1
// SPDX-License-Identifier: GPL-2.0-only
2
/*
3
 * KVM PMU support for Intel CPUs
4
 *
5
 * Copyright 2011 Red Hat, Inc. and/or its affiliates.
6
 *
7
 * Authors:
8
 *   Avi Kivity   <[email protected]>
9
 *   Gleb Natapov <[email protected]>
10
 */
11
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12

13
#include <linux/types.h>
14
#include <linux/kvm_host.h>
15
#include <linux/perf_event.h>
16
#include <asm/msr.h>
17
#include <asm/perf_event.h>
18
#include "x86.h"
19
#include "cpuid.h"
20
#include "lapic.h"
21
#include "nested.h"
22
#include "pmu.h"
23
#include "tdx.h"
24

25
/*
26
 * Perf's "BASE" is wildly misleading, architectural PMUs use bits 31:16 of ECX
27
 * to encode the "type" of counter to read, i.e. this is not a "base".  And to
28
 * further confuse things, non-architectural PMUs use bit 31 as a flag for
29
 * "fast" reads, whereas the "type" is an explicit value.
30
 */
31
#define INTEL_RDPMC_GP		0
32
#define INTEL_RDPMC_FIXED	INTEL_PMC_FIXED_RDPMC_BASE
33

34
#define INTEL_RDPMC_TYPE_MASK	GENMASK(31, 16)
35
#define INTEL_RDPMC_INDEX_MASK	GENMASK(15, 0)
36

37
#define MSR_PMC_FULL_WIDTH_BIT      (MSR_IA32_PMC0 - MSR_IA32_PERFCTR0)
38

39
static struct lbr_desc *vcpu_to_lbr_desc(struct kvm_vcpu *vcpu)
40
{
41
	if (is_td_vcpu(vcpu))
42
		return NULL;
43

44
	return &to_vmx(vcpu)->lbr_desc;
45
}
46

47
static struct x86_pmu_lbr *vcpu_to_lbr_records(struct kvm_vcpu *vcpu)
48
{
49
	if (is_td_vcpu(vcpu))
50
		return NULL;
51

52
	return &to_vmx(vcpu)->lbr_desc.records;
53
}
54

55
#pragma GCC poison to_vmx
56

57
static void reprogram_fixed_counters(struct kvm_pmu *pmu, u64 data)
58
{
59
	struct kvm_pmc *pmc;
60
	u64 old_fixed_ctr_ctrl = pmu->fixed_ctr_ctrl;
61
	int i;
62

63
	pmu->fixed_ctr_ctrl = data;
64
	for (i = 0; i < pmu->nr_arch_fixed_counters; i++) {
65
		u8 new_ctrl = fixed_ctrl_field(data, i);
66
		u8 old_ctrl = fixed_ctrl_field(old_fixed_ctr_ctrl, i);
67

68
		if (old_ctrl == new_ctrl)
69
			continue;
70

71
		pmc = get_fixed_pmc(pmu, MSR_CORE_PERF_FIXED_CTR0 + i);
72

73
		__set_bit(KVM_FIXED_PMC_BASE_IDX + i, pmu->pmc_in_use);
74
		kvm_pmu_request_counter_reprogram(pmc);
75
	}
76
}
77

78
static struct kvm_pmc *intel_rdpmc_ecx_to_pmc(struct kvm_vcpu *vcpu,
79
					    unsigned int idx, u64 *mask)
80
{
81
	unsigned int type = idx & INTEL_RDPMC_TYPE_MASK;
82
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
83
	struct kvm_pmc *counters;
84
	unsigned int num_counters;
85
	u64 bitmask;
86

87
	/*
88
	 * The encoding of ECX for RDPMC is different for architectural versus
89
	 * non-architecturals PMUs (PMUs with version '0').  For architectural
90
	 * PMUs, bits 31:16 specify the PMC type and bits 15:0 specify the PMC
91
	 * index.  For non-architectural PMUs, bit 31 is a "fast" flag, and
92
	 * bits 30:0 specify the PMC index.
93
	 *
94
	 * Yell and reject attempts to read PMCs for a non-architectural PMU,
95
	 * as KVM doesn't support such PMUs.
96
	 */
97
	if (WARN_ON_ONCE(!pmu->version))
98
		return NULL;
99

