1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2015 - ARM Ltd
4 * Author: Marc Zyngier <marc.zyngier@arm.com>
5 */
6
7 #include <hyp/switch.h>
8
9 #include <linux/arm-smccc.h>
10 #include <linux/kvm_host.h>
11 #include <linux/types.h>
12 #include <linux/jump_label.h>
13 #include <linux/percpu.h>
14 #include <uapi/linux/psci.h>
15
16 #include <kvm/arm_psci.h>
17
18 #include <asm/barrier.h>
19 #include <asm/cpufeature.h>
20 #include <asm/kprobes.h>
21 #include <asm/kvm_asm.h>
22 #include <asm/kvm_emulate.h>
23 #include <asm/kvm_hyp.h>
24 #include <asm/kvm_mmu.h>
25 #include <asm/fpsimd.h>
26 #include <asm/debug-monitors.h>
27 #include <asm/processor.h>
28 #include <asm/thread_info.h>
29 #include <asm/vectors.h>
30
31 /* VHE specific context */
32 DEFINE_PER_CPU(struct kvm_host_data, kvm_host_data);
33 DEFINE_PER_CPU(struct kvm_cpu_context, kvm_hyp_ctxt);
34 DEFINE_PER_CPU(unsigned long, kvm_hyp_vector);
35
36 /*
37 * HCR_EL2 bits that the NV guest can freely change (no RES0/RES1
38 * semantics, irrespective of the configuration), but that cannot be
39 * applied to the actual HW as things would otherwise break badly.
40 *
41 * - TGE: we want the guest to use EL1, which is incompatible with
42 * this bit being set
43 *
44 * - API/APK: they are already accounted for by vcpu_load(), and can
45 * only take effect across a load/put cycle (such as ERET)
46 */
47 #define NV_HCR_GUEST_EXCLUDE (HCR_TGE | HCR_API | HCR_APK)
48
__compute_hcr(struct kvm_vcpu * vcpu)49 static u64 __compute_hcr(struct kvm_vcpu *vcpu)
50 {
51 u64 hcr = vcpu->arch.hcr_el2;
52
53 if (!vcpu_has_nv(vcpu))
54 return hcr;
55
56 if (is_hyp_ctxt(vcpu)) {
57 hcr |= HCR_NV | HCR_NV2 | HCR_AT | HCR_TTLB;
58
59 if (!vcpu_el2_e2h_is_set(vcpu))
60 hcr |= HCR_NV1;
61
62 write_sysreg_s(vcpu->arch.ctxt.vncr_array, SYS_VNCR_EL2);
63 }
64
65 return hcr | (__vcpu_sys_reg(vcpu, HCR_EL2) & ~NV_HCR_GUEST_EXCLUDE);
66 }
67
__activate_cptr_traps(struct kvm_vcpu * vcpu)68 static void __activate_cptr_traps(struct kvm_vcpu *vcpu)
69 {
70 u64 cptr;
71
72 /*
73 * With VHE (HCR.E2H == 1), accesses to CPACR_EL1 are routed to
74 * CPTR_EL2. In general, CPACR_EL1 has the same layout as CPTR_EL2,
75 * except for some missing controls, such as TAM.
76 * In this case, CPTR_EL2.TAM has the same position with or without
77 * VHE (HCR.E2H == 1) which allows us to use here the CPTR_EL2.TAM
78 * shift value for trapping the AMU accesses.
79 */
80 u64 val = CPACR_ELx_TTA | CPTR_EL2_TAM;
81
82 if (guest_owns_fp_regs()) {
83 val |= CPACR_ELx_FPEN;
84 if (vcpu_has_sve(vcpu))
85 val |= CPACR_ELx_ZEN;
86 } else {
87 __activate_traps_fpsimd32(vcpu);
88 }
89
90 if (!vcpu_has_nv(vcpu))
91 goto write;
92
93 /*
94 * The architecture is a bit crap (what a surprise): an EL2 guest
95 * writing to CPTR_EL2 via CPACR_EL1 can't set any of TCPAC or TTA,
96 * as they are RES0 in the guest's view. To work around it, trap the
97 * sucker using the very same bit it can't set...
