arch/s390/kvm/priv.c

   1 /*
   2  * handling privileged instructions
   3  *
   4  * Copyright IBM Corp. 2008, 2013
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License (version 2 only)
   8  * as published by the Free Software Foundation.
   9  *
  10  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  11  *               Christian Borntraeger <borntraeger@de.ibm.com>
  12  */
  13
  14 #include <linux/kvm.h>
  15 #include <linux/gfp.h>
  16 #include <linux/errno.h>
  17 #include <linux/compat.h>
  18 #include <asm/asm-offsets.h>
  19 #include <asm/facility.h>
  20 #include <asm/current.h>
  21 #include <asm/debug.h>
  22 #include <asm/ebcdic.h>
  23 #include <asm/sysinfo.h>
  24 #include <asm/pgtable.h>
  25 #include <asm/pgalloc.h>
  26 #include <asm/io.h>
  27 #include <asm/ptrace.h>
  28 #include <asm/compat.h>
  29 #include "gaccess.h"
  30 #include "kvm-s390.h"
  31 #include "trace.h"
  32
  33 /* Handle SCK (SET CLOCK) interception */
  34 static int handle_set_clock(struct kvm_vcpu *vcpu)
  35 {
  36         struct kvm_vcpu *cpup;
  37         s64 val;
  38         int i, rc;
  39         ar_t ar;
  40         u64 op2;
  41
  42         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
  43                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
  44
  45         op2 = kvm_s390_get_base_disp_s(vcpu, &ar);
  46         if (op2 & 7)    /* Operand must be on a doubleword boundary */
  47                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
  48         rc = read_guest(vcpu, op2, ar, &val, sizeof(val));
  49         if (rc)
  50                 return kvm_s390_inject_prog_cond(vcpu, rc);
  51
  52         VCPU_EVENT(vcpu, 3, "SCK: setting guest TOD to 0x%llx", val);
  53
  54         mutex_lock(&vcpu->kvm->lock);
  55         preempt_disable();
  56         val = (val - get_tod_clock()) & ~0x3fUL;
  57         kvm_for_each_vcpu(i, cpup, vcpu->kvm)
  58                 cpup->arch.sie_block->epoch = val;
  59         preempt_enable();
  60         mutex_unlock(&vcpu->kvm->lock);
  61
  62         kvm_s390_set_psw_cc(vcpu, 0);
  63         return 0;
  64 }
  65
  66 static int handle_set_prefix(struct kvm_vcpu *vcpu)
  67 {
  68         u64 operand2;
  69         u32 address;
  70         int rc;
  71         ar_t ar;
  72
  73         vcpu->stat.instruction_spx++;
  74
  75         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
  76                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
  77
  78         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
  79
  80         /* must be word boundary */
  81         if (operand2 & 3)
  82                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
  83
  84         /* get the value */
  85         rc = read_guest(vcpu, operand2, ar, &address, sizeof(address));
  86         if (rc)
  87                 return kvm_s390_inject_prog_cond(vcpu, rc);
  88
  89         address &= 0x7fffe000u;
  90
  91         /*
  92          * Make sure the new value is valid memory. We only need to check the
  93          * first page, since address is 8k aligned and memory pieces are always
  94          * at least 1MB aligned and have at least a size of 1MB.
  95          */
  96         if (kvm_is_error_gpa(vcpu->kvm, address))
  97                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
  98
  99         kvm_s390_set_prefix(vcpu, address);
 100         trace_kvm_s390_handle_prefix(vcpu, 1, address);
 101         return 0;
 102 }
 103
 104 static int handle_store_prefix(struct kvm_vcpu *vcpu)
 105 {
 106         u64 operand2;
 107         u32 address;
 108         int rc;
 109         ar_t ar;
 110
 111         vcpu->stat.instruction_stpx++;
 112
 113         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 114                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 115
 116         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 117
 118         /* must be word boundary */
 119         if (operand2 & 3)
 120                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 121
 122         address = kvm_s390_get_prefix(vcpu);
 123
 124         /* get the value */
 125         rc = write_guest(vcpu, operand2, ar, &address, sizeof(address));
 126         if (rc)
 127                 return kvm_s390_inject_prog_cond(vcpu, rc);
 128
 129         VCPU_EVENT(vcpu, 3, "STPX: storing prefix 0x%x into 0x%llx", address, operand2);
 130         trace_kvm_s390_handle_prefix(vcpu, 0, address);
 131         return 0;
 132 }
 133
 134 static int handle_store_cpu_address(struct kvm_vcpu *vcpu)
 135 {
 136         u16 vcpu_id = vcpu->vcpu_id;
 137         u64 ga;
 138         int rc;
 139         ar_t ar;
 140
 141         vcpu->stat.instruction_stap++;
 142
 143         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 144                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 145
 146         ga = kvm_s390_get_base_disp_s(vcpu, &ar);
 147
 148         if (ga & 1)
 149                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 150
 151         rc = write_guest(vcpu, ga, ar, &vcpu_id, sizeof(vcpu_id));
