Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
[sfrench/cifs-2.6.git] / virt / kvm / arm / vgic / vgic-its.c
index ffd0a801aeb593527c463a7276ab7bdfeba96a35..2dff288b3a668e401d924e52cee10b9e85ecd8df 100644 (file)
@@ -23,6 +23,7 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/uaccess.h>
+#include <linux/list_sort.h>
 
 #include <linux/irqchip/arm-gic-v3.h>
 
@@ -244,6 +245,8 @@ static struct its_ite *find_ite(struct vgic_its *its, u32 device_id,
 
 #define VITS_TYPER_IDBITS 16
 #define VITS_TYPER_DEVBITS 16
+#define VITS_DTE_MAX_DEVID_OFFSET      (BIT(14) - 1)
+#define VITS_ITE_MAX_EVENTID_OFFSET    (BIT(16) - 1)
 
 /*
  * Finds and returns a collection in the ITS collection table.
@@ -298,13 +301,13 @@ static int update_lpi_config(struct kvm *kvm, struct vgic_irq *irq,
 }
 
 /*
- * Create a snapshot of the current LPI list, so that we can enumerate all
- * LPIs without holding any lock.
- * Returns the array length and puts the kmalloc'ed array into intid_ptr.
+ * Create a snapshot of the current LPIs targeting @vcpu, so that we can
+ * enumerate those LPIs without holding any lock.
+ * Returns their number and puts the kmalloc'ed array into intid_ptr.
  */
-static int vgic_copy_lpi_list(struct kvm *kvm, u32 **intid_ptr)
+static int vgic_copy_lpi_list(struct kvm_vcpu *vcpu, u32 **intid_ptr)
 {
-       struct vgic_dist *dist = &kvm->arch.vgic;
+       struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
        struct vgic_irq *irq;
        u32 *intids;
        int irq_count = dist->lpi_list_count, i = 0;
@@ -323,14 +326,14 @@ static int vgic_copy_lpi_list(struct kvm *kvm, u32 **intid_ptr)
        spin_lock(&dist->lpi_list_lock);
        list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
                /* We don't need to "get" the IRQ, as we hold the list lock. */
-               intids[i] = irq->intid;
-               if (++i == irq_count)
-                       break;
+               if (irq->target_vcpu != vcpu)
+                       continue;
+               intids[i++] = irq->intid;
        }
        spin_unlock(&dist->lpi_list_lock);
 
        *intid_ptr = intids;
-       return irq_count;
+       return i;
 }
 
 /*
@@ -379,7 +382,7 @@ static u32 max_lpis_propbaser(u64 propbaser)
 }
 
 /*
- * Scan the whole LPI pending table and sync the pending bit in there
+ * Sync the pending table pending bit of LPIs targeting @vcpu
  * with our own data structures. This relies on the LPI being
  * mapped before.
  */
@@ -392,7 +395,7 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
        u32 *intids;
        int nr_irqs, i;
 
-       nr_irqs = vgic_copy_lpi_list(vcpu->kvm, &intids);
+       nr_irqs = vgic_copy_lpi_list(vcpu, &intids);
        if (nr_irqs < 0)
                return nr_irqs;
 
@@ -692,7 +695,8 @@ static int vgic_its_cmd_handle_movi(struct kvm *kvm, struct vgic_its *its,
  * is actually valid (covered by a memslot and guest accessible).
  * For this we have to read the respective first level entry.
  */
-static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id)
+static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id,
+                             gpa_t *eaddr)
 {
        int l1_tbl_size = GITS_BASER_NR_PAGES(baser) * SZ_64K;
        u64 indirect_ptr, type = GITS_BASER_TYPE(baser);
@@ -723,6 +727,8 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id)
                addr = BASER_ADDRESS(baser) + id * esz;
                gfn = addr >> PAGE_SHIFT;
 
+               if (eaddr)
+                       *eaddr = addr;
                return kvm_is_visible_gfn(its->dev->kvm, gfn);
        }
 
@@ -755,6 +761,8 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id)
        indirect_ptr += index * esz;
        gfn = indirect_ptr >> PAGE_SHIFT;
 
+       if (eaddr)
+               *eaddr = indirect_ptr;
        return kvm_is_visible_gfn(its->dev->kvm, gfn);
 }
 
@@ -764,7 +772,7 @@ static int vgic_its_alloc_collection(struct vgic_its *its,
 {
        struct its_collection *collection;
 
