Merge tag 'kvm-arm-for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-next

Changes for KVM for arm/arm64 for 3.18

This includes a bunch of changes:
 - Support read-only memory slots on arm/arm64
 - Various changes to fix Sparse warnings
 - Correctly detect write vs. read Stage-2 faults
 - Various VGIC cleanups and fixes
 - Dynamic VGIC data strcuture sizing
 - Fix SGI set_clear_pend offset bug
 - Fix VTTBR_BADDR Mask
 - Correctly report the FSC on Stage-2 faults

Conflicts:
	virt/kvm/eventfd.c
	[duplicate, different patch where the kvm-arm version broke x86.
	 The kvm tree instead has the right one]

2 files changed, 520 insertions, 122 deletions

diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 3ee3ce06bbec..862967852d5a 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -36,21 +36,22 @@
  * How the whole thing works (courtesy of Christoffer Dall):
  *
  * - At any time, the dist->irq_pending_on_cpu is the oracle that knows if
- *   something is pending
- * - VGIC pending interrupts are stored on the vgic.irq_state vgic
- *   bitmap (this bitmap is updated by both user land ioctls and guest
- *   mmio ops, and other in-kernel peripherals such as the
- *   arch. timers) and indicate the 'wire' state.
+ *   something is pending on the CPU interface.
+ * - Interrupts that are pending on the distributor are stored on the
+ *   vgic.irq_pending vgic bitmap (this bitmap is updated by both user land
+ *   ioctls and guest mmio ops, and other in-kernel peripherals such as the
+ *   arch. timers).
  * - Every time the bitmap changes, the irq_pending_on_cpu oracle is
  *   recalculated
  * - To calculate the oracle, we need info for each cpu from
  *   compute_pending_for_cpu, which considers:
- *   - PPI: dist->irq_state & dist->irq_enable
- *   - SPI: dist->irq_state & dist->irq_enable & dist->irq_spi_target
- *   - irq_spi_target is a 'formatted' version of the GICD_ICFGR
+ *   - PPI: dist->irq_pending & dist->irq_enable
+ *   - SPI: dist->irq_pending & dist->irq_enable & dist->irq_spi_target
+ *   - irq_spi_target is a 'formatted' version of the GICD_ITARGETSRn
  *     registers, stored on each vcpu. We only keep one bit of
  *     information per interrupt, making sure that only one vcpu can
  *     accept the interrupt.
+ * - If any of the above state changes, we must recalculate the oracle.
  * - The same is true when injecting an interrupt, except that we only
  *   consider a single interrupt at a time. The irq_spi_cpu array
  *   contains the target CPU for each SPI.
@@ -60,13 +61,18 @@
  * the 'line' again. This is achieved as such:
  *
  * - When a level interrupt is moved onto a vcpu, the corresponding
- *   bit in irq_active is set. As long as this bit is set, the line
+ *   bit in irq_queued is set. As long as this bit is set, the line
  *   will be ignored for further interrupts. The interrupt is injected
  *   into the vcpu with the GICH_LR_EOI bit set (generate a
  *   maintenance interrupt on EOI).
  * - When the interrupt is EOIed, the maintenance interrupt fires,
- *   and clears the corresponding bit in irq_active. This allow the
+ *   and clears the corresponding bit in irq_queued. This allows the
  *   interrupt line to be sampled again.
+ * - Note that level-triggered interrupts can also be set to pending from
+ *   writes to GICD_ISPENDRn and lowering the external input line does not
+ *   cause the interrupt to become inactive in such a situation.
+ *   Conversely, writes to GICD_ICPENDRn do not cause the interrupt to become
+ *   inactive as long as the external input line is held high.
  */
 
 #define VGIC_ADDR_UNDEF         (-1)
@@ -89,6 +95,7 @@ static void vgic_retire_disabled_irqs(struct kvm_vcpu *vcpu);
 static void vgic_retire_lr(int lr_nr, int irq, struct kvm_vcpu *vcpu);
 static void vgic_update_state(struct kvm *kvm);
 static void vgic_kick_vcpus(struct kvm *kvm);
+static u8 *vgic_get_sgi_sources(struct vgic_dist *dist, int vcpu_id, int sgi);
 static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg);
 static struct vgic_lr vgic_get_lr(const struct kvm_vcpu *vcpu, int lr);
 static void vgic_set_lr(struct kvm_vcpu *vcpu, int lr, struct vgic_lr lr_desc);
@@ -99,10 +106,8 @@ static const struct vgic_ops *vgic_ops;
 static const struct vgic_params *vgic;
 
 /*
- * struct vgic_bitmap contains unions that provide two views of
- * the same data. In one case it is an array of registers of
- * u32's, and in the other case it is a bitmap of unsigned
- * longs.
+ * struct vgic_bitmap contains a bitmap made of unsigned longs, but
+ * extracts u32s out of them.
  *
  * This does not work on 64-bit BE systems, because the bitmap access
  * will store two consecutive 32-bit words with the higher-addressed
@@ -118,23 +123,45 @@ static const struct vgic_params *vgic;
 #define REG_OFFSET_SWIZZLE      0
 #endif
 
+static int vgic_init_bitmap(struct vgic_bitmap *b, int nr_cpus, int nr_irqs)
+{
+        int nr_longs;
+
+        nr_longs = nr_cpus + BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
+
+        b->private = kzalloc(sizeof(unsigned long) * nr_longs, GFP_KERNEL);
+        if (!b->private)
+                return -ENOMEM;
+
+        b->shared = b->private + nr_cpus;
+
+        return 0;
+}
+
+static void vgic_free_bitmap(struct vgic_bitmap *b)
+{
+        kfree(b->private);
+        b->private = NULL;
+        b->shared = NULL;
+}
+
 static u32 *vgic_bitmap_get_reg(struct vgic_bitmap *x,
                                 int cpuid, u32 offset)
 {
         offset >>= 2;
         if (!offset)
-                return x->percpu[cpuid].reg + (offset ^ REG_OFFSET_SWIZZLE);
+                return (u32 *)(x->private + cpuid) + REG_OFFSET_SWIZZLE;
         else
-                return x->shared.reg + ((offset - 1) ^ REG_OFFSET_SWIZZLE);
+                return (u32 *)(x->shared) + ((offset - 1) ^ REG_OFFSET_SWIZZLE);
 }
 
 static int vgic_bitmap_get_irq_val(struct vgic_bitmap *x,
                                    int cpuid, int irq)
 {
         if (irq < VGIC_NR_PRIVATE_IRQS)
-                return test_bit(irq, x->percpu[cpuid].reg_ul);
+                return test_bit(irq, x->private + cpuid);
 
