vgic.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (C) 2015, 2016 ARM Ltd.
 */

#include <linux/interrupt.h>
#include <linux/irq.h>
#include <linux/kvm.h>
#include <linux/kvm_host.h>
#include <linux/list_sort.h>
#include <linux/nospec.h>

#include <asm/kvm_hyp.h>

#include "vgic.h"

#define CREATE_TRACE_POINTS
#include "trace.h"

struct vgic_global kvm_vgic_global_state __ro_after_init = {
	.gicv3_cpuif = STATIC_KEY_FALSE_INIT,
};

/*
 * Locking order is always:
 * kvm->lock (mutex)
 *   vcpu->mutex (mutex)
 *     kvm->arch.config_lock (mutex)
 *       its->cmd_lock (mutex)
 *         its->its_lock (mutex)
 *           vgic_dist->lpi_xa.xa_lock		must be taken with IRQs disabled
 *             vgic_cpu->ap_list_lock		must be taken with IRQs disabled
 *               vgic_irq->irq_lock		must be taken with IRQs disabled
 *
 * As the ap_list_lock might be taken from the timer interrupt handler,
 * we have to disable IRQs before taking this lock and everything lower
 * than it.
 *
 * The config_lock has additional ordering requirements:
 * kvm->slots_lock
 *   kvm->srcu
 *     kvm->arch.config_lock
 *
 * If you need to take multiple locks, always take the upper lock first,
 * then the lower ones, e.g. first take the its_lock, then the irq_lock.
 * If you are already holding a lock and need to take a higher one, you
 * have to drop the lower ranking lock first and re-acquire it after having
 * taken the upper one.
 *
 * When taking more than one ap_list_lock at the same time, always take the
 * lowest numbered VCPU's ap_list_lock first, so:
 *   vcpuX->vcpu_id < vcpuY->vcpu_id:
 *     raw_spin_lock(vcpuX->arch.vgic_cpu.ap_list_lock);
 *     raw_spin_lock(vcpuY->arch.vgic_cpu.ap_list_lock);
 *
 * Since the VGIC must support injecting virtual interrupts from ISRs, we have
 * to use the raw_spin_lock_irqsave/raw_spin_unlock_irqrestore versions of outer
 * spinlocks for any lock that may be taken while injecting an interrupt.
 */

/*
 * Index the VM's xarray of mapped LPIs and return a reference to the IRQ
 * structure. The caller is expected to call vgic_put_irq() later once it's
 * finished with the IRQ.
 */
static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid)
{
	struct vgic_dist *dist = &kvm->arch.vgic;
	struct vgic_irq *irq = NULL;

	rcu_read_lock();

	irq = xa_load(&dist->lpi_xa, intid);
	if (!vgic_try_get_irq_ref(irq))
		irq = NULL;

	rcu_read_unlock();

	return irq;
}

/*
 * This looks up the virtual interrupt ID to get the corresponding
 * struct vgic_irq. It also increases the refcount, so any caller is expected
 * to call vgic_put_irq() once it's finished with this IRQ.
 */
struct vgic_irq *vgic_get_irq(struct kvm *kvm, u32 intid)
{
	/* SPIs */
	if (intid >= VGIC_NR_PRIVATE_IRQS &&
	    intid < (kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)) {
		intid = array_index_nospec(intid, kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS);
		return &kvm->arch.vgic.spis[intid - VGIC_NR_PRIVATE_IRQS];
	}

	/* LPIs */
	if (intid >= VGIC_MIN_LPI)
		return vgic_get_lpi(kvm, intid);

	return NULL;
}

struct vgic_irq *vgic_get_vcpu_irq(struct kvm_vcpu *vcpu, u32 intid)
{
	if (WARN_ON(!vcpu))
		return NULL;

	/* SGIs and PPIs */
	if (intid < VGIC_NR_PRIVATE_IRQS) {
		intid = array_index_nospec(intid, VGIC_NR_PRIVATE_IRQS);
		return &vcpu->arch.vgic_cpu.private_irqs[intid];
	}

	return vgic_get_irq(vcpu->kvm, intid);
}

static void vgic_release_lpi_locked(struct vgic_dist *dist, struct vgic_irq *irq)
{
	lockdep_assert_held(&dist->lpi_xa.xa_lock);
	__xa_erase(&dist->lpi_xa, irq->intid);
	kfree_rcu(irq, rcu);
}

static __must_check bool __vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
{
	if (irq->intid < VGIC_MIN_LPI)
		return false;

	return refcount_dec_and_test(&irq->refcount);
}

static __must_check bool vgic_put_irq_norelease(struct kvm *kvm, struct vgic_irq *irq)
{
	if (!__vgic_put_irq(kvm, irq))
		return false;

	irq->pending_release = true;
	return true;
}

void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
{
	struct vgic_dist *dist = &kvm->arch.vgic;
	unsigned long flags;

