Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "ARM:
   - VHE optimizations

   - EL2 address space randomization

   - speculative execution mitigations ("variant 3a", aka execution past
     invalid privilege register access)

   - bugfixes and cleanups

  PPC:
   - improvements for the radix page fault handler for HV KVM on POWER9

  s390:
   - more kvm stat counters

   - virtio gpu plumbing

   - documentation

   - facilities improvements

  x86:
   - support for VMware magic I/O port and pseudo-PMCs

   - AMD pause loop exiting

   - support for AMD core performance extensions

   - support for synchronous register access

   - expose nVMX capabilities to userspace

   - support for Hyper-V signaling via eventfd

   - use Enlightened VMCS when running on Hyper-V

   - allow userspace to disable MWAIT/HLT/PAUSE vmexits

   - usual roundup of optimizations and nested virtualization bugfixes

  Generic:
   - API selftest infrastructure (though the only tests are for x86 as
     of now)"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (174 commits)
  kvm: x86: fix a prototype warning
  kvm: selftests: add sync_regs_test
  kvm: selftests: add API testing infrastructure
  kvm: x86: fix a compile warning
  KVM: X86: Add Force Emulation Prefix for "emulate the next instruction"
  KVM: X86: Introduce handle_ud()
  KVM: vmx: unify adjacent #ifdefs
  x86: kvm: hide the unused 'cpu' variable
  KVM: VMX: remove bogus WARN_ON in handle_ept_misconfig
  Revert "KVM: X86: Fix SMRAM accessing even if VM is shutdown"
  kvm: Add emulation for movups/movupd
  KVM: VMX: raise internal error for exception during invalid protected mode state
  KVM: nVMX: Optimization: Dont set KVM_REQ_EVENT when VMExit with nested_run_pending
  KVM: nVMX: Require immediate-exit when event reinjected to L2 and L1 event pending
  KVM: x86: Fix misleading comments on handling pending exceptions
  KVM: x86: Rename interrupt.pending to interrupt.injected
  KVM: VMX: No need to clear pending NMI/interrupt on inject realmode interrupt
  x86/kvm: use Enlightened VMCS when running on Hyper-V
  x86/hyper-v: detect nested features
  x86/hyper-v: define struct hv_enlightened_vmcs and clean field bits
  ...

11 files changed, 152 insertions, 67 deletions

diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index afb0f08b8021..81cdb6b55118 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -294,6 +294,7 @@ struct kvm_vcpu_stat {
         u64 exit_userspace;
         u64 exit_null;
         u64 exit_external_request;
+        u64 exit_io_request;
         u64 exit_external_interrupt;
         u64 exit_stop_request;
         u64 exit_validity;
@@ -310,16 +311,29 @@ struct kvm_vcpu_stat {
         u64 exit_program_interruption;
         u64 exit_instr_and_program;
         u64 exit_operation_exception;
+        u64 deliver_ckc;
+        u64 deliver_cputm;
         u64 deliver_external_call;
         u64 deliver_emergency_signal;
         u64 deliver_service_signal;
-        u64 deliver_virtio_interrupt;
+        u64 deliver_virtio;
         u64 deliver_stop_signal;
         u64 deliver_prefix_signal;
         u64 deliver_restart_signal;
-        u64 deliver_program_int;
-        u64 deliver_io_int;
+        u64 deliver_program;
+        u64 deliver_io;
+        u64 deliver_machine_check;
         u64 exit_wait_state;
+        u64 inject_ckc;
+        u64 inject_cputm;
+        u64 inject_external_call;
+        u64 inject_emergency_signal;
+        u64 inject_mchk;
+        u64 inject_pfault_init;
+        u64 inject_program;
+        u64 inject_restart;
+        u64 inject_set_prefix;
+        u64 inject_stop_signal;
         u64 instruction_epsw;
         u64 instruction_gs;
         u64 instruction_io_other;
@@ -644,7 +658,12 @@ struct kvm_vcpu_arch {
 };
 
