xref: /linux/arch/s390/kvm/interrupt.c (revision 6b802031877a995456c528095c41d1948546bf45)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * handling kvm guest interrupts
4  *
5  * Copyright IBM Corp. 2008, 2020
6  *
7  *    Author(s): Carsten Otte <cotte@de.ibm.com>
8  */
9 
10 #define pr_fmt(fmt) "kvm-s390: " fmt
11 
12 #include <linux/cpufeature.h>
13 #include <linux/interrupt.h>
14 #include <linux/kvm_host.h>
15 #include <linux/hrtimer.h>
16 #include <linux/export.h>
17 #include <linux/mmu_context.h>
18 #include <linux/nospec.h>
19 #include <linux/signal.h>
20 #include <linux/slab.h>
21 #include <linux/bitmap.h>
22 #include <linux/vmalloc.h>
23 #include <asm/access-regs.h>
24 #include <asm/asm-offsets.h>
25 #include <asm/dis.h>
26 #include <linux/uaccess.h>
27 #include <asm/sclp.h>
28 #include <asm/isc.h>
29 #include <asm/nmi.h>
30 #include <asm/airq.h>
31 #include <asm/tpi.h>
32 #include "kvm-s390.h"
33 #include "gaccess.h"
34 #include "trace-s390.h"
35 #include "pci.h"
36 #include "gmap.h"
37 
38 #define PFAULT_INIT 0x0600
39 #define PFAULT_DONE 0x0680
40 #define VIRTIO_PARAM 0x0d00
41 
42 static struct kvm_s390_gib *gib;
43 
44 /* handle external calls via sigp interpretation facility */
45 static int sca_ext_call_pending(struct kvm_vcpu *vcpu, int *src_id)
46 {
47 	struct esca_block *sca = vcpu->kvm->arch.sca;
48 	union esca_sigp_ctrl sigp_ctrl = sca->cpu[vcpu->vcpu_id].sigp_ctrl;
49 
50 	if (!kvm_s390_test_cpuflags(vcpu, CPUSTAT_ECALL_PEND))
51 		return 0;
52 
53 	BUG_ON(!kvm_s390_use_sca_entries());
54 
55 	if (src_id)
56 		*src_id = sigp_ctrl.scn;
57 
58 	return sigp_ctrl.c;
59 }
60 
61 static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id)
62 {
63 	struct esca_block *sca = vcpu->kvm->arch.sca;
64 	union esca_sigp_ctrl *sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
65 	union esca_sigp_ctrl old_val, new_val = {.scn = src_id, .c = 1};
66 	int expect, rc;
67 
68 	BUG_ON(!kvm_s390_use_sca_entries());
69 
70 	old_val = READ_ONCE(*sigp_ctrl);
71 	old_val.c = 0;
72 
73 	expect = old_val.value;
74 	rc = cmpxchg(&sigp_ctrl->value, old_val.value, new_val.value);
75 
76 	if (rc != expect) {
77 		/* another external call is pending */
78 		return -EBUSY;
79 	}
80 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_ECALL_PEND);
81 	return 0;
82 }
83 
84 static void sca_clear_ext_call(struct kvm_vcpu *vcpu)
85 {
86 	struct esca_block *sca = vcpu->kvm->arch.sca;
87 	union esca_sigp_ctrl *sigp_ctrl = &sca->cpu[vcpu->vcpu_id].sigp_ctrl;
88 
89 	if (!kvm_s390_use_sca_entries())
90 		return;
91 	kvm_s390_clear_cpuflags(vcpu, CPUSTAT_ECALL_PEND);
92 
93 	WRITE_ONCE(sigp_ctrl->value, 0);
94 }
95 
96 int psw_extint_disabled(struct kvm_vcpu *vcpu)
97 {
98 	return !(vcpu->arch.sie_block->gpsw.mask & PSW_MASK_EXT);
99 }
100 
101 static int psw_ioint_disabled(struct kvm_vcpu *vcpu)
102 {
103 	return !(vcpu->arch.sie_block->gpsw.mask & PSW_MASK_IO);
104 }
105 
106 static int psw_mchk_disabled(struct kvm_vcpu *vcpu)
107 {
108 	return !(vcpu->arch.sie_block->gpsw.mask & PSW_MASK_MCHECK);
109 }
110 
111 static int psw_interrupts_disabled(struct kvm_vcpu *vcpu)
112 {
113 	return psw_extint_disabled(vcpu) &&
114 	       psw_ioint_disabled(vcpu) &&
115 	       psw_mchk_disabled(vcpu);
116 }
117 
118 static int ckc_interrupts_enabled(struct kvm_vcpu *vcpu)
119 {
120 	if (psw_extint_disabled(vcpu) ||
121 	    !(vcpu->arch.sie_block->gcr[0] & CR0_CLOCK_COMPARATOR_SUBMASK))
122 		return 0;
123 	if (guestdbg_enabled(vcpu) && guestdbg_sstep_enabled(vcpu))
124 		/* No timer interrupts when single stepping */
125 		return 0;
126 	return 1;
127 }
128 
129 static int ckc_irq_pending(struct kvm_vcpu *vcpu)
130 {
131 	const u64 now = kvm_s390_get_tod_clock_fast(vcpu->kvm);
132 	const u64 ckc = vcpu->arch.sie_block->ckc;
133 
134 	if (vcpu->arch.sie_block->gcr[0] & CR0_CLOCK_COMPARATOR_SIGN) {
135 		if ((s64)ckc >= (s64)now)
136 			return 0;
137 	} else if (ckc >= now) {
138 		return 0;
139 	}
140 	return ckc_interrupts_enabled(vcpu);
141 }
142 
143 static int cpu_timer_interrupts_enabled(struct kvm_vcpu *vcpu)
144 {
145 	return !psw_extint_disabled(vcpu) &&
146 	       (vcpu->arch.sie_block->gcr[0] & CR0_CPU_TIMER_SUBMASK);
147 }
148 
149 static int cpu_timer_irq_pending(struct kvm_vcpu *vcpu)
150 {
151 	if (!cpu_timer_interrupts_enabled(vcpu))
152 		return 0;
153 	return kvm_s390_get_cpu_timer(vcpu) >> 63;
154 }
155 
156 static uint64_t isc_to_isc_bits(int isc)
157 {
158 	return (0x80 >> isc) << 24;
159 }
160 
161 static inline u32 isc_to_int_word(u8 isc)
162 {
163 	return ((u32)isc << 27) | 0x80000000;
164 }
165 
166 static inline u8 int_word_to_isc(u32 int_word)
167 {
168 	return (int_word & 0x38000000) >> 27;
169 }
170 
171 /*
172  * To use atomic bitmap functions, we have to provide a bitmap address
173  * that is u64 aligned. However, the ipm might be u32 aligned.
174  * Therefore, we logically start the bitmap at the very beginning of the
175  * struct and fixup the bit number.
176  */
177 #define IPM_BIT_OFFSET (offsetof(struct kvm_s390_gisa, ipm) * BITS_PER_BYTE)
178 
179 /**
180  * gisa_set_iam - change the GISA interruption alert mask
181  *
182  * @gisa: gisa to operate on
183  * @iam: new IAM value to use
184  *
185  * Change the IAM atomically with the next alert address and the IPM
186  * of the GISA if the GISA is not part of the GIB alert list. All three
187  * fields are located in the first long word of the GISA.
188  *
189  * Returns: 0 on success
190  *          -EBUSY in case the gisa is part of the alert list
191  */
192 static inline int gisa_set_iam(struct kvm_s390_gisa *gisa, u8 iam)
193 {
194 	u64 word, _word;
195 
196 	word = READ_ONCE(gisa->u64.word[0]);
197 	do {
198 		if ((u64)gisa != word >> 32)
199 			return -EBUSY;
200 		_word = (word & ~0xffUL) | iam;
201 	} while (!try_cmpxchg(&gisa->u64.word[0], &word, _word));
202 
203 	return 0;
204 }
205 
206 /**
207  * gisa_clear_ipm - clear the GISA interruption pending mask
208  *
209  * @gisa: gisa to operate on
210  *
211  * Clear the IPM atomically with the next alert address and the IAM
212  * of the GISA unconditionally. All three fields are located in the
213  * first long word of the GISA.
214  */
215 static inline void gisa_clear_ipm(struct kvm_s390_gisa *gisa)
216 {
217 	u64 word, _word;
218 
219 	word = READ_ONCE(gisa->u64.word[0]);
220 	do {
221 		_word = word & ~(0xffUL << 24);
222 	} while (!try_cmpxchg(&gisa->u64.word[0], &word, _word));
223 }
224 
225 /**
226  * gisa_get_ipm_or_restore_iam - return IPM or restore GISA IAM
227  *
228  * @gi: gisa interrupt struct to work on
229  *
230  * Atomically restores the interruption alert mask if none of the
231  * relevant ISCs are pending and return the IPM.
232  *
233  * Returns: the relevant pending ISCs
234  */
235 static inline u8 gisa_get_ipm_or_restore_iam(struct kvm_s390_gisa_interrupt *gi)
236 {
237 	u8 pending_mask, alert_mask;
238 	u64 word, _word;
239 
240 	word = READ_ONCE(gi->origin->u64.word[0]);
241 	do {
242 		alert_mask = READ_ONCE(gi->alert.mask);
243 		pending_mask = (u8)(word >> 24) & alert_mask;
244 		if (pending_mask)
245 			return pending_mask;
246 		_word = (word & ~0xffUL) | alert_mask;
247 	} while (!try_cmpxchg(&gi->origin->u64.word[0], &word, _word));
248 
249 	return 0;
250 }
251 
252 static inline void gisa_set_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
253 {
254 	set_bit_inv(IPM_BIT_OFFSET + gisc, (unsigned long *) gisa);
255 }
256 
257 static inline u8 gisa_get_ipm(struct kvm_s390_gisa *gisa)
258 {
259 	return READ_ONCE(gisa->ipm);
260 }
261 
262 static inline int gisa_tac_ipm_gisc(struct kvm_s390_gisa *gisa, u32 gisc)
263 {
264 	return test_and_clear_bit_inv(IPM_BIT_OFFSET + gisc, (unsigned long *) gisa);
265 }
266 
267 static inline unsigned long pending_irqs_no_gisa(struct kvm_vcpu *vcpu)
268 {
269 	unsigned long pending = vcpu->kvm->arch.float_int.pending_irqs |
270 				vcpu->arch.local_int.pending_irqs;
271 
272 	pending &= ~vcpu->kvm->arch.float_int.masked_irqs;
273 	return pending;
274 }
275 
276 static inline unsigned long pending_irqs(struct kvm_vcpu *vcpu)
277 {
278 	struct kvm_s390_gisa_interrupt *gi = &vcpu->kvm->arch.gisa_int;
279 	unsigned long pending_mask;
280 
281 	pending_mask = pending_irqs_no_gisa(vcpu);
282 	if (gi->origin)
283 		pending_mask |= gisa_get_ipm(gi->origin) << IRQ_PEND_IO_ISC_7;
284 	return pending_mask;
285 }
286 
287 static inline int isc_to_irq_type(unsigned long isc)
288 {
289 	return IRQ_PEND_IO_ISC_0 - isc;
290 }
291 
292 static inline int irq_type_to_isc(unsigned long irq_type)
293 {
294 	return IRQ_PEND_IO_ISC_0 - irq_type;
295 }
296 
297 static unsigned long disable_iscs(struct kvm_vcpu *vcpu,
298 				   unsigned long active_mask)
299 {
300 	int i;
301 
302 	for (i = 0; i <= MAX_ISC; i++)
303 		if (!(vcpu->arch.sie_block->gcr[6] & isc_to_isc_bits(i)))
304 			active_mask &= ~(1UL << (isc_to_irq_type(i)));
305 
306 	return active_mask;
307 }
308 
309 static unsigned long deliverable_irqs(struct kvm_vcpu *vcpu)
310 {
311 	unsigned long active_mask;
312 
313 	active_mask = pending_irqs(vcpu);
314 	if (!active_mask)
315 		return 0;
316 
317 	if (psw_extint_disabled(vcpu))
318 		active_mask &= ~IRQ_PEND_EXT_MASK;
319 	if (psw_ioint_disabled(vcpu))
320 		active_mask &= ~IRQ_PEND_IO_MASK;
321 	else
322 		active_mask = disable_iscs(vcpu, active_mask);
323 	if (!(vcpu->arch.sie_block->gcr[0] & CR0_EXTERNAL_CALL_SUBMASK))
324 		__clear_bit(IRQ_PEND_EXT_EXTERNAL, &active_mask);
325 	if (!(vcpu->arch.sie_block->gcr[0] & CR0_EMERGENCY_SIGNAL_SUBMASK))
326 		__clear_bit(IRQ_PEND_EXT_EMERGENCY, &active_mask);
327 	if (!(vcpu->arch.sie_block->gcr[0] & CR0_CLOCK_COMPARATOR_SUBMASK))
328 		__clear_bit(IRQ_PEND_EXT_CLOCK_COMP, &active_mask);
329 	if (!(vcpu->arch.sie_block->gcr[0] & CR0_CPU_TIMER_SUBMASK))
330 		__clear_bit(IRQ_PEND_EXT_CPU_TIMER, &active_mask);
331 	if (!(vcpu->arch.sie_block->gcr[0] & CR0_SERVICE_SIGNAL_SUBMASK)) {
332 		__clear_bit(IRQ_PEND_EXT_SERVICE, &active_mask);
333 		__clear_bit(IRQ_PEND_EXT_SERVICE_EV, &active_mask);
334 	}
335 	if (psw_mchk_disabled(vcpu))
336 		active_mask &= ~IRQ_PEND_MCHK_MASK;
337 	/* PV guest cpus can have a single interruption injected at a time. */
338 	if (kvm_s390_pv_cpu_get_handle(vcpu) &&
339 	    vcpu->arch.sie_block->iictl != IICTL_CODE_NONE)
340 		active_mask &= ~(IRQ_PEND_EXT_II_MASK |
341 				 IRQ_PEND_IO_MASK |
342 				 IRQ_PEND_MCHK_MASK);
343 	/*
344 	 * Check both floating and local interrupt's cr14 because
345 	 * bit IRQ_PEND_MCHK_REP could be set in both cases.
346 	 */
347 	if (!(vcpu->arch.sie_block->gcr[14] &
348 	   (vcpu->kvm->arch.float_int.mchk.cr14 |
349 	   vcpu->arch.local_int.irq.mchk.cr14)))
350 		__clear_bit(IRQ_PEND_MCHK_REP, &active_mask);
351 
352 	/*
353 	 * STOP irqs will never be actively delivered. They are triggered via
354 	 * intercept requests and cleared when the stop intercept is performed.
355 	 */
356 	__clear_bit(IRQ_PEND_SIGP_STOP, &active_mask);
357 
358 	return active_mask;
359 }
360 
361 static void __set_cpu_idle(struct kvm_vcpu *vcpu)
362 {
363 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_WAIT);
364 	set_bit(vcpu->vcpu_idx, vcpu->kvm->arch.idle_mask);
365 }
366 
367 static void __unset_cpu_idle(struct kvm_vcpu *vcpu)
368 {
369 	kvm_s390_clear_cpuflags(vcpu, CPUSTAT_WAIT);
370 	clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.idle_mask);
371 }
372 
373 static void __reset_intercept_indicators(struct kvm_vcpu *vcpu)
374 {
375 	kvm_s390_clear_cpuflags(vcpu, CPUSTAT_IO_INT | CPUSTAT_EXT_INT |
376 				      CPUSTAT_STOP_INT);
377 	vcpu->arch.sie_block->lctl = 0x0000;
378 	vcpu->arch.sie_block->ictl &= ~(ICTL_LPSW | ICTL_STCTL | ICTL_PINT);
379 
380 	if (guestdbg_enabled(vcpu)) {
381 		vcpu->arch.sie_block->lctl |= (LCTL_CR0 | LCTL_CR9 |
382 					       LCTL_CR10 | LCTL_CR11);
383 		vcpu->arch.sie_block->ictl |= (ICTL_STCTL | ICTL_PINT);
384 	}
385 }
386 
387 static void set_intercept_indicators_io(struct kvm_vcpu *vcpu)
388 {
389 	if (!(pending_irqs_no_gisa(vcpu) & IRQ_PEND_IO_MASK))
390 		return;
391 	if (psw_ioint_disabled(vcpu))
392 		kvm_s390_set_cpuflags(vcpu, CPUSTAT_IO_INT);
393 	else
394 		vcpu->arch.sie_block->lctl |= LCTL_CR6;
395 }
396 
397 static void set_intercept_indicators_ext(struct kvm_vcpu *vcpu)
398 {
399 	if (!(pending_irqs_no_gisa(vcpu) & IRQ_PEND_EXT_MASK))
400 		return;
401 	if (psw_extint_disabled(vcpu))
402 		kvm_s390_set_cpuflags(vcpu, CPUSTAT_EXT_INT);
403 	else
404 		vcpu->arch.sie_block->lctl |= LCTL_CR0;
405 }
406 
407 static void set_intercept_indicators_mchk(struct kvm_vcpu *vcpu)
408 {
409 	if (!(pending_irqs_no_gisa(vcpu) & IRQ_PEND_MCHK_MASK))
410 		return;
411 	if (psw_mchk_disabled(vcpu))
412 		vcpu->arch.sie_block->ictl |= ICTL_LPSW;
413 	else
414 		vcpu->arch.sie_block->lctl |= LCTL_CR14;
415 }
416 
417 static void set_intercept_indicators_stop(struct kvm_vcpu *vcpu)
418 {
419 	if (kvm_s390_is_stop_irq_pending(vcpu))
420 		kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOP_INT);
421 }
422 
423 /* Set interception request for non-deliverable interrupts */
424 static void set_intercept_indicators(struct kvm_vcpu *vcpu)
425 {
426 	set_intercept_indicators_io(vcpu);
427 	set_intercept_indicators_ext(vcpu);
428 	set_intercept_indicators_mchk(vcpu);
429 	set_intercept_indicators_stop(vcpu);
430 }
431 
432 static int __must_check __deliver_cpu_timer(struct kvm_vcpu *vcpu)
433 {
434 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
435 	int rc = 0;
436 
437 	vcpu->stat.deliver_cputm++;
438 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_INT_CPU_TIMER,
439 					 0, 0);
440 	if (kvm_s390_pv_cpu_is_protected(vcpu)) {
441 		vcpu->arch.sie_block->iictl = IICTL_CODE_EXT;
442 		vcpu->arch.sie_block->eic = EXT_IRQ_CPU_TIMER;
443 	} else {
444 		rc  = put_guest_lc(vcpu, EXT_IRQ_CPU_TIMER,
445 				   (u16 *)__LC_EXT_INT_CODE);
446 		rc |= put_guest_lc(vcpu, 0, (u16 *)__LC_EXT_CPU_ADDR);
447 		rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
448 				     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
449 		rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW,
450 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
451 	}
452 	clear_bit(IRQ_PEND_EXT_CPU_TIMER, &li->pending_irqs);
453 	return rc ? -EFAULT : 0;
454 }
455 
456 static int __must_check __deliver_ckc(struct kvm_vcpu *vcpu)
457 {
458 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
459 	int rc = 0;
460 
461 	vcpu->stat.deliver_ckc++;
462 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_INT_CLOCK_COMP,
463 					 0, 0);
464 	if (kvm_s390_pv_cpu_is_protected(vcpu)) {
465 		vcpu->arch.sie_block->iictl = IICTL_CODE_EXT;
466 		vcpu->arch.sie_block->eic = EXT_IRQ_CLK_COMP;
467 	} else {
468 		rc  = put_guest_lc(vcpu, EXT_IRQ_CLK_COMP,
469 				   (u16 __user *)__LC_EXT_INT_CODE);
470 		rc |= put_guest_lc(vcpu, 0, (u16 *)__LC_EXT_CPU_ADDR);
471 		rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
472 				     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
473 		rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW,
474 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
475 	}
476 	clear_bit(IRQ_PEND_EXT_CLOCK_COMP, &li->pending_irqs);
477 	return rc ? -EFAULT : 0;
478 }
479 
480 static int __must_check __deliver_pfault_init(struct kvm_vcpu *vcpu)
481 {
482 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
483 	struct kvm_s390_ext_info ext;
484 	int rc;
485 
486 	spin_lock(&li->lock);
487 	ext = li->irq.ext;
488 	clear_bit(IRQ_PEND_PFAULT_INIT, &li->pending_irqs);
489 	li->irq.ext.ext_params2 = 0;
490 	spin_unlock(&li->lock);
491 
492 	VCPU_EVENT(vcpu, 4, "deliver: pfault init token 0x%llx",
493 		   ext.ext_params2);
494 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
495 					 KVM_S390_INT_PFAULT_INIT,
496 					 0, ext.ext_params2);
497 
498 	rc  = put_guest_lc(vcpu, EXT_IRQ_CP_SERVICE, (u16 *) __LC_EXT_INT_CODE);
499 	rc |= put_guest_lc(vcpu, PFAULT_INIT, (u16 *) __LC_EXT_CPU_ADDR);
500 	rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
501 			     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
502 	rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW,
503 			    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
504 	rc |= put_guest_lc(vcpu, ext.ext_params2, (u64 *) __LC_EXT_PARAMS2);
505 	return rc ? -EFAULT : 0;
506 }
507 
508 static int __write_machine_check(struct kvm_vcpu *vcpu,
509 				 struct kvm_s390_mchk_info *mchk)
510 {
511 	unsigned long ext_sa_addr;
512 	unsigned long lc;
513 	freg_t fprs[NUM_FPRS];
514 	union mci mci;
515 	int rc;
516 
517 	/*
518 	 * All other possible payload for a machine check (e.g. the register
519 	 * contents in the save area) will be handled by the ultravisor, as
520 	 * the hypervisor does not not have the needed information for
521 	 * protected guests.