	/*
	 * Normally the lock is only taken when the refcount drops to 0.
	 * Acquire/release it early on lockdep kernels to make locking issues
	 * in rare release paths a bit more obvious.
	 */
	if (IS_ENABLED(CONFIG_LOCKDEP) && irq->intid >= VGIC_MIN_LPI) {
		guard(spinlock_irqsave)(&dist->lpi_xa.xa_lock);
	}

	if (!__vgic_put_irq(kvm, irq))
		return;

	xa_lock_irqsave(&dist->lpi_xa, flags);
	vgic_release_lpi_locked(dist, irq);
	xa_unlock_irqrestore(&dist->lpi_xa, flags);
}

static void vgic_release_deleted_lpis(struct kvm *kvm)
{
	struct vgic_dist *dist = &kvm->arch.vgic;
	unsigned long flags, intid;
	struct vgic_irq *irq;

	xa_lock_irqsave(&dist->lpi_xa, flags);

	xa_for_each(&dist->lpi_xa, intid, irq) {
		if (irq->pending_release)
			vgic_release_lpi_locked(dist, irq);
	}

	xa_unlock_irqrestore(&dist->lpi_xa, flags);
}

void vgic_flush_pending_lpis(struct kvm_vcpu *vcpu)
{
	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
	struct vgic_irq *irq, *tmp;
	bool deleted = false;
	unsigned long flags;

	raw_spin_lock_irqsave(&vgic_cpu->ap_list_lock, flags);

	list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) {
		if (irq->intid >= VGIC_MIN_LPI) {
			raw_spin_lock(&irq->irq_lock);
			list_del(&irq->ap_list);
			irq->vcpu = NULL;
			raw_spin_unlock(&irq->irq_lock);
			deleted |= vgic_put_irq_norelease(vcpu->kvm, irq);
		}
	}

	raw_spin_unlock_irqrestore(&vgic_cpu->ap_list_lock, flags);

	if (deleted)
		vgic_release_deleted_lpis(vcpu->kvm);
}

void vgic_irq_set_phys_pending(struct vgic_irq *irq, bool pending)
{
	WARN_ON(irq_set_irqchip_state(irq->host_irq,
				      IRQCHIP_STATE_PENDING,
				      pending));
}

bool vgic_get_phys_line_level(struct vgic_irq *irq)
{
	bool line_level;

	BUG_ON(!irq->hw);

	if (irq->ops && irq->ops->get_input_level)
		return irq->ops->get_input_level(irq->intid);

	WARN_ON(irq_get_irqchip_state(irq->host_irq,
				      IRQCHIP_STATE_PENDING,
				      &line_level));
	return line_level;
}

/* Set/Clear the physical active state */
void vgic_irq_set_phys_active(struct vgic_irq *irq, bool active)
{

	BUG_ON(!irq->hw);
	WARN_ON(irq_set_irqchip_state(irq->host_irq,
				      IRQCHIP_STATE_ACTIVE,
				      active));
}

/**
 * vgic_target_oracle - compute the target vcpu for an irq
 *
 * @irq:	The irq to route. Must be already locked.
 *
 * Based on the current state of the interrupt (enabled, pending,
 * active, vcpu and target_vcpu), compute the next vcpu this should be
 * given to. Return NULL if this shouldn't be injected at all.
 *
 * Requires the IRQ lock to be held.
 */
struct kvm_vcpu *vgic_target_oracle(struct vgic_irq *irq)
{
	lockdep_assert_held(&irq->irq_lock);

	/* If the interrupt is active, it must stay on the current vcpu */
	if (irq->active)
		return irq->vcpu ? : irq->target_vcpu;

	/*
	 * If the IRQ is not active but enabled and pending, we should direct
	 * it to its configured target VCPU.
	 * If the distributor is disabled, pending interrupts shouldn't be
	 * forwarded.
	 */
	if (irq->enabled && irq_is_pending(irq)) {
		if (unlikely(irq->target_vcpu &&
			     !irq->target_vcpu->kvm->arch.vgic.enabled))
			return NULL;

		return irq->target_vcpu;
	}

	/* If neither active nor pending and enabled, then this IRQ should not
	 * be queued to any VCPU.
	 */
	return NULL;
}

struct vgic_sort_info {
	struct kvm_vcpu *vcpu;
	struct vgic_vmcr vmcr;
};

/*
 * The order of items in the ap_lists defines how we'll pack things in LRs as
 * well, the first items in the list being the first things populated in the
 * LRs.
 *
 * Pending, non-active interrupts must be placed at the head of the list.
 * Otherwise things should be sorted by the priority field and the GIC
 * hardware support will take care of preemption of priority groups etc.
 * Interrupts that are not deliverable should be at the end of the list.
 *
 * Return negative if "a" sorts before "b", 0 to preserve order, and positive
 * to sort "b" before "a".
 */
static int vgic_irq_cmp(void *priv, const struct list_head *a,
			const struct list_head *b)
{
	struct vgic_irq *irqa = container_of(a, struct vgic_irq, ap_list);
	struct vgic_irq *irqb = container_of(b, struct vgic_irq, ap_list);
	struct vgic_sort_info *info = priv;
	struct kvm_vcpu *vcpu = info->vcpu;
	bool penda, pendb;
	int ret;

	/*
	 * list_sort may call this function with the same element when
	 * the list is fairly long.
	 */
	if (unlikely(irqa == irqb))
		return 0;

	raw_spin_lock(&irqa->irq_lock);
	raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);