-        return test_bit(irq - VGIC_NR_PRIVATE_IRQS, x->shared.reg_ul);
+        return test_bit(irq - VGIC_NR_PRIVATE_IRQS, x->shared);
 }
 
 static void vgic_bitmap_set_irq_val(struct vgic_bitmap *x, int cpuid,
@@ -143,9 +170,9 @@ static void vgic_bitmap_set_irq_val(struct vgic_bitmap *x, int cpuid,
         unsigned long *reg;
 
         if (irq < VGIC_NR_PRIVATE_IRQS) {
-                reg = x->percpu[cpuid].reg_ul;
+                reg = x->private + cpuid;
         } else {
-                reg =  x->shared.reg_ul;
+                reg = x->shared;
                 irq -= VGIC_NR_PRIVATE_IRQS;
         }
 
@@ -157,24 +184,49 @@ static void vgic_bitmap_set_irq_val(struct vgic_bitmap *x, int cpuid,
 
 static unsigned long *vgic_bitmap_get_cpu_map(struct vgic_bitmap *x, int cpuid)
 {
-        if (unlikely(cpuid >= VGIC_MAX_CPUS))
-                return NULL;
-        return x->percpu[cpuid].reg_ul;
+        return x->private + cpuid;
 }
 
 static unsigned long *vgic_bitmap_get_shared_map(struct vgic_bitmap *x)
 {
-        return x->shared.reg_ul;
+        return x->shared;
+}
+
+static int vgic_init_bytemap(struct vgic_bytemap *x, int nr_cpus, int nr_irqs)
+{
+        int size;
+
+        size  = nr_cpus * VGIC_NR_PRIVATE_IRQS;
+        size += nr_irqs - VGIC_NR_PRIVATE_IRQS;
+
+        x->private = kzalloc(size, GFP_KERNEL);
+        if (!x->private)
+                return -ENOMEM;
+
+        x->shared = x->private + nr_cpus * VGIC_NR_PRIVATE_IRQS / sizeof(u32);
+        return 0;
+}
+
+static void vgic_free_bytemap(struct vgic_bytemap *b)
+{
+        kfree(b->private);
+        b->private = NULL;
+        b->shared = NULL;
 }
 
 static u32 *vgic_bytemap_get_reg(struct vgic_bytemap *x, int cpuid, u32 offset)
 {
-        offset >>= 2;
-        BUG_ON(offset > (VGIC_NR_IRQS / 4));
-        if (offset < 8)
-                return x->percpu[cpuid] + offset;
-        else
-                return x->shared + offset - 8;
+        u32 *reg;
+
+        if (offset < VGIC_NR_PRIVATE_IRQS) {
+                reg = x->private;
+                offset += cpuid * VGIC_NR_PRIVATE_IRQS;
+        } else {
+                reg = x->shared;
+                offset -= VGIC_NR_PRIVATE_IRQS;
+        }
+
+        return reg + (offset / sizeof(u32));
 }
 
 #define VGIC_CFG_LEVEL  0
@@ -196,46 +248,81 @@ static int vgic_irq_is_enabled(struct kvm_vcpu *vcpu, int irq)
         return vgic_bitmap_get_irq_val(&dist->irq_enabled, vcpu->vcpu_id, irq);
 }
 
-static int vgic_irq_is_active(struct kvm_vcpu *vcpu, int irq)
+static int vgic_irq_is_queued(struct kvm_vcpu *vcpu, int irq)
+{
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        return vgic_bitmap_get_irq_val(&dist->irq_queued, vcpu->vcpu_id, irq);
+}
+
+static void vgic_irq_set_queued(struct kvm_vcpu *vcpu, int irq)
+{
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        vgic_bitmap_set_irq_val(&dist->irq_queued, vcpu->vcpu_id, irq, 1);
+}
+
+static void vgic_irq_clear_queued(struct kvm_vcpu *vcpu, int irq)
+{
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        vgic_bitmap_set_irq_val(&dist->irq_queued, vcpu->vcpu_id, irq, 0);
+}
+
+static int vgic_dist_irq_get_level(struct kvm_vcpu *vcpu, int irq)
+{
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        return vgic_bitmap_get_irq_val(&dist->irq_level, vcpu->vcpu_id, irq);
+}
+
+static void vgic_dist_irq_set_level(struct kvm_vcpu *vcpu, int irq)
+{
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        vgic_bitmap_set_irq_val(&dist->irq_level, vcpu->vcpu_id, irq, 1);
+}
+
+static void vgic_dist_irq_clear_level(struct kvm_vcpu *vcpu, int irq)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
 
-        return vgic_bitmap_get_irq_val(&dist->irq_active, vcpu->vcpu_id, irq);
+        vgic_bitmap_set_irq_val(&dist->irq_level, vcpu->vcpu_id, irq, 0);
 }
 
-static void vgic_irq_set_active(struct kvm_vcpu *vcpu, int irq)
+static int vgic_dist_irq_soft_pend(struct kvm_vcpu *vcpu, int irq)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
 
-        vgic_bitmap_set_irq_val(&dist->irq_active, vcpu->vcpu_id, irq, 1);
+        return vgic_bitmap_get_irq_val(&dist->irq_soft_pend, vcpu->vcpu_id, irq);
 }
 
-static void vgic_irq_clear_active(struct kvm_vcpu *vcpu, int irq)
+static void vgic_dist_irq_clear_soft_pend(struct kvm_vcpu *vcpu, int irq)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
 
-        vgic_bitmap_set_irq_val(&dist->irq_active, vcpu->vcpu_id, irq, 0);
+        vgic_bitmap_set_irq_val(&dist->irq_soft_pend, vcpu->vcpu_id, irq, 0);
 }
 
 static int vgic_dist_irq_is_pending(struct kvm_vcpu *vcpu, int irq)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
 
-        return vgic_bitmap_get_irq_val(&dist->irq_state, vcpu->vcpu_id, irq);
+        return vgic_bitmap_get_irq_val(&dist->irq_pending, vcpu->vcpu_id, irq);
 }
 
-static void vgic_dist_irq_set(struct kvm_vcpu *vcpu, int irq)
+static void vgic_dist_irq_set_pending(struct kvm_vcpu *vcpu, int irq)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
 
-        vgic_bitmap_set_irq_val(&dist->irq_state, vcpu->vcpu_id, irq, 1);
+        vgic_bitmap_set_irq_val(&dist->irq_pending, vcpu->vcpu_id, irq, 1);
 }
 
-static void vgic_dist_irq_clear(struct kvm_vcpu *vcpu, int irq)
+static void vgic_dist_irq_clear_pending(struct kvm_vcpu *vcpu, int irq)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
 
