1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2020 - Google Inc 4 * Author: Andrew Scull <ascull@google.com> 5 */ 6 7 #include <hyp/adjust_pc.h> 8 9 #include <asm/pgtable-types.h> 10 #include <asm/kvm_asm.h> 11 #include <asm/kvm_emulate.h> 12 #include <asm/kvm_host.h> 13 #include <asm/kvm_hyp.h> 14 #include <asm/kvm_mmu.h> 15 16 #include <nvhe/ffa.h> 17 #include <nvhe/mem_protect.h> 18 #include <nvhe/mm.h> 19 #include <nvhe/pkvm.h> 20 #include <nvhe/trap_handler.h> 21 22 DEFINE_PER_CPU(struct kvm_nvhe_init_params, kvm_init_params); 23 24 void __kvm_hyp_host_forward_smc(struct kvm_cpu_context *host_ctxt); 25 26 static void __hyp_sve_save_guest(struct kvm_vcpu *vcpu) 27 { 28 __vcpu_sys_reg(vcpu, ZCR_EL1) = read_sysreg_el1(SYS_ZCR); 29 /* 30 * On saving/restoring guest sve state, always use the maximum VL for 31 * the guest. The layout of the data when saving the sve state depends 32 * on the VL, so use a consistent (i.e., the maximum) guest VL. 33 */ 34 sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, SYS_ZCR_EL2); 35 __sve_save_state(vcpu_sve_pffr(vcpu), &vcpu->arch.ctxt.fp_regs.fpsr, true); 36 write_sysreg_s(ZCR_ELx_LEN_MASK, SYS_ZCR_EL2); 37 } 38 39 static void __hyp_sve_restore_host(void) 40 { 41 struct cpu_sve_state *sve_state = *host_data_ptr(sve_state); 42 43 /* 44 * On saving/restoring host sve state, always use the maximum VL for 45 * the host. The layout of the data when saving the sve state depends 46 * on the VL, so use a consistent (i.e., the maximum) host VL. 47 * 48 * Setting ZCR_EL2 to ZCR_ELx_LEN_MASK sets the effective length 49 * supported by the system (or limited at EL3). 50 */ 51 write_sysreg_s(ZCR_ELx_LEN_MASK, SYS_ZCR_EL2); 52 __sve_restore_state(sve_state->sve_regs + sve_ffr_offset(kvm_host_sve_max_vl), 53 &sve_state->fpsr, 54 true); 55 write_sysreg_el1(sve_state->zcr_el1, SYS_ZCR); 56 } 57 58 static void fpsimd_sve_flush(void) 59 { 60 *host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED; 61 } 62 63 static void fpsimd_sve_sync(struct kvm_vcpu *vcpu) 64 { 65 bool has_fpmr; 66 67 if (!guest_owns_fp_regs()) 68 return; 69 70 cpacr_clear_set(0, CPACR_ELx_FPEN | CPACR_ELx_ZEN); 71 isb(); 72 73 if (vcpu_has_sve(vcpu)) 74 __hyp_sve_save_guest(vcpu); 75 else 76 __fpsimd_save_state(&vcpu->arch.ctxt.fp_regs); 77 78 has_fpmr = kvm_has_fpmr(kern_hyp_va(vcpu->kvm)); 79 if (has_fpmr) 80 __vcpu_sys_reg(vcpu, FPMR) = read_sysreg_s(SYS_FPMR); 81 82 if (system_supports_sve()) 83 __hyp_sve_restore_host(); 84 else 85 __fpsimd_restore_state(*host_data_ptr(fpsimd_state)); 86 87 if (has_fpmr) 88 write_sysreg_s(*host_data_ptr(fpmr), SYS_FPMR); 89 90 *host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED; 91 } 92 93 static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu) 94 { 95 struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu; 96 97 fpsimd_sve_flush(); 98 99 hyp_vcpu->vcpu.arch.ctxt = host_vcpu->arch.ctxt; 100 101 hyp_vcpu->vcpu.arch.sve_state = kern_hyp_va(host_vcpu->arch.sve_state); 102 /* Limit guest vector length to the maximum supported by the host. */ 103 hyp_vcpu->vcpu.arch.sve_max_vl = min(host_vcpu->arch.sve_max_vl, kvm_host_sve_max_vl); 104 105 hyp_vcpu->vcpu.arch.hw_mmu = host_vcpu->arch.hw_mmu; 106 107 hyp_vcpu->vcpu.arch.hcr_el2 = host_vcpu->arch.hcr_el2; 108 hyp_vcpu->vcpu.arch.mdcr_el2 = host_vcpu->arch.mdcr_el2; 109 110 hyp_vcpu->vcpu.arch.iflags = host_vcpu->arch.iflags; 111 112 hyp_vcpu->vcpu.arch.debug_ptr = kern_hyp_va(host_vcpu->arch.debug_ptr); 113 114 hyp_vcpu->vcpu.arch.vsesr_el2 = host_vcpu->arch.vsesr_el2; 115 116 hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3 = host_vcpu->arch.vgic_cpu.vgic_v3; 117 } 118 119 static void sync_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu) 120 { 121 struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu; 122 struct vgic_v3_cpu_if *hyp_cpu_if = &hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3; 123 struct vgic_v3_cpu_if *host_cpu_if = &host_vcpu->arch.vgic_cpu.vgic_v3; 124 unsigned int i; 125 126 fpsimd_sve_sync(&hyp_vcpu->vcpu); 127 128 host_vcpu->arch.ctxt = hyp_vcpu->vcpu.arch.ctxt; 129 130 host_vcpu->arch.hcr_el2 = hyp_vcpu->vcpu.arch.hcr_el2; 131 132 host_vcpu->arch.fault = hyp_vcpu->vcpu.arch.fault; 133 134 host_vcpu->arch.iflags = hyp_vcpu->vcpu.arch.iflags; 135 136 host_cpu_if->vgic_hcr = hyp_cpu_if->vgic_hcr; 137 for (i = 0; i < hyp_cpu_if->used_lrs; ++i) 138 host_cpu_if->vgic_lr[i] = hyp_cpu_if->vgic_lr[i]; 139 } 140 141 static void handle___kvm_vcpu_run(struct kvm_cpu_context *host_ctxt) 142 { 143 DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 1); 144 int ret; 145 146 host_vcpu = kern_hyp_va(host_vcpu); 147 148 if (unlikely(is_protected_kvm_enabled())) { 149 struct pkvm_hyp_vcpu *hyp_vcpu; 150 struct kvm *host_kvm; 151 152 /* 153 * KVM (and pKVM) doesn't support SME guests for now, and 154 * ensures that SME features aren't enabled in pstate when 155 * loading a vcpu. Therefore, if SME features enabled the host 156 * is misbehaving. 157 */ 158 if (unlikely(system_supports_sme() && read_sysreg_s(SYS_SVCR))) { 159 ret = -EINVAL; 160 goto out; 161 } 162 163 host_kvm = kern_hyp_va(host_vcpu->kvm); 164 hyp_vcpu = pkvm_load_hyp_vcpu(host_kvm->arch.pkvm.handle, 165 host_vcpu->vcpu_idx); 166 if (!hyp_vcpu) { 167 ret = -EINVAL; 168 goto out; 169 } 170 171 flush_hyp_vcpu(hyp_vcpu); 172 173 ret = __kvm_vcpu_run(&hyp_vcpu->vcpu); 174 175 sync_hyp_vcpu(hyp_vcpu); 176 pkvm_put_hyp_vcpu(hyp_vcpu); 177 } else { 178 /* The host is fully trusted, run its vCPU directly. */ 179 ret = __kvm_vcpu_run(host_vcpu); 180 } 181 182 out: 183 cpu_reg(host_ctxt, 1) = ret; 184 } 185 186 static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt) 187 { 188 DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1); 189 190 __kvm_adjust_pc(kern_hyp_va(vcpu)); 191 } 192 193 static void handle___kvm_flush_vm_context(struct kvm_cpu_context *host_ctxt) 194 { 195 __kvm_flush_vm_context(); 196 } 197 198 static void handle___kvm_tlb_flush_vmid_ipa(struct kvm_cpu_context *host_ctxt) 199 { 200 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 201 DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2); 202 DECLARE_REG(int, level, host_ctxt, 3); 203 204 __kvm_tlb_flush_vmid_ipa(kern_hyp_va(mmu), ipa, level); 