kernel/arch/s390/kvm/priv.c

   1 /*
   2  * handling privileged instructions
   3  *
   4  * Copyright IBM Corp. 2008, 2013
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License (version 2 only)
   8  * as published by the Free Software Foundation.
   9  *
  10  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  11  *               Christian Borntraeger <borntraeger@de.ibm.com>
  12  */
  13
  14 #include <linux/kvm.h>
  15 #include <linux/gfp.h>
  16 #include <linux/errno.h>
  17 #include <linux/compat.h>
  18 #include <asm/asm-offsets.h>
  19 #include <asm/facility.h>
  20 #include <asm/current.h>
  21 #include <asm/debug.h>
  22 #include <asm/ebcdic.h>
  23 #include <asm/sysinfo.h>
  24 #include <asm/pgtable.h>
  25 #include <asm/pgalloc.h>
  26 #include <asm/io.h>
  27 #include <asm/ptrace.h>
  28 #include <asm/compat.h>
  29 #include "gaccess.h"
  30 #include "kvm-s390.h"
  31 #include "trace.h"
  32
  33 /* Handle SCK (SET CLOCK) interception */
  34 static int handle_set_clock(struct kvm_vcpu *vcpu)
  35 {
  36         int rc;
  37         ar_t ar;
  38         u64 op2, val;
  39
  40         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
  41                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
  42
  43         op2 = kvm_s390_get_base_disp_s(vcpu, &ar);
  44         if (op2 & 7)    /* Operand must be on a doubleword boundary */
  45                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
  46         rc = read_guest(vcpu, op2, ar, &val, sizeof(val));
  47         if (rc)
  48                 return kvm_s390_inject_prog_cond(vcpu, rc);
  49
  50         VCPU_EVENT(vcpu, 3, "SCK: setting guest TOD to 0x%llx", val);
  51         kvm_s390_set_tod_clock(vcpu->kvm, val);
  52
  53         kvm_s390_set_psw_cc(vcpu, 0);
  54         return 0;
  55 }
  56
  57 static int handle_set_prefix(struct kvm_vcpu *vcpu)
  58 {
  59         u64 operand2;
  60         u32 address;
  61         int rc;
  62         ar_t ar;
  63
  64         vcpu->stat.instruction_spx++;
  65
  66         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
  67                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
  68
  69         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
  70
  71         /* must be word boundary */
  72         if (operand2 & 3)
  73                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
  74
  75         /* get the value */
  76         rc = read_guest(vcpu, operand2, ar, &address, sizeof(address));
  77         if (rc)
  78                 return kvm_s390_inject_prog_cond(vcpu, rc);
  79
  80         address &= 0x7fffe000u;
  81
  82         /*
  83          * Make sure the new value is valid memory. We only need to check the
  84          * first page, since address is 8k aligned and memory pieces are always
  85          * at least 1MB aligned and have at least a size of 1MB.
  86          */
  87         if (kvm_is_error_gpa(vcpu->kvm, address))
  88                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
  89
  90         kvm_s390_set_prefix(vcpu, address);
  91         trace_kvm_s390_handle_prefix(vcpu, 1, address);
  92         return 0;
  93 }
  94
  95 static int handle_store_prefix(struct kvm_vcpu *vcpu)
  96 {
  97         u64 operand2;
  98         u32 address;
  99         int rc;
 100         ar_t ar;
 101
 102         vcpu->stat.instruction_stpx++;
 103
 104         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 105                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 106
 107         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 108
 109         /* must be word boundary */
 110         if (operand2 & 3)
 111                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 112
 113         address = kvm_s390_get_prefix(vcpu);
 114
 115         /* get the value */
 116         rc = write_guest(vcpu, operand2, ar, &address, sizeof(address));
 117         if (rc)
 118                 return kvm_s390_inject_prog_cond(vcpu, rc);
 119
 120         VCPU_EVENT(vcpu, 3, "STPX: storing prefix 0x%x into 0x%llx", address, operand2);
 121         trace_kvm_s390_handle_prefix(vcpu, 0, address);
 122         return 0;
 123 }
 124
 125 static int handle_store_cpu_address(struct kvm_vcpu *vcpu)
 126 {
 127         u16 vcpu_id = vcpu->vcpu_id;
 128         u64 ga;
 129         int rc;
 130         ar_t ar;
 131
 132         vcpu->stat.instruction_stap++;
 133
 134         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 135                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 136
 137         ga = kvm_s390_get_base_disp_s(vcpu, &ar);
 138
 139         if (ga & 1)
 140                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 141
 142         rc = write_guest(vcpu, ga, ar, &vcpu_id, sizeof(vcpu_id));
 143         if (rc)
 144                 return kvm_s390_inject_prog_cond(vcpu, rc);
 145
 146         VCPU_EVENT(vcpu, 3, "STAP: storing cpu address (%u) to 0x%llx", vcpu_id, ga);