	/* Undeliverable interrupts should be last */
	ret = (int)(vgic_target_oracle(irqb) == vcpu) - (int)(vgic_target_oracle(irqa) == vcpu);
	if (ret)
		goto out;

	/* Same thing for interrupts targeting a disabled group */
	ret =  (int)(irqb->group ? info->vmcr.grpen1 : info->vmcr.grpen0);
	ret -= (int)(irqa->group ? info->vmcr.grpen1 : info->vmcr.grpen0);
	if (ret)
		goto out;

	penda = irqa->enabled && irq_is_pending(irqa) && !irqa->active;
	pendb = irqb->enabled && irq_is_pending(irqb) && !irqb->active;

	ret = (int)pendb - (int)penda;
	if (ret)
		goto out;

	/* Both pending and enabled, sort by priority (lower number first) */
	ret = (int)irqa->priority - (int)irqb->priority;
	if (ret)
		goto out;

	/* Finally, HW bit active interrupts have priority over non-HW ones */
	ret = (int)irqb->hw - (int)irqa->hw;

out:
	raw_spin_unlock(&irqb->irq_lock);
	raw_spin_unlock(&irqa->irq_lock);
	return ret;
}

/* Must be called with the ap_list_lock held */
static void vgic_sort_ap_list(struct kvm_vcpu *vcpu)
{
	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
	struct vgic_sort_info info = { .vcpu = vcpu, };

	lockdep_assert_held(&vgic_cpu->ap_list_lock);

	vgic_get_vmcr(vcpu, &info.vmcr);
	list_sort(&info, &vgic_cpu->ap_list_head, vgic_irq_cmp);
}

/*
 * Only valid injection if changing level for level-triggered IRQs or for a
 * rising edge, and in-kernel connected IRQ lines can only be controlled by
 * their owner.
 */
static bool vgic_validate_injection(struct vgic_irq *irq, bool level, void *owner)
{
	if (irq->owner != owner)
		return false;

	switch (irq->config) {
	case VGIC_CONFIG_LEVEL:
		return irq->line_level != level;
	case VGIC_CONFIG_EDGE:
		return level;
	}

	return false;
}

static bool vgic_model_needs_bcst_kick(struct kvm *kvm)
{
	/*
	 * A GICv3 (or GICv3-like) system exposing a GICv3 to the guest
	 * needs a broadcast kick to set TDIR globally.
	 *
	 * For systems that do not have TDIR (ARM's own v8.0 CPUs), the
	 * shadow TDIR bit is always set, and so is the register's TC bit,
	 * so no need to kick the CPUs.
	 */
	return (cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR) &&
		kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3);
}

/*
 * Check whether an IRQ needs to (and can) be queued to a VCPU's ap list.
 * Do the queuing if necessary, taking the right locks in the right order.
 * Returns true when the IRQ was queued, false otherwise.
 *
 * Needs to be entered with the IRQ lock already held, but will return
 * with all locks dropped.
 */
bool vgic_queue_irq_unlock(struct kvm *kvm, struct vgic_irq *irq,
			   unsigned long flags) __releases(&irq->irq_lock)
{
	struct kvm_vcpu *vcpu;
	bool bcast;

	lockdep_assert_held(&irq->irq_lock);

retry:
	vcpu = vgic_target_oracle(irq);
	if (irq->vcpu || !vcpu) {
		/*
		 * If this IRQ is already on a VCPU's ap_list, then it
		 * cannot be moved or modified and there is no more work for
		 * us to do.
		 *
		 * Otherwise, if the irq is not pending and enabled, it does
		 * not need to be inserted into an ap_list and there is also
		 * no more work for us to do.
		 */
		raw_spin_unlock_irqrestore(&irq->irq_lock, flags);

		/*
		 * We have to kick the VCPU here, because we could be
		 * queueing an edge-triggered interrupt for which we
		 * get no EOI maintenance interrupt. In that case,
		 * while the IRQ is already on the VCPU's AP list, the
		 * VCPU could have EOI'ed the original interrupt and
		 * won't see this one until it exits for some other
		 * reason.
		 */
		if (vcpu) {
			kvm_make_request(KVM_REQ_IRQ_PENDING, vcpu);
			kvm_vcpu_kick(vcpu);
		}
		return false;
	}

	/*
	 * We must unlock the irq lock to take the ap_list_lock where
	 * we are going to insert this new pending interrupt.
	 */
	raw_spin_unlock_irqrestore(&irq->irq_lock, flags);

	/* someone can do stuff here, which we re-check below */

	raw_spin_lock_irqsave(&vcpu->arch.vgic_cpu.ap_list_lock, flags);
	raw_spin_lock(&irq->irq_lock);

