14 files changed, 465 insertions, 185 deletions

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index fdf83afbb7d9..fcaf9c961265 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -337,6 +337,11 @@ struct kvm_pmu {
         u64 reprogram_pmi;
 };
 
+enum {
+        KVM_DEBUGREG_BP_ENABLED = 1,
+        KVM_DEBUGREG_WONT_EXIT = 2,
+};
+
 struct kvm_vcpu_arch {
         /*
          * rip and regs accesses must go through
@@ -444,7 +449,6 @@ struct kvm_vcpu_arch {
         } st;
 
         u64 last_guest_tsc;
-        u64 last_kernel_ns;
         u64 last_host_tsc;
         u64 tsc_offset_adjustment;
         u64 this_tsc_nsec;
@@ -464,7 +468,7 @@ struct kvm_vcpu_arch {
         struct mtrr_state_type mtrr_state;
         u32 pat;
 
-        int switch_db_regs;
+        unsigned switch_db_regs;
         unsigned long db[KVM_NR_DB_REGS];
         unsigned long dr6;
         unsigned long dr7;
@@ -599,6 +603,8 @@ struct kvm_arch {
         bool use_master_clock;
         u64 master_kernel_ns;
         cycle_t master_cycle_now;
+        struct delayed_work kvmclock_update_work;
+        struct delayed_work kvmclock_sync_work;
 
         struct kvm_xen_hvm_config xen_hvm_config;
 
@@ -702,6 +708,7 @@ struct kvm_x86_ops {
         void (*set_gdt)(struct kvm_vcpu *vcpu, struct desc_ptr *dt);
         u64 (*get_dr6)(struct kvm_vcpu *vcpu);
         void (*set_dr6)(struct kvm_vcpu *vcpu, unsigned long value);
+        void (*sync_dirty_debug_regs)(struct kvm_vcpu *vcpu);
         void (*set_dr7)(struct kvm_vcpu *vcpu, unsigned long value);
         void (*cache_reg)(struct kvm_vcpu *vcpu, enum kvm_reg reg);
         unsigned long (*get_rflags)(struct kvm_vcpu *vcpu);
@@ -728,8 +735,8 @@ struct kvm_x86_ops {
         int (*nmi_allowed)(struct kvm_vcpu *vcpu);
         bool (*get_nmi_mask)(struct kvm_vcpu *vcpu);
         void (*set_nmi_mask)(struct kvm_vcpu *vcpu, bool masked);
-        int (*enable_nmi_window)(struct kvm_vcpu *vcpu);
-        int (*enable_irq_window)(struct kvm_vcpu *vcpu);
+        void (*enable_nmi_window)(struct kvm_vcpu *vcpu);
+        void (*enable_irq_window)(struct kvm_vcpu *vcpu);
         void (*update_cr8_intercept)(struct kvm_vcpu *vcpu, int tpr, int irr);
         int (*vm_has_apicv)(struct kvm *kvm);
         void (*hwapic_irr_update)(struct kvm_vcpu *vcpu, int max_irr);
@@ -765,6 +772,9 @@ struct kvm_x86_ops {
                                struct x86_instruction_info *info,
                                enum x86_intercept_stage stage);
         void (*handle_external_intr)(struct kvm_vcpu *vcpu);
+        bool (*mpx_supported)(void);
+
+        int (*check_nested_events)(struct kvm_vcpu *vcpu, bool external_intr);
 };
 
 struct kvm_arch_async_pf {
diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
index 2067264fb7f5..7004d21e6219 100644
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -85,6 +85,7 @@
 #define VM_EXIT_SAVE_IA32_EFER                  0x00100000
 #define VM_EXIT_LOAD_IA32_EFER                  0x00200000
 #define VM_EXIT_SAVE_VMX_PREEMPTION_TIMER       0x00400000
+#define VM_EXIT_CLEAR_BNDCFGS                   0x00800000
 
 #define VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR       0x00036dff
 
@@ -95,6 +96,7 @@
 #define VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL     0x00002000
 #define VM_ENTRY_LOAD_IA32_PAT                  0x00004000
 #define VM_ENTRY_LOAD_IA32_EFER                 0x00008000
+#define VM_ENTRY_LOAD_BNDCFGS                   0x00010000
 
 #define VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR      0x000011ff
 
@@ -174,6 +176,8 @@ enum vmcs_field {
         GUEST_PDPTR2_HIGH               = 0x0000280f,
         GUEST_PDPTR3                    = 0x00002810,
         GUEST_PDPTR3_HIGH               = 0x00002811,
+        GUEST_BNDCFGS                   = 0x00002812,
+        GUEST_BNDCFGS_HIGH              = 0x00002813,
         HOST_IA32_PAT                   = 0x00002c00,
         HOST_IA32_PAT_HIGH              = 0x00002c01,
         HOST_IA32_EFER                  = 0x00002c02,
diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
index 6c1d7411eb00..d949ef28c48b 100644
--- a/arch/x86/include/asm/xsave.h
+++ b/arch/x86/include/asm/xsave.h
@@ -16,6 +16,8 @@
 #define XSTATE_Hi16_ZMM         0x80
 
 #define XSTATE_FPSSE    (XSTATE_FP | XSTATE_SSE)
+/* Bit 63 of XCR0 is reserved for future expansion */
+#define XSTATE_EXTEND_MASK      (~(XSTATE_FPSSE | (1ULL << 63)))
 
 #define FXSAVE_SIZE     512
 
diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
index 4924f4be2b99..c827ace3121b 100644
--- a/arch/x86/include/uapi/asm/msr-index.h
+++ b/arch/x86/include/uapi/asm/msr-index.h
@@ -295,6 +295,7 @@
 #define MSR_SMI_COUNT                   0x00000034
 #define MSR_IA32_FEATURE_CONTROL        0x0000003a
 #define MSR_IA32_TSC_ADJUST             0x0000003b
+#define MSR_IA32_BNDCFGS                0x00000d90
 
 #define FEATURE_CONTROL_LOCKED                          (1<<0)
 #define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX        (1<<1)
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 713f1b3bad52..0331cb389d68 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -417,7 +417,6 @@ void kvm_disable_steal_time(void)
 #ifdef CONFIG_SMP
 static void __init kvm_smp_prepare_boot_cpu(void)
 {
-        WARN_ON(kvm_register_clock("primary cpu clock"));
         kvm_guest_cpu_init();
         native_smp_prepare_boot_cpu();
         kvm_spinlock_init();
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index e6041094ff26..d9156ceecdff 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -242,7 +242,7 @@ void __init kvmclock_init(void)
         hv_clock = __va(mem);
         memset(hv_clock, 0, size);
 
-        if (kvm_register_clock("boot clock")) {
+        if (kvm_register_clock("primary cpu clock")) {
                 hv_clock = NULL;
                 memblock_free(mem, size);
                 return;
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index e5503d8aec1d..bea60671ef8a 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -28,7 +28,7 @@ static u32 xstate_required_size(u64 xstate_bv)
         int feature_bit = 0;
         u32 ret = XSAVE_HDR_SIZE + XSAVE_HDR_OFFSET;
 
-        xstate_bv &= ~XSTATE_FPSSE;
+        xstate_bv &= XSTATE_EXTEND_MASK;
         while (xstate_bv) {
                 if (xstate_bv & 0x1) {
                         u32 eax, ebx, ecx, edx;
@@ -43,6 +43,16 @@ static u32 xstate_required_size(u64 xstate_bv)
         return ret;
 }
 
+u64 kvm_supported_xcr0(void)
+{
+        u64 xcr0 = KVM_SUPPORTED_XCR0 & host_xcr0;
+
+        if (!kvm_x86_ops->mpx_supported())
+                xcr0 &= ~(XSTATE_BNDREGS | XSTATE_BNDCSR);
+
+        return xcr0;
+}
+
 void kvm_update_cpuid(struct kvm_vcpu *vcpu)
 {
         struct kvm_cpuid_entry2 *best;
@@ -73,9 +83,9 @@ void kvm_update_cpuid(struct kvm_vcpu *vcpu)
         } else {
                 vcpu->arch.guest_supported_xcr0 =
                         (best->eax | ((u64)best->edx << 32)) &
-                        host_xcr0 & KVM_SUPPORTED_XCR0;
-                vcpu->arch.guest_xstate_size =
-                        xstate_required_size(vcpu->arch.guest_supported_xcr0);
+                        kvm_supported_xcr0();
+                vcpu->arch.guest_xstate_size = best->ebx =
+                        xstate_required_size(vcpu->arch.xcr0);
         }
 
         kvm_pmu_cpuid_update(vcpu);
@@ -210,13 +220,6 @@ static void do_cpuid_1_ent(struct kvm_cpuid_entry2 *entry, u32 function,
         entry->flags = 0;
 }
 