-        vgic_bitmap_set_irq_val(&dist->irq_state, vcpu->vcpu_id, irq, 0);
+        vgic_bitmap_set_irq_val(&dist->irq_pending, vcpu->vcpu_id, irq, 0);
 }
 
 static void vgic_cpu_irq_set(struct kvm_vcpu *vcpu, int irq)
@@ -256,6 +343,11 @@ static void vgic_cpu_irq_clear(struct kvm_vcpu *vcpu, int irq)
                           vcpu->arch.vgic_cpu.pending_shared);
 }
 
+static bool vgic_can_sample_irq(struct kvm_vcpu *vcpu, int irq)
+{
+        return vgic_irq_is_edge(vcpu, irq) || !vgic_irq_is_queued(vcpu, irq);
+}
+
 static u32 mmio_data_read(struct kvm_exit_mmio *mmio, u32 mask)
 {
         return le32_to_cpu(*((u32 *)mmio->data)) & mask;
@@ -347,7 +439,7 @@ static bool handle_mmio_misc(struct kvm_vcpu *vcpu,
 
         case 4:                 /* GICD_TYPER */
                 reg  = (atomic_read(&vcpu->kvm->online_vcpus) - 1) << 5;
-                reg |= (VGIC_NR_IRQS >> 5) - 1;
+                reg |= (vcpu->kvm->arch.vgic.nr_irqs >> 5) - 1;
                 vgic_reg_access(mmio, &reg, word_offset,
                                 ACCESS_READ_VALUE | ACCESS_WRITE_IGNORED);
                 break;
@@ -409,11 +501,33 @@ static bool handle_mmio_set_pending_reg(struct kvm_vcpu *vcpu,
                                         struct kvm_exit_mmio *mmio,
                                         phys_addr_t offset)
 {
-        u32 *reg = vgic_bitmap_get_reg(&vcpu->kvm->arch.vgic.irq_state,
-                                       vcpu->vcpu_id, offset);
+        u32 *reg, orig;
+        u32 level_mask;
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        reg = vgic_bitmap_get_reg(&dist->irq_cfg, vcpu->vcpu_id, offset);
+        level_mask = (~(*reg));
+
+        /* Mark both level and edge triggered irqs as pending */
+        reg = vgic_bitmap_get_reg(&dist->irq_pending, vcpu->vcpu_id, offset);
+        orig = *reg;
         vgic_reg_access(mmio, reg, offset,
                         ACCESS_READ_VALUE | ACCESS_WRITE_SETBIT);
+
         if (mmio->is_write) {
+                /* Set the soft-pending flag only for level-triggered irqs */
+                reg = vgic_bitmap_get_reg(&dist->irq_soft_pend,
+                                          vcpu->vcpu_id, offset);
+                vgic_reg_access(mmio, reg, offset,
+                                ACCESS_READ_VALUE | ACCESS_WRITE_SETBIT);
+                *reg &= level_mask;
+
+                /* Ignore writes to SGIs */
+                if (offset < 2) {
+                        *reg &= ~0xffff;
+                        *reg |= orig & 0xffff;
+                }
+
                 vgic_update_state(vcpu->kvm);
                 return true;
         }
@@ -425,11 +539,34 @@ static bool handle_mmio_clear_pending_reg(struct kvm_vcpu *vcpu,
                                           struct kvm_exit_mmio *mmio,
                                           phys_addr_t offset)
 {
-        u32 *reg = vgic_bitmap_get_reg(&vcpu->kvm->arch.vgic.irq_state,
-                                       vcpu->vcpu_id, offset);
+        u32 *level_active;
+        u32 *reg, orig;
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+
+        reg = vgic_bitmap_get_reg(&dist->irq_pending, vcpu->vcpu_id, offset);
+        orig = *reg;
         vgic_reg_access(mmio, reg, offset,
                         ACCESS_READ_VALUE | ACCESS_WRITE_CLEARBIT);
         if (mmio->is_write) {
+                /* Re-set level triggered level-active interrupts */
+                level_active = vgic_bitmap_get_reg(&dist->irq_level,
+                                          vcpu->vcpu_id, offset);
+                reg = vgic_bitmap_get_reg(&dist->irq_pending,
+                                          vcpu->vcpu_id, offset);
+                *reg |= *level_active;
+
+                /* Ignore writes to SGIs */
+                if (offset < 2) {
+                        *reg &= ~0xffff;
+                        *reg |= orig & 0xffff;
+                }
+
+                /* Clear soft-pending flags */
+                reg = vgic_bitmap_get_reg(&dist->irq_soft_pend,
+                                          vcpu->vcpu_id, offset);
+                vgic_reg_access(mmio, reg, offset,
+                                ACCESS_READ_VALUE | ACCESS_WRITE_CLEARBIT);
+
                 vgic_update_state(vcpu->kvm);
                 return true;
         }
@@ -651,9 +788,9 @@ static void vgic_unqueue_irqs(struct kvm_vcpu *vcpu)
                  * is fine, then we are only setting a few bits that were
                  * already set.
                  */
-                vgic_dist_irq_set(vcpu, lr.irq);
+                vgic_dist_irq_set_pending(vcpu, lr.irq);
                 if (lr.irq < VGIC_NR_SGIS)
-                        dist->irq_sgi_sources[vcpu_id][lr.irq] |= 1 << lr.source;
+                        *vgic_get_sgi_sources(dist, vcpu_id, lr.irq) |= 1 << lr.source;
                 lr.state &= ~LR_STATE_PENDING;
                 vgic_set_lr(vcpu, i, lr);
 
@@ -662,8 +799,10 @@ static void vgic_unqueue_irqs(struct kvm_vcpu *vcpu)
                  * active), then the LR does not hold any useful info and can
                  * be marked as free for other use.
                  */
-                if (!(lr.state & LR_STATE_MASK))
+                if (!(lr.state & LR_STATE_MASK)) {
                         vgic_retire_lr(i, lr.irq, vcpu);
+                        vgic_irq_clear_queued(vcpu, lr.irq);
+                }
 