	/*
	 * Did something change behind our backs?
	 *
	 * There are two cases:
	 * 1) The irq lost its pending state or was disabled behind our
	 *    backs and/or it was queued to another VCPU's ap_list.
	 * 2) Someone changed the affinity on this irq behind our
	 *    backs and we are now holding the wrong ap_list_lock.
	 *
	 * In both cases, drop the locks and retry.
	 */

	if (unlikely(irq->vcpu || vcpu != vgic_target_oracle(irq))) {
		raw_spin_unlock(&irq->irq_lock);
		raw_spin_unlock_irqrestore(&vcpu->arch.vgic_cpu.ap_list_lock,
					   flags);

		raw_spin_lock_irqsave(&irq->irq_lock, flags);
		goto retry;
	}

	/*
	 * Grab a reference to the irq to reflect the fact that it is
	 * now in the ap_list. This is safe as the caller must already hold a
	 * reference on the irq.
	 */
	vgic_get_irq_ref(irq);
	list_add_tail(&irq->ap_list, &vcpu->arch.vgic_cpu.ap_list_head);
	irq->vcpu = vcpu;

	/* A new SPI may result in deactivation trapping on all vcpus */
	bcast = (vgic_model_needs_bcst_kick(vcpu->kvm) &&
		 vgic_valid_spi(vcpu->kvm, irq->intid) &&
		 atomic_fetch_inc(&vcpu->kvm->arch.vgic.active_spis) == 0);

	raw_spin_unlock(&irq->irq_lock);
	raw_spin_unlock_irqrestore(&vcpu->arch.vgic_cpu.ap_list_lock, flags);

	if (!bcast) {
		kvm_make_request(KVM_REQ_IRQ_PENDING, vcpu);
		kvm_vcpu_kick(vcpu);
	} else {
		kvm_make_all_cpus_request(vcpu->kvm, KVM_REQ_IRQ_PENDING);
	}

	return true;
}

/**
 * kvm_vgic_inject_irq - Inject an IRQ from a device to the vgic
 * @kvm:     The VM structure pointer
 * @vcpu:    The CPU for PPIs or NULL for global interrupts
 * @intid:   The INTID to inject a new state to.
 * @level:   Edge-triggered:  true:  to trigger the interrupt
 *			      false: to ignore the call
 *	     Level-sensitive  true:  raise the input signal
 *			      false: lower the input signal
 * @owner:   The opaque pointer to the owner of the IRQ being raised to verify
 *           that the caller is allowed to inject this IRQ.  Userspace
 *           injections will have owner == NULL.
 *
 * The VGIC is not concerned with devices being active-LOW or active-HIGH for
 * level-sensitive interrupts.  You can think of the level parameter as 1
 * being HIGH and 0 being LOW and all devices being active-HIGH.
 */
int kvm_vgic_inject_irq(struct kvm *kvm, struct kvm_vcpu *vcpu,
			unsigned int intid, bool level, void *owner)
{
	struct vgic_irq *irq;
	unsigned long flags;
	int ret;

	ret = vgic_lazy_init(kvm);
	if (ret)
		return ret;

	if (!vcpu && intid < VGIC_NR_PRIVATE_IRQS)
		return -EINVAL;

	trace_vgic_update_irq_pending(vcpu ? vcpu->vcpu_idx : 0, intid, level);

	if (intid < VGIC_NR_PRIVATE_IRQS)
		irq = vgic_get_vcpu_irq(vcpu, intid);
	else
		irq = vgic_get_irq(kvm, intid);
	if (!irq)
		return -EINVAL;

	raw_spin_lock_irqsave(&irq->irq_lock, flags);

	if (!vgic_validate_injection(irq, level, owner)) {
		/* Nothing to see here, move along... */
		raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
		vgic_put_irq(kvm, irq);
		return 0;
	}

	if (irq->config == VGIC_CONFIG_LEVEL)
		irq->line_level = level;
	else
		irq->pending_latch = true;

	vgic_queue_irq_unlock(kvm, irq, flags);
	vgic_put_irq(kvm, irq);

	return 0;
}

/* @irq->irq_lock must be held */
static int kvm_vgic_map_irq(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
			    unsigned int host_irq,
			    struct irq_ops *ops)
{
	struct irq_desc *desc;
	struct irq_data *data;

	/*
	 * Find the physical IRQ number corresponding to @host_irq
	 */
	desc = irq_to_desc(host_irq);
	if (!desc) {
		kvm_err("%s: no interrupt descriptor\n", __func__);
		return -EINVAL;
	}
	data = irq_desc_get_irq_data(desc);
	while (data->parent_data)
		data = data->parent_data;

	irq->hw = true;
	irq->host_irq = host_irq;
	irq->hwintid = data->hwirq;
	irq->ops = ops;
	return 0;
}

/* @irq->irq_lock must be held */
static inline void kvm_vgic_unmap_irq(struct vgic_irq *irq)
{
	irq->hw = false;
	irq->hwintid = 0;
	irq->ops = NULL;
}

int kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu, unsigned int host_irq,
			  u32 vintid, struct irq_ops *ops)
{
	struct vgic_irq *irq = vgic_get_vcpu_irq(vcpu, vintid);
	unsigned long flags;
	int ret;