-static bool supported_xcr0_bit(unsigned bit)
-{
-        u64 mask = ((u64)1 << bit);
-
-        return mask & KVM_SUPPORTED_XCR0 & host_xcr0;
-}
-
 #define F(x) bit(X86_FEATURE_##x)
 
 static int __do_cpuid_ent_emulated(struct kvm_cpuid_entry2 *entry,
@@ -256,6 +259,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
 #endif
         unsigned f_rdtscp = kvm_x86_ops->rdtscp_supported() ? F(RDTSCP) : 0;
         unsigned f_invpcid = kvm_x86_ops->invpcid_supported() ? F(INVPCID) : 0;
+        unsigned f_mpx = kvm_x86_ops->mpx_supported() ? F(MPX) : 0;
 
         /* cpuid 1.edx */
         const u32 kvm_supported_word0_x86_features =
@@ -303,7 +307,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
         /* cpuid 7.0.ebx */
         const u32 kvm_supported_word9_x86_features =
                 F(FSGSBASE) | F(BMI1) | F(HLE) | F(AVX2) | F(SMEP) |
-                F(BMI2) | F(ERMS) | f_invpcid | F(RTM);
+                F(BMI2) | F(ERMS) | f_invpcid | F(RTM) | f_mpx | F(RDSEED) |
+                F(ADX);
 
         /* all calls to cpuid_count() should be made on the same cpu */
         get_cpu();
@@ -436,16 +441,18 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
         }
         case 0xd: {
                 int idx, i;
+                u64 supported = kvm_supported_xcr0();
 
-                entry->eax &= host_xcr0 & KVM_SUPPORTED_XCR0;
-                entry->edx &= (host_xcr0 & KVM_SUPPORTED_XCR0) >> 32;
+                entry->eax &= supported;
+                entry->edx &= supported >> 32;
                 entry->flags |= KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
                 for (idx = 1, i = 1; idx < 64; ++idx) {
+                        u64 mask = ((u64)1 << idx);
                         if (*nent >= maxnent)
                                 goto out;
 
                         do_cpuid_1_ent(&entry[i], function, idx);
-                        if (entry[i].eax == 0 || !supported_xcr0_bit(idx))
+                        if (entry[i].eax == 0 || !(supported & mask))
                                 continue;
                         entry[i].flags |=
                                KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 07ffca0a89e9..205b17eed93c 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3668,6 +3668,10 @@ static const struct gprefix pfx_vmovntpx = {
         I(0, em_mov), N, N, N,
 };
 
+static const struct gprefix pfx_0f_28_0f_29 = {
+        I(Aligned, em_mov), I(Aligned, em_mov), N, N,
+};
+
 static const struct escape escape_d9 = { {
         N, N, N, N, N, N, N, I(DstMem, em_fnstcw),
 }, {
@@ -3870,7 +3874,9 @@ static const struct opcode twobyte_table[256] = {
         IIP(ModRM | SrcMem | Priv | Op3264, em_cr_write, cr_write, check_cr_write),
         IIP(ModRM | SrcMem | Priv | Op3264, em_dr_write, dr_write, check_dr_write),
         N, N, N, N,
-        N, N, N, GP(ModRM | DstMem | SrcReg | Sse | Mov | Aligned, &pfx_vmovntpx),
+        GP(ModRM | DstReg | SrcMem | Mov | Sse, &pfx_0f_28_0f_29),
+        GP(ModRM | DstMem | SrcReg | Mov | Sse, &pfx_0f_28_0f_29),
+        N, GP(ModRM | DstMem | SrcReg | Sse | Mov | Aligned, &pfx_vmovntpx),
         N, N, N, N,
         /* 0x30 - 0x3F */
         II(ImplicitOps | Priv, em_wrmsr, wrmsr),
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 9b531351a587..f5704d9e5ddc 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3329,7 +3329,7 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
         arch.direct_map = vcpu->arch.mmu.direct_map;
         arch.cr3 = vcpu->arch.mmu.get_cr3(vcpu);
 
-        return kvm_setup_async_pf(vcpu, gva, gfn, &arch);
+        return kvm_setup_async_pf(vcpu, gva, gfn_to_hva(vcpu->kvm, gfn), &arch);
 }
 
 static bool can_do_async_pf(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index cba218a2f08d..b1e6c1bf68d3 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -913,7 +913,8 @@ static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gva_t vaddr,
  *   and kvm_mmu_notifier_invalidate_range_start detect the mapping page isn't
  *   used by guest then tlbs are not flushed, so guest is allowed to access the
  *   freed pages.
- *   And we increase kvm->tlbs_dirty to delay tlbs flush in this case.
+ *   We set tlbs_dirty to let the notifier know this change and delay the flush
+ *   until such a case actually happens.
  */
 static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 {
@@ -942,7 +943,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
                         return -EINVAL;
 
                 if (FNAME(prefetch_invalid_gpte)(vcpu, sp, &sp->spt[i], gpte)) {
-                        vcpu->kvm->tlbs_dirty++;
+                        vcpu->kvm->tlbs_dirty = true;
                         continue;
                 }
 
@@ -957,7 +958,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 
                 if (gfn != sp->gfns[i]) {
                         drop_spte(vcpu->kvm, &sp->spt[i]);
-                        vcpu->kvm->tlbs_dirty++;
+                        vcpu->kvm->tlbs_dirty = true;
                         continue;
                 }
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 2de1bc09a8d4..7f4f9c2badae 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -34,6 +34,7 @@
 #include <asm/perf_event.h>
 #include <asm/tlbflush.h>
 #include <asm/desc.h>
+#include <asm/debugreg.h>
 #include <asm/kvm_para.h>
 
 #include <asm/virtext.h>
@@ -303,20 +304,35 @@ static inline bool is_cr_intercept(struct vcpu_svm *svm, int bit)
         return vmcb->control.intercept_cr & (1U << bit);
 }
 
-static inline void set_dr_intercept(struct vcpu_svm *svm, int bit)
+static inline void set_dr_intercepts(struct vcpu_svm *svm)
 {
         struct vmcb *vmcb = get_host_vmcb(svm);
 
-        vmcb->control.intercept_dr |= (1U << bit);
+        vmcb->control.intercept_dr = (1 << INTERCEPT_DR0_READ)
+                | (1 << INTERCEPT_DR1_READ)
+                | (1 << INTERCEPT_DR2_READ)
+                | (1 << INTERCEPT_DR3_READ)
+                | (1 << INTERCEPT_DR4_READ)
+                | (1 << INTERCEPT_DR5_READ)
+                | (1 << INTERCEPT_DR6_READ)
+                | (1 << INTERCEPT_DR7_READ)
+                | (1 << INTERCEPT_DR0_WRITE)
+                | (1 << INTERCEPT_DR1_WRITE)
+                | (1 << INTERCEPT_DR2_WRITE)
+                | (1 << INTERCEPT_DR3_WRITE)
+                | (1 << INTERCEPT_DR4_WRITE)
+                | (1 << INTERCEPT_DR5_WRITE)
+                | (1 << INTERCEPT_DR6_WRITE)
+                | (1 << INTERCEPT_DR7_WRITE);
 
         recalc_intercepts(svm);
 }
 
-static inline void clr_dr_intercept(struct vcpu_svm *svm, int bit)
+static inline void clr_dr_intercepts(struct vcpu_svm *svm)
 {
         struct vmcb *vmcb = get_host_vmcb(svm);
 