522 	 */
523 	if (kvm_s390_pv_cpu_is_protected(vcpu)) {
524 		vcpu->arch.sie_block->iictl = IICTL_CODE_MCHK;
525 		vcpu->arch.sie_block->mcic = mchk->mcic;
526 		vcpu->arch.sie_block->faddr = mchk->failing_storage_address;
527 		vcpu->arch.sie_block->edc = mchk->ext_damage_code;
528 		return 0;
529 	}
530 
531 	mci.val = mchk->mcic;
532 	/* take care of lazy register loading */
533 	kvm_s390_fpu_store(vcpu->run);
534 	save_access_regs(vcpu->run->s.regs.acrs);
535 	if (cpu_has_gs() && vcpu->arch.gs_enabled)
536 		save_gs_cb(current->thread.gs_cb);
537 
538 	/* Extended save area */
539 	rc = read_guest_lc(vcpu, __LC_MCESAD, &ext_sa_addr,
540 			   sizeof(unsigned long));
541 	/* Only bits 0 through 63-LC are used for address formation */
542 	lc = ext_sa_addr & MCESA_LC_MASK;
543 	if (test_kvm_facility(vcpu->kvm, 133)) {
544 		switch (lc) {
545 		case 0:
546 		case 10:
547 			ext_sa_addr &= ~0x3ffUL;
548 			break;
549 		case 11:
550 			ext_sa_addr &= ~0x7ffUL;
551 			break;
552 		case 12:
553 			ext_sa_addr &= ~0xfffUL;
554 			break;
555 		default:
556 			ext_sa_addr = 0;
557 			break;
558 		}
559 	} else {
560 		ext_sa_addr &= ~0x3ffUL;
561 	}
562 
563 	if (!rc && mci.vr && ext_sa_addr && test_kvm_facility(vcpu->kvm, 129)) {
564 		if (write_guest_abs(vcpu, ext_sa_addr, vcpu->run->s.regs.vrs,
565 				    512))
566 			mci.vr = 0;
567 	} else {
568 		mci.vr = 0;
569 	}
570 	if (!rc && mci.gs && ext_sa_addr && test_kvm_facility(vcpu->kvm, 133)
571 	    && (lc == 11 || lc == 12)) {
572 		if (write_guest_abs(vcpu, ext_sa_addr + 1024,
573 				    &vcpu->run->s.regs.gscb, 32))
574 			mci.gs = 0;
575 	} else {
576 		mci.gs = 0;
577 	}
578 
579 	/* General interruption information */
580 	rc |= put_guest_lc(vcpu, 1, (u8 __user *) __LC_AR_MODE_ID);
581 	rc |= write_guest_lc(vcpu, __LC_MCK_OLD_PSW,
582 			     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
583 	rc |= read_guest_lc(vcpu, __LC_MCK_NEW_PSW,
584 			    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
585 	rc |= put_guest_lc(vcpu, mci.val, (u64 __user *) __LC_MCCK_CODE);
586 
587 	/* Register-save areas */
588 	if (cpu_has_vx()) {
589 		convert_vx_to_fp(fprs, (__vector128 *) vcpu->run->s.regs.vrs);
590 		rc |= write_guest_lc(vcpu, __LC_FPREGS_SAVE_AREA, fprs, 128);
591 	} else {
592 		rc |= write_guest_lc(vcpu, __LC_FPREGS_SAVE_AREA,
593 				     vcpu->run->s.regs.fprs, 128);
594 	}
595 	rc |= write_guest_lc(vcpu, __LC_GPREGS_SAVE_AREA,
596 			     vcpu->run->s.regs.gprs, 128);
597 	rc |= put_guest_lc(vcpu, vcpu->run->s.regs.fpc,
598 			   (u32 __user *) __LC_FP_CREG_SAVE_AREA);
599 	rc |= put_guest_lc(vcpu, vcpu->arch.sie_block->todpr,
600 			   (u32 __user *) __LC_TOD_PROGREG_SAVE_AREA);
601 	rc |= put_guest_lc(vcpu, kvm_s390_get_cpu_timer(vcpu),
602 			   (u64 __user *) __LC_CPU_TIMER_SAVE_AREA);
603 	rc |= put_guest_lc(vcpu, vcpu->arch.sie_block->ckc >> 8,
604 			   (u64 __user *) __LC_CLOCK_COMP_SAVE_AREA);
605 	rc |= write_guest_lc(vcpu, __LC_AREGS_SAVE_AREA,
606 			     &vcpu->run->s.regs.acrs, 64);
607 	rc |= write_guest_lc(vcpu, __LC_CREGS_SAVE_AREA,
608 			     &vcpu->arch.sie_block->gcr, 128);
609 
610 	/* Extended interruption information */
611 	rc |= put_guest_lc(vcpu, mchk->ext_damage_code,
612 			   (u32 __user *) __LC_EXT_DAMAGE_CODE);
613 	rc |= put_guest_lc(vcpu, mchk->failing_storage_address,
614 			   (u64 __user *) __LC_MCCK_FAIL_STOR_ADDR);
615 	rc |= write_guest_lc(vcpu, __LC_PSW_SAVE_AREA, &mchk->fixed_logout,
616 			     sizeof(mchk->fixed_logout));
617 	return rc ? -EFAULT : 0;
618 }
619 
620 static int __must_check __deliver_machine_check(struct kvm_vcpu *vcpu)
621 {
622 	struct kvm_s390_float_interrupt *fi = &vcpu->kvm->arch.float_int;
623 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
624 	struct kvm_s390_mchk_info mchk = {};
625 	int deliver = 0;
626 	int rc = 0;
627 
628 	spin_lock(&fi->lock);
629 	spin_lock(&li->lock);
630 	if (test_bit(IRQ_PEND_MCHK_EX, &li->pending_irqs) ||
631 	    test_bit(IRQ_PEND_MCHK_REP, &li->pending_irqs)) {
632 		/*
633 		 * If there was an exigent machine check pending, then any
634 		 * repressible machine checks that might have been pending
635 		 * are indicated along with it, so always clear bits for
636 		 * repressible and exigent interrupts
637 		 */
638 		mchk = li->irq.mchk;
639 		clear_bit(IRQ_PEND_MCHK_EX, &li->pending_irqs);
640 		clear_bit(IRQ_PEND_MCHK_REP, &li->pending_irqs);
641 		memset(&li->irq.mchk, 0, sizeof(mchk));
642 		deliver = 1;
643 	}
644 	/*
645 	 * We indicate floating repressible conditions along with
646 	 * other pending conditions. Channel Report Pending and Channel
647 	 * Subsystem damage are the only two and are indicated by
648 	 * bits in mcic and masked in cr14.
649 	 */
650 	if (test_and_clear_bit(IRQ_PEND_MCHK_REP, &fi->pending_irqs)) {
651 		mchk.mcic |= fi->mchk.mcic;
652 		mchk.cr14 |= fi->mchk.cr14;
653 		memset(&fi->mchk, 0, sizeof(mchk));
654 		deliver = 1;
655 	}
656 	spin_unlock(&li->lock);
657 	spin_unlock(&fi->lock);
658 
659 	if (deliver) {
660 		VCPU_EVENT(vcpu, 3, "deliver: machine check mcic 0x%llx",
661 			   mchk.mcic);
662 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
663 						 KVM_S390_MCHK,
664 						 mchk.cr14, mchk.mcic);
665 		vcpu->stat.deliver_machine_check++;
666 		rc = __write_machine_check(vcpu, &mchk);
667 	}
668 	return rc;
669 }
670 
671 static int __must_check __deliver_restart(struct kvm_vcpu *vcpu)
672 {
673 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
674 	int rc = 0;
675 
676 	VCPU_EVENT(vcpu, 3, "%s", "deliver: cpu restart");
677 	vcpu->stat.deliver_restart_signal++;
678 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_RESTART, 0, 0);
679 
680 	if (kvm_s390_pv_cpu_is_protected(vcpu)) {
681 		vcpu->arch.sie_block->iictl = IICTL_CODE_RESTART;
682 	} else {
683 		rc  = write_guest_lc(vcpu,
684 				     offsetof(struct lowcore, restart_old_psw),
685 				     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
686 		rc |= read_guest_lc(vcpu, offsetof(struct lowcore, restart_psw),
687 				    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
688 	}
689 	clear_bit(IRQ_PEND_RESTART, &li->pending_irqs);
690 	return rc ? -EFAULT : 0;
691 }
692 
693 static int __must_check __deliver_set_prefix(struct kvm_vcpu *vcpu)
694 {
695 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
696 	struct kvm_s390_prefix_info prefix;
697 
698 	spin_lock(&li->lock);
699 	prefix = li->irq.prefix;
700 	li->irq.prefix.address = 0;
701 	clear_bit(IRQ_PEND_SET_PREFIX, &li->pending_irqs);
702 	spin_unlock(&li->lock);
703 
704 	vcpu->stat.deliver_prefix_signal++;
705 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
706 					 KVM_S390_SIGP_SET_PREFIX,
707 					 prefix.address, 0);
708 
709 	kvm_s390_set_prefix(vcpu, prefix.address);
710 	return 0;
711 }
712 
713 static int __must_check __deliver_emergency_signal(struct kvm_vcpu *vcpu)
714 {
715 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
716 	int rc;
717 	int cpu_addr;
718 
719 	spin_lock(&li->lock);
720 	cpu_addr = find_first_bit(li->sigp_emerg_pending, KVM_MAX_VCPUS);
721 	clear_bit(cpu_addr, li->sigp_emerg_pending);
722 	if (bitmap_empty(li->sigp_emerg_pending, KVM_MAX_VCPUS))
723 		clear_bit(IRQ_PEND_EXT_EMERGENCY, &li->pending_irqs);
724 	spin_unlock(&li->lock);
725 
726 	VCPU_EVENT(vcpu, 4, "%s", "deliver: sigp emerg");
727 	vcpu->stat.deliver_emergency_signal++;
728 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_INT_EMERGENCY,
729 					 cpu_addr, 0);
730 	if (kvm_s390_pv_cpu_is_protected(vcpu)) {
731 		vcpu->arch.sie_block->iictl = IICTL_CODE_EXT;
732 		vcpu->arch.sie_block->eic = EXT_IRQ_EMERGENCY_SIG;
733 		vcpu->arch.sie_block->extcpuaddr = cpu_addr;
734 		return 0;
735 	}
736 
737 	rc  = put_guest_lc(vcpu, EXT_IRQ_EMERGENCY_SIG,
738 			   (u16 *)__LC_EXT_INT_CODE);
739 	rc |= put_guest_lc(vcpu, cpu_addr, (u16 *)__LC_EXT_CPU_ADDR);
740 	rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
741 			     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
742 	rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW,
743 			    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
744 	return rc ? -EFAULT : 0;
745 }
746 
747 static int __must_check __deliver_external_call(struct kvm_vcpu *vcpu)
748 {
749 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
750 	struct kvm_s390_extcall_info extcall;
751 	int rc;
752 
753 	spin_lock(&li->lock);
754 	extcall = li->irq.extcall;
755 	li->irq.extcall.code = 0;
756 	clear_bit(IRQ_PEND_EXT_EXTERNAL, &li->pending_irqs);
757 	spin_unlock(&li->lock);
758 
759 	VCPU_EVENT(vcpu, 4, "%s", "deliver: sigp ext call");
760 	vcpu->stat.deliver_external_call++;
761 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
762 					 KVM_S390_INT_EXTERNAL_CALL,
763 					 extcall.code, 0);
764 	if (kvm_s390_pv_cpu_is_protected(vcpu)) {
765 		vcpu->arch.sie_block->iictl = IICTL_CODE_EXT;
766 		vcpu->arch.sie_block->eic = EXT_IRQ_EXTERNAL_CALL;
767 		vcpu->arch.sie_block->extcpuaddr = extcall.code;
768 		return 0;
769 	}
770 
771 	rc  = put_guest_lc(vcpu, EXT_IRQ_EXTERNAL_CALL,
772 			   (u16 *)__LC_EXT_INT_CODE);
773 	rc |= put_guest_lc(vcpu, extcall.code, (u16 *)__LC_EXT_CPU_ADDR);
774 	rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
775 			     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
776 	rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW, &vcpu->arch.sie_block->gpsw,
777 			    sizeof(psw_t));
778 	return rc ? -EFAULT : 0;
779 }
780 
781 static int __deliver_prog_pv(struct kvm_vcpu *vcpu, u16 code)
782 {
783 	switch (code) {
784 	case PGM_SPECIFICATION:
785 		vcpu->arch.sie_block->iictl = IICTL_CODE_SPECIFICATION;
786 		break;
787 	case PGM_OPERAND:
788 		vcpu->arch.sie_block->iictl = IICTL_CODE_OPERAND;
789 		break;
790 	default:
791 		return -EINVAL;
792 	}
793 	return 0;
794 }
795 
796 static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
797 {
798 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
799 	struct kvm_s390_pgm_info pgm_info;
800 	int rc = 0, nullifying = false;
801 	u16 ilen;
802 
803 	spin_lock(&li->lock);
804 	pgm_info = li->irq.pgm;
805 	clear_bit(IRQ_PEND_PROG, &li->pending_irqs);
806 	memset(&li->irq.pgm, 0, sizeof(pgm_info));
807 	spin_unlock(&li->lock);
808 
809 	ilen = pgm_info.flags & KVM_S390_PGM_FLAGS_ILC_MASK;
810 	VCPU_EVENT(vcpu, 3, "deliver: program irq code 0x%x, ilen:%d",
811 		   pgm_info.code, ilen);
812 	vcpu->stat.deliver_program++;
813 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_PROGRAM_INT,
814 					 pgm_info.code, 0);
815 
816 	/* PER is handled by the ultravisor */
817 	if (kvm_s390_pv_cpu_is_protected(vcpu))
818 		return __deliver_prog_pv(vcpu, pgm_info.code & ~PGM_PER);
819 
820 	switch (pgm_info.code & ~PGM_PER) {
821 	case PGM_AFX_TRANSLATION:
822 	case PGM_ASX_TRANSLATION:
823 	case PGM_EX_TRANSLATION:
824 	case PGM_LFX_TRANSLATION:
825 	case PGM_LSTE_SEQUENCE:
826 	case PGM_LSX_TRANSLATION:
827 	case PGM_LX_TRANSLATION:
828 	case PGM_PRIMARY_AUTHORITY:
829 	case PGM_SECONDARY_AUTHORITY:
830 		nullifying = true;
831 		fallthrough;
832 	case PGM_SPACE_SWITCH:
833 		rc = put_guest_lc(vcpu, pgm_info.trans_exc_code,
834 				  (u64 *)__LC_TRANS_EXC_CODE);
835 		break;
836 	case PGM_ALEN_TRANSLATION:
837 	case PGM_ALE_SEQUENCE:
838 	case PGM_ASTE_INSTANCE:
839 	case PGM_ASTE_SEQUENCE:
840 	case PGM_ASTE_VALIDITY:
841 	case PGM_EXTENDED_AUTHORITY:
842 		rc = put_guest_lc(vcpu, pgm_info.exc_access_id,
843 				  (u8 *)__LC_EXC_ACCESS_ID);
844 		nullifying = true;
845 		break;
846 	case PGM_ASCE_TYPE:
847 	case PGM_PAGE_TRANSLATION:
848 	case PGM_REGION_FIRST_TRANS:
849 	case PGM_REGION_SECOND_TRANS:
850 	case PGM_REGION_THIRD_TRANS:
851 	case PGM_SEGMENT_TRANSLATION:
852 		rc = put_guest_lc(vcpu, pgm_info.trans_exc_code,
853 				  (u64 *)__LC_TRANS_EXC_CODE);
854 		rc |= put_guest_lc(vcpu, pgm_info.exc_access_id,
855 				   (u8 *)__LC_EXC_ACCESS_ID);
856 		rc |= put_guest_lc(vcpu, pgm_info.op_access_id,
857 				   (u8 *)__LC_OP_ACCESS_ID);
858 		nullifying = true;
859 		break;
860 	case PGM_MONITOR:
861 		rc = put_guest_lc(vcpu, pgm_info.mon_class_nr,
862 				  (u16 *)__LC_MON_CLASS_NR);
863 		rc |= put_guest_lc(vcpu, pgm_info.mon_code,
864 				   (u64 *)__LC_MON_CODE);
865 		break;
866 	case PGM_VECTOR_PROCESSING:
867 	case PGM_DATA:
868 		rc = put_guest_lc(vcpu, pgm_info.data_exc_code,
869 				  (u32 *)__LC_DATA_EXC_CODE);
870 		break;
871 	case PGM_PROTECTION:
872 		rc = put_guest_lc(vcpu, pgm_info.trans_exc_code,
873 				  (u64 *)__LC_TRANS_EXC_CODE);
874 		rc |= put_guest_lc(vcpu, pgm_info.exc_access_id,
875 				   (u8 *)__LC_EXC_ACCESS_ID);
876 		break;
877 	case PGM_STACK_FULL:
878 	case PGM_STACK_EMPTY:
879 	case PGM_STACK_SPECIFICATION:
880 	case PGM_STACK_TYPE:
881 	case PGM_STACK_OPERATION:
882 	case PGM_TRACE_TABEL:
883 	case PGM_CRYPTO_OPERATION:
884 		nullifying = true;
885 		break;
886 	}
887 
888 	if (pgm_info.code & PGM_PER) {
889 		rc |= put_guest_lc(vcpu, pgm_info.per_code,
890 				   (u8 *) __LC_PER_CODE);
891 		rc |= put_guest_lc(vcpu, pgm_info.per_atmid,
892 				   (u8 *)__LC_PER_ATMID);
893 		rc |= put_guest_lc(vcpu, pgm_info.per_address,
894 				   (u64 *) __LC_PER_ADDRESS);
895 		rc |= put_guest_lc(vcpu, pgm_info.per_access_id,
896 				   (u8 *) __LC_PER_ACCESS_ID);
897 	}
898 
899 	if (nullifying && !(pgm_info.flags & KVM_S390_PGM_FLAGS_NO_REWIND))
900 		kvm_s390_rewind_psw(vcpu, ilen);
901 
902 	/* bit 1+2 of the target are the ilc, so we can directly use ilen */