98 */
99 if (vcpu_el2_e2h_is_set(vcpu) && is_hyp_ctxt(vcpu))
100 val |= CPTR_EL2_TCPAC;
101
102 /*
103 * Layer the guest hypervisor's trap configuration on top of our own if
104 * we're in a nested context.
105 */
106 if (is_hyp_ctxt(vcpu))
107 goto write;
108
109 cptr = vcpu_sanitised_cptr_el2(vcpu);
110
111 /*
112 * Pay attention, there's some interesting detail here.
113 *
114 * The CPTR_EL2.xEN fields are 2 bits wide, although there are only two
115 * meaningful trap states when HCR_EL2.TGE = 0 (running a nested guest):
116 *
117 * - CPTR_EL2.xEN = x0, traps are enabled
118 * - CPTR_EL2.xEN = x1, traps are disabled
119 *
120 * In other words, bit[0] determines if guest accesses trap or not. In
121 * the interest of simplicity, clear the entire field if the guest
122 * hypervisor has traps enabled to dispel any illusion of something more
123 * complicated taking place.
124 */
125 if (!(SYS_FIELD_GET(CPACR_ELx, FPEN, cptr) & BIT(0)))
126 val &= ~CPACR_ELx_FPEN;
127 if (!(SYS_FIELD_GET(CPACR_ELx, ZEN, cptr) & BIT(0)))
128 val &= ~CPACR_ELx_ZEN;
129
130 if (kvm_has_feat(vcpu->kvm, ID_AA64MMFR3_EL1, S2POE, IMP))
131 val |= cptr & CPACR_ELx_E0POE;
132
133 val |= cptr & CPTR_EL2_TCPAC;
134
135 write:
136 write_sysreg(val, cpacr_el1);
137 }
138
__activate_traps(struct kvm_vcpu * vcpu)139 static void __activate_traps(struct kvm_vcpu *vcpu)
140 {
141 u64 val;
142
143 ___activate_traps(vcpu, __compute_hcr(vcpu));
144
145 if (has_cntpoff()) {
146 struct timer_map map;
147
148 get_timer_map(vcpu, &map);
149
150 /*
151 * We're entrering the guest. Reload the correct
152 * values from memory now that TGE is clear.
153 */
154 if (map.direct_ptimer == vcpu_ptimer(vcpu))
155 val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
156 if (map.direct_ptimer == vcpu_hptimer(vcpu))
157 val = __vcpu_sys_reg(vcpu, CNTHP_CVAL_EL2);
158
159 if (map.direct_ptimer) {
160 write_sysreg_el0(val, SYS_CNTP_CVAL);
161 isb();
162 }
163 }
164
165 __activate_cptr_traps(vcpu);
166
167 write_sysreg(__this_cpu_read(kvm_hyp_vector), vbar_el1);
168 }
169 NOKPROBE_SYMBOL(__activate_traps);
170
__deactivate_traps(struct kvm_vcpu * vcpu)171 static void __deactivate_traps(struct kvm_vcpu *vcpu)
172 {
173 const char *host_vectors = vectors;
174
175 ___deactivate_traps(vcpu);
176
177 write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2);
178
179 if (has_cntpoff()) {
180 struct timer_map map;
181 u64 val, offset;
182
183 get_timer_map(vcpu, &map);
184
185 /*
186 * We're exiting the guest. Save the latest CVAL value
187 * to memory and apply the offset now that TGE is set.
188 */
189 val = read_sysreg_el0(SYS_CNTP_CVAL);
190 if (map.direct_ptimer == vcpu_ptimer(vcpu))
191 __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0) = val;
192 if (map.direct_ptimer == vcpu_hptimer(vcpu))
193 __vcpu_sys_reg(vcpu, CNTHP_CVAL_EL2) = val;
194
195 offset = read_sysreg_s(SYS_CNTPOFF_EL2);
196
197 if (map.direct_ptimer && offset) {
198 write_sysreg_el0(val + offset, SYS_CNTP_CVAL);
199 isb();
200 }
201 }
202
203 /*
204 * ARM errata 1165522 and 1530923 require the actual execution of the
205 * above before we can switch to the EL2/EL0 translation regime used by
206 * the host.