-       if (!vgic_its_check_id(its, its->baser_coll_table, coll_id))
+       if (!vgic_its_check_id(its, its->baser_coll_table, coll_id, NULL))
                return E_ITS_MAPC_COLLECTION_OOR;
 
        collection = kzalloc(sizeof(*collection), GFP_KERNEL);
@@ -802,6 +810,25 @@ static void vgic_its_free_collection(struct vgic_its *its, u32 coll_id)
        kfree(collection);
 }
 
+/* Must be called with its_lock mutex held */
+static struct its_ite *vgic_its_alloc_ite(struct its_device *device,
+                                         struct its_collection *collection,
+                                         u32 lpi_id, u32 event_id)
+{
+       struct its_ite *ite;
+
+       ite = kzalloc(sizeof(*ite), GFP_KERNEL);
+       if (!ite)
+               return ERR_PTR(-ENOMEM);
+
+       ite->event_id   = event_id;
+       ite->collection = collection;
+       ite->lpi = lpi_id;
+
+       list_add_tail(&ite->ite_list, &device->itt_head);
+       return ite;
+}
+
 /*
  * The MAPTI and MAPI commands map LPIs to ITTEs.
  * Must be called with its_lock mutex held.
@@ -816,8 +843,8 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
        struct kvm_vcpu *vcpu = NULL;
        struct its_device *device;
        struct its_collection *collection, *new_coll = NULL;
-       int lpi_nr;
        struct vgic_irq *irq;
+       int lpi_nr;
 
        device = find_its_device(its, device_id);
        if (!device)
@@ -846,19 +873,13 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
                new_coll = collection;
        }
 
-       ite = kzalloc(sizeof(struct its_ite), GFP_KERNEL);
-       if (!ite) {
+       ite = vgic_its_alloc_ite(device, collection, lpi_nr, event_id);
+       if (IS_ERR(ite)) {
                if (new_coll)
                        vgic_its_free_collection(its, coll_id);
-               return -ENOMEM;
+               return PTR_ERR(ite);
        }
 
-       ite->event_id   = event_id;
-       list_add_tail(&ite->ite_list, &device->itt_head);
-
-       ite->collection = collection;
-       ite->lpi = lpi_nr;
-
        if (its_is_collection_mapped(collection))
                vcpu = kvm_get_vcpu(kvm, collection->target_addr);
 
@@ -891,6 +912,26 @@ static void vgic_its_unmap_device(struct kvm *kvm, struct its_device *device)
        kfree(device);
 }
 
+/* Must be called with its_lock mutex held */
+static struct its_device *vgic_its_alloc_device(struct vgic_its *its,
+                                               u32 device_id, gpa_t itt_addr,
+                                               u8 num_eventid_bits)
+{
+       struct its_device *device;
+
+       device = kzalloc(sizeof(*device), GFP_KERNEL);
+       if (!device)
+               return ERR_PTR(-ENOMEM);
+
+       device->device_id = device_id;
+       device->itt_addr = itt_addr;
+       device->num_eventid_bits = num_eventid_bits;
+       INIT_LIST_HEAD(&device->itt_head);
+
+       list_add_tail(&device->dev_list, &its->device_list);
+       return device;
+}
+
 /*
  * MAPD maps or unmaps a device ID to Interrupt Translation Tables (ITTs).
  * Must be called with the its_lock mutex held.
@@ -904,7 +945,7 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its,
        gpa_t itt_addr = its_cmd_get_ittaddr(its_cmd);
        struct its_device *device;
 
-       if (!vgic_its_check_id(its, its->baser_device_table, device_id))
+       if (!vgic_its_check_id(its, its->baser_device_table, device_id, NULL))
                return E_ITS_MAPD_DEVICE_OOR;
 
        if (valid && num_eventid_bits > VITS_TYPER_IDBITS)
@@ -927,17 +968,10 @@ static int vgic_its_cmd_handle_mapd(struct kvm *kvm, struct vgic_its *its,
        if (!valid)
                return 0;
 
