unsigned offset = (long)_offset;
3768 struct kvm *kvm;
3769 struct kvm_stat_data stat_tmp = {.offset = offset};
3770 u64 tmp_val;
3771
3772 *val = 0;
3773 spin_lock(&kvm_lock);
3774 list_for_each_entry(kvm, &vm_list, vm_list) {
3775 stat_tmp.kvm = kvm;
3776 vm_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
3777 *val += tmp_val;
3778 }
3779 spin_unlock(&kvm_lock);
3780 return 0;
3781}
3782
3783static int vm_stat_clear(void *_offset, u64 val)
3784{
3785 unsigned offset = (long)_offset;
3786 struct kvm *kvm;
3787 struct kvm_stat_data stat_tmp = {.offset = offset};
3788
3789 if (val)
3790 return -EINVAL;
3791
3792 spin_lock(&kvm_lock);
3793 list_for_each_entry(kvm, &vm_list, vm_list) {
3794 stat_tmp.kvm = kvm;
3795 vm_stat_clear_per_vm((void *)&stat_tmp, 0);
3796 }
3797 spin_unlock(&kvm_lock);
3798
3799 return 0;
3800}
3801
3802DEFINE_SIMPLE_ATTRIBUTE(vm_stat_fops, vm_stat_get, vm_stat_clear, "%llu\n");
3803
3804static int vcpu_stat_get(void *_offset, u64 *val)
3805{
3806 unsigned offset = (long)_offset;
3807 struct kvm *kvm;
3808 struct kvm_stat_data stat_tmp = {.offset = offset};
3809 u64 tmp_val;
3810
3811 *val = 0;
3812 spin_lock(&kvm_lock);
3813 list_for_each_entry(kvm, &vm_list, vm_list) {
3814 stat_tmp.kvm = kvm;
3815 vcpu_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
3816 *val += tmp_val;
3817 }
3818 spin_unlock(&kvm_lock);
3819 return 0;
3820}
3821
3822static int vcpu_stat_clear(void *_offset, u64 val)
3823{
3824 unsigned offset = (long)_offset;
3825 struct kvm *kvm;
3826 struct kvm_stat_data stat_tmp = {.offset = offset};
3827
3828 if (val)
3829 return -EINVAL;
3830
3831 spin_lock(&kvm_lock);
3832 list_for_each_entry(kvm, &vm_list, vm_list) {
3833 stat_tmp.kvm = kvm;
3834 vcpu_stat_clear_per_vm((void *)&stat_tmp, 0);
3835 }
3836 spin_unlock(&kvm_lock);
3837
3838 return 0;
3839}
3840
3841DEFINE_SIMPLE_ATTRIBUTE(vcpu_stat_fops, vcpu_stat_get, vcpu_stat_clear,
3842 "%llu\n");
3843
3844static const struct file_operations *stat_fops[] = {
3845 [KVM_STAT_VCPU] = &vcpu_stat_fops,
3846 [KVM_STAT_VM] = &vm_stat_fops,
3847};
3848
3849static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
3850{
3851 struct kobj_uevent_env *env;
3852 unsigned long long created, active;
3853
3854 if (!kvm_dev.this_device || !kvm)
3855 return;
3856
3857 spin_lock(&kvm_lock);
3858 if (type == KVM_EVENT_CREATE_VM) {
3859 kvm_createvm_count++;
3860 kvm_active_vms++;
3861 } else if (type == KVM_EVENT_DESTROY_VM) {
3862 kvm_active_vms--;
3863 }
3864 created = kvm_createvm_count;
3865 active = kvm_active_vms;
3866 spin_unlock(&kvm_lock);
3867
3868 env = kzalloc(sizeof(*env), GFP_KERNEL);
3869 if (!env)
3870 return;
3871
3872 add_uevent_var(env, "CREATED=%llu", created);
3873 add_uevent_var(env, "COUNT=%llu", active);
3874
3875 if (type == KVM_EVENT_CREATE_VM) {
3876 add_uevent_var(env, "EVENT=create");
3877 kvm->userspace_pid = task_pid_nr(current);