	BUG_ON(!irq);

	raw_spin_lock_irqsave(&irq->irq_lock, flags);
	ret = kvm_vgic_map_irq(vcpu, irq, host_irq, ops);
	raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
	vgic_put_irq(vcpu->kvm, irq);

	return ret;
}

/**
 * kvm_vgic_reset_mapped_irq - Reset a mapped IRQ
 * @vcpu: The VCPU pointer
 * @vintid: The INTID of the interrupt
 *
 * Reset the active and pending states of a mapped interrupt.  Kernel
 * subsystems injecting mapped interrupts should reset their interrupt lines
 * when we are doing a reset of the VM.
 */
void kvm_vgic_reset_mapped_irq(struct kvm_vcpu *vcpu, u32 vintid)
{
	struct vgic_irq *irq = vgic_get_vcpu_irq(vcpu, vintid);
	unsigned long flags;

	if (!irq->hw)
		goto out;

	raw_spin_lock_irqsave(&irq->irq_lock, flags);
	irq->active = false;
	irq->pending_latch = false;
	irq->line_level = false;
	raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
out:
	vgic_put_irq(vcpu->kvm, irq);
}

int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, unsigned int vintid)
{
	struct vgic_irq *irq;
	unsigned long flags;

	if (!vgic_initialized(vcpu->kvm))
		return -EAGAIN;

	irq = vgic_get_vcpu_irq(vcpu, vintid);
	BUG_ON(!irq);

	raw_spin_lock_irqsave(&irq->irq_lock, flags);
	kvm_vgic_unmap_irq(irq);
	raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
	vgic_put_irq(vcpu->kvm, irq);

	return 0;
}

int kvm_vgic_get_map(struct kvm_vcpu *vcpu, unsigned int vintid)
{
	struct vgic_irq *irq = vgic_get_vcpu_irq(vcpu, vintid);
	unsigned long flags;
	int ret = -1;

	raw_spin_lock_irqsave(&irq->irq_lock, flags);
	if (irq->hw)
		ret = irq->hwintid;
	raw_spin_unlock_irqrestore(&irq->irq_lock, flags);

	vgic_put_irq(vcpu->kvm, irq);
	return ret;
}

/**
 * kvm_vgic_set_owner - Set the owner of an interrupt for a VM
 *
 * @vcpu:   Pointer to the VCPU (used for PPIs)
 * @intid:  The virtual INTID identifying the interrupt (PPI or SPI)
 * @owner:  Opaque pointer to the owner
 *
 * Returns 0 if intid is not already used by another in-kernel device and the
 * owner is set, otherwise returns an error code.
 */
int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner)
{
	struct vgic_irq *irq;
	unsigned long flags;
	int ret = 0;

	if (!vgic_initialized(vcpu->kvm))
		return -EAGAIN;

	/* SGIs and LPIs cannot be wired up to any device */
	if (!irq_is_ppi(intid) && !vgic_valid_spi(vcpu->kvm, intid))
		return -EINVAL;

	irq = vgic_get_vcpu_irq(vcpu, intid);
	raw_spin_lock_irqsave(&irq->irq_lock, flags);
	if (irq->owner && irq->owner != owner)
		ret = -EEXIST;
	else
		irq->owner = owner;
	raw_spin_unlock_irqrestore(&irq->irq_lock, flags);

	return ret;
}

/**
 * vgic_prune_ap_list - Remove non-relevant interrupts from the list
 *
 * @vcpu: The VCPU pointer
 *
 * Go over the list of "interesting" interrupts, and prune those that we
 * won't have to consider in the near future.
 */
static void vgic_prune_ap_list(struct kvm_vcpu *vcpu)
{
	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
	struct vgic_irq *irq, *tmp;
	bool deleted_lpis = false;

	DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());

retry:
	raw_spin_lock(&vgic_cpu->ap_list_lock);

	list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) {
		struct kvm_vcpu *target_vcpu, *vcpuA, *vcpuB;
		bool target_vcpu_needs_kick = false;

		raw_spin_lock(&irq->irq_lock);

		BUG_ON(vcpu != irq->vcpu);

		target_vcpu = vgic_target_oracle(irq);

		if (!target_vcpu) {
			/*
			 * We don't need to process this interrupt any
			 * further, move it off the list.
			 */
			list_del(&irq->ap_list);
			irq->vcpu = NULL;
			raw_spin_unlock(&irq->irq_lock);

			/*
			 * This vgic_put_irq call matches the
			 * vgic_get_irq_ref in vgic_queue_irq_unlock,
			 * where we added the LPI to the ap_list. As
			 * we remove the irq from the list, we drop
			 * also drop the refcount.
			 */
			deleted_lpis |= vgic_put_irq_norelease(vcpu->kvm, irq);
			continue;
		}

		if (target_vcpu == vcpu) {
			/* We're on the right CPU */
			raw_spin_unlock(&irq->irq_lock);
			continue;
		}

		/* This interrupt looks like it has to be migrated. */

		raw_spin_unlock(&irq->irq_lock);
		raw_spin_unlock(&vgic_cpu->ap_list_lock);

		/*
		 * Ensure locking order by always locking the smallest
		 * ID first.
		 */
		if (vcpu->vcpu_id < target_vcpu->vcpu_id) {
			vcpuA = vcpu;
			vcpuB = target_vcpu;
		} else {
			vcpuA = target_vcpu;
			vcpuB = vcpu;
		}

		raw_spin_lock(&vcpuA->arch.vgic_cpu.ap_list_lock);
		raw_spin_lock_nested(&vcpuB->arch.vgic_cpu.ap_list_lock,
				      SINGLE_DEPTH_NESTING);
		raw_spin_lock(&irq->irq_lock);