 struct kvm_vm_stat {
-        ulong remote_tlb_flush;
+        u64 inject_io;
+        u64 inject_float_mchk;
+        u64 inject_pfault_done;
+        u64 inject_service_signal;
+        u64 inject_virtio;
+        u64 remote_tlb_flush;
 };
 
 struct kvm_arch_memory_slot {
@@ -792,6 +811,7 @@ struct kvm_arch{
         int css_support;
         int use_irqchip;
         int use_cmma;
+        int use_pfmfi;
         int user_cpu_state_ctrl;
         int user_sigp;
         int user_stsi;
diff --git a/arch/s390/include/asm/kvm_para.h b/arch/s390/include/asm/kvm_para.h
index 74eeec9c0a80..cbc7c3a68e4d 100644
--- a/arch/s390/include/asm/kvm_para.h
+++ b/arch/s390/include/asm/kvm_para.h
@@ -193,6 +193,11 @@ static inline unsigned int kvm_arch_para_features(void)
         return 0;
 }
 
+static inline unsigned int kvm_arch_para_hints(void)
+{
+        return 0;
+}
+
 static inline bool kvm_check_and_clear_guest_paused(void)
 {
         return false;
diff --git a/arch/s390/include/asm/mmu.h b/arch/s390/include/asm/mmu.h
index db35c41a59d5..c639c95850e4 100644
--- a/arch/s390/include/asm/mmu.h
+++ b/arch/s390/include/asm/mmu.h
@@ -22,8 +22,8 @@ typedef struct {
         unsigned int has_pgste:1;
         /* The mmu context uses storage keys. */
         unsigned int use_skey:1;
-        /* The mmu context uses CMMA. */
-        unsigned int use_cmma:1;
+        /* The mmu context uses CMM. */
+        unsigned int uses_cmm:1;
 } mm_context_t;
 
 #define INIT_MM_CONTEXT(name)                                              \
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index 6c8ce15cde7b..324f6f452982 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -31,7 +31,7 @@ static inline int init_new_context(struct task_struct *tsk,
                 (current->mm && current->mm->context.alloc_pgste);
         mm->context.has_pgste = 0;
         mm->context.use_skey = 0;
-        mm->context.use_cmma = 0;
+        mm->context.uses_cmm = 0;
 #endif
         switch (mm->context.asce_limit) {
         case _REGION2_SIZE:
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index c24bfa72baf7..8e2b8647ee12 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -1050,8 +1050,7 @@ shadow_r2t:
                 rc = gmap_shadow_r2t(sg, saddr, rfte.val, *fake);
                 if (rc)
                         return rc;
-                /* fallthrough */
-        }
+        } /* fallthrough */
         case ASCE_TYPE_REGION2: {
                 union region2_table_entry rste;
 
@@ -1077,8 +1076,7 @@ shadow_r3t:
                 rc = gmap_shadow_r3t(sg, saddr, rste.val, *fake);
                 if (rc)
                         return rc;
-                /* fallthrough */
-        }
+        } /* fallthrough */
         case ASCE_TYPE_REGION3: {
                 union region3_table_entry rtte;
 
@@ -1113,8 +1111,7 @@ shadow_sgt:
                 rc = gmap_shadow_sgt(sg, saddr, rtte.val, *fake);
                 if (rc)
                         return rc;
-                /* fallthrough */
-        }
+        } /* fallthrough */
         case ASCE_TYPE_SEGMENT: {
                 union segment_table_entry ste;
 
diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
index 07c6e81163bf..a389fa85cca2 100644
--- a/arch/s390/kvm/intercept.c
+++ b/arch/s390/kvm/intercept.c
@@ -50,18 +50,6 @@ u8 kvm_s390_get_ilen(struct kvm_vcpu *vcpu)
         return ilen;
 }
 