-        vmcb->control.intercept_dr &= ~(1U << bit);
+        vmcb->control.intercept_dr = 0;
 
         recalc_intercepts(svm);
 }
@@ -1080,23 +1096,7 @@ static void init_vmcb(struct vcpu_svm *svm)
         set_cr_intercept(svm, INTERCEPT_CR4_WRITE);
         set_cr_intercept(svm, INTERCEPT_CR8_WRITE);
 
-        set_dr_intercept(svm, INTERCEPT_DR0_READ);
-        set_dr_intercept(svm, INTERCEPT_DR1_READ);
-        set_dr_intercept(svm, INTERCEPT_DR2_READ);
-        set_dr_intercept(svm, INTERCEPT_DR3_READ);
-        set_dr_intercept(svm, INTERCEPT_DR4_READ);
-        set_dr_intercept(svm, INTERCEPT_DR5_READ);
-        set_dr_intercept(svm, INTERCEPT_DR6_READ);
-        set_dr_intercept(svm, INTERCEPT_DR7_READ);
-
-        set_dr_intercept(svm, INTERCEPT_DR0_WRITE);
-        set_dr_intercept(svm, INTERCEPT_DR1_WRITE);
-        set_dr_intercept(svm, INTERCEPT_DR2_WRITE);
-        set_dr_intercept(svm, INTERCEPT_DR3_WRITE);
-        set_dr_intercept(svm, INTERCEPT_DR4_WRITE);
-        set_dr_intercept(svm, INTERCEPT_DR5_WRITE);
-        set_dr_intercept(svm, INTERCEPT_DR6_WRITE);
-        set_dr_intercept(svm, INTERCEPT_DR7_WRITE);
+        set_dr_intercepts(svm);
 
         set_exception_intercept(svm, PF_VECTOR);
         set_exception_intercept(svm, UD_VECTOR);
@@ -1684,6 +1684,21 @@ static void svm_set_dr6(struct kvm_vcpu *vcpu, unsigned long value)
         mark_dirty(svm->vmcb, VMCB_DR);
 }
 
+static void svm_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_svm *svm = to_svm(vcpu);
+
+        get_debugreg(vcpu->arch.db[0], 0);
+        get_debugreg(vcpu->arch.db[1], 1);
+        get_debugreg(vcpu->arch.db[2], 2);
+        get_debugreg(vcpu->arch.db[3], 3);
+        vcpu->arch.dr6 = svm_get_dr6(vcpu);
+        vcpu->arch.dr7 = svm->vmcb->save.dr7;
+
+        vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
+        set_dr_intercepts(svm);
+}
+
 static void svm_set_dr7(struct kvm_vcpu *vcpu, unsigned long value)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
@@ -2842,6 +2857,7 @@ static int iret_interception(struct vcpu_svm *svm)
         clr_intercept(svm, INTERCEPT_IRET);
         svm->vcpu.arch.hflags |= HF_IRET_MASK;
         svm->nmi_iret_rip = kvm_rip_read(&svm->vcpu);
+        kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
         return 1;
 }
 
@@ -2974,6 +2990,17 @@ static int dr_interception(struct vcpu_svm *svm)
         unsigned long val;
         int err;
 
+        if (svm->vcpu.guest_debug == 0) {
+                /*
+                 * No more DR vmexits; force a reload of the debug registers
+                 * and reenter on this instruction.  The next vmexit will
+                 * retrieve the full state of the debug registers.
+                 */
+                clr_dr_intercepts(svm);
+                svm->vcpu.arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
+                return 1;
+        }
+
         if (!boot_cpu_has(X86_FEATURE_DECODEASSISTS))
                 return emulate_on_interception(svm);
 
@@ -3649,7 +3676,7 @@ static int svm_interrupt_allowed(struct kvm_vcpu *vcpu)
         return ret;
 }
 
-static int enable_irq_window(struct kvm_vcpu *vcpu)
+static void enable_irq_window(struct kvm_vcpu *vcpu)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
@@ -3663,16 +3690,15 @@ static int enable_irq_window(struct kvm_vcpu *vcpu)
                 svm_set_vintr(svm);
                 svm_inject_irq(svm, 0x0);
         }
-        return 0;
 }
 
-static int enable_nmi_window(struct kvm_vcpu *vcpu)
+static void enable_nmi_window(struct kvm_vcpu *vcpu)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
         if ((svm->vcpu.arch.hflags & (HF_NMI_MASK | HF_IRET_MASK))
             == HF_NMI_MASK)
-                return 0; /* IRET will cause a vm exit */
+                return; /* IRET will cause a vm exit */
 
         /*
          * Something prevents NMI from been injected. Single step over possible
@@ -3681,7 +3707,6 @@ static int enable_nmi_window(struct kvm_vcpu *vcpu)
         svm->nmi_singlestep = true;
         svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
         update_db_bp_intercept(vcpu);
-        return 0;
 }
 
 static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
@@ -4064,6 +4089,11 @@ static bool svm_invpcid_supported(void)
         return false;
 }
 
+static bool svm_mpx_supported(void)
+{
+        return false;
+}
+
 static bool svm_has_wbinvd_exit(void)
 {
         return true;
@@ -4302,6 +4332,7 @@ static struct kvm_x86_ops svm_x86_ops = {
         .get_dr6 = svm_get_dr6,
         .set_dr6 = svm_set_dr6,
         .set_dr7 = svm_set_dr7,
+        .sync_dirty_debug_regs = svm_sync_dirty_debug_regs,
         .cache_reg = svm_cache_reg,
         .get_rflags = svm_get_rflags,
         .set_rflags = svm_set_rflags,
@@ -4345,6 +4376,7 @@ static struct kvm_x86_ops svm_x86_ops = {
 
         .rdtscp_supported = svm_rdtscp_supported,
         .invpcid_supported = svm_invpcid_supported,
+        .mpx_supported = svm_mpx_supported,
 
         .set_supported_cpuid = svm_set_supported_cpuid,
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 392752834751..1320e0f8e611 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -31,6 +31,7 @@
 #include <linux/ftrace_event.h>
 #include <linux/slab.h>
 #include <linux/tboot.h>
+#include <linux/hrtimer.h>
 #include "kvm_cache_regs.h"
 #include "x86.h"
 
@@ -42,6 +43,7 @@
 #include <asm/i387.h>
 #include <asm/xcr.h>
 #include <asm/perf_event.h>
+#include <asm/debugreg.h>
 #include <asm/kexec.h>
 
 #include "trace.h"
@@ -110,6 +112,8 @@ module_param(nested, bool, S_IRUGO);
 
 #define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM))
 
+#define VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE 5
+
 /*
  * These 2 parameters are used to config the controls for Pause-Loop Exiting:
  * ple_gap:    upper bound on the amount of time between two successive
@@ -202,6 +206,7 @@ struct __packed vmcs12 {
         u64 guest_pdptr1;
         u64 guest_pdptr2;
         u64 guest_pdptr3;
+        u64 guest_bndcfgs;
         u64 host_ia32_pat;
         u64 host_ia32_efer;
         u64 host_ia32_perf_global_ctrl;
@@ -374,6 +379,9 @@ struct nested_vmx {
          */
         struct page *apic_access_page;
         u64 msr_ia32_feature_control;
+
+        struct hrtimer preemption_timer;
+        bool preemption_timer_expired;
 };
 