 152         if (rc)
 153                 return kvm_s390_inject_prog_cond(vcpu, rc);
 154
 155         VCPU_EVENT(vcpu, 3, "STAP: storing cpu address (%u) to 0x%llx", vcpu_id, ga);
 156         trace_kvm_s390_handle_stap(vcpu, ga);
 157         return 0;
 158 }
 159
 160 static int __skey_check_enable(struct kvm_vcpu *vcpu)
 161 {
 162         int rc = 0;
 163         if (!(vcpu->arch.sie_block->ictl & (ICTL_ISKE | ICTL_SSKE | ICTL_RRBE)))
 164                 return rc;
 165
 166         rc = s390_enable_skey();
 167         VCPU_EVENT(vcpu, 3, "%s", "enabling storage keys for guest");
 168         trace_kvm_s390_skey_related_inst(vcpu);
 169         vcpu->arch.sie_block->ictl &= ~(ICTL_ISKE | ICTL_SSKE | ICTL_RRBE);
 170         return rc;
 171 }
 172
 173
 174 static int handle_skey(struct kvm_vcpu *vcpu)
 175 {
 176         int rc = __skey_check_enable(vcpu);
 177
 178         if (rc)
 179                 return rc;
 180         vcpu->stat.instruction_storage_key++;
 181
 182         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 183                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 184
 185         kvm_s390_rewind_psw(vcpu, 4);
 186         VCPU_EVENT(vcpu, 4, "%s", "retrying storage key operation");
 187         return 0;
 188 }
 189
 190 static int handle_ipte_interlock(struct kvm_vcpu *vcpu)
 191 {
 192         vcpu->stat.instruction_ipte_interlock++;
 193         if (psw_bits(vcpu->arch.sie_block->gpsw).p)
 194                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 195         wait_event(vcpu->kvm->arch.ipte_wq, !ipte_lock_held(vcpu));
 196         kvm_s390_rewind_psw(vcpu, 4);
 197         VCPU_EVENT(vcpu, 4, "%s", "retrying ipte interlock operation");
 198         return 0;
 199 }
 200
 201 static int handle_test_block(struct kvm_vcpu *vcpu)
 202 {
 203         gpa_t addr;
 204         int reg2;
 205
 206         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 207                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 208
 209         kvm_s390_get_regs_rre(vcpu, NULL, &reg2);
 210         addr = vcpu->run->s.regs.gprs[reg2] & PAGE_MASK;
 211         addr = kvm_s390_logical_to_effective(vcpu, addr);
 212         if (kvm_s390_check_low_addr_prot_real(vcpu, addr))
 213                 return kvm_s390_inject_prog_irq(vcpu, &vcpu->arch.pgm);
 214         addr = kvm_s390_real_to_abs(vcpu, addr);
 215
 216         if (kvm_is_error_gpa(vcpu->kvm, addr))
 217                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 218         /*
 219          * We don't expect errors on modern systems, and do not care
 220          * about storage keys (yet), so let's just clear the page.
 221          */
 222         if (kvm_clear_guest(vcpu->kvm, addr, PAGE_SIZE))
 223                 return -EFAULT;
 224         kvm_s390_set_psw_cc(vcpu, 0);
 225         vcpu->run->s.regs.gprs[0] = 0;
 226         return 0;
 227 }
 228
 229 static int handle_tpi(struct kvm_vcpu *vcpu)
 230 {
 231         struct kvm_s390_interrupt_info *inti;
 232         unsigned long len;
 233         u32 tpi_data[3];
 234         int rc;
 235         u64 addr;
 236         ar_t ar;
 237
 238         addr = kvm_s390_get_base_disp_s(vcpu, &ar);
 239         if (addr & 3)
 240                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 241
 242         inti = kvm_s390_get_io_int(vcpu->kvm, vcpu->arch.sie_block->gcr[6], 0);
 243         if (!inti) {
 244                 kvm_s390_set_psw_cc(vcpu, 0);
 245                 return 0;
 246         }
 247
 248         tpi_data[0] = inti->io.subchannel_id << 16 | inti->io.subchannel_nr;
 249         tpi_data[1] = inti->io.io_int_parm;
 250         tpi_data[2] = inti->io.io_int_word;
 251         if (addr) {
 252                 /*
 253                  * Store the two-word I/O interruption code into the
 254                  * provided area.
 255                  */
 256                 len = sizeof(tpi_data) - 4;
 257                 rc = write_guest(vcpu, addr, ar, &tpi_data, len);
 258                 if (rc) {
 259                         rc = kvm_s390_inject_prog_cond(vcpu, rc);
 260                         goto reinject_interrupt;
 261                 }
 262         } else {
 263                 /*
 264                  * Store the three-word I/O interruption code into
 265                  * the appropriate lowcore area.
 266                  */
 267                 len = sizeof(tpi_data);
 268                 if (write_guest_lc(vcpu, __LC_SUBCHANNEL_ID, &tpi_data, len)) {
 269                         /* failed writes to the low core are not recoverable */
 270                         rc = -EFAULT;
 271                         goto reinject_interrupt;
 272                 }
 273         }
 274
 275         /* irq was successfully handed to the guest */
 276         kfree(inti);
 277         kvm_s390_set_psw_cc(vcpu, 1);
 278         return 0;
 279 reinject_interrupt:
 280         /*
 281          * If we encounter a problem storing the interruption code, the
 282          * instruction is suppressed from the guest's view: reinject the
 283          * interrupt.