903 	rc |= put_guest_lc(vcpu, ilen, (u16 *) __LC_PGM_ILC);
904 	rc |= put_guest_lc(vcpu, vcpu->arch.sie_block->gbea,
905 				 (u64 *) __LC_PGM_LAST_BREAK);
906 	rc |= put_guest_lc(vcpu, pgm_info.code, (u16 *)__LC_PGM_CODE);
907 	rc |= write_guest_lc(vcpu, __LC_PGM_OLD_PSW,
908 			     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
909 	rc |= read_guest_lc(vcpu, __LC_PGM_NEW_PSW,
910 			    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
911 	return rc ? -EFAULT : 0;
912 }
913 
914 #define SCCB_MASK 0xFFFFFFF8
915 #define SCCB_EVENT_PENDING 0x3
916 
917 static int write_sclp(struct kvm_vcpu *vcpu, u32 parm)
918 {
919 	int rc;
920 
921 	if (kvm_s390_pv_cpu_get_handle(vcpu)) {
922 		vcpu->arch.sie_block->iictl = IICTL_CODE_EXT;
923 		vcpu->arch.sie_block->eic = EXT_IRQ_SERVICE_SIG;
924 		vcpu->arch.sie_block->eiparams = parm;
925 		return 0;
926 	}
927 
928 	rc  = put_guest_lc(vcpu, EXT_IRQ_SERVICE_SIG, (u16 *)__LC_EXT_INT_CODE);
929 	rc |= put_guest_lc(vcpu, 0, (u16 *)__LC_EXT_CPU_ADDR);
930 	rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
931 			     &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
932 	rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW,
933 			    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
934 	rc |= put_guest_lc(vcpu, parm,
935 			   (u32 *)__LC_EXT_PARAMS);
936 
937 	return rc ? -EFAULT : 0;
938 }
939 
940 static int __must_check __deliver_service(struct kvm_vcpu *vcpu)
941 {
942 	struct kvm_s390_float_interrupt *fi = &vcpu->kvm->arch.float_int;
943 	struct kvm_s390_ext_info ext;
944 
945 	spin_lock(&fi->lock);
946 	if (test_bit(IRQ_PEND_EXT_SERVICE, &fi->masked_irqs) ||
947 	    !(test_bit(IRQ_PEND_EXT_SERVICE, &fi->pending_irqs))) {
948 		spin_unlock(&fi->lock);
949 		return 0;
950 	}
951 	ext = fi->srv_signal;
952 	memset(&fi->srv_signal, 0, sizeof(ext));
953 	clear_bit(IRQ_PEND_EXT_SERVICE, &fi->pending_irqs);
954 	clear_bit(IRQ_PEND_EXT_SERVICE_EV, &fi->pending_irqs);
955 	if (kvm_s390_pv_cpu_is_protected(vcpu))
956 		set_bit(IRQ_PEND_EXT_SERVICE, &fi->masked_irqs);
957 	spin_unlock(&fi->lock);
958 
959 	if (!ext.ext_params)
960 		return 0;
961 
962 	VCPU_EVENT(vcpu, 4, "deliver: sclp parameter 0x%x",
963 		   ext.ext_params);
964 	vcpu->stat.deliver_service_signal++;
965 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_INT_SERVICE,
966 					 ext.ext_params, 0);
967 
968 	return write_sclp(vcpu, ext.ext_params);
969 }
970 
971 static int __must_check __deliver_service_ev(struct kvm_vcpu *vcpu)
972 {
973 	struct kvm_s390_float_interrupt *fi = &vcpu->kvm->arch.float_int;
974 	struct kvm_s390_ext_info ext;
975 
976 	spin_lock(&fi->lock);
977 	if (!(test_bit(IRQ_PEND_EXT_SERVICE_EV, &fi->pending_irqs))) {
978 		spin_unlock(&fi->lock);
979 		return 0;
980 	}
981 	ext = fi->srv_signal;
982 	/* only clear the event bits */
983 	fi->srv_signal.ext_params &= ~SCCB_EVENT_PENDING;
984 	clear_bit(IRQ_PEND_EXT_SERVICE_EV, &fi->pending_irqs);
985 	spin_unlock(&fi->lock);
986 
987 	VCPU_EVENT(vcpu, 4, "%s", "deliver: sclp parameter event");
988 	vcpu->stat.deliver_service_signal++;
989 	trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_INT_SERVICE,
990 					 ext.ext_params, 0);
991 
992 	return write_sclp(vcpu, ext.ext_params & SCCB_EVENT_PENDING);
993 }
994 
995 static int __must_check __deliver_pfault_done(struct kvm_vcpu *vcpu)
996 {
997 	struct kvm_s390_float_interrupt *fi = &vcpu->kvm->arch.float_int;
998 	struct kvm_s390_interrupt_info *inti;
999 	int rc = 0;
1000 
1001 	spin_lock(&fi->lock);
1002 	inti = list_first_entry_or_null(&fi->lists[FIRQ_LIST_PFAULT],
1003 					struct kvm_s390_interrupt_info,
1004 					list);
1005 	if (inti) {
1006 		list_del(&inti->list);
1007 		fi->counters[FIRQ_CNTR_PFAULT] -= 1;
1008 	}
1009 	if (list_empty(&fi->lists[FIRQ_LIST_PFAULT]))
1010 		clear_bit(IRQ_PEND_PFAULT_DONE, &fi->pending_irqs);
1011 	spin_unlock(&fi->lock);
1012 
1013 	if (inti) {
1014 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
1015 						 KVM_S390_INT_PFAULT_DONE, 0,
1016 						 inti->ext.ext_params2);
1017 		VCPU_EVENT(vcpu, 4, "deliver: pfault done token 0x%llx",
1018 			   inti->ext.ext_params2);
1019 
1020 		rc  = put_guest_lc(vcpu, EXT_IRQ_CP_SERVICE,
1021 				(u16 *)__LC_EXT_INT_CODE);
1022 		rc |= put_guest_lc(vcpu, PFAULT_DONE,
1023 				(u16 *)__LC_EXT_CPU_ADDR);
1024 		rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
1025 				&vcpu->arch.sie_block->gpsw,
1026 				sizeof(psw_t));
1027 		rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW,
1028 				&vcpu->arch.sie_block->gpsw,
1029 				sizeof(psw_t));
1030 		rc |= put_guest_lc(vcpu, inti->ext.ext_params2,
1031 				(u64 *)__LC_EXT_PARAMS2);
1032 		kfree(inti);
1033 	}
1034 	return rc ? -EFAULT : 0;
1035 }
1036 
1037 static int __must_check __deliver_virtio(struct kvm_vcpu *vcpu)
1038 {
1039 	struct kvm_s390_float_interrupt *fi = &vcpu->kvm->arch.float_int;
1040 	struct kvm_s390_interrupt_info *inti;
1041 	int rc = 0;
1042 
1043 	spin_lock(&fi->lock);
1044 	inti = list_first_entry_or_null(&fi->lists[FIRQ_LIST_VIRTIO],
1045 					struct kvm_s390_interrupt_info,
1046 					list);
1047 	if (inti) {
1048 		VCPU_EVENT(vcpu, 4,
1049 			   "deliver: virtio parm: 0x%x,parm64: 0x%llx",
1050 			   inti->ext.ext_params, inti->ext.ext_params2);
1051 		vcpu->stat.deliver_virtio++;
1052 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
1053 				inti->type,
1054 				inti->ext.ext_params,
1055 				inti->ext.ext_params2);
1056 		list_del(&inti->list);
1057 		fi->counters[FIRQ_CNTR_VIRTIO] -= 1;
1058 	}
1059 	if (list_empty(&fi->lists[FIRQ_LIST_VIRTIO]))
1060 		clear_bit(IRQ_PEND_VIRTIO, &fi->pending_irqs);
1061 	spin_unlock(&fi->lock);
1062 
1063 	if (inti) {
1064 		rc  = put_guest_lc(vcpu, EXT_IRQ_CP_SERVICE,
1065 				(u16 *)__LC_EXT_INT_CODE);
1066 		rc |= put_guest_lc(vcpu, VIRTIO_PARAM,
1067 				(u16 *)__LC_EXT_CPU_ADDR);
1068 		rc |= write_guest_lc(vcpu, __LC_EXT_OLD_PSW,
1069 				&vcpu->arch.sie_block->gpsw,
1070 				sizeof(psw_t));
1071 		rc |= read_guest_lc(vcpu, __LC_EXT_NEW_PSW,
1072 				&vcpu->arch.sie_block->gpsw,
1073 				sizeof(psw_t));
1074 		rc |= put_guest_lc(vcpu, inti->ext.ext_params,
1075 				(u32 *)__LC_EXT_PARAMS);
1076 		rc |= put_guest_lc(vcpu, inti->ext.ext_params2,
1077 				(u64 *)__LC_EXT_PARAMS2);
1078 		kfree(inti);
1079 	}
1080 	return rc ? -EFAULT : 0;
1081 }
1082 
1083 static int __do_deliver_io(struct kvm_vcpu *vcpu, struct kvm_s390_io_info *io)
1084 {
1085 	int rc;
1086 
1087 	if (kvm_s390_pv_cpu_is_protected(vcpu)) {
1088 		vcpu->arch.sie_block->iictl = IICTL_CODE_IO;
1089 		vcpu->arch.sie_block->subchannel_id = io->subchannel_id;
1090 		vcpu->arch.sie_block->subchannel_nr = io->subchannel_nr;
1091 		vcpu->arch.sie_block->io_int_parm = io->io_int_parm;
1092 		vcpu->arch.sie_block->io_int_word = io->io_int_word;
1093 		return 0;
1094 	}
1095 
1096 	rc  = put_guest_lc(vcpu, io->subchannel_id, (u16 *)__LC_SUBCHANNEL_ID);
1097 	rc |= put_guest_lc(vcpu, io->subchannel_nr, (u16 *)__LC_SUBCHANNEL_NR);
1098 	rc |= put_guest_lc(vcpu, io->io_int_parm, (u32 *)__LC_IO_INT_PARM);
1099 	rc |= put_guest_lc(vcpu, io->io_int_word, (u32 *)__LC_IO_INT_WORD);
1100 	rc |= write_guest_lc(vcpu, __LC_IO_OLD_PSW,
1101 			     &vcpu->arch.sie_block->gpsw,
1102 			     sizeof(psw_t));
1103 	rc |= read_guest_lc(vcpu, __LC_IO_NEW_PSW,
1104 			    &vcpu->arch.sie_block->gpsw,
1105 			    sizeof(psw_t));
1106 	return rc ? -EFAULT : 0;
1107 }
1108 
1109 static int __must_check __deliver_io(struct kvm_vcpu *vcpu,
1110 				     unsigned long irq_type)
1111 {
1112 	struct list_head *isc_list;
1113 	struct kvm_s390_float_interrupt *fi;
1114 	struct kvm_s390_gisa_interrupt *gi = &vcpu->kvm->arch.gisa_int;
1115 	struct kvm_s390_interrupt_info *inti = NULL;
1116 	struct kvm_s390_io_info io;
1117 	u32 isc;
1118 	int rc = 0;
1119 
1120 	fi = &vcpu->kvm->arch.float_int;
1121 
1122 	spin_lock(&fi->lock);
1123 	isc = irq_type_to_isc(irq_type);
1124 	isc_list = &fi->lists[isc];
1125 	inti = list_first_entry_or_null(isc_list,
1126 					struct kvm_s390_interrupt_info,
1127 					list);
1128 	if (inti) {
1129 		if (inti->type & KVM_S390_INT_IO_AI_MASK)
1130 			VCPU_EVENT(vcpu, 4, "%s", "deliver: I/O (AI)");
1131 		else
1132 			VCPU_EVENT(vcpu, 4, "deliver: I/O %x ss %x schid %04x",
1133 			inti->io.subchannel_id >> 8,
1134 			inti->io.subchannel_id >> 1 & 0x3,
1135 			inti->io.subchannel_nr);
1136 
1137 		vcpu->stat.deliver_io++;
1138 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
1139 				inti->type,
1140 				((__u32)inti->io.subchannel_id << 16) |
1141 				inti->io.subchannel_nr,
1142 				((__u64)inti->io.io_int_parm << 32) |
1143 				inti->io.io_int_word);
1144 		list_del(&inti->list);
1145 		fi->counters[FIRQ_CNTR_IO] -= 1;
1146 	}
1147 	if (list_empty(isc_list))
1148 		clear_bit(irq_type, &fi->pending_irqs);
1149 	spin_unlock(&fi->lock);
1150 
1151 	if (inti) {
1152 		rc = __do_deliver_io(vcpu, &(inti->io));
1153 		kfree(inti);
1154 		goto out;
1155 	}
1156 
1157 	if (gi->origin && gisa_tac_ipm_gisc(gi->origin, isc)) {
1158 		/*
1159 		 * in case an adapter interrupt was not delivered
1160 		 * in SIE context KVM will handle the delivery
1161 		 */
1162 		VCPU_EVENT(vcpu, 4, "%s isc %u", "deliver: I/O (AI/gisa)", isc);
1163 		memset(&io, 0, sizeof(io));
1164 		io.io_int_word = isc_to_int_word(isc);
1165 		vcpu->stat.deliver_io++;
1166 		trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
1167 			KVM_S390_INT_IO(1, 0, 0, 0),
1168 			((__u32)io.subchannel_id << 16) |
1169 			io.subchannel_nr,
1170 			((__u64)io.io_int_parm << 32) |
1171 			io.io_int_word);
1172 		rc = __do_deliver_io(vcpu, &io);
1173 	}
1174 out:
1175 	return rc;
1176 }
1177 
1178 /* Check whether an external call is pending (deliverable or not) */
1179 int kvm_s390_ext_call_pending(struct kvm_vcpu *vcpu)
1180 {
1181 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1182 
1183 	if (!kvm_s390_use_sca_entries())
1184 		return test_bit(IRQ_PEND_EXT_EXTERNAL, &li->pending_irqs);
1185 
1186 	return sca_ext_call_pending(vcpu, NULL);
1187 }
1188 
1189 int kvm_s390_vcpu_has_irq(struct kvm_vcpu *vcpu, int exclude_stop)
1190 {
1191 	if (deliverable_irqs(vcpu))
1192 		return 1;
1193 
1194 	if (kvm_cpu_has_pending_timer(vcpu))
1195 		return 1;
1196 
1197 	/* external call pending and deliverable */
1198 	if (kvm_s390_ext_call_pending(vcpu) &&
1199 	    !psw_extint_disabled(vcpu) &&
1200 	    (vcpu->arch.sie_block->gcr[0] & CR0_EXTERNAL_CALL_SUBMASK))
1201 		return 1;
1202 
1203 	if (!exclude_stop && kvm_s390_is_stop_irq_pending(vcpu))
1204 		return 1;
1205 	return 0;
1206 }
1207 
1208 int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu)
1209 {
1210 	return ckc_irq_pending(vcpu) || cpu_timer_irq_pending(vcpu);
1211 }
1212 
1213 static u64 __calculate_sltime(struct kvm_vcpu *vcpu)
1214 {
1215 	const u64 now = kvm_s390_get_tod_clock_fast(vcpu->kvm);
1216 	const u64 ckc = vcpu->arch.sie_block->ckc;
1217 	u64 cputm, sltime = 0;
1218 
1219 	if (ckc_interrupts_enabled(vcpu)) {
1220 		if (vcpu->arch.sie_block->gcr[0] & CR0_CLOCK_COMPARATOR_SIGN) {
1221 			if ((s64)now < (s64)ckc)
1222 				sltime = tod_to_ns((s64)ckc - (s64)now);
1223 		} else if (now < ckc) {
1224 			sltime = tod_to_ns(ckc - now);
1225 		}
1226 		/* already expired */
1227 		if (!sltime)
1228 			return 0;
1229 		if (cpu_timer_interrupts_enabled(vcpu)) {
1230 			cputm = kvm_s390_get_cpu_timer(vcpu);
1231 			/* already expired? */
1232 			if (cputm >> 63)
1233 				return 0;
1234 			return min_t(u64, sltime, tod_to_ns(cputm));
1235 		}
1236 	} else if (cpu_timer_interrupts_enabled(vcpu)) {
1237 		sltime = kvm_s390_get_cpu_timer(vcpu);
1238 		/* already expired? */
1239 		if (sltime >> 63)
1240 			return 0;
1241 	}
1242 	return sltime;
1243 }
1244 
1245 int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
1246 {
1247 	struct kvm_s390_gisa_interrupt *gi = &vcpu->kvm->arch.gisa_int;
1248 	u64 sltime;
1249 
1250 	vcpu->stat.exit_wait_state++;
1251 
1252 	/* fast path */
1253 	if (kvm_arch_vcpu_runnable(vcpu))
1254 		return 0;
1255 
1256 	if (psw_interrupts_disabled(vcpu)) {
1257 		VCPU_EVENT(vcpu, 3, "%s", "disabled wait");
1258 		return -EOPNOTSUPP; /* disabled wait */
1259 	}
1260 
1261 	if (gi->origin &&
1262 	    (gisa_get_ipm_or_restore_iam(gi) &
1263 	     vcpu->arch.sie_block->gcr[6] >> 24))
1264 		return 0;
1265 
1266 	if (!ckc_interrupts_enabled(vcpu) &&
1267 	    !cpu_timer_interrupts_enabled(vcpu)) {
1268 		VCPU_EVENT(vcpu, 3, "%s", "enabled wait w/o timer");
1269 		__set_cpu_idle(vcpu);
1270 		goto no_timer;
1271 	}
1272 
1273 	sltime = __calculate_sltime(vcpu);
1274 	if (!sltime)
1275 		return 0;
1276 
1277 	__set_cpu_idle(vcpu);
1278 	hrtimer_start(&vcpu->arch.ckc_timer, sltime, HRTIMER_MODE_REL);
1279 	VCPU_EVENT(vcpu, 4, "enabled wait: %llu ns", sltime);
1280 no_timer:
1281 	kvm_vcpu_srcu_read_unlock(vcpu);
1282 	vcpu->kvm->arch.float_int.last_sleep_cpu = vcpu->vcpu_idx;
1283 	kvm_vcpu_halt(vcpu);
1284 	vcpu->valid_wakeup = false;
1285 	__unset_cpu_idle(vcpu);
1286 	kvm_vcpu_srcu_read_lock(vcpu);
1287 
1288 	hrtimer_cancel(&vcpu->arch.ckc_timer);
1289 	return 0;
1290 }
1291 
1292 void kvm_s390_vcpu_wakeup(struct kvm_vcpu *vcpu)
1293 {
1294 	vcpu->valid_wakeup = true;
1295 	kvm_vcpu_wake_up(vcpu);
1296 
1297 	/*
1298 	 * The VCPU might not be sleeping but rather executing VSIE. Let's
1299 	 * kick it, so it leaves the SIE to process the request.