 147         trace_kvm_s390_handle_stap(vcpu, ga);
 148         return 0;
 149 }
 150
 151 static int __skey_check_enable(struct kvm_vcpu *vcpu)
 152 {
 153         int rc = 0;
 154         if (!(vcpu->arch.sie_block->ictl & (ICTL_ISKE | ICTL_SSKE | ICTL_RRBE)))
 155                 return rc;
 156
 157         rc = s390_enable_skey();
 158         VCPU_EVENT(vcpu, 3, "%s", "enabling storage keys for guest");
 159         trace_kvm_s390_skey_related_inst(vcpu);
 160         vcpu->arch.sie_block->ictl &= ~(ICTL_ISKE | ICTL_SSKE | ICTL_RRBE);
 161         return rc;
 162 }
 163
 164
 165 static int handle_skey(struct kvm_vcpu *vcpu)
 166 {
 167         int rc = __skey_check_enable(vcpu);
 168
 169         if (rc)
 170                 return rc;
 171         vcpu->stat.instruction_storage_key++;
 172
 173         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 174                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 175
 176         kvm_s390_rewind_psw(vcpu, 4);
 177         VCPU_EVENT(vcpu, 4, "%s", "retrying storage key operation");
 178         return 0;
 179 }
 180
 181 static int handle_ipte_interlock(struct kvm_vcpu *vcpu)
 182 {
 183         vcpu->stat.instruction_ipte_interlock++;
 184         if (psw_bits(vcpu->arch.sie_block->gpsw).p)
 185                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 186         wait_event(vcpu->kvm->arch.ipte_wq, !ipte_lock_held(vcpu));
 187         kvm_s390_rewind_psw(vcpu, 4);
 188         VCPU_EVENT(vcpu, 4, "%s", "retrying ipte interlock operation");
 189         return 0;
 190 }
 191
 192 static int handle_test_block(struct kvm_vcpu *vcpu)
 193 {
 194         gpa_t addr;
 195         int reg2;
 196
 197         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 198                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 199
 200         kvm_s390_get_regs_rre(vcpu, NULL, &reg2);
 201         addr = vcpu->run->s.regs.gprs[reg2] & PAGE_MASK;
 202         addr = kvm_s390_logical_to_effective(vcpu, addr);
 203         if (kvm_s390_check_low_addr_prot_real(vcpu, addr))
 204                 return kvm_s390_inject_prog_irq(vcpu, &vcpu->arch.pgm);
 205         addr = kvm_s390_real_to_abs(vcpu, addr);
 206
 207         if (kvm_is_error_gpa(vcpu->kvm, addr))
 208                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 209         /*
 210          * We don't expect errors on modern systems, and do not care
 211          * about storage keys (yet), so let's just clear the page.
 212          */
 213         if (kvm_clear_guest(vcpu->kvm, addr, PAGE_SIZE))
 214                 return -EFAULT;
 215         kvm_s390_set_psw_cc(vcpu, 0);
 216         vcpu->run->s.regs.gprs[0] = 0;
 217         return 0;
 218 }
 219
 220 static int handle_tpi(struct kvm_vcpu *vcpu)
 221 {
 222         struct kvm_s390_interrupt_info *inti;
 223         unsigned long len;
 224         u32 tpi_data[3];
 225         int rc;
 226         u64 addr;
 227         ar_t ar;
 228
 229         addr = kvm_s390_get_base_disp_s(vcpu, &ar);
 230         if (addr & 3)
 231                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 232
 233         inti = kvm_s390_get_io_int(vcpu->kvm, vcpu->arch.sie_block->gcr[6], 0);
 234         if (!inti) {
 235                 kvm_s390_set_psw_cc(vcpu, 0);
 236                 return 0;
 237         }
 238
 239         tpi_data[0] = inti->io.subchannel_id << 16 | inti->io.subchannel_nr;
 240         tpi_data[1] = inti->io.io_int_parm;
 241         tpi_data[2] = inti->io.io_int_word;
 242         if (addr) {
 243                 /*
 244                  * Store the two-word I/O interruption code into the
 245                  * provided area.
 246                  */
 247                 len = sizeof(tpi_data) - 4;
 248                 rc = write_guest(vcpu, addr, ar, &tpi_data, len);
 249                 if (rc) {
 250                         rc = kvm_s390_inject_prog_cond(vcpu, rc);
 251                         goto reinject_interrupt;
 252                 }
 253         } else {
 254                 /*
 255                  * Store the three-word I/O interruption code into
 256                  * the appropriate lowcore area.
 257                  */
 258                 len = sizeof(tpi_data);
 259                 if (write_guest_lc(vcpu, __LC_SUBCHANNEL_ID, &tpi_data, len)) {
 260                         /* failed writes to the low core are not recoverable */
 261                         rc = -EFAULT;
 262                         goto reinject_interrupt;
 263                 }
 264         }
 265
 266         /* irq was successfully handed to the guest */
 267         kfree(inti);
 268         kvm_s390_set_psw_cc(vcpu, 1);
 269         return 0;
 270 reinject_interrupt:
 271         /*
 272          * If we encounter a problem storing the interruption code, the
 273          * instruction is suppressed from the guest's view: reinject the
 274          * interrupt.