207 */
208 asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_SPECULATIVE_AT));
209
210 kvm_reset_cptr_el2(vcpu);
211
212 if (!arm64_kernel_unmapped_at_el0())
213 host_vectors = __this_cpu_read(this_cpu_vector);
214 write_sysreg(host_vectors, vbar_el1);
215 }
216 NOKPROBE_SYMBOL(__deactivate_traps);
217
218 /*
219 * Disable IRQs in __vcpu_{load,put}_{activate,deactivate}_traps() to
220 * prevent a race condition between context switching of PMUSERENR_EL0
221 * in __{activate,deactivate}_traps_common() and IPIs that attempts to
222 * update PMUSERENR_EL0. See also kvm_set_pmuserenr().
223 */
__vcpu_load_activate_traps(struct kvm_vcpu * vcpu)224 static void __vcpu_load_activate_traps(struct kvm_vcpu *vcpu)
225 {
226 unsigned long flags;
227
228 local_irq_save(flags);
229 __activate_traps_common(vcpu);
230 local_irq_restore(flags);
231 }
232
__vcpu_put_deactivate_traps(struct kvm_vcpu * vcpu)233 static void __vcpu_put_deactivate_traps(struct kvm_vcpu *vcpu)
234 {
235 unsigned long flags;
236
237 local_irq_save(flags);
238 __deactivate_traps_common(vcpu);
239 local_irq_restore(flags);
240 }
241
kvm_vcpu_load_vhe(struct kvm_vcpu * vcpu)242 void kvm_vcpu_load_vhe(struct kvm_vcpu *vcpu)
243 {
244 host_data_ptr(host_ctxt)->__hyp_running_vcpu = vcpu;
245
246 __vcpu_load_switch_sysregs(vcpu);
247 __vcpu_load_activate_traps(vcpu);
248 __load_stage2(vcpu->arch.hw_mmu, vcpu->arch.hw_mmu->arch);
249 }
250
kvm_vcpu_put_vhe(struct kvm_vcpu * vcpu)251 void kvm_vcpu_put_vhe(struct kvm_vcpu *vcpu)
252 {
253 __vcpu_put_deactivate_traps(vcpu);
254 __vcpu_put_switch_sysregs(vcpu);
255
256 host_data_ptr(host_ctxt)->__hyp_running_vcpu = NULL;
257 }
258
kvm_hyp_handle_eret(struct kvm_vcpu * vcpu,u64 * exit_code)259 static bool kvm_hyp_handle_eret(struct kvm_vcpu *vcpu, u64 *exit_code)
260 {
261 u64 esr = kvm_vcpu_get_esr(vcpu);
262 u64 spsr, elr, mode;
263
264 /*
265 * Going through the whole put/load motions is a waste of time
266 * if this is a VHE guest hypervisor returning to its own
267 * userspace, or the hypervisor performing a local exception
268 * return. No need to save/restore registers, no need to
269 * switch S2 MMU. Just do the canonical ERET.
270 *
271 * Unless the trap has to be forwarded further down the line,
272 * of course...
