xref: /linux/arch/x86/kvm/xen.c (revision 2dc73b48665411a08c4e5f0f823dea8510761603)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Copyright © 2019 Oracle and/or its affiliates. All rights reserved.
4  * Copyright © 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
5  *
6  * KVM Xen emulation
7  */
8 
9 #include "x86.h"
10 #include "xen.h"
11 #include "hyperv.h"
12 #include "lapic.h"
13 
14 #include <linux/eventfd.h>
15 #include <linux/kvm_host.h>
16 #include <linux/sched/stat.h>
17 
18 #include <trace/events/kvm.h>
19 #include <xen/interface/xen.h>
20 #include <xen/interface/vcpu.h>
21 #include <xen/interface/version.h>
22 #include <xen/interface/event_channel.h>
23 #include <xen/interface/sched.h>
24 
25 #include "trace.h"
26 
27 static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm);
28 static int kvm_xen_setattr_evtchn(struct kvm *kvm, struct kvm_xen_hvm_attr *data);
29 static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r);
30 
31 DEFINE_STATIC_KEY_DEFERRED_FALSE(kvm_xen_enabled, HZ);
32 
33 static int kvm_xen_shared_info_init(struct kvm *kvm, gfn_t gfn)
34 {
35 	struct gfn_to_pfn_cache *gpc = &kvm->arch.xen.shinfo_cache;
36 	struct pvclock_wall_clock *wc;
37 	gpa_t gpa = gfn_to_gpa(gfn);
38 	u32 *wc_sec_hi;
39 	u32 wc_version;
40 	u64 wall_nsec;
41 	int ret = 0;
42 	int idx = srcu_read_lock(&kvm->srcu);
43 
44 	if (gfn == GPA_INVALID) {
45 		kvm_gfn_to_pfn_cache_destroy(kvm, gpc);
46 		goto out;
47 	}
48 
49 	do {
50 		ret = kvm_gfn_to_pfn_cache_init(kvm, gpc, NULL, KVM_HOST_USES_PFN,
51 						gpa, PAGE_SIZE);
52 		if (ret)
53 			goto out;
54 
55 		/*
56 		 * This code mirrors kvm_write_wall_clock() except that it writes
57 		 * directly through the pfn cache and doesn't mark the page dirty.
58 		 */
59 		wall_nsec = ktime_get_real_ns() - get_kvmclock_ns(kvm);
60 
61 		/* It could be invalid again already, so we need to check */
62 		read_lock_irq(&gpc->lock);
63 
64 		if (gpc->valid)
65 			break;
66 
67 		read_unlock_irq(&gpc->lock);
68 	} while (1);
69 
70 	/* Paranoia checks on the 32-bit struct layout */
71 	BUILD_BUG_ON(offsetof(struct compat_shared_info, wc) != 0x900);
72 	BUILD_BUG_ON(offsetof(struct compat_shared_info, arch.wc_sec_hi) != 0x924);
73 	BUILD_BUG_ON(offsetof(struct pvclock_vcpu_time_info, version) != 0);
74 
75 #ifdef CONFIG_X86_64
76 	/* Paranoia checks on the 64-bit struct layout */
77 	BUILD_BUG_ON(offsetof(struct shared_info, wc) != 0xc00);
78 	BUILD_BUG_ON(offsetof(struct shared_info, wc_sec_hi) != 0xc0c);
79 
80 	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode) {
81 		struct shared_info *shinfo = gpc->khva;
82 
83 		wc_sec_hi = &shinfo->wc_sec_hi;
84 		wc = &shinfo->wc;
85 	} else
86 #endif
87 	{
88 		struct compat_shared_info *shinfo = gpc->khva;
89 
90 		wc_sec_hi = &shinfo->arch.wc_sec_hi;
91 		wc = &shinfo->wc;
92 	}
93 
94 	/* Increment and ensure an odd value */
95 	wc_version = wc->version = (wc->version + 1) | 1;
96 	smp_wmb();
97 
98 	wc->nsec = do_div(wall_nsec,  1000000000);
99 	wc->sec = (u32)wall_nsec;
100 	*wc_sec_hi = wall_nsec >> 32;
101 	smp_wmb();
102 
103 	wc->version = wc_version + 1;
104 	read_unlock_irq(&gpc->lock);
105 
106 	kvm_make_all_cpus_request(kvm, KVM_REQ_MASTERCLOCK_UPDATE);
107 
108 out:
109 	srcu_read_unlock(&kvm->srcu, idx);
110 	return ret;
111 }
112 
113 void kvm_xen_inject_timer_irqs(struct kvm_vcpu *vcpu)
114 {
115 	if (atomic_read(&vcpu->arch.xen.timer_pending) > 0) {
116 		struct kvm_xen_evtchn e;
117 
118 		e.vcpu_id = vcpu->vcpu_id;
119 		e.vcpu_idx = vcpu->vcpu_idx;
120 		e.port = vcpu->arch.xen.timer_virq;
121 		e.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
122 
123 		kvm_xen_set_evtchn(&e, vcpu->kvm);
124 
125 		vcpu->arch.xen.timer_expires = 0;
126 		atomic_set(&vcpu->arch.xen.timer_pending, 0);
127 	}
128 }
129 
130 static enum hrtimer_restart xen_timer_callback(struct hrtimer *timer)
131 {
132 	struct kvm_vcpu *vcpu = container_of(timer, struct kvm_vcpu,
133 					     arch.xen.timer);
134 	if (atomic_read(&vcpu->arch.xen.timer_pending))
135 		return HRTIMER_NORESTART;
136 
137 	atomic_inc(&vcpu->arch.xen.timer_pending);
138 	kvm_make_request(KVM_REQ_UNBLOCK, vcpu);
139 	kvm_vcpu_kick(vcpu);
140 
141 	return HRTIMER_NORESTART;
142 }
143 
144 static void kvm_xen_start_timer(struct kvm_vcpu *vcpu, u64 guest_abs, s64 delta_ns)
145 {
146 	atomic_set(&vcpu->arch.xen.timer_pending, 0);
147 	vcpu->arch.xen.timer_expires = guest_abs;
148 
149 	if (delta_ns <= 0) {
150 		xen_timer_callback(&vcpu->arch.xen.timer);
151 	} else {
152 		ktime_t ktime_now = ktime_get();
153 		hrtimer_start(&vcpu->arch.xen.timer,
154 			      ktime_add_ns(ktime_now, delta_ns),
155 			      HRTIMER_MODE_ABS_HARD);
156 	}
157 }
158 
159 static void kvm_xen_stop_timer(struct kvm_vcpu *vcpu)
160 {
161 	hrtimer_cancel(&vcpu->arch.xen.timer);
162 	vcpu->arch.xen.timer_expires = 0;
163 	atomic_set(&vcpu->arch.xen.timer_pending, 0);
164 }
165 
166 static void kvm_xen_init_timer(struct kvm_vcpu *vcpu)
167 {
168 	hrtimer_init(&vcpu->arch.xen.timer, CLOCK_MONOTONIC,
169 		     HRTIMER_MODE_ABS_HARD);
170 	vcpu->arch.xen.timer.function = xen_timer_callback;
171 }
172 
173 static void kvm_xen_update_runstate(struct kvm_vcpu *v, int state)
174 {
175 	struct kvm_vcpu_xen *vx = &v->arch.xen;
176 	u64 now = get_kvmclock_ns(v->kvm);
177 	u64 delta_ns = now - vx->runstate_entry_time;
178 	u64 run_delay = current->sched_info.run_delay;
179 
180 	if (unlikely(!vx->runstate_entry_time))
181 		vx->current_runstate = RUNSTATE_offline;
182 
183 	/*
184 	 * Time waiting for the scheduler isn't "stolen" if the
185 	 * vCPU wasn't running anyway.
186 	 */
187 	if (vx->current_runstate == RUNSTATE_running) {
188 		u64 steal_ns = run_delay - vx->last_steal;
189 
190 		delta_ns -= steal_ns;
191 
192 		vx->runstate_times[RUNSTATE_runnable] += steal_ns;
193 	}
194 	vx->last_steal = run_delay;
195 
196 	vx->runstate_times[vx->current_runstate] += delta_ns;
197 	vx->current_runstate = state;
198 	vx->runstate_entry_time = now;
199 }
200 
201 void kvm_xen_update_runstate_guest(struct kvm_vcpu *v, int state)
202 {
203 	struct kvm_vcpu_xen *vx = &v->arch.xen;
204 	struct gfn_to_pfn_cache *gpc = &vx->runstate_cache;
205 	uint64_t *user_times;
206 	unsigned long flags;
207 	size_t user_len;
208 	int *user_state;
209 
210 	kvm_xen_update_runstate(v, state);
211 
212 	if (!vx->runstate_cache.active)
213 		return;
214 
215 	if (IS_ENABLED(CONFIG_64BIT) && v->kvm->arch.xen.long_mode)
216 		user_len = sizeof(struct vcpu_runstate_info);
217 	else
218 		user_len = sizeof(struct compat_vcpu_runstate_info);
219 
220 	read_lock_irqsave(&gpc->lock, flags);
221 	while (!kvm_gfn_to_pfn_cache_check(v->kvm, gpc, gpc->gpa,
222 					   user_len)) {
223 		read_unlock_irqrestore(&gpc->lock, flags);
224 
225 		/* When invoked from kvm_sched_out() we cannot sleep */
226 		if (state == RUNSTATE_runnable)
227 			return;
228 
229 		if (kvm_gfn_to_pfn_cache_refresh(v->kvm, gpc, gpc->gpa, user_len))
230 			return;
231 
232 		read_lock_irqsave(&gpc->lock, flags);
233 	}
234 
235 	/*
236 	 * The only difference between 32-bit and 64-bit versions of the
237 	 * runstate struct us the alignment of uint64_t in 32-bit, which
238 	 * means that the 64-bit version has an additional 4 bytes of
239 	 * padding after the first field 'state'.