100
	/*
101
	 * General Purpose (GP) PMCs are supported on all PMUs, and fixed PMCs
102
	 * are supported on all architectural PMUs, i.e. on all virtual PMUs
103
	 * supported by KVM.  Note, KVM only emulates fixed PMCs for PMU v2+,
104
	 * but the type itself is still valid, i.e. let RDPMC fail due to
105
	 * accessing a non-existent counter.  Reject attempts to read all other
106
	 * types, which are unknown/unsupported.
107
	 */
108
	switch (type) {
109
	case INTEL_RDPMC_FIXED:
110
		counters = pmu->fixed_counters;
111
		num_counters = pmu->nr_arch_fixed_counters;
112
		bitmask = pmu->counter_bitmask[KVM_PMC_FIXED];
113
		break;
114
	case INTEL_RDPMC_GP:
115
		counters = pmu->gp_counters;
116
		num_counters = pmu->nr_arch_gp_counters;
117
		bitmask = pmu->counter_bitmask[KVM_PMC_GP];
118
		break;
119
	default:
120
		return NULL;
121
	}
122

123
	idx &= INTEL_RDPMC_INDEX_MASK;
124
	if (idx >= num_counters)
125
		return NULL;
126

127
	*mask &= bitmask;
128
	return &counters[array_index_nospec(idx, num_counters)];
129
}
130

131
static inline u64 vcpu_get_perf_capabilities(struct kvm_vcpu *vcpu)
132
{
133
	if (!guest_cpu_cap_has(vcpu, X86_FEATURE_PDCM))
134
		return 0;
135

136
	return vcpu->arch.perf_capabilities;
137
}
138

139
static inline bool fw_writes_is_enabled(struct kvm_vcpu *vcpu)
140
{
141
	return (vcpu_get_perf_capabilities(vcpu) & PERF_CAP_FW_WRITES) != 0;
142
}
143

144
static inline struct kvm_pmc *get_fw_gp_pmc(struct kvm_pmu *pmu, u32 msr)
145
{
146
	if (!fw_writes_is_enabled(pmu_to_vcpu(pmu)))
147
		return NULL;
148

149
	return get_gp_pmc(pmu, msr, MSR_IA32_PMC0);
150
}
151

152
static bool intel_pmu_lbr_is_compatible(struct kvm_vcpu *vcpu)
153
{
154
	if (is_td_vcpu(vcpu))
155
		return false;
156

157
	return cpuid_model_is_consistent(vcpu);
158
}
159

160
bool intel_pmu_lbr_is_enabled(struct kvm_vcpu *vcpu)
161
{
162
	if (is_td_vcpu(vcpu))
163
		return false;
164

165
	return !!vcpu_to_lbr_records(vcpu)->nr;
166
}
167

168
static bool intel_pmu_is_valid_lbr_msr(struct kvm_vcpu *vcpu, u32 index)
169
{
170
	struct x86_pmu_lbr *records = vcpu_to_lbr_records(vcpu);
171
	bool ret = false;
172

173
	if (!intel_pmu_lbr_is_enabled(vcpu))
174
		return ret;
175

176
	ret = (index == MSR_LBR_SELECT) || (index == MSR_LBR_TOS) ||
177
		(index >= records->from && index < records->from + records->nr) ||
178
		(index >= records->to && index < records->to + records->nr);
179

180
	if (!ret && records->info)
181
		ret = (index >= records->info && index < records->info + records->nr);
182

183
	return ret;
184
}
185

186
static bool intel_is_valid_msr(struct kvm_vcpu *vcpu, u32 msr)
187
{
188
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
189
	u64 perf_capabilities;
190
	int ret;
191

192
	switch (msr) {
193
	case MSR_CORE_PERF_FIXED_CTR_CTRL:
194
		return kvm_pmu_has_perf_global_ctrl(pmu);
195
	case MSR_IA32_PEBS_ENABLE:
196
		ret = vcpu_get_perf_capabilities(vcpu) & PERF_CAP_PEBS_FORMAT;
197
		break;
198
	case MSR_IA32_DS_AREA:
199
		ret = guest_cpu_cap_has(vcpu, X86_FEATURE_DS);
200
		break;
201
	case MSR_PEBS_DATA_CFG:
202
		perf_capabilities = vcpu_get_perf_capabilities(vcpu);
203
		ret = (perf_capabilities & PERF_CAP_PEBS_BASELINE) &&
204
			((perf_capabilities & PERF_CAP_PEBS_FORMAT) > 3);
205
		break;
206
	default:
207
		ret = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0) ||
208
			get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0) ||
209
			get_fixed_pmc(pmu, msr) || get_fw_gp_pmc(pmu, msr) ||
210
			intel_pmu_is_valid_lbr_msr(vcpu, msr);
211
		break;
212
	}
213