 #define POSTED_INTR_ON  0
@@ -441,6 +449,7 @@ struct vcpu_vmx {
 #endif
                 int           gs_ldt_reload_needed;
                 int           fs_reload_needed;
+                u64           msr_host_bndcfgs;
         } host_state;
         struct {
                 int vm86_active;
@@ -533,6 +542,7 @@ static const unsigned long shadow_read_write_fields[] = {
         GUEST_CS_LIMIT,
         GUEST_CS_BASE,
         GUEST_ES_BASE,
+        GUEST_BNDCFGS,
         CR0_GUEST_HOST_MASK,
         CR0_READ_SHADOW,
         CR4_READ_SHADOW,
@@ -588,6 +598,7 @@ static const unsigned short vmcs_field_to_offset_table[] = {
         FIELD64(GUEST_PDPTR1, guest_pdptr1),
         FIELD64(GUEST_PDPTR2, guest_pdptr2),
         FIELD64(GUEST_PDPTR3, guest_pdptr3),
+        FIELD64(GUEST_BNDCFGS, guest_bndcfgs),
         FIELD64(HOST_IA32_PAT, host_ia32_pat),
         FIELD64(HOST_IA32_EFER, host_ia32_efer),
         FIELD64(HOST_IA32_PERF_GLOBAL_CTRL, host_ia32_perf_global_ctrl),
@@ -718,6 +729,7 @@ static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu);
 static u64 construct_eptp(unsigned long root_hpa);
 static void kvm_cpu_vmxon(u64 addr);
 static void kvm_cpu_vmxoff(void);
+static bool vmx_mpx_supported(void);
 static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
 static void vmx_set_segment(struct kvm_vcpu *vcpu,
                             struct kvm_segment *var, int seg);
@@ -728,6 +740,7 @@ static u32 vmx_segment_access_rights(struct kvm_segment *var);
 static void vmx_sync_pir_to_irr_dummy(struct kvm_vcpu *vcpu);
 static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx);
 static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx);
+static bool vmx_mpx_supported(void);
 
 static DEFINE_PER_CPU(struct vmcs *, vmxarea);
 static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
@@ -1047,6 +1060,12 @@ static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
         return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
 }
 
+static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
+{
+        return vmcs12->pin_based_vm_exec_control &
+                PIN_BASED_VMX_PREEMPTION_TIMER;
+}
+
 static inline int nested_cpu_has_ept(struct vmcs12 *vmcs12)
 {
         return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_EPT);
@@ -1710,6 +1729,8 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
         if (is_long_mode(&vmx->vcpu))
                 wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
 #endif
+        if (boot_cpu_has(X86_FEATURE_MPX))
+                rdmsrl(MSR_IA32_BNDCFGS, vmx->host_state.msr_host_bndcfgs);
         for (i = 0; i < vmx->save_nmsrs; ++i)
                 kvm_set_shared_msr(vmx->guest_msrs[i].index,
                                    vmx->guest_msrs[i].data,
@@ -1747,6 +1768,8 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx)
 #ifdef CONFIG_X86_64
         wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
 #endif
+        if (vmx->host_state.msr_host_bndcfgs)
+                wrmsrl(MSR_IA32_BNDCFGS, vmx->host_state.msr_host_bndcfgs);
         /*
          * If the FPU is not active (through the host task or
          * the guest vcpu), then restore the cr0.TS bit.
@@ -2248,9 +2271,9 @@ static __init void nested_vmx_setup_ctls_msrs(void)
          */
         nested_vmx_pinbased_ctls_low |= PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
         nested_vmx_pinbased_ctls_high &= PIN_BASED_EXT_INTR_MASK |
-                PIN_BASED_NMI_EXITING | PIN_BASED_VIRTUAL_NMIS |
+                PIN_BASED_NMI_EXITING | PIN_BASED_VIRTUAL_NMIS;
+        nested_vmx_pinbased_ctls_high |= PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR |
                 PIN_BASED_VMX_PREEMPTION_TIMER;
-        nested_vmx_pinbased_ctls_high |= PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
 
         /*
          * Exit controls
@@ -2265,15 +2288,12 @@ static __init void nested_vmx_setup_ctls_msrs(void)
 #ifdef CONFIG_X86_64
                 VM_EXIT_HOST_ADDR_SPACE_SIZE |
 #endif
-                VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT |
+                VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT;
+        nested_vmx_exit_ctls_high |= VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR |
+                VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
                 VM_EXIT_SAVE_VMX_PREEMPTION_TIMER;
-        if (!(nested_vmx_pinbased_ctls_high & PIN_BASED_VMX_PREEMPTION_TIMER) ||
-            !(nested_vmx_exit_ctls_high & VM_EXIT_SAVE_VMX_PREEMPTION_TIMER)) {
-                nested_vmx_exit_ctls_high &= ~VM_EXIT_SAVE_VMX_PREEMPTION_TIMER;
-                nested_vmx_pinbased_ctls_high &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
-        }
-        nested_vmx_exit_ctls_high |= (VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR |
-                VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER);
+        if (vmx_mpx_supported())
+                nested_vmx_exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
 
         /* entry controls */
         rdmsr(MSR_IA32_VMX_ENTRY_CTLS,
@@ -2287,6 +2307,8 @@ static __init void nested_vmx_setup_ctls_msrs(void)
                 VM_ENTRY_LOAD_IA32_PAT;
         nested_vmx_entry_ctls_high |= (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR |
                                        VM_ENTRY_LOAD_IA32_EFER);
+        if (vmx_mpx_supported())
+                nested_vmx_entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
 
         /* cpu-based controls */
         rdmsr(MSR_IA32_VMX_PROCBASED_CTLS,
@@ -2342,9 +2364,9 @@ static __init void nested_vmx_setup_ctls_msrs(void)
 
         /* miscellaneous data */
         rdmsr(MSR_IA32_VMX_MISC, nested_vmx_misc_low, nested_vmx_misc_high);
-        nested_vmx_misc_low &= VMX_MISC_PREEMPTION_TIMER_RATE_MASK |
-                VMX_MISC_SAVE_EFER_LMA;
-        nested_vmx_misc_low |= VMX_MISC_ACTIVITY_HLT;
+        nested_vmx_misc_low &= VMX_MISC_SAVE_EFER_LMA;
+        nested_vmx_misc_low |= VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE |
+                VMX_MISC_ACTIVITY_HLT;
         nested_vmx_misc_high = 0;
 }
 
@@ -2479,6 +2501,11 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
         case MSR_IA32_SYSENTER_ESP:
                 data = vmcs_readl(GUEST_SYSENTER_ESP);
                 break;
+        case MSR_IA32_BNDCFGS:
+                if (!vmx_mpx_supported())
+                        return 1;
+                data = vmcs_read64(GUEST_BNDCFGS);
+                break;
         case MSR_IA32_FEATURE_CONTROL:
                 if (!nested_vmx_allowed(vcpu))
                         return 1;
@@ -2547,6 +2574,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
         case MSR_IA32_SYSENTER_ESP:
                 vmcs_writel(GUEST_SYSENTER_ESP, data);
                 break;
+        case MSR_IA32_BNDCFGS:
+                if (!vmx_mpx_supported())
+                        return 1;
+                vmcs_write64(GUEST_BNDCFGS, data);
+                break;
         case MSR_IA32_TSC:
                 kvm_write_tsc(vcpu, msr_info);
                 break;
@@ -2832,12 +2864,12 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
                       vmx_capability.ept, vmx_capability.vpid);
         }
 
-        min = 0;
+        min = VM_EXIT_SAVE_DEBUG_CONTROLS;
 #ifdef CONFIG_X86_64
         min |= VM_EXIT_HOST_ADDR_SPACE_SIZE;
 #endif
         opt = VM_EXIT_SAVE_IA32_PAT | VM_EXIT_LOAD_IA32_PAT |
-                VM_EXIT_ACK_INTR_ON_EXIT;
+                VM_EXIT_ACK_INTR_ON_EXIT | VM_EXIT_CLEAR_BNDCFGS;
         if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_EXIT_CTLS,
                                 &_vmexit_control) < 0)
                 return -EIO;
@@ -2853,8 +2885,8 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
                 !(_vmexit_control & VM_EXIT_ACK_INTR_ON_EXIT))
                 _pin_based_exec_control &= ~PIN_BASED_POSTED_INTR;
 
-        min = 0;
-        opt = VM_ENTRY_LOAD_IA32_PAT;
+        min = VM_ENTRY_LOAD_DEBUG_CONTROLS;
+        opt = VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS;
         if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_ENTRY_CTLS,
                                 &_vmentry_control) < 0)
                 return -EIO;
@@ -4223,6 +4255,10 @@ static u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
 static u32 vmx_exec_control(struct vcpu_vmx *vmx)
 {
         u32 exec_control = vmcs_config.cpu_based_exec_ctrl;
+
+        if (vmx->vcpu.arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)
+                exec_control &= ~CPU_BASED_MOV_DR_EXITING;
+
         if (!vm_need_tpr_shadow(vmx->vcpu.kvm)) {
                 exec_control &= ~CPU_BASED_TPR_SHADOW;
 #ifdef CONFIG_X86_64
@@ -4496,39 +4532,28 @@ static bool nested_exit_on_nmi(struct kvm_vcpu *vcpu)
                 PIN_BASED_NMI_EXITING;
 }
 