-static int handle_noop(struct kvm_vcpu *vcpu)
-{
-        switch (vcpu->arch.sie_block->icptcode) {
-        case 0x10:
-                vcpu->stat.exit_external_request++;
-                break;
-        default:
-                break; /* nothing */
-        }
-        return 0;
-}
-
 static int handle_stop(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
@@ -465,8 +453,11 @@ int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu)
 
         switch (vcpu->arch.sie_block->icptcode) {
         case ICPT_EXTREQ:
+                vcpu->stat.exit_external_request++;
+                return 0;
         case ICPT_IOREQ:
-                return handle_noop(vcpu);
+                vcpu->stat.exit_io_request++;
+                return 0;
         case ICPT_INST:
                 rc = handle_instruction(vcpu);
                 break;
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index b04616b57a94..37d06e022238 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -391,6 +391,7 @@ static int __must_check __deliver_cpu_timer(struct kvm_vcpu *vcpu)
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         int rc;
 
+        vcpu->stat.deliver_cputm++;
         trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_INT_CPU_TIMER,
                                          0, 0);
 
@@ -410,6 +411,7 @@ static int __must_check __deliver_ckc(struct kvm_vcpu *vcpu)
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         int rc;
 
+        vcpu->stat.deliver_ckc++;
         trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_INT_CLOCK_COMP,
                                          0, 0);
 
@@ -595,6 +597,7 @@ static int __must_check __deliver_machine_check(struct kvm_vcpu *vcpu)
                 trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
                                                  KVM_S390_MCHK,
                                                  mchk.cr14, mchk.mcic);
+                vcpu->stat.deliver_machine_check++;
                 rc = __write_machine_check(vcpu, &mchk);
         }
         return rc;
@@ -710,7 +713,7 @@ static int __must_check __deliver_prog(struct kvm_vcpu *vcpu)
         ilen = pgm_info.flags & KVM_S390_PGM_FLAGS_ILC_MASK;
         VCPU_EVENT(vcpu, 3, "deliver: program irq code 0x%x, ilen:%d",
                    pgm_info.code, ilen);
-        vcpu->stat.deliver_program_int++;
+        vcpu->stat.deliver_program++;
         trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, KVM_S390_PROGRAM_INT,
                                          pgm_info.code, 0);
 
@@ -899,7 +902,7 @@ static int __must_check __deliver_virtio(struct kvm_vcpu *vcpu)
                 VCPU_EVENT(vcpu, 4,
                            "deliver: virtio parm: 0x%x,parm64: 0x%llx",
                            inti->ext.ext_params, inti->ext.ext_params2);
-                vcpu->stat.deliver_virtio_interrupt++;
+                vcpu->stat.deliver_virtio++;
                 trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
                                 inti->type,
                                 inti->ext.ext_params,
@@ -975,7 +978,7 @@ static int __must_check __deliver_io(struct kvm_vcpu *vcpu,
                         inti->io.subchannel_id >> 1 & 0x3,
                         inti->io.subchannel_nr);
 
-                vcpu->stat.deliver_io_int++;
+                vcpu->stat.deliver_io++;
                 trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
                                 inti->type,
                                 ((__u32)inti->io.subchannel_id << 16) |
@@ -1004,7 +1007,7 @@ static int __must_check __deliver_io(struct kvm_vcpu *vcpu,
                 VCPU_EVENT(vcpu, 4, "%s isc %u", "deliver: I/O (AI/gisa)", isc);
                 memset(&io, 0, sizeof(io));
                 io.io_int_word = isc_to_int_word(isc);
-                vcpu->stat.deliver_io_int++;
+                vcpu->stat.deliver_io++;
                 trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id,
                         KVM_S390_INT_IO(1, 0, 0, 0),
                         ((__u32)io.subchannel_id << 16) |
@@ -1268,6 +1271,7 @@ static int __inject_prog(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
 
+        vcpu->stat.inject_program++;
         VCPU_EVENT(vcpu, 3, "inject: program irq code 0x%x", irq->u.pgm.code);
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_PROGRAM_INT,
                                    irq->u.pgm.code, 0);
@@ -1309,6 +1313,7 @@ static int __inject_pfault_init(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
 