214
	return ret;
215
}
216

217
static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu, u32 msr)
218
{
219
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
220
	struct kvm_pmc *pmc;
221

222
	pmc = get_fixed_pmc(pmu, msr);
223
	pmc = pmc ? pmc : get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0);
224
	pmc = pmc ? pmc : get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0);
225

226
	return pmc;
227
}
228

229
static inline void intel_pmu_release_guest_lbr_event(struct kvm_vcpu *vcpu)
230
{
231
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
232

233
	if (!lbr_desc)
234
		return;
235

236
	if (lbr_desc->event) {
237
		perf_event_release_kernel(lbr_desc->event);
238
		lbr_desc->event = NULL;
239
		vcpu_to_pmu(vcpu)->event_count--;
240
	}
241
}
242

243
int intel_pmu_create_guest_lbr_event(struct kvm_vcpu *vcpu)
244
{
245
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
246
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
247
	struct perf_event *event;
248

249
	/*
250
	 * The perf_event_attr is constructed in the minimum efficient way:
251
	 * - set 'pinned = true' to make it task pinned so that if another
252
	 *   cpu pinned event reclaims LBR, the event->oncpu will be set to -1;
253
	 * - set '.exclude_host = true' to record guest branches behavior;
254
	 *
255
	 * - set '.config = INTEL_FIXED_VLBR_EVENT' to indicates host perf
256
	 *   schedule the event without a real HW counter but a fake one;
257
	 *   check is_guest_lbr_event() and __intel_get_event_constraints();
258
	 *
259
	 * - set 'sample_type = PERF_SAMPLE_BRANCH_STACK' and
260
	 *   'branch_sample_type = PERF_SAMPLE_BRANCH_CALL_STACK |
261
	 *   PERF_SAMPLE_BRANCH_USER' to configure it as a LBR callstack
262
	 *   event, which helps KVM to save/restore guest LBR records
263
	 *   during host context switches and reduces quite a lot overhead,
264
	 *   check branch_user_callstack() and intel_pmu_lbr_sched_task();
265
	 */
266
	struct perf_event_attr attr = {
267
		.type = PERF_TYPE_RAW,
268
		.size = sizeof(attr),
269
		.config = INTEL_FIXED_VLBR_EVENT,
270
		.sample_type = PERF_SAMPLE_BRANCH_STACK,
271
		.pinned = true,
272
		.exclude_host = true,
273
		.branch_sample_type = PERF_SAMPLE_BRANCH_CALL_STACK |
274
					PERF_SAMPLE_BRANCH_USER,
275
	};
276

277
	if (WARN_ON_ONCE(!lbr_desc))
278
		return 0;
279

280
	if (unlikely(lbr_desc->event)) {
281
		__set_bit(INTEL_PMC_IDX_FIXED_VLBR, pmu->pmc_in_use);
282
		return 0;
283
	}
284

285
	event = perf_event_create_kernel_counter(&attr, -1,
286
						current, NULL, NULL);
287
	if (IS_ERR(event)) {
288
		pr_debug_ratelimited("%s: failed %ld\n",
289
					__func__, PTR_ERR(event));
290
		return PTR_ERR(event);
291
	}
292
	lbr_desc->event = event;
293
	pmu->event_count++;
294
	__set_bit(INTEL_PMC_IDX_FIXED_VLBR, pmu->pmc_in_use);
295
	return 0;
296
}
297

298
/*
299
 * It's safe to access LBR msrs from guest when they have not
300
 * been passthrough since the host would help restore or reset
301
 * the LBR msrs records when the guest LBR event is scheduled in.
302
 */
303
static bool intel_pmu_handle_lbr_msrs_access(struct kvm_vcpu *vcpu,
304
				     struct msr_data *msr_info, bool read)
305
{
306
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
307
	u32 index = msr_info->index;
308

309
	if (!intel_pmu_is_valid_lbr_msr(vcpu, index))
310
		return false;
311

312
	if (!lbr_desc->event && intel_pmu_create_guest_lbr_event(vcpu) < 0)
313
		goto dummy;
314