 275          */
 276         if (kvm_s390_reinject_io_int(vcpu->kvm, inti)) {
 277                 kfree(inti);
 278                 rc = -EFAULT;
 279         }
 280         /* don't set the cc, a pgm irq was injected or we drop to user space */
 281         return rc ? -EFAULT : 0;
 282 }
 283
 284 static int handle_tsch(struct kvm_vcpu *vcpu)
 285 {
 286         struct kvm_s390_interrupt_info *inti = NULL;
 287         const u64 isc_mask = 0xffUL << 24; /* all iscs set */
 288
 289         /* a valid schid has at least one bit set */
 290         if (vcpu->run->s.regs.gprs[1])
 291                 inti = kvm_s390_get_io_int(vcpu->kvm, isc_mask,
 292                                            vcpu->run->s.regs.gprs[1]);
 293
 294         /*
 295          * Prepare exit to userspace.
 296          * We indicate whether we dequeued a pending I/O interrupt
 297          * so that userspace can re-inject it if the instruction gets
 298          * a program check. While this may re-order the pending I/O
 299          * interrupts, this is no problem since the priority is kept
 300          * intact.
 301          */
 302         vcpu->run->exit_reason = KVM_EXIT_S390_TSCH;
 303         vcpu->run->s390_tsch.dequeued = !!inti;
 304         if (inti) {
 305                 vcpu->run->s390_tsch.subchannel_id = inti->io.subchannel_id;
 306                 vcpu->run->s390_tsch.subchannel_nr = inti->io.subchannel_nr;
 307                 vcpu->run->s390_tsch.io_int_parm = inti->io.io_int_parm;
 308                 vcpu->run->s390_tsch.io_int_word = inti->io.io_int_word;
 309         }
 310         vcpu->run->s390_tsch.ipb = vcpu->arch.sie_block->ipb;
 311         kfree(inti);
 312         return -EREMOTE;
 313 }
 314
 315 static int handle_io_inst(struct kvm_vcpu *vcpu)
 316 {
 317         VCPU_EVENT(vcpu, 4, "%s", "I/O instruction");
 318
 319         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 320                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 321
 322         if (vcpu->kvm->arch.css_support) {
 323                 /*
 324                  * Most I/O instructions will be handled by userspace.
 325                  * Exceptions are tpi and the interrupt portion of tsch.
 326                  */
 327                 if (vcpu->arch.sie_block->ipa == 0xb236)
 328                         return handle_tpi(vcpu);
 329                 if (vcpu->arch.sie_block->ipa == 0xb235)
 330                         return handle_tsch(vcpu);
 331                 /* Handle in userspace. */
 332                 return -EOPNOTSUPP;
 333         } else {
 334                 /*
 335                  * Set condition code 3 to stop the guest from issuing channel
 336                  * I/O instructions.
 337                  */
 338                 kvm_s390_set_psw_cc(vcpu, 3);
 339                 return 0;
 340         }
 341 }
 342
 343 static int handle_stfl(struct kvm_vcpu *vcpu)
 344 {
 345         int rc;
 346         unsigned int fac;
 347
 348         vcpu->stat.instruction_stfl++;
 349
 350         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 351                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 352
 353         /*
 354          * We need to shift the lower 32 facility bits (bit 0-31) from a u64
 355          * into a u32 memory representation. They will remain bits 0-31.
 356          */
 357         fac = *vcpu->kvm->arch.model.fac->list >> 32;
 358         rc = write_guest_lc(vcpu, offsetof(struct _lowcore, stfl_fac_list),
 359                             &fac, sizeof(fac));
 360         if (rc)
 361                 return rc;
 362         VCPU_EVENT(vcpu, 3, "STFL: store facility list 0x%x", fac);
 363         trace_kvm_s390_handle_stfl(vcpu, fac);
 364         return 0;
 365 }
 366
 367 #define PSW_MASK_ADDR_MODE (PSW_MASK_EA | PSW_MASK_BA)
 368 #define PSW_MASK_UNASSIGNED 0xb80800fe7fffffffUL
 369 #define PSW_ADDR_24 0x0000000000ffffffUL
 370 #define PSW_ADDR_31 0x000000007fffffffUL
 371
 372 int is_valid_psw(psw_t *psw)
 373 {
 374         if (psw->mask & PSW_MASK_UNASSIGNED)
 375                 return 0;
 376         if ((psw->mask & PSW_MASK_ADDR_MODE) == PSW_MASK_BA) {
 377                 if (psw->addr & ~PSW_ADDR_31)
 378                         return 0;
 379         }
 380         if (!(psw->mask & PSW_MASK_ADDR_MODE) && (psw->addr & ~PSW_ADDR_24))
 381                 return 0;