 284          */
 285         if (kvm_s390_reinject_io_int(vcpu->kvm, inti)) {
 286                 kfree(inti);
 287                 rc = -EFAULT;
 288         }
 289         /* don't set the cc, a pgm irq was injected or we drop to user space */
 290         return rc ? -EFAULT : 0;
 291 }
 292
 293 static int handle_tsch(struct kvm_vcpu *vcpu)
 294 {
 295         struct kvm_s390_interrupt_info *inti = NULL;
 296         const u64 isc_mask = 0xffUL << 24; /* all iscs set */
 297
 298         /* a valid schid has at least one bit set */
 299         if (vcpu->run->s.regs.gprs[1])
 300                 inti = kvm_s390_get_io_int(vcpu->kvm, isc_mask,
 301                                            vcpu->run->s.regs.gprs[1]);
 302
 303         /*
 304          * Prepare exit to userspace.
 305          * We indicate whether we dequeued a pending I/O interrupt
 306          * so that userspace can re-inject it if the instruction gets
 307          * a program check. While this may re-order the pending I/O
 308          * interrupts, this is no problem since the priority is kept
 309          * intact.
 310          */
 311         vcpu->run->exit_reason = KVM_EXIT_S390_TSCH;
 312         vcpu->run->s390_tsch.dequeued = !!inti;
 313         if (inti) {
 314                 vcpu->run->s390_tsch.subchannel_id = inti->io.subchannel_id;
 315                 vcpu->run->s390_tsch.subchannel_nr = inti->io.subchannel_nr;
 316                 vcpu->run->s390_tsch.io_int_parm = inti->io.io_int_parm;
 317                 vcpu->run->s390_tsch.io_int_word = inti->io.io_int_word;
 318         }
 319         vcpu->run->s390_tsch.ipb = vcpu->arch.sie_block->ipb;
 320         kfree(inti);
 321         return -EREMOTE;
 322 }
 323
 324 static int handle_io_inst(struct kvm_vcpu *vcpu)
 325 {
 326         VCPU_EVENT(vcpu, 4, "%s", "I/O instruction");
 327
 328         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 329                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 330
 331         if (vcpu->kvm->arch.css_support) {
 332                 /*
 333                  * Most I/O instructions will be handled by userspace.
 334                  * Exceptions are tpi and the interrupt portion of tsch.
 335                  */
 336                 if (vcpu->arch.sie_block->ipa == 0xb236)
 337                         return handle_tpi(vcpu);
 338                 if (vcpu->arch.sie_block->ipa == 0xb235)
 339                         return handle_tsch(vcpu);
 340                 /* Handle in userspace. */
 341                 return -EOPNOTSUPP;
 342         } else {
 343                 /*
 344                  * Set condition code 3 to stop the guest from issuing channel
 345                  * I/O instructions.
 346                  */
 347                 kvm_s390_set_psw_cc(vcpu, 3);
 348                 return 0;
 349         }
 350 }
 351
 352 static int handle_stfl(struct kvm_vcpu *vcpu)
 353 {
 354         int rc;
 355         unsigned int fac;
 356
 357         vcpu->stat.instruction_stfl++;
 358
 359         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 360                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 361
 362         /*
 363          * We need to shift the lower 32 facility bits (bit 0-31) from a u64
 364          * into a u32 memory representation. They will remain bits 0-31.