1300 	 */
1301 	kvm_s390_vsie_kick(vcpu);
1302 }
1303 
1304 enum hrtimer_restart kvm_s390_idle_wakeup(struct hrtimer *timer)
1305 {
1306 	struct kvm_vcpu *vcpu;
1307 	u64 sltime;
1308 
1309 	vcpu = container_of(timer, struct kvm_vcpu, arch.ckc_timer);
1310 	sltime = __calculate_sltime(vcpu);
1311 
1312 	/*
1313 	 * If the monotonic clock runs faster than the tod clock we might be
1314 	 * woken up too early and have to go back to sleep to avoid deadlocks.
1315 	 */
1316 	if (sltime && hrtimer_forward_now(timer, ns_to_ktime(sltime)))
1317 		return HRTIMER_RESTART;
1318 	kvm_s390_vcpu_wakeup(vcpu);
1319 	return HRTIMER_NORESTART;
1320 }
1321 
1322 void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu)
1323 {
1324 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1325 
1326 	spin_lock(&li->lock);
1327 	li->pending_irqs = 0;
1328 	bitmap_zero(li->sigp_emerg_pending, KVM_MAX_VCPUS);
1329 	memset(&li->irq, 0, sizeof(li->irq));
1330 	spin_unlock(&li->lock);
1331 
1332 	sca_clear_ext_call(vcpu);
1333 }
1334 
1335 int __must_check kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
1336 {
1337 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1338 	int rc = 0;
1339 	bool delivered = false;
1340 	unsigned long irq_type;
1341 	unsigned long irqs;
1342 
1343 	__reset_intercept_indicators(vcpu);
1344 
1345 	/* pending ckc conditions might have been invalidated */
1346 	clear_bit(IRQ_PEND_EXT_CLOCK_COMP, &li->pending_irqs);
1347 	if (ckc_irq_pending(vcpu))
1348 		set_bit(IRQ_PEND_EXT_CLOCK_COMP, &li->pending_irqs);
1349 
1350 	/* pending cpu timer conditions might have been invalidated */
1351 	clear_bit(IRQ_PEND_EXT_CPU_TIMER, &li->pending_irqs);
1352 	if (cpu_timer_irq_pending(vcpu))
1353 		set_bit(IRQ_PEND_EXT_CPU_TIMER, &li->pending_irqs);
1354 
1355 	while ((irqs = deliverable_irqs(vcpu)) && !rc) {
1356 		/* bits are in the reverse order of interrupt priority */
1357 		irq_type = find_last_bit(&irqs, IRQ_PEND_COUNT);
1358 		switch (irq_type) {
1359 		case IRQ_PEND_IO_ISC_0:
1360 		case IRQ_PEND_IO_ISC_1:
1361 		case IRQ_PEND_IO_ISC_2:
1362 		case IRQ_PEND_IO_ISC_3:
1363 		case IRQ_PEND_IO_ISC_4:
1364 		case IRQ_PEND_IO_ISC_5:
1365 		case IRQ_PEND_IO_ISC_6:
1366 		case IRQ_PEND_IO_ISC_7:
1367 			rc = __deliver_io(vcpu, irq_type);
1368 			break;
1369 		case IRQ_PEND_MCHK_EX:
1370 		case IRQ_PEND_MCHK_REP:
1371 			rc = __deliver_machine_check(vcpu);
1372 			break;
1373 		case IRQ_PEND_PROG:
1374 			rc = __deliver_prog(vcpu);
1375 			break;
1376 		case IRQ_PEND_EXT_EMERGENCY:
1377 			rc = __deliver_emergency_signal(vcpu);
1378 			break;
1379 		case IRQ_PEND_EXT_EXTERNAL:
1380 			rc = __deliver_external_call(vcpu);
1381 			break;
1382 		case IRQ_PEND_EXT_CLOCK_COMP:
1383 			rc = __deliver_ckc(vcpu);
1384 			break;
1385 		case IRQ_PEND_EXT_CPU_TIMER:
1386 			rc = __deliver_cpu_timer(vcpu);
1387 			break;
1388 		case IRQ_PEND_RESTART:
1389 			rc = __deliver_restart(vcpu);
1390 			break;
1391 		case IRQ_PEND_SET_PREFIX:
1392 			rc = __deliver_set_prefix(vcpu);
1393 			break;
1394 		case IRQ_PEND_PFAULT_INIT:
1395 			rc = __deliver_pfault_init(vcpu);
1396 			break;
1397 		case IRQ_PEND_EXT_SERVICE:
1398 			rc = __deliver_service(vcpu);
1399 			break;
1400 		case IRQ_PEND_EXT_SERVICE_EV:
1401 			rc = __deliver_service_ev(vcpu);
1402 			break;
1403 		case IRQ_PEND_PFAULT_DONE:
1404 			rc = __deliver_pfault_done(vcpu);
1405 			break;
1406 		case IRQ_PEND_VIRTIO:
1407 			rc = __deliver_virtio(vcpu);
1408 			break;
1409 		default:
1410 			WARN_ONCE(1, "Unknown pending irq type %ld", irq_type);
1411 			clear_bit(irq_type, &li->pending_irqs);
1412 		}
1413 		delivered |= !rc;
1414 	}
1415 
1416 	/*
1417 	 * We delivered at least one interrupt and modified the PC. Force a
1418 	 * singlestep event now.
1419 	 */
1420 	if (delivered && guestdbg_sstep_enabled(vcpu)) {
1421 		struct kvm_debug_exit_arch *debug_exit = &vcpu->run->debug.arch;
1422 
1423 		debug_exit->addr = vcpu->arch.sie_block->gpsw.addr;
1424 		debug_exit->type = KVM_SINGLESTEP;
1425 		vcpu->guest_debug |= KVM_GUESTDBG_EXIT_PENDING;
1426 	}
1427 
1428 	set_intercept_indicators(vcpu);
1429 
1430 	return rc;
1431 }
1432 
1433 static int __inject_prog(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
1434 {
1435 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1436 
1437 	vcpu->stat.inject_program++;
1438 	VCPU_EVENT(vcpu, 3, "inject: program irq code 0x%x", irq->u.pgm.code);
1439 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_PROGRAM_INT,
1440 				   irq->u.pgm.code, 0);
1441 
1442 	if (!(irq->u.pgm.flags & KVM_S390_PGM_FLAGS_ILC_VALID)) {
1443 		/* auto detection if no valid ILC was given */
1444 		irq->u.pgm.flags &= ~KVM_S390_PGM_FLAGS_ILC_MASK;
1445 		irq->u.pgm.flags |= kvm_s390_get_ilen(vcpu);
1446 		irq->u.pgm.flags |= KVM_S390_PGM_FLAGS_ILC_VALID;
1447 	}
1448 
1449 	if (irq->u.pgm.code == PGM_PER) {
1450 		li->irq.pgm.code |= PGM_PER;
1451 		li->irq.pgm.flags = irq->u.pgm.flags;
1452 		/* only modify PER related information */
1453 		li->irq.pgm.per_address = irq->u.pgm.per_address;
1454 		li->irq.pgm.per_code = irq->u.pgm.per_code;
1455 		li->irq.pgm.per_atmid = irq->u.pgm.per_atmid;
1456 		li->irq.pgm.per_access_id = irq->u.pgm.per_access_id;
1457 	} else if (!(irq->u.pgm.code & PGM_PER)) {
1458 		li->irq.pgm.code = (li->irq.pgm.code & PGM_PER) |
1459 				   irq->u.pgm.code;
1460 		li->irq.pgm.flags = irq->u.pgm.flags;
1461 		/* only modify non-PER information */
1462 		li->irq.pgm.trans_exc_code = irq->u.pgm.trans_exc_code;
1463 		li->irq.pgm.mon_code = irq->u.pgm.mon_code;
1464 		li->irq.pgm.data_exc_code = irq->u.pgm.data_exc_code;
1465 		li->irq.pgm.mon_class_nr = irq->u.pgm.mon_class_nr;
1466 		li->irq.pgm.exc_access_id = irq->u.pgm.exc_access_id;
1467 		li->irq.pgm.op_access_id = irq->u.pgm.op_access_id;
1468 	} else {
1469 		li->irq.pgm = irq->u.pgm;
1470 	}
1471 	set_bit(IRQ_PEND_PROG, &li->pending_irqs);
1472 	return 0;
1473 }
1474 
1475 static int __inject_pfault_init(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
1476 {
1477 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1478 
1479 	vcpu->stat.inject_pfault_init++;
1480 	VCPU_EVENT(vcpu, 4, "inject: pfault init parameter block at 0x%llx",
1481 		   irq->u.ext.ext_params2);
1482 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_PFAULT_INIT,
1483 				   irq->u.ext.ext_params,
1484 				   irq->u.ext.ext_params2);
1485 
1486 	li->irq.ext = irq->u.ext;
1487 	set_bit(IRQ_PEND_PFAULT_INIT, &li->pending_irqs);
1488 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_EXT_INT);
1489 	return 0;
1490 }
1491 
1492 static int __inject_extcall(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
1493 {
1494 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1495 	struct kvm_s390_extcall_info *extcall = &li->irq.extcall;
1496 	uint16_t src_id = irq->u.extcall.code;
1497 
1498 	vcpu->stat.inject_external_call++;
1499 	VCPU_EVENT(vcpu, 4, "inject: external call source-cpu:%u",
1500 		   src_id);
1501 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_EXTERNAL_CALL,
1502 				   src_id, 0);
1503 
1504 	/* sending vcpu invalid */
1505 	if (kvm_get_vcpu_by_id(vcpu->kvm, src_id) == NULL)
1506 		return -EINVAL;
1507 
1508 	if (kvm_s390_use_sca_entries() && !kvm_s390_pv_cpu_get_handle(vcpu))
1509 		return sca_inject_ext_call(vcpu, src_id);
1510 
1511 	if (test_and_set_bit(IRQ_PEND_EXT_EXTERNAL, &li->pending_irqs))
1512 		return -EBUSY;
1513 	*extcall = irq->u.extcall;
1514 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_EXT_INT);
1515 	return 0;
1516 }
1517 
1518 static int __inject_set_prefix(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
1519 {
1520 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1521 	struct kvm_s390_prefix_info *prefix = &li->irq.prefix;
1522 
1523 	vcpu->stat.inject_set_prefix++;
1524 	VCPU_EVENT(vcpu, 3, "inject: set prefix to %x",
1525 		   irq->u.prefix.address);
1526 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_SIGP_SET_PREFIX,
1527 				   irq->u.prefix.address, 0);
1528 
1529 	if (!is_vcpu_stopped(vcpu))
1530 		return -EBUSY;
1531 
1532 	*prefix = irq->u.prefix;
1533 	set_bit(IRQ_PEND_SET_PREFIX, &li->pending_irqs);
1534 	return 0;
1535 }
1536 
1537 #define KVM_S390_STOP_SUPP_FLAGS (KVM_S390_STOP_FLAG_STORE_STATUS)
1538 static int __inject_sigp_stop(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
1539 {
1540 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1541 	struct kvm_s390_stop_info *stop = &li->irq.stop;
1542 	int rc = 0;
1543 
1544 	vcpu->stat.inject_stop_signal++;
1545 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_SIGP_STOP, 0, 0);
1546 
1547 	if (irq->u.stop.flags & ~KVM_S390_STOP_SUPP_FLAGS)
1548 		return -EINVAL;
1549 
1550 	if (is_vcpu_stopped(vcpu)) {
1551 		if (irq->u.stop.flags & KVM_S390_STOP_FLAG_STORE_STATUS)
1552 			rc = kvm_s390_store_status_unloaded(vcpu,
1553 						KVM_S390_STORE_STATUS_NOADDR);
1554 		return rc;
1555 	}
1556 
1557 	if (test_and_set_bit(IRQ_PEND_SIGP_STOP, &li->pending_irqs))
1558 		return -EBUSY;
1559 	stop->flags = irq->u.stop.flags;
1560 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOP_INT);
1561 	return 0;
1562 }
1563 
1564 static int __inject_sigp_restart(struct kvm_vcpu *vcpu)
1565 {
1566 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1567 
1568 	vcpu->stat.inject_restart++;
1569 	VCPU_EVENT(vcpu, 3, "%s", "inject: restart int");
1570 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_RESTART, 0, 0);
1571 
1572 	set_bit(IRQ_PEND_RESTART, &li->pending_irqs);
1573 	return 0;
1574 }
1575 
1576 static int __inject_sigp_emergency(struct kvm_vcpu *vcpu,
1577 				   struct kvm_s390_irq *irq)
1578 {
1579 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1580 
1581 	vcpu->stat.inject_emergency_signal++;
1582 	VCPU_EVENT(vcpu, 4, "inject: emergency from cpu %u",
1583 		   irq->u.emerg.code);
1584 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_EMERGENCY,
1585 				   irq->u.emerg.code, 0);
1586 
1587 	/* sending vcpu invalid */
1588 	if (kvm_get_vcpu_by_id(vcpu->kvm, irq->u.emerg.code) == NULL)
1589 		return -EINVAL;
1590 
1591 	set_bit(irq->u.emerg.code, li->sigp_emerg_pending);
1592 	set_bit(IRQ_PEND_EXT_EMERGENCY, &li->pending_irqs);
1593 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_EXT_INT);
1594 	return 0;
1595 }
1596 
1597 static int __inject_mchk(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
1598 {
1599 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1600 	struct kvm_s390_mchk_info *mchk = &li->irq.mchk;
1601 
1602 	vcpu->stat.inject_mchk++;
1603 	VCPU_EVENT(vcpu, 3, "inject: machine check mcic 0x%llx",
1604 		   irq->u.mchk.mcic);
1605 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_MCHK, 0,
1606 				   irq->u.mchk.mcic);
1607 
1608 	/*
1609 	 * Because repressible machine checks can be indicated along with
1610 	 * exigent machine checks (PoP, Chapter 11, Interruption action)
1611 	 * we need to combine cr14, mcic and external damage code.