315
	/*
316
	 * Disable irq to ensure the LBR feature doesn't get reclaimed by the
317
	 * host at the time the value is read from the msr, and this avoids the
318
	 * host LBR value to be leaked to the guest. If LBR has been reclaimed,
319
	 * return 0 on guest reads.
320
	 */
321
	local_irq_disable();
322
	if (lbr_desc->event->state == PERF_EVENT_STATE_ACTIVE) {
323
		if (read)
324
			rdmsrq(index, msr_info->data);
325
		else
326
			wrmsrq(index, msr_info->data);
327
		__set_bit(INTEL_PMC_IDX_FIXED_VLBR, vcpu_to_pmu(vcpu)->pmc_in_use);
328
		local_irq_enable();
329
		return true;
330
	}
331
	clear_bit(INTEL_PMC_IDX_FIXED_VLBR, vcpu_to_pmu(vcpu)->pmc_in_use);
332
	local_irq_enable();
333

334
dummy:
335
	if (read)
336
		msr_info->data = 0;
337
	return true;
338
}
339

340
static int intel_pmu_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
341
{
342
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
343
	struct kvm_pmc *pmc;
344
	u32 msr = msr_info->index;
345

346
	switch (msr) {
347
	case MSR_CORE_PERF_FIXED_CTR_CTRL:
348
		msr_info->data = pmu->fixed_ctr_ctrl;
349
		break;
350
	case MSR_IA32_PEBS_ENABLE:
351
		msr_info->data = pmu->pebs_enable;
352
		break;
353
	case MSR_IA32_DS_AREA:
354
		msr_info->data = pmu->ds_area;
355
		break;
356
	case MSR_PEBS_DATA_CFG:
357
		msr_info->data = pmu->pebs_data_cfg;
358
		break;
359
	default:
360
		if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0)) ||
361
		    (pmc = get_gp_pmc(pmu, msr, MSR_IA32_PMC0))) {
362
			u64 val = pmc_read_counter(pmc);
363
			msr_info->data =
364
				val & pmu->counter_bitmask[KVM_PMC_GP];
365
			break;
366
		} else if ((pmc = get_fixed_pmc(pmu, msr))) {
367
			u64 val = pmc_read_counter(pmc);
368
			msr_info->data =
369
				val & pmu->counter_bitmask[KVM_PMC_FIXED];
370
			break;
371
		} else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
372
			msr_info->data = pmc->eventsel;
373
			break;
374
		} else if (intel_pmu_handle_lbr_msrs_access(vcpu, msr_info, true)) {
375
			break;
376
		}
377
		return 1;
378
	}
379

380
	return 0;
381
}
382

383
static int intel_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
384
{
385
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
386
	struct kvm_pmc *pmc;
387
	u32 msr = msr_info->index;
388
	u64 data = msr_info->data;
389
	u64 reserved_bits, diff;
390

391
	switch (msr) {
392
	case MSR_CORE_PERF_FIXED_CTR_CTRL:
393
		if (data & pmu->fixed_ctr_ctrl_rsvd)
394
			return 1;
395

396
		if (pmu->fixed_ctr_ctrl != data)
397
			reprogram_fixed_counters(pmu, data);
398
		break;
399
	case MSR_IA32_PEBS_ENABLE:
400
		if (data & pmu->pebs_enable_rsvd)
401
			return 1;
402

403
		if (pmu->pebs_enable != data) {
404
			diff = pmu->pebs_enable ^ data;
405
			pmu->pebs_enable = data;
406
			reprogram_counters(pmu, diff);
407
		}
408
		break;
409
	case MSR_IA32_DS_AREA:
410
		if (is_noncanonical_msr_address(data, vcpu))
411
			return 1;
412

413
		pmu->ds_area = data;
414
		break;
415
	case MSR_PEBS_DATA_CFG:
416
		if (data & pmu->pebs_data_cfg_rsvd)
417
			return 1;
418

419
		pmu->pebs_data_cfg = data;
420
		break;
421
	default:
422
		if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0)) ||
423
		    (pmc = get_gp_pmc(pmu, msr, MSR_IA32_PMC0))) {
424
			if ((msr & MSR_PMC_FULL_WIDTH_BIT) &&
425
			    (data & ~pmu->counter_bitmask[KVM_PMC_GP]))
426
				return 1;
427