                 /* Finally update the VGIC state. */
                 vgic_update_state(vcpu->kvm);
@@ -677,7 +816,7 @@ static bool read_set_clear_sgi_pend_reg(struct kvm_vcpu *vcpu,
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         int sgi;
-        int min_sgi = (offset & ~0x3) * 4;
+        int min_sgi = (offset & ~0x3);
         int max_sgi = min_sgi + 3;
         int vcpu_id = vcpu->vcpu_id;
         u32 reg = 0;
@@ -685,7 +824,7 @@ static bool read_set_clear_sgi_pend_reg(struct kvm_vcpu *vcpu,
         /* Copy source SGIs from distributor side */
         for (sgi = min_sgi; sgi <= max_sgi; sgi++) {
                 int shift = 8 * (sgi - min_sgi);
-                reg |= (u32)dist->irq_sgi_sources[vcpu_id][sgi] << shift;
+                reg |= ((u32)*vgic_get_sgi_sources(dist, vcpu_id, sgi)) << shift;
         }
 
         mmio_data_write(mmio, ~0, reg);
@@ -698,7 +837,7 @@ static bool write_set_clear_sgi_pend_reg(struct kvm_vcpu *vcpu,
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         int sgi;
-        int min_sgi = (offset & ~0x3) * 4;
+        int min_sgi = (offset & ~0x3);
         int max_sgi = min_sgi + 3;
         int vcpu_id = vcpu->vcpu_id;
         u32 reg;
@@ -709,14 +848,15 @@ static bool write_set_clear_sgi_pend_reg(struct kvm_vcpu *vcpu,
         /* Clear pending SGIs on the distributor */
         for (sgi = min_sgi; sgi <= max_sgi; sgi++) {
                 u8 mask = reg >> (8 * (sgi - min_sgi));
+                u8 *src = vgic_get_sgi_sources(dist, vcpu_id, sgi);
                 if (set) {
-                        if ((dist->irq_sgi_sources[vcpu_id][sgi] & mask) != mask)
+                        if ((*src & mask) != mask)
                                 updated = true;
-                        dist->irq_sgi_sources[vcpu_id][sgi] |= mask;
+                        *src |= mask;
                 } else {
-                        if (dist->irq_sgi_sources[vcpu_id][sgi] & mask)
+                        if (*src & mask)
                                 updated = true;
-                        dist->irq_sgi_sources[vcpu_id][sgi] &= ~mask;
+                        *src &= ~mask;
                 }
         }
 
@@ -755,6 +895,7 @@ static bool handle_mmio_sgi_clear(struct kvm_vcpu *vcpu,
 struct mmio_range {
         phys_addr_t base;
         unsigned long len;
+        int bits_per_irq;
         bool (*handle_mmio)(struct kvm_vcpu *vcpu, struct kvm_exit_mmio *mmio,
                             phys_addr_t offset);
 };
@@ -763,56 +904,67 @@ static const struct mmio_range vgic_dist_ranges[] = {
         {
                 .base           = GIC_DIST_CTRL,
                 .len            = 12,
+                .bits_per_irq   = 0,
                 .handle_mmio    = handle_mmio_misc,
         },
         {
                 .base           = GIC_DIST_IGROUP,
-                .len            = VGIC_NR_IRQS / 8,
+                .len            = VGIC_MAX_IRQS / 8,
+                .bits_per_irq   = 1,
                 .handle_mmio    = handle_mmio_raz_wi,
         },
         {
                 .base           = GIC_DIST_ENABLE_SET,
-                .len            = VGIC_NR_IRQS / 8,
+                .len            = VGIC_MAX_IRQS / 8,
+                .bits_per_irq   = 1,
                 .handle_mmio    = handle_mmio_set_enable_reg,
         },
         {
                 .base           = GIC_DIST_ENABLE_CLEAR,
-                .len            = VGIC_NR_IRQS / 8,
+                .len            = VGIC_MAX_IRQS / 8,
+                .bits_per_irq   = 1,
                 .handle_mmio    = handle_mmio_clear_enable_reg,
         },
         {
                 .base           = GIC_DIST_PENDING_SET,
-                .len            = VGIC_NR_IRQS / 8,
+                .len            = VGIC_MAX_IRQS / 8,
+                .bits_per_irq   = 1,
                 .handle_mmio    = handle_mmio_set_pending_reg,
         },
         {
                 .base           = GIC_DIST_PENDING_CLEAR,
-                .len            = VGIC_NR_IRQS / 8,
+                .len            = VGIC_MAX_IRQS / 8,
+                .bits_per_irq   = 1,
                 .handle_mmio    = handle_mmio_clear_pending_reg,
         },
         {
                 .base           = GIC_DIST_ACTIVE_SET,
-                .len            = VGIC_NR_IRQS / 8,
+                .len            = VGIC_MAX_IRQS / 8,
+                .bits_per_irq   = 1,
                 .handle_mmio    = handle_mmio_raz_wi,
         },
         {
                 .base           = GIC_DIST_ACTIVE_CLEAR,
-                .len            = VGIC_NR_IRQS / 8,
+                .len            = VGIC_MAX_IRQS / 8,
+                .bits_per_irq   = 1,
                 .handle_mmio    = handle_mmio_raz_wi,
         },
         {
                 .base           = GIC_DIST_PRI,
-                .len            = VGIC_NR_IRQS,
+                .len            = VGIC_MAX_IRQS,
+                .bits_per_irq   = 8,
                 .handle_mmio    = handle_mmio_priority_reg,
         },
         {
                 .base           = GIC_DIST_TARGET,
-                .len            = VGIC_NR_IRQS,
+                .len            = VGIC_MAX_IRQS,
+                .bits_per_irq   = 8,
                 .handle_mmio    = handle_mmio_target_reg,
         },
         {
                 .base           = GIC_DIST_CONFIG,
-                .len            = VGIC_NR_IRQS / 4,
+                .len            = VGIC_MAX_IRQS / 4,
+                .bits_per_irq   = 2,
                 .handle_mmio    = handle_mmio_cfg_reg,
         },
         {
@@ -850,6 +1002,22 @@ struct mmio_range *find_matching_range(const struct mmio_range *ranges,
         return NULL;
 }
 
+static bool vgic_validate_access(const struct vgic_dist *dist,
+                                 const struct mmio_range *range,
+                                 unsigned long offset)
+{
+        int irq;
+
+        if (!range->bits_per_irq)
+                return true;    /* Not an irq-based access */
+
+        irq = offset * 8 / range->bits_per_irq;
+        if (irq >= dist->nr_irqs)
+                return false;
+
+        return true;
+}
+
 /**
  * vgic_handle_mmio - handle an in-kernel MMIO access
  * @vcpu:       pointer to the vcpu performing the access
@@ -889,7 +1057,13 @@ bool vgic_handle_mmio(struct kvm_vcpu *vcpu, struct kvm_run *run,
 
         spin_lock(&vcpu->kvm->arch.vgic.lock);
         offset = mmio->phys_addr - range->base - base;
-        updated_state = range->handle_mmio(vcpu, mmio, offset);
+        if (vgic_validate_access(dist, range, offset)) {
+                updated_state = range->handle_mmio(vcpu, mmio, offset);
+        } else {
+                vgic_reg_access(mmio, NULL, offset,
+                                ACCESS_READ_RAZ | ACCESS_WRITE_IGNORED);
+                updated_state = false;
+        }
         spin_unlock(&vcpu->kvm->arch.vgic.lock);
         kvm_prepare_mmio(run, mmio);
         kvm_handle_mmio_return(vcpu, run);
@@ -900,6 +1074,11 @@ bool vgic_handle_mmio(struct kvm_vcpu *vcpu, struct kvm_run *run,
         return true;
 }
 