 382         if ((psw->mask & PSW_MASK_ADDR_MODE) ==  PSW_MASK_EA)
 383                 return 0;
 384         if (psw->addr & 1)
 385                 return 0;
 386         return 1;
 387 }
 388
 389 int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
 390 {
 391         psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
 392         psw_compat_t new_psw;
 393         u64 addr;
 394         int rc;
 395         ar_t ar;
 396
 397         if (gpsw->mask & PSW_MASK_PSTATE)
 398                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 399
 400         addr = kvm_s390_get_base_disp_s(vcpu, &ar);
 401         if (addr & 7)
 402                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 403
 404         rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw));
 405         if (rc)
 406                 return kvm_s390_inject_prog_cond(vcpu, rc);
 407         if (!(new_psw.mask & PSW32_MASK_BASE))
 408                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 409         gpsw->mask = (new_psw.mask & ~PSW32_MASK_BASE) << 32;
 410         gpsw->mask |= new_psw.addr & PSW32_ADDR_AMODE;
 411         gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
 412         if (!is_valid_psw(gpsw))
 413                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 414         return 0;
 415 }
 416
 417 static int handle_lpswe(struct kvm_vcpu *vcpu)
 418 {
 419         psw_t new_psw;
 420         u64 addr;
 421         int rc;
 422         ar_t ar;
 423
 424         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 425                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 426
 427         addr = kvm_s390_get_base_disp_s(vcpu, &ar);
 428         if (addr & 7)
 429                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 430         rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw));
 431         if (rc)
 432                 return kvm_s390_inject_prog_cond(vcpu, rc);
 433         vcpu->arch.sie_block->gpsw = new_psw;
 434         if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
 435                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 436         return 0;
 437 }
 438
 439 static int handle_stidp(struct kvm_vcpu *vcpu)
 440 {
 441         u64 stidp_data = vcpu->arch.stidp_data;
 442         u64 operand2;
 443         int rc;
 444         ar_t ar;
 445
 446         vcpu->stat.instruction_stidp++;
 447
 448         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 449                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 450
 451         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 452
 453         if (operand2 & 7)
 454                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 455
 456         rc = write_guest(vcpu, operand2, ar, &stidp_data, sizeof(stidp_data));
 457         if (rc)
 458                 return kvm_s390_inject_prog_cond(vcpu, rc);
 459
 460         VCPU_EVENT(vcpu, 3, "STIDP: store cpu id 0x%llx", stidp_data);
 461         return 0;
 462 }
 463
 464 static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
 465 {
 466         int cpus = 0;
 467         int n;
 468
 469         cpus = atomic_read(&vcpu->kvm->online_vcpus);
 470
 471         /* deal with other level 3 hypervisors */
 472         if (stsi(mem, 3, 2, 2))
 473                 mem->count = 0;
 474         if (mem->count < 8)
 475                 mem->count++;
 476         for (n = mem->count - 1; n > 0 ; n--)
 477                 memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
 478
 479         memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
 480         mem->vm[0].cpus_total = cpus;
 481         mem->vm[0].cpus_configured = cpus;
 482         mem->vm[0].cpus_standby = 0;
 483         mem->vm[0].cpus_reserved = 0;
 484         mem->vm[0].caf = 1000;
 485         memcpy(mem->vm[0].name, "KVMguest", 8);
 486         ASCEBC(mem->vm[0].name, 8);
 487         memcpy(mem->vm[0].cpi, "KVM/Linux       ", 16);
 488         ASCEBC(mem->vm[0].cpi, 16);
 489 }
 490
 491 static void insert_stsi_usr_data(struct kvm_vcpu *vcpu, u64 addr, ar_t ar,
 492                                  u8 fc, u8 sel1, u16 sel2)
 493 {
 494         vcpu->run->exit_reason = KVM_EXIT_S390_STSI;
 495         vcpu->run->s390_stsi.addr = addr;
 496         vcpu->run->s390_stsi.ar = ar;
 497         vcpu->run->s390_stsi.fc = fc;
 498         vcpu->run->s390_stsi.sel1 = sel1;