+        vcpu->stat.inject_pfault_init++;
         VCPU_EVENT(vcpu, 4, "inject: pfault init parameter block at 0x%llx",
                    irq->u.ext.ext_params2);
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_PFAULT_INIT,
@@ -1327,6 +1332,7 @@ static int __inject_extcall(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
         struct kvm_s390_extcall_info *extcall = &li->irq.extcall;
         uint16_t src_id = irq->u.extcall.code;
 
+        vcpu->stat.inject_external_call++;
         VCPU_EVENT(vcpu, 4, "inject: external call source-cpu:%u",
                    src_id);
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_EXTERNAL_CALL,
@@ -1351,6 +1357,7 @@ static int __inject_set_prefix(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         struct kvm_s390_prefix_info *prefix = &li->irq.prefix;
 
+        vcpu->stat.inject_set_prefix++;
         VCPU_EVENT(vcpu, 3, "inject: set prefix to %x",
                    irq->u.prefix.address);
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_SIGP_SET_PREFIX,
@@ -1371,6 +1378,7 @@ static int __inject_sigp_stop(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
         struct kvm_s390_stop_info *stop = &li->irq.stop;
         int rc = 0;
 
+        vcpu->stat.inject_stop_signal++;
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_SIGP_STOP, 0, 0);
 
         if (irq->u.stop.flags & ~KVM_S390_STOP_SUPP_FLAGS)
@@ -1395,6 +1403,7 @@ static int __inject_sigp_restart(struct kvm_vcpu *vcpu,
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
 
+        vcpu->stat.inject_restart++;
         VCPU_EVENT(vcpu, 3, "%s", "inject: restart int");
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_RESTART, 0, 0);
 
@@ -1407,6 +1416,7 @@ static int __inject_sigp_emergency(struct kvm_vcpu *vcpu,
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
 
+        vcpu->stat.inject_emergency_signal++;
         VCPU_EVENT(vcpu, 4, "inject: emergency from cpu %u",
                    irq->u.emerg.code);
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_EMERGENCY,
@@ -1427,6 +1437,7 @@ static int __inject_mchk(struct kvm_vcpu *vcpu, struct kvm_s390_irq *irq)
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         struct kvm_s390_mchk_info *mchk = &li->irq.mchk;
 
+        vcpu->stat.inject_mchk++;
         VCPU_EVENT(vcpu, 3, "inject: machine check mcic 0x%llx",
                    irq->u.mchk.mcic);
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_MCHK, 0,
@@ -1457,6 +1468,7 @@ static int __inject_ckc(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
 
+        vcpu->stat.inject_ckc++;
         VCPU_EVENT(vcpu, 3, "%s", "inject: clock comparator external");
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_CLOCK_COMP,
                                    0, 0);
@@ -1470,6 +1482,7 @@ static int __inject_cpu_timer(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
 
+        vcpu->stat.inject_cputm++;
         VCPU_EVENT(vcpu, 3, "%s", "inject: cpu timer external");
         trace_kvm_s390_inject_vcpu(vcpu->vcpu_id, KVM_S390_INT_CPU_TIMER,
                                    0, 0);
@@ -1596,6 +1609,7 @@ static int __inject_service(struct kvm *kvm,
 {
         struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
 
+        kvm->stat.inject_service_signal++;
         spin_lock(&fi->lock);
         fi->srv_signal.ext_params |= inti->ext.ext_params & SCCB_EVENT_PENDING;
         /*
@@ -1621,6 +1635,7 @@ static int __inject_virtio(struct kvm *kvm,
 {
         struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
 
+        kvm->stat.inject_virtio++;
         spin_lock(&fi->lock);
         if (fi->counters[FIRQ_CNTR_VIRTIO] >= KVM_S390_MAX_VIRTIO_IRQS) {
                 spin_unlock(&fi->lock);
@@ -1638,6 +1653,7 @@ static int __inject_pfault_done(struct kvm *kvm,
 {
         struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
 