-       device = kzalloc(sizeof(struct its_device), GFP_KERNEL);
-       if (!device)
-               return -ENOMEM;
-
-       device->device_id = device_id;
-       device->num_eventid_bits = num_eventid_bits;
-       device->itt_addr = itt_addr;
-
-       INIT_LIST_HEAD(&device->itt_head);
-
-       list_add_tail(&device->dev_list, &its->device_list);
+       device = vgic_its_alloc_device(its, device_id, itt_addr,
+                                      num_eventid_bits);
+       if (IS_ERR(device))
+               return PTR_ERR(device);
 
        return 0;
 }
@@ -1047,7 +1081,7 @@ static int vgic_its_cmd_handle_invall(struct kvm *kvm, struct vgic_its *its,
 
        vcpu = kvm_get_vcpu(kvm, collection->target_addr);
 
-       irq_count = vgic_copy_lpi_list(kvm, &intids);
+       irq_count = vgic_copy_lpi_list(vcpu, &intids);
        if (irq_count < 0)
                return irq_count;
 
@@ -1506,17 +1540,19 @@ void vgic_enable_lpis(struct kvm_vcpu *vcpu)
                its_sync_lpi_pending_table(vcpu);
 }
 
-static int vgic_register_its_iodev(struct kvm *kvm, struct vgic_its *its)
+static int vgic_register_its_iodev(struct kvm *kvm, struct vgic_its *its,
+                                  u64 addr)
 {
        struct vgic_io_device *iodev = &its->iodev;
        int ret;
 
-       if (!its->initialized)
-               return -EBUSY;
-
-       if (IS_VGIC_ADDR_UNDEF(its->vgic_its_base))
-               return -ENXIO;
+       mutex_lock(&kvm->slots_lock);
+       if (!IS_VGIC_ADDR_UNDEF(its->vgic_its_base)) {
+               ret = -EBUSY;
+               goto out;
+       }
 
+       its->vgic_its_base = addr;
        iodev->regions = its_registers;
        iodev->nr_regions = ARRAY_SIZE(its_registers);
        kvm_iodevice_init(&iodev->dev, &kvm_io_gic_ops);
@@ -1524,9 +1560,9 @@ static int vgic_register_its_iodev(struct kvm *kvm, struct vgic_its *its)
        iodev->base_addr = its->vgic_its_base;
        iodev->iodev_type = IODEV_ITS;
        iodev->its = its;
-       mutex_lock(&kvm->slots_lock);
        ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, iodev->base_addr,
                                      KVM_VGIC_V3_ITS_SIZE, &iodev->dev);
+out:
        mutex_unlock(&kvm->slots_lock);
 
        return ret;
@@ -1563,7 +1599,6 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
        INIT_LIST_HEAD(&its->collection_list);
 
        dev->kvm->arch.vgic.has_its = true;
-       its->initialized = false;
        its->enabled = false;
        its->dev = dev;
 
@@ -1578,13 +1613,20 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
        return vgic_its_set_abi(its, NR_ITS_ABIS - 1);
 }
 
+static void vgic_its_free_device(struct kvm *kvm, struct its_device *dev)
+{
+       struct its_ite *ite, *tmp;
+
+       list_for_each_entry_safe(ite, tmp, &dev->itt_head, ite_list)
+               its_free_ite(kvm, ite);
+       list_del(&dev->dev_list);
+       kfree(dev);
+}
+
 static void vgic_its_destroy(struct kvm_device *kvm_dev)
 {
        struct kvm *kvm = kvm_dev->kvm;
        struct vgic_its *its = kvm_dev->private;
-       struct its_device *dev;
-       struct its_ite *ite;
-       struct list_head *dev_cur, *dev_temp;
        struct list_head *cur, *temp;
 
        /*
@@ -1595,19 +1637,19 @@ static void vgic_its_destroy(struct kvm_device *kvm_dev)
                return;
 
        mutex_lock(&its->its_lock);
-       list_for_each_safe(dev_cur, dev_temp, &its->device_list) {
-               dev = container_of(dev_cur, struct its_device, dev_list);
-               list_for_each_safe(cur, temp, &dev->itt_head) {
-                       ite = (container_of(cur, struct its_ite, ite_list));
-                       its_free_ite(kvm, ite);
-               }
-               list_del(dev_cur);
-               kfree(dev);
+       list_for_each_safe(cur, temp, &its->device_list) {
+               struct its_device *dev;
+
+               dev = list_entry(cur, struct its_device, dev_list);
+               vgic_its_free_device(kvm, dev);
        }
 
        list_for_each_safe(cur, temp, &its->collection_list) {
+               struct its_collection *coll;
+
+               coll = list_entry(cur, struct its_collection, coll_list);
                list_del(cur);
-               kfree(container_of(cur, struct its_collection, coll_list));
+               kfree(coll);
        }
        mutex_unlock(&its->its_lock);
 