+static u8 *vgic_get_sgi_sources(struct vgic_dist *dist, int vcpu_id, int sgi)
+{
+        return dist->irq_sgi_sources + vcpu_id * VGIC_NR_SGIS + sgi;
+}
+
 static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg)
 {
         struct kvm *kvm = vcpu->kvm;
@@ -932,8 +1111,8 @@ static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg)
         kvm_for_each_vcpu(c, vcpu, kvm) {
                 if (target_cpus & 1) {
                         /* Flag the SGI as pending */
-                        vgic_dist_irq_set(vcpu, sgi);
-                        dist->irq_sgi_sources[c][sgi] |= 1 << vcpu_id;
+                        vgic_dist_irq_set_pending(vcpu, sgi);
+                        *vgic_get_sgi_sources(dist, c, sgi) |= 1 << vcpu_id;
                         kvm_debug("SGI%d from CPU%d to CPU%d\n", sgi, vcpu_id, c);
                 }
 
@@ -941,32 +1120,38 @@ static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg)
         }
 }
 
+static int vgic_nr_shared_irqs(struct vgic_dist *dist)
+{
+        return dist->nr_irqs - VGIC_NR_PRIVATE_IRQS;
+}
+
 static int compute_pending_for_cpu(struct kvm_vcpu *vcpu)
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         unsigned long *pending, *enabled, *pend_percpu, *pend_shared;
         unsigned long pending_private, pending_shared;
+        int nr_shared = vgic_nr_shared_irqs(dist);
         int vcpu_id;
 
         vcpu_id = vcpu->vcpu_id;
         pend_percpu = vcpu->arch.vgic_cpu.pending_percpu;
         pend_shared = vcpu->arch.vgic_cpu.pending_shared;
 
-        pending = vgic_bitmap_get_cpu_map(&dist->irq_state, vcpu_id);
+        pending = vgic_bitmap_get_cpu_map(&dist->irq_pending, vcpu_id);
         enabled = vgic_bitmap_get_cpu_map(&dist->irq_enabled, vcpu_id);
         bitmap_and(pend_percpu, pending, enabled, VGIC_NR_PRIVATE_IRQS);
 
-        pending = vgic_bitmap_get_shared_map(&dist->irq_state);
+        pending = vgic_bitmap_get_shared_map(&dist->irq_pending);
         enabled = vgic_bitmap_get_shared_map(&dist->irq_enabled);
-        bitmap_and(pend_shared, pending, enabled, VGIC_NR_SHARED_IRQS);
+        bitmap_and(pend_shared, pending, enabled, nr_shared);
         bitmap_and(pend_shared, pend_shared,
                    vgic_bitmap_get_shared_map(&dist->irq_spi_target[vcpu_id]),
-                   VGIC_NR_SHARED_IRQS);
+                   nr_shared);
 
         pending_private = find_first_bit(pend_percpu, VGIC_NR_PRIVATE_IRQS);
-        pending_shared = find_first_bit(pend_shared, VGIC_NR_SHARED_IRQS);
+        pending_shared = find_first_bit(pend_shared, nr_shared);
         return (pending_private < VGIC_NR_PRIVATE_IRQS ||
-                pending_shared < VGIC_NR_SHARED_IRQS);
+                pending_shared < vgic_nr_shared_irqs(dist));
 }
 
 /*
@@ -980,14 +1165,14 @@ static void vgic_update_state(struct kvm *kvm)
         int c;
 
         if (!dist->enabled) {
-                set_bit(0, &dist->irq_pending_on_cpu);
+                set_bit(0, dist->irq_pending_on_cpu);
                 return;
         }
 
         kvm_for_each_vcpu(c, vcpu, kvm) {
                 if (compute_pending_for_cpu(vcpu)) {
                         pr_debug("CPU%d has pending interrupts\n", c);
-                        set_bit(c, &dist->irq_pending_on_cpu);
+                        set_bit(c, dist->irq_pending_on_cpu);
                 }
         }
 }
@@ -1079,8 +1264,8 @@ static void vgic_retire_disabled_irqs(struct kvm_vcpu *vcpu)
 
                 if (!vgic_irq_is_enabled(vcpu, vlr.irq)) {
                         vgic_retire_lr(lr, vlr.irq, vcpu);
-                        if (vgic_irq_is_active(vcpu, vlr.irq))
-                                vgic_irq_clear_active(vcpu, vlr.irq);
+                        if (vgic_irq_is_queued(vcpu, vlr.irq))
+                                vgic_irq_clear_queued(vcpu, vlr.irq);
                 }
         }
 }
@@ -1092,13 +1277,14 @@ static void vgic_retire_disabled_irqs(struct kvm_vcpu *vcpu)
 static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
 {
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+        struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         struct vgic_lr vlr;
         int lr;
 
         /* Sanitize the input... */
         BUG_ON(sgi_source_id & ~7);
         BUG_ON(sgi_source_id && irq >= VGIC_NR_SGIS);
-        BUG_ON(irq >= VGIC_NR_IRQS);
+        BUG_ON(irq >= dist->nr_irqs);
 
         kvm_debug("Queue IRQ%d\n", irq);
 
@@ -1144,14 +1330,14 @@ static bool vgic_queue_sgi(struct kvm_vcpu *vcpu, int irq)
         int vcpu_id = vcpu->vcpu_id;
         int c;
 
-        sources = dist->irq_sgi_sources[vcpu_id][irq];
+        sources = *vgic_get_sgi_sources(dist, vcpu_id, irq);
 
-        for_each_set_bit(c, &sources, VGIC_MAX_CPUS) {
+        for_each_set_bit(c, &sources, dist->nr_cpus) {
                 if (vgic_queue_irq(vcpu, c, irq))
                         clear_bit(c, &sources);
         }
 
-        dist->irq_sgi_sources[vcpu_id][irq] = sources;
+        *vgic_get_sgi_sources(dist, vcpu_id, irq) = sources;
 