 499         vcpu->run->s390_stsi.sel2 = sel2;
 500 }
 501
 502 static int handle_stsi(struct kvm_vcpu *vcpu)
 503 {
 504         int fc = (vcpu->run->s.regs.gprs[0] & 0xf0000000) >> 28;
 505         int sel1 = vcpu->run->s.regs.gprs[0] & 0xff;
 506         int sel2 = vcpu->run->s.regs.gprs[1] & 0xffff;
 507         unsigned long mem = 0;
 508         u64 operand2;
 509         int rc = 0;
 510         ar_t ar;
 511
 512         vcpu->stat.instruction_stsi++;
 513         VCPU_EVENT(vcpu, 3, "STSI: fc: %u sel1: %u sel2: %u", fc, sel1, sel2);
 514
 515         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 516                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 517
 518         if (fc > 3) {
 519                 kvm_s390_set_psw_cc(vcpu, 3);
 520                 return 0;
 521         }
 522
 523         if (vcpu->run->s.regs.gprs[0] & 0x0fffff00
 524             || vcpu->run->s.regs.gprs[1] & 0xffff0000)
 525                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 526
 527         if (fc == 0) {
 528                 vcpu->run->s.regs.gprs[0] = 3 << 28;
 529                 kvm_s390_set_psw_cc(vcpu, 0);
 530                 return 0;
 531         }
 532
 533         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 534
 535         if (operand2 & 0xfff)
 536                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 537
 538         switch (fc) {
 539         case 1: /* same handling for 1 and 2 */
 540         case 2:
 541                 mem = get_zeroed_page(GFP_KERNEL);
 542                 if (!mem)
 543                         goto out_no_data;
 544                 if (stsi((void *) mem, fc, sel1, sel2))
 545                         goto out_no_data;
 546                 break;
 547         case 3:
 548                 if (sel1 != 2 || sel2 != 2)
 549                         goto out_no_data;
 550                 mem = get_zeroed_page(GFP_KERNEL);
 551                 if (!mem)
 552                         goto out_no_data;
 553                 handle_stsi_3_2_2(vcpu, (void *) mem);
 554                 break;
 555         }
 556
 557         rc = write_guest(vcpu, operand2, ar, (void *)mem, PAGE_SIZE);
 558         if (rc) {
 559                 rc = kvm_s390_inject_prog_cond(vcpu, rc);
 560                 goto out;
 561         }
 562         if (vcpu->kvm->arch.user_stsi) {
 563                 insert_stsi_usr_data(vcpu, operand2, ar, fc, sel1, sel2);
 564                 rc = -EREMOTE;
 565         }
 566         trace_kvm_s390_handle_stsi(vcpu, fc, sel1, sel2, operand2);
 567         free_page(mem);
 568         kvm_s390_set_psw_cc(vcpu, 0);
 569         vcpu->run->s.regs.gprs[0] = 0;
 570         return rc;
 571 out_no_data:
 572         kvm_s390_set_psw_cc(vcpu, 3);
 573 out:
 574         free_page(mem);
 575         return rc;
 576 }
 577
 578 static const intercept_handler_t b2_handlers[256] = {
 579         [0x02] = handle_stidp,
 580         [0x04] = handle_set_clock,
 581         [0x10] = handle_set_prefix,
 582         [0x11] = handle_store_prefix,
 583         [0x12] = handle_store_cpu_address,
 584         [0x21] = handle_ipte_interlock,
 585         [0x29] = handle_skey,
 586         [0x2a] = handle_skey,
 587         [0x2b] = handle_skey,
 588         [0x2c] = handle_test_block,
 589         [0x30] = handle_io_inst,
 590         [0x31] = handle_io_inst,
 591         [0x32] = handle_io_inst,
 592         [0x33] = handle_io_inst,
 593         [0x34] = handle_io_inst,
 594         [0x35] = handle_io_inst,
 595         [0x36] = handle_io_inst,
 596         [0x37] = handle_io_inst,
 597         [0x38] = handle_io_inst,
 598         [0x39] = handle_io_inst,
 599         [0x3a] = handle_io_inst,
 600         [0x3b] = handle_io_inst,
 601         [0x3c] = handle_io_inst,
 602         [0x50] = handle_ipte_interlock,
 603         [0x5f] = handle_io_inst,
 604         [0x74] = handle_io_inst,
 605         [0x76] = handle_io_inst,
 606         [0x7d] = handle_stsi,
 607         [0xb1] = handle_stfl,
 608         [0xb2] = handle_lpswe,
 609 };
 610
 611 int kvm_s390_handle_b2(struct kvm_vcpu *vcpu)
 612 {
 613         intercept_handler_t handler;
 614
 615         /*
 616          * A lot of B2 instructions are priviledged. Here we check for
 617          * the privileged ones, that we can handle in the kernel.
 618          * Anything else goes to userspace.