@@ -1702,13 +1744,553 @@ out:
        return ret;
 }
 
+static u32 compute_next_devid_offset(struct list_head *h,
+                                    struct its_device *dev)
+{
+       struct its_device *next;
+       u32 next_offset;
+
+       if (list_is_last(&dev->dev_list, h))
+               return 0;
+       next = list_next_entry(dev, dev_list);
+       next_offset = next->device_id - dev->device_id;
+
+       return min_t(u32, next_offset, VITS_DTE_MAX_DEVID_OFFSET);
+}
+
+static u32 compute_next_eventid_offset(struct list_head *h, struct its_ite *ite)
+{
+       struct its_ite *next;
+       u32 next_offset;
+
+       if (list_is_last(&ite->ite_list, h))
+               return 0;
+       next = list_next_entry(ite, ite_list);
+       next_offset = next->event_id - ite->event_id;
+
+       return min_t(u32, next_offset, VITS_ITE_MAX_EVENTID_OFFSET);
+}
+
+/**
+ * entry_fn_t - Callback called on a table entry restore path
+ * @its: its handle
+ * @id: id of the entry
+ * @entry: pointer to the entry
+ * @opaque: pointer to an opaque data
+ *
+ * Return: < 0 on error, 0 if last element was identified, id offset to next
+ * element otherwise
+ */
+typedef int (*entry_fn_t)(struct vgic_its *its, u32 id, void *entry,
+                         void *opaque);
+
+/**
+ * scan_its_table - Scan a contiguous table in guest RAM and applies a function
+ * to each entry
+ *
+ * @its: its handle
+ * @base: base gpa of the table
+ * @size: size of the table in bytes
+ * @esz: entry size in bytes
+ * @start_id: the ID of the first entry in the table
+ * (non zero for 2d level tables)
+ * @fn: function to apply on each entry
+ *
+ * Return: < 0 on error, 0 if last element was identified, 1 otherwise
+ * (the last element may not be found on second level tables)
+ */
+static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz,
+                         int start_id, entry_fn_t fn, void *opaque)
+{
+       void *entry = kzalloc(esz, GFP_KERNEL);
+       struct kvm *kvm = its->dev->kvm;
+       unsigned long len = size;
+       int id = start_id;
+       gpa_t gpa = base;
+       int ret;
+
+       while (len > 0) {
+               int next_offset;
+               size_t byte_offset;
+
+               ret = kvm_read_guest(kvm, gpa, entry, esz);
+               if (ret)
+                       goto out;
+
+               next_offset = fn(its, id, entry, opaque);
+               if (next_offset <= 0) {
+                       ret = next_offset;
+                       goto out;
+               }
+
+               byte_offset = next_offset * esz;
+               id += next_offset;
+               gpa += byte_offset;
+               len -= byte_offset;
+       }
+       ret =  1;
+
+out:
+       kfree(entry);
+       return ret;
+}
+
+/**
+ * vgic_its_save_ite - Save an interrupt translation entry at @gpa
+ */
+static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
+                             struct its_ite *ite, gpa_t gpa, int ite_esz)
+{
+       struct kvm *kvm = its->dev->kvm;
+       u32 next_offset;
+       u64 val;
+
+       next_offset = compute_next_eventid_offset(&dev->itt_head, ite);
+       val = ((u64)next_offset << KVM_ITS_ITE_NEXT_SHIFT) |
+              ((u64)ite->lpi << KVM_ITS_ITE_PINTID_SHIFT) |
+               ite->collection->collection_id;
+       val = cpu_to_le64(val);
+       return kvm_write_guest(kvm, gpa, &val, ite_esz);
+}
+
+/**
+ * vgic_its_restore_ite - restore an interrupt translation entry
+ * @event_id: id used for indexing
+ * @ptr: pointer to the ITE entry
+ * @opaque: pointer to the its_device
+ */
+static int vgic_its_restore_ite(struct vgic_its *its, u32 event_id,
+                               void *ptr, void *opaque)
+{
+       struct its_device *dev = (struct its_device *)opaque;
+       struct its_collection *collection;
+       struct kvm *kvm = its->dev->kvm;
+       struct kvm_vcpu *vcpu = NULL;
+       u64 val;
+       u64 *p = (u64 *)ptr;
+       struct vgic_irq *irq;
+       u32 coll_id, lpi_id;
+       struct its_ite *ite;
+       u32 offset;
+
+       val = *p;
+
+       val = le64_to_cpu(val);
+