 365          */
 366         fac = *vcpu->kvm->arch.model.fac->list >> 32;
 367         rc = write_guest_lc(vcpu, offsetof(struct _lowcore, stfl_fac_list),
 368                             &fac, sizeof(fac));
 369         if (rc)
 370                 return rc;
 371         VCPU_EVENT(vcpu, 3, "STFL: store facility list 0x%x", fac);
 372         trace_kvm_s390_handle_stfl(vcpu, fac);
 373         return 0;
 374 }
 375
 376 #define PSW_MASK_ADDR_MODE (PSW_MASK_EA | PSW_MASK_BA)
 377 #define PSW_MASK_UNASSIGNED 0xb80800fe7fffffffUL
 378 #define PSW_ADDR_24 0x0000000000ffffffUL
 379 #define PSW_ADDR_31 0x000000007fffffffUL
 380
 381 int is_valid_psw(psw_t *psw)
 382 {
 383         if (psw->mask & PSW_MASK_UNASSIGNED)
 384                 return 0;
 385         if ((psw->mask & PSW_MASK_ADDR_MODE) == PSW_MASK_BA) {
 386                 if (psw->addr & ~PSW_ADDR_31)
 387                         return 0;
 388         }
 389         if (!(psw->mask & PSW_MASK_ADDR_MODE) && (psw->addr & ~PSW_ADDR_24))
 390                 return 0;
 391         if ((psw->mask & PSW_MASK_ADDR_MODE) ==  PSW_MASK_EA)
 392                 return 0;
 393         if (psw->addr & 1)
 394                 return 0;
 395         return 1;
 396 }
 397
 398 int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
 399 {
 400         psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
 401         psw_compat_t new_psw;
 402         u64 addr;
 403         int rc;
 404         ar_t ar;
 405
 406         if (gpsw->mask & PSW_MASK_PSTATE)
 407                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 408
 409         addr = kvm_s390_get_base_disp_s(vcpu, &ar);
 410         if (addr & 7)
 411                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 412
 413         rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw));
 414         if (rc)
 415                 return kvm_s390_inject_prog_cond(vcpu, rc);
 416         if (!(new_psw.mask & PSW32_MASK_BASE))
 417                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 418         gpsw->mask = (new_psw.mask & ~PSW32_MASK_BASE) << 32;
 419         gpsw->mask |= new_psw.addr & PSW32_ADDR_AMODE;
 420         gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
 421         if (!is_valid_psw(gpsw))
 422                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 423         return 0;
 424 }
 425
 426 static int handle_lpswe(struct kvm_vcpu *vcpu)
 427 {
 428         psw_t new_psw;
 429         u64 addr;
 430         int rc;
 431         ar_t ar;
 432
 433         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 434                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 435
 436         addr = kvm_s390_get_base_disp_s(vcpu, &ar);
 437         if (addr & 7)
 438                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 439         rc = read_guest(vcpu, addr, ar, &new_psw, sizeof(new_psw));
 440         if (rc)
 441                 return kvm_s390_inject_prog_cond(vcpu, rc);
 442         vcpu->arch.sie_block->gpsw = new_psw;
 443         if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
 444                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 445         return 0;
 446 }
 447
 448 static int handle_stidp(struct kvm_vcpu *vcpu)
 449 {
 450         u64 stidp_data = vcpu->arch.stidp_data;
 451         u64 operand2;
 452         int rc;
 453         ar_t ar;
 454
 455         vcpu->stat.instruction_stidp++;
 456
 457         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 458                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 459
 460         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 461
 462         if (operand2 & 7)
 463                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 464
 465         rc = write_guest(vcpu, operand2, ar, &stidp_data, sizeof(stidp_data));
 466         if (rc)
 467                 return kvm_s390_inject_prog_cond(vcpu, rc);
 468
 469         VCPU_EVENT(vcpu, 3, "STIDP: store cpu id 0x%llx", stidp_data);
 470         return 0;
 471 }
 472
 473 static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
 474 {
 475         int cpus = 0;
 476         int n;
 477
 478         cpus = atomic_read(&vcpu->kvm->online_vcpus);
 479
 480         /* deal with other level 3 hypervisors */
 481         if (stsi(mem, 3, 2, 2))
 482                 mem->count = 0;
 483         if (mem->count < 8)
 484                 mem->count++;
 485         for (n = mem->count - 1; n > 0 ; n--)
 486                 memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
 487
 488         memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
 489         mem->vm[0].cpus_total = cpus;
 490         mem->vm[0].cpus_configured = cpus;
 491         mem->vm[0].cpus_standby = 0;
 492         mem->vm[0].cpus_reserved = 0;
 493         mem->vm[0].caf = 1000;
 494         memcpy(mem->vm[0].name, "KVMguest", 8);