240 	 *
241 	 * So we use 'int __user *user_state' to point to the state field,
242 	 * and 'uint64_t __user *user_times' for runstate_entry_time. So
243 	 * the actual array of time[] in each state starts at user_times[1].
244 	 */
245 	BUILD_BUG_ON(offsetof(struct vcpu_runstate_info, state) != 0);
246 	BUILD_BUG_ON(offsetof(struct compat_vcpu_runstate_info, state) != 0);
247 	BUILD_BUG_ON(sizeof(struct compat_vcpu_runstate_info) != 0x2c);
248 #ifdef CONFIG_X86_64
249 	BUILD_BUG_ON(offsetof(struct vcpu_runstate_info, state_entry_time) !=
250 		     offsetof(struct compat_vcpu_runstate_info, state_entry_time) + 4);
251 	BUILD_BUG_ON(offsetof(struct vcpu_runstate_info, time) !=
252 		     offsetof(struct compat_vcpu_runstate_info, time) + 4);
253 #endif
254 
255 	user_state = gpc->khva;
256 
257 	if (IS_ENABLED(CONFIG_64BIT) && v->kvm->arch.xen.long_mode)
258 		user_times = gpc->khva + offsetof(struct vcpu_runstate_info,
259 						  state_entry_time);
260 	else
261 		user_times = gpc->khva + offsetof(struct compat_vcpu_runstate_info,
262 						  state_entry_time);
263 
264 	/*
265 	 * First write the updated state_entry_time at the appropriate
266 	 * location determined by 'offset'.
267 	 */
268 	BUILD_BUG_ON(sizeof_field(struct vcpu_runstate_info, state_entry_time) !=
269 		     sizeof(user_times[0]));
270 	BUILD_BUG_ON(sizeof_field(struct compat_vcpu_runstate_info, state_entry_time) !=
271 		     sizeof(user_times[0]));
272 
273 	user_times[0] = vx->runstate_entry_time | XEN_RUNSTATE_UPDATE;
274 	smp_wmb();
275 
276 	/*
277 	 * Next, write the new runstate. This is in the *same* place
278 	 * for 32-bit and 64-bit guests, asserted here for paranoia.
279 	 */
280 	BUILD_BUG_ON(offsetof(struct vcpu_runstate_info, state) !=
281 		     offsetof(struct compat_vcpu_runstate_info, state));
282 	BUILD_BUG_ON(sizeof_field(struct vcpu_runstate_info, state) !=
283 		     sizeof(vx->current_runstate));
284 	BUILD_BUG_ON(sizeof_field(struct compat_vcpu_runstate_info, state) !=
285 		     sizeof(vx->current_runstate));
286 
287 	*user_state = vx->current_runstate;
288 
289 	/*
290 	 * Write the actual runstate times immediately after the
291 	 * runstate_entry_time.
292 	 */
293 	BUILD_BUG_ON(offsetof(struct vcpu_runstate_info, state_entry_time) !=
294 		     offsetof(struct vcpu_runstate_info, time) - sizeof(u64));
295 	BUILD_BUG_ON(offsetof(struct compat_vcpu_runstate_info, state_entry_time) !=
296 		     offsetof(struct compat_vcpu_runstate_info, time) - sizeof(u64));
297 	BUILD_BUG_ON(sizeof_field(struct vcpu_runstate_info, time) !=
298 		     sizeof_field(struct compat_vcpu_runstate_info, time));
299 	BUILD_BUG_ON(sizeof_field(struct vcpu_runstate_info, time) !=
300 		     sizeof(vx->runstate_times));
301 
302 	memcpy(user_times + 1, vx->runstate_times, sizeof(vx->runstate_times));
303 	smp_wmb();
304 
305 	/*
306 	 * Finally, clear the XEN_RUNSTATE_UPDATE bit in the guest's
307 	 * runstate_entry_time field.
308 	 */
309 	user_times[0] &= ~XEN_RUNSTATE_UPDATE;
310 	smp_wmb();
311 
312 	read_unlock_irqrestore(&gpc->lock, flags);
313 
314 	mark_page_dirty_in_slot(v->kvm, gpc->memslot, gpc->gpa >> PAGE_SHIFT);
315 }
316 
317 static void kvm_xen_inject_vcpu_vector(struct kvm_vcpu *v)
318 {
319 	struct kvm_lapic_irq irq = { };
320 	int r;
321 
322 	irq.dest_id = v->vcpu_id;
323 	irq.vector = v->arch.xen.upcall_vector;
324 	irq.dest_mode = APIC_DEST_PHYSICAL;
325 	irq.shorthand = APIC_DEST_NOSHORT;
326 	irq.delivery_mode = APIC_DM_FIXED;
327 	irq.level = 1;
328 
329 	/* The fast version will always work for physical unicast */
330 	WARN_ON_ONCE(!kvm_irq_delivery_to_apic_fast(v->kvm, NULL, &irq, &r, NULL));
331 }
332 
333 /*
334  * On event channel delivery, the vcpu_info may not have been accessible.
335  * In that case, there are bits in vcpu->arch.xen.evtchn_pending_sel which
336  * need to be marked into the vcpu_info (and evtchn_upcall_pending set).
337  * Do so now that we can sleep in the context of the vCPU to bring the
338  * page in, and refresh the pfn cache for it.
339  */
340 void kvm_xen_inject_pending_events(struct kvm_vcpu *v)
341 {
342 	unsigned long evtchn_pending_sel = READ_ONCE(v->arch.xen.evtchn_pending_sel);
343 	struct gfn_to_pfn_cache *gpc = &v->arch.xen.vcpu_info_cache;
344 	unsigned long flags;
345 
346 	if (!evtchn_pending_sel)
347 		return;
348 
349 	/*
350 	 * Yes, this is an open-coded loop. But that's just what put_user()
351 	 * does anyway. Page it in and retry the instruction. We're just a
352 	 * little more honest about it.
353 	 */
354 	read_lock_irqsave(&gpc->lock, flags);
355 	while (!kvm_gfn_to_pfn_cache_check(v->kvm, gpc, gpc->gpa,
356 					   sizeof(struct vcpu_info))) {
357 		read_unlock_irqrestore(&gpc->lock, flags);
358 
359 		if (kvm_gfn_to_pfn_cache_refresh(v->kvm, gpc, gpc->gpa,
360 						 sizeof(struct vcpu_info)))
361 			return;
362 
363 		read_lock_irqsave(&gpc->lock, flags);
364 	}
365 
366 	/* Now gpc->khva is a valid kernel address for the vcpu_info */
367 	if (IS_ENABLED(CONFIG_64BIT) && v->kvm->arch.xen.long_mode) {
368 		struct vcpu_info *vi = gpc->khva;
369 
370 		asm volatile(LOCK_PREFIX "orq %0, %1\n"
371 			     "notq %0\n"
372 			     LOCK_PREFIX "andq %0, %2\n"
373 			     : "=r" (evtchn_pending_sel),
374 			       "+m" (vi->evtchn_pending_sel),
375 			       "+m" (v->arch.xen.evtchn_pending_sel)
376 			     : "0" (evtchn_pending_sel));
377 		WRITE_ONCE(vi->evtchn_upcall_pending, 1);
378 	} else {
379 		u32 evtchn_pending_sel32 = evtchn_pending_sel;
380 		struct compat_vcpu_info *vi = gpc->khva;
381 
382 		asm volatile(LOCK_PREFIX "orl %0, %1\n"
383 			     "notl %0\n"
384 			     LOCK_PREFIX "andl %0, %2\n"
385 			     : "=r" (evtchn_pending_sel32),
386 			       "+m" (vi->evtchn_pending_sel),
387 			       "+m" (v->arch.xen.evtchn_pending_sel)
388 			     : "0" (evtchn_pending_sel32));
389 		WRITE_ONCE(vi->evtchn_upcall_pending, 1);
390 	}
391 	read_unlock_irqrestore(&gpc->lock, flags);
392 
393 	/* For the per-vCPU lapic vector, deliver it as MSI. */
394 	if (v->arch.xen.upcall_vector)
395 		kvm_xen_inject_vcpu_vector(v);
396 
397 	mark_page_dirty_in_slot(v->kvm, gpc->memslot, gpc->gpa >> PAGE_SHIFT);
398 }
399 
400 int __kvm_xen_has_interrupt(struct kvm_vcpu *v)
401 {
402 	struct gfn_to_pfn_cache *gpc = &v->arch.xen.vcpu_info_cache;
403 	unsigned long flags;
404 	u8 rc = 0;
405 
406 	/*
407 	 * If the global upcall vector (HVMIRQ_callback_vector) is set and
408 	 * the vCPU's evtchn_upcall_pending flag is set, the IRQ is pending.
409 	 */
410 
411 	/* No need for compat handling here */
412 	BUILD_BUG_ON(offsetof(struct vcpu_info, evtchn_upcall_pending) !=
413 		     offsetof(struct compat_vcpu_info, evtchn_upcall_pending));
414 	BUILD_BUG_ON(sizeof(rc) !=
415 		     sizeof_field(struct vcpu_info, evtchn_upcall_pending));
416 	BUILD_BUG_ON(sizeof(rc) !=
417 		     sizeof_field(struct compat_vcpu_info, evtchn_upcall_pending));
418 
419 	read_lock_irqsave(&gpc->lock, flags);
420 	while (!kvm_gfn_to_pfn_cache_check(v->kvm, gpc, gpc->gpa,
421 					   sizeof(struct vcpu_info))) {
422 		read_unlock_irqrestore(&gpc->lock, flags);
423 
424 		/*
425 		 * This function gets called from kvm_vcpu_block() after setting the
426 		 * task to TASK_INTERRUPTIBLE, to see if it needs to wake immediately
427 		 * from a HLT. So we really mustn't sleep. If the page ended up absent
428 		 * at that point, just return 1 in order to trigger an immediate wake,
429 		 * and we'll end up getting called again from a context where we *can*
430 		 * fault in the page and wait for it.