273 */
274 if ((__vcpu_sys_reg(vcpu, HCR_EL2) & HCR_NV) ||
275 (__vcpu_sys_reg(vcpu, HFGITR_EL2) & HFGITR_EL2_ERET))
276 return false;
277
278 spsr = read_sysreg_el1(SYS_SPSR);
279 mode = spsr & (PSR_MODE_MASK | PSR_MODE32_BIT);
280
281 switch (mode) {
282 case PSR_MODE_EL0t:
283 if (!(vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu)))
284 return false;
285 break;
286 case PSR_MODE_EL2t:
287 mode = PSR_MODE_EL1t;
288 break;
289 case PSR_MODE_EL2h:
290 mode = PSR_MODE_EL1h;
291 break;
292 default:
293 return false;
294 }
295
296 /* If ERETAx fails, take the slow path */
297 if (esr_iss_is_eretax(esr)) {
298 if (!(vcpu_has_ptrauth(vcpu) && kvm_auth_eretax(vcpu, &elr)))
299 return false;
300 } else {
301 elr = read_sysreg_el1(SYS_ELR);
302 }
303
304 spsr = (spsr & ~(PSR_MODE_MASK | PSR_MODE32_BIT)) | mode;
305
306 write_sysreg_el2(spsr, SYS_SPSR);
307 write_sysreg_el2(elr, SYS_ELR);
308
309 return true;
310 }
311
kvm_hyp_save_fpsimd_host(struct kvm_vcpu * vcpu)312 static void kvm_hyp_save_fpsimd_host(struct kvm_vcpu *vcpu)
313 {
314 __fpsimd_save_state(*host_data_ptr(fpsimd_state));
315
316 if (kvm_has_fpmr(vcpu->kvm))
317 **host_data_ptr(fpmr_ptr) = read_sysreg_s(SYS_FPMR);
318 }
319
kvm_hyp_handle_tlbi_el2(struct kvm_vcpu * vcpu,u64 * exit_code)320 static bool kvm_hyp_handle_tlbi_el2(struct kvm_vcpu *vcpu, u64 *exit_code)
321 {
322 int ret = -EINVAL;
323 u32 instr;
324 u64 val;
325
326 /*
327 * Ideally, we would never trap on EL2 S1 TLB invalidations using
328 * the EL1 instructions when the guest's HCR_EL2.{E2H,TGE}=={1,1}.
329 * But "thanks" to FEAT_NV2, we don't trap writes to HCR_EL2,
330 * meaning that we can't track changes to the virtual TGE bit. So we
331 * have to leave HCR_EL2.TTLB set on the host. Oopsie...
332 *
333 * Try and handle these invalidation as quickly as possible, without
334 * fully exiting. Note that we don't need to consider any forwarding
335 * here, as having E2H+TGE set is the very definition of being
336 * InHost.
337 *
338 * For the lesser hypervisors out there that have failed to get on
339 * with the VHE program, we can also handle the nVHE style of EL2
340 * invalidation.
341 */
342 if (!(is_hyp_ctxt(vcpu)))
343 return false;
344
345 instr = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
346 val = vcpu_get_reg(vcpu, kvm_vcpu_sys_get_rt(vcpu));
347
348 if ((kvm_supported_tlbi_s1e1_op(vcpu, instr) &&
349 vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu)) ||
350 kvm_supported_tlbi_s1e2_op (vcpu, instr))
351 ret = __kvm_tlbi_s1e2(NULL, val, instr);
352
353 if (ret)
354 return false;
355
356 __kvm_skip_instr(vcpu);
357
358 return true;
359 }
360
kvm_hyp_handle_cpacr_el1(struct kvm_vcpu * vcpu,u64 * exit_code)361 static bool kvm_hyp_handle_cpacr_el1(struct kvm_vcpu *vcpu, u64 *exit_code)
362 {
363 u64 esr = kvm_vcpu_get_esr(vcpu);
364 int rt;
365
366 if (!is_hyp_ctxt(vcpu) || esr_sys64_to_sysreg(esr) != SYS_CPACR_EL1)
367 return false;
368
369 rt = kvm_vcpu_sys_get_rt(vcpu);
370
371 if ((esr & ESR_ELx_SYS64_ISS_DIR_MASK) == ESR_ELx_SYS64_ISS_DIR_READ) {
372 vcpu_set_reg(vcpu, rt, __vcpu_sys_reg(vcpu, CPTR_EL2));
373 } else {
374 vcpu_write_sys_reg(vcpu, vcpu_get_reg(vcpu, rt), CPTR_EL2);
375 __activate_cptr_traps(vcpu);
376 }
377
378 __kvm_skip_instr(vcpu);
379
380 return true;
381 }
382
kvm_hyp_handle_zcr_el2(struct kvm_vcpu * vcpu,u64 * exit_code)383 static bool kvm_hyp_handle_zcr_el2(struct kvm_vcpu *vcpu, u64 *exit_code)
384 {
385 u32 sysreg = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
386
387 if (!vcpu_has_nv(vcpu))
388 return false;
389
390 if (sysreg != SYS_ZCR_EL2)
391 return false;
392
393 if (guest_owns_fp_regs())
394 return false;
395
396 /*
397 * ZCR_EL2 traps are handled in the slow path, with the expectation
398 * that the guest's FP context has already been loaded onto the CPU.