+       coll_id = val & KVM_ITS_ITE_ICID_MASK;
+       lpi_id = (val & KVM_ITS_ITE_PINTID_MASK) >> KVM_ITS_ITE_PINTID_SHIFT;
+
+       if (!lpi_id)
+               return 1; /* invalid entry, no choice but to scan next entry */
+
+       if (lpi_id < VGIC_MIN_LPI)
+               return -EINVAL;
+
+       offset = val >> KVM_ITS_ITE_NEXT_SHIFT;
+       if (event_id + offset >= BIT_ULL(dev->num_eventid_bits))
+               return -EINVAL;
+
+       collection = find_collection(its, coll_id);
+       if (!collection)
+               return -EINVAL;
+
+       ite = vgic_its_alloc_ite(dev, collection, lpi_id, event_id);
+       if (IS_ERR(ite))
+               return PTR_ERR(ite);
+
+       if (its_is_collection_mapped(collection))
+               vcpu = kvm_get_vcpu(kvm, collection->target_addr);
+
+       irq = vgic_add_lpi(kvm, lpi_id, vcpu);
+       if (IS_ERR(irq))
+               return PTR_ERR(irq);
+       ite->irq = irq;
+
+       return offset;
+}
+
+static int vgic_its_ite_cmp(void *priv, struct list_head *a,
+                           struct list_head *b)
+{
+       struct its_ite *itea = container_of(a, struct its_ite, ite_list);
+       struct its_ite *iteb = container_of(b, struct its_ite, ite_list);
+
+       if (itea->event_id < iteb->event_id)
+               return -1;
+       else
+               return 1;
+}
+
+static int vgic_its_save_itt(struct vgic_its *its, struct its_device *device)
+{
+       const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+       gpa_t base = device->itt_addr;
+       struct its_ite *ite;
+       int ret;
+       int ite_esz = abi->ite_esz;
+
+       list_sort(NULL, &device->itt_head, vgic_its_ite_cmp);
+
+       list_for_each_entry(ite, &device->itt_head, ite_list) {
+               gpa_t gpa = base + ite->event_id * ite_esz;
+
+               ret = vgic_its_save_ite(its, device, ite, gpa, ite_esz);
+               if (ret)
+                       return ret;
+       }
+       return 0;
+}
+
+static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev)
+{
+       const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+       gpa_t base = dev->itt_addr;
+       int ret;
+       int ite_esz = abi->ite_esz;
+       size_t max_size = BIT_ULL(dev->num_eventid_bits) * ite_esz;
+
+       ret = scan_its_table(its, base, max_size, ite_esz, 0,
+                            vgic_its_restore_ite, dev);
+
+       return ret;
+}
+
+/**
+ * vgic_its_save_dte - Save a device table entry at a given GPA
+ *
+ * @its: ITS handle
+ * @dev: ITS device
+ * @ptr: GPA
+ */
+static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
+                            gpa_t ptr, int dte_esz)
+{
+       struct kvm *kvm = its->dev->kvm;
+       u64 val, itt_addr_field;
+       u32 next_offset;
+
+       itt_addr_field = dev->itt_addr >> 8;
+       next_offset = compute_next_devid_offset(&its->device_list, dev);
+       val = (1ULL << KVM_ITS_DTE_VALID_SHIFT |
+              ((u64)next_offset << KVM_ITS_DTE_NEXT_SHIFT) |
+              (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) |
+               (dev->num_eventid_bits - 1));
+       val = cpu_to_le64(val);
+       return kvm_write_guest(kvm, ptr, &val, dte_esz);
+}
+
+/**
+ * vgic_its_restore_dte - restore a device table entry
+ *
+ * @its: its handle
+ * @id: device id the DTE corresponds to
+ * @ptr: kernel VA where the 8 byte DTE is located
+ * @opaque: unused
+ *
+ * Return: < 0 on error, 0 if the dte is the last one, id offset to the
+ * next dte otherwise
+ */
+static int vgic_its_restore_dte(struct vgic_its *its, u32 id,
+                               void *ptr, void *opaque)
+{
+       struct its_device *dev;
+       gpa_t itt_addr;
+       u8 num_eventid_bits;
+       u64 entry = *(u64 *)ptr;
+       bool valid;
+       u32 offset;
+       int ret;
+
+       entry = le64_to_cpu(entry);
+
+       valid = entry >> KVM_ITS_DTE_VALID_SHIFT;
+       num_eventid_bits = (entry & KVM_ITS_DTE_SIZE_MASK) + 1;
+       itt_addr = ((entry & KVM_ITS_DTE_ITTADDR_MASK)
+                       >> KVM_ITS_DTE_ITTADDR_SHIFT) << 8;
+
+       if (!valid)
+               return 1;
+
+       /* dte entry is valid */