+        kvm->stat.inject_pfault_done++;
         spin_lock(&fi->lock);
         if (fi->counters[FIRQ_CNTR_PFAULT] >=
                 (ASYNC_PF_PER_VCPU * KVM_MAX_VCPUS)) {
@@ -1657,6 +1673,7 @@ static int __inject_float_mchk(struct kvm *kvm,
 {
         struct kvm_s390_float_interrupt *fi = &kvm->arch.float_int;
 
+        kvm->stat.inject_float_mchk++;
         spin_lock(&fi->lock);
         fi->mchk.cr14 |= inti->mchk.cr14 & (1UL << CR_PENDING_SUBCLASS);
         fi->mchk.mcic |= inti->mchk.mcic;
@@ -1672,6 +1689,7 @@ static int __inject_io(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
         struct list_head *list;
         int isc;
 
+        kvm->stat.inject_io++;
         isc = int_word_to_isc(inti->io.io_int_word);
 
         if (kvm->arch.gisa && inti->type & KVM_S390_INT_IO_AI_MASK) {
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 339ac0964590..64c986243018 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -57,6 +57,7 @@
                            (KVM_MAX_VCPUS + LOCAL_IRQS))
 
 #define VCPU_STAT(x) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU
+#define VM_STAT(x) offsetof(struct kvm, stat.x), KVM_STAT_VM
 
 struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "userspace_handled", VCPU_STAT(exit_userspace) },
@@ -64,6 +65,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "exit_validity", VCPU_STAT(exit_validity) },
         { "exit_stop_request", VCPU_STAT(exit_stop_request) },
         { "exit_external_request", VCPU_STAT(exit_external_request) },
+        { "exit_io_request", VCPU_STAT(exit_io_request) },
         { "exit_external_interrupt", VCPU_STAT(exit_external_interrupt) },
         { "exit_instruction", VCPU_STAT(exit_instruction) },
         { "exit_pei", VCPU_STAT(exit_pei) },
@@ -78,16 +80,34 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "instruction_lctl", VCPU_STAT(instruction_lctl) },
         { "instruction_stctl", VCPU_STAT(instruction_stctl) },
         { "instruction_stctg", VCPU_STAT(instruction_stctg) },
+        { "deliver_ckc", VCPU_STAT(deliver_ckc) },
+        { "deliver_cputm", VCPU_STAT(deliver_cputm) },
         { "deliver_emergency_signal", VCPU_STAT(deliver_emergency_signal) },
         { "deliver_external_call", VCPU_STAT(deliver_external_call) },
         { "deliver_service_signal", VCPU_STAT(deliver_service_signal) },
-        { "deliver_virtio_interrupt", VCPU_STAT(deliver_virtio_interrupt) },
+        { "deliver_virtio", VCPU_STAT(deliver_virtio) },
         { "deliver_stop_signal", VCPU_STAT(deliver_stop_signal) },
         { "deliver_prefix_signal", VCPU_STAT(deliver_prefix_signal) },
         { "deliver_restart_signal", VCPU_STAT(deliver_restart_signal) },
-        { "deliver_program_interruption", VCPU_STAT(deliver_program_int) },
-        { "deliver_io_interrupt", VCPU_STAT(deliver_io_int) },
+        { "deliver_program", VCPU_STAT(deliver_program) },
+        { "deliver_io", VCPU_STAT(deliver_io) },
+        { "deliver_machine_check", VCPU_STAT(deliver_machine_check) },
         { "exit_wait_state", VCPU_STAT(exit_wait_state) },
+        { "inject_ckc", VCPU_STAT(inject_ckc) },
+        { "inject_cputm", VCPU_STAT(inject_cputm) },
+        { "inject_external_call", VCPU_STAT(inject_external_call) },
+        { "inject_float_mchk", VM_STAT(inject_float_mchk) },
+        { "inject_emergency_signal", VCPU_STAT(inject_emergency_signal) },
+        { "inject_io", VM_STAT(inject_io) },
+        { "inject_mchk", VCPU_STAT(inject_mchk) },
+        { "inject_pfault_done", VM_STAT(inject_pfault_done) },
+        { "inject_program", VCPU_STAT(inject_program) },
+        { "inject_restart", VCPU_STAT(inject_restart) },
+        { "inject_service_signal", VM_STAT(inject_service_signal) },
+        { "inject_set_prefix", VCPU_STAT(inject_set_prefix) },
+        { "inject_stop_signal", VCPU_STAT(inject_stop_signal) },
+        { "inject_pfault_init", VCPU_STAT(inject_pfault_init) },
+        { "inject_virtio", VM_STAT(inject_virtio) },
         { "instruction_epsw", VCPU_STAT(instruction_epsw) },
         { "instruction_gs", VCPU_STAT(instruction_gs) },
         { "instruction_io_other", VCPU_STAT(instruction_io_other) },
@@ -152,13 +172,33 @@ static int nested;
 module_param(nested, int, S_IRUGO);
 MODULE_PARM_DESC(nested, "Nested virtualization support");
 