399 *
400 * Load the guest's FP context and unconditionally forward to the
401 * slow path for handling (i.e. return false).
402 */
403 kvm_hyp_handle_fpsimd(vcpu, exit_code);
404 return false;
405 }
406
kvm_hyp_handle_sysreg_vhe(struct kvm_vcpu * vcpu,u64 * exit_code)407 static bool kvm_hyp_handle_sysreg_vhe(struct kvm_vcpu *vcpu, u64 *exit_code)
408 {
409 if (kvm_hyp_handle_tlbi_el2(vcpu, exit_code))
410 return true;
411
412 if (kvm_hyp_handle_cpacr_el1(vcpu, exit_code))
413 return true;
414
415 if (kvm_hyp_handle_zcr_el2(vcpu, exit_code))
416 return true;
417
418 return kvm_hyp_handle_sysreg(vcpu, exit_code);
419 }
420
421 static const exit_handler_fn hyp_exit_handlers[] = {
422 [0 ... ESR_ELx_EC_MAX] = NULL,
423 [ESR_ELx_EC_CP15_32] = kvm_hyp_handle_cp15_32,
424 [ESR_ELx_EC_SYS64] = kvm_hyp_handle_sysreg_vhe,
425 [ESR_ELx_EC_SVE] = kvm_hyp_handle_fpsimd,
426 [ESR_ELx_EC_FP_ASIMD] = kvm_hyp_handle_fpsimd,
427 [ESR_ELx_EC_IABT_LOW] = kvm_hyp_handle_iabt_low,
428 [ESR_ELx_EC_DABT_LOW] = kvm_hyp_handle_dabt_low,
429 [ESR_ELx_EC_WATCHPT_LOW] = kvm_hyp_handle_watchpt_low,
430 [ESR_ELx_EC_ERET] = kvm_hyp_handle_eret,
431 [ESR_ELx_EC_MOPS] = kvm_hyp_handle_mops,
432 };
433
kvm_get_exit_handler_array(struct kvm_vcpu * vcpu)434 static const exit_handler_fn *kvm_get_exit_handler_array(struct kvm_vcpu *vcpu)
435 {
436 return hyp_exit_handlers;
437 }
438
early_exit_filter(struct kvm_vcpu * vcpu,u64 * exit_code)439 static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code)
440 {
441 /*
442 * If we were in HYP context on entry, adjust the PSTATE view
443 * so that the usual helpers work correctly.
444 */
445 if (vcpu_has_nv(vcpu) && (read_sysreg(hcr_el2) & HCR_NV)) {
446 u64 mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT);
447
448 switch (mode) {
449 case PSR_MODE_EL1t:
450 mode = PSR_MODE_EL2t;
451 break;
452 case PSR_MODE_EL1h:
453 mode = PSR_MODE_EL2h;
454 break;
455 }
456
457 *vcpu_cpsr(vcpu) &= ~(PSR_MODE_MASK | PSR_MODE32_BIT);
458 *vcpu_cpsr(vcpu) |= mode;
459 }
460 }
461
462 /* Switch to the guest for VHE systems running in EL2 */
__kvm_vcpu_run_vhe(struct kvm_vcpu * vcpu)463 static int __kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu)
464 {
465 struct kvm_cpu_context *host_ctxt;
466 struct kvm_cpu_context *guest_ctxt;
467 u64 exit_code;
468
469 host_ctxt = host_data_ptr(host_ctxt);
470 guest_ctxt = &vcpu->arch.ctxt;
471
472 sysreg_save_host_state_vhe(host_ctxt);
473
474 /*
475 * Note that ARM erratum 1165522 requires us to configure both stage 1
476 * and stage 2 translation for the guest context before we clear
477 * HCR_EL2.TGE. The stage 1 and stage 2 guest context has already been
478 * loaded on the CPU in kvm_vcpu_load_vhe().