 619          */
 620         handler = b2_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
 621         if (handler)
 622                 return handler(vcpu);
 623
 624         return -EOPNOTSUPP;
 625 }
 626
 627 static int handle_epsw(struct kvm_vcpu *vcpu)
 628 {
 629         int reg1, reg2;
 630
 631         kvm_s390_get_regs_rre(vcpu, &reg1, &reg2);
 632
 633         /* This basically extracts the mask half of the psw. */
 634         vcpu->run->s.regs.gprs[reg1] &= 0xffffffff00000000UL;
 635         vcpu->run->s.regs.gprs[reg1] |= vcpu->arch.sie_block->gpsw.mask >> 32;
 636         if (reg2) {
 637                 vcpu->run->s.regs.gprs[reg2] &= 0xffffffff00000000UL;
 638                 vcpu->run->s.regs.gprs[reg2] |=
 639                         vcpu->arch.sie_block->gpsw.mask & 0x00000000ffffffffUL;
 640         }
 641         return 0;
 642 }
 643
 644 #define PFMF_RESERVED   0xfffc0101UL
 645 #define PFMF_SK         0x00020000UL
 646 #define PFMF_CF         0x00010000UL
 647 #define PFMF_UI         0x00008000UL
 648 #define PFMF_FSC        0x00007000UL
 649 #define PFMF_NQ         0x00000800UL
 650 #define PFMF_MR         0x00000400UL
 651 #define PFMF_MC         0x00000200UL
 652 #define PFMF_KEY        0x000000feUL
 653
 654 static int handle_pfmf(struct kvm_vcpu *vcpu)
 655 {
 656         int reg1, reg2;
 657         unsigned long start, end;
 658
 659         vcpu->stat.instruction_pfmf++;
 660
 661         kvm_s390_get_regs_rre(vcpu, &reg1, &reg2);
 662
 663         if (!test_kvm_facility(vcpu->kvm, 8))
 664                 return kvm_s390_inject_program_int(vcpu, PGM_OPERATION);
 665
 666         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 667                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 668
 669         if (vcpu->run->s.regs.gprs[reg1] & PFMF_RESERVED)
 670                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 671
 672         /* Only provide non-quiescing support if the host supports it */
 673         if (vcpu->run->s.regs.gprs[reg1] & PFMF_NQ && !test_facility(14))
 674                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 675
 676         /* No support for conditional-SSKE */
 677         if (vcpu->run->s.regs.gprs[reg1] & (PFMF_MR | PFMF_MC))
 678                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 679
 680         start = vcpu->run->s.regs.gprs[reg2] & PAGE_MASK;
 681         start = kvm_s390_logical_to_effective(vcpu, start);
 682
 683         switch (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) {
 684         case 0x00000000:
 685                 end = (start + (1UL << 12)) & ~((1UL << 12) - 1);
 686                 break;
 687         case 0x00001000:
 688                 end = (start + (1UL << 20)) & ~((1UL << 20) - 1);
 689                 break;
 690         case 0x00002000:
 691                 /* only support 2G frame size if EDAT2 is available and we are
 692                    not in 24-bit addressing mode */
 693                 if (!test_kvm_facility(vcpu->kvm, 78) ||
 694                     psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_AMODE_24BIT)
 695                         return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 696                 end = (start + (1UL << 31)) & ~((1UL << 31) - 1);
 697                 break;
 698         default:
 699                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 700         }
 701
 702         if (vcpu->run->s.regs.gprs[reg1] & PFMF_CF) {
 703                 if (kvm_s390_check_low_addr_prot_real(vcpu, start))
 704                         return kvm_s390_inject_prog_irq(vcpu, &vcpu->arch.pgm);
 705         }
 706
 707         while (start < end) {
 708                 unsigned long useraddr, abs_addr;
 709
 710                 /* Translate guest address to host address */
 711                 if ((vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) == 0)
 712                         abs_addr = kvm_s390_real_to_abs(vcpu, start);
 713                 else
 714                         abs_addr = start;
 715                 useraddr = gfn_to_hva(vcpu->kvm, gpa_to_gfn(abs_addr));
 716                 if (kvm_is_error_hva(useraddr))
 717                         return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 718
 719                 if (vcpu->run->s.regs.gprs[reg1] & PFMF_CF) {
 720                         if (clear_user((void __user *)useraddr, PAGE_SIZE))
 721                                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 722                 }
 723
 724                 if (vcpu->run->s.regs.gprs[reg1] & PFMF_SK) {
 725                         int rc = __skey_check_enable(vcpu);
 726
 727                         if (rc)
 728                                 return rc;
 729                         if (set_guest_storage_key(current->mm, useraddr,
 730                                         vcpu->run->s.regs.gprs[reg1] & PFMF_KEY,
 731                                         vcpu->run->s.regs.gprs[reg1] & PFMF_NQ))
 732                                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 733                 }
 734
 735                 start += PAGE_SIZE;
 736         }
 737         if (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC)
 738                 vcpu->run->s.regs.gprs[reg2] = end;
 739         return 0;
 740 }
 741
 742 static int handle_essa(struct kvm_vcpu *vcpu)
 743 {
 744         /* entries expected to be 1FF */
 745         int entries = (vcpu->arch.sie_block->cbrlo & ~PAGE_MASK) >> 3;
 746         unsigned long *cbrlo, cbrle;
 747         struct gmap *gmap;
 748         int i;
 749
 750         VCPU_EVENT(vcpu, 4, "ESSA: release %d pages", entries);
 751         gmap = vcpu->arch.gmap;