1612 	 * Failing storage address and the logout area should not be or'ed
1613 	 * together, we just indicate the last occurrence of the corresponding
1614 	 * machine check
1615 	 */
1616 	mchk->cr14 |= irq->u.mchk.cr14;
1617 	mchk->mcic |= irq->u.mchk.mcic;
1618 	mchk->ext_damage_code |= irq->u.mchk.ext_damage_code;
1619 	mchk->failing_storage_address = irq->u.mchk.failing_storage_address;
1620 	memcpy(&mchk->fixed_logout, &irq->u.mchk.fixed_logout,
1621 	       sizeof(mchk->fixed_logout));
1622 	if (mchk->mcic & MCHK_EX_MASK)
1623 		set_bit(IRQ_PEND_MCHK_EX, &li->pending_irqs);
1624 	else if (mchk->mcic & MCHK_REP_MASK)
1625 		set_bit(IRQ_PEND_MCHK_REP,  &li->pending_irqs);
1626 	return 0;
1627 }
1628 
1629 static int __inject_ckc(struct kvm_vcpu *vcpu)
1630 {
1631 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1632 
1633 	vcpu->stat.inject_ckc++;
1634 	VCPU_EVENT(vcpu, 3, "%s", "inject: clock comparator external");
1635 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_CLOCK_COMP,
1636 				   0, 0);
1637 
1638 	set_bit(IRQ_PEND_EXT_CLOCK_COMP, &li->pending_irqs);
1639 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_EXT_INT);
1640 	return 0;
1641 }
1642 
1643 static int __inject_cpu_timer(struct kvm_vcpu *vcpu)
1644 {
1645 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
1646 
1647 	vcpu->stat.inject_cputm++;
1648 	VCPU_EVENT(vcpu, 3, "%s", "inject: cpu timer external");
1649 	trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_CPU_TIMER,
1650 				   0, 0);
1651 
1652 	set_bit(IRQ_PEND_EXT_CPU_TIMER, &li->pending_irqs);
1653 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_EXT_INT);
1654 	return 0;
1655 }
1656 
1657 static struct kvm_s390_interrupt_info *get_io_int(struct kvm *kvm,
1658 						  int isc, u32 schid)
1659 {
1660 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
1661 	struct list_head *isc_list = &fi->lists[FIRQ_LIST_IO_ISC_0 + isc];
1662 	struct kvm_s390_interrupt_info *iter;
1663 	u16 id = (schid & 0xffff0000U) >> 16;
1664 	u16 nr = schid & 0x0000ffffU;
1665 
1666 	spin_lock(&fi->lock);
1667 	list_for_each_entry(iter, isc_list, list) {
1668 		if (schid && (id != iter->io.subchannel_id ||
1669 			      nr != iter->io.subchannel_nr))
1670 			continue;
1671 		/* found an appropriate entry */
1672 		list_del_init(&iter->list);
1673 		fi->counters[FIRQ_CNTR_IO] -= 1;
1674 		if (list_empty(isc_list))
1675 			clear_bit(isc_to_irq_type(isc), &fi->pending_irqs);
1676 		spin_unlock(&fi->lock);
1677 		return iter;
1678 	}
1679 	spin_unlock(&fi->lock);
1680 	return NULL;
1681 }
1682 
1683 static struct kvm_s390_interrupt_info *get_top_io_int(struct kvm *kvm,
1684 						      u64 isc_mask, u32 schid)
1685 {
1686 	struct kvm_s390_interrupt_info *inti = NULL;
1687 	int isc;
1688 
1689 	for (isc = 0; isc <= MAX_ISC && !inti; isc++) {
1690 		if (isc_mask & isc_to_isc_bits(isc))
1691 			inti = get_io_int(kvm, isc, schid);
1692 	}
1693 	return inti;
1694 }
1695 
1696 static int get_top_gisa_isc(struct kvm *kvm, u64 isc_mask, u32 schid)
1697 {
1698 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
1699 	unsigned long active_mask;
1700 	int isc;
1701 
1702 	if (schid)
1703 		goto out;
1704 	if (!gi->origin)
1705 		goto out;
1706 
1707 	active_mask = (isc_mask & gisa_get_ipm(gi->origin) << 24) << 32;
1708 	while (active_mask) {
1709 		isc = __fls(active_mask) ^ (BITS_PER_LONG - 1);
1710 		if (gisa_tac_ipm_gisc(gi->origin, isc))
1711 			return isc;
1712 		clear_bit_inv(isc, &active_mask);
1713 	}
1714 out:
1715 	return -EINVAL;
1716 }
1717 
1718 /*
1719  * Dequeue and return an I/O interrupt matching any of the interruption
1720  * subclasses as designated by the isc mask in cr6 and the schid (if != 0).
1721  * Take into account the interrupts pending in the interrupt list and in GISA.
1722  *
1723  * Note that for a guest that does not enable I/O interrupts
1724  * but relies on TPI, a flood of classic interrupts may starve
1725  * out adapter interrupts on the same isc. Linux does not do
1726  * that, and it is possible to work around the issue by configuring
1727  * different iscs for classic and adapter interrupts in the guest,
1728  * but we may want to revisit this in the future.
1729  */
1730 struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
1731 						    u64 isc_mask, u32 schid)
1732 {
1733 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
1734 	struct kvm_s390_interrupt_info *inti, *tmp_inti;
1735 	int isc;
1736 
1737 	inti = get_top_io_int(kvm, isc_mask, schid);
1738 
1739 	isc = get_top_gisa_isc(kvm, isc_mask, schid);
1740 	if (isc < 0)
1741 		/* no AI in GISA */
1742 		goto out;
1743 
1744 	if (!inti)
1745 		/* AI in GISA but no classical IO int */
1746 		goto gisa_out;
1747 
1748 	/* both types of interrupts present */
1749 	if (int_word_to_isc(inti->io.io_int_word) <= isc) {
1750 		/* classical IO int with higher priority */
1751 		gisa_set_ipm_gisc(gi->origin, isc);
1752 		goto out;
1753 	}
1754 gisa_out:
1755 	tmp_inti = kzalloc_obj(*inti, GFP_KERNEL_ACCOUNT);
1756 	if (tmp_inti) {
1757 		tmp_inti->type = KVM_S390_INT_IO(1, 0, 0, 0);
1758 		tmp_inti->io.io_int_word = isc_to_int_word(isc);
1759 		if (inti)
1760 			kvm_s390_reinject_io_int(kvm, inti);
1761 		inti = tmp_inti;
1762 	} else
1763 		gisa_set_ipm_gisc(gi->origin, isc);
1764 out:
1765 	return inti;
1766 }
1767 
1768 static int __inject_service(struct kvm *kvm,
1769 			     struct kvm_s390_interrupt_info *inti)
1770 {
1771 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
1772 
1773 	kvm->stat.inject_service_signal++;
1774 	spin_lock(&fi->lock);
1775 	fi->srv_signal.ext_params |= inti->ext.ext_params & SCCB_EVENT_PENDING;
1776 
1777 	/* We always allow events, track them separately from the sccb ints */
1778 	if (fi->srv_signal.ext_params & SCCB_EVENT_PENDING)
1779 		set_bit(IRQ_PEND_EXT_SERVICE_EV, &fi->pending_irqs);
1780 
1781 	/*
1782 	 * Early versions of the QEMU s390 bios will inject several
1783 	 * service interrupts after another without handling a
1784 	 * condition code indicating busy.
1785 	 * We will silently ignore those superfluous sccb values.
1786 	 * A future version of QEMU will take care of serialization
1787 	 * of servc requests
1788 	 */
1789 	if (fi->srv_signal.ext_params & SCCB_MASK)
1790 		goto out;
1791 	fi->srv_signal.ext_params |= inti->ext.ext_params & SCCB_MASK;
1792 	set_bit(IRQ_PEND_EXT_SERVICE, &fi->pending_irqs);
1793 out:
1794 	spin_unlock(&fi->lock);
1795 	kfree(inti);
1796 	return 0;
1797 }
1798 
1799 static int __inject_virtio(struct kvm *kvm,
1800 			    struct kvm_s390_interrupt_info *inti)
1801 {
1802 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
1803 
1804 	kvm->stat.inject_virtio++;
1805 	spin_lock(&fi->lock);
1806 	if (fi->counters[FIRQ_CNTR_VIRTIO] >= KVM_S390_MAX_VIRTIO_IRQS) {
1807 		spin_unlock(&fi->lock);
1808 		return -EBUSY;
1809 	}
1810 	fi->counters[FIRQ_CNTR_VIRTIO] += 1;
1811 	list_add_tail(&inti->list, &fi->lists[FIRQ_LIST_VIRTIO]);
1812 	set_bit(IRQ_PEND_VIRTIO, &fi->pending_irqs);
1813 	spin_unlock(&fi->lock);
1814 	return 0;
1815 }
1816 
1817 static int __inject_pfault_done(struct kvm *kvm,
1818 				 struct kvm_s390_interrupt_info *inti)
1819 {
1820 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
1821 
1822 	kvm->stat.inject_pfault_done++;
1823 	spin_lock(&fi->lock);
1824 	if (fi->counters[FIRQ_CNTR_PFAULT] >=
1825 		(ASYNC_PF_PER_VCPU * KVM_MAX_VCPUS)) {
1826 		spin_unlock(&fi->lock);
1827 		return -EBUSY;
1828 	}
1829 	fi->counters[FIRQ_CNTR_PFAULT] += 1;
1830 	list_add_tail(&inti->list, &fi->lists[FIRQ_LIST_PFAULT]);
1831 	set_bit(IRQ_PEND_PFAULT_DONE, &fi->pending_irqs);
1832 	spin_unlock(&fi->lock);
1833 	return 0;
1834 }
1835 
1836 #define CR_PENDING_SUBCLASS 28
1837 static int __inject_float_mchk(struct kvm *kvm,
1838 				struct kvm_s390_interrupt_info *inti)
1839 {
1840 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
1841 
1842 	kvm->stat.inject_float_mchk++;
1843 	spin_lock(&fi->lock);
1844 	fi->mchk.cr14 |= inti->mchk.cr14 & (1UL << CR_PENDING_SUBCLASS);
1845 	fi->mchk.mcic |= inti->mchk.mcic;
1846 	set_bit(IRQ_PEND_MCHK_REP, &fi->pending_irqs);
1847 	spin_unlock(&fi->lock);
1848 	kfree(inti);
1849 	return 0;
1850 }
1851 
1852 static int __inject_io(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
1853 {
1854 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
1855 	struct kvm_s390_float_interrupt *fi;
1856 	struct list_head *list;
1857 	int isc;
1858 
1859 	kvm->stat.inject_io++;
1860 	isc = int_word_to_isc(inti->io.io_int_word);
1861 
1862 	/*
1863 	 * We do not use the lock checking variant as this is just a
1864 	 * performance optimization and we do not hold the lock here.
1865 	 * This is ok as the code will pick interrupts from both "lists"
1866 	 * for delivery.
1867 	 */
1868 	if (gi->origin && inti->type & KVM_S390_INT_IO_AI_MASK) {
1869 		VM_EVENT(kvm, 4, "%s isc %1u", "inject: I/O (AI/gisa)", isc);
1870 		gisa_set_ipm_gisc(gi->origin, isc);
1871 		kfree(inti);
1872 		return 0;
1873 	}
1874 
1875 	fi = &kvm->arch.float_int;
1876 	spin_lock(&fi->lock);
1877 	if (fi->counters[FIRQ_CNTR_IO] >= KVM_S390_MAX_FLOAT_IRQS) {
1878 		spin_unlock(&fi->lock);
1879 		return -EBUSY;
1880 	}
1881 	fi->counters[FIRQ_CNTR_IO] += 1;
1882 
1883 	if (inti->type & KVM_S390_INT_IO_AI_MASK)
1884 		VM_EVENT(kvm, 4, "%s", "inject: I/O (AI)");
1885 	else
1886 		VM_EVENT(kvm, 4, "inject: I/O %x ss %x schid %04x",
1887 			inti->io.subchannel_id >> 8,
1888 			inti->io.subchannel_id >> 1 & 0x3,
1889 			inti->io.subchannel_nr);
1890 	list = &fi->lists[FIRQ_LIST_IO_ISC_0 + isc];
1891 	list_add_tail(&inti->list, list);
1892 	set_bit(isc_to_irq_type(isc), &fi->pending_irqs);
1893 	spin_unlock(&fi->lock);
1894 	return 0;
1895 }
1896 
1897 /*
1898  * Find a destination VCPU for a floating irq and kick it.
1899  */
1900 static void __floating_irq_kick(struct kvm *kvm, u64 type)
1901 {
1902 	struct kvm_vcpu *dst_vcpu;
1903 	int sigcpu, online_vcpus, nr_tries = 0;
1904 
1905 	online_vcpus = atomic_read(&kvm->online_vcpus);
1906 	if (!online_vcpus)
1907 		return;
1908 
1909 	for (sigcpu = kvm->arch.float_int.last_sleep_cpu; ; sigcpu++) {
1910 		sigcpu %= online_vcpus;
1911 		dst_vcpu = kvm_get_vcpu(kvm, sigcpu);
1912 		if (!is_vcpu_stopped(dst_vcpu))
1913 			break;
1914 		/* avoid endless loops if all vcpus are stopped */
1915 		if (nr_tries++ >= online_vcpus)
1916 			return;
1917 	}
1918 
1919 	/* make the VCPU drop out of the SIE, or wake it up if sleeping */
1920 	switch (type) {
1921 	case KVM_S390_MCHK:
1922 		kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_STOP_INT);
1923 		break;
1924 	case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
1925 		if (!(type & KVM_S390_INT_IO_AI_MASK &&
1926 		      kvm->arch.gisa_int.origin) ||
1927 		      kvm_s390_pv_cpu_get_handle(dst_vcpu))
1928 			kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_IO_INT);
1929 		break;
1930 	default:
1931 		kvm_s390_set_cpuflags(dst_vcpu, CPUSTAT_EXT_INT);
1932 		break;
1933 	}
1934 	kvm_s390_vcpu_wakeup(dst_vcpu);
1935 }
1936 
1937 static int __inject_vm(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
1938 {
1939 	u64 type = READ_ONCE(inti->type);
1940 	int rc;
1941 
1942 	switch (type) {
1943 	case KVM_S390_MCHK:
1944 		rc = __inject_float_mchk(kvm, inti);
1945 		break;
1946 	case KVM_S390_INT_VIRTIO:
1947 		rc = __inject_virtio(kvm, inti);
1948 		break;
1949 	case KVM_S390_INT_SERVICE:
1950 		rc = __inject_service(kvm, inti);
1951 		break;
1952 	case KVM_S390_INT_PFAULT_DONE:
1953 		rc = __inject_pfault_done(kvm, inti);
1954 		break;
1955 	case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
1956 		rc = __inject_io(kvm, inti);
1957 		break;
1958 	default:
1959 		rc = -EINVAL;
1960 	}
1961 	if (rc)
1962 		return rc;
1963 
1964 	__floating_irq_kick(kvm, type);
1965 	return 0;
1966 }
1967 
1968 int kvm_s390_inject_vm(struct kvm *kvm,
1969 		       struct kvm_s390_interrupt *s390int)
1970 {
1971 	struct kvm_s390_interrupt_info *inti;
1972 	int rc;
1973 
1974 	inti = kzalloc_obj(*inti, GFP_KERNEL_ACCOUNT);
1975 	if (!inti)
1976 		return -ENOMEM;
1977 
1978 	inti->type = s390int->type;
1979 	switch (inti->type) {
1980 	case KVM_S390_INT_VIRTIO:
1981 		VM_EVENT(kvm, 5, "inject: virtio parm:%x,parm64:%llx",
1982 			 s390int->parm, s390int->parm64);
1983 		inti->ext.ext_params = s390int->parm;
1984 		inti->ext.ext_params2 = s390int->parm64;
1985 		break;
1986 	case KVM_S390_INT_SERVICE:
1987 		VM_EVENT(kvm, 4, "inject: sclp parm:%x", s390int->parm);
1988 		inti->ext.ext_params = s390int->parm;
1989 		break;
1990 	case KVM_S390_INT_PFAULT_DONE:
1991 		inti->ext.ext_params2 = s390int->parm64;
1992 		break;
1993 	case KVM_S390_MCHK:
1994 		VM_EVENT(kvm, 3, "inject: machine check mcic 0x%llx",
1995 			 s390int->parm64);
1996 		inti->mchk.cr14 = s390int->parm; /* upper bits are not used */
1997 		inti->mchk.mcic = s390int->parm64;
1998 		break;
1999 	case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
2000 		inti->io.subchannel_id = s390int->parm >> 16;
2001 		inti->io.subchannel_nr = s390int->parm & 0x0000ffffu;
2002 		inti->io.io_int_parm = s390int->parm64 >> 32;
2003 		inti->io.io_int_word = s390int->parm64 & 0x00000000ffffffffull;
2004 		break;
2005 	default:
2006 		kfree(inti);
2007 		return -EINVAL;
2008 	}
2009 	trace_kvm_s390_inject_vm(s390int->type, s390int->parm, s390int->parm64,
2010 				 2);
2011 
2012 	rc = __inject_vm(kvm, inti);
2013 	if (rc)
2014 		kfree(inti);
2015 	return rc;
2016 }
2017 
2018 int kvm_s390_reinject_io_int(struct kvm *kvm,
2019 			      struct kvm_s390_interrupt_info *inti)
2020 {
2021 	return __inject_vm(kvm, inti);
2022 }
2023 
2024 int s390int_to_s390irq(struct kvm_s390_interrupt *s390int,
2025 		       struct kvm_s390_irq *irq)
2026 {
2027 	irq->type = s390int->type;
2028 	switch (irq->type) {
2029 	case KVM_S390_PROGRAM_INT:
2030 		if (s390int->parm & 0xffff0000)
2031 			return -EINVAL;
2032 		irq->u.pgm.code = s390int->parm;
2033 		break;
2034 	case KVM_S390_SIGP_SET_PREFIX:
2035 		irq->u.prefix.address = s390int->parm;
2036 		break;
2037 	case KVM_S390_SIGP_STOP:
2038 		irq->u.stop.flags = s390int->parm;
2039 		break;
2040 	case KVM_S390_INT_EXTERNAL_CALL:
2041 		if (s390int->parm & 0xffff0000)
2042 			return -EINVAL;
2043 		irq->u.extcall.code = s390int->parm;
2044 		break;
2045 	case KVM_S390_INT_EMERGENCY:
2046 		if (s390int->parm & 0xffff0000)
2047 			return -EINVAL;
2048 		irq->u.emerg.code = s390int->parm;
2049 		break;
2050 	case KVM_S390_MCHK:
2051 		irq->u.mchk.mcic = s390int->parm64;
2052 		break;
2053 	case KVM_S390_INT_PFAULT_INIT:
2054 		irq->u.ext.ext_params = s390int->parm;
2055 		irq->u.ext.ext_params2 = s390int->parm64;
2056 		break;
2057 	case KVM_S390_RESTART:
2058 	case KVM_S390_INT_CLOCK_COMP:
2059 	case KVM_S390_INT_CPU_TIMER:
2060 		break;
2061 	default:
2062 		return -EINVAL;
2063 	}
2064 	return 0;
2065 }
2066 
2067 int kvm_s390_is_stop_irq_pending(struct kvm_vcpu *vcpu)
2068 {
2069 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
2070 
2071 	return test_bit(IRQ_PEND_SIGP_STOP, &li->pending_irqs);
2072 }
2073 
2074 int kvm_s390_is_restart_irq_pending(struct kvm_vcpu *vcpu)
2075 {
2076 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
2077 
2078 	return test_bit(IRQ_PEND_RESTART, &li->pending_irqs);
2079 }
2080 
2081 void kvm_s390_clear_stop_irq(struct kvm_vcpu *vcpu)
2082 {
2083 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
2084 
2085 	spin_lock(&li->lock);
2086 	li->irq.stop.flags = 0;
2087 	clear_bit(IRQ_PEND_SIGP_STOP, &li->pending_irqs);
2088 	spin_unlock(&li->lock);
2089 }
2090 
2091 static int do_inject_vcpu(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
2092 {
2093 	int rc;
2094 
2095 	switch (irq->type) {
2096 	case KVM_S390_PROGRAM_INT:
2097 		rc = __inject_prog(vcpu, irq);
2098 		break;
2099 	case KVM_S390_SIGP_SET_PREFIX:
2100 		rc = __inject_set_prefix(vcpu, irq);
2101 		break;
2102 	case KVM_S390_SIGP_STOP:
2103 		rc = __inject_sigp_stop(vcpu, irq);
2104 		break;
2105 	case KVM_S390_RESTART:
2106 		rc = __inject_sigp_restart(vcpu);
2107 		break;
2108 	case KVM_S390_INT_CLOCK_COMP:
2109 		rc = __inject_ckc(vcpu);
2110 		break;
2111 	case KVM_S390_INT_CPU_TIMER:
2112 		rc = __inject_cpu_timer(vcpu);
2113 		break;
2114 	case KVM_S390_INT_EXTERNAL_CALL:
2115 		rc = __inject_extcall(vcpu, irq);
2116 		break;
2117 	case KVM_S390_INT_EMERGENCY:
2118 		rc = __inject_sigp_emergency(vcpu, irq);
2119 		break;
2120 	case KVM_S390_MCHK:
2121 		rc = __inject_mchk(vcpu, irq);
2122 		break;
2123 	case KVM_S390_INT_PFAULT_INIT:
2124 		rc = __inject_pfault_init(vcpu, irq);
2125 		break;
2126 	case KVM_S390_INT_VIRTIO:
2127 	case KVM_S390_INT_SERVICE:
2128 	case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
2129 	default:
2130 		rc = -EINVAL;
2131 	}
2132 
2133 	return rc;
2134 }
2135 
2136 int kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
2137 {
2138 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
2139 	int rc;
2140 
2141 	spin_lock(&li->lock);
2142 	rc = do_inject_vcpu(vcpu, irq);
2143 	spin_unlock(&li->lock);
2144 	if (!rc)
2145 		kvm_s390_vcpu_wakeup(vcpu);
2146 	return rc;
2147 }
2148 
2149 static inline void clear_irq_list(struct list_head *_list)
2150 {
2151 	struct kvm_s390_interrupt_info *inti, *n;
2152 
2153 	list_for_each_entry_safe(inti, n, _list, list) {
2154 		list_del(&inti->list);
2155 		kfree(inti);
2156 	}
2157 }
2158 
2159 static void inti_to_irq(struct kvm_s390_interrupt_info *inti,
2160 		       struct kvm_s390_irq *irq)
2161 {
2162 	irq->type = inti->type;
2163 	switch (inti->type) {
2164 	case KVM_S390_INT_PFAULT_INIT:
2165 	case KVM_S390_INT_PFAULT_DONE:
2166 	case KVM_S390_INT_VIRTIO:
2167 		irq->u.ext = inti->ext;
2168 		break;
2169 	case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
2170 		irq->u.io = inti->io;
2171 		break;
2172 	}
2173 }
2174 
2175 void kvm_s390_clear_float_irqs(struct kvm *kvm)
2176 {
2177 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
2178 	int i;
2179 
2180 	mutex_lock(&kvm->lock);
2181 	if (!kvm_s390_pv_is_protected(kvm))
2182 		fi->masked_irqs = 0;
2183 	mutex_unlock(&kvm->lock);
2184 	spin_lock(&fi->lock);
2185 	fi->pending_irqs = 0;
2186 	memset(&fi->srv_signal, 0, sizeof(fi->srv_signal));
2187 	memset(&fi->mchk, 0, sizeof(fi->mchk));
2188 	for (i = 0; i < FIRQ_LIST_COUNT; i++)
2189 		clear_irq_list(&fi->lists[i]);
2190 	for (i = 0; i < FIRQ_MAX_COUNT; i++)
2191 		fi->counters[i] = 0;
2192 	spin_unlock(&fi->lock);
2193 	kvm_s390_gisa_clear(kvm);
2194 };
2195 
2196 static int get_all_floating_irqs(struct kvm *kvm, u8 __user *usrbuf, u64 len)
2197 {
2198 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
2199 	struct kvm_s390_interrupt_info *inti;
2200 	struct kvm_s390_float_interrupt *fi;
2201 	struct kvm_s390_irq *buf;
2202 	struct kvm_s390_irq *irq;
2203 	int max_irqs;
2204 	int ret = 0;
2205 	int n = 0;
2206 	int i;
2207 
2208 	if (len > KVM_S390_FLIC_MAX_BUFFER || len == 0)
2209 		return -EINVAL;
2210 
2211 	/*
2212 	 * We are already using -ENOMEM to signal
2213 	 * userspace it may retry with a bigger buffer,
2214 	 * so we need to use something else for this case
2215 	 */
2216 	buf = vzalloc(len);
2217 	if (!buf)
2218 		return -ENOBUFS;
2219 
2220 	max_irqs = len / sizeof(struct kvm_s390_irq);
2221 
2222 	if (gi->origin && gisa_get_ipm(gi->origin)) {
2223 		for (i = 0; i <= MAX_ISC; i++) {
2224 			if (n == max_irqs) {
2225 				/* signal userspace to try again */
2226 				ret = -ENOMEM;
2227 				goto out_nolock;
2228 			}
2229 			if (gisa_tac_ipm_gisc(gi->origin, i)) {
2230 				irq = (struct kvm_s390_irq *) &buf[n];
2231 				irq->type = KVM_S390_INT_IO(1, 0, 0, 0);
2232 				irq->u.io.io_int_word = isc_to_int_word(i);
2233 				n++;
2234 			}
2235 		}
2236 	}
2237 	fi = &kvm->arch.float_int;
2238 	spin_lock(&fi->lock);
2239 	for (i = 0; i < FIRQ_LIST_COUNT; i++) {
2240 		list_for_each_entry(inti, &fi->lists[i], list) {
2241 			if (n == max_irqs) {
2242 				/* signal userspace to try again */
2243 				ret = -ENOMEM;
2244 				goto out;
2245 			}
2246 			inti_to_irq(inti, &buf[n]);
2247 			n++;
2248 		}
2249 	}
2250 	if (test_bit(IRQ_PEND_EXT_SERVICE, &fi->pending_irqs) ||
2251 	    test_bit(IRQ_PEND_EXT_SERVICE_EV, &fi->pending_irqs)) {
2252 		if (n == max_irqs) {
2253 			/* signal userspace to try again */
2254 			ret = -ENOMEM;
2255 			goto out;
2256 		}
2257 		irq = (struct kvm_s390_irq *) &buf[n];
2258 		irq->type = KVM_S390_INT_SERVICE;
2259 		irq->u.ext = fi->srv_signal;
2260 		n++;
2261 	}
2262 	if (test_bit(IRQ_PEND_MCHK_REP, &fi->pending_irqs)) {
2263 		if (n == max_irqs) {
2264 				/* signal userspace to try again */
2265 				ret = -ENOMEM;
2266 				goto out;
2267 		}
2268 		irq = (struct kvm_s390_irq *) &buf[n];
2269 		irq->type = KVM_S390_MCHK;
2270 		irq->u.mchk = fi->mchk;
2271 		n++;
2272 }
2273 
2274 out:
2275 	spin_unlock(&fi->lock);
2276 out_nolock:
2277 	if (!ret && n > 0) {
2278 		if (copy_to_user(usrbuf, buf, sizeof(struct kvm_s390_irq) * n))
2279 			ret = -EFAULT;
2280 	}
2281 	vfree(buf);
2282 
2283 	return ret < 0 ? ret : n;
2284 }
2285 
2286 static int flic_ais_mode_get_all(struct kvm *kvm, struct kvm_device_attr *attr)
2287 {
2288 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
2289 	struct kvm_s390_ais_all ais;
2290 
2291 	if (attr->attr < sizeof(ais))
2292 		return -EINVAL;
2293 
2294 	if (!test_kvm_facility(kvm, 72))
2295 		return -EOPNOTSUPP;
2296 
2297 	mutex_lock(&fi->ais_lock);
2298 	ais.simm = fi->simm;
2299 	ais.nimm = fi->nimm;
2300 	mutex_unlock(&fi->ais_lock);
2301 
2302 	if (copy_to_user((void __user *)attr->addr, &ais, sizeof(ais)))
2303 		return -EFAULT;
2304 
2305 	return 0;
2306 }
2307 
2308 static int flic_get_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
2309 {
2310 	int r;
2311 
2312 	switch (attr->group) {
2313 	case KVM_DEV_FLIC_GET_ALL_IRQS:
2314 		r = get_all_floating_irqs(dev->kvm, (u8 __user *) attr->addr,
2315 					  attr->attr);
2316 		break;
2317 	case KVM_DEV_FLIC_AISM_ALL:
2318 		r = flic_ais_mode_get_all(dev->kvm, attr);
2319 		break;
2320 	default:
2321 		r = -EINVAL;
2322 	}
2323 
2324 	return r;
2325 }
2326 
2327 static inline int copy_irq_from_user(struct kvm_s390_interrupt_info *inti,
2328 				     u64 addr)
2329 {
2330 	struct kvm_s390_irq __user *uptr = (struct kvm_s390_irq __user *) addr;
2331 	void *target = NULL;
2332 	void __user *source;
2333 	u64 size;
2334 
2335 	if (get_user(inti->type, (u64 __user *)addr))
2336 		return -EFAULT;
2337 
2338 	switch (inti->type) {
2339 	case KVM_S390_INT_PFAULT_INIT:
2340 	case KVM_S390_INT_PFAULT_DONE:
2341 	case KVM_S390_INT_VIRTIO:
2342 	case KVM_S390_INT_SERVICE:
2343 		target = (void *) &inti->ext;
2344 		source = &uptr->u.ext;
2345 		size = sizeof(inti->ext);
2346 		break;
2347 	case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
2348 		target = (void *) &inti->io;
2349 		source = &uptr->u.io;
2350 		size = sizeof(inti->io);
2351 		break;
2352 	case KVM_S390_MCHK:
2353 		target = (void *) &inti->mchk;
2354 		source = &uptr->u.mchk;
2355 		size = sizeof(inti->mchk);
2356 		break;
2357 	default:
2358 		return -EINVAL;
2359 	}
2360 
2361 	if (copy_from_user(target, source, size))
2362 		return -EFAULT;
2363 
2364 	return 0;
2365 }
2366 
2367 static int enqueue_floating_irq(struct kvm_device *dev,
2368 				struct kvm_device_attr *attr)
2369 {
2370 	struct kvm_s390_interrupt_info *inti = NULL;
2371 	int r = 0;
2372 	int len = attr->attr;
2373 
2374 	if (len % sizeof(struct kvm_s390_irq) != 0)
2375 		return -EINVAL;
2376 	else if (len > KVM_S390_FLIC_MAX_BUFFER)
2377 		return -EINVAL;
2378 
2379 	while (len >= sizeof(struct kvm_s390_irq)) {
2380 		inti = kzalloc_obj(*inti, GFP_KERNEL_ACCOUNT);
2381 		if (!inti)
2382 			return -ENOMEM;
2383 
2384 		r = copy_irq_from_user(inti, attr->addr);
2385 		if (r) {
2386 			kfree(inti);
2387 			return r;
2388 		}
2389 		r = __inject_vm(dev->kvm, inti);
2390 		if (r) {
2391 			kfree(inti);
2392 			return r;
2393 		}
2394 		len -= sizeof(struct kvm_s390_irq);
2395 		attr->addr += sizeof(struct kvm_s390_irq);
2396 	}
2397 
2398 	return r;
2399 }
2400 
2401 static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
2402 {
2403 	if (id >= MAX_S390_IO_ADAPTERS)
2404 		return NULL;
2405 	id = array_index_nospec(id, MAX_S390_IO_ADAPTERS);
2406 	return kvm->arch.adapters[id];
2407 }
2408 
2409 static int register_io_adapter(struct kvm_device *dev,
2410 			       struct kvm_device_attr *attr)
2411 {
2412 	struct s390_io_adapter *adapter;
2413 	struct kvm_s390_io_adapter adapter_info;
2414 
2415 	if (copy_from_user(&adapter_info,
2416 			   (void __user *)attr->addr, sizeof(adapter_info)))
2417 		return -EFAULT;
2418 
2419 	if (adapter_info.id >= MAX_S390_IO_ADAPTERS)
2420 		return -EINVAL;
2421 
2422 	adapter_info.id = array_index_nospec(adapter_info.id,
2423 					     MAX_S390_IO_ADAPTERS);
2424 
2425 	if (dev->kvm->arch.adapters[adapter_info.id] != NULL)
2426 		return -EINVAL;
2427 
2428 	adapter = kzalloc_obj(*adapter, GFP_KERNEL_ACCOUNT);
2429 	if (!adapter)
2430 		return -ENOMEM;
2431 
2432 	adapter->id = adapter_info.id;
2433 	adapter->isc = adapter_info.isc;
2434 	adapter->maskable = adapter_info.maskable;
2435 	adapter->masked = false;
2436 	adapter->swap = adapter_info.swap;
2437 	adapter->suppressible = (adapter_info.flags) &
2438 				KVM_S390_ADAPTER_SUPPRESSIBLE;
2439 	dev->kvm->arch.adapters[adapter->id] = adapter;
2440 
2441 	return 0;
2442 }
2443 
2444 int kvm_s390_mask_adapter(struct kvm *kvm, unsigned int id, bool masked)
2445 {
2446 	int ret;
2447 	struct s390_io_adapter *adapter = get_io_adapter(kvm, id);
2448 
2449 	if (!adapter || !adapter->maskable)
2450 		return -EINVAL;
2451 	ret = adapter->masked;
2452 	adapter->masked = masked;
2453 	return ret;
2454 }
2455 
2456 void kvm_s390_destroy_adapters(struct kvm *kvm)
2457 {
2458 	int i;
2459 
2460 	for (i = 0; i < MAX_S390_IO_ADAPTERS; i++)
2461 		kfree(kvm->arch.adapters[i]);
2462 }
2463 
2464 static int modify_io_adapter(struct kvm_device *dev,
2465 			     struct kvm_device_attr *attr)
2466 {
2467 	struct kvm_s390_io_adapter_req req;
2468 	struct s390_io_adapter *adapter;
2469 	int ret;
2470 
2471 	if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
2472 		return -EFAULT;
2473 
2474 	adapter = get_io_adapter(dev->kvm, req.id);
2475 	if (!adapter)
2476 		return -EINVAL;
2477 	switch (req.type) {
2478 	case KVM_S390_IO_ADAPTER_MASK:
2479 		ret = kvm_s390_mask_adapter(dev->kvm, req.id, req.mask);
2480 		if (ret > 0)
2481 			ret = 0;
2482 		break;
2483 	/*
2484 	 * The following operations are no longer needed and therefore no-ops.
2485 	 * The gpa to hva translation is done when an IRQ route is set up. The
2486 	 * set_irq code uses get_user_pages_remote() to do the actual write.
2487 	 */
2488 	case KVM_S390_IO_ADAPTER_MAP:
2489 	case KVM_S390_IO_ADAPTER_UNMAP:
2490 		ret = 0;
2491 		break;
2492 	default:
2493 		ret = -EINVAL;
2494 	}
2495 
2496 	return ret;
2497 }
2498 
2499 static int clear_io_irq(struct kvm *kvm, struct kvm_device_attr *attr)
2500 
2501 {
2502 	const u64 isc_mask = 0xffUL << 24; /* all iscs set */
2503 	u32 schid;
2504 
2505 	if (attr->flags)
2506 		return -EINVAL;
2507 	if (attr->attr != sizeof(schid))
2508 		return -EINVAL;
2509 	if (copy_from_user(&schid, (void __user *) attr->addr, sizeof(schid)))
2510 		return -EFAULT;
2511 	if (!schid)
2512 		return -EINVAL;
2513 	kfree(kvm_s390_get_io_int(kvm, isc_mask, schid));
2514 	/*
2515 	 * If userspace is conforming to the architecture, we can have at most
2516 	 * one pending I/O interrupt per subchannel, so this is effectively a
2517 	 * clear all.
2518 	 */
2519 	return 0;
2520 }
2521 
2522 static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
2523 {
2524 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
2525 	struct kvm_s390_ais_req req;
2526 	int ret = 0;
2527 
2528 	if (!test_kvm_facility(kvm, 72))
2529 		return -EOPNOTSUPP;
2530 
2531 	if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
2532 		return -EFAULT;
2533 
2534 	if (req.isc > MAX_ISC)
2535 		return -EINVAL;
2536 
2537 	trace_kvm_s390_modify_ais_mode(req.isc,
2538 				       (fi->simm & AIS_MODE_MASK(req.isc)) ?
2539 				       (fi->nimm & AIS_MODE_MASK(req.isc)) ?