 495         ASCEBC(mem->vm[0].name, 8);
 496         memcpy(mem->vm[0].cpi, "KVM/Linux       ", 16);
 497         ASCEBC(mem->vm[0].cpi, 16);
 498 }
 499
 500 static void insert_stsi_usr_data(struct kvm_vcpu *vcpu, u64 addr, ar_t ar,
 501                                  u8 fc, u8 sel1, u16 sel2)
 502 {
 503         vcpu->run->exit_reason = KVM_EXIT_S390_STSI;
 504         vcpu->run->s390_stsi.addr = addr;
 505         vcpu->run->s390_stsi.ar = ar;
 506         vcpu->run->s390_stsi.fc = fc;
 507         vcpu->run->s390_stsi.sel1 = sel1;
 508         vcpu->run->s390_stsi.sel2 = sel2;
 509 }
 510
 511 static int handle_stsi(struct kvm_vcpu *vcpu)
 512 {
 513         int fc = (vcpu->run->s.regs.gprs[0] & 0xf0000000) >> 28;
 514         int sel1 = vcpu->run->s.regs.gprs[0] & 0xff;
 515         int sel2 = vcpu->run->s.regs.gprs[1] & 0xffff;
 516         unsigned long mem = 0;
 517         u64 operand2;
 518         int rc = 0;
 519         ar_t ar;
 520
 521         vcpu->stat.instruction_stsi++;
 522         VCPU_EVENT(vcpu, 3, "STSI: fc: %u sel1: %u sel2: %u", fc, sel1, sel2);
 523
 524         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 525                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 526
 527         if (fc > 3) {
 528                 kvm_s390_set_psw_cc(vcpu, 3);
 529                 return 0;
 530         }
 531
 532         if (vcpu->run->s.regs.gprs[0] & 0x0fffff00
 533             || vcpu->run->s.regs.gprs[1] & 0xffff0000)
 534                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 535
 536         if (fc == 0) {
 537                 vcpu->run->s.regs.gprs[0] = 3 << 28;
 538                 kvm_s390_set_psw_cc(vcpu, 0);
 539                 return 0;
 540         }
 541
 542         operand2 = kvm_s390_get_base_disp_s(vcpu, &ar);
 543
 544         if (operand2 & 0xfff)
 545                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 546
 547         switch (fc) {
 548         case 1: /* same handling for 1 and 2 */
 549         case 2:
 550                 mem = get_zeroed_page(GFP_KERNEL);
 551                 if (!mem)
 552                         goto out_no_data;
 553                 if (stsi((void *) mem, fc, sel1, sel2))
 554                         goto out_no_data;
 555                 break;
 556         case 3:
 557                 if (sel1 != 2 || sel2 != 2)
 558                         goto out_no_data;
 559                 mem = get_zeroed_page(GFP_KERNEL);
 560                 if (!mem)
 561                         goto out_no_data;
 562                 handle_stsi_3_2_2(vcpu, (void *) mem);
 563                 break;
 564         }
 565
 566         rc = write_guest(vcpu, operand2, ar, (void *)mem, PAGE_SIZE);
 567         if (rc) {
 568                 rc = kvm_s390_inject_prog_cond(vcpu, rc);
 569                 goto out;
 570         }
 571         if (vcpu->kvm->arch.user_stsi) {
 572                 insert_stsi_usr_data(vcpu, operand2, ar, fc, sel1, sel2);
 573                 rc = -EREMOTE;
 574         }
 575         trace_kvm_s390_handle_stsi(vcpu, fc, sel1, sel2, operand2);
 576         free_page(mem);
 577         kvm_s390_set_psw_cc(vcpu, 0);
 578         vcpu->run->s.regs.gprs[0] = 0;
 579         return rc;
 580 out_no_data:
 581         kvm_s390_set_psw_cc(vcpu, 3);
 582 out:
 583         free_page(mem);
 584         return rc;
 585 }
 586
 587 static const intercept_handler_t b2_handlers[256] = {
 588         [0x02] = handle_stidp,
 589         [0x04] = handle_set_clock,
 590         [0x10] = handle_set_prefix,
 591         [0x11] = handle_store_prefix,
 592         [0x12] = handle_store_cpu_address,
 593         [0x21] = handle_ipte_interlock,
 594         [0x29] = handle_skey,
 595         [0x2a] = handle_skey,
 596         [0x2b] = handle_skey,
 597         [0x2c] = handle_test_block,
 598         [0x30] = handle_io_inst,
 599         [0x31] = handle_io_inst,
 600         [0x32] = handle_io_inst,
 601         [0x33] = handle_io_inst,
 602         [0x34] = handle_io_inst,
 603         [0x35] = handle_io_inst,
 604         [0x36] = handle_io_inst,
 605         [0x37] = handle_io_inst,
 606         [0x38] = handle_io_inst,
 607         [0x39] = handle_io_inst,
 608         [0x3a] = handle_io_inst,
 609         [0x3b] = handle_io_inst,
 610         [0x3c] = handle_io_inst,
 611         [0x50] = handle_ipte_interlock,
 612         [0x5f] = handle_io_inst,
 613         [0x74] = handle_io_inst,
 614         [0x76] = handle_io_inst,
 615         [0x7d] = handle_stsi,
 616         [0xb1] = handle_stfl,
 617         [0xb2] = handle_lpswe,
 618 };
 619
 620 int kvm_s390_handle_b2(struct kvm_vcpu *vcpu)
 621 {
 622         intercept_handler_t handler;
 623
 624         /*
 625          * A lot of B2 instructions are priviledged. Here we check for
 626          * the privileged ones, that we can handle in the kernel.
 627          * Anything else goes to userspace.