431 		 */
432 		if (in_atomic() || !task_is_running(current))
433 			return 1;
434 
435 		if (kvm_gfn_to_pfn_cache_refresh(v->kvm, gpc, gpc->gpa,
436 						 sizeof(struct vcpu_info))) {
437 			/*
438 			 * If this failed, userspace has screwed up the
439 			 * vcpu_info mapping. No interrupts for you.
440 			 */
441 			return 0;
442 		}
443 		read_lock_irqsave(&gpc->lock, flags);
444 	}
445 
446 	rc = ((struct vcpu_info *)gpc->khva)->evtchn_upcall_pending;
447 	read_unlock_irqrestore(&gpc->lock, flags);
448 	return rc;
449 }
450 
451 int kvm_xen_hvm_set_attr(struct kvm *kvm, struct kvm_xen_hvm_attr *data)
452 {
453 	int r = -ENOENT;
454 
455 
456 	switch (data->type) {
457 	case KVM_XEN_ATTR_TYPE_LONG_MODE:
458 		if (!IS_ENABLED(CONFIG_64BIT) && data->u.long_mode) {
459 			r = -EINVAL;
460 		} else {
461 			mutex_lock(&kvm->lock);
462 			kvm->arch.xen.long_mode = !!data->u.long_mode;
463 			mutex_unlock(&kvm->lock);
464 			r = 0;
465 		}
466 		break;
467 
468 	case KVM_XEN_ATTR_TYPE_SHARED_INFO:
469 		mutex_lock(&kvm->lock);
470 		r = kvm_xen_shared_info_init(kvm, data->u.shared_info.gfn);
471 		mutex_unlock(&kvm->lock);
472 		break;
473 
474 	case KVM_XEN_ATTR_TYPE_UPCALL_VECTOR:
475 		if (data->u.vector && data->u.vector < 0x10)
476 			r = -EINVAL;
477 		else {
478 			mutex_lock(&kvm->lock);
479 			kvm->arch.xen.upcall_vector = data->u.vector;
480 			mutex_unlock(&kvm->lock);
481 			r = 0;
482 		}
483 		break;
484 
485 	case KVM_XEN_ATTR_TYPE_EVTCHN:
486 		r = kvm_xen_setattr_evtchn(kvm, data);
487 		break;
488 
489 	case KVM_XEN_ATTR_TYPE_XEN_VERSION:
490 		mutex_lock(&kvm->lock);
491 		kvm->arch.xen.xen_version = data->u.xen_version;
492 		mutex_unlock(&kvm->lock);
493 		r = 0;
494 		break;
495 
496 	default:
497 		break;
498 	}
499 
500 	return r;
501 }
502 
503 int kvm_xen_hvm_get_attr(struct kvm *kvm, struct kvm_xen_hvm_attr *data)
504 {
505 	int r = -ENOENT;
506 
507 	mutex_lock(&kvm->lock);
508 
509 	switch (data->type) {
510 	case KVM_XEN_ATTR_TYPE_LONG_MODE:
511 		data->u.long_mode = kvm->arch.xen.long_mode;
512 		r = 0;
513 		break;
514 
515 	case KVM_XEN_ATTR_TYPE_SHARED_INFO:
516 		if (kvm->arch.xen.shinfo_cache.active)
517 			data->u.shared_info.gfn = gpa_to_gfn(kvm->arch.xen.shinfo_cache.gpa);
518 		else
519 			data->u.shared_info.gfn = GPA_INVALID;
520 		r = 0;
521 		break;
522 
523 	case KVM_XEN_ATTR_TYPE_UPCALL_VECTOR:
524 		data->u.vector = kvm->arch.xen.upcall_vector;
525 		r = 0;
526 		break;
527 
528 	case KVM_XEN_ATTR_TYPE_XEN_VERSION:
529 		data->u.xen_version = kvm->arch.xen.xen_version;
530 		r = 0;
531 		break;
532 
533 	default:
534 		break;
535 	}
536 
537 	mutex_unlock(&kvm->lock);
538 	return r;
539 }
540 
541 int kvm_xen_vcpu_set_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data)
542 {
543 	int idx, r = -ENOENT;
544 
545 	mutex_lock(&vcpu->kvm->lock);
546 	idx = srcu_read_lock(&vcpu->kvm->srcu);
547 
548 	switch (data->type) {
549 	case KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO:
550 		/* No compat necessary here. */
551 		BUILD_BUG_ON(sizeof(struct vcpu_info) !=
552 			     sizeof(struct compat_vcpu_info));
553 		BUILD_BUG_ON(offsetof(struct vcpu_info, time) !=
554 			     offsetof(struct compat_vcpu_info, time));
555 
556 		if (data->u.gpa == GPA_INVALID) {
557 			kvm_gfn_to_pfn_cache_destroy(vcpu->kvm, &vcpu->arch.xen.vcpu_info_cache);
558 			r = 0;
559 			break;
560 		}
561 
562 		r = kvm_gfn_to_pfn_cache_init(vcpu->kvm,
563 					      &vcpu->arch.xen.vcpu_info_cache,
564 					      NULL, KVM_HOST_USES_PFN, data->u.gpa,
565 					      sizeof(struct vcpu_info));
566 		if (!r)
567 			kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
568 
569 		break;
570 
571 	case KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO:
572 		if (data->u.gpa == GPA_INVALID) {
573 			kvm_gfn_to_pfn_cache_destroy(vcpu->kvm,
574 						     &vcpu->arch.xen.vcpu_time_info_cache);
575 			r = 0;
576 			break;
577 		}
578 
579 		r = kvm_gfn_to_pfn_cache_init(vcpu->kvm,
580 					      &vcpu->arch.xen.vcpu_time_info_cache,
581 					      NULL, KVM_HOST_USES_PFN, data->u.gpa,
582 					      sizeof(struct pvclock_vcpu_time_info));
583 		if (!r)
584 			kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
585 		break;
586 
587 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR:
588 		if (!sched_info_on()) {
589 			r = -EOPNOTSUPP;
590 			break;
591 		}
592 		if (data->u.gpa == GPA_INVALID) {
593 			kvm_gfn_to_pfn_cache_destroy(vcpu->kvm,
594 						     &vcpu->arch.xen.runstate_cache);
595 			r = 0;
596 			break;
597 		}
598 
599 		r = kvm_gfn_to_pfn_cache_init(vcpu->kvm,
600 					      &vcpu->arch.xen.runstate_cache,
601 					      NULL, KVM_HOST_USES_PFN, data->u.gpa,
602 					      sizeof(struct vcpu_runstate_info));
603 		break;
604 
605 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT:
606 		if (!sched_info_on()) {
607 			r = -EOPNOTSUPP;
608 			break;
609 		}
610 		if (data->u.runstate.state > RUNSTATE_offline) {
611 			r = -EINVAL;
612 			break;
613 		}
614 
615 		kvm_xen_update_runstate(vcpu, data->u.runstate.state);
616 		r = 0;
617 		break;
618 
619 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA:
620 		if (!sched_info_on()) {
621 			r = -EOPNOTSUPP;
622 			break;
623 		}
624 		if (data->u.runstate.state > RUNSTATE_offline) {
625 			r = -EINVAL;
626 			break;
627 		}
628 		if (data->u.runstate.state_entry_time !=
629 		    (data->u.runstate.time_running +
630 		     data->u.runstate.time_runnable +
631 		     data->u.runstate.time_blocked +
632 		     data->u.runstate.time_offline)) {
633 			r = -EINVAL;
634 			break;
635 		}
636 		if (get_kvmclock_ns(vcpu->kvm) <
637 		    data->u.runstate.state_entry_time) {
638 			r = -EINVAL;
639 			break;
640 		}
641 
642 		vcpu->arch.xen.current_runstate = data->u.runstate.state;
643 		vcpu->arch.xen.runstate_entry_time =
644 			data->u.runstate.state_entry_time;
645 		vcpu->arch.xen.runstate_times[RUNSTATE_running] =
646 			data->u.runstate.time_running;
647 		vcpu->arch.xen.runstate_times[RUNSTATE_runnable] =
648 			data->u.runstate.time_runnable;
649 		vcpu->arch.xen.runstate_times[RUNSTATE_blocked] =
650 			data->u.runstate.time_blocked;
651 		vcpu->arch.xen.runstate_times[RUNSTATE_offline] =
652 			data->u.runstate.time_offline;
653 		vcpu->arch.xen.last_steal = current->sched_info.run_delay;
654 		r = 0;
655 		break;
656 
657 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST:
658 		if (!sched_info_on()) {
659 			r = -EOPNOTSUPP;
660 			break;
661 		}
662 		if (data->u.runstate.state > RUNSTATE_offline &&
663 		    data->u.runstate.state != (u64)-1) {
664 			r = -EINVAL;
665 			break;
666 		}
667 		/* The adjustment must add up */
668 		if (data->u.runstate.state_entry_time !=
669 		    (data->u.runstate.time_running +
670 		     data->u.runstate.time_runnable +
671 		     data->u.runstate.time_blocked +
672 		     data->u.runstate.time_offline)) {
673 			r = -EINVAL;
674 			break;
675 		}
676 
677 		if (get_kvmclock_ns(vcpu->kvm) <
678 		    (vcpu->arch.xen.runstate_entry_time +
679 		     data->u.runstate.state_entry_time)) {
680 			r = -EINVAL;
681 			break;
682 		}
683 