205 } 206 207 static void handle___kvm_tlb_flush_vmid_ipa_nsh(struct kvm_cpu_context *host_ctxt) 208 { 209 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 210 DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2); 211 DECLARE_REG(int, level, host_ctxt, 3); 212 213 __kvm_tlb_flush_vmid_ipa_nsh(kern_hyp_va(mmu), ipa, level); 214 } 215 216 static void 217 handle___kvm_tlb_flush_vmid_range(struct kvm_cpu_context *host_ctxt) 218 { 219 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 220 DECLARE_REG(phys_addr_t, start, host_ctxt, 2); 221 DECLARE_REG(unsigned long, pages, host_ctxt, 3); 222 223 __kvm_tlb_flush_vmid_range(kern_hyp_va(mmu), start, pages); 224 } 225 226 static void handle___kvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt) 227 { 228 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 229 230 __kvm_tlb_flush_vmid(kern_hyp_va(mmu)); 231 } 232 233 static void handle___kvm_flush_cpu_context(struct kvm_cpu_context *host_ctxt) 234 { 235 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 236 237 __kvm_flush_cpu_context(kern_hyp_va(mmu)); 238 } 239 240 static void handle___kvm_timer_set_cntvoff(struct kvm_cpu_context *host_ctxt) 241 { 242 __kvm_timer_set_cntvoff(cpu_reg(host_ctxt, 1)); 243 } 244 245 static void handle___kvm_enable_ssbs(struct kvm_cpu_context *host_ctxt) 246 { 247 u64 tmp; 248 249 tmp = read_sysreg_el2(SYS_SCTLR); 250 tmp |= SCTLR_ELx_DSSBS; 251 write_sysreg_el2(tmp, SYS_SCTLR); 252 } 253 254 static void handle___vgic_v3_get_gic_config(struct kvm_cpu_context *host_ctxt) 255 { 256 cpu_reg(host_ctxt, 1) = __vgic_v3_get_gic_config(); 257 } 258 259 static void handle___vgic_v3_init_lrs(struct kvm_cpu_context *host_ctxt) 260 { 261 __vgic_v3_init_lrs(); 262 } 263 264 static void handle___kvm_get_mdcr_el2(struct kvm_cpu_context *host_ctxt) 265 { 266 cpu_reg(host_ctxt, 1) = __kvm_get_mdcr_el2(); 267 } 268 269 static void handle___vgic_v3_save_vmcr_aprs(struct kvm_cpu_context *host_ctxt) 270 { 271 DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1); 272 273 __vgic_v3_save_vmcr_aprs(kern_hyp_va(cpu_if)); 274 } 275 276 static void handle___vgic_v3_restore_vmcr_aprs(struct kvm_cpu_context *host_ctxt) 277 { 278 DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1); 279 280 __vgic_v3_restore_vmcr_aprs(kern_hyp_va(cpu_if)); 281 } 282 283 static void handle___pkvm_init(struct kvm_cpu_context *host_ctxt) 284 { 285 DECLARE_REG(phys_addr_t, phys, host_ctxt, 1); 286 DECLARE_REG(unsigned long, size, host_ctxt, 2); 287 DECLARE_REG(unsigned long, nr_cpus, host_ctxt, 3); 288 DECLARE_REG(unsigned long *, per_cpu_base, host_ctxt, 4); 289 DECLARE_REG(u32, hyp_va_bits, host_ctxt, 5); 290 291 /* 292 * __pkvm_init() will return only if an error occurred, otherwise it 293 * will tail-call in __pkvm_init_finalise() which will have to deal 294 * with the host context directly. 