         /*
          * If the sources bitmap has been cleared it means that we
@@ -1160,7 +1346,7 @@ static bool vgic_queue_sgi(struct kvm_vcpu *vcpu, int irq)
          * our emulated gic and can get rid of them.
          */
         if (!sources) {
-                vgic_dist_irq_clear(vcpu, irq);
+                vgic_dist_irq_clear_pending(vcpu, irq);
                 vgic_cpu_irq_clear(vcpu, irq);
                 return true;
         }
@@ -1170,15 +1356,15 @@ static bool vgic_queue_sgi(struct kvm_vcpu *vcpu, int irq)
 
 static bool vgic_queue_hwirq(struct kvm_vcpu *vcpu, int irq)
 {
-        if (vgic_irq_is_active(vcpu, irq))
+        if (!vgic_can_sample_irq(vcpu, irq))
                 return true; /* level interrupt, already queued */
 
         if (vgic_queue_irq(vcpu, 0, irq)) {
                 if (vgic_irq_is_edge(vcpu, irq)) {
-                        vgic_dist_irq_clear(vcpu, irq);
+                        vgic_dist_irq_clear_pending(vcpu, irq);
                         vgic_cpu_irq_clear(vcpu, irq);
                 } else {
-                        vgic_irq_set_active(vcpu, irq);
+                        vgic_irq_set_queued(vcpu, irq);
                 }
 
                 return true;
@@ -1223,7 +1409,7 @@ static void __kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
         }
 
         /* SPIs */
-        for_each_set_bit(i, vgic_cpu->pending_shared, VGIC_NR_SHARED_IRQS) {
+        for_each_set_bit(i, vgic_cpu->pending_shared, vgic_nr_shared_irqs(dist)) {
                 if (!vgic_queue_hwirq(vcpu, i + VGIC_NR_PRIVATE_IRQS))
                         overflow = 1;
         }
@@ -1239,7 +1425,7 @@ epilog:
                  * us. Claim we don't have anything pending. We'll
                  * adjust that if needed while exiting.
                  */
-                clear_bit(vcpu_id, &dist->irq_pending_on_cpu);
+                clear_bit(vcpu_id, dist->irq_pending_on_cpu);
         }
 }
 
@@ -1261,17 +1447,32 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
 
                 for_each_set_bit(lr, eisr_ptr, vgic->nr_lr) {
                         struct vgic_lr vlr = vgic_get_lr(vcpu, lr);
+                        WARN_ON(vgic_irq_is_edge(vcpu, vlr.irq));
 
-                        vgic_irq_clear_active(vcpu, vlr.irq);
+                        vgic_irq_clear_queued(vcpu, vlr.irq);
                         WARN_ON(vlr.state & LR_STATE_MASK);
                         vlr.state = 0;
                         vgic_set_lr(vcpu, lr, vlr);
 
+                        /*
+                         * If the IRQ was EOIed it was also ACKed and we we
+                         * therefore assume we can clear the soft pending
+                         * state (should it had been set) for this interrupt.
+                         *
+                         * Note: if the IRQ soft pending state was set after
+                         * the IRQ was acked, it actually shouldn't be
+                         * cleared, but we have no way of knowing that unless
+                         * we start trapping ACKs when the soft-pending state
+                         * is set.
+                         */
+                        vgic_dist_irq_clear_soft_pend(vcpu, vlr.irq);
+
                         /* Any additional pending interrupt? */
-                        if (vgic_dist_irq_is_pending(vcpu, vlr.irq)) {
+                        if (vgic_dist_irq_get_level(vcpu, vlr.irq)) {
                                 vgic_cpu_irq_set(vcpu, vlr.irq);
                                 level_pending = true;
                         } else {
+                                vgic_dist_irq_clear_pending(vcpu, vlr.irq);
                                 vgic_cpu_irq_clear(vcpu, vlr.irq);
                         }
 
@@ -1315,14 +1516,14 @@ static void __kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
 
                 vlr = vgic_get_lr(vcpu, lr);
 
-                BUG_ON(vlr.irq >= VGIC_NR_IRQS);
+                BUG_ON(vlr.irq >= dist->nr_irqs);
                 vgic_cpu->vgic_irq_lr_map[vlr.irq] = LR_EMPTY;
         }
 
         /* Check if we still have something up our sleeve... */
         pending = find_first_zero_bit(elrsr_ptr, vgic->nr_lr);
         if (level_pending || pending < vgic->nr_lr)
-                set_bit(vcpu->vcpu_id, &dist->irq_pending_on_cpu);
+                set_bit(vcpu->vcpu_id, dist->irq_pending_on_cpu);
 }
 
 void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
@@ -1356,7 +1557,7 @@ int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
         if (!irqchip_in_kernel(vcpu->kvm))
                 return 0;
 
-        return test_bit(vcpu->vcpu_id, &dist->irq_pending_on_cpu);
+        return test_bit(vcpu->vcpu_id, dist->irq_pending_on_cpu);
 }
 
 static void vgic_kick_vcpus(struct kvm *kvm)
@@ -1376,34 +1577,36 @@ static void vgic_kick_vcpus(struct kvm *kvm)
 
 static int vgic_validate_injection(struct kvm_vcpu *vcpu, int irq, int level)
 {
-        int is_edge = vgic_irq_is_edge(vcpu, irq);
-        int state = vgic_dist_irq_is_pending(vcpu, irq);
+        int edge_triggered = vgic_irq_is_edge(vcpu, irq);
 
         /*
          * Only inject an interrupt if:
          * - edge triggered and we have a rising edge
          * - level triggered and we change level
          */
-        if (is_edge)
+        if (edge_triggered) {
+                int state = vgic_dist_irq_is_pending(vcpu, irq);
                 return level > state;
-        else
+        } else {
+                int state = vgic_dist_irq_get_level(vcpu, irq);
                 return level != state;
+        }
 }
 
-static bool vgic_update_irq_state(struct kvm *kvm, int cpuid,
+static bool vgic_update_irq_pending(struct kvm *kvm, int cpuid,
                                   unsigned int irq_num, bool level)
 {
         struct vgic_dist *dist = &kvm->arch.vgic;
         struct kvm_vcpu *vcpu;
-        int is_edge, is_level;
+        int edge_triggered, level_triggered;
         int enabled;
         bool ret = true;
 
         spin_lock(&dist->lock);
 
         vcpu = kvm_get_vcpu(kvm, cpuid);
-        is_edge = vgic_irq_is_edge(vcpu, irq_num);
-        is_level = !is_edge;
+        edge_triggered = vgic_irq_is_edge(vcpu, irq_num);
+        level_triggered = !edge_triggered;
 
         if (!vgic_validate_injection(vcpu, irq_num, level)) {
                 ret = false;
@@ -1417,10 +1620,19 @@ static bool vgic_update_irq_state(struct kvm *kvm, int cpuid,
 
         kvm_debug("Inject IRQ%d level %d CPU%d\n", irq_num, level, cpuid);
 
-        if (level)
-                vgic_dist_irq_set(vcpu, irq_num);
-        else
-                vgic_dist_irq_clear(vcpu, irq_num);
+        if (level) {
+                if (level_triggered)
+                        vgic_dist_irq_set_level(vcpu, irq_num);
+                vgic_dist_irq_set_pending(vcpu, irq_num);
+        } else {
+                if (level_triggered) {
+                        vgic_dist_irq_clear_level(vcpu, irq_num);
+                        if (!vgic_dist_irq_soft_pend(vcpu, irq_num))
+                                vgic_dist_irq_clear_pending(vcpu, irq_num);
+                } else {
+                        vgic_dist_irq_clear_pending(vcpu, irq_num);
+                }
+        }
 
         enabled = vgic_irq_is_enabled(vcpu, irq_num);
 