684 		vcpu->arch.xen.runstate_entry_time +=
685 			data->u.runstate.state_entry_time;
686 		vcpu->arch.xen.runstate_times[RUNSTATE_running] +=
687 			data->u.runstate.time_running;
688 		vcpu->arch.xen.runstate_times[RUNSTATE_runnable] +=
689 			data->u.runstate.time_runnable;
690 		vcpu->arch.xen.runstate_times[RUNSTATE_blocked] +=
691 			data->u.runstate.time_blocked;
692 		vcpu->arch.xen.runstate_times[RUNSTATE_offline] +=
693 			data->u.runstate.time_offline;
694 
695 		if (data->u.runstate.state <= RUNSTATE_offline)
696 			kvm_xen_update_runstate(vcpu, data->u.runstate.state);
697 		r = 0;
698 		break;
699 
700 	case KVM_XEN_VCPU_ATTR_TYPE_VCPU_ID:
701 		if (data->u.vcpu_id >= KVM_MAX_VCPUS)
702 			r = -EINVAL;
703 		else {
704 			vcpu->arch.xen.vcpu_id = data->u.vcpu_id;
705 			r = 0;
706 		}
707 		break;
708 
709 	case KVM_XEN_VCPU_ATTR_TYPE_TIMER:
710 		if (data->u.timer.port &&
711 		    data->u.timer.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL) {
712 			r = -EINVAL;
713 			break;
714 		}
715 
716 		if (!vcpu->arch.xen.timer.function)
717 			kvm_xen_init_timer(vcpu);
718 
719 		/* Stop the timer (if it's running) before changing the vector */
720 		kvm_xen_stop_timer(vcpu);
721 		vcpu->arch.xen.timer_virq = data->u.timer.port;
722 
723 		/* Start the timer if the new value has a valid vector+expiry. */
724 		if (data->u.timer.port && data->u.timer.expires_ns)
725 			kvm_xen_start_timer(vcpu, data->u.timer.expires_ns,
726 					    data->u.timer.expires_ns -
727 					    get_kvmclock_ns(vcpu->kvm));
728 
729 		r = 0;
730 		break;
731 
732 	case KVM_XEN_VCPU_ATTR_TYPE_UPCALL_VECTOR:
733 		if (data->u.vector && data->u.vector < 0x10)
734 			r = -EINVAL;
735 		else {
736 			vcpu->arch.xen.upcall_vector = data->u.vector;
737 			r = 0;
738 		}
739 		break;
740 
741 	default:
742 		break;
743 	}
744 
745 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
746 	mutex_unlock(&vcpu->kvm->lock);
747 	return r;
748 }
749 
750 int kvm_xen_vcpu_get_attr(struct kvm_vcpu *vcpu, struct kvm_xen_vcpu_attr *data)
751 {
752 	int r = -ENOENT;
753 
754 	mutex_lock(&vcpu->kvm->lock);
755 
756 	switch (data->type) {
757 	case KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO:
758 		if (vcpu->arch.xen.vcpu_info_cache.active)
759 			data->u.gpa = vcpu->arch.xen.vcpu_info_cache.gpa;
760 		else
761 			data->u.gpa = GPA_INVALID;
762 		r = 0;
763 		break;
764 
765 	case KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO:
766 		if (vcpu->arch.xen.vcpu_time_info_cache.active)
767 			data->u.gpa = vcpu->arch.xen.vcpu_time_info_cache.gpa;
768 		else
769 			data->u.gpa = GPA_INVALID;
770 		r = 0;
771 		break;
772 
773 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR:
774 		if (!sched_info_on()) {
775 			r = -EOPNOTSUPP;
776 			break;
777 		}
778 		if (vcpu->arch.xen.runstate_cache.active) {
779 			data->u.gpa = vcpu->arch.xen.runstate_cache.gpa;
780 			r = 0;
781 		}
782 		break;
783 
784 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT:
785 		if (!sched_info_on()) {
786 			r = -EOPNOTSUPP;
787 			break;
788 		}
789 		data->u.runstate.state = vcpu->arch.xen.current_runstate;
790 		r = 0;
791 		break;
792 
793 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA:
794 		if (!sched_info_on()) {
795 			r = -EOPNOTSUPP;
796 			break;
797 		}
798 		data->u.runstate.state = vcpu->arch.xen.current_runstate;
799 		data->u.runstate.state_entry_time =
800 			vcpu->arch.xen.runstate_entry_time;
801 		data->u.runstate.time_running =
802 			vcpu->arch.xen.runstate_times[RUNSTATE_running];
803 		data->u.runstate.time_runnable =
804 			vcpu->arch.xen.runstate_times[RUNSTATE_runnable];
805 		data->u.runstate.time_blocked =
806 			vcpu->arch.xen.runstate_times[RUNSTATE_blocked];
807 		data->u.runstate.time_offline =
808 			vcpu->arch.xen.runstate_times[RUNSTATE_offline];
809 		r = 0;
810 		break;
811 
812 	case KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST:
813 		r = -EINVAL;
814 		break;
815 
816 	case KVM_XEN_VCPU_ATTR_TYPE_VCPU_ID:
817 		data->u.vcpu_id = vcpu->arch.xen.vcpu_id;
818 		r = 0;
819 		break;
820 
821 	case KVM_XEN_VCPU_ATTR_TYPE_TIMER:
822 		data->u.timer.port = vcpu->arch.xen.timer_virq;
823 		data->u.timer.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;
824 		data->u.timer.expires_ns = vcpu->arch.xen.timer_expires;
825 		r = 0;
826 		break;
827 
828 	case KVM_XEN_VCPU_ATTR_TYPE_UPCALL_VECTOR:
829 		data->u.vector = vcpu->arch.xen.upcall_vector;
830 		r = 0;
831 		break;
832 
833 	default:
834 		break;
835 	}
836 
837 	mutex_unlock(&vcpu->kvm->lock);
838 	return r;
839 }
840 
841 int kvm_xen_write_hypercall_page(struct kvm_vcpu *vcpu, u64 data)
842 {
843 	struct kvm *kvm = vcpu->kvm;
844 	u32 page_num = data & ~PAGE_MASK;
845 	u64 page_addr = data & PAGE_MASK;
846 	bool lm = is_long_mode(vcpu);
847 
848 	/* Latch long_mode for shared_info pages etc. */
849 	vcpu->kvm->arch.xen.long_mode = lm;
850 
851 	/*
852 	 * If Xen hypercall intercept is enabled, fill the hypercall
853 	 * page with VMCALL/VMMCALL instructions since that's what
854 	 * we catch. Else the VMM has provided the hypercall pages
855 	 * with instructions of its own choosing, so use those.
856 	 */
857 	if (kvm_xen_hypercall_enabled(kvm)) {
858 		u8 instructions[32];
859 		int i;
860 
861 		if (page_num)
862 			return 1;
863 
864 		/* mov imm32, %eax */
865 		instructions[0] = 0xb8;
866 
867 		/* vmcall / vmmcall */
868 		static_call(kvm_x86_patch_hypercall)(vcpu, instructions + 5);
869 
870 		/* ret */
871 		instructions[8] = 0xc3;
872 
873 		/* int3 to pad */
874 		memset(instructions + 9, 0xcc, sizeof(instructions) - 9);
875 
876 		for (i = 0; i < PAGE_SIZE / sizeof(instructions); i++) {
877 			*(u32 *)&instructions[1] = i;
878 			if (kvm_vcpu_write_guest(vcpu,
879 						 page_addr + (i * sizeof(instructions)),
880 						 instructions, sizeof(instructions)))
881 				return 1;
882 		}
883 	} else {
884 		/*
885 		 * Note, truncation is a non-issue as 'lm' is guaranteed to be
886 		 * false for a 32-bit kernel, i.e. when hva_t is only 4 bytes.
887 		 */
888 		hva_t blob_addr = lm ? kvm->arch.xen_hvm_config.blob_addr_64
889 				     : kvm->arch.xen_hvm_config.blob_addr_32;
890 		u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
891 				  : kvm->arch.xen_hvm_config.blob_size_32;
892 		u8 *page;
893 
894 		if (page_num >= blob_size)
895 			return 1;
896 
897 		blob_addr += page_num * PAGE_SIZE;
898 
899 		page = memdup_user((u8 __user *)blob_addr, PAGE_SIZE);
900 		if (IS_ERR(page))
901 			return PTR_ERR(page);
902 
903 		if (kvm_vcpu_write_guest(vcpu, page_addr, page, PAGE_SIZE)) {
904 			kfree(page);
905 			return 1;
906 		}
907 	}
908 	return 0;
909 }
910 
911 int kvm_xen_hvm_config(struct kvm *kvm, struct kvm_xen_hvm_config *xhc)
912 {
913 	/* Only some feature flags need to be *enabled* by userspace */
914 	u32 permitted_flags = KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL |
915 		KVM_XEN_HVM_CONFIG_EVTCHN_SEND;
916 
917 	if (xhc->flags & ~permitted_flags)
918 		return -EINVAL;
919 
920 	/*
921 	 * With hypercall interception the kernel generates its own
922 	 * hypercall page so it must not be provided.