 628          */
 629         handler = b2_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
 630         if (handler)
 631                 return handler(vcpu);
 632
 633         return -EOPNOTSUPP;
 634 }
 635
 636 static int handle_epsw(struct kvm_vcpu *vcpu)
 637 {
 638         int reg1, reg2;
 639
 640         kvm_s390_get_regs_rre(vcpu, &reg1, &reg2);
 641
 642         /* This basically extracts the mask half of the psw. */
 643         vcpu->run->s.regs.gprs[reg1] &= 0xffffffff00000000UL;
 644         vcpu->run->s.regs.gprs[reg1] |= vcpu->arch.sie_block->gpsw.mask >> 32;
 645         if (reg2) {
 646                 vcpu->run->s.regs.gprs[reg2] &= 0xffffffff00000000UL;
 647                 vcpu->run->s.regs.gprs[reg2] |=
 648                         vcpu->arch.sie_block->gpsw.mask & 0x00000000ffffffffUL;
 649         }
 650         return 0;
 651 }
 652
 653 #define PFMF_RESERVED   0xfffc0101UL
 654 #define PFMF_SK         0x00020000UL
 655 #define PFMF_CF         0x00010000UL
 656 #define PFMF_UI         0x00008000UL
 657 #define PFMF_FSC        0x00007000UL
 658 #define PFMF_NQ         0x00000800UL
 659 #define PFMF_MR         0x00000400UL
 660 #define PFMF_MC         0x00000200UL
 661 #define PFMF_KEY        0x000000feUL
 662
 663 static int handle_pfmf(struct kvm_vcpu *vcpu)
 664 {
 665         int reg1, reg2;
 666         unsigned long start, end;
 667
 668         vcpu->stat.instruction_pfmf++;
 669
 670         kvm_s390_get_regs_rre(vcpu, &reg1, &reg2);
 671
 672         if (!MACHINE_HAS_PFMF)
 673                 return kvm_s390_inject_program_int(vcpu, PGM_OPERATION);
 674
 675         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 676                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 677
 678         if (vcpu->run->s.regs.gprs[reg1] & PFMF_RESERVED)
 679                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 680
 681         /* Only provide non-quiescing support if the host supports it */
 682         if (vcpu->run->s.regs.gprs[reg1] & PFMF_NQ && !test_facility(14))
 683                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 684
 685         /* No support for conditional-SSKE */
 686         if (vcpu->run->s.regs.gprs[reg1] & (PFMF_MR | PFMF_MC))
 687                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 688
 689         start = vcpu->run->s.regs.gprs[reg2] & PAGE_MASK;
 690         start = kvm_s390_logical_to_effective(vcpu, start);
 691
 692         switch (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) {
 693         case 0x00000000:
 694                 end = (start + (1UL << 12)) & ~((1UL << 12) - 1);
 695                 break;
 696         case 0x00001000:
 697                 end = (start + (1UL << 20)) & ~((1UL << 20) - 1);
 698                 break;
 699         case 0x00002000:
 700                 /* only support 2G frame size if EDAT2 is available and we are
 701                    not in 24-bit addressing mode */
 702                 if (!test_kvm_facility(vcpu->kvm, 78) ||
 703                     psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_AMODE_24BIT)
 704                         return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 705                 end = (start + (1UL << 31)) & ~((1UL << 31) - 1);
 706                 break;
 707         default:
 708                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 709         }
 710
 711         if (vcpu->run->s.regs.gprs[reg1] & PFMF_CF) {
 712                 if (kvm_s390_check_low_addr_prot_real(vcpu, start))
 713                         return kvm_s390_inject_prog_irq(vcpu, &vcpu->arch.pgm);
 714         }
 715
 716         while (start < end) {
 717                 unsigned long useraddr, abs_addr;
 718
 719                 /* Translate guest address to host address */
 720                 if ((vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) == 0)
 721                         abs_addr = kvm_s390_real_to_abs(vcpu, start);
 722                 else
 723                         abs_addr = start;
 724                 useraddr = gfn_to_hva(vcpu->kvm, gpa_to_gfn(abs_addr));
 725                 if (kvm_is_error_hva(useraddr))
 726                         return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 727
 728                 if (vcpu->run->s.regs.gprs[reg1] & PFMF_CF) {
 729                         if (clear_user((void __user *)useraddr, PAGE_SIZE))
 730                                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 731                 }
 732
 733                 if (vcpu->run->s.regs.gprs[reg1] & PFMF_SK) {
 734                         int rc = __skey_check_enable(vcpu);
 735
 736                         if (rc)
 737                                 return rc;
 738                         if (set_guest_storage_key(current->mm, useraddr,
 739                                         vcpu->run->s.regs.gprs[reg1] & PFMF_KEY,
 740                                         vcpu->run->s.regs.gprs[reg1] & PFMF_NQ))
 741                                 return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 742                 }
 743
 744                 start += PAGE_SIZE;
 745         }
 746         if (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC)
 747                 vcpu->run->s.regs.gprs[reg2] = end;
 748         return 0;
 749 }
 750
 751 static int handle_essa(struct kvm_vcpu *vcpu)
 752 {
 753         /* entries expected to be 1FF */
 754         int entries = (vcpu->arch.sie_block->cbrlo & ~PAGE_MASK) >> 3;
 755         unsigned long *cbrlo, cbrle;
 756         struct gmap *gmap;
 757         int i;
 758
 759         VCPU_EVENT(vcpu, 4, "ESSA: release %d pages", entries);