-/* upper facilities limit for kvm */
-unsigned long kvm_s390_fac_list_mask[16] = { FACILITIES_KVM };
 
-unsigned long kvm_s390_fac_list_mask_size(void)
+/*
+ * For now we handle at most 16 double words as this is what the s390 base
+ * kernel handles and stores in the prefix page. If we ever need to go beyond
+ * this, this requires changes to code, but the external uapi can stay.
+ */
+#define SIZE_INTERNAL 16
+
+/*
+ * Base feature mask that defines default mask for facilities. Consists of the
+ * defines in FACILITIES_KVM and the non-hypervisor managed bits.
+ */
+static unsigned long kvm_s390_fac_base[SIZE_INTERNAL] = { FACILITIES_KVM };
+/*
+ * Extended feature mask. Consists of the defines in FACILITIES_KVM_CPUMODEL
+ * and defines the facilities that can be enabled via a cpu model.
+ */
+static unsigned long kvm_s390_fac_ext[SIZE_INTERNAL] = { FACILITIES_KVM_CPUMODEL };
+
+static unsigned long kvm_s390_fac_size(void)
 {
-        BUILD_BUG_ON(ARRAY_SIZE(kvm_s390_fac_list_mask) > S390_ARCH_FAC_MASK_SIZE_U64);
-        return ARRAY_SIZE(kvm_s390_fac_list_mask);
+        BUILD_BUG_ON(SIZE_INTERNAL > S390_ARCH_FAC_MASK_SIZE_U64);
+        BUILD_BUG_ON(SIZE_INTERNAL > S390_ARCH_FAC_LIST_SIZE_U64);
+        BUILD_BUG_ON(SIZE_INTERNAL * sizeof(unsigned long) >
+                sizeof(S390_lowcore.stfle_fac_list));
+
+        return SIZE_INTERNAL;
 }
 
 /* available cpu features supported by kvm */
@@ -679,6 +719,8 @@ static int kvm_s390_set_mem_control(struct kvm *kvm, struct kvm_device_attr *att
                 mutex_lock(&kvm->lock);
                 if (!kvm->created_vcpus) {
                         kvm->arch.use_cmma = 1;
+                        /* Not compatible with cmma. */
+                        kvm->arch.use_pfmfi = 0;
                         ret = 0;
                 }
                 mutex_unlock(&kvm->lock);
@@ -1583,7 +1625,7 @@ static int kvm_s390_get_cmma_bits(struct kvm *kvm,
                 return -EINVAL;
         /* CMMA is disabled or was not used, or the buffer has length zero */
         bufsize = min(args->count, KVM_S390_CMMA_SIZE_MAX);
-        if (!bufsize || !kvm->mm->context.use_cmma) {
+        if (!bufsize || !kvm->mm->context.uses_cmm) {
                 memset(args, 0, sizeof(*args));
                 return 0;
         }
@@ -1660,7 +1702,7 @@ static int kvm_s390_get_cmma_bits(struct kvm *kvm,
 /*
  * This function sets the CMMA attributes for the given pages. If the input
  * buffer has zero length, no action is taken, otherwise the attributes are
- * set and the mm->context.use_cmma flag is set.
+ * set and the mm->context.uses_cmm flag is set.
  */
 static int kvm_s390_set_cmma_bits(struct kvm *kvm,
                                   const struct kvm_s390_cmma_log *args)
@@ -1710,9 +1752,9 @@ static int kvm_s390_set_cmma_bits(struct kvm *kvm,
         srcu_read_unlock(&kvm->srcu, srcu_idx);
         up_read(&kvm->mm->mmap_sem);
 