923 	 */
924 	if ((xhc->flags & KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL) &&
925 	    (xhc->blob_addr_32 || xhc->blob_addr_64 ||
926 	     xhc->blob_size_32 || xhc->blob_size_64))
927 		return -EINVAL;
928 
929 	mutex_lock(&kvm->lock);
930 
931 	if (xhc->msr && !kvm->arch.xen_hvm_config.msr)
932 		static_branch_inc(&kvm_xen_enabled.key);
933 	else if (!xhc->msr && kvm->arch.xen_hvm_config.msr)
934 		static_branch_slow_dec_deferred(&kvm_xen_enabled);
935 
936 	memcpy(&kvm->arch.xen_hvm_config, xhc, sizeof(*xhc));
937 
938 	mutex_unlock(&kvm->lock);
939 	return 0;
940 }
941 
942 static int kvm_xen_hypercall_set_result(struct kvm_vcpu *vcpu, u64 result)
943 {
944 	kvm_rax_write(vcpu, result);
945 	return kvm_skip_emulated_instruction(vcpu);
946 }
947 
948 static int kvm_xen_hypercall_complete_userspace(struct kvm_vcpu *vcpu)
949 {
950 	struct kvm_run *run = vcpu->run;
951 
952 	if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.xen.hypercall_rip)))
953 		return 1;
954 
955 	return kvm_xen_hypercall_set_result(vcpu, run->xen.u.hcall.result);
956 }
957 
958 static bool wait_pending_event(struct kvm_vcpu *vcpu, int nr_ports,
959 			       evtchn_port_t *ports)
960 {
961 	struct kvm *kvm = vcpu->kvm;
962 	struct gfn_to_pfn_cache *gpc = &kvm->arch.xen.shinfo_cache;
963 	unsigned long *pending_bits;
964 	unsigned long flags;
965 	bool ret = true;
966 	int idx, i;
967 
968 	read_lock_irqsave(&gpc->lock, flags);
969 	idx = srcu_read_lock(&kvm->srcu);
970 	if (!kvm_gfn_to_pfn_cache_check(kvm, gpc, gpc->gpa, PAGE_SIZE))
971 		goto out_rcu;
972 
973 	ret = false;
974 	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode) {
975 		struct shared_info *shinfo = gpc->khva;
976 		pending_bits = (unsigned long *)&shinfo->evtchn_pending;
977 	} else {
978 		struct compat_shared_info *shinfo = gpc->khva;
979 		pending_bits = (unsigned long *)&shinfo->evtchn_pending;
980 	}
981 
982 	for (i = 0; i < nr_ports; i++) {
983 		if (test_bit(ports[i], pending_bits)) {
984 			ret = true;
985 			break;
986 		}
987 	}
988 
989  out_rcu:
990 	srcu_read_unlock(&kvm->srcu, idx);
991 	read_unlock_irqrestore(&gpc->lock, flags);
992 
993 	return ret;
994 }
995 
996 static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode,
997 				 u64 param, u64 *r)
998 {
999 	int idx, i;
1000 	struct sched_poll sched_poll;
1001 	evtchn_port_t port, *ports;
1002 	gpa_t gpa;
1003 
1004 	if (!longmode || !lapic_in_kernel(vcpu) ||
1005 	    !(vcpu->kvm->arch.xen_hvm_config.flags & KVM_XEN_HVM_CONFIG_EVTCHN_SEND))
1006 		return false;
1007 
1008 	idx = srcu_read_lock(&vcpu->kvm->srcu);
1009 	gpa = kvm_mmu_gva_to_gpa_system(vcpu, param, NULL);
1010 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
1011 
1012 	if (!gpa || kvm_vcpu_read_guest(vcpu, gpa, &sched_poll,
1013 					sizeof(sched_poll))) {
1014 		*r = -EFAULT;
1015 		return true;
1016 	}
1017 
1018 	if (unlikely(sched_poll.nr_ports > 1)) {
1019 		/* Xen (unofficially) limits number of pollers to 128 */
1020 		if (sched_poll.nr_ports > 128) {
1021 			*r = -EINVAL;
1022 			return true;
1023 		}
1024 
1025 		ports = kmalloc_array(sched_poll.nr_ports,
1026 				      sizeof(*ports), GFP_KERNEL);
1027 		if (!ports) {
1028 			*r = -ENOMEM;
1029 			return true;
1030 		}
1031 	} else
1032 		ports = &port;
1033 
1034 	for (i = 0; i < sched_poll.nr_ports; i++) {
1035 		idx = srcu_read_lock(&vcpu->kvm->srcu);
1036 		gpa = kvm_mmu_gva_to_gpa_system(vcpu,
1037 						(gva_t)(sched_poll.ports + i),
1038 						NULL);
1039 		srcu_read_unlock(&vcpu->kvm->srcu, idx);
1040 
1041 		if (!gpa || kvm_vcpu_read_guest(vcpu, gpa,
1042 						&ports[i], sizeof(port))) {
1043 			*r = -EFAULT;
1044 			goto out;
1045 		}
1046 	}
1047 
1048 	if (sched_poll.nr_ports == 1)
1049 		vcpu->arch.xen.poll_evtchn = port;
1050 	else
1051 		vcpu->arch.xen.poll_evtchn = -1;
1052 
1053 	set_bit(vcpu->vcpu_idx, vcpu->kvm->arch.xen.poll_mask);
1054 
1055 	if (!wait_pending_event(vcpu, sched_poll.nr_ports, ports)) {
1056 		vcpu->arch.mp_state = KVM_MP_STATE_HALTED;
1057 
1058 		if (sched_poll.timeout)
1059 			mod_timer(&vcpu->arch.xen.poll_timer,
1060 				  jiffies + nsecs_to_jiffies(sched_poll.timeout));
1061 
1062 		kvm_vcpu_halt(vcpu);
1063 
1064 		if (sched_poll.timeout)
1065 			del_timer(&vcpu->arch.xen.poll_timer);
1066 
1067 		vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
1068 		kvm_clear_request(KVM_REQ_UNHALT, vcpu);
1069 	}
1070 
1071 	vcpu->arch.xen.poll_evtchn = 0;
1072 	*r = 0;
1073 out:
1074 	/* Really, this is only needed in case of timeout */
1075 	clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.xen.poll_mask);
1076 
1077 	if (unlikely(sched_poll.nr_ports > 1))
1078 		kfree(ports);
1079 	return true;
1080 }
1081 
1082 static void cancel_evtchn_poll(struct timer_list *t)
1083 {
1084 	struct kvm_vcpu *vcpu = from_timer(vcpu, t, arch.xen.poll_timer);
1085 
1086 	kvm_make_request(KVM_REQ_UNBLOCK, vcpu);
1087 	kvm_vcpu_kick(vcpu);
1088 }
1089 
1090 static bool kvm_xen_hcall_sched_op(struct kvm_vcpu *vcpu, bool longmode,
1091 				   int cmd, u64 param, u64 *r)
1092 {
1093 	switch (cmd) {
1094 	case SCHEDOP_poll:
1095 		if (kvm_xen_schedop_poll(vcpu, longmode, param, r))
1096 			return true;
1097 		fallthrough;
1098 	case SCHEDOP_yield:
1099 		kvm_vcpu_on_spin(vcpu, true);
1100 		*r = 0;
1101 		return true;
1102 	default:
1103 		break;
1104 	}
1105 
1106 	return false;
1107 }
1108 
1109 struct compat_vcpu_set_singleshot_timer {
1110     uint64_t timeout_abs_ns;
1111     uint32_t flags;
1112 } __attribute__((packed));
1113 
1114 static bool kvm_xen_hcall_vcpu_op(struct kvm_vcpu *vcpu, bool longmode, int cmd,
1115 				  int vcpu_id, u64 param, u64 *r)
1116 {
1117 	struct vcpu_set_singleshot_timer oneshot;
1118 	s64 delta;
1119 	gpa_t gpa;
1120 	int idx;
1121 
1122 	if (!kvm_xen_timer_enabled(vcpu))
1123 		return false;
1124 
1125 	switch (cmd) {
1126 	case VCPUOP_set_singleshot_timer:
1127 		if (vcpu->arch.xen.vcpu_id != vcpu_id) {
1128 			*r = -EINVAL;
1129 			return true;
1130 		}
1131 		idx = srcu_read_lock(&vcpu->kvm->srcu);
1132 		gpa = kvm_mmu_gva_to_gpa_system(vcpu, param, NULL);
1133 		srcu_read_unlock(&vcpu->kvm->srcu, idx);
1134 
1135 		/*
1136 		 * The only difference for 32-bit compat is the 4 bytes of
1137 		 * padding after the interesting part of the structure. So
1138 		 * for a faithful emulation of Xen we have to *try* to copy
1139 		 * the padding and return -EFAULT if we can't. Otherwise we
1140 		 * might as well just have copied the 12-byte 32-bit struct.
1141 		 */
1142 		BUILD_BUG_ON(offsetof(struct compat_vcpu_set_singleshot_timer, timeout_abs_ns) !=
1143 			     offsetof(struct vcpu_set_singleshot_timer, timeout_abs_ns));
1144 		BUILD_BUG_ON(sizeof_field(struct compat_vcpu_set_singleshot_timer, timeout_abs_ns) !=
1145 			     sizeof_field(struct vcpu_set_singleshot_timer, timeout_abs_ns));
1146 		BUILD_BUG_ON(offsetof(struct compat_vcpu_set_singleshot_timer, flags) !=
1147 			     offsetof(struct vcpu_set_singleshot_timer, flags));
1148 		BUILD_BUG_ON(sizeof_field(struct compat_vcpu_set_singleshot_timer, flags) !=
1149 			     sizeof_field(struct vcpu_set_singleshot_timer, flags));
1150 
1151 		if (!gpa ||
1152 		    kvm_vcpu_read_guest(vcpu, gpa, &oneshot, longmode ? sizeof(oneshot) :
1153 					sizeof(struct compat_vcpu_set_singleshot_timer))) {
1154 			*r = -EFAULT;
1155 			return true;
1156 		}
1157 
1158 		delta = oneshot.timeout_abs_ns - get_kvmclock_ns(vcpu->kvm);
1159 		if ((oneshot.flags & VCPU_SSHOTTMR_future) && delta < 0) {
1160 			*r = -ETIME;
1161 			return true;
1162 		}
1163 
1164 		kvm_xen_start_timer(vcpu, oneshot.timeout_abs_ns, delta);
1165 		*r = 0;
1166 		return true;
1167 
1168 	case VCPUOP_stop_singleshot_timer:
1169 		if (vcpu->arch.xen.vcpu_id != vcpu_id) {
1170 			*r = -EINVAL;
1171 			return true;
1172 		}
1173 		kvm_xen_stop_timer(vcpu);
1174 		*r = 0;
1175 		return true;
1176 	}
1177 
1178 	return false;
1179 }
1180 
1181 static bool kvm_xen_hcall_set_timer_op(struct kvm_vcpu *vcpu, uint64_t timeout,
1182 				       u64 *r)
1183 {
1184 	if (!kvm_xen_timer_enabled(vcpu))
1185 		return false;
1186 
1187 	if (timeout) {
1188 		uint64_t guest_now = get_kvmclock_ns(vcpu->kvm);
1189 		int64_t delta = timeout - guest_now;
1190 
1191 		/* Xen has a 'Linux workaround' in do_set_timer_op() which
1192 		 * checks for negative absolute timeout values (caused by
1193 		 * integer overflow), and for values about 13 days in the
1194 		 * future (2^50ns) which would be caused by jiffies
1195 		 * overflow. For those cases, it sets the timeout 100ms in
1196 		 * the future (not *too* soon, since if a guest really did
1197 		 * set a long timeout on purpose we don't want to keep
1198 		 * churning CPU time by waking it up).