-static int enable_irq_window(struct kvm_vcpu *vcpu)
+static void enable_irq_window(struct kvm_vcpu *vcpu)
 {
         u32 cpu_based_vm_exec_control;
 
-        if (is_guest_mode(vcpu) && nested_exit_on_intr(vcpu))
-                /*
-                 * We get here if vmx_interrupt_allowed() said we can't
-                 * inject to L1 now because L2 must run. The caller will have
-                 * to make L2 exit right after entry, so we can inject to L1
-                 * more promptly.
-                 */
-                return -EBUSY;
-
         cpu_based_vm_exec_control = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
         cpu_based_vm_exec_control |= CPU_BASED_VIRTUAL_INTR_PENDING;
         vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control);
-        return 0;
 }
 
-static int enable_nmi_window(struct kvm_vcpu *vcpu)
+static void enable_nmi_window(struct kvm_vcpu *vcpu)
 {
         u32 cpu_based_vm_exec_control;
 
-        if (!cpu_has_virtual_nmis())
-                return enable_irq_window(vcpu);
-
-        if (vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI)
-                return enable_irq_window(vcpu);
+        if (!cpu_has_virtual_nmis() ||
+            vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+                enable_irq_window(vcpu);
+                return;
+        }
 
         cpu_based_vm_exec_control = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
         cpu_based_vm_exec_control |= CPU_BASED_VIRTUAL_NMI_PENDING;
         vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control);
-        return 0;
 }
 
 static void vmx_inject_irq(struct kvm_vcpu *vcpu)
@@ -4620,22 +4645,8 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
 
 static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
 {
-        if (is_guest_mode(vcpu)) {
-                if (to_vmx(vcpu)->nested.nested_run_pending)
-                        return 0;
-                if (nested_exit_on_nmi(vcpu)) {
-                        nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
-                                          NMI_VECTOR | INTR_TYPE_NMI_INTR |
-                                          INTR_INFO_VALID_MASK, 0);
-                        /*
-                         * The NMI-triggered VM exit counts as injection:
-                         * clear this one and block further NMIs.
-                         */
-                        vcpu->arch.nmi_pending = 0;
-                        vmx_set_nmi_mask(vcpu, true);
-                        return 0;
-                }
-        }
+        if (to_vmx(vcpu)->nested.nested_run_pending)
+                return 0;
 
         if (!cpu_has_virtual_nmis() && to_vmx(vcpu)->soft_vnmi_blocked)
                 return 0;
@@ -4647,19 +4658,8 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
 
 static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu)
 {
-        if (is_guest_mode(vcpu)) {
-                if (to_vmx(vcpu)->nested.nested_run_pending)
-                        return 0;
-                if (nested_exit_on_intr(vcpu)) {
-                        nested_vmx_vmexit(vcpu, EXIT_REASON_EXTERNAL_INTERRUPT,
-                                          0, 0);
-                        /*
-                         * fall through to normal code, but now in L1, not L2
-                         */
-                }
-        }
-
-        return (vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
+        return (!to_vmx(vcpu)->nested.nested_run_pending &&
+                vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
                 !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
                         (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
 }
@@ -5102,6 +5102,22 @@ static int handle_dr(struct kvm_vcpu *vcpu)
                 }
         }
 
+        if (vcpu->guest_debug == 0) {
+                u32 cpu_based_vm_exec_control;
+
+                cpu_based_vm_exec_control = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+                cpu_based_vm_exec_control &= ~CPU_BASED_MOV_DR_EXITING;
+                vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control);
+
+                /*
+                 * No more DR vmexits; force a reload of the debug registers
+                 * and reenter on this instruction.  The next vmexit will
+                 * retrieve the full state of the debug registers.
+                 */
+                vcpu->arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
+                return 1;
+        }
+
         exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
         dr = exit_qualification & DEBUG_REG_ACCESS_NUM;
         reg = DEBUG_REG_ACCESS_REG(exit_qualification);
@@ -5128,6 +5144,24 @@ static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val)
 {
 }
 
+static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
+{
+        u32 cpu_based_vm_exec_control;
+
+        get_debugreg(vcpu->arch.db[0], 0);
+        get_debugreg(vcpu->arch.db[1], 1);
+        get_debugreg(vcpu->arch.db[2], 2);
+        get_debugreg(vcpu->arch.db[3], 3);
+        get_debugreg(vcpu->arch.dr6, 6);
+        vcpu->arch.dr7 = vmcs_readl(GUEST_DR7);
+
+        vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
+
+        cpu_based_vm_exec_control = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+        cpu_based_vm_exec_control |= CPU_BASED_MOV_DR_EXITING;
+        vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control);
+}
+
 static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val)
 {
         vmcs_writel(GUEST_DR7, val);
@@ -5727,6 +5761,18 @@ static void nested_vmx_failValid(struct kvm_vcpu *vcpu,
          */
 }
 
+static enum hrtimer_restart vmx_preemption_timer_fn(struct hrtimer *timer)
+{
+        struct vcpu_vmx *vmx =
+                container_of(timer, struct vcpu_vmx, nested.preemption_timer);
+
+        vmx->nested.preemption_timer_expired = true;
+        kvm_make_request(KVM_REQ_EVENT, &vmx->vcpu);
+        kvm_vcpu_kick(&vmx->vcpu);
+
+        return HRTIMER_NORESTART;
+}
+
 /*
  * Emulate the VMXON instruction.
  * Currently, we just remember that VMX is active, and do not save or even
@@ -5791,6 +5837,10 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
         INIT_LIST_HEAD(&(vmx->nested.vmcs02_pool));
         vmx->nested.vmcs02_num = 0;
 
+        hrtimer_init(&vmx->nested.preemption_timer, CLOCK_MONOTONIC,
+                     HRTIMER_MODE_REL);
+        vmx->nested.preemption_timer.function = vmx_preemption_timer_fn;
+
         vmx->nested.vmxon = true;
 
         skip_emulated_instruction(vcpu);
@@ -6767,9 +6817,6 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                  * table is L0's fault.
                  */
                 return 0;
-        case EXIT_REASON_PREEMPTION_TIMER:
-                return vmcs12->pin_based_vm_exec_control &
-                        PIN_BASED_VMX_PREEMPTION_TIMER;
         case EXIT_REASON_WBINVD:
                 return nested_cpu_has2(vmcs12, SECONDARY_EXEC_WBINVD_EXITING);
         case EXIT_REASON_XSETBV:
@@ -6785,27 +6832,6 @@ static void vmx_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
         *info2 = vmcs_read32(VM_EXIT_INTR_INFO);
 }
 
-static void nested_adjust_preemption_timer(struct kvm_vcpu *vcpu)
-{
-        u64 delta_tsc_l1;
-        u32 preempt_val_l1, preempt_val_l2, preempt_scale;
-
-        if (!(get_vmcs12(vcpu)->pin_based_vm_exec_control &
-                        PIN_BASED_VMX_PREEMPTION_TIMER))
-                return;
-        preempt_scale = native_read_msr(MSR_IA32_VMX_MISC) &
-                        MSR_IA32_VMX_MISC_PREEMPTION_TIMER_SCALE;
-        preempt_val_l2 = vmcs_read32(VMX_PREEMPTION_TIMER_VALUE);
-        delta_tsc_l1 = vmx_read_l1_tsc(vcpu, native_read_tsc())
-                - vcpu->arch.last_guest_tsc;
-        preempt_val_l1 = delta_tsc_l1 >> preempt_scale;
-        if (preempt_val_l2 <= preempt_val_l1)
-                preempt_val_l2 = 0;
-        else
-                preempt_val_l2 -= preempt_val_l1;
-        vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, preempt_val_l2);
-}
-
 /*
  * The guest has exited.  See if we can fix it or if we need userspace
  * assistance.
@@ -7052,6 +7078,12 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu)
                 local_irq_enable();
 }
 