+       offset = (entry & KVM_ITS_DTE_NEXT_MASK) >> KVM_ITS_DTE_NEXT_SHIFT;
+
+       dev = vgic_its_alloc_device(its, id, itt_addr, num_eventid_bits);
+       if (IS_ERR(dev))
+               return PTR_ERR(dev);
+
+       ret = vgic_its_restore_itt(its, dev);
+       if (ret) {
+               vgic_its_free_device(its->dev->kvm, dev);
+               return ret;
+       }
+
+       return offset;
+}
+
+static int vgic_its_device_cmp(void *priv, struct list_head *a,
+                              struct list_head *b)
+{
+       struct its_device *deva = container_of(a, struct its_device, dev_list);
+       struct its_device *devb = container_of(b, struct its_device, dev_list);
+
+       if (deva->device_id < devb->device_id)
+               return -1;
+       else
+               return 1;
+}
+
+/**
+ * vgic_its_save_device_tables - Save the device table and all ITT
+ * into guest RAM
+ *
+ * L1/L2 handling is hidden by vgic_its_check_id() helper which directly
+ * returns the GPA of the device entry
+ */
+static int vgic_its_save_device_tables(struct vgic_its *its)
+{
+       const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+       struct its_device *dev;
+       int dte_esz = abi->dte_esz;
+       u64 baser;
+
+       baser = its->baser_device_table;
+
+       list_sort(NULL, &its->device_list, vgic_its_device_cmp);
+
+       list_for_each_entry(dev, &its->device_list, dev_list) {
+               int ret;
+               gpa_t eaddr;
+
+               if (!vgic_its_check_id(its, baser,
+                                      dev->device_id, &eaddr))
+                       return -EINVAL;
+
+               ret = vgic_its_save_itt(its, dev);
+               if (ret)
+                       return ret;
+
+               ret = vgic_its_save_dte(its, dev, eaddr, dte_esz);
+               if (ret)
+                       return ret;
+       }
+       return 0;
+}
+
+/**
+ * handle_l1_dte - callback used for L1 device table entries (2 stage case)
+ *
+ * @its: its handle
+ * @id: index of the entry in the L1 table
+ * @addr: kernel VA
+ * @opaque: unused
+ *
+ * L1 table entries are scanned by steps of 1 entry
+ * Return < 0 if error, 0 if last dte was found when scanning the L2
+ * table, +1 otherwise (meaning next L1 entry must be scanned)
+ */
+static int handle_l1_dte(struct vgic_its *its, u32 id, void *addr,
+                        void *opaque)
+{
+       const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+       int l2_start_id = id * (SZ_64K / abi->dte_esz);
+       u64 entry = *(u64 *)addr;
+       int dte_esz = abi->dte_esz;
+       gpa_t gpa;
+       int ret;
+
+       entry = le64_to_cpu(entry);
+
+       if (!(entry & KVM_ITS_L1E_VALID_MASK))
+               return 1;
+
+       gpa = entry & KVM_ITS_L1E_ADDR_MASK;
+
+       ret = scan_its_table(its, gpa, SZ_64K, dte_esz,
+                            l2_start_id, vgic_its_restore_dte, NULL);
+
+       if (ret <= 0)
+               return ret;
+
+       return 1;
+}
+
+/**
+ * vgic_its_restore_device_tables - Restore the device table and all ITT
+ * from guest RAM to internal data structs
+ */
+static int vgic_its_restore_device_tables(struct vgic_its *its)
+{
+       const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+       u64 baser = its->baser_device_table;
+       int l1_esz, ret;
+       int l1_tbl_size = GITS_BASER_NR_PAGES(baser) * SZ_64K;
+       gpa_t l1_gpa;
+
+       if (!(baser & GITS_BASER_VALID))
+               return 0;
+
+       l1_gpa = BASER_ADDRESS(baser);
+
+       if (baser & GITS_BASER_INDIRECT) {
+               l1_esz = GITS_LVL1_ENTRY_SIZE;
+               ret = scan_its_table(its, l1_gpa, l1_tbl_size, l1_esz, 0,
+                                    handle_l1_dte, NULL);
+       } else {
+               l1_esz = abi->dte_esz;
+               ret = scan_its_table(its, l1_gpa, l1_tbl_size, l1_esz, 0,
+                                    vgic_its_restore_dte, NULL);
+       }
+
+       if (ret > 0)
+               ret = -EINVAL;
+
+       return ret;
+}
+
+static int vgic_its_save_cte(struct vgic_its *its,
+                            struct its_collection *collection,