@@ -1429,7 +1641,7 @@ static bool vgic_update_irq_state(struct kvm *kvm, int cpuid,
                 goto out;
         }
 
-        if (is_level && vgic_irq_is_active(vcpu, irq_num)) {
+        if (!vgic_can_sample_irq(vcpu, irq_num)) {
                 /*
                  * Level interrupt in progress, will be picked up
                  * when EOId.
@@ -1440,7 +1652,7 @@ static bool vgic_update_irq_state(struct kvm *kvm, int cpuid,
 
         if (level) {
                 vgic_cpu_irq_set(vcpu, irq_num);
-                set_bit(cpuid, &dist->irq_pending_on_cpu);
+                set_bit(cpuid, dist->irq_pending_on_cpu);
         }
 
 out:
@@ -1466,7 +1678,8 @@ out:
 int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int irq_num,
                         bool level)
 {
-        if (vgic_update_irq_state(kvm, cpuid, irq_num, level))
+        if (likely(vgic_initialized(kvm)) &&
+            vgic_update_irq_pending(kvm, cpuid, irq_num, level))
                 vgic_kick_vcpus(kvm);
 
         return 0;
@@ -1483,6 +1696,32 @@ static irqreturn_t vgic_maintenance_handler(int irq, void *data)
         return IRQ_HANDLED;
 }
 
+void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
+{
+        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+
+        kfree(vgic_cpu->pending_shared);
+        kfree(vgic_cpu->vgic_irq_lr_map);
+        vgic_cpu->pending_shared = NULL;
+        vgic_cpu->vgic_irq_lr_map = NULL;
+}
+
+static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
+{
+        struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+
+        int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
+        vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
+        vgic_cpu->vgic_irq_lr_map = kzalloc(nr_irqs, GFP_KERNEL);
+
+        if (!vgic_cpu->pending_shared || !vgic_cpu->vgic_irq_lr_map) {
+                kvm_vgic_vcpu_destroy(vcpu);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
 /**
  * kvm_vgic_vcpu_init - Initialize per-vcpu VGIC state
  * @vcpu: pointer to the vcpu struct
@@ -1490,16 +1729,13 @@ static irqreturn_t vgic_maintenance_handler(int irq, void *data)
  * Initialize the vgic_cpu struct and vgic_dist struct fields pertaining to
  * this vcpu and enable the VGIC for this VCPU
  */
-int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
+static void kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
 {
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         int i;
 
-        if (vcpu->vcpu_id >= VGIC_MAX_CPUS)
-                return -EBUSY;
-
-        for (i = 0; i < VGIC_NR_IRQS; i++) {
+        for (i = 0; i < dist->nr_irqs; i++) {
                 if (i < VGIC_NR_PPIS)
                         vgic_bitmap_set_irq_val(&dist->irq_enabled,
                                                 vcpu->vcpu_id, i, 1);
@@ -1518,8 +1754,113 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
         vgic_cpu->nr_lr = vgic->nr_lr;
 
         vgic_enable(vcpu);
+}
 
-        return 0;
+void kvm_vgic_destroy(struct kvm *kvm)
+{
+        struct vgic_dist *dist = &kvm->arch.vgic;
+        struct kvm_vcpu *vcpu;
+        int i;
+
+        kvm_for_each_vcpu(i, vcpu, kvm)
+                kvm_vgic_vcpu_destroy(vcpu);
+
+        vgic_free_bitmap(&dist->irq_enabled);
+        vgic_free_bitmap(&dist->irq_level);
+        vgic_free_bitmap(&dist->irq_pending);
+        vgic_free_bitmap(&dist->irq_soft_pend);
+        vgic_free_bitmap(&dist->irq_queued);
+        vgic_free_bitmap(&dist->irq_cfg);
+        vgic_free_bytemap(&dist->irq_priority);
+        if (dist->irq_spi_target) {
+                for (i = 0; i < dist->nr_cpus; i++)
+                        vgic_free_bitmap(&dist->irq_spi_target[i]);
+        }
+        kfree(dist->irq_sgi_sources);
+        kfree(dist->irq_spi_cpu);
+        kfree(dist->irq_spi_target);
+        kfree(dist->irq_pending_on_cpu);
+        dist->irq_sgi_sources = NULL;
+        dist->irq_spi_cpu = NULL;
+        dist->irq_spi_target = NULL;
+        dist->irq_pending_on_cpu = NULL;
+}
+
+/*
+ * Allocate and initialize the various data structures. Must be called
+ * with kvm->lock held!
+ */
+static int vgic_init_maps(struct kvm *kvm)
+{
+        struct vgic_dist *dist = &kvm->arch.vgic;
+        struct kvm_vcpu *vcpu;
+        int nr_cpus, nr_irqs;
+        int ret, i;
+
+        if (dist->nr_cpus)      /* Already allocated */
+                return 0;
+
+        nr_cpus = dist->nr_cpus = atomic_read(&kvm->online_vcpus);
+        if (!nr_cpus)           /* No vcpus? Can't be good... */
+                return -EINVAL;
+
+        /*
+         * If nobody configured the number of interrupts, use the
+         * legacy one.
+         */
+        if (!dist->nr_irqs)
+                dist->nr_irqs = VGIC_NR_IRQS_LEGACY;
+
+        nr_irqs = dist->nr_irqs;
+
+        ret  = vgic_init_bitmap(&dist->irq_enabled, nr_cpus, nr_irqs);
+        ret |= vgic_init_bitmap(&dist->irq_level, nr_cpus, nr_irqs);
+        ret |= vgic_init_bitmap(&dist->irq_pending, nr_cpus, nr_irqs);
+        ret |= vgic_init_bitmap(&dist->irq_soft_pend, nr_cpus, nr_irqs);
+        ret |= vgic_init_bitmap(&dist->irq_queued, nr_cpus, nr_irqs);
+        ret |= vgic_init_bitmap(&dist->irq_cfg, nr_cpus, nr_irqs);
+        ret |= vgic_init_bytemap(&dist->irq_priority, nr_cpus, nr_irqs);
+
+        if (ret)
+                goto out;
+
+        dist->irq_sgi_sources = kzalloc(nr_cpus * VGIC_NR_SGIS, GFP_KERNEL);
+        dist->irq_spi_cpu = kzalloc(nr_irqs - VGIC_NR_PRIVATE_IRQS, GFP_KERNEL);
+        dist->irq_spi_target = kzalloc(sizeof(*dist->irq_spi_target) * nr_cpus,
+                                       GFP_KERNEL);
+        dist->irq_pending_on_cpu = kzalloc(BITS_TO_LONGS(nr_cpus) * sizeof(long),
+                                           GFP_KERNEL);
+        if (!dist->irq_sgi_sources ||
+            !dist->irq_spi_cpu ||
+            !dist->irq_spi_target ||
+            !dist->irq_pending_on_cpu) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        for (i = 0; i < nr_cpus; i++)
+                ret |= vgic_init_bitmap(&dist->irq_spi_target[i],
+                                        nr_cpus, nr_irqs);
+
+        if (ret)
+                goto out;
+
+        kvm_for_each_vcpu(i, vcpu, kvm) {
+                ret = vgic_vcpu_init_maps(vcpu, nr_irqs);
+                if (ret) {
+                        kvm_err("VGIC: Failed to allocate vcpu memory\n");
+                        break;
+                }
+        }
+
+        for (i = VGIC_NR_PRIVATE_IRQS; i < dist->nr_irqs; i += 4)
+                vgic_set_target_reg(kvm, 0, i);
+
+out:
+        if (ret)
+                kvm_vgic_destroy(kvm);
+
+        return ret;
 }
 