+static bool vmx_mpx_supported(void)
+{
+        return (vmcs_config.vmexit_ctrl & VM_EXIT_CLEAR_BNDCFGS) &&
+                (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS);
+}
+
 static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
 {
         u32 exit_intr_info;
@@ -7218,8 +7250,6 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
         atomic_switch_perf_msrs(vmx);
         debugctlmsr = get_debugctlmsr();
 
-        if (is_guest_mode(vcpu) && !vmx->nested.nested_run_pending)
-                nested_adjust_preemption_timer(vcpu);
         vmx->__launched = vmx->loaded_vmcs->launched;
         asm(
                 /* Store host registers */
@@ -7616,6 +7646,28 @@ static void vmx_inject_page_fault_nested(struct kvm_vcpu *vcpu,
                 kvm_inject_page_fault(vcpu, fault);
 }
 
+static void vmx_start_preemption_timer(struct kvm_vcpu *vcpu)
+{
+        u64 preemption_timeout = get_vmcs12(vcpu)->vmx_preemption_timer_value;
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+        if (vcpu->arch.virtual_tsc_khz == 0)
+                return;
+
+        /* Make sure short timeouts reliably trigger an immediate vmexit.
+         * hrtimer_start does not guarantee this. */
+        if (preemption_timeout <= 1) {
+                vmx_preemption_timer_fn(&vmx->nested.preemption_timer);
+                return;
+        }
+
+        preemption_timeout <<= VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE;
+        preemption_timeout *= 1000000;
+        do_div(preemption_timeout, vcpu->arch.virtual_tsc_khz);
+        hrtimer_start(&vmx->nested.preemption_timer,
+                      ns_to_ktime(preemption_timeout), HRTIMER_MODE_REL);
+}
+
 /*
  * prepare_vmcs02 is called when the L1 guest hypervisor runs its nested
  * L2 guest. L1 has a vmcs for L2 (vmcs12), and this function "merges" it
@@ -7629,7 +7681,6 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         u32 exec_control;
-        u32 exit_control;
 
         vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
         vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
@@ -7687,13 +7738,14 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
 
         vmcs_write64(VMCS_LINK_POINTER, -1ull);
 
-        vmcs_write32(PIN_BASED_VM_EXEC_CONTROL,
-                (vmcs_config.pin_based_exec_ctrl |
-                 vmcs12->pin_based_vm_exec_control));
+        exec_control = vmcs12->pin_based_vm_exec_control;
+        exec_control |= vmcs_config.pin_based_exec_ctrl;
+        exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+        vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, exec_control);
 
-        if (vmcs12->pin_based_vm_exec_control & PIN_BASED_VMX_PREEMPTION_TIMER)
-                vmcs_write32(VMX_PREEMPTION_TIMER_VALUE,
-                             vmcs12->vmx_preemption_timer_value);
+        vmx->nested.preemption_timer_expired = false;
+        if (nested_cpu_has_preemption_timer(vmcs12))
+                vmx_start_preemption_timer(vcpu);
 
         /*
          * Whether page-faults are trapped is determined by a combination of
@@ -7721,7 +7773,7 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                 enable_ept ? vmcs12->page_fault_error_code_match : 0);
 
         if (cpu_has_secondary_exec_ctrls()) {
-                u32 exec_control = vmx_secondary_exec_control(vmx);
+                exec_control = vmx_secondary_exec_control(vmx);
                 if (!vmx->rdtscp_enabled)
                         exec_control &= ~SECONDARY_EXEC_RDTSCP;
                 /* Take the following fields only from vmcs12 */
@@ -7808,10 +7860,7 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
          * we should use its exit controls. Note that VM_EXIT_LOAD_IA32_EFER
          * bits are further modified by vmx_set_efer() below.
          */
-        exit_control = vmcs_config.vmexit_ctrl;
-        if (vmcs12->pin_based_vm_exec_control & PIN_BASED_VMX_PREEMPTION_TIMER)
-                exit_control |= VM_EXIT_SAVE_VMX_PREEMPTION_TIMER;
-        vm_exit_controls_init(vmx, exit_control);
+        vmcs_write32(VM_EXIT_CONTROLS, vmcs_config.vmexit_ctrl);
 
         /* vmcs12's VM_ENTRY_LOAD_IA32_EFER and VM_ENTRY_IA32E_MODE are
          * emulated by vmx_set_efer(), below.
@@ -7830,6 +7879,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
 
         set_cr4_guest_host_mask(vmx);
 
+        if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)
+                vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
+
         if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
                 vmcs_write64(TSC_OFFSET,
                         vmx->nested.vmcs01_tsc_offset + vmcs12->tsc_offset);
@@ -8155,6 +8207,58 @@ static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu,
         }
 }
 
+static int vmx_check_nested_events(struct kvm_vcpu *vcpu, bool external_intr)
+{
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+        if (nested_cpu_has_preemption_timer(get_vmcs12(vcpu)) &&
+            vmx->nested.preemption_timer_expired) {
+                if (vmx->nested.nested_run_pending)
+                        return -EBUSY;
+                nested_vmx_vmexit(vcpu, EXIT_REASON_PREEMPTION_TIMER, 0, 0);
+                return 0;
+        }
+
+        if (vcpu->arch.nmi_pending && nested_exit_on_nmi(vcpu)) {
+                if (vmx->nested.nested_run_pending ||
+                    vcpu->arch.interrupt.pending)
+                        return -EBUSY;
+                nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
+                                  NMI_VECTOR | INTR_TYPE_NMI_INTR |
+                                  INTR_INFO_VALID_MASK, 0);
+                /*
+                 * The NMI-triggered VM exit counts as injection:
+                 * clear this one and block further NMIs.
+                 */
+                vcpu->arch.nmi_pending = 0;
+                vmx_set_nmi_mask(vcpu, true);
+                return 0;
+        }
+
+        if ((kvm_cpu_has_interrupt(vcpu) || external_intr) &&
+            nested_exit_on_intr(vcpu)) {
+                if (vmx->nested.nested_run_pending)
+                        return -EBUSY;
+                nested_vmx_vmexit(vcpu, EXIT_REASON_EXTERNAL_INTERRUPT, 0, 0);
+        }
+
+        return 0;
+}
+
+static u32 vmx_get_preemption_timer_value(struct kvm_vcpu *vcpu)
+{
+        ktime_t remaining =
+                hrtimer_get_remaining(&to_vmx(vcpu)->nested.preemption_timer);
+        u64 value;
+
+        if (ktime_to_ns(remaining) <= 0)
+                return 0;
+
+        value = ktime_to_ns(remaining) * vcpu->arch.virtual_tsc_khz;
+        do_div(value, 1000000);
+        return value >> VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE;
+}
+
 /*
  * prepare_vmcs12 is part of what we need to do when the nested L2 guest exits
  * and we want to prepare to run its L1 parent. L1 keeps a vmcs for L2 (vmcs12),
@@ -8225,10 +8329,13 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         else
                 vmcs12->guest_activity_state = GUEST_ACTIVITY_ACTIVE;
 
-        if ((vmcs12->pin_based_vm_exec_control & PIN_BASED_VMX_PREEMPTION_TIMER) &&
-            (vmcs12->vm_exit_controls & VM_EXIT_SAVE_VMX_PREEMPTION_TIMER))
-                vmcs12->vmx_preemption_timer_value =
-                        vmcs_read32(VMX_PREEMPTION_TIMER_VALUE);
+        if (nested_cpu_has_preemption_timer(vmcs12)) {
+                if (vmcs12->vm_exit_controls &
+                    VM_EXIT_SAVE_VMX_PREEMPTION_TIMER)
+                        vmcs12->vmx_preemption_timer_value =
+                                vmx_get_preemption_timer_value(vcpu);
+                hrtimer_cancel(&to_vmx(vcpu)->nested.preemption_timer);
+        }
 
         /*
          * In some cases (usually, nested EPT), L2 is allowed to change its
@@ -8260,6 +8367,8 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         vmcs12->guest_sysenter_cs = vmcs_read32(GUEST_SYSENTER_CS);
         vmcs12->guest_sysenter_esp = vmcs_readl(GUEST_SYSENTER_ESP);
         vmcs12->guest_sysenter_eip = vmcs_readl(GUEST_SYSENTER_EIP);
+        if (vmx_mpx_supported())
+                vmcs12->guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
 