428
			if (!msr_info->host_initiated &&
429
			    !(msr & MSR_PMC_FULL_WIDTH_BIT))
430
				data = (s64)(s32)data;
431
			pmc_write_counter(pmc, data);
432
			break;
433
		} else if ((pmc = get_fixed_pmc(pmu, msr))) {
434
			pmc_write_counter(pmc, data);
435
			break;
436
		} else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
437
			reserved_bits = pmu->reserved_bits;
438
			if ((pmc->idx == 2) &&
439
			    (pmu->raw_event_mask & HSW_IN_TX_CHECKPOINTED))
440
				reserved_bits ^= HSW_IN_TX_CHECKPOINTED;
441
			if (data & reserved_bits)
442
				return 1;
443

444
			if (data != pmc->eventsel) {
445
				pmc->eventsel = data;
446
				kvm_pmu_request_counter_reprogram(pmc);
447
			}
448
			break;
449
		} else if (intel_pmu_handle_lbr_msrs_access(vcpu, msr_info, false)) {
450
			break;
451
		}
452
		/* Not a known PMU MSR. */
453
		return 1;
454
	}
455

456
	return 0;
457
}
458

459
/*
460
 * Map fixed counter events to architectural general purpose event encodings.
461
 * Perf doesn't provide APIs to allow KVM to directly program a fixed counter,
462
 * and so KVM instead programs the architectural event to effectively request
463
 * the fixed counter.  Perf isn't guaranteed to use a fixed counter and may
464
 * instead program the encoding into a general purpose counter, e.g. if a
465
 * different perf_event is already utilizing the requested counter, but the end
466
 * result is the same (ignoring the fact that using a general purpose counter
467
 * will likely exacerbate counter contention).
468
 *
469
 * Forcibly inlined to allow asserting on @index at build time, and there should
470
 * never be more than one user.
471
 */
472
static __always_inline u64 intel_get_fixed_pmc_eventsel(unsigned int index)
473
{
474
	const enum perf_hw_id fixed_pmc_perf_ids[] = {
475
		[0] = PERF_COUNT_HW_INSTRUCTIONS,
476
		[1] = PERF_COUNT_HW_CPU_CYCLES,
477
		[2] = PERF_COUNT_HW_REF_CPU_CYCLES,
478
	};
479
	u64 eventsel;
480

481
	BUILD_BUG_ON(ARRAY_SIZE(fixed_pmc_perf_ids) != KVM_MAX_NR_INTEL_FIXED_COUNTERS);
482
	BUILD_BUG_ON(index >= KVM_MAX_NR_INTEL_FIXED_COUNTERS);
483

484
	/*
485
	 * Yell if perf reports support for a fixed counter but perf doesn't
486
	 * have a known encoding for the associated general purpose event.
487
	 */
488
	eventsel = perf_get_hw_event_config(fixed_pmc_perf_ids[index]);
489
	WARN_ON_ONCE(!eventsel && index < kvm_pmu_cap.num_counters_fixed);
490
	return eventsel;
491
}
492

493
static void intel_pmu_enable_fixed_counter_bits(struct kvm_pmu *pmu, u64 bits)
494
{
495
	int i;
496

497
	for (i = 0; i < pmu->nr_arch_fixed_counters; i++)
498
		pmu->fixed_ctr_ctrl_rsvd &= ~intel_fixed_bits_by_idx(i, bits);
499
}
500

501
static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
502
{
503
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
504
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
505
	struct kvm_cpuid_entry2 *entry;
506
	union cpuid10_eax eax;
507
	union cpuid10_edx edx;
508
	u64 perf_capabilities;
509
	u64 counter_rsvd;
510

511
	if (!lbr_desc)
512
		return;
513

514
	memset(&lbr_desc->records, 0, sizeof(lbr_desc->records));
515

516
	/*
517
	 * Setting passthrough of LBR MSRs is done only in the VM-Entry loop,
518
	 * and PMU refresh is disallowed after the vCPU has run, i.e. this code
519
	 * should never be reached while KVM is passing through MSRs.
520
	 */
521
	if (KVM_BUG_ON(lbr_desc->msr_passthrough, vcpu->kvm))
522
		return;
523