2540 				       2 : KVM_S390_AIS_MODE_SINGLE :
2541 				       KVM_S390_AIS_MODE_ALL, req.mode);
2542 
2543 	mutex_lock(&fi->ais_lock);
2544 	switch (req.mode) {
2545 	case KVM_S390_AIS_MODE_ALL:
2546 		fi->simm &= ~AIS_MODE_MASK(req.isc);
2547 		fi->nimm &= ~AIS_MODE_MASK(req.isc);
2548 		break;
2549 	case KVM_S390_AIS_MODE_SINGLE:
2550 		fi->simm |= AIS_MODE_MASK(req.isc);
2551 		fi->nimm &= ~AIS_MODE_MASK(req.isc);
2552 		break;
2553 	default:
2554 		ret = -EINVAL;
2555 	}
2556 	mutex_unlock(&fi->ais_lock);
2557 
2558 	return ret;
2559 }
2560 
2561 static int kvm_s390_inject_airq(struct kvm *kvm,
2562 				struct s390_io_adapter *adapter)
2563 {
2564 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
2565 	struct kvm_s390_interrupt s390int = {
2566 		.type = KVM_S390_INT_IO(1, 0, 0, 0),
2567 		.parm = 0,
2568 		.parm64 = isc_to_int_word(adapter->isc),
2569 	};
2570 	int ret = 0;
2571 
2572 	if (!test_kvm_facility(kvm, 72) || !adapter->suppressible)
2573 		return kvm_s390_inject_vm(kvm, &s390int);
2574 
2575 	mutex_lock(&fi->ais_lock);
2576 	if (fi->nimm & AIS_MODE_MASK(adapter->isc)) {
2577 		trace_kvm_s390_airq_suppressed(adapter->id, adapter->isc);
2578 		goto out;
2579 	}
2580 
2581 	ret = kvm_s390_inject_vm(kvm, &s390int);
2582 	if (!ret && (fi->simm & AIS_MODE_MASK(adapter->isc))) {
2583 		fi->nimm |= AIS_MODE_MASK(adapter->isc);
2584 		trace_kvm_s390_modify_ais_mode(adapter->isc,
2585 					       KVM_S390_AIS_MODE_SINGLE, 2);
2586 	}
2587 out:
2588 	mutex_unlock(&fi->ais_lock);
2589 	return ret;
2590 }
2591 
2592 static int flic_inject_airq(struct kvm *kvm, struct kvm_device_attr *attr)
2593 {
2594 	unsigned int id = attr->attr;
2595 	struct s390_io_adapter *adapter = get_io_adapter(kvm, id);
2596 
2597 	if (!adapter)
2598 		return -EINVAL;
2599 
2600 	return kvm_s390_inject_airq(kvm, adapter);
2601 }
2602 
2603 static int flic_ais_mode_set_all(struct kvm *kvm, struct kvm_device_attr *attr)
2604 {
2605 	struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
2606 	struct kvm_s390_ais_all ais;
2607 
2608 	if (!test_kvm_facility(kvm, 72))
2609 		return -EOPNOTSUPP;
2610 
2611 	if (copy_from_user(&ais, (void __user *)attr->addr, sizeof(ais)))
2612 		return -EFAULT;
2613 
2614 	mutex_lock(&fi->ais_lock);
2615 	fi->simm = ais.simm;
2616 	fi->nimm = ais.nimm;
2617 	mutex_unlock(&fi->ais_lock);
2618 
2619 	return 0;
2620 }
2621 
2622 static int flic_set_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
2623 {
2624 	int r = 0;
2625 	unsigned long i;
2626 	struct kvm_vcpu *vcpu;
2627 
2628 	switch (attr->group) {
2629 	case KVM_DEV_FLIC_ENQUEUE:
2630 		r = enqueue_floating_irq(dev, attr);
2631 		break;
2632 	case KVM_DEV_FLIC_CLEAR_IRQS:
2633 		kvm_s390_clear_float_irqs(dev->kvm);
2634 		break;
2635 	case KVM_DEV_FLIC_APF_ENABLE:
2636 		if (kvm_is_ucontrol(dev->kvm))
2637 			return -EINVAL;
2638 		set_bit(GMAP_FLAG_PFAULT_ENABLED, &dev->kvm->arch.gmap->flags);
2639 		break;
2640 	case KVM_DEV_FLIC_APF_DISABLE_WAIT:
2641 		if (kvm_is_ucontrol(dev->kvm))
2642 			return -EINVAL;
2643 		clear_bit(GMAP_FLAG_PFAULT_ENABLED, &dev->kvm->arch.gmap->flags);
2644 		/*
2645 		 * Make sure no async faults are in transition when
2646 		 * clearing the queues. So we don't need to worry
2647 		 * about late coming workers.
2648 		 */
2649 		synchronize_srcu(&dev->kvm->srcu);
2650 		kvm_for_each_vcpu(i, vcpu, dev->kvm)
2651 			kvm_clear_async_pf_completion_queue(vcpu);
2652 		break;
2653 	case KVM_DEV_FLIC_ADAPTER_REGISTER:
2654 		r = register_io_adapter(dev, attr);
2655 		break;
2656 	case KVM_DEV_FLIC_ADAPTER_MODIFY:
2657 		r = modify_io_adapter(dev, attr);
2658 		break;
2659 	case KVM_DEV_FLIC_CLEAR_IO_IRQ:
2660 		r = clear_io_irq(dev->kvm, attr);
2661 		break;
2662 	case KVM_DEV_FLIC_AISM:
2663 		r = modify_ais_mode(dev->kvm, attr);
2664 		break;
2665 	case KVM_DEV_FLIC_AIRQ_INJECT:
2666 		r = flic_inject_airq(dev->kvm, attr);
2667 		break;
2668 	case KVM_DEV_FLIC_AISM_ALL:
2669 		r = flic_ais_mode_set_all(dev->kvm, attr);
2670 		break;
2671 	default:
2672 		r = -EINVAL;
2673 	}
2674 
2675 	return r;
2676 }
2677 
2678 static int flic_has_attr(struct kvm_device *dev,
2679 			     struct kvm_device_attr *attr)
2680 {
2681 	switch (attr->group) {
2682 	case KVM_DEV_FLIC_GET_ALL_IRQS:
2683 	case KVM_DEV_FLIC_ENQUEUE:
2684 	case KVM_DEV_FLIC_CLEAR_IRQS:
2685 	case KVM_DEV_FLIC_APF_ENABLE:
2686 	case KVM_DEV_FLIC_APF_DISABLE_WAIT:
2687 	case KVM_DEV_FLIC_ADAPTER_REGISTER:
2688 	case KVM_DEV_FLIC_ADAPTER_MODIFY:
2689 	case KVM_DEV_FLIC_CLEAR_IO_IRQ:
2690 	case KVM_DEV_FLIC_AISM:
2691 	case KVM_DEV_FLIC_AIRQ_INJECT:
2692 	case KVM_DEV_FLIC_AISM_ALL:
2693 		return 0;
2694 	}
2695 	return -ENXIO;
2696 }
2697 
2698 static int flic_create(struct kvm_device *dev, u32 type)
2699 {
2700 	if (!dev)
2701 		return -EINVAL;
2702 	if (dev->kvm->arch.flic)
2703 		return -EINVAL;
2704 	dev->kvm->arch.flic = dev;
2705 	return 0;
2706 }
2707 
2708 static void flic_destroy(struct kvm_device *dev)
2709 {
2710 	dev->kvm->arch.flic = NULL;
2711 	kfree(dev);
2712 }
2713 
2714 /* s390 floating irq controller (flic) */
2715 struct kvm_device_ops kvm_flic_ops = {
2716 	.name = "kvm-flic",
2717 	.get_attr = flic_get_attr,
2718 	.set_attr = flic_set_attr,
2719 	.has_attr = flic_has_attr,
2720 	.create = flic_create,
2721 	.destroy = flic_destroy,
2722 };
2723 
2724 static unsigned long get_ind_bit(__u64 addr, unsigned long bit_nr, bool swap)
2725 {
2726 	unsigned long bit;
2727 
2728 	bit = bit_nr + (addr % PAGE_SIZE) * 8;
2729 
2730 	/* kvm_set_routing_entry() should never allow this to happen */
2731 	WARN_ON_ONCE(bit > (PAGE_SIZE * BITS_PER_BYTE - 1));
2732 
2733 	return swap ? (bit ^ (BITS_PER_LONG - 1)) : bit;
2734 }
2735 
2736 static struct page *get_map_page(struct kvm *kvm, u64 uaddr)
2737 {
2738 	struct mm_struct *mm = kvm->mm;
2739 	struct page *page = NULL;
2740 	int locked = 1;
2741 
2742 	if (mmget_not_zero(mm)) {
2743 		mmap_read_lock(mm);
2744 		get_user_pages_remote(mm, uaddr, 1, FOLL_WRITE,
2745 				      &page, &locked);
2746 		if (locked)
2747 			mmap_read_unlock(mm);
2748 		mmput(mm);
2749 	}
2750 
2751 	return page;
2752 }
2753 
2754 static int adapter_indicators_set(struct kvm *kvm,
2755 				  struct s390_io_adapter *adapter,
2756 				  struct kvm_s390_adapter_int *adapter_int)
2757 {
2758 	unsigned long bit;
2759 	int summary_set, idx;
2760 	struct page *ind_page, *summary_page;
2761 	void *map;
2762 
2763 	ind_page = get_map_page(kvm, adapter_int->ind_addr);
2764 	if (!ind_page)
2765 		return -1;
2766 	summary_page = get_map_page(kvm, adapter_int->summary_addr);
2767 	if (!summary_page) {
2768 		put_page(ind_page);
2769 		return -1;
2770 	}
2771 
2772 	idx = srcu_read_lock(&kvm->srcu);
2773 	map = page_address(ind_page);
2774 	bit = get_ind_bit(adapter_int->ind_addr,
2775 			  adapter_int->ind_offset, adapter->swap);
2776 	set_bit(bit, map);
2777 	mark_page_dirty(kvm, adapter_int->ind_gaddr >> PAGE_SHIFT);
2778 	set_page_dirty_lock(ind_page);
2779 	map = page_address(summary_page);
2780 	bit = get_ind_bit(adapter_int->summary_addr,
2781 			  adapter_int->summary_offset, adapter->swap);
2782 	summary_set = test_and_set_bit(bit, map);
2783 	mark_page_dirty(kvm, adapter_int->summary_gaddr >> PAGE_SHIFT);
2784 	set_page_dirty_lock(summary_page);
2785 	srcu_read_unlock(&kvm->srcu, idx);
2786 
2787 	put_page(ind_page);
2788 	put_page(summary_page);
2789 	return summary_set ? 0 : 1;
2790 }
2791 
2792 /*
2793  * < 0 - not injected due to error
2794  * = 0 - coalesced, summary indicator already active
2795  * > 0 - injected interrupt
2796  */
2797 static int set_adapter_int(struct kvm_kernel_irq_routing_entry *e,
2798 			   struct kvm *kvm, int irq_source_id, int level,
2799 			   bool line_status)
2800 {
2801 	int ret;
2802 	struct s390_io_adapter *adapter;
2803 
2804 	/* We're only interested in the 0->1 transition. */
2805 	if (!level)
2806 		return 0;
2807 	adapter = get_io_adapter(kvm, e->adapter.adapter_id);
2808 	if (!adapter)
2809 		return -1;
2810 	ret = adapter_indicators_set(kvm, adapter, &e->adapter);
2811 	if ((ret > 0) && !adapter->masked) {
2812 		ret = kvm_s390_inject_airq(kvm, adapter);
2813 		if (ret == 0)
2814 			ret = 1;
2815 	}
2816 	return ret;
2817 }
2818 
2819 /*
2820  * Inject the machine check to the guest.
2821  */
2822 void kvm_s390_reinject_machine_check(struct kvm_vcpu *vcpu,
2823 				     struct mcck_volatile_info *mcck_info)
2824 {
2825 	struct kvm_s390_interrupt_info inti;
2826 	struct kvm_s390_irq irq;
2827 	struct kvm_s390_mchk_info *mchk;
2828 	union mci mci;
2829 	__u64 cr14 = 0;         /* upper bits are not used */
2830 	int rc;
2831 
2832 	mci.val = mcck_info->mcic;
2833 
2834 	/* log machine checks being reinjected on all debugs */
2835 	VCPU_EVENT(vcpu, 2, "guest machine check %lx", mci.val);
2836 	KVM_EVENT(2, "guest machine check %lx", mci.val);
2837 	pr_info("guest machine check pid %d: %lx", current->pid, mci.val);
2838 
2839 	if (mci.sr)
2840 		cr14 |= CR14_RECOVERY_SUBMASK;
2841 	if (mci.dg)
2842 		cr14 |= CR14_DEGRADATION_SUBMASK;
2843 	if (mci.w)
2844 		cr14 |= CR14_WARNING_SUBMASK;
2845 
2846 	mchk = mci.ck ? &inti.mchk : &irq.u.mchk;
2847 	mchk->cr14 = cr14;
2848 	mchk->mcic = mcck_info->mcic;
2849 	mchk->ext_damage_code = mcck_info->ext_damage_code;
2850 	mchk->failing_storage_address = mcck_info->failing_storage_address;
2851 	if (mci.ck) {
2852 		/* Inject the floating machine check */
2853 		inti.type = KVM_S390_MCHK;
2854 		rc = __inject_vm(vcpu->kvm, &inti);
2855 	} else {
2856 		/* Inject the machine check to specified vcpu */
2857 		irq.type = KVM_S390_MCHK;
2858 		rc = kvm_s390_inject_vcpu(vcpu, &irq);
2859 	}
2860 	WARN_ON_ONCE(rc);
2861 }
2862 
2863 int kvm_set_routing_entry(struct kvm *kvm,
2864 			  struct kvm_kernel_irq_routing_entry *e,
2865 			  const struct kvm_irq_routing_entry *ue)
2866 {
2867 	const struct kvm_irq_routing_s390_adapter *adapter;
2868 	u64 uaddr_s, uaddr_i;
2869 	int idx;
2870 
2871 	switch (ue->type) {
2872 	/* we store the userspace addresses instead of the guest addresses */
2873 	case KVM_IRQ_ROUTING_S390_ADAPTER:
2874 		if (kvm_is_ucontrol(kvm))
2875 			return -EINVAL;
2876 		e->set = set_adapter_int;
2877 
2878 		adapter = &ue->u.adapter;
2879 		if (adapter->summary_addr + (adapter->summary_offset / 8) >=
2880 		    (adapter->summary_addr & PAGE_MASK) + PAGE_SIZE)
2881 			return -EINVAL;
2882 		if (adapter->ind_addr + (adapter->ind_offset / 8) >=
2883 		    (adapter->ind_addr & PAGE_MASK) + PAGE_SIZE)
2884 			return -EINVAL;
2885 
2886 		idx = srcu_read_lock(&kvm->srcu);
2887 		uaddr_s = gpa_to_hva(kvm, ue->u.adapter.summary_addr);
2888 		uaddr_i = gpa_to_hva(kvm, ue->u.adapter.ind_addr);
2889 		srcu_read_unlock(&kvm->srcu, idx);
2890 
2891 		if (kvm_is_error_hva(uaddr_s) || kvm_is_error_hva(uaddr_i))
2892 			return -EFAULT;
2893 		e->adapter.summary_addr = uaddr_s;
2894 		e->adapter.summary_gaddr = ue->u.adapter.summary_addr;
2895 		e->adapter.ind_addr = uaddr_i;
2896 		e->adapter.ind_gaddr = ue->u.adapter.ind_addr;
2897 		e->adapter.summary_offset = ue->u.adapter.summary_offset;
2898 		e->adapter.ind_offset = ue->u.adapter.ind_offset;
2899 		e->adapter.adapter_id = ue->u.adapter.adapter_id;
2900 		return 0;
2901 	default:
2902 		return -EINVAL;
2903 	}
2904 }
2905 
2906 int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e, struct kvm *kvm,
2907 		int irq_source_id, int level, bool line_status)
2908 {
2909 	return -EINVAL;
2910 }
2911 
2912 int kvm_s390_set_irq_state(struct kvm_vcpu *vcpu, void __user *irqstate, int len)
2913 {
2914 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
2915 	struct kvm_s390_irq *buf;
2916 	int r = 0;
2917 	int n;
2918 
2919 	buf = vmalloc(len);
2920 	if (!buf)
2921 		return -ENOMEM;
2922 
2923 	if (copy_from_user((void *) buf, irqstate, len)) {
2924 		r = -EFAULT;
2925 		goto out_free;
2926 	}
2927 
2928 	/*
2929 	 * Don't allow setting the interrupt state
2930 	 * when there are already interrupts pending
2931 	 */
2932 	spin_lock(&li->lock);
2933 	if (li->pending_irqs) {
2934 		r = -EBUSY;
2935 		goto out_unlock;
2936 	}
2937 
2938 	for (n = 0; n < len / sizeof(*buf); n++) {
2939 		r = do_inject_vcpu(vcpu, &buf[n]);
2940 		if (r)
2941 			break;
2942 	}
2943 
2944 out_unlock:
2945 	spin_unlock(&li->lock);
2946 out_free:
2947 	vfree(buf);
2948 
2949 	return r;
2950 }
2951 
2952 static void store_local_irq(struct kvm_s390_local_interrupt *li,
2953 			    struct kvm_s390_irq *irq,
2954 			    unsigned long irq_type)
2955 {
2956 	switch (irq_type) {
2957 	case IRQ_PEND_MCHK_EX:
2958 	case IRQ_PEND_MCHK_REP:
2959 		irq->type = KVM_S390_MCHK;
2960 		irq->u.mchk = li->irq.mchk;
2961 		break;
2962 	case IRQ_PEND_PROG:
2963 		irq->type = KVM_S390_PROGRAM_INT;
2964 		irq->u.pgm = li->irq.pgm;
2965 		break;
2966 	case IRQ_PEND_PFAULT_INIT:
2967 		irq->type = KVM_S390_INT_PFAULT_INIT;
2968 		irq->u.ext = li->irq.ext;
2969 		break;
2970 	case IRQ_PEND_EXT_EXTERNAL:
2971 		irq->type = KVM_S390_INT_EXTERNAL_CALL;
2972 		irq->u.extcall = li->irq.extcall;
2973 		break;
2974 	case IRQ_PEND_EXT_CLOCK_COMP:
2975 		irq->type = KVM_S390_INT_CLOCK_COMP;
2976 		break;
2977 	case IRQ_PEND_EXT_CPU_TIMER:
2978 		irq->type = KVM_S390_INT_CPU_TIMER;
2979 		break;
2980 	case IRQ_PEND_SIGP_STOP:
2981 		irq->type = KVM_S390_SIGP_STOP;
2982 		irq->u.stop = li->irq.stop;
2983 		break;
2984 	case IRQ_PEND_RESTART:
2985 		irq->type = KVM_S390_RESTART;
2986 		break;
2987 	case IRQ_PEND_SET_PREFIX:
2988 		irq->type = KVM_S390_SIGP_SET_PREFIX;
2989 		irq->u.prefix = li->irq.prefix;
2990 		break;
2991 	}
2992 }
2993 
2994 int kvm_s390_get_irq_state(struct kvm_vcpu *vcpu, __u8 __user *buf, int len)
2995 {
2996 	int scn;
2997 	DECLARE_BITMAP(sigp_emerg_pending, KVM_MAX_VCPUS);
2998 	struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
2999 	unsigned long pending_irqs;
3000 	struct kvm_s390_irq irq;
3001 	unsigned long irq_type;
3002 	int cpuaddr;
3003 	int n = 0;
3004 
3005 	spin_lock(&li->lock);
3006 	pending_irqs = li->pending_irqs;
3007 	memcpy(&sigp_emerg_pending, &li->sigp_emerg_pending,
3008 	       sizeof(sigp_emerg_pending));
3009 	spin_unlock(&li->lock);
3010 
3011 	for_each_set_bit(irq_type, &pending_irqs, IRQ_PEND_COUNT) {
3012 		memset(&irq, 0, sizeof(irq));
3013 		if (irq_type == IRQ_PEND_EXT_EMERGENCY)
3014 			continue;
3015 		if (n + sizeof(irq) > len)
3016 			return -ENOBUFS;
3017 		store_local_irq(&vcpu->arch.local_int, &irq, irq_type);
3018 		if (copy_to_user(&buf[n], &irq, sizeof(irq)))
3019 			return -EFAULT;
3020 		n += sizeof(irq);
3021 	}
3022 
3023 	if (test_bit(IRQ_PEND_EXT_EMERGENCY, &pending_irqs)) {
3024 		for_each_set_bit(cpuaddr, sigp_emerg_pending, KVM_MAX_VCPUS) {
3025 			memset(&irq, 0, sizeof(irq));
3026 			if (n + sizeof(irq) > len)
3027 				return -ENOBUFS;
3028 			irq.type = KVM_S390_INT_EMERGENCY;
3029 			irq.u.emerg.code = cpuaddr;
3030 			if (copy_to_user(&buf[n], &irq, sizeof(irq)))
3031 				return -EFAULT;
3032 			n += sizeof(irq);
3033 		}
3034 	}
3035 
3036 	if (sca_ext_call_pending(vcpu, &scn)) {
3037 		if (n + sizeof(irq) > len)
3038 			return -ENOBUFS;
3039 		memset(&irq, 0, sizeof(irq));
3040 		irq.type = KVM_S390_INT_EXTERNAL_CALL;
3041 		irq.u.extcall.code = scn;
3042 		if (copy_to_user(&buf[n], &irq, sizeof(irq)))
3043 			return -EFAULT;
3044 		n += sizeof(irq);
3045 	}
3046 
3047 	return n;
3048 }
3049 
3050 static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask)
3051 {
3052 	int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus);
3053 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3054 	struct kvm_vcpu *vcpu;
3055 	u8 vcpu_isc_mask;
3056 
3057 	for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) {
3058 		vcpu = kvm_get_vcpu(kvm, vcpu_idx);
3059 		if (psw_ioint_disabled(vcpu))
3060 			continue;
3061 		vcpu_isc_mask = (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
3062 		if (deliverable_mask & vcpu_isc_mask) {
3063 			/* lately kicked but not yet running */
3064 			if (test_and_set_bit(vcpu_idx, gi->kicked_mask))
3065 				return;
3066 			kvm_s390_vcpu_wakeup(vcpu);
3067 			return;
3068 		}
3069 	}
3070 }
3071 
3072 static enum hrtimer_restart gisa_vcpu_kicker(struct hrtimer *timer)
3073 {
3074 	struct kvm_s390_gisa_interrupt *gi =
3075 		container_of(timer, struct kvm_s390_gisa_interrupt, timer);
3076 	struct kvm *kvm =
3077 		container_of(gi->origin, struct sie_page2, gisa)->kvm;
3078 	u8 pending_mask;
3079 
3080 	pending_mask = gisa_get_ipm_or_restore_iam(gi);
3081 	if (pending_mask) {
3082 		__airqs_kick_single_vcpu(kvm, pending_mask);
3083 		hrtimer_forward_now(timer, ns_to_ktime(gi->expires));
3084 		return HRTIMER_RESTART;
3085 	}
3086 
3087 	return HRTIMER_NORESTART;
3088 }
3089 
3090 #define NULL_GISA_ADDR 0x00000000UL
3091 #define NONE_GISA_ADDR 0x00000001UL
3092 #define GISA_ADDR_MASK 0xfffff000UL
3093 
3094 static void process_gib_alert_list(void)
3095 {
3096 	struct kvm_s390_gisa_interrupt *gi;
3097 	u32 final, gisa_phys, origin = 0UL;
3098 	struct kvm_s390_gisa *gisa;
3099 	struct kvm *kvm;
3100 
3101 	do {
3102 		/*
3103 		 * If the NONE_GISA_ADDR is still stored in the alert list
3104 		 * origin, we will leave the outer loop. No further GISA has
3105 		 * been added to the alert list by millicode while processing
3106 		 * the current alert list.