         /* update exit information fields: */
 
@@ -8369,6 +8478,10 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
         vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
         vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
 
+        /* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1.  */
+        if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
+                vmcs_write64(GUEST_BNDCFGS, 0);
+
         if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PAT) {
                 vmcs_write64(GUEST_IA32_PAT, vmcs12->host_ia32_pat);
                 vcpu->arch.pat = vmcs12->host_ia32_pat;
@@ -8495,6 +8608,9 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
                 nested_vmx_succeed(vcpu);
         if (enable_shadow_vmcs)
                 vmx->nested.sync_shadow_vmcs = true;
+
+        /* in case we halted in L2 */
+        vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
 }
 
 /*
@@ -8573,6 +8689,7 @@ static struct kvm_x86_ops vmx_x86_ops = {
         .get_dr6 = vmx_get_dr6,
         .set_dr6 = vmx_set_dr6,
         .set_dr7 = vmx_set_dr7,
+        .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs,
         .cache_reg = vmx_cache_reg,
         .get_rflags = vmx_get_rflags,
         .set_rflags = vmx_set_rflags,
@@ -8634,6 +8751,9 @@ static struct kvm_x86_ops vmx_x86_ops = {
 
         .check_intercept = vmx_check_intercept,
         .handle_external_intr = vmx_handle_external_intr,
+        .mpx_supported = vmx_mpx_supported,
+
+        .check_nested_events = vmx_check_nested_events,
 };
 
 static int __init vmx_init(void)
@@ -8721,6 +8841,8 @@ static int __init vmx_init(void)
         vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false);
         vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false);
         vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false);
+        vmx_disable_intercept_for_msr(MSR_IA32_BNDCFGS, true);
+
         memcpy(vmx_msr_bitmap_legacy_x2apic,
                         vmx_msr_bitmap_legacy, PAGE_SIZE);
         memcpy(vmx_msr_bitmap_longmode_x2apic,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 2b8578432d5b..d1c55f8722c6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -595,13 +595,13 @@ static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
 
 int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
 {
-        u64 xcr0;
+        u64 xcr0 = xcr;
+        u64 old_xcr0 = vcpu->arch.xcr0;
         u64 valid_bits;
 
         /* Only support XCR_XFEATURE_ENABLED_MASK(xcr0) now  */
         if (index != XCR_XFEATURE_ENABLED_MASK)
                 return 1;
-        xcr0 = xcr;
         if (!(xcr0 & XSTATE_FP))
                 return 1;
         if ((xcr0 & XSTATE_YMM) && !(xcr0 & XSTATE_SSE))
@@ -616,8 +616,14 @@ int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
         if (xcr0 & ~valid_bits)
                 return 1;
 
+        if ((!(xcr0 & XSTATE_BNDREGS)) != (!(xcr0 & XSTATE_BNDCSR)))
+                return 1;
+
         kvm_put_guest_xcr0(vcpu);
         vcpu->arch.xcr0 = xcr0;
+
+        if ((xcr0 ^ old_xcr0) & XSTATE_EXTEND_MASK)
+                kvm_update_cpuid(vcpu);
         return 0;
 }
 
@@ -753,7 +759,9 @@ static void kvm_update_dr7(struct kvm_vcpu *vcpu)
         else
                 dr7 = vcpu->arch.dr7;
         kvm_x86_ops->set_dr7(vcpu, dr7);
-        vcpu->arch.switch_db_regs = (dr7 & DR7_BP_EN_MASK);
+        vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_BP_ENABLED;
+        if (dr7 & DR7_BP_EN_MASK)
+                vcpu->arch.switch_db_regs |= KVM_DEBUGREG_BP_ENABLED;
 }
 
 static int __kvm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long val)
@@ -879,7 +887,7 @@ static u32 msrs_to_save[] = {
         MSR_CSTAR, MSR_KERNEL_GS_BASE, MSR_SYSCALL_MASK, MSR_LSTAR,
 #endif
         MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA,
-        MSR_IA32_FEATURE_CONTROL
+        MSR_IA32_FEATURE_CONTROL, MSR_IA32_BNDCFGS
 };
 
 static unsigned num_msrs_to_save;
@@ -1581,7 +1589,6 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
         /* With all the info we got, fill in the values */
         vcpu->hv_clock.tsc_timestamp = tsc_timestamp;
         vcpu->hv_clock.system_time = kernel_ns + v->kvm->arch.kvmclock_offset;
-        vcpu->last_kernel_ns = kernel_ns;
         vcpu->last_guest_tsc = tsc_timestamp;
 
         /*
@@ -1623,14 +1630,21 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
  * the others.
  *
  * So in those cases, request a kvmclock update for all vcpus.
- * The worst case for a remote vcpu to update its kvmclock
- * is then bounded by maximum nohz sleep latency.
+ * We need to rate-limit these requests though, as they can
+ * considerably slow guests that have a large number of vcpus.
+ * The time for a remote vcpu to update its kvmclock is bound
+ * by the delay we use to rate-limit the updates.
  */
 
-static void kvm_gen_kvmclock_update(struct kvm_vcpu *v)
+#define KVMCLOCK_UPDATE_DELAY msecs_to_jiffies(100)
+
+static void kvmclock_update_fn(struct work_struct *work)
 {
         int i;
-        struct kvm *kvm = v->kvm;
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct kvm_arch *ka = container_of(dwork, struct kvm_arch,
+                                           kvmclock_update_work);
+        struct kvm *kvm = container_of(ka, struct kvm, arch);
         struct kvm_vcpu *vcpu;
 
         kvm_for_each_vcpu(i, vcpu, kvm) {
@@ -1639,6 +1653,29 @@ static void kvm_gen_kvmclock_update(struct kvm_vcpu *v)
         }
 }
 
+static void kvm_gen_kvmclock_update(struct kvm_vcpu *v)
+{
+        struct kvm *kvm = v->kvm;
+
+        set_bit(KVM_REQ_CLOCK_UPDATE, &v->requests);
+        schedule_delayed_work(&kvm->arch.kvmclock_update_work,
+                                        KVMCLOCK_UPDATE_DELAY);
+}
+
+#define KVMCLOCK_SYNC_PERIOD (300 * HZ)
+
+static void kvmclock_sync_fn(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct kvm_arch *ka = container_of(dwork, struct kvm_arch,
+                                           kvmclock_sync_work);
+        struct kvm *kvm = container_of(ka, struct kvm, arch);
+
+        schedule_delayed_work(&kvm->arch.kvmclock_update_work, 0);
+        schedule_delayed_work(&kvm->arch.kvmclock_sync_work,
+                                        KVMCLOCK_SYNC_PERIOD);
+}
+
 static bool msr_mtrr_valid(unsigned msr)
 {
         switch (msr) {
@@ -2323,9 +2360,12 @@ static int get_msr_hyperv(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
         case HV_X64_MSR_VP_INDEX: {
                 int r;
                 struct kvm_vcpu *v;
-                kvm_for_each_vcpu(r, v, vcpu->kvm)
-                        if (v == vcpu)
+                kvm_for_each_vcpu(r, v, vcpu->kvm) {
+                        if (v == vcpu) {
                                 data = r;
+                                break;
+                        }
+                }
                 break;
         }
         case HV_X64_MSR_EOI:
@@ -2617,6 +2657,7 @@ int kvm_dev_ioctl_check_extension(long ext)
         case KVM_CAP_KVMCLOCK_CTRL:
         case KVM_CAP_READONLY_MEM:
         case KVM_CAP_HYPERV_TIME:
+        case KVM_CAP_IOAPIC_POLARITY_IGNORED:
 #ifdef CONFIG_KVM_DEVICE_ASSIGNMENT
         case KVM_CAP_ASSIGN_DEV_IRQ:
         case KVM_CAP_PCI_2_3:
@@ -3043,9 +3084,7 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
                  * CPUID leaf 0xD, index 0, EDX:EAX.  This is for compatibility
                  * with old userspace.
                  */
-                if (xstate_bv & ~KVM_SUPPORTED_XCR0)
-                        return -EINVAL;
-                if (xstate_bv & ~host_xcr0)
+                if (xstate_bv & ~kvm_supported_xcr0())
                         return -EINVAL;
                 memcpy(&vcpu->arch.guest_fpu.state->xsave,
                         guest_xsave->region, vcpu->arch.guest_xstate_size);
@@ -3898,6 +3937,23 @@ static void kvm_init_msr_list(void)
         for (i = j = KVM_SAVE_MSRS_BEGIN; i < ARRAY_SIZE(msrs_to_save); i++) {
                 if (rdmsr_safe(msrs_to_save[i], &dummy[0], &dummy[1]) < 0)
                         continue;
+
+                /*
+                 * Even MSRs that are valid in the host may not be exposed
+                 * to the guests in some cases.  We could work around this
+                 * in VMX with the generic MSR save/load machinery, but it
+                 * is not really worthwhile since it will really only
+                 * happen with nested virtualization.
+                 */
+                switch (msrs_to_save[i]) {
+                case MSR_IA32_BNDCFGS:
+                        if (!kvm_x86_ops->mpx_supported())
+                                continue;
+                        break;
+                default:
+                        break;
+                }
+
                 if (j < i)
                         msrs_to_save[j] = msrs_to_save[i];
                 j++;
@@ -4394,6 +4450,7 @@ static int emulator_cmpxchg_emulated(struct x86_emulate_ctxt *ctxt,
         if (!exchanged)
                 return X86EMUL_CMPXCHG_FAILED;
 