524
	entry = kvm_find_cpuid_entry(vcpu, 0xa);
525
	if (!entry)
526
		return;
527

528
	eax.full = entry->eax;
529
	edx.full = entry->edx;
530

531
	pmu->version = eax.split.version_id;
532
	if (!pmu->version)
533
		return;
534

535
	pmu->nr_arch_gp_counters = min_t(int, eax.split.num_counters,
536
					 kvm_pmu_cap.num_counters_gp);
537
	eax.split.bit_width = min_t(int, eax.split.bit_width,
538
				    kvm_pmu_cap.bit_width_gp);
539
	pmu->counter_bitmask[KVM_PMC_GP] = BIT_ULL(eax.split.bit_width) - 1;
540
	eax.split.mask_length = min_t(int, eax.split.mask_length,
541
				      kvm_pmu_cap.events_mask_len);
542
	pmu->available_event_types = ~entry->ebx & (BIT_ULL(eax.split.mask_length) - 1);
543

544
	entry = kvm_find_cpuid_entry_index(vcpu, 7, 0);
545
	if (entry &&
546
	    (boot_cpu_has(X86_FEATURE_HLE) || boot_cpu_has(X86_FEATURE_RTM)) &&
547
	    (entry->ebx & (X86_FEATURE_HLE|X86_FEATURE_RTM))) {
548
		pmu->reserved_bits ^= HSW_IN_TX;
549
		pmu->raw_event_mask |= (HSW_IN_TX|HSW_IN_TX_CHECKPOINTED);
550
	}
551

552
	perf_capabilities = vcpu_get_perf_capabilities(vcpu);
553
	if (intel_pmu_lbr_is_compatible(vcpu) &&
554
	    (perf_capabilities & PERF_CAP_LBR_FMT))
555
		memcpy(&lbr_desc->records, &vmx_lbr_caps, sizeof(vmx_lbr_caps));
556
	else
557
		lbr_desc->records.nr = 0;
558

559
	if (lbr_desc->records.nr)
560
		bitmap_set(pmu->all_valid_pmc_idx, INTEL_PMC_IDX_FIXED_VLBR, 1);
561

562
	if (pmu->version == 1)
563
		return;
564

565
	pmu->nr_arch_fixed_counters = min_t(int, edx.split.num_counters_fixed,
566
					    kvm_pmu_cap.num_counters_fixed);
567
	edx.split.bit_width_fixed = min_t(int, edx.split.bit_width_fixed,
568
					  kvm_pmu_cap.bit_width_fixed);
569
	pmu->counter_bitmask[KVM_PMC_FIXED] = BIT_ULL(edx.split.bit_width_fixed) - 1;
570

571
	intel_pmu_enable_fixed_counter_bits(pmu, INTEL_FIXED_0_KERNEL |
572
						 INTEL_FIXED_0_USER |
573
						 INTEL_FIXED_0_ENABLE_PMI);
574

575
	counter_rsvd = ~((BIT_ULL(pmu->nr_arch_gp_counters) - 1) |
576
			 ((BIT_ULL(pmu->nr_arch_fixed_counters) - 1) << KVM_FIXED_PMC_BASE_IDX));
577
	pmu->global_ctrl_rsvd = counter_rsvd;
578

579
	/*
580
	 * GLOBAL_STATUS and GLOBAL_OVF_CONTROL (a.k.a. GLOBAL_STATUS_RESET)
581
	 * share reserved bit definitions.  The kernel just happens to use
582
	 * OVF_CTRL for the names.
583
	 */
584
	pmu->global_status_rsvd = pmu->global_ctrl_rsvd
585
			& ~(MSR_CORE_PERF_GLOBAL_OVF_CTRL_OVF_BUF |
586
			    MSR_CORE_PERF_GLOBAL_OVF_CTRL_COND_CHGD);
587
	if (vmx_pt_mode_is_host_guest())
588
		pmu->global_status_rsvd &=
589
				~MSR_CORE_PERF_GLOBAL_OVF_CTRL_TRACE_TOPA_PMI;
590

591
	if (perf_capabilities & PERF_CAP_PEBS_FORMAT) {
592
		if (perf_capabilities & PERF_CAP_PEBS_BASELINE) {
593
			pmu->pebs_enable_rsvd = counter_rsvd;
594
			pmu->reserved_bits &= ~ICL_EVENTSEL_ADAPTIVE;
595
			pmu->pebs_data_cfg_rsvd = ~0xff00000full;
596
			intel_pmu_enable_fixed_counter_bits(pmu, ICL_FIXED_0_ADAPTIVE);
597
		} else {
598
			pmu->pebs_enable_rsvd = ~(BIT_ULL(pmu->nr_arch_gp_counters) - 1);
599
		}
600
	}
601
}
602