		/*
		 * If the affinity has been preserved, move the
		 * interrupt around. Otherwise, it means things have
		 * changed while the interrupt was unlocked, and we
		 * need to replay this.
		 *
		 * In all cases, we cannot trust the list not to have
		 * changed, so we restart from the beginning.
		 */
		if (target_vcpu == vgic_target_oracle(irq)) {
			struct vgic_cpu *new_cpu = &target_vcpu->arch.vgic_cpu;

			list_del(&irq->ap_list);
			irq->vcpu = target_vcpu;
			list_add_tail(&irq->ap_list, &new_cpu->ap_list_head);
			target_vcpu_needs_kick = true;
		}

		raw_spin_unlock(&irq->irq_lock);
		raw_spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock);
		raw_spin_unlock(&vcpuA->arch.vgic_cpu.ap_list_lock);

		if (target_vcpu_needs_kick) {
			kvm_make_request(KVM_REQ_IRQ_PENDING, target_vcpu);
			kvm_vcpu_kick(target_vcpu);
		}

		goto retry;
	}

	raw_spin_unlock(&vgic_cpu->ap_list_lock);

	if (unlikely(deleted_lpis))
		vgic_release_deleted_lpis(vcpu->kvm);
}

static inline void vgic_fold_lr_state(struct kvm_vcpu *vcpu)
{
	if (kvm_vgic_global_state.type == VGIC_V2)
		vgic_v2_fold_lr_state(vcpu);
	else
		vgic_v3_fold_lr_state(vcpu);
}

/* Requires the irq_lock to be held. */
static inline void vgic_populate_lr(struct kvm_vcpu *vcpu,
				    struct vgic_irq *irq, int lr)
{
	lockdep_assert_held(&irq->irq_lock);

	if (kvm_vgic_global_state.type == VGIC_V2)
		vgic_v2_populate_lr(vcpu, irq, lr);
	else
		vgic_v3_populate_lr(vcpu, irq, lr);
}

static inline void vgic_clear_lr(struct kvm_vcpu *vcpu, int lr)
{
	if (kvm_vgic_global_state.type == VGIC_V2)
		vgic_v2_clear_lr(vcpu, lr);
	else
		vgic_v3_clear_lr(vcpu, lr);
}

static void summarize_ap_list(struct kvm_vcpu *vcpu,
			      struct ap_list_summary *als)
{
	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
	struct vgic_irq *irq;

	lockdep_assert_held(&vgic_cpu->ap_list_lock);

	*als = (typeof(*als)){};

	list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
		guard(raw_spinlock)(&irq->irq_lock);

		if (unlikely(vgic_target_oracle(irq) != vcpu))
			continue;

		if (!irq->active)
			als->nr_pend++;
		else
			als->nr_act++;

		if (irq->intid < VGIC_NR_SGIS)
			als->nr_sgi++;
	}
}

/*
 * Dealing with LR overflow is close to black magic -- dress accordingly.
 *
 * We have to present an almost infinite number of interrupts through a very
 * limited number of registers. Therefore crucial decisions must be made to
 * ensure we feed the most relevant interrupts into the LRs, and yet have
 * some facilities to let the guest interact with those that are not there.
 *
 * All considerations below are in the context of interrupts targeting a
 * single vcpu with non-idle state (either pending, active, or both),
 * colloquially called the ap_list:
 *
 * - Pending interrupts must have priority over active interrupts. This also
 *   excludes pending+active interrupts. This ensures that a guest can
 *   perform priority drops on any number of interrupts, and yet be
 *   presented the next pending one.
 *
 * - Deactivation of interrupts outside of the LRs must be tracked by using
 *   either the EOIcount-driven maintenance interrupt, and sometimes by
 *   trapping the DIR register.
 *
 * - For EOImode=0, a non-zero EOIcount means walking the ap_list past the
 *   point that made it into the LRs, and deactivate interrupts that would
 *   have made it onto the LRs if we had the space.
 *
 * - The MI-generation bits must be used to try and force an exit when the
 *   guest has done enough changes to the LRs that we want to reevaluate the
 *   situation:
 *
 *	- if the total number of pending interrupts exceeds the number of
 *	  LR, NPIE must be set in order to exit once no pending interrupts
 *	  are present in the LRs, allowing us to populate the next batch.
 *
 *	- if there are active interrupts outside of the LRs, then LRENPIE
 *	  must be set so that we exit on deactivation of one of these, and
 *	  work out which one is to be deactivated.  Note that this is not
 *	  enough to deal with EOImode=1, see below.
 *
 *	- if the overall number of interrupts exceeds the number of LRs,
 *	  then UIE must be set to allow refilling of the LRs once the
 *	  majority of them has been processed.
 *
 *	- as usual, MI triggers are only an optimisation, since we cannot
 *        rely on the MI being delivered in timely manner...
 *
 * - EOImode=1 creates some additional problems:
 *
 *      - deactivation can happen in any order, and we cannot rely on
 *	  EOImode=0's coupling of priority-drop and deactivation which
 *	  imposes strict reverse Ack order. This means that DIR must
 *	  trap if we have active interrupts outside of the LRs.
 *
 *      - deactivation of SPIs can occur on any CPU, while the SPI is only
 *	  present in the ap_list of the CPU that actually ack-ed it. In that
 *	  case, EOIcount doesn't provide enough information, and we must
 *	  resort to trapping DIR even if we don't overflow the LRs. Bonus
 *	  point for not trapping DIR when no SPIs are pending or active in
 *	  the whole VM.
 *
 *	- LPIs do not suffer the same problem as SPIs on deactivation, as we
 *	  have to essentially discard the active state, see below.
 *
 * - Virtual LPIs have an active state (surprise!), which gets removed on
 *   priority drop (EOI). However, EOIcount doesn't get bumped when the LPI
 *   is not present in the LR (surprise again!). Special care must therefore
 *   be taken to remove the active state from any activated LPI when exiting
 *   from the guest. This is in a way no different from what happens on the
 *   physical side. We still rely on the running priority to have been
 *   removed from the APRs, irrespective of the LPI being present in the LRs
 *   or not.
 *
 * - Virtual SGIs directly injected via GICv4.1 must not affect EOIcount, as
 *   they are not managed in SW and don't have a true active state. So only
 *   set vSGIEOICount when no SGIs are in the ap_list.
 *
 * - GICv2 SGIs with multiple sources are injected one source at a time, as
 *   if they were made pending sequentially. This may mean that we don't
 *   always present the HPPI if other interrupts with lower priority are
 *   pending in the LRs. Big deal.
 */
static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
{
	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
	struct ap_list_summary als;
	struct vgic_irq *irq;
	int count = 0;