+        mark_page_dirty(vcpu->kvm, gpa >> PAGE_SHIFT);
         kvm_mmu_pte_write(vcpu, gpa, new, bytes);
 
         return X86EMUL_CONTINUE;
@@ -5537,9 +5594,10 @@ int kvm_arch_init(void *opaque)
                 goto out_free_percpu;
 
         kvm_set_mmio_spte_mask();
-        kvm_init_msr_list();
 
         kvm_x86_ops = ops;
+        kvm_init_msr_list();
+
         kvm_mmu_set_mask_ptes(PT_USER_MASK, PT_ACCESSED_MASK,
                         PT_DIRTY_MASK, PT64_NX_MASK, 0);
 
@@ -5782,8 +5840,10 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu)
         kvm_x86_ops->update_cr8_intercept(vcpu, tpr, max_irr);
 }
 
-static void inject_pending_event(struct kvm_vcpu *vcpu)
+static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
 {
+        int r;
+
         /* try to reinject previous events if any */
         if (vcpu->arch.exception.pending) {
                 trace_kvm_inj_exception(vcpu->arch.exception.nr,
@@ -5793,17 +5853,23 @@ static void inject_pending_event(struct kvm_vcpu *vcpu)
                                           vcpu->arch.exception.has_error_code,
                                           vcpu->arch.exception.error_code,
                                           vcpu->arch.exception.reinject);
-                return;
+                return 0;
         }
 
         if (vcpu->arch.nmi_injected) {
                 kvm_x86_ops->set_nmi(vcpu);
-                return;
+                return 0;
         }
 
         if (vcpu->arch.interrupt.pending) {
                 kvm_x86_ops->set_irq(vcpu);
-                return;
+                return 0;
+        }
+
+        if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) {
+                r = kvm_x86_ops->check_nested_events(vcpu, req_int_win);
+                if (r != 0)
+                        return r;
         }
 
         /* try to inject new event if pending */
@@ -5820,6 +5886,7 @@ static void inject_pending_event(struct kvm_vcpu *vcpu)
                         kvm_x86_ops->set_irq(vcpu);
                 }
         }
+        return 0;
 }
 
 static void process_nmi(struct kvm_vcpu *vcpu)
@@ -5924,15 +5991,13 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
                         goto out;
                 }
 
-                inject_pending_event(vcpu);
-
+                if (inject_pending_event(vcpu, req_int_win) != 0)
+                        req_immediate_exit = true;
                 /* enable NMI/IRQ window open exits if needed */
-                if (vcpu->arch.nmi_pending)
-                        req_immediate_exit =
-                                kvm_x86_ops->enable_nmi_window(vcpu) != 0;
+                else if (vcpu->arch.nmi_pending)
+                        kvm_x86_ops->enable_nmi_window(vcpu);
                 else if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
-                        req_immediate_exit =
-                                kvm_x86_ops->enable_irq_window(vcpu) != 0;
+                        kvm_x86_ops->enable_irq_window(vcpu);
 
                 if (kvm_lapic_enabled(vcpu)) {
                         /*
@@ -5992,12 +6057,28 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
                 set_debugreg(vcpu->arch.eff_db[1], 1);
                 set_debugreg(vcpu->arch.eff_db[2], 2);
                 set_debugreg(vcpu->arch.eff_db[3], 3);
+                set_debugreg(vcpu->arch.dr6, 6);
         }
 
         trace_kvm_entry(vcpu->vcpu_id);
         kvm_x86_ops->run(vcpu);
 
         /*
+         * Do this here before restoring debug registers on the host.  And
+         * since we do this before handling the vmexit, a DR access vmexit
+         * can (a) read the correct value of the debug registers, (b) set
+         * KVM_DEBUGREG_WONT_EXIT again.
+         */
+        if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) {
+                int i;
+
+                WARN_ON(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP);
+                kvm_x86_ops->sync_dirty_debug_regs(vcpu);
+                for (i = 0; i < KVM_NR_DB_REGS; i++)
+                        vcpu->arch.eff_db[i] = vcpu->arch.db[i];
+        }
+
+        /*
          * If the guest has used debug registers, at least dr7
          * will be disabled while returning to the host.
          * If we don't have active breakpoints in the host, we don't
@@ -6711,6 +6792,7 @@ int kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
 {
         int r;
         struct msr_data msr;
+        struct kvm *kvm = vcpu->kvm;
 
         r = vcpu_load(vcpu);
         if (r)
@@ -6721,6 +6803,9 @@ int kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
         kvm_write_tsc(vcpu, &msr);
         vcpu_put(vcpu);
 
+        schedule_delayed_work(&kvm->arch.kvmclock_sync_work,
+                                        KVMCLOCK_SYNC_PERIOD);
+
         return r;
 }
 
@@ -7013,6 +7098,9 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 
         pvclock_update_vm_gtod_copy(kvm);
 
+        INIT_DELAYED_WORK(&kvm->arch.kvmclock_update_work, kvmclock_update_fn);
+        INIT_DELAYED_WORK(&kvm->arch.kvmclock_sync_work, kvmclock_sync_fn);
+
         return 0;
 }
 
@@ -7050,6 +7138,8 @@ static void kvm_free_vcpus(struct kvm *kvm)
 
 void kvm_arch_sync_events(struct kvm *kvm)
 {
+        cancel_delayed_work_sync(&kvm->arch.kvmclock_sync_work);
+        cancel_delayed_work_sync(&kvm->arch.kvmclock_update_work);
         kvm_free_all_assigned_devices(kvm);
         kvm_free_pit(kvm);
 }
@@ -7248,6 +7338,9 @@ void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
 
 int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
 {
+        if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events)
+                kvm_x86_ops->check_nested_events(vcpu, false);
+
         return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
                 !vcpu->arch.apf.halted)
                 || !list_empty_careful(&vcpu->async_pf.done)
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 8da5823bcde6..8c97bac9a895 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -122,9 +122,12 @@ int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt,
         gva_t addr, void *val, unsigned int bytes,
         struct x86_exception *exception);
 
-#define KVM_SUPPORTED_XCR0      (XSTATE_FP | XSTATE_SSE | XSTATE_YMM)
+#define KVM_SUPPORTED_XCR0     (XSTATE_FP | XSTATE_SSE | XSTATE_YMM \
+                                | XSTATE_BNDREGS | XSTATE_BNDCSR)
 extern u64 host_xcr0;
 
+extern u64 kvm_supported_xcr0(void);
+
 extern unsigned int min_timer_period_us;
 
 extern struct static_key kvm_no_apic_vcpu;