3107 		 */
3108 		final = (origin & NONE_GISA_ADDR);
3109 		/*
3110 		 * Cut off the alert list and store the NONE_GISA_ADDR in the
3111 		 * alert list origin to avoid further GAL interruptions.
3112 		 * A new alert list can be build up by millicode in parallel
3113 		 * for guests not in the yet cut-off alert list. When in the
3114 		 * final loop, store the NULL_GISA_ADDR instead. This will re-
3115 		 * enable GAL interruptions on the host again.
3116 		 */
3117 		origin = xchg(&gib->alert_list_origin,
3118 			      (!final) ? NONE_GISA_ADDR : NULL_GISA_ADDR);
3119 		/*
3120 		 * Loop through the just cut-off alert list and start the
3121 		 * gisa timers to kick idle vcpus to consume the pending
3122 		 * interruptions asap.
3123 		 */
3124 		while (origin & GISA_ADDR_MASK) {
3125 			gisa_phys = origin;
3126 			gisa = phys_to_virt(gisa_phys);
3127 			origin = gisa->next_alert;
3128 			gisa->next_alert = gisa_phys;
3129 			kvm = container_of(gisa, struct sie_page2, gisa)->kvm;
3130 			gi = &kvm->arch.gisa_int;
3131 			if (hrtimer_active(&gi->timer))
3132 				hrtimer_cancel(&gi->timer);
3133 			hrtimer_start(&gi->timer, 0, HRTIMER_MODE_REL);
3134 		}
3135 	} while (!final);
3136 
3137 }
3138 
3139 void kvm_s390_gisa_clear(struct kvm *kvm)
3140 {
3141 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3142 
3143 	if (!gi->origin)
3144 		return;
3145 	gisa_clear_ipm(gi->origin);
3146 	VM_EVENT(kvm, 3, "gisa 0x%p cleared", gi->origin);
3147 }
3148 
3149 void kvm_s390_gisa_init(struct kvm *kvm)
3150 {
3151 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3152 
3153 	if (!css_general_characteristics.aiv)
3154 		return;
3155 	gi->origin = &kvm->arch.sie_page2->gisa;
3156 	gi->alert.mask = 0;
3157 	spin_lock_init(&gi->alert.ref_lock);
3158 	gi->expires = 50 * 1000; /* 50 usec */
3159 	hrtimer_setup(&gi->timer, gisa_vcpu_kicker, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
3160 	memset(gi->origin, 0, sizeof(struct kvm_s390_gisa));
3161 	gi->origin->next_alert = (u32)virt_to_phys(gi->origin);
3162 	VM_EVENT(kvm, 3, "gisa 0x%p initialized", gi->origin);
3163 }
3164 
3165 void kvm_s390_gisa_enable(struct kvm *kvm)
3166 {
3167 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3168 	struct kvm_vcpu *vcpu;
3169 	unsigned long i;
3170 	u32 gisa_desc;
3171 
3172 	if (gi->origin)
3173 		return;
3174 	kvm_s390_gisa_init(kvm);
3175 	gisa_desc = kvm_s390_get_gisa_desc(kvm);
3176 	if (!gisa_desc)
3177 		return;
3178 	kvm_for_each_vcpu(i, vcpu, kvm) {
3179 		mutex_lock(&vcpu->mutex);
3180 		vcpu->arch.sie_block->gd = gisa_desc;
3181 		vcpu->arch.sie_block->eca |= ECA_AIV;
3182 		VCPU_EVENT(vcpu, 3, "AIV gisa format-%u enabled for cpu %03u",
3183 			   vcpu->arch.sie_block->gd & 0x3, vcpu->vcpu_id);
3184 		mutex_unlock(&vcpu->mutex);
3185 	}
3186 }
3187 
3188 void kvm_s390_gisa_destroy(struct kvm *kvm)
3189 {
3190 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3191 	struct kvm_s390_gisa *gisa = gi->origin;
3192 
3193 	if (!gi->origin)
3194 		return;
3195 	WARN(gi->alert.mask != 0x00,
3196 	     "unexpected non zero alert.mask 0x%02x",
3197 	     gi->alert.mask);
3198 	gi->alert.mask = 0x00;
3199 	if (gisa_set_iam(gi->origin, gi->alert.mask))
3200 		process_gib_alert_list();
3201 	hrtimer_cancel(&gi->timer);
3202 	gi->origin = NULL;
3203 	VM_EVENT(kvm, 3, "gisa 0x%p destroyed", gisa);
3204 }
3205 
3206 void kvm_s390_gisa_disable(struct kvm *kvm)
3207 {
3208 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3209 	struct kvm_vcpu *vcpu;
3210 	unsigned long i;
3211 
3212 	if (!gi->origin)
3213 		return;
3214 	kvm_for_each_vcpu(i, vcpu, kvm) {
3215 		mutex_lock(&vcpu->mutex);
3216 		vcpu->arch.sie_block->eca &= ~ECA_AIV;
3217 		vcpu->arch.sie_block->gd = 0U;
3218 		mutex_unlock(&vcpu->mutex);
3219 		VCPU_EVENT(vcpu, 3, "AIV disabled for cpu %03u", vcpu->vcpu_id);
3220 	}
3221 	kvm_s390_gisa_destroy(kvm);
3222 }
3223 
3224 /**
3225  * kvm_s390_gisc_register - register a guest ISC
3226  *
3227  * @kvm:  the kernel vm to work with
3228  * @gisc: the guest interruption sub class to register
3229  *
3230  * The function extends the vm specific alert mask to use.
3231  * The effective IAM mask in the GISA is updated as well
3232  * in case the GISA is not part of the GIB alert list.
3233  * It will be updated latest when the IAM gets restored
3234  * by gisa_get_ipm_or_restore_iam().
3235  *
3236  * Returns: the nonspecific ISC (NISC) the gib alert mechanism
3237  *          has registered with the channel subsystem.
3238  *          -ENODEV in case the vm uses no GISA
3239  *          -ERANGE in case the guest ISC is invalid
3240  */
3241 int kvm_s390_gisc_register(struct kvm *kvm, u32 gisc)
3242 {
3243 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3244 
3245 	if (!gi->origin)
3246 		return -ENODEV;
3247 	if (gisc > MAX_ISC)
3248 		return -ERANGE;
3249 
3250 	spin_lock(&gi->alert.ref_lock);
3251 	gi->alert.ref_count[gisc]++;
3252 	if (gi->alert.ref_count[gisc] == 1) {
3253 		gi->alert.mask |= 0x80 >> gisc;
3254 		gisa_set_iam(gi->origin, gi->alert.mask);
3255 	}
3256 	spin_unlock(&gi->alert.ref_lock);
3257 
3258 	return gib->nisc;
3259 }
3260 EXPORT_SYMBOL_GPL(kvm_s390_gisc_register);
3261 
3262 /**
3263  * kvm_s390_gisc_unregister - unregister a guest ISC
3264  *
3265  * @kvm:  the kernel vm to work with
3266  * @gisc: the guest interruption sub class to register
3267  *
3268  * The function reduces the vm specific alert mask to use.
3269  * The effective IAM mask in the GISA is updated as well
3270  * in case the GISA is not part of the GIB alert list.
3271  * It will be updated latest when the IAM gets restored
3272  * by gisa_get_ipm_or_restore_iam().
3273  *
3274  * Returns: the nonspecific ISC (NISC) the gib alert mechanism
3275  *          has registered with the channel subsystem.
3276  *          -ENODEV in case the vm uses no GISA
3277  *          -ERANGE in case the guest ISC is invalid
3278  *          -EINVAL in case the guest ISC is not registered
3279  */
3280 int kvm_s390_gisc_unregister(struct kvm *kvm, u32 gisc)
3281 {
3282 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
3283 	int rc = 0;
3284 
3285 	if (!gi->origin)
3286 		return -ENODEV;
3287 	if (gisc > MAX_ISC)
3288 		return -ERANGE;
3289 
3290 	spin_lock(&gi->alert.ref_lock);
3291 	if (gi->alert.ref_count[gisc] == 0) {
3292 		rc = -EINVAL;
3293 		goto out;
3294 	}
3295 	gi->alert.ref_count[gisc]--;
3296 	if (gi->alert.ref_count[gisc] == 0) {
3297 		gi->alert.mask &= ~(0x80 >> gisc);
3298 		gisa_set_iam(gi->origin, gi->alert.mask);
3299 	}
3300 out:
3301 	spin_unlock(&gi->alert.ref_lock);
3302 
3303 	return rc;
3304 }
3305 EXPORT_SYMBOL_GPL(kvm_s390_gisc_unregister);
3306 
3307 static void aen_host_forward(unsigned long si)
3308 {
3309 	struct kvm_s390_gisa_interrupt *gi;
3310 	struct zpci_gaite *gaite;
3311 	struct kvm *kvm;
3312 
3313 	gaite = (struct zpci_gaite *)aift->gait +
3314 		(si * sizeof(struct zpci_gaite));
3315 	if (gaite->count == 0)
3316 		return;
3317 	if (gaite->aisb != 0)
3318 		set_bit_inv(gaite->aisbo, phys_to_virt(gaite->aisb));
3319 
3320 	kvm = kvm_s390_pci_si_to_kvm(aift, si);
3321 	if (!kvm)
3322 		return;
3323 	gi = &kvm->arch.gisa_int;
3324 
3325 	if (!(gi->origin->g1.simm & AIS_MODE_MASK(gaite->gisc)) ||
3326 	    !(gi->origin->g1.nimm & AIS_MODE_MASK(gaite->gisc))) {
3327 		gisa_set_ipm_gisc(gi->origin, gaite->gisc);
3328 		if (hrtimer_active(&gi->timer))
3329 			hrtimer_cancel(&gi->timer);
3330 		hrtimer_start(&gi->timer, 0, HRTIMER_MODE_REL);
3331 		kvm->stat.aen_forward++;
3332 	}
3333 }
3334 
3335 static void aen_process_gait(u8 isc)
3336 {
3337 	bool found = false, first = true;
3338 	union zpci_sic_iib iib = {{0}};
3339 	unsigned long si, flags;
3340 
3341 	spin_lock_irqsave(&aift->gait_lock, flags);
3342 
3343 	if (!aift->gait) {
3344 		spin_unlock_irqrestore(&aift->gait_lock, flags);
3345 		return;
3346 	}
3347 
3348 	for (si = 0;;) {
3349 		/* Scan adapter summary indicator bit vector */
3350 		si = airq_iv_scan(aift->sbv, si, airq_iv_end(aift->sbv));
3351 		if (si == -1UL) {
3352 			if (first || found) {
3353 				/* Re-enable interrupts. */
3354 				zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, isc,
3355 						  &iib);
3356 				first = found = false;
3357 			} else {
3358 				/* Interrupts on and all bits processed */
3359 				break;
3360 			}
3361 			found = false;
3362 			si = 0;
3363 			/* Scan again after re-enabling interrupts */
3364 			continue;
3365 		}
3366 		found = true;
3367 		aen_host_forward(si);
3368 	}
3369 
3370 	spin_unlock_irqrestore(&aift->gait_lock, flags);
3371 }
3372 
3373 static void gib_alert_irq_handler(struct airq_struct *airq,
3374 				  struct tpi_info *tpi_info)
3375 {
3376 	struct tpi_adapter_info *info = (struct tpi_adapter_info *)tpi_info;
3377 
3378 	inc_irq_stat(IRQIO_GAL);
3379 
3380 	if ((info->forward || info->error) &&
3381 	    IS_ENABLED(CONFIG_VFIO_PCI_ZDEV_KVM)) {
3382 		aen_process_gait(info->isc);
3383 		if (info->aism != 0)
3384 			process_gib_alert_list();
3385 	} else {
3386 		process_gib_alert_list();
3387 	}
3388 }
3389 
3390 static struct airq_struct gib_alert_irq = {
3391 	.handler = gib_alert_irq_handler,
3392 };
3393 
3394 void kvm_s390_gib_destroy(void)
3395 {
3396 	if (!gib)
3397 		return;
3398 	if (kvm_s390_pci_interp_allowed() && aift) {
3399 		mutex_lock(&aift->aift_lock);
3400 		kvm_s390_pci_aen_exit();
3401 		mutex_unlock(&aift->aift_lock);
3402 	}
3403 	chsc_sgib(0);
3404 	unregister_adapter_interrupt(&gib_alert_irq);
3405 	free_page((unsigned long)gib);
3406 	gib = NULL;
3407 }
3408 
3409 int __init kvm_s390_gib_init(u8 nisc)
3410 {
3411 	u32 gib_origin;
3412 	int rc = 0;
3413 
3414 	if (!css_general_characteristics.aiv) {
3415 		KVM_EVENT(3, "%s", "gib not initialized, no AIV facility");
3416 		goto out;
3417 	}
3418 
3419 	gib = (struct kvm_s390_gib *)get_zeroed_page(GFP_KERNEL_ACCOUNT | GFP_DMA);
3420 	if (!gib) {
3421 		rc = -ENOMEM;
3422 		goto out;
3423 	}
3424 
3425 	gib_alert_irq.isc = nisc;
3426 	if (register_adapter_interrupt(&gib_alert_irq)) {
3427 		pr_err("Registering the GIB alert interruption handler failed\n");
3428 		rc = -EIO;
3429 		goto out_free_gib;
3430 	}
3431 	/* adapter interrupts used for AP (applicable here) don't use the LSI */
3432 	*gib_alert_irq.lsi_ptr = 0xff;
3433 
3434 	gib->nisc = nisc;
3435 	gib_origin = virt_to_phys(gib);
3436 	if (chsc_sgib(gib_origin)) {
3437 		pr_err("Associating the GIB with the AIV facility failed\n");
3438 		free_page((unsigned long)gib);
3439 		gib = NULL;
3440 		rc = -EIO;
3441 		goto out_unreg_gal;
3442 	}
3443 
3444 	if (kvm_s390_pci_interp_allowed()) {
3445 		if (kvm_s390_pci_aen_init(nisc)) {
3446 			pr_err("Initializing AEN for PCI failed\n");
3447 			rc = -EIO;
3448 			goto out_unreg_gal;
3449 		}
3450 	}
3451 
3452 	KVM_EVENT(3, "gib 0x%p (nisc=%d) initialized", gib, gib->nisc);
3453 	goto out;
3454 
3455 out_unreg_gal:
3456 	unregister_adapter_interrupt(&gib_alert_irq);
3457 out_free_gib:
3458 	free_page((unsigned long)gib);
3459 	gib = NULL;
3460 out:
3461 	return rc;
3462 }
3463