+                            gpa_t gpa, int esz)
+{
+       u64 val;
+
+       val = (1ULL << KVM_ITS_CTE_VALID_SHIFT |
+              ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) |
+              collection->collection_id);
+       val = cpu_to_le64(val);
+       return kvm_write_guest(its->dev->kvm, gpa, &val, esz);
+}
+
+static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
+{
+       struct its_collection *collection;
+       struct kvm *kvm = its->dev->kvm;
+       u32 target_addr, coll_id;
+       u64 val;
+       int ret;
+
+       BUG_ON(esz > sizeof(val));
+       ret = kvm_read_guest(kvm, gpa, &val, esz);
+       if (ret)
+               return ret;
+       val = le64_to_cpu(val);
+       if (!(val & KVM_ITS_CTE_VALID_MASK))
+               return 0;
+
+       target_addr = (u32)(val >> KVM_ITS_CTE_RDBASE_SHIFT);
+       coll_id = val & KVM_ITS_CTE_ICID_MASK;
+
+       if (target_addr >= atomic_read(&kvm->online_vcpus))
+               return -EINVAL;
+
+       collection = find_collection(its, coll_id);
+       if (collection)
+               return -EEXIST;
+       ret = vgic_its_alloc_collection(its, &collection, coll_id);
+       if (ret)
+               return ret;
+       collection->target_addr = target_addr;
+       return 1;
+}
+
+/**
+ * vgic_its_save_collection_table - Save the collection table into
+ * guest RAM
+ */
+static int vgic_its_save_collection_table(struct vgic_its *its)
+{
+       const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+       struct its_collection *collection;
+       u64 val;
+       gpa_t gpa;
+       size_t max_size, filled = 0;
+       int ret, cte_esz = abi->cte_esz;
+
+       gpa = BASER_ADDRESS(its->baser_coll_table);
+       if (!gpa)
+               return 0;
+
+       max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K;
+
+       list_for_each_entry(collection, &its->collection_list, coll_list) {
+               ret = vgic_its_save_cte(its, collection, gpa, cte_esz);
+               if (ret)
+                       return ret;
+               gpa += cte_esz;
+               filled += cte_esz;
+       }
+
+       if (filled == max_size)
+               return 0;
+
+       /*
+        * table is not fully filled, add a last dummy element
+        * with valid bit unset
+        */
+       val = 0;
+       BUG_ON(cte_esz > sizeof(val));
+       ret = kvm_write_guest(its->dev->kvm, gpa, &val, cte_esz);
+       return ret;
+}
+
+/**
+ * vgic_its_restore_collection_table - reads the collection table
+ * in guest memory and restores the ITS internal state. Requires the
+ * BASER registers to be restored before.
+ */
+static int vgic_its_restore_collection_table(struct vgic_its *its)
+{
+       const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+       int cte_esz = abi->cte_esz;
+       size_t max_size, read = 0;
+       gpa_t gpa;
+       int ret;
+
+       if (!(its->baser_coll_table & GITS_BASER_VALID))
+               return 0;
+
+       gpa = BASER_ADDRESS(its->baser_coll_table);
+
+       max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K;
+
+       while (read < max_size) {
+               ret = vgic_its_restore_cte(its, gpa, cte_esz);
+               if (ret <= 0)
+                       break;
+               gpa += cte_esz;
+               read += cte_esz;
+       }
+       return ret;
+}
+
 /**
  * vgic_its_save_tables_v0 - Save the ITS tables into guest ARM
  * according to v0 ABI
  */
 static int vgic_its_save_tables_v0(struct vgic_its *its)
 {
-       return -ENXIO;
+       struct kvm *kvm = its->dev->kvm;
+       int ret;
+
+       mutex_lock(&kvm->lock);
+       mutex_lock(&its->its_lock);
+
+       if (!lock_all_vcpus(kvm)) {
+               mutex_unlock(&its->its_lock);
+               mutex_unlock(&kvm->lock);
+               return -EBUSY;
+       }
+
+       ret = vgic_its_save_device_tables(its);
+       if (ret)
+               goto out;
+
+       ret = vgic_its_save_collection_table(its);
+
+out:
+       unlock_all_vcpus(kvm);
+       mutex_unlock(&its->its_lock);
+       mutex_unlock(&kvm->lock);
+       return ret;
 }
 