-        if (!kvm->mm->context.use_cmma) {
+        if (!kvm->mm->context.uses_cmm) {
                 down_write(&kvm->mm->mmap_sem);
-                kvm->mm->context.use_cmma = 1;
+                kvm->mm->context.uses_cmm = 1;
                 up_write(&kvm->mm->mmap_sem);
         }
 out:
@@ -1967,20 +2009,15 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         if (!kvm->arch.sie_page2)
                 goto out_err;
 
-        /* Populate the facility mask initially. */
-        memcpy(kvm->arch.model.fac_mask, S390_lowcore.stfle_fac_list,
-               sizeof(S390_lowcore.stfle_fac_list));
-        for (i = 0; i < S390_ARCH_FAC_LIST_SIZE_U64; i++) {
-                if (i < kvm_s390_fac_list_mask_size())
-                        kvm->arch.model.fac_mask[i] &= kvm_s390_fac_list_mask[i];
-                else
-                        kvm->arch.model.fac_mask[i] = 0UL;
-        }
-
-        /* Populate the facility list initially. */
         kvm->arch.model.fac_list = kvm->arch.sie_page2->fac_list;
-        memcpy(kvm->arch.model.fac_list, kvm->arch.model.fac_mask,
-               S390_ARCH_FAC_LIST_SIZE_BYTE);
+
+        for (i = 0; i < kvm_s390_fac_size(); i++) {
+                kvm->arch.model.fac_mask[i] = S390_lowcore.stfle_fac_list[i] &
+                                              (kvm_s390_fac_base[i] |
+                                               kvm_s390_fac_ext[i]);
+                kvm->arch.model.fac_list[i] = S390_lowcore.stfle_fac_list[i] &
+                                              kvm_s390_fac_base[i];
+        }
 
         /* we are always in czam mode - even on pre z14 machines */
         set_kvm_facility(kvm->arch.model.fac_mask, 138);
@@ -2028,6 +2065,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 
         kvm->arch.css_support = 0;
         kvm->arch.use_irqchip = 0;
+        kvm->arch.use_pfmfi = sclp.has_pfmfi;
         kvm->arch.epoch = 0;
 
         spin_lock_init(&kvm->arch.start_stop_lock);
@@ -2454,8 +2492,6 @@ int kvm_s390_vcpu_setup_cmma(struct kvm_vcpu *vcpu)
         vcpu->arch.sie_block->cbrlo = get_zeroed_page(GFP_KERNEL);
         if (!vcpu->arch.sie_block->cbrlo)
                 return -ENOMEM;
-
-        vcpu->arch.sie_block->ecb2 &= ~ECB2_PFMFI;
         return 0;
 }
 
@@ -2491,7 +2527,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
         if (test_kvm_facility(vcpu->kvm, 73))
                 vcpu->arch.sie_block->ecb |= ECB_TE;
 
-        if (test_kvm_facility(vcpu->kvm, 8) && sclp.has_pfmfi)
+        if (test_kvm_facility(vcpu->kvm, 8) && vcpu->kvm->arch.use_pfmfi)
                 vcpu->arch.sie_block->ecb2 |= ECB2_PFMFI;
         if (test_kvm_facility(vcpu->kvm, 130))
                 vcpu->arch.sie_block->ecb2 |= ECB2_IEP;
@@ -3023,7 +3059,7 @@ retry:
 
         if (kvm_check_request(KVM_REQ_START_MIGRATION, vcpu)) {
                 /*
-                 * Disable CMMA virtualization; we will emulate the ESSA
+                 * Disable CMM virtualization; we will emulate the ESSA
                  * instruction manually, in order to provide additional
                  * functionalities needed for live migration.
                  */
@@ -3033,11 +3069,11 @@ retry:
 