603
static void intel_pmu_init(struct kvm_vcpu *vcpu)
604
{
605
	int i;
606
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
607
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
608

609
	if (!lbr_desc)
610
		return;
611

612
	for (i = 0; i < KVM_MAX_NR_INTEL_GP_COUNTERS; i++) {
613
		pmu->gp_counters[i].type = KVM_PMC_GP;
614
		pmu->gp_counters[i].vcpu = vcpu;
615
		pmu->gp_counters[i].idx = i;
616
		pmu->gp_counters[i].current_config = 0;
617
	}
618

619
	for (i = 0; i < KVM_MAX_NR_INTEL_FIXED_COUNTERS; i++) {
620
		pmu->fixed_counters[i].type = KVM_PMC_FIXED;
621
		pmu->fixed_counters[i].vcpu = vcpu;
622
		pmu->fixed_counters[i].idx = i + KVM_FIXED_PMC_BASE_IDX;
623
		pmu->fixed_counters[i].current_config = 0;
624
		pmu->fixed_counters[i].eventsel = intel_get_fixed_pmc_eventsel(i);
625
	}
626

627
	lbr_desc->records.nr = 0;
628
	lbr_desc->event = NULL;
629
	lbr_desc->msr_passthrough = false;
630
}
631

632
static void intel_pmu_reset(struct kvm_vcpu *vcpu)
633
{
634
	intel_pmu_release_guest_lbr_event(vcpu);
635
}
636

637
/*
638
 * Emulate LBR_On_PMI behavior for 1 < pmu.version < 4.
639
 *
640
 * If Freeze_LBR_On_PMI = 1, the LBR is frozen on PMI and
641
 * the KVM emulates to clear the LBR bit (bit 0) in IA32_DEBUGCTL.
642
 *
643
 * Guest needs to re-enable LBR to resume branches recording.
644
 */
645
static void intel_pmu_legacy_freezing_lbrs_on_pmi(struct kvm_vcpu *vcpu)
646
{
647
	u64 data = vmx_guest_debugctl_read();
648

649
	if (data & DEBUGCTLMSR_FREEZE_LBRS_ON_PMI) {
650
		data &= ~DEBUGCTLMSR_LBR;
651
		vmx_guest_debugctl_write(vcpu, data);
652
	}
653
}
654

655
static void intel_pmu_deliver_pmi(struct kvm_vcpu *vcpu)
656
{
657
	u8 version = vcpu_to_pmu(vcpu)->version;
658

659
	if (!intel_pmu_lbr_is_enabled(vcpu))
660
		return;
661

662
	if (version > 1 && version < 4)
663
		intel_pmu_legacy_freezing_lbrs_on_pmi(vcpu);
664
}
665

666
static void vmx_update_intercept_for_lbr_msrs(struct kvm_vcpu *vcpu, bool set)
667
{
668
	struct x86_pmu_lbr *lbr = vcpu_to_lbr_records(vcpu);
669
	int i;
670

671
	for (i = 0; i < lbr->nr; i++) {
672
		vmx_set_intercept_for_msr(vcpu, lbr->from + i, MSR_TYPE_RW, set);
673
		vmx_set_intercept_for_msr(vcpu, lbr->to + i, MSR_TYPE_RW, set);
674
		if (lbr->info)
675
			vmx_set_intercept_for_msr(vcpu, lbr->info + i, MSR_TYPE_RW, set);
676
	}
677

678
	vmx_set_intercept_for_msr(vcpu, MSR_LBR_SELECT, MSR_TYPE_RW, set);
679
	vmx_set_intercept_for_msr(vcpu, MSR_LBR_TOS, MSR_TYPE_RW, set);
680
}
681

682
static inline void vmx_disable_lbr_msrs_passthrough(struct kvm_vcpu *vcpu)
683
{
684
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
685

686
	if (!lbr_desc->msr_passthrough)
687
		return;
688

689
	vmx_update_intercept_for_lbr_msrs(vcpu, true);
690
	lbr_desc->msr_passthrough = false;
691
}
692