	lockdep_assert_held(&vgic_cpu->ap_list_lock);

	summarize_ap_list(vcpu, &als);

	if (irqs_outside_lrs(&als))
		vgic_sort_ap_list(vcpu);

	list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
		scoped_guard(raw_spinlock,  &irq->irq_lock) {
			if (likely(vgic_target_oracle(irq) == vcpu)) {
				vgic_populate_lr(vcpu, irq, count++);
			}
		}

		if (count == kvm_vgic_global_state.nr_lr)
			break;
	}

	/* Nuke remaining LRs */
	for (int i = count ; i < kvm_vgic_global_state.nr_lr; i++)
		vgic_clear_lr(vcpu, i);

	if (!static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif)) {
		vcpu->arch.vgic_cpu.vgic_v2.used_lrs = count;
		vgic_v2_configure_hcr(vcpu, &als);
	} else {
		vcpu->arch.vgic_cpu.vgic_v3.used_lrs = count;
		vgic_v3_configure_hcr(vcpu, &als);
	}
}

static inline bool can_access_vgic_from_kernel(void)
{
	/*
	 * GICv2 can always be accessed from the kernel because it is
	 * memory-mapped, and VHE systems can access GICv3 EL2 system
	 * registers.
	 */
	return !static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) || has_vhe();
}

static inline void vgic_save_state(struct kvm_vcpu *vcpu)
{
	if (!static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
		vgic_v2_save_state(vcpu);
	else
		__vgic_v3_save_state(&vcpu->arch.vgic_cpu.vgic_v3);
}

/* Sync back the hardware VGIC state into our emulation after a guest's run. */
void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
{
	/* If nesting, emulate the HW effect from L0 to L1 */
	if (vgic_state_is_nested(vcpu)) {
		vgic_v3_sync_nested(vcpu);
		return;
	}

	if (vcpu_has_nv(vcpu))
		vgic_v3_nested_update_mi(vcpu);

	if (can_access_vgic_from_kernel())
		vgic_save_state(vcpu);

	vgic_fold_lr_state(vcpu);
	vgic_prune_ap_list(vcpu);
}

/* Sync interrupts that were deactivated through a DIR trap */
void kvm_vgic_process_async_update(struct kvm_vcpu *vcpu)
{
	unsigned long flags;

	/* Make sure we're in the same context as LR handling */
	local_irq_save(flags);
	vgic_prune_ap_list(vcpu);
	local_irq_restore(flags);
}

static inline void vgic_restore_state(struct kvm_vcpu *vcpu)
{
	if (!static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
		vgic_v2_restore_state(vcpu);
	else
		__vgic_v3_restore_state(&vcpu->arch.vgic_cpu.vgic_v3);
}

/* Flush our emulation state into the GIC hardware before entering the guest. */
void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
{
	/*
	 * If in a nested state, we must return early. Two possibilities:
	 *
	 * - If we have any pending IRQ for the guest and the guest
	 *   expects IRQs to be handled in its virtual EL2 mode (the
	 *   virtual IMO bit is set) and it is not already running in
	 *   virtual EL2 mode, then we have to emulate an IRQ
	 *   exception to virtual EL2.
	 *
	 *   We do that by placing a request to ourselves which will
	 *   abort the entry procedure and inject the exception at the
	 *   beginning of the run loop.
	 *
	 * - Otherwise, do exactly *NOTHING* apart from enabling the virtual
	 *   CPU interface. The guest state is already loaded, and we can
	 *   carry on with running it.
	 *
	 * If we have NV, but are not in a nested state, compute the
	 * maintenance interrupt state, as it may fire.
	 */
	if (vgic_state_is_nested(vcpu)) {
		if (kvm_vgic_vcpu_pending_irq(vcpu))
			kvm_make_request(KVM_REQ_GUEST_HYP_IRQ_PENDING, vcpu);

		vgic_v3_flush_nested(vcpu);
		return;
	}

	if (vcpu_has_nv(vcpu))
		vgic_v3_nested_update_mi(vcpu);

	DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());

	scoped_guard(raw_spinlock, &vcpu->arch.vgic_cpu.ap_list_lock)
		vgic_flush_lr_state(vcpu);

	if (can_access_vgic_from_kernel())
		vgic_restore_state(vcpu);

	if (vgic_supports_direct_irqs(vcpu->kvm))
		vgic_v4_commit(vcpu);
}

void kvm_vgic_load(struct kvm_vcpu *vcpu)
{
	if (unlikely(!irqchip_in_kernel(vcpu->kvm) || !vgic_initialized(vcpu->kvm))) {
		if (has_vhe() && static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
			__vgic_v3_activate_traps(&vcpu->arch.vgic_cpu.vgic_v3);
		return;
	}

	if (!static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
		vgic_v2_load(vcpu);
	else
		vgic_v3_load(vcpu);
}

void kvm_vgic_put(struct kvm_vcpu *vcpu)
{
	if (unlikely(!irqchip_in_kernel(vcpu->kvm) || !vgic_initialized(vcpu->kvm))) {
		if (has_vhe() && static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
			__vgic_v3_deactivate_traps(&vcpu->arch.vgic_cpu.vgic_v3);
		return;
	}

	if (!static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
		vgic_v2_put(vcpu);
	else
		vgic_v3_put(vcpu);
}

int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
{
	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
	struct vgic_irq *irq;
	bool pending = false;
	unsigned long flags;
	struct vgic_vmcr vmcr;

	if (!vcpu->kvm->arch.vgic.enabled)
		return false;

	if (vcpu->arch.vgic_cpu.vgic_v3.its_vpe.pending_last)
		return true;

	vgic_get_vmcr(vcpu, &vmcr);

	raw_spin_lock_irqsave(&vgic_cpu->ap_list_lock, flags);

	list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
		raw_spin_lock(&irq->irq_lock);
		pending = irq_is_pending(irq) && irq->enabled &&
			  !irq->active &&
			  irq->priority < vmcr.pmr;
		raw_spin_unlock(&irq->irq_lock);

		if (pending)
			break;
	}

	raw_spin_unlock_irqrestore(&vgic_cpu->ap_list_lock, flags);

	return pending;
}

void vgic_kick_vcpus(struct kvm *kvm)
{
	struct kvm_vcpu *vcpu;
	unsigned long c;

	/*
	 * We've injected an interrupt, time to find out who deserves
	 * a good kick...
	 */
	kvm_for_each_vcpu(c, vcpu, kvm) {
		if (kvm_vgic_vcpu_pending_irq(vcpu)) {
			kvm_make_request(KVM_REQ_IRQ_PENDING, vcpu);
			kvm_vcpu_kick(vcpu);
		}
	}
}

bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, unsigned int vintid)
{
	struct vgic_irq *irq;
	bool map_is_active;
	unsigned long flags;

	if (!vgic_initialized(vcpu->kvm))
		return false;

	irq = vgic_get_vcpu_irq(vcpu, vintid);
	raw_spin_lock_irqsave(&irq->irq_lock, flags);
	map_is_active = irq->hw && irq->active;
	raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
	vgic_put_irq(vcpu->kvm, irq);

	return map_is_active;
}

/*
 * Level-triggered mapped IRQs are special because we only observe rising
 * edges as input to the VGIC.
 *
 * If the guest never acked the interrupt we have to sample the physical
 * line and set the line level, because the device state could have changed
 * or we simply need to process the still pending interrupt later.
 *
 * We could also have entered the guest with the interrupt active+pending.
 * On the next exit, we need to re-evaluate the pending state, as it could
 * otherwise result in a spurious interrupt by injecting a now potentially
 * stale pending state.
 *
 * If this causes us to lower the level, we have to also clear the physical
 * active state, since we will otherwise never be told when the interrupt
 * becomes asserted again.
 *
 * Another case is when the interrupt requires a helping hand on
 * deactivation (no HW deactivation, for example).
 */
void vgic_irq_handle_resampling(struct vgic_irq *irq,
				bool lr_deactivated, bool lr_pending)
{
	if (vgic_irq_is_mapped_level(irq)) {
		bool resample = false;

		if (unlikely(vgic_irq_needs_resampling(irq))) {
			resample = !(irq->active || irq->pending_latch);
		} else if (lr_pending || (lr_deactivated && irq->line_level)) {
			irq->line_level = vgic_get_phys_line_level(irq);
			resample = !irq->line_level;
		}

		if (resample)
			vgic_irq_set_phys_active(irq, false);
	}
}