 752         vcpu->stat.instruction_essa++;
 753         if (!vcpu->kvm->arch.use_cmma)
 754                 return kvm_s390_inject_program_int(vcpu, PGM_OPERATION);
 755
 756         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 757                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 758
 759         if (((vcpu->arch.sie_block->ipb & 0xf0000000) >> 28) > 6)
 760                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 761
 762         /* Rewind PSW to repeat the ESSA instruction */
 763         kvm_s390_rewind_psw(vcpu, 4);
 764         vcpu->arch.sie_block->cbrlo &= PAGE_MASK;       /* reset nceo */
 765         cbrlo = phys_to_virt(vcpu->arch.sie_block->cbrlo);
 766         down_read(&gmap->mm->mmap_sem);
 767         for (i = 0; i < entries; ++i) {
 768                 cbrle = cbrlo[i];
 769                 if (unlikely(cbrle & ~PAGE_MASK || cbrle < 2 * PAGE_SIZE))
 770                         /* invalid entry */
 771                         break;
 772                 /* try to free backing */
 773                 __gmap_zap(gmap, cbrle);
 774         }
 775         up_read(&gmap->mm->mmap_sem);
 776         if (i < entries)
 777                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 778         return 0;
 779 }
 780
 781 static const intercept_handler_t b9_handlers[256] = {
 782         [0x8a] = handle_ipte_interlock,
 783         [0x8d] = handle_epsw,
 784         [0x8e] = handle_ipte_interlock,
 785         [0x8f] = handle_ipte_interlock,
 786         [0xab] = handle_essa,
 787         [0xaf] = handle_pfmf,
 788 };
 789
 790 int kvm_s390_handle_b9(struct kvm_vcpu *vcpu)
 791 {
 792         intercept_handler_t handler;
 793
 794         /* This is handled just as for the B2 instructions. */
 795         handler = b9_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
 796         if (handler)
 797                 return handler(vcpu);
 798
 799         return -EOPNOTSUPP;
 800 }
 801
 802 int kvm_s390_handle_lctl(struct kvm_vcpu *vcpu)
 803 {
 804         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 805         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 806         int reg, rc, nr_regs;
 807         u32 ctl_array[16];
 808         u64 ga;
 809         ar_t ar;
 810
 811         vcpu->stat.instruction_lctl++;
 812
 813         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 814                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 815
 816         ga = kvm_s390_get_base_disp_rs(vcpu, &ar);
 817
 818         if (ga & 3)
 819                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 820
 821         VCPU_EVENT(vcpu, 4, "LCTL: r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 822         trace_kvm_s390_handle_lctl(vcpu, 0, reg1, reg3, ga);
 823
 824         nr_regs = ((reg3 - reg1) & 0xf) + 1;
 825         rc = read_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u32));
 826         if (rc)
 827                 return kvm_s390_inject_prog_cond(vcpu, rc);
 828         reg = reg1;
 829         nr_regs = 0;
 830         do {
 831                 vcpu->arch.sie_block->gcr[reg] &= 0xffffffff00000000ul;
 832                 vcpu->arch.sie_block->gcr[reg] |= ctl_array[nr_regs++];
 833                 if (reg == reg3)
 834                         break;
 835                 reg = (reg + 1) % 16;
 836         } while (1);
 837         kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 838         return 0;
 839 }
 840
 841 int kvm_s390_handle_stctl(struct kvm_vcpu *vcpu)
 842 {
 843         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 844         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 845         int reg, rc, nr_regs;
 846         u32 ctl_array[16];
 847         u64 ga;
 848         ar_t ar;
 849
 850         vcpu->stat.instruction_stctl++;
 851
 852         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 853                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 854
 855         ga = kvm_s390_get_base_disp_rs(vcpu, &ar);
 856
 857         if (ga & 3)
 858                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 859
 860         VCPU_EVENT(vcpu, 4, "STCTL r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 861         trace_kvm_s390_handle_stctl(vcpu, 0, reg1, reg3, ga);
 862
 863         reg = reg1;
 864         nr_regs = 0;
 865         do {
 866                 ctl_array[nr_regs++] = vcpu->arch.sie_block->gcr[reg];
 867                 if (reg == reg3)
 868                         break;
 869                 reg = (reg + 1) % 16;
 870         } while (1);
 871         rc = write_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u32));
 872         return rc ? kvm_s390_inject_prog_cond(vcpu, rc) : 0;
 873 }
 874
 875 static int handle_lctlg(struct kvm_vcpu *vcpu)
 876 {
 877         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 878         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 879         int reg, rc, nr_regs;
 880         u64 ctl_array[16];
 881         u64 ga;
 882         ar_t ar;
 883
 884         vcpu->stat.instruction_lctlg++;
 885
 886         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 887                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 888
 889         ga = kvm_s390_get_base_disp_rsy(vcpu, &ar);
 890
 891         if (ga & 7)
 892                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 893
 894         VCPU_EVENT(vcpu, 4, "LCTLG: r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 895         trace_kvm_s390_handle_lctl(vcpu, 1, reg1, reg3, ga);
 896
 897         nr_regs = ((reg3 - reg1) & 0xf) + 1;
 898         rc = read_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u64));