3878 } else if (type == KVM_EVENT_DESTROY_VM) {
3879 add_uevent_var(env, "EVENT=destroy");
3880 }
3881 add_uevent_var(env, "PID=%d", kvm->userspace_pid);
3882
3883 if (kvm->debugfs_dentry) {
3884 char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL);
3885
3886 if (p) {
3887 tmp = dentry_path_raw(kvm->debugfs_dentry, p, PATH_MAX);
3888 if (!IS_ERR(tmp))
3889 add_uevent_var(env, "STATS_PATH=%s", tmp);
3890 kfree(p);
3891 }
3892 }
3893 /* no need for checks, since we are adding at most only 5 keys */
3894 env->envp[env->envp_idx++] = NULL;
3895 kobject_uevent_env(&kvm_dev.this_device->kobj, KOBJ_CHANGE, env->envp);
3896 kfree(env);
3897}
3898
3899static int kvm_init_debug(void)
3900{
3901 int r = -EEXIST;
3902 struct kvm_stats_debugfs_item *p;
3903
3904 kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);
3905 if (kvm_debugfs_dir == NULL)
3906 goto out;
3907
3908 kvm_debugfs_num_entries = 0;
3909 for (p = debugfs_entries; p->name; ++p, kvm_debugfs_num_entries++) {
3910 if (!debugfs_create_file(p->name, 0644, kvm_debugfs_dir,
3911 (void *)(long)p->offset,
3912 stat_fops[p->kind]))
3913 goto out_dir;
3914 }
3915
3916 return 0;
3917
3918out_dir:
3919 debugfs_remove_recursive(kvm_debugfs_dir);
3920out:
3921 return r;
3922}
3923
3924static int kvm_suspend(void)
3925{
3926 if (kvm_usage_count)
3927 hardware_disable_nolock(NULL);
3928 return 0;
3929}
3930
3931static void kvm_resume(void)
3932{
3933 if (kvm_usage_count) {
3934 WARN_ON(raw_spin_is_locked(&kvm_count_lock));
3935 hardware_enable_nolock(NULL);
3936 }
3937}
3938
3939static struct syscore_ops kvm_syscore_ops = {
3940 .suspend = kvm_suspend,
3941 .resume = kvm_resume,
3942};
3943
3944static inline
3945struct kvm_vcpu *preempt_notifier_to_vcpu(struct preempt_notifier *pn)
3946{
3947 return container_of(pn, struct kvm_vcpu, preempt_notifier);
3948}
3949
3950static void kvm_sched_in(struct preempt_notifier *pn, int cpu)
3951{
3952 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
3953
3954 if (vcpu->preempted)
3955 vcpu->preempted = false;
3956
3957 kvm_arch_sched_in(vcpu, cpu);
3958
3959 kvm_arch_vcpu_load(vcpu, cpu);
3960}
3961
3962static void kvm_sched_out(struct preempt_notifier *pn,
3963 struct task_struct *next)
3964{
3965 struct kvm_vcpu *vcpu = preempt_notifier_to_vcpu(pn);
3966
3967 if (current->state == TASK_RUNNING)
3968 vcpu->preempted = true;
3969 kvm_arch_vcpu_put(vcpu);
3970}
3971
3972int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
3973 struct module *module)
3974{
3975 int r;
3976 int cpu;
3977
3978 r = kvm_arch_init(opaque);
3979 if (r)
3980 goto out_fail;
3981
3982 /*
3983 * kvm_arch_init makes sure there's at most one caller
3984 * for architectures that support multiple implementations,
3985 * like intel and amd on x86.
3986 * kvm_arch_init must be called before kvm_irqfd_init to avoid creating
3987 * conflicts in case kvm is already setup for another implementation.