693
static inline void vmx_enable_lbr_msrs_passthrough(struct kvm_vcpu *vcpu)
694
{
695
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
696

697
	if (lbr_desc->msr_passthrough)
698
		return;
699

700
	vmx_update_intercept_for_lbr_msrs(vcpu, false);
701
	lbr_desc->msr_passthrough = true;
702
}
703

704
/*
705
 * Higher priority host perf events (e.g. cpu pinned) could reclaim the
706
 * pmu resources (e.g. LBR) that were assigned to the guest. This is
707
 * usually done via ipi calls (more details in perf_install_in_context).
708
 *
709
 * Before entering the non-root mode (with irq disabled here), double
710
 * confirm that the pmu features enabled to the guest are not reclaimed
711
 * by higher priority host events. Otherwise, disallow vcpu's access to
712
 * the reclaimed features.
713
 */
714
void vmx_passthrough_lbr_msrs(struct kvm_vcpu *vcpu)
715
{
716
	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
717
	struct lbr_desc *lbr_desc = vcpu_to_lbr_desc(vcpu);
718

719
	if (WARN_ON_ONCE(!lbr_desc))
720
		return;
721

722
	if (!lbr_desc->event) {
723
		vmx_disable_lbr_msrs_passthrough(vcpu);
724
		if (vmx_guest_debugctl_read() & DEBUGCTLMSR_LBR)
725
			goto warn;
726
		if (test_bit(INTEL_PMC_IDX_FIXED_VLBR, pmu->pmc_in_use))
727
			goto warn;
728
		return;
729
	}
730

731
	if (lbr_desc->event->state < PERF_EVENT_STATE_ACTIVE) {
732
		vmx_disable_lbr_msrs_passthrough(vcpu);
733
		__clear_bit(INTEL_PMC_IDX_FIXED_VLBR, pmu->pmc_in_use);
734
		goto warn;
735
	} else
736
		vmx_enable_lbr_msrs_passthrough(vcpu);
737

738
	return;
739

740
warn:
741
	pr_warn_ratelimited("vcpu-%d: fail to passthrough LBR.\n", vcpu->vcpu_id);
742
}
743

744
static void intel_pmu_cleanup(struct kvm_vcpu *vcpu)
745
{
746
	if (!(vmx_guest_debugctl_read() & DEBUGCTLMSR_LBR))
747
		intel_pmu_release_guest_lbr_event(vcpu);
748
}
749

750
void intel_pmu_cross_mapped_check(struct kvm_pmu *pmu)
751
{
752
	struct kvm_pmc *pmc = NULL;
753
	int bit, hw_idx;
754

755
	kvm_for_each_pmc(pmu, pmc, bit, (unsigned long *)&pmu->global_ctrl) {
756
		if (!pmc_is_locally_enabled(pmc) ||
757
		    !pmc_is_globally_enabled(pmc) || !pmc->perf_event)
758
			continue;
759

760
		/*
761
		 * A negative index indicates the event isn't mapped to a
762
		 * physical counter in the host, e.g. due to contention.
763
		 */
764
		hw_idx = pmc->perf_event->hw.idx;
765
		if (hw_idx != pmc->idx && hw_idx > -1)
766
			pmu->host_cross_mapped_mask |= BIT_ULL(hw_idx);
767
	}
768
}
769

770
struct kvm_pmu_ops intel_pmu_ops __initdata = {
771
	.rdpmc_ecx_to_pmc = intel_rdpmc_ecx_to_pmc,
772
	.msr_idx_to_pmc = intel_msr_idx_to_pmc,
773
	.is_valid_msr = intel_is_valid_msr,
774
	.get_msr = intel_pmu_get_msr,
775
	.set_msr = intel_pmu_set_msr,
776
	.refresh = intel_pmu_refresh,
777
	.init = intel_pmu_init,
778
	.reset = intel_pmu_reset,
779
	.deliver_pmi = intel_pmu_deliver_pmi,
780
	.cleanup = intel_pmu_cleanup,
781
	.EVENTSEL_EVENT = ARCH_PERFMON_EVENTSEL_EVENT,
782
	.MAX_NR_GP_COUNTERS = KVM_MAX_NR_INTEL_GP_COUNTERS,
783
	.MIN_NR_GP_COUNTERS = 1,
784
};
785

786