 /**
@@ -1718,7 +2300,29 @@ static int vgic_its_save_tables_v0(struct vgic_its *its)
  */
 static int vgic_its_restore_tables_v0(struct vgic_its *its)
 {
-       return -ENXIO;
+       struct kvm *kvm = its->dev->kvm;
+       int ret;
+
+       mutex_lock(&kvm->lock);
+       mutex_lock(&its->its_lock);
+
+       if (!lock_all_vcpus(kvm)) {
+               mutex_unlock(&its->its_lock);
+               mutex_unlock(&kvm->lock);
+               return -EBUSY;
+       }
+
+       ret = vgic_its_restore_collection_table(its);
+       if (ret)
+               goto out;
+
+       ret = vgic_its_restore_device_tables(its);
+out:
+       unlock_all_vcpus(kvm);
+       mutex_unlock(&its->its_lock);
+       mutex_unlock(&kvm->lock);
+
+       return ret;
 }
 
 static int vgic_its_commit_v0(struct vgic_its *its)
@@ -1751,6 +2355,10 @@ static int vgic_its_has_attr(struct kvm_device *dev,
                switch (attr->attr) {
                case KVM_DEV_ARM_VGIC_CTRL_INIT:
                        return 0;
+               case KVM_DEV_ARM_ITS_SAVE_TABLES:
+                       return 0;
+               case KVM_DEV_ARM_ITS_RESTORE_TABLES:
+                       return 0;
                }
                break;
        case KVM_DEV_ARM_VGIC_GRP_ITS_REGS:
@@ -1782,18 +2390,21 @@ static int vgic_its_set_attr(struct kvm_device *dev,
                if (ret)
                        return ret;
 
-               its->vgic_its_base = addr;
-
-               return 0;
+               return vgic_register_its_iodev(dev->kvm, its, addr);
        }
-       case KVM_DEV_ARM_VGIC_GRP_CTRL:
+       case KVM_DEV_ARM_VGIC_GRP_CTRL: {
+               const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+
                switch (attr->attr) {
                case KVM_DEV_ARM_VGIC_CTRL_INIT:
-                       its->initialized = true;
-
+                       /* Nothing to do */
                        return 0;
+               case KVM_DEV_ARM_ITS_SAVE_TABLES:
+                       return abi->save_tables(its);
+               case KVM_DEV_ARM_ITS_RESTORE_TABLES:
+                       return abi->restore_tables(its);
                }
-               break;
+       }
        case KVM_DEV_ARM_VGIC_GRP_ITS_REGS: {
                u64 __user *uaddr = (u64 __user *)(long)attr->addr;
                u64 reg;
@@ -1855,30 +2466,3 @@ int kvm_vgic_register_its_device(void)
        return kvm_register_device_ops(&kvm_arm_vgic_its_ops,
                                       KVM_DEV_TYPE_ARM_VGIC_ITS);
 }
-
-/*
- * Registers all ITSes with the kvm_io_bus framework.
- * To follow the existing VGIC initialization sequence, this has to be
- * done as late as possible, just before the first VCPU runs.
- */
-int vgic_register_its_iodevs(struct kvm *kvm)
-{
-       struct kvm_device *dev;
-       int ret = 0;
-
-       list_for_each_entry(dev, &kvm->devices, vm_node) {
-               if (dev->ops != &kvm_arm_vgic_its_ops)
-                       continue;
-
-               ret = vgic_register_its_iodev(kvm, dev->private);
-               if (ret)
-                       return ret;
-               /*
-                * We don't need to care about tearing down previously
-                * registered ITSes, as the kvm_io_bus framework removes
-                * them for us if the VM gets destroyed.
-                */
-       }
-
-       return ret;
-}