 899         if (rc)
 900                 return kvm_s390_inject_prog_cond(vcpu, rc);
 901         reg = reg1;
 902         nr_regs = 0;
 903         do {
 904                 vcpu->arch.sie_block->gcr[reg] = ctl_array[nr_regs++];
 905                 if (reg == reg3)
 906                         break;
 907                 reg = (reg + 1) % 16;
 908         } while (1);
 909         kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 910         return 0;
 911 }
 912
 913 static int handle_stctg(struct kvm_vcpu *vcpu)
 914 {
 915         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 916         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 917         int reg, rc, nr_regs;
 918         u64 ctl_array[16];
 919         u64 ga;
 920         ar_t ar;
 921
 922         vcpu->stat.instruction_stctg++;
 923
 924         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 925                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 926
 927         ga = kvm_s390_get_base_disp_rsy(vcpu, &ar);
 928
 929         if (ga & 7)
 930                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 931
 932         VCPU_EVENT(vcpu, 4, "STCTG r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 933         trace_kvm_s390_handle_stctl(vcpu, 1, reg1, reg3, ga);
 934
 935         reg = reg1;
 936         nr_regs = 0;
 937         do {
 938                 ctl_array[nr_regs++] = vcpu->arch.sie_block->gcr[reg];
 939                 if (reg == reg3)
 940                         break;
 941                 reg = (reg + 1) % 16;
 942         } while (1);
 943         rc = write_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u64));
 944         return rc ? kvm_s390_inject_prog_cond(vcpu, rc) : 0;
 945 }
 946
 947 static const intercept_handler_t eb_handlers[256] = {
 948         [0x2f] = handle_lctlg,
 949         [0x25] = handle_stctg,
 950 };
 951
 952 int kvm_s390_handle_eb(struct kvm_vcpu *vcpu)
 953 {
 954         intercept_handler_t handler;
 955
 956         handler = eb_handlers[vcpu->arch.sie_block->ipb & 0xff];
 957         if (handler)
 958                 return handler(vcpu);
 959         return -EOPNOTSUPP;
 960 }
 961
 962 static int handle_tprot(struct kvm_vcpu *vcpu)
 963 {
 964         u64 address1, address2;
 965         unsigned long hva, gpa;
 966         int ret = 0, cc = 0;
 967         bool writable;
 968         ar_t ar;
 969
 970         vcpu->stat.instruction_tprot++;
 971
 972         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 973                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 974
 975         kvm_s390_get_base_disp_sse(vcpu, &address1, &address2, &ar, NULL);
 976
 977         /* we only handle the Linux memory detection case:
 978          * access key == 0
 979          * everything else goes to userspace. */
 980         if (address2 & 0xf0)
 981                 return -EOPNOTSUPP;
 982         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_DAT)
 983                 ipte_lock(vcpu);
 984         ret = guest_translate_address(vcpu, address1, ar, &gpa, 1);
 985         if (ret == PGM_PROTECTION) {
 986                 /* Write protected? Try again with read-only... */
 987                 cc = 1;
 988                 ret = guest_translate_address(vcpu, address1, ar, &gpa, 0);
 989         }
 990         if (ret) {
 991                 if (ret == PGM_ADDRESSING || ret == PGM_TRANSLATION_SPEC) {
 992                         ret = kvm_s390_inject_program_int(vcpu, ret);
 993                 } else if (ret > 0) {
 994                         /* Translation not available */
 995                         kvm_s390_set_psw_cc(vcpu, 3);
 996                         ret = 0;
 997                 }
 998                 goto out_unlock;
 999         }
1000
1001         hva = gfn_to_hva_prot(vcpu->kvm, gpa_to_gfn(gpa), &writable);
1002         if (kvm_is_error_hva(hva)) {
1003                 ret = kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
1004         } else {
1005                 if (!writable)
1006                         cc = 1;         /* Write not permitted ==> read-only */
1007                 kvm_s390_set_psw_cc(vcpu, cc);
1008                 /* Note: CC2 only occurs for storage keys (not supported yet) */
1009         }
1010 out_unlock:
1011         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_DAT)
1012                 ipte_unlock(vcpu);
1013         return ret;
1014 }
1015
1016 int kvm_s390_handle_e5(struct kvm_vcpu *vcpu)
1017 {
1018         /* For e5xx... instructions we only handle TPROT */
1019         if ((vcpu->arch.sie_block->ipa & 0x00ff) == 0x01)
1020                 return handle_tprot(vcpu);
1021         return -EOPNOTSUPP;
1022 }
1023
1024 static int handle_sckpf(struct kvm_vcpu *vcpu)
1025 {
1026         u32 value;
1027
1028         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
1029                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
1030
1031         if (vcpu->run->s.regs.gprs[0] & 0x00000000ffff0000)
1032                 return kvm_s390_inject_program_int(vcpu,
1033                                                    PGM_SPECIFICATION);
1034
1035         value = vcpu->run->s.regs.gprs[0] & 0x000000000000ffff;
1036         vcpu->arch.sie_block->todpr = value;
1037
1038         return 0;
1039 }
1040
1041 static const intercept_handler_t x01_handlers[256] = {
1042         [0x07] = handle_sckpf,
1043 };
1044
1045 int kvm_s390_handle_01(struct kvm_vcpu *vcpu)
1046 {
1047         intercept_handler_t handler;
1048
1049         handler = x01_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
1050         if (handler)
1051                 return handler(vcpu);
1052         return -EOPNOTSUPP;
1053 }