 /**
@@ -1533,6 +1874,7 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
  */
 int kvm_vgic_init(struct kvm *kvm)
 {
+        struct kvm_vcpu *vcpu;
         int ret = 0, i;
 
         if (!irqchip_in_kernel(kvm))
@@ -1550,6 +1892,12 @@ int kvm_vgic_init(struct kvm *kvm)
                 goto out;
         }
 
+        ret = vgic_init_maps(kvm);
+        if (ret) {
+                kvm_err("Unable to allocate maps\n");
+                goto out;
+        }
+
         ret = kvm_phys_addr_ioremap(kvm, kvm->arch.vgic.vgic_cpu_base,
                                     vgic->vcpu_base, KVM_VGIC_V2_CPU_SIZE);
         if (ret) {
@@ -1557,11 +1905,13 @@ int kvm_vgic_init(struct kvm *kvm)
                 goto out;
         }
 
-        for (i = VGIC_NR_PRIVATE_IRQS; i < VGIC_NR_IRQS; i += 4)
-                vgic_set_target_reg(kvm, 0, i);
+        kvm_for_each_vcpu(i, vcpu, kvm)
+                kvm_vgic_vcpu_init(vcpu);
 
         kvm->arch.vgic.ready = true;
 out:
+        if (ret)
+                kvm_vgic_destroy(kvm);
         mutex_unlock(&kvm->lock);
         return ret;
 }
@@ -1613,7 +1963,7 @@ out:
         return ret;
 }
 
-static bool vgic_ioaddr_overlap(struct kvm *kvm)
+static int vgic_ioaddr_overlap(struct kvm *kvm)
 {
         phys_addr_t dist = kvm->arch.vgic.vgic_dist_base;
         phys_addr_t cpu = kvm->arch.vgic.vgic_cpu_base;
@@ -1802,6 +2152,10 @@ static int vgic_attr_regs_access(struct kvm_device *dev,
 
         mutex_lock(&dev->kvm->lock);
 
+        ret = vgic_init_maps(dev->kvm);
+        if (ret)
+                goto out;
+
         if (cpuid >= atomic_read(&dev->kvm->online_vcpus)) {
                 ret = -EINVAL;
                 goto out;
@@ -1899,6 +2253,36 @@ static int vgic_set_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
 
                 return vgic_attr_regs_access(dev, attr, &reg, true);
         }
+        case KVM_DEV_ARM_VGIC_GRP_NR_IRQS: {
+                u32 __user *uaddr = (u32 __user *)(long)attr->addr;
+                u32 val;
+                int ret = 0;
+
+                if (get_user(val, uaddr))
+                        return -EFAULT;
+
+                /*
+                 * We require:
+                 * - at least 32 SPIs on top of the 16 SGIs and 16 PPIs
+                 * - at most 1024 interrupts
+                 * - a multiple of 32 interrupts
+                 */
+                if (val < (VGIC_NR_PRIVATE_IRQS + 32) ||
+                    val > VGIC_MAX_IRQS ||
+                    (val & 31))
+                        return -EINVAL;
+
+                mutex_lock(&dev->kvm->lock);
+
+                if (vgic_initialized(dev->kvm) || dev->kvm->arch.vgic.nr_irqs)
+                        ret = -EBUSY;
+                else
+                        dev->kvm->arch.vgic.nr_irqs = val;
+
+                mutex_unlock(&dev->kvm->lock);
+
+                return ret;
+        }
 
         }
 
@@ -1935,6 +2319,11 @@ static int vgic_get_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
                 r = put_user(reg, uaddr);
                 break;
         }
+        case KVM_DEV_ARM_VGIC_GRP_NR_IRQS: {
+                u32 __user *uaddr = (u32 __user *)(long)attr->addr;
+                r = put_user(dev->kvm->arch.vgic.nr_irqs, uaddr);
+                break;
+        }
 
         }
 
@@ -1971,6 +2360,8 @@ static int vgic_has_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
         case KVM_DEV_ARM_VGIC_GRP_CPU_REGS:
                 offset = attr->attr & KVM_DEV_ARM_VGIC_OFFSET_MASK;
                 return vgic_has_attr_regs(vgic_cpu_ranges, offset);
+        case KVM_DEV_ARM_VGIC_GRP_NR_IRQS:
+                return 0;
         }
         return -ENXIO;
 }
@@ -2029,8 +2420,8 @@ static const struct of_device_id vgic_ids[] = {
 int kvm_vgic_hyp_init(void)
 {
         const struct of_device_id *matched_id;
-        int (*vgic_probe)(struct device_node *,const struct vgic_ops **,
-                          const struct vgic_params **);
+        const int (*vgic_probe)(struct device_node *,const struct vgic_ops **,
+                                const struct vgic_params **);
         struct device_node *vgic_node;
         int ret;
 
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a1cf53ee0d28..39a02fbdb572 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1095,9 +1095,9 @@ EXPORT_SYMBOL_GPL(gfn_to_hva);
  * If writable is set to false, the hva returned by this function is only
  * allowed to be read.
  */
-unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
+unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
+                                      gfn_t gfn, bool *writable)
 {
-        struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
         unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);
 
         if (!kvm_is_error_hva(hva) && writable)
@@ -1106,6 +1106,13 @@ unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
         return hva;
 }
 
+unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
+{
+        struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
+
+        return gfn_to_hva_memslot_prot(slot, gfn, writable);
+}
+
 static int kvm_read_hva(void *data, void __user *hva, int len)
 {
         return __copy_from_user(data, hva, len);