         if (kvm_check_request(KVM_REQ_STOP_MIGRATION, vcpu)) {
                 /*
-                 * Re-enable CMMA virtualization if CMMA is available and
-                 * was used.
+                 * Re-enable CMM virtualization if CMMA is available and
+                 * CMM has been used.
                  */
                 if ((vcpu->kvm->arch.use_cmma) &&
-                    (vcpu->kvm->mm->context.use_cmma))
+                    (vcpu->kvm->mm->context.uses_cmm))
                         vcpu->arch.sie_block->ecb2 |= ECB2_CMMA;
                 goto retry;
         }
@@ -4044,7 +4080,7 @@ static int __init kvm_s390_init(void)
         }
 
         for (i = 0; i < 16; i++)
-                kvm_s390_fac_list_mask[i] |=
+                kvm_s390_fac_base[i] |=
                         S390_lowcore.stfle_fac_list[i] & nonhyp_mask(i);
 
         return kvm_init(NULL, sizeof(struct kvm_vcpu), 0, THIS_MODULE);
diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
index f55ac0ef99ea..1b5621f4fe5b 100644
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -294,8 +294,6 @@ void exit_sie(struct kvm_vcpu *vcpu);
 void kvm_s390_sync_request(int req, struct kvm_vcpu *vcpu);
 int kvm_s390_vcpu_setup_cmma(struct kvm_vcpu *vcpu);
 void kvm_s390_vcpu_unsetup_cmma(struct kvm_vcpu *vcpu);
-unsigned long kvm_s390_fac_list_mask_size(void);
-extern unsigned long kvm_s390_fac_list_mask[];
 void kvm_s390_set_cpu_timer(struct kvm_vcpu *vcpu, __u64 cputm);
 __u64 kvm_s390_get_cpu_timer(struct kvm_vcpu *vcpu);
 
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index f0b4185158af..ebfa0442e569 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -1078,9 +1078,9 @@ static int handle_essa(struct kvm_vcpu *vcpu)
                  * value really needs to be written to; if the value is
                  * already correct, we do nothing and avoid the lock.
                  */
-                if (vcpu->kvm->mm->context.use_cmma == 0) {
+                if (vcpu->kvm->mm->context.uses_cmm == 0) {
                         down_write(&vcpu->kvm->mm->mmap_sem);
-                        vcpu->kvm->mm->context.use_cmma = 1;
+                        vcpu->kvm->mm->context.uses_cmm = 1;
                         up_write(&vcpu->kvm->mm->mmap_sem);
                 }
                 /*
diff --git a/arch/s390/tools/gen_facilities.c b/arch/s390/tools/gen_facilities.c
index 424a1ba4f874..90a8c9e84ca6 100644
--- a/arch/s390/tools/gen_facilities.c
+++ b/arch/s390/tools/gen_facilities.c
@@ -62,6 +62,13 @@ static struct facility_def facility_defs[] = {
                 }
         },
         {
+                /*
+                 * FACILITIES_KVM contains the list of facilities that are part
+                 * of the default facility mask and list that are passed to the
+                 * initial CPU model. If no CPU model is used, this, together
+                 * with the non-hypervisor managed bits, is the maximum list of
+                 * guest facilities supported by KVM.
+                 */
                 .name = "FACILITIES_KVM",
                 .bits = (int[]){
                         0,  /* N3 instructions */
@@ -89,6 +96,19 @@ static struct facility_def facility_defs[] = {
                         -1  /* END */
                 }
         },
+        {
+                /*
+                 * FACILITIES_KVM_CPUMODEL contains the list of facilities
+                 * that can be enabled by CPU model code if the host supports
+                 * it. These facilities are not passed to the guest without
+                 * CPU model support.
+                 */
+
+                .name = "FACILITIES_KVM_CPUMODEL",
+                .bits = (int[]){
+                        -1  /* END */
+                }
+        },
 };
 
 static void print_facility_list(struct facility_def *def)