3988 */
3989 r = kvm_irqfd_init();
3990 if (r)
3991 goto out_irqfd;
3992
3993 if (!zalloc_cpumask_var(&cpus_hardware_enabled, GFP_KERNEL)) {
3994 r = -ENOMEM;
3995 goto out_free_0;
3996 }
3997
3998 r = kvm_arch_hardware_setup();
3999 if (r < 0)
4000 goto out_free_0a;
4001
4002 for_each_online_cpu(cpu) {
4003 smp_call_function_single(cpu,
4004 kvm_arch_check_processor_compat,
4005 &r, 1);
4006 if (r < 0)
4007 goto out_free_1;
4008 }
4009
4010 r = cpuhp_setup_state_nocalls(CPUHP_AP_KVM_STARTING, "kvm/cpu:starting",
4011 kvm_starting_cpu, kvm_dying_cpu);
4012 if (r)
4013 goto out_free_2;
4014 register_reboot_notifier(&kvm_reboot_notifier);
4015
4016 /* A kmem cache lets us meet the alignment requirements of fx_save. */
4017 if (!vcpu_align)
4018 vcpu_align = __alignof__(struct kvm_vcpu);
4019 kvm_vcpu_cache =
4020 kmem_cache_create_usercopy("kvm_vcpu", vcpu_size, vcpu_align,
4021 SLAB_ACCOUNT,
4022 offsetof(struct kvm_vcpu, arch),
4023 sizeof_field(struct kvm_vcpu, arch),
4024 NULL);
4025 if (!kvm_vcpu_cache) {
4026 r = -ENOMEM;
4027 goto out_free_3;
4028 }
4029
4030 r = kvm_async_pf_init();
4031 if (r)
4032 goto out_free;
4033
4034 kvm_chardev_ops.owner = module;
4035 kvm_vm_fops.owner = module;
4036 kvm_vcpu_fops.owner = module;
4037
4038 r = misc_register(&kvm_dev);
4039 if (r) {
4040 pr_err("kvm: misc device register failed\n");
4041 goto out_unreg;
4042 }
4043
4044 register_syscore_ops(&kvm_syscore_ops);
4045
4046 kvm_preempt_ops.sched_in = kvm_sched_in;
4047 kvm_preempt_ops.sched_out = kvm_sched_out;
4048
4049 r = kvm_init_debug();
4050 if (r) {
4051 pr_err("kvm: create debugfs files failed\n");
4052 goto out_undebugfs;
4053 }
4054
4055 r = kvm_vfio_ops_init();
4056 WARN_ON(r);
4057
4058 return 0;
4059
4060out_undebugfs:
4061 unregister_syscore_ops(&kvm_syscore_ops);
4062 misc_deregister(&kvm_dev);
4063out_unreg:
4064 kvm_async_pf_deinit();
4065out_free:
4066 kmem_cache_destroy(kvm_vcpu_cache);
4067out_free_3:
4068 unregister_reboot_notifier(&kvm_reboot_notifier);
4069 cpuhp_remove_state_nocalls(CPUHP_AP_KVM_STARTING);
4070out_free_2:
4071out_free_1:
4072 kvm_arch_hardware_unsetup();
4073out_free_0a:
4074 free_cpumask_var(cpus_hardware_enabled);
4075out_free_0:
4076 kvm_irqfd_exit();
4077out_irqfd:
4078 kvm_arch_exit();
4079out_fail:
4080 return r;
4081}
4082EXPORT_SYMBOL_GPL(kvm_init);
4083
4084void kvm_exit(void)
4085{
4086 debugfs_remove_recursive(kvm_debugfs_dir);
4087 misc_deregister(&kvm_dev);
4088 kmem_cache_destroy(kvm_vcpu_cache);
4089 kvm_async_pf_deinit();
4090 unregister_syscore_ops(&kvm_syscore_ops);
4091 unregister_reboot_notifier(&kvm_reboot_notifier);
4092 cpuhp_remove_state_nocalls(CPUHP_AP_KVM_STARTING);
4093 on_each_cpu(hardware_disable_nolock, NULL, 1);
4094 kvm_arch_hardware_unsetup();
4095 kvm_arch_exit();
4096 kvm_irqfd_exit();
4097 free_cpumask_var(cpus_hardware_enabled);
4098 kvm_vfio_ops_exit();
4099}
4100EXPORT_SYMBOL_GPL(kvm_exit);