1199 		 */
1200 		if (unlikely((int64_t)timeout < 0 ||
1201 			     (delta > 0 && (uint32_t) (delta >> 50) != 0))) {
1202 			delta = 100 * NSEC_PER_MSEC;
1203 			timeout = guest_now + delta;
1204 		}
1205 
1206 		kvm_xen_start_timer(vcpu, timeout, delta);
1207 	} else {
1208 		kvm_xen_stop_timer(vcpu);
1209 	}
1210 
1211 	*r = 0;
1212 	return true;
1213 }
1214 
1215 int kvm_xen_hypercall(struct kvm_vcpu *vcpu)
1216 {
1217 	bool longmode;
1218 	u64 input, params[6], r = -ENOSYS;
1219 	bool handled = false;
1220 
1221 	input = (u64)kvm_register_read(vcpu, VCPU_REGS_RAX);
1222 
1223 	/* Hyper-V hypercalls get bit 31 set in EAX */
1224 	if ((input & 0x80000000) &&
1225 	    kvm_hv_hypercall_enabled(vcpu))
1226 		return kvm_hv_hypercall(vcpu);
1227 
1228 	longmode = is_64_bit_hypercall(vcpu);
1229 	if (!longmode) {
1230 		params[0] = (u32)kvm_rbx_read(vcpu);
1231 		params[1] = (u32)kvm_rcx_read(vcpu);
1232 		params[2] = (u32)kvm_rdx_read(vcpu);
1233 		params[3] = (u32)kvm_rsi_read(vcpu);
1234 		params[4] = (u32)kvm_rdi_read(vcpu);
1235 		params[5] = (u32)kvm_rbp_read(vcpu);
1236 	}
1237 #ifdef CONFIG_X86_64
1238 	else {
1239 		params[0] = (u64)kvm_rdi_read(vcpu);
1240 		params[1] = (u64)kvm_rsi_read(vcpu);
1241 		params[2] = (u64)kvm_rdx_read(vcpu);
1242 		params[3] = (u64)kvm_r10_read(vcpu);
1243 		params[4] = (u64)kvm_r8_read(vcpu);
1244 		params[5] = (u64)kvm_r9_read(vcpu);
1245 	}
1246 #endif
1247 	trace_kvm_xen_hypercall(input, params[0], params[1], params[2],
1248 				params[3], params[4], params[5]);
1249 
1250 	switch (input) {
1251 	case __HYPERVISOR_xen_version:
1252 		if (params[0] == XENVER_version && vcpu->kvm->arch.xen.xen_version) {
1253 			r = vcpu->kvm->arch.xen.xen_version;
1254 			handled = true;
1255 		}
1256 		break;
1257 	case __HYPERVISOR_event_channel_op:
1258 		if (params[0] == EVTCHNOP_send)
1259 			handled = kvm_xen_hcall_evtchn_send(vcpu, params[1], &r);
1260 		break;
1261 	case __HYPERVISOR_sched_op:
1262 		handled = kvm_xen_hcall_sched_op(vcpu, longmode, params[0],
1263 						 params[1], &r);
1264 		break;
1265 	case __HYPERVISOR_vcpu_op:
1266 		handled = kvm_xen_hcall_vcpu_op(vcpu, longmode, params[0], params[1],
1267 						params[2], &r);
1268 		break;
1269 	case __HYPERVISOR_set_timer_op: {
1270 		u64 timeout = params[0];
1271 		/* In 32-bit mode, the 64-bit timeout is in two 32-bit params. */
1272 		if (!longmode)
1273 			timeout |= params[1] << 32;
1274 		handled = kvm_xen_hcall_set_timer_op(vcpu, timeout, &r);
1275 		break;
1276 	}
1277 	default:
1278 		break;
1279 	}
1280 
1281 	if (handled)
1282 		return kvm_xen_hypercall_set_result(vcpu, r);
1283 
1284 	vcpu->run->exit_reason = KVM_EXIT_XEN;
1285 	vcpu->run->xen.type = KVM_EXIT_XEN_HCALL;
1286 	vcpu->run->xen.u.hcall.longmode = longmode;
1287 	vcpu->run->xen.u.hcall.cpl = static_call(kvm_x86_get_cpl)(vcpu);
1288 	vcpu->run->xen.u.hcall.input = input;
1289 	vcpu->run->xen.u.hcall.params[0] = params[0];
1290 	vcpu->run->xen.u.hcall.params[1] = params[1];
1291 	vcpu->run->xen.u.hcall.params[2] = params[2];
1292 	vcpu->run->xen.u.hcall.params[3] = params[3];
1293 	vcpu->run->xen.u.hcall.params[4] = params[4];
1294 	vcpu->run->xen.u.hcall.params[5] = params[5];
1295 	vcpu->arch.xen.hypercall_rip = kvm_get_linear_rip(vcpu);
1296 	vcpu->arch.complete_userspace_io =
1297 		kvm_xen_hypercall_complete_userspace;
1298 
1299 	return 0;
1300 }
1301 
1302 static inline int max_evtchn_port(struct kvm *kvm)
1303 {
1304 	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode)
1305 		return EVTCHN_2L_NR_CHANNELS;
1306 	else
1307 		return COMPAT_EVTCHN_2L_NR_CHANNELS;
1308 }
1309 
1310 static void kvm_xen_check_poller(struct kvm_vcpu *vcpu, int port)
1311 {
1312 	int poll_evtchn = vcpu->arch.xen.poll_evtchn;
1313 
1314 	if ((poll_evtchn == port || poll_evtchn == -1) &&
1315 	    test_and_clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.xen.poll_mask)) {
1316 		kvm_make_request(KVM_REQ_UNBLOCK, vcpu);
1317 		kvm_vcpu_kick(vcpu);
1318 	}
1319 }
1320 
1321 /*
1322  * The return value from this function is propagated to kvm_set_irq() API,
1323  * so it returns:
1324  *  < 0   Interrupt was ignored (masked or not delivered for other reasons)
1325  *  = 0   Interrupt was coalesced (previous irq is still pending)
1326  *  > 0   Number of CPUs interrupt was delivered to
1327  *
1328  * It is also called directly from kvm_arch_set_irq_inatomic(), where the
1329  * only check on its return value is a comparison with -EWOULDBLOCK'.
1330  */
1331 int kvm_xen_set_evtchn_fast(struct kvm_xen_evtchn *xe, struct kvm *kvm)
1332 {
1333 	struct gfn_to_pfn_cache *gpc = &kvm->arch.xen.shinfo_cache;
1334 	struct kvm_vcpu *vcpu;
1335 	unsigned long *pending_bits, *mask_bits;
1336 	unsigned long flags;
1337 	int port_word_bit;
1338 	bool kick_vcpu = false;
1339 	int vcpu_idx, idx, rc;
1340 
1341 	vcpu_idx = READ_ONCE(xe->vcpu_idx);
1342 	if (vcpu_idx >= 0)
1343 		vcpu = kvm_get_vcpu(kvm, vcpu_idx);
1344 	else {
1345 		vcpu = kvm_get_vcpu_by_id(kvm, xe->vcpu_id);
1346 		if (!vcpu)
1347 			return -EINVAL;
1348 		WRITE_ONCE(xe->vcpu_idx, vcpu->vcpu_idx);
1349 	}
1350 
1351 	if (!vcpu->arch.xen.vcpu_info_cache.active)
1352 		return -EINVAL;
1353 
1354 	if (xe->port >= max_evtchn_port(kvm))
1355 		return -EINVAL;
1356 
1357 	rc = -EWOULDBLOCK;
1358 
1359 	idx = srcu_read_lock(&kvm->srcu);
1360 
1361 	read_lock_irqsave(&gpc->lock, flags);
1362 	if (!kvm_gfn_to_pfn_cache_check(kvm, gpc, gpc->gpa, PAGE_SIZE))
1363 		goto out_rcu;
1364 
1365 	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode) {
1366 		struct shared_info *shinfo = gpc->khva;
1367 		pending_bits = (unsigned long *)&shinfo->evtchn_pending;
1368 		mask_bits = (unsigned long *)&shinfo->evtchn_mask;
1369 		port_word_bit = xe->port / 64;
1370 	} else {
1371 		struct compat_shared_info *shinfo = gpc->khva;
1372 		pending_bits = (unsigned long *)&shinfo->evtchn_pending;
1373 		mask_bits = (unsigned long *)&shinfo->evtchn_mask;
1374 		port_word_bit = xe->port / 32;
1375 	}
1376 
1377 	/*
1378 	 * If this port wasn't already set, and if it isn't masked, then
1379 	 * we try to set the corresponding bit in the in-kernel shadow of
1380 	 * evtchn_pending_sel for the target vCPU. And if *that* wasn't
1381 	 * already set, then we kick the vCPU in question to write to the
1382 	 * *real* evtchn_pending_sel in its own guest vcpu_info struct.
1383 	 */
1384 	if (test_and_set_bit(xe->port, pending_bits)) {
1385 		rc = 0; /* It was already raised */
1386 	} else if (test_bit(xe->port, mask_bits)) {
1387 		rc = -ENOTCONN; /* Masked */
1388 		kvm_xen_check_poller(vcpu, xe->port);
1389 	} else {
1390 		rc = 1; /* Delivered to the bitmap in shared_info. */
1391 		/* Now switch to the vCPU's vcpu_info to set the index and pending_sel */
1392 		read_unlock_irqrestore(&gpc->lock, flags);
1393 		gpc = &vcpu->arch.xen.vcpu_info_cache;
1394 
1395 		read_lock_irqsave(&gpc->lock, flags);
1396 		if (!kvm_gfn_to_pfn_cache_check(kvm, gpc, gpc->gpa, sizeof(struct vcpu_info))) {
1397 			/*
1398 			 * Could not access the vcpu_info. Set the bit in-kernel
1399 			 * and prod the vCPU to deliver it for itself.