 760         gmap = vcpu->arch.gmap;
 761         vcpu->stat.instruction_essa++;
 762         if (!vcpu->kvm->arch.use_cmma)
 763                 return kvm_s390_inject_program_int(vcpu, PGM_OPERATION);
 764
 765         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 766                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 767
 768         if (((vcpu->arch.sie_block->ipb & 0xf0000000) >> 28) > 6)
 769                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 770
 771         /* Rewind PSW to repeat the ESSA instruction */
 772         kvm_s390_rewind_psw(vcpu, 4);
 773         vcpu->arch.sie_block->cbrlo &= PAGE_MASK;       /* reset nceo */
 774         cbrlo = phys_to_virt(vcpu->arch.sie_block->cbrlo);
 775         down_read(&gmap->mm->mmap_sem);
 776         for (i = 0; i < entries; ++i) {
 777                 cbrle = cbrlo[i];
 778                 if (unlikely(cbrle & ~PAGE_MASK || cbrle < 2 * PAGE_SIZE))
 779                         /* invalid entry */
 780                         break;
 781                 /* try to free backing */
 782                 __gmap_zap(gmap, cbrle);
 783         }
 784         up_read(&gmap->mm->mmap_sem);
 785         if (i < entries)
 786                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 787         return 0;
 788 }
 789
 790 static const intercept_handler_t b9_handlers[256] = {
 791         [0x8a] = handle_ipte_interlock,
 792         [0x8d] = handle_epsw,
 793         [0x8e] = handle_ipte_interlock,
 794         [0x8f] = handle_ipte_interlock,
 795         [0xab] = handle_essa,
 796         [0xaf] = handle_pfmf,
 797 };
 798
 799 int kvm_s390_handle_b9(struct kvm_vcpu *vcpu)
 800 {
 801         intercept_handler_t handler;
 802
 803         /* This is handled just as for the B2 instructions. */
 804         handler = b9_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
 805         if (handler)
 806                 return handler(vcpu);
 807
 808         return -EOPNOTSUPP;
 809 }
 810
 811 int kvm_s390_handle_lctl(struct kvm_vcpu *vcpu)
 812 {
 813         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 814         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 815         int reg, rc, nr_regs;
 816         u32 ctl_array[16];
 817         u64 ga;
 818         ar_t ar;
 819
 820         vcpu->stat.instruction_lctl++;
 821
 822         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 823                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 824
 825         ga = kvm_s390_get_base_disp_rs(vcpu, &ar);
 826
 827         if (ga & 3)
 828                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 829
 830         VCPU_EVENT(vcpu, 4, "LCTL: r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 831         trace_kvm_s390_handle_lctl(vcpu, 0, reg1, reg3, ga);
 832
 833         nr_regs = ((reg3 - reg1) & 0xf) + 1;
 834         rc = read_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u32));
 835         if (rc)
 836                 return kvm_s390_inject_prog_cond(vcpu, rc);
 837         reg = reg1;
 838         nr_regs = 0;
 839         do {
 840                 vcpu->arch.sie_block->gcr[reg] &= 0xffffffff00000000ul;
 841                 vcpu->arch.sie_block->gcr[reg] |= ctl_array[nr_regs++];
 842                 if (reg == reg3)
 843                         break;
 844                 reg = (reg + 1) % 16;
 845         } while (1);
 846         kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 847         return 0;
 848 }
 849
 850 int kvm_s390_handle_stctl(struct kvm_vcpu *vcpu)
 851 {
 852         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 853         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 854         int reg, rc, nr_regs;
 855         u32 ctl_array[16];
 856         u64 ga;
 857         ar_t ar;
 858
 859         vcpu->stat.instruction_stctl++;
 860
 861         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 862                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 863
 864         ga = kvm_s390_get_base_disp_rs(vcpu, &ar);
 865
 866         if (ga & 3)
 867                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 868
 869         VCPU_EVENT(vcpu, 4, "STCTL r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 870         trace_kvm_s390_handle_stctl(vcpu, 0, reg1, reg3, ga);
 871
 872         reg = reg1;
 873         nr_regs = 0;
 874         do {
 875                 ctl_array[nr_regs++] = vcpu->arch.sie_block->gcr[reg];
 876                 if (reg == reg3)
 877                         break;
 878                 reg = (reg + 1) % 16;
 879         } while (1);
 880         rc = write_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u32));
 881         return rc ? kvm_s390_inject_prog_cond(vcpu, rc) : 0;
 882 }
 883
 884 static int handle_lctlg(struct kvm_vcpu *vcpu)
 885 {
 886         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 887         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 888         int reg, rc, nr_regs;
 889         u64 ctl_array[16];
 890         u64 ga;
 891         ar_t ar;
 892
 893         vcpu->stat.instruction_lctlg++;
 894
 895         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 896                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 897
 898         ga = kvm_s390_get_base_disp_rsy(vcpu, &ar);
 899
 900         if (ga & 7)
 901                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 902
 903         VCPU_EVENT(vcpu, 4, "LCTLG: r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 904         trace_kvm_s390_handle_lctl(vcpu, 1, reg1, reg3, ga);
 905
 906         nr_regs = ((reg3 - reg1) & 0xf) + 1;
 907         rc = read_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u64));