479 */
480 __activate_traps(vcpu);
481
482 __kvm_adjust_pc(vcpu);
483
484 sysreg_restore_guest_state_vhe(guest_ctxt);
485 __debug_switch_to_guest(vcpu);
486
487 do {
488 /* Jump in the fire! */
489 exit_code = __guest_enter(vcpu);
490
491 /* And we're baaack! */
492 } while (fixup_guest_exit(vcpu, &exit_code));
493
494 sysreg_save_guest_state_vhe(guest_ctxt);
495
496 __deactivate_traps(vcpu);
497
498 sysreg_restore_host_state_vhe(host_ctxt);
499
500 if (guest_owns_fp_regs())
501 __fpsimd_save_fpexc32(vcpu);
502
503 __debug_switch_to_host(vcpu);
504
505 return exit_code;
506 }
507 NOKPROBE_SYMBOL(__kvm_vcpu_run_vhe);
508
__kvm_vcpu_run(struct kvm_vcpu * vcpu)509 int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
510 {
511 int ret;
512
513 local_daif_mask();
514
515 /*
516 * Having IRQs masked via PMR when entering the guest means the GIC
517 * will not signal the CPU of interrupts of lower priority, and the
518 * only way to get out will be via guest exceptions.
519 * Naturally, we want to avoid this.
520 *
521 * local_daif_mask() already sets GIC_PRIO_PSR_I_SET, we just need a
522 * dsb to ensure the redistributor is forwards EL2 IRQs to the CPU.
523 */
524 pmr_sync();
525
526 ret = __kvm_vcpu_run_vhe(vcpu);
527
528 /*
529 * local_daif_restore() takes care to properly restore PSTATE.DAIF
530 * and the GIC PMR if the host is using IRQ priorities.
531 */
532 local_daif_restore(DAIF_PROCCTX_NOIRQ);
533
534 /*
535 * When we exit from the guest we change a number of CPU configuration
536 * parameters, such as traps. We rely on the isb() in kvm_call_hyp*()
537 * to make sure these changes take effect before running the host or
538 * additional guests.
539 */
540 return ret;
541 }
542
__hyp_call_panic(u64 spsr,u64 elr,u64 par)543 static void __noreturn __hyp_call_panic(u64 spsr, u64 elr, u64 par)
544 {
545 struct kvm_cpu_context *host_ctxt;
546 struct kvm_vcpu *vcpu;
547
548 host_ctxt = host_data_ptr(host_ctxt);
549 vcpu = host_ctxt->__hyp_running_vcpu;
550
551 __deactivate_traps(vcpu);
552 sysreg_restore_host_state_vhe(host_ctxt);
553
554 panic("HYP panic:\nPS:%08llx PC:%016llx ESR:%08llx\nFAR:%016llx HPFAR:%016llx PAR:%016llx\nVCPU:%p\n",
555 spsr, elr,
556 read_sysreg_el2(SYS_ESR), read_sysreg_el2(SYS_FAR),
557 read_sysreg(hpfar_el2), par, vcpu);
558 }
559 NOKPROBE_SYMBOL(__hyp_call_panic);
560
hyp_panic(void)561 void __noreturn hyp_panic(void)
562 {
563 u64 spsr = read_sysreg_el2(SYS_SPSR);
564 u64 elr = read_sysreg_el2(SYS_ELR);
565 u64 par = read_sysreg_par();
566
567 __hyp_call_panic(spsr, elr, par);
568 }
569
kvm_unexpected_el2_exception(void)570 asmlinkage void kvm_unexpected_el2_exception(void)
571 {
572 __kvm_unexpected_el2_exception();
573 }
574