1400 			 */
1401 			if (!test_and_set_bit(port_word_bit, &vcpu->arch.xen.evtchn_pending_sel))
1402 				kick_vcpu = true;
1403 			goto out_rcu;
1404 		}
1405 
1406 		if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode) {
1407 			struct vcpu_info *vcpu_info = gpc->khva;
1408 			if (!test_and_set_bit(port_word_bit, &vcpu_info->evtchn_pending_sel)) {
1409 				WRITE_ONCE(vcpu_info->evtchn_upcall_pending, 1);
1410 				kick_vcpu = true;
1411 			}
1412 		} else {
1413 			struct compat_vcpu_info *vcpu_info = gpc->khva;
1414 			if (!test_and_set_bit(port_word_bit,
1415 					      (unsigned long *)&vcpu_info->evtchn_pending_sel)) {
1416 				WRITE_ONCE(vcpu_info->evtchn_upcall_pending, 1);
1417 				kick_vcpu = true;
1418 			}
1419 		}
1420 
1421 		/* For the per-vCPU lapic vector, deliver it as MSI. */
1422 		if (kick_vcpu && vcpu->arch.xen.upcall_vector) {
1423 			kvm_xen_inject_vcpu_vector(vcpu);
1424 			kick_vcpu = false;
1425 		}
1426 	}
1427 
1428  out_rcu:
1429 	read_unlock_irqrestore(&gpc->lock, flags);
1430 	srcu_read_unlock(&kvm->srcu, idx);
1431 
1432 	if (kick_vcpu) {
1433 		kvm_make_request(KVM_REQ_UNBLOCK, vcpu);
1434 		kvm_vcpu_kick(vcpu);
1435 	}
1436 
1437 	return rc;
1438 }
1439 
1440 static int kvm_xen_set_evtchn(struct kvm_xen_evtchn *xe, struct kvm *kvm)
1441 {
1442 	bool mm_borrowed = false;
1443 	int rc;
1444 
1445 	rc = kvm_xen_set_evtchn_fast(xe, kvm);
1446 	if (rc != -EWOULDBLOCK)
1447 		return rc;
1448 
1449 	if (current->mm != kvm->mm) {
1450 		/*
1451 		 * If not on a thread which already belongs to this KVM,
1452 		 * we'd better be in the irqfd workqueue.
1453 		 */
1454 		if (WARN_ON_ONCE(current->mm))
1455 			return -EINVAL;
1456 
1457 		kthread_use_mm(kvm->mm);
1458 		mm_borrowed = true;
1459 	}
1460 
1461 	/*
1462 	 * For the irqfd workqueue, using the main kvm->lock mutex is
1463 	 * fine since this function is invoked from kvm_set_irq() with
1464 	 * no other lock held, no srcu. In future if it will be called
1465 	 * directly from a vCPU thread (e.g. on hypercall for an IPI)
1466 	 * then it may need to switch to using a leaf-node mutex for
1467 	 * serializing the shared_info mapping.
1468 	 */
1469 	mutex_lock(&kvm->lock);
1470 
1471 	/*
1472 	 * It is theoretically possible for the page to be unmapped
1473 	 * and the MMU notifier to invalidate the shared_info before
1474 	 * we even get to use it. In that case, this looks like an
1475 	 * infinite loop. It was tempting to do it via the userspace
1476 	 * HVA instead... but that just *hides* the fact that it's
1477 	 * an infinite loop, because if a fault occurs and it waits
1478 	 * for the page to come back, it can *still* immediately
1479 	 * fault and have to wait again, repeatedly.
1480 	 *
1481 	 * Conversely, the page could also have been reinstated by
1482 	 * another thread before we even obtain the mutex above, so
1483 	 * check again *first* before remapping it.
1484 	 */
1485 	do {
1486 		struct gfn_to_pfn_cache *gpc = &kvm->arch.xen.shinfo_cache;
1487 		int idx;
1488 
1489 		rc = kvm_xen_set_evtchn_fast(xe, kvm);
1490 		if (rc != -EWOULDBLOCK)
1491 			break;
1492 
1493 		idx = srcu_read_lock(&kvm->srcu);
1494 		rc = kvm_gfn_to_pfn_cache_refresh(kvm, gpc, gpc->gpa, PAGE_SIZE);
1495 		srcu_read_unlock(&kvm->srcu, idx);
1496 	} while(!rc);
1497 
1498 	mutex_unlock(&kvm->lock);
1499 
1500 	if (mm_borrowed)
1501 		kthread_unuse_mm(kvm->mm);
1502 
1503 	return rc;
1504 }
1505 
1506 /* This is the version called from kvm_set_irq() as the .set function */
1507 static int evtchn_set_fn(struct kvm_kernel_irq_routing_entry *e, struct kvm *kvm,
1508 			 int irq_source_id, int level, bool line_status)
1509 {
1510 	if (!level)
1511 		return -EINVAL;
1512 
1513 	return kvm_xen_set_evtchn(&e->xen_evtchn, kvm);
1514 }
1515 
1516 /*
1517  * Set up an event channel interrupt from the KVM IRQ routing table.
1518  * Used for e.g. PIRQ from passed through physical devices.
1519  */
1520 int kvm_xen_setup_evtchn(struct kvm *kvm,
1521 			 struct kvm_kernel_irq_routing_entry *e,
1522 			 const struct kvm_irq_routing_entry *ue)
1523 
1524 {
1525 	struct kvm_vcpu *vcpu;
1526 
1527 	if (ue->u.xen_evtchn.port >= max_evtchn_port(kvm))
1528 		return -EINVAL;
1529 
1530 	/* We only support 2 level event channels for now */
1531 	if (ue->u.xen_evtchn.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL)
1532 		return -EINVAL;
1533 
1534 	/*
1535 	 * Xen gives us interesting mappings from vCPU index to APIC ID,
1536 	 * which means kvm_get_vcpu_by_id() has to iterate over all vCPUs
1537 	 * to find it. Do that once at setup time, instead of every time.
1538 	 * But beware that on live update / live migration, the routing
1539 	 * table might be reinstated before the vCPU threads have finished
1540 	 * recreating their vCPUs.
1541 	 */
1542 	vcpu = kvm_get_vcpu_by_id(kvm, ue->u.xen_evtchn.vcpu);
1543 	if (vcpu)
1544 		e->xen_evtchn.vcpu_idx = vcpu->vcpu_idx;
1545 	else
1546 		e->xen_evtchn.vcpu_idx = -1;
1547 
1548 	e->xen_evtchn.port = ue->u.xen_evtchn.port;
1549 	e->xen_evtchn.vcpu_id = ue->u.xen_evtchn.vcpu;
1550 	e->xen_evtchn.priority = ue->u.xen_evtchn.priority;
1551 	e->set = evtchn_set_fn;
1552 
1553 	return 0;
1554 }
1555 
1556 /*
1557  * Explicit event sending from userspace with KVM_XEN_HVM_EVTCHN_SEND ioctl.
1558  */
1559 int kvm_xen_hvm_evtchn_send(struct kvm *kvm, struct kvm_irq_routing_xen_evtchn *uxe)
1560 {
1561 	struct kvm_xen_evtchn e;
1562 	int ret;
1563 
1564 	if (!uxe->port || uxe->port >= max_evtchn_port(kvm))
1565 		return -EINVAL;
1566 
1567 	/* We only support 2 level event channels for now */
1568 	if (uxe->priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL)
1569 		return -EINVAL;
1570 
1571 	e.port = uxe->port;
1572 	e.vcpu_id = uxe->vcpu;
1573 	e.vcpu_idx = -1;
1574 	e.priority = uxe->priority;
1575 
1576 	ret = kvm_xen_set_evtchn(&e, kvm);
1577 
1578 	/*
1579 	 * None of that 'return 1 if it actually got delivered' nonsense.
1580 	 * We don't care if it was masked (-ENOTCONN) either.
1581 	 */
1582 	if (ret > 0 || ret == -ENOTCONN)
1583 		ret = 0;
1584 
1585 	return ret;
1586 }
1587 
1588 /*
1589  * Support for *outbound* event channel events via the EVTCHNOP_send hypercall.
1590  */
1591 struct evtchnfd {
1592 	u32 send_port;
1593 	u32 type;
1594 	union {
1595 		struct kvm_xen_evtchn port;
1596 		struct {
1597 			u32 port; /* zero */
1598 			struct eventfd_ctx *ctx;
1599 		} eventfd;
1600 	} deliver;
1601 };
1602 
1603 /*
1604  * Update target vCPU or priority for a registered sending channel.
1605  */
1606 static int kvm_xen_eventfd_update(struct kvm *kvm,
1607 				  struct kvm_xen_hvm_attr *data)
1608 {
1609 	u32 port = data->u.evtchn.send_port;
1610 	struct evtchnfd *evtchnfd;
1611 
1612 	if (!port || port >= max_evtchn_port(kvm))
1613 		return -EINVAL;
1614 
1615 	mutex_lock(&kvm->lock);
1616 	evtchnfd = idr_find(&kvm->arch.xen.evtchn_ports, port);
1617 	mutex_unlock(&kvm->lock);
1618 
1619 	if (!evtchnfd)
1620 		return -ENOENT;
1621 
1622 	/* For an UPDATE, nothing may change except the priority/vcpu */
1623 	if (evtchnfd->type != data->u.evtchn.type)
1624 		return -EINVAL;
1625 
1626 	/*
1627 	 * Port cannot change, and if it's zero that was an eventfd
1628 	 * which can't be changed either.
1629 	 */
1630 	if (!evtchnfd->deliver.port.port ||
1631 	    evtchnfd->deliver.port.port != data->u.evtchn.deliver.port.port)
1632 		return -EINVAL;
1633 
1634 	/* We only support 2 level event channels for now */
1635 	if (data->u.evtchn.deliver.port.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL)
1636 		return -EINVAL;
1637 
1638 	mutex_lock(&kvm->lock);
1639 	evtchnfd->deliver.port.priority = data->u.evtchn.deliver.port.priority;
1640 	if (evtchnfd->deliver.port.vcpu_id != data->u.evtchn.deliver.port.vcpu) {
1641 		evtchnfd->deliver.port.vcpu_id = data->u.evtchn.deliver.port.vcpu;
1642 		evtchnfd->deliver.port.vcpu_idx = -1;
1643 	}
1644 	mutex_unlock(&kvm->lock);
1645 	return 0;
1646 }
1647 
1648 /*
1649  * Configure the target (eventfd or local port delivery) for sending on
1650  * a given event channel.