295 */ 296 cpu_reg(host_ctxt, 1) = __pkvm_init(phys, size, nr_cpus, per_cpu_base, 297 hyp_va_bits); 298 } 299 300 static void handle___pkvm_cpu_set_vector(struct kvm_cpu_context *host_ctxt) 301 { 302 DECLARE_REG(enum arm64_hyp_spectre_vector, slot, host_ctxt, 1); 303 304 cpu_reg(host_ctxt, 1) = pkvm_cpu_set_vector(slot); 305 } 306 307 static void handle___pkvm_host_share_hyp(struct kvm_cpu_context *host_ctxt) 308 { 309 DECLARE_REG(u64, pfn, host_ctxt, 1); 310 311 cpu_reg(host_ctxt, 1) = __pkvm_host_share_hyp(pfn); 312 } 313 314 static void handle___pkvm_host_unshare_hyp(struct kvm_cpu_context *host_ctxt) 315 { 316 DECLARE_REG(u64, pfn, host_ctxt, 1); 317 318 cpu_reg(host_ctxt, 1) = __pkvm_host_unshare_hyp(pfn); 319 } 320 321 static void handle___pkvm_create_private_mapping(struct kvm_cpu_context *host_ctxt) 322 { 323 DECLARE_REG(phys_addr_t, phys, host_ctxt, 1); 324 DECLARE_REG(size_t, size, host_ctxt, 2); 325 DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 3); 326 327 /* 328 * __pkvm_create_private_mapping() populates a pointer with the 329 * hypervisor start address of the allocation. 330 * 331 * However, handle___pkvm_create_private_mapping() hypercall crosses the 332 * EL1/EL2 boundary so the pointer would not be valid in this context. 333 * 334 * Instead pass the allocation address as the return value (or return 335 * ERR_PTR() on failure). 336 */ 337 unsigned long haddr; 338 int err = __pkvm_create_private_mapping(phys, size, prot, &haddr); 339 340 if (err) 341 haddr = (unsigned long)ERR_PTR(err); 342 343 cpu_reg(host_ctxt, 1) = haddr; 344 } 345 346 static void handle___pkvm_prot_finalize(struct kvm_cpu_context *host_ctxt) 347 { 348 cpu_reg(host_ctxt, 1) = __pkvm_prot_finalize(); 349 } 350 351 static void handle___pkvm_vcpu_init_traps(struct kvm_cpu_context *host_ctxt) 352 { 353 DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1); 354 355 __pkvm_vcpu_init_traps(kern_hyp_va(vcpu)); 356 } 357 358 static void handle___pkvm_init_vm(struct kvm_cpu_context *host_ctxt) 359 { 360 DECLARE_REG(struct kvm *, host_kvm, host_ctxt, 1); 361 DECLARE_REG(unsigned long, vm_hva, host_ctxt, 2); 362 DECLARE_REG(unsigned long, pgd_hva, host_ctxt, 3); 363 364 host_kvm = kern_hyp_va(host_kvm); 365 cpu_reg(host_ctxt, 1) = __pkvm_init_vm(host_kvm, vm_hva, pgd_hva); 366 } 367 368 static void handle___pkvm_init_vcpu(struct kvm_cpu_context *host_ctxt) 369 { 370 DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1); 371 DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 2); 372 DECLARE_REG(unsigned long, vcpu_hva, host_ctxt, 3); 373 374 host_vcpu = kern_hyp_va(host_vcpu); 375 cpu_reg(host_ctxt, 1) = __pkvm_init_vcpu(handle, host_vcpu, vcpu_hva); 376 } 377 378 static void handle___pkvm_teardown_vm(struct kvm_cpu_context *host_ctxt) 379 { 380 DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1); 381 382 cpu_reg(host_ctxt, 1) = __pkvm_teardown_vm(handle); 383 } 384 385 typedef void (*hcall_t)(struct kvm_cpu_context *); 386 387 #define HANDLE_FUNC(x) [__KVM_HOST_SMCCC_FUNC_##x] = (hcall_t)handle_##x 388 389 static const hcall_t host_hcall[] = { 390 /* ___kvm_hyp_init */ 391 HANDLE_FUNC(__kvm_get_mdcr_el2), 392 HANDLE_FUNC(__pkvm_init), 393 HANDLE_FUNC(__pkvm_create_private_mapping), 394 HANDLE_FUNC(__pkvm_cpu_set_vector), 395 HANDLE_FUNC(__kvm_enable_ssbs), 396 HANDLE_FUNC(__vgic_v3_init_lrs), 397 HANDLE_FUNC(__vgic_v3_get_gic_config), 