 908         if (rc)
 909                 return kvm_s390_inject_prog_cond(vcpu, rc);
 910         reg = reg1;
 911         nr_regs = 0;
 912         do {
 913                 vcpu->arch.sie_block->gcr[reg] = ctl_array[nr_regs++];
 914                 if (reg == reg3)
 915                         break;
 916                 reg = (reg + 1) % 16;
 917         } while (1);
 918         kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 919         return 0;
 920 }
 921
 922 static int handle_stctg(struct kvm_vcpu *vcpu)
 923 {
 924         int reg1 = (vcpu->arch.sie_block->ipa & 0x00f0) >> 4;
 925         int reg3 = vcpu->arch.sie_block->ipa & 0x000f;
 926         int reg, rc, nr_regs;
 927         u64 ctl_array[16];
 928         u64 ga;
 929         ar_t ar;
 930
 931         vcpu->stat.instruction_stctg++;
 932
 933         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 934                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 935
 936         ga = kvm_s390_get_base_disp_rsy(vcpu, &ar);
 937
 938         if (ga & 7)
 939                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 940
 941         VCPU_EVENT(vcpu, 4, "STCTG r1:%d, r3:%d, addr: 0x%llx", reg1, reg3, ga);
 942         trace_kvm_s390_handle_stctl(vcpu, 1, reg1, reg3, ga);
 943
 944         reg = reg1;
 945         nr_regs = 0;
 946         do {
 947                 ctl_array[nr_regs++] = vcpu->arch.sie_block->gcr[reg];
 948                 if (reg == reg3)
 949                         break;
 950                 reg = (reg + 1) % 16;
 951         } while (1);
 952         rc = write_guest(vcpu, ga, ar, ctl_array, nr_regs * sizeof(u64));
 953         return rc ? kvm_s390_inject_prog_cond(vcpu, rc) : 0;
 954 }
 955
 956 static const intercept_handler_t eb_handlers[256] = {
 957         [0x2f] = handle_lctlg,
 958         [0x25] = handle_stctg,
 959 };
 960
 961 int kvm_s390_handle_eb(struct kvm_vcpu *vcpu)
 962 {
 963         intercept_handler_t handler;
 964
 965         handler = eb_handlers[vcpu->arch.sie_block->ipb & 0xff];
 966         if (handler)
 967                 return handler(vcpu);
 968         return -EOPNOTSUPP;
 969 }
 970
 971 static int handle_tprot(struct kvm_vcpu *vcpu)
 972 {
 973         u64 address1, address2;
 974         unsigned long hva, gpa;
 975         int ret = 0, cc = 0;
 976         bool writable;
 977         ar_t ar;
 978
 979         vcpu->stat.instruction_tprot++;
 980
 981         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 982                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 983
 984         kvm_s390_get_base_disp_sse(vcpu, &address1, &address2, &ar, NULL);
 985
 986         /* we only handle the Linux memory detection case:
 987          * access key == 0
 988          * everything else goes to userspace. */
 989         if (address2 & 0xf0)
 990                 return -EOPNOTSUPP;
 991         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_DAT)
 992                 ipte_lock(vcpu);
 993         ret = guest_translate_address(vcpu, address1, ar, &gpa, 1);
 994         if (ret == PGM_PROTECTION) {
 995                 /* Write protected? Try again with read-only... */
 996                 cc = 1;
 997                 ret = guest_translate_address(vcpu, address1, ar, &gpa, 0);
 998         }
 999         if (ret) {
1000                 if (ret == PGM_ADDRESSING || ret == PGM_TRANSLATION_SPEC) {
1001                         ret = kvm_s390_inject_program_int(vcpu, ret);
1002                 } else if (ret > 0) {
1003                         /* Translation not available */
1004                         kvm_s390_set_psw_cc(vcpu, 3);
1005                         ret = 0;
1006                 }
1007                 goto out_unlock;
1008         }
1009
1010         hva = gfn_to_hva_prot(vcpu->kvm, gpa_to_gfn(gpa), &writable);
1011         if (kvm_is_error_hva(hva)) {
1012                 ret = kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
1013         } else {
1014                 if (!writable)
1015                         cc = 1;         /* Write not permitted ==> read-only */
1016                 kvm_s390_set_psw_cc(vcpu, cc);
1017                 /* Note: CC2 only occurs for storage keys (not supported yet) */
1018         }
1019 out_unlock:
1020         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_DAT)
1021                 ipte_unlock(vcpu);
1022         return ret;
1023 }
1024
1025 int kvm_s390_handle_e5(struct kvm_vcpu *vcpu)
1026 {
1027         /* For e5xx... instructions we only handle TPROT */
1028         if ((vcpu->arch.sie_block->ipa & 0x00ff) == 0x01)
1029                 return handle_tprot(vcpu);
1030         return -EOPNOTSUPP;
1031 }
1032
1033 static int handle_sckpf(struct kvm_vcpu *vcpu)
1034 {
1035         u32 value;
1036
1037         if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
1038                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
1039
1040         if (vcpu->run->s.regs.gprs[0] & 0x00000000ffff0000)
1041                 return kvm_s390_inject_program_int(vcpu,
1042                                                    PGM_SPECIFICATION);
1043
1044         value = vcpu->run->s.regs.gprs[0] & 0x000000000000ffff;
1045         vcpu->arch.sie_block->todpr = value;
1046
1047         return 0;
1048 }
1049
1050 static const intercept_handler_t x01_handlers[256] = {
1051         [0x07] = handle_sckpf,
1052 };
1053
1054 int kvm_s390_handle_01(struct kvm_vcpu *vcpu)
1055 {
1056         intercept_handler_t handler;
1057
1058         handler = x01_handlers[vcpu->arch.sie_block->ipa & 0x00ff];
1059         if (handler)
1060                 return handler(vcpu);
1061         return -EOPNOTSUPP;
1062 }