1651  */
1652 static int kvm_xen_eventfd_assign(struct kvm *kvm,
1653 				  struct kvm_xen_hvm_attr *data)
1654 {
1655 	u32 port = data->u.evtchn.send_port;
1656 	struct eventfd_ctx *eventfd = NULL;
1657 	struct evtchnfd *evtchnfd = NULL;
1658 	int ret = -EINVAL;
1659 
1660 	if (!port || port >= max_evtchn_port(kvm))
1661 		return -EINVAL;
1662 
1663 	evtchnfd = kzalloc(sizeof(struct evtchnfd), GFP_KERNEL);
1664 	if (!evtchnfd)
1665 		return -ENOMEM;
1666 
1667 	switch(data->u.evtchn.type) {
1668 	case EVTCHNSTAT_ipi:
1669 		/* IPI  must map back to the same port# */
1670 		if (data->u.evtchn.deliver.port.port != data->u.evtchn.send_port)
1671 			goto out; /* -EINVAL */
1672 		break;
1673 
1674 	case EVTCHNSTAT_interdomain:
1675 		if (data->u.evtchn.deliver.port.port) {
1676 			if (data->u.evtchn.deliver.port.port >= max_evtchn_port(kvm))
1677 				goto out; /* -EINVAL */
1678 		} else {
1679 			eventfd = eventfd_ctx_fdget(data->u.evtchn.deliver.eventfd.fd);
1680 			if (IS_ERR(eventfd)) {
1681 				ret = PTR_ERR(eventfd);
1682 				goto out;
1683 			}
1684 		}
1685 		break;
1686 
1687 	case EVTCHNSTAT_virq:
1688 	case EVTCHNSTAT_closed:
1689 	case EVTCHNSTAT_unbound:
1690 	case EVTCHNSTAT_pirq:
1691 	default: /* Unknown event channel type */
1692 		goto out; /* -EINVAL */
1693 	}
1694 
1695 	evtchnfd->send_port = data->u.evtchn.send_port;
1696 	evtchnfd->type = data->u.evtchn.type;
1697 	if (eventfd) {
1698 		evtchnfd->deliver.eventfd.ctx = eventfd;
1699 	} else {
1700 		/* We only support 2 level event channels for now */
1701 		if (data->u.evtchn.deliver.port.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL)
1702 			goto out; /* -EINVAL; */
1703 
1704 		evtchnfd->deliver.port.port = data->u.evtchn.deliver.port.port;
1705 		evtchnfd->deliver.port.vcpu_id = data->u.evtchn.deliver.port.vcpu;
1706 		evtchnfd->deliver.port.vcpu_idx = -1;
1707 		evtchnfd->deliver.port.priority = data->u.evtchn.deliver.port.priority;
1708 	}
1709 
1710 	mutex_lock(&kvm->lock);
1711 	ret = idr_alloc(&kvm->arch.xen.evtchn_ports, evtchnfd, port, port + 1,
1712 			GFP_KERNEL);
1713 	mutex_unlock(&kvm->lock);
1714 	if (ret >= 0)
1715 		return 0;
1716 
1717 	if (ret == -ENOSPC)
1718 		ret = -EEXIST;
1719 out:
1720 	if (eventfd)
1721 		eventfd_ctx_put(eventfd);
1722 	kfree(evtchnfd);
1723 	return ret;
1724 }
1725 
1726 static int kvm_xen_eventfd_deassign(struct kvm *kvm, u32 port)
1727 {
1728 	struct evtchnfd *evtchnfd;
1729 
1730 	mutex_lock(&kvm->lock);
1731 	evtchnfd = idr_remove(&kvm->arch.xen.evtchn_ports, port);
1732 	mutex_unlock(&kvm->lock);
1733 
1734 	if (!evtchnfd)
1735 		return -ENOENT;
1736 
1737 	if (kvm)
1738 		synchronize_srcu(&kvm->srcu);
1739 	if (!evtchnfd->deliver.port.port)
1740 		eventfd_ctx_put(evtchnfd->deliver.eventfd.ctx);
1741 	kfree(evtchnfd);
1742 	return 0;
1743 }
1744 
1745 static int kvm_xen_eventfd_reset(struct kvm *kvm)
1746 {
1747 	struct evtchnfd *evtchnfd;
1748 	int i;
1749 
1750 	mutex_lock(&kvm->lock);
1751 	idr_for_each_entry(&kvm->arch.xen.evtchn_ports, evtchnfd, i) {
1752 		idr_remove(&kvm->arch.xen.evtchn_ports, evtchnfd->send_port);
1753 		synchronize_srcu(&kvm->srcu);
1754 		if (!evtchnfd->deliver.port.port)
1755 			eventfd_ctx_put(evtchnfd->deliver.eventfd.ctx);
1756 		kfree(evtchnfd);
1757 	}
1758 	mutex_unlock(&kvm->lock);
1759 
1760 	return 0;
1761 }
1762 
1763 static int kvm_xen_setattr_evtchn(struct kvm *kvm, struct kvm_xen_hvm_attr *data)
1764 {
1765 	u32 port = data->u.evtchn.send_port;
1766 
1767 	if (data->u.evtchn.flags == KVM_XEN_EVTCHN_RESET)
1768 		return kvm_xen_eventfd_reset(kvm);
1769 
1770 	if (!port || port >= max_evtchn_port(kvm))
1771 		return -EINVAL;
1772 
1773 	if (data->u.evtchn.flags == KVM_XEN_EVTCHN_DEASSIGN)
1774 		return kvm_xen_eventfd_deassign(kvm, port);
1775 	if (data->u.evtchn.flags == KVM_XEN_EVTCHN_UPDATE)
1776 		return kvm_xen_eventfd_update(kvm, data);
1777 	if (data->u.evtchn.flags)
1778 		return -EINVAL;
1779 
1780 	return kvm_xen_eventfd_assign(kvm, data);
1781 }
1782 
1783 static bool kvm_xen_hcall_evtchn_send(struct kvm_vcpu *vcpu, u64 param, u64 *r)
1784 {
1785 	struct evtchnfd *evtchnfd;
1786 	struct evtchn_send send;
1787 	gpa_t gpa;
1788 	int idx;
1789 
1790 	idx = srcu_read_lock(&vcpu->kvm->srcu);
1791 	gpa = kvm_mmu_gva_to_gpa_system(vcpu, param, NULL);
1792 	srcu_read_unlock(&vcpu->kvm->srcu, idx);
1793 
1794 	if (!gpa || kvm_vcpu_read_guest(vcpu, gpa, &send, sizeof(send))) {
1795 		*r = -EFAULT;
1796 		return true;
1797 	}
1798 
1799 	/* The evtchn_ports idr is protected by vcpu->kvm->srcu */
1800 	evtchnfd = idr_find(&vcpu->kvm->arch.xen.evtchn_ports, send.port);
1801 	if (!evtchnfd)
1802 		return false;
1803 
1804 	if (evtchnfd->deliver.port.port) {
1805 		int ret = kvm_xen_set_evtchn(&evtchnfd->deliver.port, vcpu->kvm);
1806 		if (ret < 0 && ret != -ENOTCONN)
1807 			return false;
1808 	} else {
1809 		eventfd_signal(evtchnfd->deliver.eventfd.ctx, 1);
1810 	}
1811 
1812 	*r = 0;
1813 	return true;
1814 }
1815 
1816 void kvm_xen_init_vcpu(struct kvm_vcpu *vcpu)
1817 {
1818 	vcpu->arch.xen.vcpu_id = vcpu->vcpu_idx;
1819 	vcpu->arch.xen.poll_evtchn = 0;
1820 	timer_setup(&vcpu->arch.xen.poll_timer, cancel_evtchn_poll, 0);
1821 }
1822 
1823 void kvm_xen_destroy_vcpu(struct kvm_vcpu *vcpu)
1824 {
1825 	if (kvm_xen_timer_enabled(vcpu))
1826 		kvm_xen_stop_timer(vcpu);
1827 
1828 	kvm_gfn_to_pfn_cache_destroy(vcpu->kvm,
1829 				     &vcpu->arch.xen.runstate_cache);
1830 	kvm_gfn_to_pfn_cache_destroy(vcpu->kvm,
1831 				     &vcpu->arch.xen.vcpu_info_cache);
1832 	kvm_gfn_to_pfn_cache_destroy(vcpu->kvm,
1833 				     &vcpu->arch.xen.vcpu_time_info_cache);
1834 	del_timer_sync(&vcpu->arch.xen.poll_timer);
1835 }
1836 
1837 void kvm_xen_init_vm(struct kvm *kvm)
1838 {
1839 	idr_init(&kvm->arch.xen.evtchn_ports);
1840 }
1841 
1842 void kvm_xen_destroy_vm(struct kvm *kvm)
1843 {
1844 	struct evtchnfd *evtchnfd;
1845 	int i;
1846 
1847 	kvm_gfn_to_pfn_cache_destroy(kvm, &kvm->arch.xen.shinfo_cache);
1848 
1849 	idr_for_each_entry(&kvm->arch.xen.evtchn_ports, evtchnfd, i) {
1850 		if (!evtchnfd->deliver.port.port)
1851 			eventfd_ctx_put(evtchnfd->deliver.eventfd.ctx);
1852 		kfree(evtchnfd);
1853 	}
1854 	idr_destroy(&kvm->arch.xen.evtchn_ports);
1855 
1856 	if (kvm->arch.xen_hvm_config.msr)
1857 		static_branch_slow_dec_deferred(&kvm_xen_enabled);
1858 }
1859