398 HANDLE_FUNC(__pkvm_prot_finalize), 399 400 HANDLE_FUNC(__pkvm_host_share_hyp), 401 HANDLE_FUNC(__pkvm_host_unshare_hyp), 402 HANDLE_FUNC(__kvm_adjust_pc), 403 HANDLE_FUNC(__kvm_vcpu_run), 404 HANDLE_FUNC(__kvm_flush_vm_context), 405 HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa), 406 HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa_nsh), 407 HANDLE_FUNC(__kvm_tlb_flush_vmid), 408 HANDLE_FUNC(__kvm_tlb_flush_vmid_range), 409 HANDLE_FUNC(__kvm_flush_cpu_context), 410 HANDLE_FUNC(__kvm_timer_set_cntvoff), 411 HANDLE_FUNC(__vgic_v3_save_vmcr_aprs), 412 HANDLE_FUNC(__vgic_v3_restore_vmcr_aprs), 413 HANDLE_FUNC(__pkvm_vcpu_init_traps), 414 HANDLE_FUNC(__pkvm_init_vm), 415 HANDLE_FUNC(__pkvm_init_vcpu), 416 HANDLE_FUNC(__pkvm_teardown_vm), 417 }; 418 419 static void handle_host_hcall(struct kvm_cpu_context *host_ctxt) 420 { 421 DECLARE_REG(unsigned long, id, host_ctxt, 0); 422 unsigned long hcall_min = 0; 423 hcall_t hfn; 424 425 /* 426 * If pKVM has been initialised then reject any calls to the 427 * early "privileged" hypercalls. Note that we cannot reject 428 * calls to __pkvm_prot_finalize for two reasons: (1) The static 429 * key used to determine initialisation must be toggled prior to 430 * finalisation and (2) finalisation is performed on a per-CPU 431 * basis. This is all fine, however, since __pkvm_prot_finalize 432 * returns -EPERM after the first call for a given CPU. 433 */ 434 if (static_branch_unlikely(&kvm_protected_mode_initialized)) 435 hcall_min = __KVM_HOST_SMCCC_FUNC___pkvm_prot_finalize; 436 437 id &= ~ARM_SMCCC_CALL_HINTS; 438 id -= KVM_HOST_SMCCC_ID(0); 439 440 if (unlikely(id < hcall_min || id >= ARRAY_SIZE(host_hcall))) 441 goto inval; 442 443 hfn = host_hcall[id]; 444 if (unlikely(!hfn)) 445 goto inval; 446 447 cpu_reg(host_ctxt, 0) = SMCCC_RET_SUCCESS; 448 hfn(host_ctxt); 449 450 return; 451 inval: 452 cpu_reg(host_ctxt, 0) = SMCCC_RET_NOT_SUPPORTED; 453 } 454 455 static void default_host_smc_handler(struct kvm_cpu_context *host_ctxt) 456 { 457 __kvm_hyp_host_forward_smc(host_ctxt); 458 } 459 460 static void handle_host_smc(struct kvm_cpu_context *host_ctxt) 461 { 462 DECLARE_REG(u64, func_id, host_ctxt, 0); 463 bool handled; 464 465 func_id &= ~ARM_SMCCC_CALL_HINTS; 466 467 handled = kvm_host_psci_handler(host_ctxt, func_id); 468 if (!handled) 469 handled = kvm_host_ffa_handler(host_ctxt, func_id); 470 if (!handled) 471 default_host_smc_handler(host_ctxt); 472 473 /* SMC was trapped, move ELR past the current PC. */ 474 kvm_skip_host_instr(); 475 } 476 477 void handle_trap(struct kvm_cpu_context *host_ctxt) 478 { 479 u64 esr = read_sysreg_el2(SYS_ESR); 480 481 switch (ESR_ELx_EC(esr)) { 482 case ESR_ELx_EC_HVC64: 483 handle_host_hcall(host_ctxt); 484 break; 485 case ESR_ELx_EC_SMC64: 486 handle_host_smc(host_ctxt); 487 break; 488 case ESR_ELx_EC_SVE: 489 cpacr_clear_set(0, CPACR_ELx_ZEN); 490 isb(); 491 sve_cond_update_zcr_vq(ZCR_ELx_LEN_MASK, SYS_ZCR_EL2); 492 break; 493 case ESR_ELx_EC_IABT_LOW: 494 case ESR_ELx_EC_DABT_LOW: 495 handle_host_mem_abort(host_ctxt); 496 break; 497 default: 498 BUG(); 499 } 500 } 501